Control, Censorship, and Programmable Money
Learning Objectives
Identify control mechanisms enabled by programmable money
Distinguish between legitimate uses and potential abuses of control
Analyze real-world examples of financial control and censorship
Evaluate the censorship resistance spectrum across implementations
Assess appropriate limits on programmable money control capabilities
Traditional money—cash—cannot refuse to work. A dollar bill does not check who's spending it, where, or on what. This is a feature, not a bug: money that works regardless of circumstances provides economic freedom.
Programmable money can say no. It can check conditions, evaluate rules, and refuse transactions that don't comply. This creates:
- Prevent fraud in progress
- Enforce sanctions on criminals
- Comply with court orders
- Protect consumers from scams
- Block political opponents' transactions
- Freeze accounts without due process
- Enforce social compliance through financial pressure
- Control population through economic means
The same technical capability enables both. The difference lies in governance, accountability, and constraints on use.
Mechanism:
Individual transactions can be evaluated and blocked before execution.
How it works:
Transaction submitted → Evaluated against rules → Approved or blocked
- Sender identity (sanctioned person)
- Recipient identity (blacklisted entity)
- Amount (suspicious threshold)
- Category (prohibited goods)
- Location (sanctioned country)
- Pattern (unusual behavior)
- Stablecoin issuers can blacklist addresses
- CBDC systems can block by identity
- Payment processors already do this
Mechanism:
Entire accounts (wallets, balances) can be frozen, preventing any transaction.
How it works:
Freeze order issued → Account flagged → All transactions blocked
- Full freeze (no transactions in or out)
- Partial freeze (receive only, no send)
- Time-limited freeze
- Conditional freeze (until compliance)
- Banks freeze accounts regularly (court orders, suspicious activity)
- Stablecoins can freeze addresses (USDC has done this)
- CBDCs would have this capability built in
Mechanism:
Money can be restricted to specific uses, merchants, or categories.
How it works:
Funds tagged with restrictions → POS verifies compliance → Transaction allowed or blocked
- Only at approved merchants
- Not for specified categories
- Only within geographic region
- Only until specified date
- SNAP (food only)
- Gift cards (specific merchants)
- Some CBDC pilots (consumption vouchers)
Mechanism:
The value of money can be programmatically changed.
How it works:
Expiration: Value → 0 after date
Demurrage: Value decays over time
Inflation/deflation: Value adjusted by formula
Conditional: Value changes based on circumstances
- Money no longer a stable store of value
- Issuer controls purchasing power
- Recipients uncertain of true value
Mechanism:
Rules execute automatically without human intervention.
Traditional enforcement:
Violation detected → Report filed → Human reviews → Decision made → Action taken
Time: Days to months
Discretion: Human judgment applied
Automated enforcement:
Violation detected → Rule executes → Action taken
Time: Milliseconds
Discretion: None (code has no judgment)
Use case:
Block fraudulent transactions as they occur.
How it works:
Pattern: Transaction matches known fraud patterns
Action: Block transaction, alert user
Benefit: Prevents loss, protects users
- Protects users from harm
- Consent implied (users want fraud prevention)
- Reversible (false positives can be corrected)
- Clear benefit exceeds cost
Use case:
Prevent sanctioned individuals and entities from transacting.
How it works:
Pattern: Party matches sanctions list (OFAC, etc.)
Action: Block transaction
Benefit: Enforces legal requirements
- Democratic legal process creates sanctions
- Targets specific, identified individuals
- Due process (theoretically) available
- National security rationale
- Sanctions lists can be politicized
- Due process often inadequate
- Collateral damage to family, associates
- Who controls the list?
Use case:
Freeze assets pursuant to court judgment.
How it works:
Court order issued → Account frozen → Funds held pending resolution
- Judicial process with due process
- Public, challengeable proceedings
- Legal framework for resolution
Use case:
Prevent money laundering and terrorist financing.
How it works:
Suspicious activity → Enhanced monitoring → Potential blocking
- Addresses real criminal activity
- Regulatory requirement
- Proportional (suspicious activity, not everyone)
- Surveillance of everyone to catch few
- False positives common
- Burden falls on legitimate users
Scenario:
Government blocks transactions of political opponents, protesters, or dissenters.
Examples:
Canada 2022 (Freedom Convoy):
Context: Trucker protests against COVID restrictions
Action: Government invoked Emergencies Act
Result: Bank accounts of protesters frozen without court order
Scope: Donors to protest also affected
Duration: Brief (Act revoked), but precedent set
- Financial participation in protests can be frozen
- Without traditional court process
- Chilling effect on political expression
China (broader pattern):
Context: Social credit system integration
Capability: Lower scores → Reduced financial access
Scope: Transportation, credit, various services
Pattern: Financial control as political control
Scenario:
Financial access tied to social compliance scores.
How it might work:
Behavior tracked → Score calculated → Money behavior adjusted
- Reduced spending limits
- Blocked categories
- Higher transaction costs
- Account restrictions
- China has social credit, but integration with e-CNY unclear
- Technical capability exists
- Full deployment not yet evident
Scenario:
Government freezes accounts without legal process.
