Ransomware Insurance

Reuters reports that insurers have halved the amount of cyber cover they provide to customers following an increase in ransomware attacks that resulted in large payouts. 

Major EU and US insurers  have been able to charge higher premiums to cover 'ransoms, the repair of hacked networks, business interruption losses and even PR fees to mend reputational damage'. However growth in ransomware attacks and claims that the criminals are increasingly sophisticated result in insurers 'changing their appetites, limits, coverage and pricing', with one Reuters source commenting

Limits have halved – where people were offering 10 million pounds ($13.50 million), nearly everyone has reduced to five.

 Lloyd's of London (reported as having around 20% of the global market for cyber insurance) has reportedly discouraged its syndicate members from taking on cyber insurance next year. Reuters comments 

Combined ratio - a measure of profitability in which a level of more than 100% indicates a loss - climbed by more than 20 percentage points from 2019 to 95.4%. While insurers struggle to cope, companies are under-insured. "It's very unlikely people are getting the same limits - if they are, they are paying an extraordinary amount," ... 

[O]ne technology client had previously bought 130 million pounds of professional indemnity and cyber cover for 250,000 pounds. Now the client could only get 55 million pounds of cover and the price was 500,000 pounds. Insurers who issued $5 million cyber liability policies last year have scaled back to limits of between $1 million and $3 million in 2021... 

Where hackers previously took a scattergun approach with methods such as sending out thousands of phishing emails, they have become more targeted, reading balance sheets and focusing on specific sectors. ... [A]ttacks were moving away from healthcare facilities and municipalities - which have weak IT controls but also little money - to manufacturing or logistics companies. Such firms have deep pockets and cannot afford extended outages to fix their systems, so would rather pay ransoms, especially if they have insurance to cover them. ... 

Premium rates have almost doubled in the United States and jumped by 73% in Britain as a result of the frequency and severity of ransomware attacks, insurance broker Marsh said. RPS said rates for some policies had risen by as much as 300%. Where ransom payments were typically $600 a few years ago, they now are as high as $50 million, said Michael Shen, head of cyber and technology at insurer Canopius, and insurers are sometimes asking policyholders to pay half of the ransom. 

Crypto and Ransomware

'Keys Under Doormats: Mandating insecurity by requiring government access to all data and communications' by Harold Abelson, Ross Anderson, Steven M. Bellovin, Josh Benaloh, Matt Blaze, Whitfield Diffie, John Gilmore, Matthew Green, Susan Landau, Peter G. Neumann, Ronald L. Rivest, Jeffrey I. Schiller, Bruce Schneier, Michael Specter and Daniel J. Weitzner in 2015 commented 

Twenty years ago, law enforcement organizations lobbied to require data and communication services to engineer their products to guarantee law enforcement access to all data. After lengthy debate and vigorous predictions of enforcement channels “going dark,” these attempts to regulate the emerging Internet were abandoned. In the intervening years, innovation on the Internet flourished, and law enforcement agencies found new and more effective means of accessing vastly larger quantities of data. Today we are again hearing calls for regulation to mandate the provision of exceptional access mechanisms. In this report, a group of computer scientists and security experts, many of whom participated in a 1997 study of these same topics, has convened to explore the likely effects of imposing extraordinary access mandates. 

We have found that the damage that could be caused by law enforcement exceptional access requirements would be even greater today than it would have been 20 years ago. In the wake of the growing economic and social cost of the fundamental insecurity of today’s Internet environment, any proposals that alter the security dynamics online should be approached with caution. Exceptional access would force Internet system developers to reverse “forward secrecy” design practices that seek to minimize the impact on user privacy when systems are breached. The complexity of today’s Internet environment, with millions of apps and globally connected services, means that new law enforcement requirements are likely to introduce unanticipated, hard to detect security flaws. Beyond these and other technical vulnerabilities, the prospect of globally deployed exceptional access systems raises difficult problems about how such an environment would be governed and how to ensure that such systems would respect human rights and the rule of law.

Their Executive Summary is - 

 Political and law enforcement leaders in the United States and the United Kingdom have called for Internet systems to be redesigned to ensure government access to information — even encrypted information. They argue that the growing use of encryption will neutralize their investigative capabilities. They propose that data storage and communications systems must be designed for exceptional access by law enforcement agencies. These proposals are unworkable in practice, raise enormous legal and ethical questions, and would undo progress on security at a time when Internet vulnerabilities are causing extreme economic harm. 

As computer scientists with extensive security and systems experience, we believe that law enforcement has failed to account for the risks inherent in exceptional access systems. Based on our considerable expertise in real-world applications, we know that such risks lurk in the technical details. In this report we examine whether it is technically and operationally feasible to meet law enforcement’s call for exceptional access without causing large-scale security vulnerabilities. We take no issue here with law enforcement’s desire to execute lawful surveillance orders when they meet the requirements of human rights and the rule of law. Our strong recommendation is that anyone proposing regulations should first present concrete technical requirements, which industry, academics, and the public can analyze for technical weaknesses and for hidden costs. 

Many of us worked together in 1997 in response to a similar but narrower and better- defined proposal called the Clipper Chip. The Clipper proposal sought to have all strong encryption systems retain a copy of keys necessary to decrypt information with a trusted third party who would turn over keys to law enforcement upon proper legal authorization. We found at that time that it was beyond the technical state of the art to build key escrow systems at scale. Governments kept pressing for key escrow, but Internet firms successfully resisted on the grounds of the enormous expense, the governance issues, and the risk. The Clipper Chip was eventually abandoned. A much more narrow set of law enforcement access requirements have been imposed, but only on regulated telecommunications systems. Still, in a small but troubling number of cases, weakness related to these requirements have emerged and been exploited by state actors and others. Those problems would have been worse had key escrow been widely deployed. And if all information applications had had to be designed and certified for exceptional access, it is doubtful that companies like Facebook and Twitter would even exist. Another important lesson from the 1990’s is that the decline in surveillance capacity predicted by law enforcement 20 years ago did not happen. Indeed, in 1992, the FBI’s Advanced Telephony Unit warned that within three years Title III wiretaps would be useless: no more than 40% would be intelligible and that in the worst case all might be rendered useless. The world did not “go dark.” On the contrary, law enforcement has much better and more effective surveillance capabilities now than it did then. 

The goal of this report is to similarly analyze the newly proposed requirement of exceptional access to communications in today’s more complex, global information infrastructure. We find that it would pose far more grave security risks, imperil innovation, and raise thorny issues for human rights and international relations. 

There are three general problems. First, providing exceptional access to communications would force a U-turn from the best practices now being deployed to make the Internet more secure. These practices include forward secrecy — where decryption keys are deleted immediately after use, so that stealing the encryption key used by a communications server would not compromise earlier or later communications. A related technique, authenticated encryption, uses the same temporary key to guarantee confidentiality and to verify that the message has not been forged or tampered with. 

Second, building in exceptional access would substantially increase system complexity. Security researchers inside and outside government agree that complexity is the enemy of security — every new feature can interact with others to create vulnerabilities. To achieve widespread exceptional access, new technology features would have to be deployed and tested with literally hundreds of thousands of developers all around the world. This is a far more complex environment than the electronic surveillance now deployed in telecommunications and Internet access services, which tend to use similar technologies and are more likely to have the resources to manage vulnerabilities that may arise from new features. Features to permit law enforcement exceptional access across a wide range of Internet and mobile computing applications could be particularly problematic because their typical use would be surreptitious — making security testing difficult and less effective. 

Third, exceptional access would create concentrated targets that could attract bad actors. Security credentials that unlock the data would have to be retained by the platform provider, law enforcement agencies, or some other trusted third party. If law enforcement’s keys guaranteed access to everything, an attacker who gained access to these keys would enjoy the same privilege. Moreover, law enforcement’s stated need for rapid access to data would make it impractical to store keys offline or split keys among multiple keyholders, as security engineers would normally do with extremely high-value credentials. Recent attacks on the United States Government Office of Personnel Management (OPM) show how much harm can arise when many organizations rely on a single institution that itself has security vulnerabilities. In the case of OPM, numerous federal agencies lost sensitive data because OPM had insecure infrastructure. If service providers implement exceptional access requirements incorrectly, the security of all of their users will be at risk. 

Our analysis applies not just to systems providing access to encrypted data but also to systems providing access directly to plaintext. For example, law enforcement has called for social networks to allow automated, rapid access to their data. A law enforcement backdoor into a social network is also a vulnerability open to attack and abuse. Indeed, Google’s database of surveillance targets was surveilled by Chinese agents who hacked into its systems, presumably for counterintelligence purposes. 

The greatest impediment to exceptional access may be jurisdiction. Building in exceptional access would be risky enough even if only one law enforcement agency in the world had it. But this is not only a US issue. The UK government promises legislation this fall to compel communications service providers, including US-based corporations, to grant access to UK law enforcement agencies, and other countries would certainly follow suit. China has already intimated that it may require exceptional access. If a British-based developer deploys a messaging application used by citizens of China, must it provide exceptional access to Chinese law enforcement? Which countries have sufficient respect for the rule of law to participate in an international exceptional access framework? How would such determinations be made? How would timely approvals be given for the millions of new products with communications capabilities? And how would this new surveillance ecosystem be funded and supervised? The US and UK governments have fought long and hard to keep the governance of the Internet open, in the face of demands from authoritarian countries that it be brought under state control. Does not the push for exceptional access represent a breathtaking policy reversal? 

The need to grapple with these legal and policy concerns could move the Internet overnight from its current open and entrepreneurial model to becoming a highly regulated industry. Tackling these questions requires more than our technical expertise as computer scientists, but they must be answered before anyone can embark on the technical design of an exceptional access system. 

In the body of this report, we seek to set the basis for the needed debate by presenting the historical background to exceptional access, summarizing law enforcement demands as we understand them, and then discussing them in the context of the two most popular and rapidly growing types of platform: a messaging service and a personal electronic device such as a smartphone or tablet. Finally, we set out in detail the questions for which policymakers should require answers if the demand for exceptional access is to be taken seriously. Absent a concrete technical proposal, and without adequate answers to the questions raised in this report, legislators should reject out of hand any proposal to return to the failed cryptography control policy of the 1990s.

The US Treasury Financial Crimes Enforcement Network (FINCEN) Financial Trend Analysis 'Ransomware Trends in Bank Secrecy Act Data Between January 2021 and June 2021' report comments

This Financial Trend Analysis focuses on ransomware pattern and trend information identified in Bank Secrecy Act (BSA) data. This report is issued pursuant to Section 6206 of the Anti-Money Laundering Act of 2020 (AMLA) which requires the Financial Crimes Enforcement Network (FinCEN) to periodically publish threat pattern and trend information derived from financial institutions’ Suspicious Activity Reports (SARs). FinCEN issued government-wide priorities for anti-money laundering and countering the financing of terrorism (AML/CFT) policy on 30 June 2021, which included cybercrime as a government-wide priority. FinCEN highlighted ransomware as a particularly acute cybercrime concern. The information contained in this report is relevant to the public, including a wide range of businesses, industries, and critical infrastructure sectors. The report also highlights the value of BSA information filed by regulated financial institutions. 

