How does insider trading law affect bitcoin exchanges? The Bitcoin network is predicated on the premise that it is difficult to find 'low' hash values for a given input. This is an incredibly safe bet because of the way the algorithm is implemented - if you change one byte in the input then the output changes to an (apparently) random number without any way to predict what it could be in advance. People can 'mine' for new bitcoin by taking existing blocks and trying to 'solve' them by looking for a particularly low hash value. Currently this is done by simply trying lots of input values until a low enough output is hit by chance. Huge 'farms' and pools of computing power and specialised hardware exist to mine the new bitcoin and by all accounts only just manage to turn a profit after the cost of powering them. So suppose someone somewhere discovers the hashing algorithm the Bitcoin network uses is not as random as the world thinks and comes up with a new unlocking algorithm that can reliably produce low hash values and 'solve a block' in seconds on his beat up pentium III computer at home (I realise that this is almost certainly impossible but it's a hypothetical). He, and only he, then knows the secret and has the power to create new bitcoin quickly. Would there be legal implications for him to use this new knowledge to his advantage and to the detriment of others by, for example, Generating new bitcoin and accumulating it just slowly enough to avoid arousing suspicion After a period suddenly dumping and short-selling as much as he can before going public with the news of his algorithm (which would surely suddenly devalue the currency to the point of collapse) Obviously he would be on safe ground if he just started using his new algorithm to generate bitcoin - nothing in the rules about how blocks are solved. My suspicion is that as soon as he uses that algorithm to deliberately influence the exchange for the currency for his own profit (which he arguably does by 'going slow' in stage 1 but certainly does by timing the dumping/short selling just before the announcement in stage 2) then he must be violating some law, such as some kind of ban on insider trading?
Your question assumes that there is a method to find a block of bitcoins with a faster computation than the brute force method used so far. If such a faster calculation method exists, it is proprietary to the mathematics and our superhero has not invented it, he just discovered it and used it. It is not an insider trading case since everybody has the possibility to acquire the same math knowledge for free and use the same super algorithm (and maybe is using it already). Insider trading covers only situations when an insider has an information earlier than the market due his proximity to the information, being e.g. employee of the relevant company whose shares are traded, etc. Insider trading presumes that the insider is an "insider", i.e. has the information earlier only due to his position. On the other hand, having an information earlier due to his math skills which are available to everybody does not constitute insider trading. Using the new discovered super algorithm for shorting the bitcoin price is not illegal since the super algorithm is not illegal either, but proprietary to the mathematics. The assumption that the price will drop may be not true, it is only a valid speculation.
The rule you are alluding to with respect to a television set is called the "first sale doctrine" which basically prohibits copyright and trademark owners from limiting the ability of a buyer of a good (like a CD or authorized logo T-Shirt) protected by copyright or trademark, from limiting further sales of that good (or the manner in which the good is used by its new owner) after a first retail sale of the good with copyright or trademark protections. This doctrine was derived from an old common law rule that invalidated "restraints on alienation" of property other than intellectual property on public policy grounds, and like the "restrain on alienation" rule for tangible property, the first sale doctrine that applies to intellectual property was also (at least originally) a court created common law rule. But Minecraft isn't, conceptually, a good. It is a continuing service provided over the Internet, and firms that provide continuing services on a licensed basis, as Minecraft does, can impose terms of service (a.k.a. an "end user license agreement" a.k.a. EULA) which must be complied with in order for users to be allowed to continue to utilize the service. So, its prohibition on exchanges of things of real world value for things of game value, except as the terms of service authorize, is permitted. A user of Minecraft is more analogous legally to someone skating at an ice rink than to someone who buys a CD or book. If you buy a ticket to skate at an ice rink, the people granting you the license to use the ice rink have the right to set rules governing how you utilize that service, and to terminate your license if you don't follow the rules (e.g. by skating in the wrong direction at the wrong time). Indeed, a ticket to an event is also known in legal parlance as a form of "license" just like a EULA, and licenses to use real property are the origin of the body of law that now governs the licensing of intangible intellectual property. A Minecraft license isn't something that you own (even if you have a license of unlimited duration), it is a qualified and limited right to use something that someone else owns, that you aren't allowed to purchase, but you are allowed to use on the owner's terms. How can they enforce servers to follow that rule if the server's are not using Mojang's proprietary software. The EULA or TOS obligation in the Minecraft business model is enforceable because Minecraft isn't in the business of selling proprietary software, even though it does do that. Minecraft is in the business of licensing access to data and online resources. The EULA regulates your access to the data on servers, and the computing power of those servers, not your ownership of an app which facilitates your use of the licensed services. And, while there are various contractual remedies for violating a EULA, the most basic one is a self-help remedy: to cut you off from your ability to use the service if you violate the owner's rules. Indeed, at least heuristically, the easiest way to distinguish an intellectual property good, which is subject to the first sale doctrine, from an intellectual property service, which can be licensed pursuant to a EULA, is whether, as a practical matter, the firm distributing the intellectual property has a practical ability to deny you service going forward without resort to the courts. If the owner of the intellectual property has no practical ability to do that, the intellectual property being distributed will probably be classified as a good and be subject to the first sale doctrine. But, if the owner of the intellectual property has the practical ability to cut you off from the intellectual property being distributed without resort to the courts, the intellectual property being distributed will probably be classified as a service, which is not subject to the first sale doctrine and may be licensed.
