Today I was in Washington DC to talk about financial privacy and the narrow path to non-dystopian digital ID. It was great to see @valkenburgh and @secparam, but I want to now expand on a point from our panel:

I think it is likely the BSA, as applied today, is unconstitional.

This is probably going to be surprising to a lot of you. After all, didn't the Supreme Court uphold the BSA as constitutional when it was challenged in 1974? Why yes, it most certainly did.

Have you read that opinion? I have. That same court said that the fact pattern today is likely unconstitional.

The case, for those unfamiliar, is California Bankers Assn. v. Shultz (416 U.S. 21). In it, when you read the actual decision, you find some interesting tidbits:

Title I recordkeeping requirements were upheld because mere recordkeeping was not a search, and the authorities asking a third party for individual pieces of data was thus not a search. Government access in that case still required orderly legal process.

Title II domestic reporting was largely a standing issue, pointing out there were not customers specifically challenging this at the time who had been clearly impacted.

Fifth amendment claims by depositors or the ACLU were considered speculative at the time, and did not note specific facts (nor privacy concerns) or even clear intent to engage in transactions in some cases.

Powell, who was joined by Blackmun, concurring with the majority, in fact specifically noted that “A significant extension of the regulations’ reporting requirements… would pose substantial and difficult constitutional questions.”

First: I think this case was correctly decided on the facts at the time, in the world where banking was largely done on paper, records searches were one at a time or at most small batches, and the amount of information a bank collected was far more limited. On the standing and non-ripeness points, those were probably also correct at the time, but I will note that doesn't make something constitutional, just that SCOTUS has a long history of punting on things until they have to confront it.

Second: the fact pattern today looks absolutely nothing like the fact pattern at the time. The expansiveness of a search is far greater, with banks involved in every asset of digital life and the transaction monitoring far more comprehensive than before. Previously, a BSA request could not get every purchase you had made over the past three months (thus also geolocating you at all those times), because that was all done in cash. Now it can.

In light of things like the recent Flock decisions at district courts finding Flock database searches without a warrant to be unconstitutional and the cell phone tower decision showing that non-particularized geofence warrants are also unconstitutional, it's hard for me to see how "we see your location constantly through your card always and then we turn tens of thousands of people's wroth of information over to the government with no individual suspicion" is going to pass muster.

The second point is in light of government pressure to close accounts, like the @USOCC just found in their report about the debanking of digital asset companies, the standing and ripeness arguments now look very different. There was, in fact, an actual nationwide dragnet at big banks to debank certain customers, partially pushed by regulators leaning on reputational risk, and the standing, harm, and ripeness issues created might be overcome here.

The third point is that the reporting requirements have expanded dramatically, exactly the thing the court itself cautioned against. "Hey gives us this one customer's info for transactions over $10k" is now "give us all transactions for all customers at all thresholds", and by waving their hands and screaming "third party doctrine", the Feds think this is somehow magically constitutional.

My view: it's not.

I think the time is right for someone to challenge this, and win.