This Financial Trend Analysis is in response to the increase in number and severity of ransomware attacks against U.S. critical infrastructure since late 2020. For example, in May 2021, hackers used a ransomware attack to extort a multi-million dollar ransom, which also disrupted the Colonial Pipeline and caused gasoline shortages. Other recent attacks have targeted various sectors, including manufacturing, legal, insurance, health care, energy, education, and the food supply chain in the United States and across the globe. As Treasury Secretary Janet L. Yellen recently noted, “Ransomware and cyber-attacks are victimizing businesses large and small across America and are a direct threat to our economy.” 

FinCEN analysis of ransomware-related SARs filed during the first half of 2021 indicates that ransomware is an increasing threat to the U.S. financial sector, businesses, and the public. The number of ransomware-related SARs filed monthly has grown rapidly, with 635 SARs filed and 458 transactions reported between 1 January 2021 and 30 June 2021 (“the review period”), up 30 percent from the total of 487 SARs filed for the entire 2020 calendar year. The total value of suspicious activity reported in ransomware-related SARs during the first six months of 2021 was $590 million, which exceeds the value reported for the entirety of 2020 ($416 million). 

Trends represented in this report illustrate financial institutions’ identification and reporting of ransomware events and may not reflect the actual dates associated with ransomware incidents. 

FinCEN’s analysis of ransomware-related SARs highlights average ransomware payment amounts, top ransomware variants, and insights from FinCEN’s blockchain analysis: 

The 635 SARs filed during the review period include 458 SARs reporting transactions that occurred in the same timeframe. The remaining 177 SARs report transactions that occurred prior to 2021. 

Average Monthly Suspicious Amount of Ransomware Transactions: 

According to data generated from ransomware-related SARs, the mean average total monthly suspicious amount of ransomware transactions was $66.4 million and the median average was $45 million. FinCEN identified bitcoin (BTC) as the most common ransomware-related payment method in reported transactions. 

Top Ransomware Variants: 

Ransomware actors develop their own versions of ransomware, known as “variants,” and these versions are given new names based on a change to software or to denote a particular threat actor behind the malware. FinCEN identified 68 ransomware variants reported in SAR data for transactions during the review period. The most commonly reported variants were REvil/Sodinokibi, Conti, DarkSide, Avaddon, and Phobos. 

Insights from Blockchain Analysis: 

FinCEN identified and analyzed 177 unique convertible virtual currency (CVC) wallet addresses used for ransomware-related payments associated with the 10 most commonly reported ransomware variants in SARs during the review period. Based on blockchain analysis of identifiable transactions with the 177 CVC wallet addresses, FinCEN identified approximately $5.2 billion in outgoing BTC transactions potentially tied to ransomware payments. 

FinCEN Identified Ransomware Money Laundering Typologies: 

FinCEN identified several money laundering typologies common among ransomware variants in 2021 including threat actors increasingly requesting payments in Anonymity-enhanced Cryptocurrencies (AECs) and avoiding reusing wallet addresses, “chain hopping” and cashing out at centralized exchanges, and using mixing services and decentralized exchanges to convert proceeds. 

Scope and Methodology: 

FinCEN examined ransomware-related SARs filed between 1 January 2021 and 30 June 2021 to determine trends. The full data set consisted of 635 SARs reporting $590 million in suspicious activity. Of the 635 SARs filed during the review period, 458 report actual transactions that occurred during the review period worth $398 million. The remaining 177 SARs report transactions that occurred before 1 January 2021. FinCEN reviewed and verified each SAR to remove any suspicious activity amount unrelated to ransomware and to extract relevant indicators of compromise (IOCs). From this data, FinCEN identified the top 10 most common ransomware variants and analyzed their IOCs through commercially available analytics tools. This analysis allowed FinCEN to chart the flow of ransomware payments in BTC to identify which CVC exchanges and services ransomware actors used to launder their proceeds. USD figures cited in this analysis are based on the value of BTC when the transactions occurred. FinCEN also compared data gathered for 2021 to SAR data gathered in previous years in order to track ransomware trends. This data set consisted of 2,184 SARs reflecting $1.56 billion in suspicious activity filed between 1 January 2011 and 30 June 2021. 

Ransomware Filings in First Six Months of 2021 Exceed 2020 Total 

The total U.S. dollar value for ransomware-related transactions reported in SARs filed during the review period exceeds that of any previous year since 2011. In the first six months of 2021, FinCEN identified $590 million in ransomware-related SARs, a 42 percent increase compared to a total of $416 million for all of 2020 (see Figures 1 and 2). If current trends continue, SARs filed in 2021 are projected to have a higher ransomware-related transaction value than SARs filed in the previous 10 years combined, which would represent a continuing trend of substantial increases in reported year-over-year ransomware activity. This trend potentially reflects the increasing overall prevalence of ransomware-related incidents as well as improved detection and reporting of incidents by covered financial institutions, which may also be related to increased awareness of reporting obligations pertaining to ransomware and willingness to report. 

As noted in FinCEN’s 2020 Advisory on Ransomware, AECs reduce the transparency of CVC financial flows, including ransomware payments, through anonymizing features, such as mixing and cryptographic enhancements.

Ransomware

The New York Times reports that ResearchTechnology (ERT), a US provider of software used in clinical trialss, was hit by a ransomware attack that has slowed some of those trials over the past two weeks. ERT is reported as stating that clinical trial patients were never at risk, with the Times commenting that customers said the attack forced trial researchers to track their patients with pen and paper. 

 Among those hit were IQVIA, the contract research organization helping manage AstraZeneca’s Covid vaccine trial, and Bristol Myers Squibb, the drugmaker leading a consortium of companies to develop a quick test for the virus. 

ERT has not said how many clinical trials were affected, but its software is used in drug trials across Europe, Asia and North America. It was used in three-quarters of trials that led to drug approvals by the Food and Drug Administration last year, according to its website. 

On Friday, Drew Bustos, ERT’s vice president of marketing, confirmed that ransomware had seized its systems on Sept. 20. As a precaution, Mr. Bustos said, the company took its systems offline that day, called in outside cybersecurity experts and notified the Federal Bureau of Investigation. 

“Nobody feels great about these experiences, but this has been contained,” Mr. Bustos said. He added that ERT was starting to bring its systems back online on Friday and planned to bring remaining systems online over the coming days.

Bustos is reported as saying it is still too early to say who was behind the attack and declined to say whether ERT paid its extortionists, "as so many companies hit by ransomware now do". 

 The Times notes that another major ransomware attack last weekend, on major hospital chain Universal Health Services (2019 revenue US$11.4bn) which operates at 400 locations. The UHS media release states

an information technology security incident in the early morning hours of September 27, 2020. As a result, the Company suspended user access to its information technology applications related to operations located in the United States. 

The Company has implemented extensive information technology security protocols and is working diligently with its security partners to restore its information technology operations as quickly as possible. xxx In the meantime, while this matter may result in temporary disruptions to certain aspects of our clinical and financial operations, our acute care and behavioral health facilities are utilizing their established back-up processes including offline documentation methods. Patient care continues to be delivered safely and effectively. 

At this time, we have no evidence that patient or employee data was accessed, copied or misused.

Australian Cyber Security Strategy

The Industry Advisory Panel on the  Australia’s 2020 Cyber Security Strategy appears to be underwhelmed by the Commonwealth government's approach. It its report this week it comments

 Technology now sits at the very heart of the lives of most Australians and increasingly shapes our economy, our society and our future. It is fast changing how we live, learn and work as well as creating incredible new opportunities, efficiencies and benefits - from remote working to digitised global supply chains, from tele-health to e-commerce. The Federal Government is clear-eyed about the opportunities:

“Our Government’s goal is for Australia to be a leading digital economy by 2030. Our degree of success will be critical to income growth and job creation over the next decade and beyond. Our extensive policy agenda encompasses digital access, connectivity, consumer data and competition policy, government service delivery and skills development, trade and global e-commerce governance, as well as the necessary focus on security and privacy concerns.” Prime Minister Scott Morrison BCA annual dinner keynote 21 November 2019

The scope and timing of that ambition is well placed. As we enter the 2020s the world is on the exciting cusp of a fourth industrial revolution driven by connectivity and digital technologies. Artificial intelligence, sensors, autonomous machines and systems, edge compute, augmented reality and 5G will combine to create incredible new products and services, infuse the physical world with digital, revolutionise business operations, elevate human work, and serve customers and citizens in many new ways. 

All of this was true before the emergence of the COVID pandemic which has only further underlined the importance of the digital economy in Australia. In responding to COVID, mandatory social distancing and self-isolation means healthcare, education, work and commerce and even staying in touch with friends and family are largely being done online. Looking beyond this crisis, technology and our ability and willingness to embrace the digital world has now emerged as central to a rapid economic recovery. 

With so much at stake, robust and effective cyber security has never been more important and the 2020 Cyber Security Strategy Industry Advisory Panel welcomed the opportunity to contribute to that outcome. 

Australia’s 2020 Cyber Security Strategy 

The Panel were engaged in late 2019 at a time when the Federal Government were reviewing the progress of the landmark 2016 Cyber Security Strategy. This work led to the establishment of the Joint Cyber Security Centres, creation of cyber.gov.au as a one-stop-shop for cyber security advice and the establishment of key leadership positions including the Ambassador for Cyber Affairs. 

Despite these achievements the Government acknowledged that significant and ongoing changes in the scope, scale and sophistication of cyber threats required an evolution in our approach to cyber security as a nation. Minister for Home Affairs, Peter Dutton, has described how meeting the evolving cyber challenge is key to Australia’s economic prosperity and national security. In September 2019 he said:

“Cyber security has never been more important to Australia’s economic prosperity and national security. In 2016, the Australian Government delivered its landmark Cyber Security Strategy, which invested $230 million to foster a safer internet for all Australians. Despite making strong progress against the goals set in 2016, the threat environment has changed significantly and we need to adapt our approach to improve the security of business and the community.” “Cyber criminals are more abundant and better resourced, state actors have become more sophisticated and emboldened, and more of our economy is connecting online. Cyber security incidents have been estimated to cost Australian businesses up to $29 billion per year and cybercrime affected almost one in three Australian adults in 2018.” 