The ultimate question is whether an obviously joke enterprise constitutes a real offering of securities or just performance art (a Ponzi scheme is one of many types of securities fraud). An unregistered offering of securities that does not fall within an exception is per se unlawful under federal law, but a security is generally defined as something offered with at least a prospect of making a potential profit for the investor which is not something that is true of this offering. (And if less than $1,000,000 are sold it might even be within an exemption to securities laws). State securities laws are divided into two categories. Most allow any offering of securities so long as proper disclosures are made and the offer is restricted to the right kind of investors. A minority impose substantive quality standards on offerings and this offering might violate the law in those states (although this still would present the question of whether a known money losing opportunity is really a security since there is no evidence of an intent to potentially make a profit from the investment). I do not believe that California imposes substantive quality of investment standards on public or private offerings of securities. Any deal whether or not it is a security is actionable if it is fraudulent. Normally an element of any claim for fraud is justified reliance upon a representation or upon a failure to disclose information. But, in this case, it is hard to see how anyone could say that they were justified in relying on any representation in making a purchase because they were told that they were being cheated. So, it is hard to see how a fraud claim would be sustained here either. I'm not sure that this cleanly falls into the category of gambling either, even though there is money at stake and the outcome isn't entirely certain. This doesn't really seem like a game of chance to me. Indeed, viewed as performance art, this scheme might even be entitled to First Amendment protection. Ultimately, I would not prioritize a civil or criminal action against this enterprise either from the perspective of a private lawyer representing an investor, or from the perspective of a government enforcement authority. And, while I would be a little nervous about running this enterprise, I wouldn't be quaking in my boots. In a civil lawsuit, any award would probably be minimal, and in a criminal case there would probably be an extremely generous plea offered.
You quoted the definition of personal data from Art 4(1) GDPR. This definition of identifiability is further explained in Recital 26: […] To determine whether a natural person is identifiable, account should be taken of all the means reasonably likely to be used, such as singling out, either by the controller or by another person to identify the natural person directly or indirectly. To ascertain whether means are reasonably likely to be used to identify the natural person, account should be taken of all objective factors, such as the costs of and the amount of time required for identification, taking into consideration the available technology at the time of the processing and technological developments. […] If the user ID is unique, then the hashed user ID will be unique as well. Thus, the hashed ID will enable “singling out”, and would still count as identifying in the sense of the GDPR. You also claim that there's no way to reverse the hash. This is not quite correct. Assuming that the hash function itself is secure, then the only way to crack the hash is to brute-force the input. The difficulty of brute-forcing depends only on the entropy of the input data, not on the size of the output hash. It is thus comparatively easy to crack hashes of short low-entropy strings like sequential integer user IDs, IPv4 addresses, or weak passwords. In contrast, it would be difficult to crack long random user IDs, such as UUID version 4 identifiers created from a cryptographically secure RNG (CSPRNG). Even if the hashes can't be cracked, they are not anonymous – you can link them to the original user ID, after all. The GDPR only considers data anonymized if there are no “reasonably likely” means to re-identify the data subject. If this de-identification is reversible, it's called pseudonymization instead. If storage allows, a better technique to generate pseudonymous IDs is to create a table that maps the true ID to a CSPRNG-random ID. Unlike a hash, the random ID cannot leak extra information about the original ID. This pseudonymization technique could perhaps also be turned into irreversible anonymization by deleting the ID mapping, assuming that no “singling out” can happen. Pseudonymization is a very good security measure. It is explicitly mandated whenever appropriate in Art 32 GDPR. So you should probably use it. It's just that GDPR continues to fully apply to processing of the pseudonymized data. Since the pseudonymized data is the data subject's personal data, you may be required to delete it when receiving an Art 17 request for erasure. You may also be required to forward the request to others with whom you shared the data. However, the right to erasure has many conditions and exceptions. If you actually need to keep the data for a particular purpose, chances are good that you can keep it.