This escalation in malicious cyber activity has only increased during COVID as we have been forced to work, learn and connect from home, outside of some of our usual security frameworks. We are seeing malicious actors including criminals and state based actors exploiting this opportunity to their own advantage, to the significant risk and detriment of Australian citizens. 

On 30 June 2020, Prime Minister Scott Morrison pointed to the urgency of the issue: “The Federal Government’s top priority is protecting our nation’s economy, national security and sovereignty. Malicious cyber activity undermines that.” Australia’s ability to prosper as a digital economy can be enhanced if we increase our investment in our cyber defences. We must move to comprehensively protect ourselves and our businesses from cybercrime, protect our national infrastructure and improve the security of our institutions – including our democratic electoral processes, which have been the subject of malicious cyber-attack in other parts of the world. It is crucial we act quickly and decisively. 

The 2020 Cyber Security Strategy Industry Advisory Panel was formed in November 2019 and asked to provide advice from an industry perspective on best practices in cyber security and related fields; emerging cyber security trends and threats; key strategic priorities for the 2020 Cyber Security Strategy; significant obstacles and barriers for the delivery of the 2020 Cyber Security Strategy; and the effect of proposed initiatives on different elements of the economy, both domestic and international. 

The Panel met 13 times between November 2019 and July 2020, including two meetings with Minister Dutton and formal briefings, including some classified, from the Department of Home Affairs, the Australian Signals Directorate, the Attorney-General’s Department, the Department of the Treasury, the Australian Competition and Consumer Commission, the then Department of Communications and the Arts, the eSafety Commissioner, the Australian Federal Police, the Australian Security Intelligence Organisation, the Cyber Security Cooperative Research Centre and AustCyber. 

After broad consultation and careful deliberation, the 2020 Cyber Security Strategy Industry Advisory Panel has developed a series of recommendations that we believe strike the right balance between increasing our cyber defences, promoting the development of a digital economy and countering threats to our economy, safety, sovereignty and national security. 

The Panel’s recommendations are structured around a framework with five key pillars:

• Deterrence: deterring malicious actors from targeting Australia. 

• Prevention: preventing people and sectors in Australia from being compromised online. 

• Detection: identifying and responding quickly to cyber security threats. 

• Resilience: minimising the impact of cyber security incidents. 

• Investment: investing in essential cyber security enablers.

On deterrence, we recommend that the Government establish clear consequences for those targeting Australia and people living in Australia. A key priority is increasing transparency on Government investigative activity with more frequent attribution and consequences applied where appropriate. Strengthening the Australian Cyber Security Centre’s ability to disrupt cyber criminals by targeting the proceeds of cybercrime derived both domestically and internationally is a priority. 

On prevention, the recommendations include the pursuit of initiatives that make businesses and citizens in Australia harder to compromise online. This includes a clear definition for critical infrastructure and systems of national significance with a view to capturing all essential services and functions in the public and private sectors; consistent, principles-based regulatory requirements to implement reasonable protection against cyber threats for owners and operators of critical infrastructure and systems of national significance; measures to build trust in technology markets through transparency such as product labelling; and the extension of existing legislative and regulatory frameworks relevant in the physical world to the online world. Ultimately cybercrime is just crime, cyber espionage is just espionage and hacktivism is just activism online. 

All levels of Government should take steps to better protect public sector networks from cyber security threats. Government agencies should be required to achieve the same or higher levels of protection as privately-owned critical infrastructure operators. Different levels of government should collaborate to share best practices and lessons learned. Ultimately Governments should be exemplars of cyber security best practice and Australian governments have some way to go in achieving this aspiration. 

On detection, recommendations include that Government establish automated, real-time and bi-directional threat sharing mechanisms between industry and Government, beginning with critical infrastructure sectors. Government should also empower industry to automatically block a greater proportion of known cyber security threats in real-time including initiatives such as ‘cleaner pipes’. 

On resilience, recommendations include the development of proactive mitigation strategies and strengthening of systems essential for end-to-end resilience. Government should strengthen the incident response and victim support options already in place. Speed is key when it comes to recovering from cyber incidents and Government should hold regular large scale and cross-sectoral cyber security incident response exercises to improve the readiness of interdependent critical infrastructure providers and government agencies. 

Resilience includes both the ability to recover from a cyber-attack as well as the redundancy designed-in to systems and processes. In other words, a key factor influencing the ability to recover is the level of redundancy present in systems in the first place. It is important to also call out that a number of recommendations to build resilience relate to the role of the individual, in particular around building cyber awareness. In this regard there is an important distinction between cyber security (which means protecting data and information networks and critical infrastructure functions) and cyber safety (which means protecting users from harmful online content). The fundamental ability to participate safely online is the difference between enjoying the internet’s abundant information resources and opportunities, and being a potential victim of a cybercrime. 

On investment, recommendations support the ongoing development of highly specialised and effective capabilities exemplified by the Australian Cyber Security Centre and the state-based Joint Cyber Security Centres. This existing capability should be substantially increased and enhanced through significant investment and a more integrated governance structure that maintains an industry leadership role. It is going to be a critical enabler to the success of the 2020 Cyber Security Strategy. 

The Panel is also of the view that it is important for Government and industry to continue to invest in cyber skills development and security risk management in Australia. Good enterprise security management includes all aspects of securing people, property and technology. This skills investment is recommended at both a professional and specialist skills level and also more broadly, and should include primary, secondary and tertiary courses (including programs that focus on all aspects of enterprise security risk management, particularly cyber skills uplift). Importantly many of these skills should be built as foundational requirements in science, maths, engineering and technology. Although the cyber skills and awareness of directors on the boards of Australia’s listed companies has been developed in recent years, there is opportunity for further development and support. 

Within this framework of 60 recommendations sit 25 high priority and 35 other recommendations that address the full spectrum of cyber security threats – from the ‘routine’ threats that target vulnerable people in Australia every day to sophisticated ‘state actor’ cyber-attacks that threaten our economy, safety, sovereignty and national security. The Panel recommends that threats to critical infrastructure, digital supply chains and systems of national significance should be addressed first. 

State, territory and local governments should also be considered key implementation partners for all elements of the Strategy. We encourage the Australian Government to establish formal mechanisms to ensure ongoing engagement with all levels of government. 

Clear roles and responsibilities 

Cyber threats continue to shift and evolve and, as the threats evolve, so must our response. The recommendations we propose are built around creating robust and adaptable defences as threats emerge and technologies and opportunities change. 

It is important to recognise that effective cyber defences involve more than just investment dollars. Our report highlights that an effective response includes fundamentally organising and governing differently to ensure more efficient and effective use of resources and aligning cyber security imperatives across Australia. This requires clearly defined roles, responsibilities and authorities to be established and the Federal Government’s role in leading and coordinating the national effort is therefore critical. Ultimately the Government is in a unique position with access to information and tools which mean that in particular circumstances it is the appropriate party to lead our cyber defence. This is not only about the Federal Government but effective coordination with other tiers of Government. Government also plays an important role partnering with industry, as well as broadening community awareness and skills in adequately addressing cyber issues. 

If Australia’s cyber security is well organised and well governed then the application of all resources - public, private, people, infrastructure and capital investment – will achieve far more efficient and effective results. This was an important learning from the 2016 Cyber Strategy. 

The only way to look at cyber security is as a team. Large enterprises, small and medium businesses and Government all have shared platforms, common customers, and all are the target of attacks. We all therefore play a role, and share an accountability, in keeping Australians safe. 

Implementation 

The 2020 Strategy will be largely measured based on how well it is implemented and whether it meets or exceeds objective and bold metrics. During consultation, some stakeholders viewed implementation of the 2016 Cyber Security Strategy as being limited by regular changes in governance arrangements, lack of clarity about the roles of different government departments and inconsistent public communication. We encourage the Government to create strong governance and evaluation mechanisms around the 2020 Strategy. Data collection and evaluation, based on a maturity framework, should be afforded a high priority. A standing industry advisory panel could be established to advise the Minister for Home Affairs on cyber security matters and implementation of the 2020 Strategy on an ongoing basis strengthening the important link between Government and industry. Such a panel should have appropriate representation from across business, academia and the community. State and territory governments should be closely involved in implementation of the Strategy. It would be appropriate for state and territories to be represented on the public service committee responsible for implementing the Strategy. 

Never a more important time 

The Australian Government deserves real credit for the leadership it has shown on cyber security, including through the development of Australia’s 2020 Cyber Security Strategy and the announcement of a $1.35 billion investment (Cyber Enhanced Situational Awareness and Response package) over the next 10 years which will support a number of the key recommendations set out in this report. With robust cyber security critical for our economic prosperity, international competitiveness and national security, this work will only become more important as Australia continues to digitise in the future. The Chair of the Panel, Andy Penn, describes the opportunity and the challenge ahead:

“The beginning of the 2020s has been marked by a period of profound disruption for Australia with the devastating bushfires and the COVID virus. At the same time and as we progress further into the decade we will also experience an extraordinary new era of technology innovation. As an optimist I am convinced we will adapt and technology will help to solve some of society’s biggest challenges and realise some of its biggest opportunities. But at the same time, this period of working and studying from home and the accelerated trend to a digital economy are exposing us to a more vulnerable environment of cyber threats. We are seeing increased levels of malicious cyber activity both state based and criminal. Successfully meeting this challenge requires upgrading Australia’s cyber defences to be strong, adaptive and built around a strategic framework that is coordinated, integrated and capable. The 2020 Cyber Security Strategy has an opportunity to be all of those things and provide an enormous – and never more important - contribution to a safer, more prosperous Australia.”

The Panel appreciate the opportunity to have worked with the Australian Government to build Australia’s cyber defences through the 2020 Cyber Security Strategy and look forward to the key initiatives emanating from this work - they could not arrive at a more important time. 

List of Recommendations 

Objective 1: There are clear consequences for targeting Australians 

In considering how Australia can increase the consequences of malicious cyber activity for nation states and cyber criminals, the 2020 Cyber Security Strategy should as an immediate priority:

1 Target the growing volume of cybercrime by increasing operational-level cooperation with states, territories, and international partners leveraging the Australian Cyber Security Centre and Joint Cyber Security Centres. 

2 Increase the Australian Cyber Security Centre’s ability to disrupt cyber criminals on the Dark Web and to target the proceeds of cybercrime. 

3 Leverage existing cybercrime awareness raising campaigns to better inform businesses and individuals about new and emerging cybercrime threats to them. 

4 Hold malicious actors accountable via enhanced law enforcement, diplomatic means, and economic sanctions or otherwise as appropriate. 

5 Work with industry to better inform threat visibility and Government attribution activities where appropriate. 

6 The Australian Government should openly describe and advocate the actions it may take in response to a serious cyber security incident to deter malicious cyber actors from targeting Australia. 

7 Promote international law and continue to embed norms of responsible state behaviour online, in particular those that relate to the protection of critical infrastructure serving the public and deterring malicious cyber activity including intellectual property theft and ransomware attacks.

Objective 2: Cyber risks are owned by those best placed to manage them 

In considering how Australia can improve cyber security risk management across the economy and for critical infrastructure, the 2020 Cyber Security Strategy should as an immediate priority:

8 Review the Australian Government’s definition for critical infrastructure with a view to capturing all essential systems and functions in the public and private sectors and supply chains, including digital infrastructure such as data centres, that address all systems of national significance. 

9 Introduce consistent, principles-based requirements to implement reasonable protection against cyber threats (where needed) for owners and operators of critical infrastructure (regardless of whether owned or operated by Government or private), with measurement based on a fit-for-purpose cyber maturity-based framework. In alignment with international best practice, this should leverage rather than duplicate existing sectoral regulations and minimise regulatory burden. We further recommend that the 2020 Cyber Security Strategy should:

 We further recommend that the 2020 Cyber Security Strategy should:

10 Review Australia’s legislative environment for cyber security to ensure that suppliers of digital products and services have appropriate obligations to protect their customers.  

11 Strongly encourage major vendors to sign-up to a voluntary ‘secure by design’ charter to leverage international best practice. 

Objective 3: Australians practise safe behaviours at home and at work 

In considering how Australia can reduce human risk factors in cyber security, the 2020 Cyber Security Strategy should as an immediate priority:

12 Unify all Government messaging on online safety and cyber security awareness raising, noting that existing campaigns run by different Government agencies share a common audience who do not distinguish between different online issues. Government should speak with one voice. Campaigns should be age and sector appropriate. 

13 Increase assistance to small and medium businesses and the community through cyber security toolkits, trusted advice and practical assistance.

14 Partner with industry to increase the scale, reach and impact/effectiveness of cyber security awareness raising campaigns, including through co-design and co-funding where appropriate. 

15 Incentivise large businesses to provide cyber security support to small and medium businesses in their supply chain and customer base. 

Objective 4: Government is a cyber security exemplar 

In considering how the Australian Government can improve trust in the cyber security of its own systems and networks, the 2020 Cyber Security Strategy should as an immediate priority:

16 Make Australian governments exemplars of enterprise security risk management, including cyber security, physical security and personnel security. 

17. Require Government agencies providing essential services to meet the same cyber security standards as privately owned critical infrastructure, with increased accountability and oversight. 

18 Prioritise the decommissioning or hardening of vulnerable legacy systems as part of an accelerated shift towards secure cloud based services.

 We further recommend that the 2020 Cyber Security Strategy should:

19 Better coordinate digital procurement decisions across Government, with a view to negotiating best practice outcomes and where appropriate cost savings with common vendors. 

20 Leverage Government procurement processes to improve cyber security through purchasing products and services with higher standards. 

21 Require larger, more capable Government departments to provide cyber security services to smaller agencies on a basis that is uniform, consistent and risk based. 

22 Fund the Australian Cyber Security Centre (ACSC) to continue its rolling program of cyber security improvements (but not audits) for other Australian Government agencies. Given the ACSC essentially provides a second line of defence role in risk management terminology, audit should be undertaken by a separate agency.

Objective 5: Trusted goods, services and supply chains 

In considering how Australia can encourage the development of a digital technology market where security is built-in across the supply chain, the 2020 Cyber Security Strategy should as an immediate priority:

23 Increase investment in cyber security research and development, including basic sciences, and coordinate state and territory-led research and development at the national level. This will enable Government to maximise economic opportunities and drive national security outcomes. 

24 Work with industry to increase Australia’s role in shaping international cyber security standards. 

25 Work with industry and likeminded nations to encourage diversity, transparency and competition in digital supply chains.

We further recommend that the 2020 Cyber Security Strategy should:

26 Develop a program to identify and assess emerging threats and emerging technologies that could introduce new vulnerabilities leveraging Australia’s global leadership in policy development related to cyber risks. The CSIRO and Defence Science and Technology are two existing national agencies that could be leveraged to support the development of this program. 

27 Obtain industry consensus around what cyber security standards should be used in Australia and accelerate the adoption of these standards to ensure digital products and services are ‘secure by design’. 

28 Require increased recognition and adoption of specific cyber security standards in Australia. 

29 Implement a dynamic accreditation or mandatory cyber security labelling scheme so that consumers can make informed choices about their own cyber security (recognising that accreditations and product labelling will need to take account of changes in technology). 

30 Work with the emerging cyber insurance industry to improve access to reliable actuarial data and develop best practice approaches to nudging the cyber security hygiene of policy holders. 

31 Build transparency into critical and emerging technology supply chains to enable consumers to trust the cyber security of their devices. 

32 Consider mandatory requirements or certification of supply chains for software and hardware supporting critical infrastructure.

Objective 6: Comprehensive situational awareness enables action 

In considering how the Government and industry can improve the timeliness and quality of threat information sharing to better anticipate and respond to threats, the 2020 Cyber Security Strategy should as an immediate priority:

33 Establish automated, real-time and bi-directional threat sharing mechanisms between Government and industry, beginning with critical infrastructure sectors.

 We further recommend that the 2020 Cyber Security Strategy should:

35. Consider the development of ‘safe harbour’ legislative provisions that give industry certainty about the information it can voluntarily share with other organisations to prevent or respond to cyber security threats. 

36. Resume the publication of annual reports on the state of cyber security threats to Australia.

Objective 7: Effective incident response options and victim support 

In considering how Government and industry can create and sustain a high level of preparedness for incidents and improve support to victims, the 2020 Cyber Security Strategy should as an immediate priority:

34 Empower industry to automatically block a greater proportion of known cyber security threats in real-time, including by providing legislative certainty. 

37 Map in partnership with industry, the resilience of critical infrastructure networks, with a view to increasing maturity levels over time. 

38 Identify and assess in partnership with industry interdependencies, single points of failure and consolidation risk to enable better understanding of cyber risk. 

39 Work with industry to agree a unique set of circumstances in relation to critical infrastructure and systems of national significance where it would be necessary for Government to provide reasonable assistance to Australian businesses during a cyber security emergency, and define suitable oversight and thresholds for action. 

40 Provide additional funding to not-for-profit organisations that support victims of cybercrime and communicate their role and existence to the community.

 We further recommend that the 2020 Cyber Security Strategy should:

41 Hold a large scale and cross-sectoral cyber security incident response exercise at least every two years to improve national coordination and incident response readiness of interdependent critical infrastructure providers and government agencies. Exercises should include links to international activities where appropriate. 

42. Include industry in Australia’s formal incident response plans by amending the national Cyber Incident Management Arrangements.

Enabler 1: The Australian Signals Directorate’s Joint Cyber Security Centres (JCSCs) 

Recognising the JCSCs are the local offices of the Australian Cyber Security Centre, the 2020 Cyber Security Strategy should as an immediate priority:

43 Establish a national board chaired by ASD (with industry co-chair) and including industry representation to strengthen the strategic leadership of the Joint Cyber Security Centres, underpinned by a charter outlining the JCSCs’ scope and deliverables. 

44 Fund ASD to provide enhanced technical and consulting cyber services to industry through the JCSC Program, including a greater focus on information sharing. 

We further recommend that the 2020 Cyber Security Strategy should:

45 Create a staff exchange program between the ACSC, academia and industry to enable cross-sectoral collaboration and information sharing. The CSIRO and Defence Science and Technology could be leveraged to support the engagement between academia and industry. 

46 Dedicate additional JCSC resources to engage with local governments.

Enabler 2: Cyber security skills 

In considering how Government, industry and academia improve risk postures by strengthening the pipeline of skilled cyber security professionals, the 2020 Cyber Security Strategy should:

47 Position the Australian Government to take a national leadership role in addressing Australia’s cyber security skills shortage. 

48 Work with professional bodies and academia to include cyber security education in adjunct technical fields such as engineering and data science and extend cyber skills training to company directors. 

49 Consider creating an internationally aligned accreditation scheme to recognise the skills, experience and qualifications of cyber security professionals in both technical and management roles. This should including mapping the equivalency of existing qualifications. 

50 Adopt a national framework that defines the roles that make up the cyber security profession. Use this framework to develop a national workforce planning program for the cyber security profession. 

51 Consider additional incentives to attract and retain Government cyber security specialists. 

52 Strengthen voluntary professional accreditation of university cyber security courses, to provide greater assurance to students and employers that courses are meeting contemporary industry demands. 

53 Develop targeted cyber security programs in primary and high school to inspire young people to take up a career in cyber security, and build foundational skills in science, maths, engineering and technology. 

54 Undertake a regular survey across Government and business to better understand the size of cyber security skills shortage in Australia and evaluate new programs under the 2020 Cyber Security Strategy. 

Enabler 3: Intelligence and Assessment 

The Panel recognises the importance of intelligence-led efforts to combat malicious cyber activity and acknowledges that this is primarily a matter for Government. The Panel is of the view that successful implementation of the recommendations above relating to Objective 1 (Clear consequences for targeting Australia and Australians), 

Objective 6 (Comprehensive situational awareness enables action) and Enabler 1 (The Australian Signals Directorate’s Joint Cyber Security Centres) will support Government to enhance the delivery of this enabler. The Panel encourages the Government to be open and transparent about its knowledge of the threat environment wherever possible, including by declassifying information when appropriate, increasing proactive cyber threat briefings to security cleared industry personnel with a need to know, and sponsoring greater numbers of industry representatives to obtain security clearances. 

Enabler 4: Governance 

In considering how Government should manage implementation of the Strategy, including oversight arrangements, ongoing industry consultation and reporting mechanisms, the 2020 Cyber Security Strategy should as an immediate priority:

55 Include state and territory Governments in development, implementation and monitoring of all relevant initiatives under the 2020 Cyber Security Strategy.

We further recommend that the 2020 Cyber Security Strategy should:

56 Appoint an industry advisory panel to advise the Government on cyber security on an ongoing basis, including on the implementation of the 2020 Cyber Security Strategy. The panel should work with the accountable Government agency or department responsible for implementing the Strategy, while reporting to the Minister for Home Affairs. 

57 Task the industry advisory panel to publish an annual progress report on implementation of the 2020 Cyber Security Strategy and emerging cyber security threats and priorities for Australia from an industry perspective. 

Enabler 5: Evidence and Evaluation In considering the best practice approaches to evidence collection and evaluation that can inform implementation of the Strategy and future policy making, the 2020 Cyber Security Strategy should:

58 Adopt a maturity model approach to evidence and evaluation. 

59 Invest in improved data collection, research and analysis to underpin evaluation of the performance against the metrics of the 2020 Cyber Security Strategy. This should include periodic surveys of the cyber security maturity of public and private sector organisations. 