The basic principle about copyright protection is that the expression of an idea is protected, but the idea itself is not. So wholesale copying without permission is infringing. But the abstract algorithm is not protected by copyright (and let us assume that it also isn't patented). By way of analog, an insertion sort is a pretty easy concept to grasp, and once you understand it, you can re-create it, independent of how the original example (where from you learned about the sort) is expressed. So the question is whether it is necessary for you to copy that code (copyright protects against copying), or can you independently re-express the algorithmic idea (ideas are not protected)?
Political risk insurance exists, but not in the format hypothesized. What the question is contemplating is more like a gambling bet, or a futures contract (which is a type of "derivative" contract), than insurance. What constitutes an insurable risk of harm to an insurable interest is mostly a matter of common law although there are some state statutes on point in the U.S. which is the level of federalism at which insurance is regulated. Basically, you can only insure against a loss to an "insurable interest" caused by an insurable risk. In practice, this means that insurance has to be linked to an individualized loss of an individual or business that is clearly and directly caused by a covered occurrence. A change in governing political party itself, doesn't give rise to such a loss. The mere fact that a party is elected or that the people elected take an oath of office, doesn't itself change any laws or regulations. It just puts in place people who might do such things in the future. Political risk insurance, when it exists, insures against the nationalization of one's business at a loss, or against the industry that one is engaged in becoming illegal, at a loss. It is the specific action taken by the newly elected regime towards the particular insured firm or individual, and not the actual new regime itself, that gives rise to a loss to an insurable interest in the case of political risk insurance. For example, you might be able to buy political risk insurance against the possibility that your marijuana business which is legal under state law but not federal law, will be seized in a civil forfeiture or shut down by a change in the practical effect of the relevant state law. If you are worried that your company's stock will decline in value due to an election result, the available financial instrument would be to short sell your company's stock, hedging against losses arising from a drop in stock price below a certain dollar value by a certain date for any reason. If your company is not publicly held, the risk of a decline in business due to an election result is not something that can be insured against.
Financial institutions in the US are subject to regulations that restrict what sorts of things non-licensed employees can talk about with clients and advice they can give about structuring accounts and payments in ways that might avoid triggering money laundering alarms. I think this employee was being cautious about getting into a gray area and phrased the reason they couldn't talk about it poorly. The reason they were restricted from giving you an answer could be a legality, but not necessarily because they are giving you legal advice.
What Big Tech is doing is spending a lot of money on lawyers and appeals – doesn't matter if it costs millions if you can make money in the meanwhile. Facebook stores a lot of user data in the US. Initially, this was allowed because the US was recognized as offering an adequate level of data protection under the Safe Harbor and later the Privacy Shield Framework. Then Schrems I and Schrems II happened and the adequacy recognition was ruled to be invalid. Does Facebook pull back their user data? No. The GDPR offers alternative reasons why you might process data in foreign countries, such as “standard contractual clauses” (SCCs) or “binding corporate rules” (BCRs). Now, Facebook claims that they are using SCCs. Is this valid? Almost certainly not due to the issues of US law analyzed in the Schrems II case, but it can take years for the next round of court cases to work its way through the system. And when Facebook's use of SCCs is ruled invalid they will probably try BCRs next, and once that is over a decade will have passed and the US might actually have achieved an adequate privacy level by then. You do not have Facebook-style money to spend on lawyers and endless rounds of appeals, so you should avoid legally risky things such as outsourcing data processing activities to companies in the US (this doesn't mean you can't be compliant if you are a US entity). I mentioned adequacy decision previously. There is a list of countries that the EU considers to be sufficiently safe. Currently, the more notable countries involve Canada, Israel, Japan, New Zealand, Republic of Korea, Switzerland, and the United Kingdom, in addition to EU/EEA countries of course. If you want to process data in a location that is OK for both the UK and the US, then looking at companies in one of these countries is a good idea. For example, if most of your users are in the US but you would like your servers to be in a country with an EU adequacy decision, then looking at Canada could make sense. Even outside of this list, you can process data if you implement additional safeguards via SCCs. However, this requires a case by case analysis of the legal environment in that country. One problem with the US is that it has national security laws that impose requirements on companies in a manner that is incompatible with SCCs. A company bound by these US laws cannot enter into such a contract where it guarantees the privacy of your user's data. Countries other than the EU have much more tedious data residency laws. The GDPR does not impose any data residency requirements in the sense that data must not leave a particular country – you just have to ensure that the data is properly protected. In contrast, Russia and China have real data residency requirements that are fundamentally incompatible with the GDPR.