60 Publish regular updates on implementation of the 2020 Cyber Security Strategy and periodically review and refresh the Strategy every 2 or 4 years.

Cryptocurrences and Information as Property

Law unsurprisingly continues to catch up with 'information as property and the supposedly revolutionary concept of 'virtual currencies', ie private money systems.

In New Zealand the High Court in Ruscoe and Moore v Cryptopia Limited (In Liquidation)  [2020] NZHC 728 has concluded that cryptocurrencies are property.

Gendall J states

For present purposes it will become apparent that I reach the conclusion that the cryptocurrencies here situated in Cryptopia’s exchange are a species of intangible personal property and clearly an identifiable thing of value. Without question they are capable of being the subject matter of a trust. I will now set out my reasons for this conclusion. 

The authorities 

[70] This first issue outlined at para [46](a)] of this judgment asked the specific question whether any or all of the digital assets held by the liquidators are “property” within the definition outlined in s 2 of the Companies Act. 

[71] That section defines “property” as: ...property of every kind whether tangible or intangible, real or personal, corporeal or incorporeal, and includes rights, interests, and claims of every kind in relation to property however they arise. 

[72] Although there is a certain circularity with this definition, it is nevertheless inclusive and wide in that it extends “property” for the purposes of the Act to include “rights, interests, and claims of every kind in relation to property however they arise.” 

[73] Courts in New Zealand have accepted that the definition of “property” in the Companies Act is a “wide” one and includes “money” despite money not being expressly included in the terms of the s 2 definition. This is clear from the Supreme Court decision in McIntosh v Fisk. There, the Court accepted it was arguable that “the payment of money by RAM would fall within s 292(3)(a) as a transfer of property by RAM due to the wide definition of “property” in s 2 of the Companies Act.” 

[74] Further, in Chapman v Effective Fencing Ltd, Associate Judge Faire held:  

The definition of “property” in s 2 in referring to “every kind” of property, is wide enough to cover money.

Clearly money is “tangible” and “personal” property in terms of the definition. 

[75] Lord Wilberforce’s opinion in the House of Lords in National Provincial Bank Ltd v Ainsworth is often cited as the classic statement of the characteristics of “property”.  There, his Lordship said:

Before a right or an interest can be admitted into the category of property, or of a right affecting property, it must be definable, identifiable by third parties, capable in its nature of assumption by third parties, and have some degree of permanence or stability.

I will return to this definition shortly. 

[76] But first, I turn to several recent cases where the question of cryptocurrencies as “property” has been addressed to some extent. The first is a Singaporean case, B2C2 Ltd v Quoine Pte Ltd, which Ms Cooper in particular considered to be an important decision, given its factual setting was not dissimilar to the present case. 

[77] Initially this involved a 2019 first instance decision of the Singapore International Commercial Court, a new division of the High Court of Singapore created in 2015. That decision was then appealed to the Court of Appeal of Singapore and was the subject of a lengthy appeal judgment delivered this year.  In the lower  court, all parties accepted that cryptocurrencies were a species of “property”, a concession which the judge, Thorley IJ  accepted was rightly made. 

[78] The case concerned a Singaporean cryptocurrency exchange operated by Quoine, in many ways like Cryptopia, on which B2C2 was a trader. Some trading was set up to occur automatically through computers connected to the exchange and was pre-programmed. The transactions which led to the litigation were conducted by way of algorithms created by Quoine and by B2C2. The trades in question resulted from pre-programmed requests to exchange cryptocoins of ethereum for bitcoin. Errors occurred in the programming and an unusual set of circumstances resulted in B2C2’s computer offering ethereum for bitcoin at the rate of one ethereum for 10 bitcoin. The computer of another trader on that platform accepted that bid, seven such trades taking place (“the disputed trades”). The going rate of ethereum for bitcoin in the market at the time was one ethereum for 0.04 of a bitcoin. The effect of the automatic trading was that B2C2 sold ethereum at about 250 times its appropriate price. Quoine became aware of the mistake. It then reversed the trades which led to the litigation. 

[79] B2C2 sued Quoine in the High Court for breach of the contract between it as a trader and Quoine as the operator of the exchange and for breach of trust as a result of Quoine’s having returned the bitcoin to the counterparty. A defence of mistake was raised in that Court but Thorley IJ held there was no basis for setting aside the trading and Quoine was accordingly liable to B2C2 for having wrongly reversed the trades. He upheld both B2C2’s contract claim and its claim for breach of trust. 

[80] That breach of trust claim could have succeeded only if the bitcoins in question were an asset that could form the subject matter of a trust. At the lower court level, Quoine had conceded that Bitcoin was a species of “property” but it did not concede that there was any trust. Thorley IJ considered that the concession on the “property” point was rightly made and in his judgment his Honour stated:

Cryptocurrencies are not legal tender in the sense of being a regulated currency issued by government but do have the fundamental characteristic of intangible property as being an identifiable thing of value. Quoine drew my  attention to the classic definition of a property right in the House of Lords decision of National Provincial Bank v Ainsworth [1965] UKHL 1; [1965] 1 AC 1175 (HL) at 1248: "...it must be definable, identifiable by third parties, capable in its nature of assumption by third parties, and have some degree of permanence or stability". Cryptocurrencies meet all these requirements. Whilst there may be some academic debate as to the precise nature of the property right, in the light of the fact that Quoine does not seek to dispute that they may be treated as property in a generic sense, I need not consider the question further. 

[81] In the proceeding, as I have mentioned, B2C2 had alleged that Quoine’s reversal of the disputed trades was in breach of contract and breach of trust. On the trust point there were no express words in Quoine’s terms and conditions indicating an intention to create a trust. However, B2C2 argued Quoine had shown an intention to create a trust by holding traders’ cryptocurrency in separate digital wallets from Quoine’s own assets. Against that, Quoine submitted that a Risk Disclosure Statement it had provided notified customers that assets were not deposited in a trust account so customers may lose their assets in the case that Quoine was to be bankrupted or go into liquidation. 

[82] The High Court, in considering the first instance claims brought by B2C2, allowed them both on the basis of breach of contract and breach of trust. In finding there was a trust, the Court there held that the “decisive factor” was that the assets were held separately as members’ assets rather than as part of Quoine’s trading assets. The decision was appealed to the Court of Appeal as I have noted. On appeal the majority upheld the High Court’s decision on the breach of contract aspect but overturned the decision on the breach of trust cause of action. On that breach of trust claim, a majority of the Court of Appeal rejected the International Judge’s view that it was a “decisive factor” that the assets were held separately rather than as part of Quoine’s trading assets. The Court of Appeal found the mere fact Quoine’s assets were segregated from its customers cannot in and of itself lead to the conclusion that there was a trust. Further discussion of this trust aspect will follow later in my judgment. 

[83] On the “property” question, in its decision, the Court of Appeal also declined to decide whether Bitcoin as the cryptocurrency in question was “property” capable of forming the subject matter of a trust. In their decision the Court of Appeal in the majority judgment, delivered by Menon CJ, commented: There may be much to commend the view that cryptocurrencies should be capable of assimilation into the general concepts of property. There are, however, different questions as to the type of property that is involved. It is not necessary for us to come to a final position on this question in the present case. 

[84] This comment from the Court of Appeal, although not definitive, along with similar suggestions from other authorities, in my view, are of some help when considering this question as to whether the digital assets here could be regarded as “property”. 

Other authorities 

[85] A second case perhaps supporting this interpretation is a 2018 decision in Vorotyntseva v Money-4 Ltd.  There, Birss J sitting in the Chancery Division of the English High Court granted ex parte a proprietary freezing order over some bitcoin and ethereum currency, stating that the defendant in that case had not suggested that “cryptocurrency cannot be a form of ‘property’”.  No further discussion took place on the point. 

[86] In a not dissimilar Canadian decision, Shair.Com Global Digital Services Ltd v Arnold, the Supreme Court of British Colombia granted an ex parte preservation order to the plaintiff company against its former chief operating officer with respect to digital currencies that might still be in the defendant’s possession.  Without providing any reasoning the Court accepted that cryptocurrencies could be property within the rules for preservation orders, noting that in the correspondence between the parties that had been filed for the proceeding the defendant had not denied that the plaintiff had an interest to pursue. 

[87] Recently, a decision of the English High Court in AA v Persons Unknown also held that cryptocurrencies are “property”.   There, Bryan J granted an interim proprietary injunction against a cryptocurrency exchange over bitcoin which represented proceeds of ransom monies paid out to a hacker by the applicant insurance company. The hackers had installed malware into the insurance company’s computer system, and demanded the company pay a ransom in bitcoin, to regain access to its system. The ransom was paid in bitcoin and transferred into the exchange. The insurance company applied to the Court for an interim proprietary injunction against the exchange over the bitcoin, amongst other things. 

[88] Only counsel for the applicant insurance company appeared at the hearing in that case and filed submissions. And, it seems the High Court there primarily relied on the Legal Statement on Cryptoassets and Smart Contracts, and that no other argument was addressed to the Court on the issue. 

[89] It is also useful, as I see it, to turn to consider a diverse range of types of assets that have already been recognised elsewhere as “property” at equity. These examples of “property” also illustrate that they are capable of being the subject of a trust. They include:

(a) Any simple chose in action– even an oral contract can be the subject of an orally created trust with the result that a liquidator of a corporate trustee could not pursue the chose in order to obtain a money judgment for the benefit of unsecured creditors. 

(b) Non-enforceable debt claims – for example a barrister’s claim that fees be paid by the relevant instructing solicitor was recently held in Gwinnutt v George to be part of the property belonging to a bankrupt barrister, even though the barrister had no legally enforceable right to the fees. In the circumstances of that case, in fact there was also no contract all between the barrister and the solicitors. 

(c) Payments through the banking system – money transactions have recently ceased to involve tangible coins or banknotes and usually take the form of electronic bank payments. Equity will apply its proprietary tracing rules to payments effected by these means, even though on transfer of money from one bank account to another this does not involve the transfer of anything in the literal sense from the payer to the payee and the recipient does not hold the same asset.     

(d) Copyright – although copyright has statutory recognition, it nevertheless provides a strong example of intangible property. The subject matter of copyright turns merely on combinations of sounds or shapes in two or three dimensions (including words or drawings) that are sufficiently distinctive to justify the law preventing others from reproducing them.  These sounds and shapes can exist in digital form. Although the resulting intellectual property needs to be identifiable, in many cases whether there has been a copyright infringement will involve an element of judgment in the tribunal called upon to adjudicate on the associated legal rights. These rights can be made the subject matter of a trust. 

(e) Shares – shares in a company are another type of intangible property which typically has a more complicated existence than merely conferring a right to sue. Voting rights in relation to the appointment and removal of directors and in relation to other important company matters can be exercised. Shares are properly regarded as an item of property in equity even where they are non-transferrable or transferrable only to particular persons.   

(f) Licences/exemptions/quotas – modern statutory regulation frequently operated on the basis of blanket prohibitions coupled with defined exemptions granted to individuals that allow each individual then to trade. Such exemptions function and are recognised as intangible items as property. Their value is not derived from a right to sue but rather the opposite, namely an immunity from prosecution.  Examples of this include export quotas, milk supply quotas, fishing quotas, petroleum exploration licences, waste disposal licences, and carbon credits. These tradeable rights can form the subject matter of a trust and where that happens the asset falls outside the estate of an insolvent trustee. There is a large body of case law that confirms such rights are a type of property and subject to normal property protections.   

(g) A trustee’s rights of indemnity – a trustee’s rights to be indemnified in respect of trust expenses has been held to confer a proprietary interest in the trust assets even though these assets are realised by self-help remedies rather than recourse to the courts: Carter Holt Harvey Woodproducts Australia Pty Ltd v Commonwealth.  

Although these rights are not choses in action, they are a species of intangible property. The breadth of the sort of interests that may be the subject of a trust is also confirmed here at [84] as follows: 

 To describe [the right of indemnity] as constituting a beneficial interest in the trust assets, and so as property, thus acknowledges the characteristic blending of personal rights and obligations with proprietary interests which is the “genius” of the trust institution. Such a beneficial interest falls naturally and ordinarily within the definition of “property” in s 9 of the Corporations Act. 

Although a number of the examples outlined above do involve statutory licences and quotas and are within broad statutory definitions of the word “property” in the respective jurisdictions, the types of interest capable of forming the subject matter of a trust at equity, as I see it, are no less broad. A similar point was made by Mr Stephen Morris QC sitting as a deputy High Court judge in Armstrong DLW GmbH v Winnington Networks Ltd:  Whilst the cited case law concerned the meaning of “property” as specifically defined in various statutes, in my judgment, the reasoning of Morritt LJ (in Celtic Extraction) applies equally to the characteristics of property at common law. Indeed, Morritt LJ himself relied upon National Provincial Bank v Ainsworth.  Moreover the terms used in statutory definitions are themselves derived from common law concepts. 

[90] At this point it is useful also to interpolate three recent New Zealand cases which might be seen to be at the boundaries of the legal concept of “property”. The first is Dixon v R.  In this case, which adopted a broad approach to the concept, the Supreme Court held that a digital copy of CCTV footage was “property” within the broad definition found in s 2 of the Crimes Act 1961. The defendant had downloaded a copy of certain footage without the consent of the owner of the computer on which the footage had been recorded. The Court held that computer data can be “property” and that making a copy of it involves a taking, even when the data is not protected by a password. The Supreme Court appeared to endorse the view that computer data would meet general definitions of property including that within s 4 of the Property Law Act 2007. Arnold J, writing the judgment of the Court, stated :  

We consider that interpreting the word “property” as we have is not only required by the statutory purpose and context but is also consistent with the common conception of “property”. 

[91] The second case, a decision of Thomas J in the High Court is Henderson v Walker.  In that case Thomas J was prepared to apply the principles of Dixon in a private law setting and to extend the tort of conversion to purely personal digital information, including the content of private emails. However, her Honour also concluded merely making a copy of emails and other personal data would not amount to conversion. Refusing access to them or destroying them would be, nevertheless. 

[92] In that case, Mr Walker in his capacity as liquidator of subsidiary companies of Property Ventures Limited (PVL) came into possession of a laptop belonging to PVL and of a tape drive that was a backup of PVL’s server. There were a lot of personal, non-company emails sent by and to Mr Henderson, a principal of PVL, and some personal photographs on those devices. Mr Walker distributed at least some of these or allowed them to be distributed to third parties who should not have received this material. Mr Henderson sued Mr Walker, pleading some seven causes of action including breach of confidence, invasion of privacy and conversion. Thomas J held that in principle the common law action in conversion was available with respect to some of the actions which had occurred involving the computer data. 

[93] In my view, it is reasonable to conclude that the reasoning of Thomas J that this data was effectively “property” capable of being converted, could be properly extended to wrongful interferences with cryptocurrency or digital assets. Any person who gained unauthorised access to the private key attached to cryptocoins and used it would permanently deprive the proper possessor of the cryptocoins of that property and its value. 

[94] Another recent High Court decision in New Zealand, Commissioner of Police v Rowland, is also usefully noted here.  In that case this Court approved a settlement under the Criminal Proceeds (Recovery) Act 2009 that included quantities of two cryptocurrencies – bitcoin and ethereum. The question whether the cryptocurrencies were “property” that was amenable to forfeiture under that legislation, however, was not raised in the proceeding. An assumption was made that they did fall within the definition in terms of that legislation. The definition of “property” in the Criminal Proceeds (Recovery) Act at s 5 provides: property— (a) means real or personal property of any kind— (i) whether situated in New Zealand or a foreign country; and (ii) whether tangible or intangible; and (iii) whether movable or immovable; and (b) includes an interest in real or personal property 

[95] Turning back to the decisions noted above in Dixon and Henderson, in those cases the New Zealand courts involved have accepted that the orthodox position that information is not “property” does not attach to cases involving digital assets. There, digital files were seen as “property” by distinguishing them from “pure information”. 

[96] So far as the Supreme Court was concerned in Dixon v R, in the context of the Crimes Act 1961, this was because the files (the digital footage) there: (a) could be identified; (b) had a value; (c) were capable of being transferred; and (d) had a physical presence, albeit one that could not be detected by means of unaided sensors. 

[97] In Thomas J’s decision in this Court in Henderson, in the context of the tort of conversion, this was because it was possible to control and therefore possess the digital files (a large number of documents, emails and images). Possession required cognitive control and manual control. While traditionally the tort of conversion requires physical control and therefore tangibility, physical control is only one example of manual control. The two fundamental elements of manual control are excludability and exhaustibility – whether others can be excluded from the thing’s control and when the thing’s value can be deprived from others. In her decision Thomas J considered both were satisfied on the facts because: 

(a) As to excludability: digital files have a material presence. They physically alter the medium on which they are held. The physical presence allows others to be excluded from the digital asset, either by physical control of the medium or by password protection. 

(b) As to exhaustibility: digital files can be deleted or modified so as to render them useless or inaccessible. 

[98] These principles, in my view, apply equally in the present case to the cryptocurrencies at issue. 

[99] I turn now to the Companies Act. In that Act reference is made to both “property” and “assets”. Assets are not defined in the Act other than the section specific definition at s 129 which applies to “major transactions”. Section 129(2) provides: ...assets includes property of any kind, whether tangible or intangible That definition is expressly limited to s 129 and the use of inclusive language supports the finding that the term “asset” might possibly be seen as wider in scope than “property”. 

[100] The powers of liquidators in the Act are generally expressed to be over a company’s “assets”:

(a) Section 248(1)(a) provides that: The liquidator has custody and control over the company’s assets. 

(b) Section 253 characterises the principal duty of a liquidator as: (a) to take possession of, protect, realise and distribute the assets, or the proceeds of the realisation of the assets, of the company to its creditors in accordance with the act; and (b) if there are surplus assets remaining, to distribute them, or the proceeds of the realisation of the surplus assets, in accordance with s 313(4) in a reasonable and efficient manner. 

[101] The term “asset” is used elsewhere in the Companies Act: 

(a) The solvency test: the relevant limb of the test here is that: “the value of the company’s assets is greater than the value of its liabilities...”. 

(b) Section 237 provides that the Court may make additional orders relating to (among other things): ... (a) the transfer or vesting of real or personal property, assets, rights, powers, interests, liabilities, contracts, and engagements: ... 

(c) Clause 1(1) of sch 7 requires the liquidator to pay: ... 

(e) to any creditor who protects, preserves the value of, or recovers assets of the company for the benefit of the company’s creditors by the payment of money or the giving of an indemnity,— (i) the amount received by the liquidator by the realisation of those assets, up to the value of that creditor’s unsecured debt; and (ii) the amount of the costs incurred by that creditor in protecting, preserving the value of, or recovering those assets. 

The four requirements for a “property” interest 

[102] I return now to the classic statement of the characteristics of “property” outlined by Lord Wilberforce in Ainsworth essentially to recognise what constitutes a “property” interest, and then to apply this to each cryptocurrency at issue here.  In doing so, I need to say at the outset that I am satisfied the criteria for Lord Wilberforce’s definition of “property” are clearly met in this case. I say this bearing in mind the indications I have outlined from the range of authorities noted above that support this conclusion. This is also in line with the approach adopted in the Legal Statement on Cryptoassets and Smart Contracts noted above. 

[103] Lord Wilberforce’s long-applied statement is outlined at [75] above. It outlines four requirements that I now address in turn. 

(a) Identifiable subject matter 

[104] The first requirement is that the asset in question needs to be definable. It needs to be capable of being isolated from other assets whether of the same type or of other types and thereby identified. It is possible, however, for there to be co-ownership (either at law or in equity) of a definable share of an identified bulk of like assets. The present situation, as I see it, is one of this sort. 

[105] Computer-readable strings of characters recorded on networks of computers established for the purpose of recording those strings, as I see it, are sufficiently distinct to be capable of then being allocated uniquely to an accountholder on that particular network. For the cryptocurrencies involved here, the allocation is made by what is called a public key – the data allocated to one public key will not be confused with another. This is the case even though the identical data is held on every computer attached to the network. Indeed, the working of the system is such that the distribution of the data across a large network of computers, when combined with cryptography that prevents individual networks from altering historic data over the network, assists in giving that data stability. It is these features that provide the basic underpinning for the existing cryptocurrencies. 

[106] This is in large measure similar to what occurs in the banking system where large and trusted international banks record balances in various numbered bank accounts held with them. The identifiability provided by cryptocurrency data recorded in the network of computers (called the “distributed ledger”) is no less than the identifiability which results from the bank’s inclusion of balances in their customers’ numbered bank accounts. Equity regards such recorded bank balances as a type of property owned by the party in whose favour the balance is recorded. 

[107] The developer of the most widely known cryptocurrency (Bitcoin), Satoshi Nakamoto, who I have referred to above, argued in 2008:

...an electronic payment system based on cryptographic proof instead of trust, allowing any two willing parties to transact directly with each other without the need for a trusted third party... will provide superior stability and reliability compared to the traditional banking system. 

[108] It is also the case, as I see it, that the public key so allocated to a cryptocurrency account might also be argued to be more readily identifiable than some asserted rights for example to copyright (which is acknowledged as “property”) where issues of originality may be at play. 

(b) Identifiable by third parties 

[109] The second component of property outlined by Lord Wilberforce is that the thing needs to be identifiable by third parties. This element alludes to the thing identified having to have an owner capable of being recognised as such by third parties. The degree of control over the type of asset that a person has to have before the law recognises it as capable of being owned must involve an element of judgement but again I am satisfied here that cryptoassets clearly meet this criterion. 

[110] On this aspect, it has long been recognised by property lawyers that the power of an owner to exclude others from an asset provides a more important indicator of ownership than the power actively to use or benefit from that asset. 

[111] The unique strings of data recording the creation of and dealings with cryptocurrency are always allocated via the public key to a particular accountholder connected to the system. But that allocation by itself is unlikely to be recognised as creating an item of property if there is no element of excludability. So, if that accountholder’s personal connection to the data via the public key could be lost through any person connected with the network being able to reallocate the cryptocurrency to any other colleague on the network without the consent of the accountholder, there might be some doubt whether the law would conclude that the accountholder owned the key. 

[112] The degree of control necessary for ownership (namely the power to exclude others) is achieved for cryptocurrencies by the computer software allocating to each public key a second set of data made available only to the holder of the account (the private key), and requiring the combination of the two sets of data in order to record a transfer of the cryptocurrency attached to the public key from one account to another. A varied public key and a new private key for the cryptocurrency are generated after each transfer of cryptocurrency. The private key, in effect, is like a PIN. Anyone who learns of the private key attached to a public key can transfer the public key but the private key, having been used once in respect of the public key, cannot be used again. 

[113] These features of cryptocurrencies inhibit two potential practices. First, the existence of the private key inhibits the possibility of involuntary transfers – it gives the power to exclude third parties from access. And secondly, the creation of a new private key after each transfer or disposition inhibits a holder from purporting to transfer the cryptocurrency data twice. 

(c) Capable of assumption by third parties 

[114] The third of Lord Wilberforce’s criteria, namely that the right or interest in question must be capable of assumption by third parties, generally involves two aspects: 

(a) Third parties must respect the rights of the owner in that property and will be subject to actions expressly devised by the law to give effect to proprietary rights if they assert their own claim to ownership without justification. Property has been said by its nature to be concerned with legal rights that affect strangers to bilateral transactions.  These third parties will also include insolvency officials of an insolvent trustee; and 

(b) Normally, but not always, an asset recognised by the law as an item of property will be something which is potentially desirable to third parties such that they would want themselves to obtain ownership of it. It might not matter that an asset has no current market value if there has been a market for the asset in the past. For example, in the case where polluted land has excessive clean-up costs, it may be worthless, but it will still be regarded as property. 

[115] Both aspects of this component of Lord Wilberforce’s test are reflected in comments by Lord Bridge for the Privy Council in Attorney-General of Hong Kong v Nai-Keung, a case concerned with a charge of theft of an export quota brought under the theft ordinance of Hong Kong:  It would be strange indeed if something which is freely brought and sold and which may clearly be the subject of dishonest dealing which deprives the owner of the benefit it confers were not capable of being stolen. Their Lordships have no hesitation in concluding that export quotas in Hong Kong, although not “things in action” are a form of “other intangible property. 

[116] I am satisfied here that cryptocurrencies meet both aspects of the assumption by third parties criterion outlined by Lord Wilberforce. There can be no doubt that cryptocurrencies can be, and many are, the subject of active trading markets. 

(d) Some degree of permanence or stability 

[117] The last of Lord Wilberforce’s criteria for determining whether something is capable of attracting proprietary status, in my view is also met here. This criterion requires that the thing needs to have some degree of permanence or stability, but as I see the position, it does not add much to the other three criteria noted above. It is true too that some assets will have little permanence yet undoubtedly be property, such as the example of the ticket to a football match which can have a very short life yet unquestionably it is regarded as property. Also unproblematic, as I see it, will be situations where the short life of an asset is the result of the deliberate process of transferring the value inherent in the asset so that one asset becomes replaced by another. As I have noted above, cryptocurrencies work in this manner but it is also true that bank payments use a similar process which is simply native to the type of property in question. This is not inimical to the asset’s status as property. 

[118] The blockchain methodology which cryptocurrency systems deploy also greatly assist in giving stability to cryptocoins. The entire life history of a cryptocoin is available in the public recordkeeping of the blockchain. A particular cryptocoin stays fully recognised, in existence and stable unless and until it is “spent” through the use of the private key, which may never happen. Standard cryptocurrency systems do not provide for the arbitrary cancellation of coins. 

[119] While it is possible for cryptocurrencies to be wrongfully interfered with, by someone gaining unauthorised access to the private key or by hacking the address to which an owner intends to send a coin, these risks are not markedly greater than those borne by an owner of tangible property or a person relying on the integrity of a bank account record with or without the use of a PIN. 

Conclusion on the four criteria 

[120] I am satisfied that cryptocurrencies meet the standard criteria outlined by Lord Wilberforce to be considered a species of “property”. They are a type of intangible property as a result of the combination of three interdependent features. They obtain their definition as a result of the public key recording the unit of currency. The control and stability necessary to ownership and for creating a market in the coins are provided by the other two features – the private key attached to the corresponding public key and the generation of a fresh private key upon a transfer of the relevant coin. 

[121] This identical point is made in the Legal Statement on Cryptoassets and Smart Contracts which says that a cryptoasset is “a conglomeration of public data, private key and system rules.” 

Possible arguments against cryptocurrency being property 

[122] Two arguments that are most commonly raised to suggest that cryptocurrencies do not have the status of “property” are: 

(a) The common law recognises only two classes of personal property: tangibles and choses in action. Cryptocurrencies are said to be neither. 

(b) Information is not generally recognised as a form of “property” and cryptocurrencies might be said to be a form of information. 

[123] Although before me counsel for the creditors did not rely particularly on the first objection noted above, nevertheless I address it briefly. On this, I am satisfied the argument here is in fact a red-herring. This is because cases which might be perceived to be problematic in this area are not about the limits of what can be recognised as “property” but simply about the number of categories of “property” one needs. This accords with the well-known dictum of Fry LJ sitting in the English Court of Appeal in Colonial Bank v Whinney that all personal property must either be a chose in possession or a chose in action. The argument follows that cryptocurrencies are neither a chose in possession nor a chose in action. 

[124] Essentially here, Fry LJ in his judgment did not seem to be taking a narrow view of what can be classified as property, but rather he was simply wanting to push all examples of property into one of two categories. There is nothing, as I see it, in Fry LJ’s dictum that would lead a court to conclude that cryptocurrencies are not property. The most that could be said is that cryptocoins might have to be classified as choses in action. Indeed, it would be ironic that something that might be said to have more proprietary features than a simple debt is deemed not to be property at all when a simple debt qualifies. 

[125] For these reasons, this first argument advanced by some to support the claim that cryptocurrency is not property in my view is readily dismissed. 

[126] I turn now to the second argument suggesting that cryptocurrency does not have the status of property as noted at [122](b) above. This is to the effect that cryptocoins are just a type of information and that information is not property. The argument is based on the view that neither the common law nor equity recognises property in “information” and cryptocurrencies are said to be merely digitally recorded information. This argument, it is said, is supported by the 2014 decision of the English Court of Appeal in Your Response Ltd v Datateam Business Media Ltd. In Your Response, the Court held that there could be no property in a database in the situation prevailing there, which involved a party contracted by a client to maintain and update a database of the client’s customers. It was held that this party had no common law lien over the database for the fees owed to it. As I see it, however, the decision in Your Response does not go much further than to make a determination upon the particular facts of that case. I am satisfied it is an inconclusive precedent in a case such as the present. 

[127] And, in my view, it is wrong in any event to regard cryptocurrencies as mere information because: 

(a) The whole purpose behind cryptocurrencies is to create an item of tradeable value not simply to record or to impart in confidence knowledge or information. Although cryptocoins are not backed by the promise of a bank, the combination of data that records their existence and affords them exclusivity is otherwise comparable to the electronic records of a bank. The use of the private key also provides a method of transferring that value. This might be seen as similar in operation to, for example, a PIN on an electronic bank account. 

(b) And, generally, as I see it, cryptocoins are no more mere information than the words of a contract are. What allows a contract to be capable of being an item of property is not the words nor even the binding promise which is only a personal obligation, but the fact that equity recognises there is a unique relationship between the parties created by the words and then supplies a system for transferring the contractual rights. Similarly, a unique relationship and system of transfer exists with respect to the relevant data on the blockchain that makes up a cryptocoin. 

(c) In Boardman v Phipps Lord Upjohn stated: "In general, information is not property at all. It is normally open to all who have eyes to read and ears to hear.” This statement appears to confirm as a principle for not regarding information as property the fact that it can be infinitely duplicated. Again, this is not true of cryptocoins where every public key recording the data constituting the coin is unique on the system where it is recorded. It is also protected by the associated private key from being transferred without consent. 

(d) Cryptocurrency systems provide a more secure method of transfer than a mere assignment of a chose in action. It is possible in equity for the holder of a chose in action to assign it multiple times. Only one assignment will be effective to bind the debtor but the winner may not be the first assignee in time but rather the first assignee to notify the debtor. By way of contrast, a cryptocoin can not only be assigned in that way but it can also be sold only once. 

[128] I am satisfied that cryptocurrencies are far more than merely digitally recorded information. The argument that cryptocurrency is mere information and therefore it is not property is a simplistic one and, in my view, it is wrong in the present context. I dismiss it. 

Public policy arguments 

[129] Lastly, I turn to certain public policy arguments here. It is widely known that at least some types of cryptocurrency are used by criminals for the transmission of funds across borders in order to pursue criminal activity and as a means of laundering the proceeds of past criminal activity. This is not exclusive, however. Cryptocurrencies have also become popular with honest people as a method of effecting payments and of investing. The traditional banking sector is itself widely reported to be already using block chain technology and to be planning to create trading platforms for cryptocurrencies.  Any failure by the general law to recognise cryptocurrencies as property, as I see it, would have little effect in reducing potential criminal activity. The banking system is subject to exploitation by the criminal fraternity just as other traditional assets are. 

[130] In my view, honest commercial developments may very well be hindered by a failure of the general law to recognise cryptoassets as property. This is notwithstanding any possible need for more formal regulation of cryptocurrencies. 

[131] The Legal Statement on Cryptoassets and Smart Contracts has also advocated dealing with the status of cryptocurrencies unencumbered by other legal issues including the need for regulation.  Similarly, in those cases where the status of cryptocurrencies as property has been assumed or conceded, including those I have noted above, no court has felt obliged to take a public policy objection. Further, before me Ms Cooper for the creditors raised no particular public policy arguments. 

[132] Overall, I am of the view that public policy questions here do nothing to harm the accountholders’ contention that cryptocurrencies do have the status of property. 

Conclusion 

[133] The answer to the question posed at [46](a) above is yes. I find that, for the reasons outlined above, all of the various cryptocurrencies are “property” within the definition outlined in s 2 of the Companies Act and also probably more generally. In addition, these digital assets, I find, being property, are capable of forming the subject matter of a trust.

'Cryptocurrencies as Property' by Paul T Babie, David Brown, Ryan Catterwell and Mark Giancaspro comments

The case provides significant guidance for any jurisdiction, common or civil, faced with determining whether cyrptocurrencies are property. This note outlines the approach taken to ‘the property question’ by Gendall J, in four parts. Part I introduces the property question. Part II provides a brief overview of blockchain and the nature of cryptocurrencies. Part III briefly recounts Gendall J’s reasons for the judgment

In the United Kingdom  AA v Persons Unknown and Others, Re Bitcoin  [2019] EWHC 3556 (Comm) the English Commercial Court has concluded that Bitcoin is property.

The judgment states, at [55] onwards -

Turning then to the relevant principles in relation to the granting of a proprietary injunction, the first and perhaps fundamental question that arises in relation to this claim for a proprietary injunction is whether or not in fact the Bitcoins, which are being held in this account of the second defendant with the third or fourth defendants are property at all. Prima facie there is a difficulty in treating Bitcoins and other crypto currencies as a form of property: they are neither chose in possession nor are they chose in action. They are not choses in possession because they are virtual, they are not tangible, they cannot be possessed. They are not choses in action because they do not embody any right capable of being enforced by action. That produces a difficulty because English law traditionally views property as being of only two kinds, choses in possession and choses in action. In Colonial Bank v Whinney [1885] 30 Ch.D 261 Fry LJ said: "All personal things are either in possession or action. The law knows no tertium quid between the two." 

On that analysis Bitcoins and other crypto currencies could not be classified as a form of property, which would prevent them being the subject of a proprietary injunction or a freezing injunction. This exact issue has recently in November 2019 been the subject of detailed consideration by the UK Jurisdictional Task Force ("UKJT") which has published a legal statement on Crypto assets and Smart contracts, ("the Legal Statement"). The UKJT is chaired by Sir Geoffrey Vos, and Sir Antony Zacaroli is also a member. However, neither in their judicial capacity was responsible for the drafting of the legal statement, nor have either in their judicial capacities endorsed that legal statement. Indeed Sir Geoffrey Voss explained in the foreword to the Legal Statement: "It is not my role as a judge nor that of the UKJT or its parent, the UK Lawtech Delivery Panel, to endorse the contents of the Legal Statement". Those responsible for drafting the Legal Statement were Laurence Akka QC, David Quest QC, Matthew Lavy and Sam Goodman. 

It follows that the legal statement is not in fact a statement of the law. Nevertheless, in my judgment, it is relevant to consider the analysis in that Legal Statement as to the proprietary status of crypto currencies because it is a detailed and careful consideration and, as I shall come on to, I consider that that analysis as to the proprietary status of crypto currencies is compelling and for the reasons identified therein should be adopted by this court. 

The difficulty identified in treating crypto currencies in property, as I say, starts from the premise that the English law of property recognises no forms of property other than choses in possession and choses in action. As I have already identified, crypto currencies do not sit neatly within either category. However, on a more detailed analysis I consider that it is fallacious to proceed on the basis that the English law of property recognises no forms of property other than choses in possession and choses in action. The reasons for this are set out between paragraphs 71 to 84 in the Legal Statement.

"71. The Colonial Bank case concerned a dispute about shares deposited as security for a loan. The borrower was declared bankrupt and there was a contest for the shares between the plaintiff bank and the trustee in bankruptcy. The case was not about the scope of property generally: there was no dispute that the shares were property. The relevant question was rather whether they were things in action within the meaning of the Bankruptcy Act 1883, an issue of statutory interpretation. If so, then they were excluded from the bankrupt estate by section 44 of that Act. 

72. Lindley LJ and Cotton LJ held that the shares were not things in action. They relied principally on previous case law where the court had come to a similar conclusion in relation to the predecessor statute, the Bankruptcy Act 1869. They also drew some support from sections 50(3) and 50(5) of the 1883 Act, which appeared to make a distinction between shares and things in action. 

73. Fry LJ reached the opposite conclusion, reasoning principally from what he considered to be the essential nature of a share. A share constituted "the right to receive certain benefits from a corporation, and to do certain acts as a member of that corporation" and was therefore, in his view, closely akin to a debt. He supported his conclusion by a comparison of shares to other, established, things in action, such as partnership interests and interests in funds. 

74. Fry LJ's statement that "personal things" are either in possession or in action, and that there is no third category, may carry the logical implication that an intangible thing is not property if it is not a thing in action. It is not clear, however, whether Fry LJ intended that corollary and it should not in any case be regarded as part of the reasoning leading to his decision (and so binding in other cases). The question before him was whether the shares were things in action for the purpose of the Bankruptcy Act, not whether they were property, still less the scope of property generally. 

75. Moreover, in making the statement Fry LJ attributed a very broad meaning to things in action. He approved a passage from Personal Property by Joshua Williams, which described things in action as a kind of residual category of property: "In modern times [sc. by the 19th century] … several species of property have sprung up which were unknown to the common law … For want of a better classification, these subjects of personal property are now usually spoken of as ... [things] in action. They are, in fact, personal property of an incorporeal nature…". 

76. On appeal, the House of Lords also framed the question as one about statutory interpretation. They reversed the Court of Appeal's decision, approving the judgment and reasoning of Fry LJ. They did not explicitly address the issue of exhaustive classification between things in action and things in possession and said nothing about the definition of property. Lord Blackburn did say, however, that "in modern times lawyers have accurately or inaccurately used the phrase '[things] in action' as including all personal chattels that are not in possession". Thus, to the extent that the House of Lords agreed with Fry LJ on the classification issue, that seems to have been on the basis that the class of things in action could be extended to all intangible property (i.e. it was a residual class of all things not in possession) rather than on the basis that the class of intangible property should be restricted to rights that could be claimed or enforced by action. 

77. Our view is that Colonial Bank is not therefore to be treated as limiting the scope of what kinds of things can be property in law. If anything, it shows the ability of the common law to stretch traditional definitions and concepts to adapt to new business practices (in that case the development of shares in companies). 

78. Colonial Bank was referred to in Allgemeine Versicherungs-Gesellschaft Helvetia v Administrator of German Property by Slesser LJ as showing "how the two conditions of [thing] in action and [thing] in possession are antithetical and how there is nomiddle term". Again, however, the case was not about the scope of property generally but about whether something that was undoubtedly property should be classified as a thing in possession or a thing in action. 

79. Most recently, Colonial Bank was cited in 2014 in Your Response v Datateam. In that case, the claimant sought to assert a lien over a database in digital form but faced the obstacle of the previous decision of the House of Lords in OBG Ltd v Allan that there could be no claim in conversion for wrongful interference with a thing in action because it could not be possessed. In an attempt to distinguish the case from OBG, the claimant argued that, even if the database could not be regarded as a physical object, it was a form of intangible property different from a thing in action and so was capable of being possessed. 

80. The Court of Appeal rejected the argument. Moore-Bick LJ said that Colonial Bank made it "very difficult to accept that the common law recognises the existence of intangible property other than [things] in action (apart from patents, which are subject to statutory classification), but even if it does, the decision in OBG Ltd v Allan [2008] AC 1 prevents us from holding that property of that kind is susceptible of possession so that wrongful interference can constitute the tort of conversion." He said that there was "a powerful case for reconsidering the dichotomy between [things] in possession and [things] in action and recognising a third category of intangible property, which may also be susceptible of possession and therefore amenable to the tort of conversion" but the Court of Appeal could not do that because it was bound to follow the decision in OBG. The other members of the court agreed. 

81. The Court of Appeal did not, and did not need to, go so far as to hold that intangible things other than things in action could never be property at all, only that they could not be the subject of certain remedies. The intangible thing with which they were concerned was a database, which (as Floyd LJ said) would not be regarded as property anyway because it was pure information. They did not have to consider intangible assets with the special characteristics possessed by cryptoassets. 

82. In other cases, the courts have found no difficulty in treating novel kinds of intangible assets as property. Although some of those cases are concerned with the meaning of property in particular statutory contexts, there are at least two concerning property in general. In Dairy Swift v Dairywise Farms Ltd, the court held that a milk quota could be the subject of a trust; and in Armstrong v Winnington, the court held that an EU carbon emissions allowance could be the subject of a tracing claim as a form of "other intangible property", even though it was neither a thing in possession nor a thing in action. 

83. A number of important 20th century statutes define property in terms that assume that intangible property is not limited to things in action. The Theft Act 1968, the Proceeds of Crime Act 2002, and the Fraud Act 2006 all define property as including things in action "and other intangible property". It might be said that those statutes are extending the definition of property for their own, special purposes, but they at least demonstrate that there is no conceptual difficulty in treating intangible things as property even if they may not be things in action. Moreover, the Patents Act 1977 goes further in providing, at s30, that a patent or application for a patent "is personal property (without being a thing in action)". That necessarily recognises that personal property can include things other than things in possession (which a patent clearly is not) and things in action. 

84. We conclude that the fact that a cryptoasset might not be a thing in action on the narrower definition of that term does not in itself mean that it cannot be treated as property." 

The conclusion that was expressed was that a crypto asset might not be a thing in action on a narrow definition of that term, but that does not mean that it cannot be treated as property. Essentially, and for the reasons identified in that legal statement, I consider that a crypto asset such as Bitcoin are property. They meet the four criteria set out in Lord Wilberforce's classic definition of property in National Provincial Bank v Ainsworth [1965] 1 AC 1175 as being definable, identifiable by third parties, capable in their nature of assumption by third parties, and having some degree of permanence. That too, was the conclusion of the Singapore International Commercial Court in B2C2 Limited v Quoine PTC Limited [2019] SGHC (I) 03 [142]. 

There are also two English authorities to which my attention has been drawn where crypto currencies have been treated as property, albeit that those authorities do not consider the issue in depth. They are, and I have already mentioned them, in Vorotyntseva v Money -4 Limited t/a as Nebeus .com, the decision of Birss J, where he granted a worldwide freezing order in respect of a substantial quantity of Bitcoin and Ethereum, another virtual currency, and the case of Liam David Robertson, where Moulder J granted an asset preservation order over crypto currencies in that case. 

In those circumstances and for the reasons I have given, as elaborated upon in the Legal Statement which I gratefully as what I consider to be an accurate statement as to the position under English law, I am satisfied for the purpose of granting an interim injunction in the form of an interim proprietary injunction that crypto currencies are a form of property capable of being the subject of a proprietary injunction.