- Cyprus 2013: Bank deposits confiscated
- India 2016: Large notes demonetized overnight
- Various authoritarian states: Routine account freezing
- Faster execution (instant vs. days)
- Broader scope (everyone vs. bank customers)
- Harder to evade (no physical cash escape)
Scenario:
Private programmable money issuer abuses control capability.
- Favoring affiliated merchants
- Discriminatory access
- Arbitrary rule changes
- Data monetization through behavior requirements
- Regulatory oversight (limited)
- Competition (can switch providers)
- Reputation concerns (limits worst abuse)
- Central authority can block any transaction
- No appeal or constraint
- Arbitrary use possible
- No alternative available
- Hypothetical authoritarian CBDC
- Corporate money with no competition
- Authority can block, but with limits
- Legal process required
- Appeals available
- Constraints on scope
- Most CBDC proposals (in theory)
- Regulated stablecoins
- Banking system with rule of law
- No single authority can block
- Requires coordination to censor
- Technical barriers to censorship
- Alternatives exist
- Bitcoin (requires 51% attack)
- Decentralized stablecoins (DAI)
- Physical cash
| Level | Description | Example | Tradeoffs |
|---|---|---|---|
| 0 | Full censorship | Authoritarian CBDC | Control: High, Freedom: None |
| 1 | Easy censorship | Centralized stablecoin | Control: High, Freedom: Low |
| 2 | Constrained censorship | Democratic CBDC w/process | Control: Medium, Freedom: Medium |
| 3 | Difficult censorship | Bitcoin | Control: Low, Freedom: High |
| 4 | Near-impossible censorship | Cash | Control: None, Freedom: Maximum |
| Implementation | Level | Notes |
|---|---|---|
| Cash | 4 | No digital control possible |
| Bitcoin | 3 | Requires network majority |
| Ethereum | 2-3 | Validator coordination possible |
| USDC | 1 | Circle can blacklist addresses |
| e-CNY | 0-1 | Central bank full control |
| XRP/XRPL | 2 | Validators could coordinate; harder than USDC |
If programmable money has control capability, principles should include:
Actions require legal basis
Notice to affected party
Opportunity to challenge
Independent review
Action proportional to violation
Minimum necessary restriction
Time-limited when possible
Rules publicly known
Actions reported
Oversight bodies have access
Who decides is identified
Decisions can be challenged
Consequences for abuse
Cash or equivalent available
No total financial exclusion
Ability to meet basic needs
Control capabilities that should not exist:
- Blocking legal political expression
- Indefinite freezing without process
- Category restrictions on legal goods
- Social score integration
- Collective punishment
- Retroactive rule changes
Who should control the controls?
Insulated from political pressure
Technical mandate
But: Unelected, limited accountability
Court orders for major actions
Due process built in
But: Slow, resource-intensive
Laws define limits
Democratic input
But: Laws can change
Multiple parties must agree
Harder to abuse
But: Slower response
Likely reality: Some combination, varying by jurisdiction.
Design choices that limit abuse:
- Holding limits (can't freeze all money if some is outside system)
- Offline capability (transactions can occur without central verification)
- Pseudonymity (identity not always known)
- Interoperability (can move to different system)
- Sunset provisions (controls expire unless renewed)
- Validators approve transactions
- Malicious validators could refuse transactions
- But: Requires majority of trusted validators
- Decentralized validator set limits individual control
- Trust line issuers can freeze issued currencies
- Native XRP cannot be frozen by design
- Differentiated control by asset type
- More difficult than centralized stablecoins
- Easier than Bitcoin (fewer validators)
- No single point of control
| Aspect | XRP/XRPL | USDC | Bitcoin |
|---|---|---|---|
| Native asset freeze | No | N/A (USDC is token) | No |
| Token freeze | Issuer can | Circle can | N/A |
| Transaction blocking | Validator coordination | Circle can | 51% attack |
| Practical censorship resistance | Medium | Low | High |
- XRP (native) has meaningful censorship resistance
- XRPL issued currencies have issuer control
- RLUSD would have Ripple control (like other stablecoins)
- Positioning: More resistant than centralized, less than Bitcoin
✅ Control mechanisms are technically feasible
✅ Legitimate uses exist (fraud, sanctions, court orders)
✅ Abuse occurs (Canada convoy, various authoritarian examples)
✅ Different implementations have different control levels
⚠️ Whether democratic safeguards will hold
⚠️ Scope of future control implementation
⚠️ Whether alternatives will remain available
⚠️ Long-term political evolution of control norms
📌 Control capability normalized before limits established
📌 "Legitimate" uses expanding over time
📌 Cash elimination removing alternatives
📌 Corporate control without democratic oversight
Programmable money's control capabilities are a feature for legitimate purposes and a danger for abuse. The same technology enables both. Governance, accountability, and preserved alternatives are the only protections—and they're imperfect.
Evaluate the control capabilities and risks of a specific programmable money implementation.
- Select implementation (CBDC, stablecoin, or crypto)
- Map control capabilities (what can be done)
- Identify governance structure (who decides)
- Assess safeguards (what limits exist)
- Analyze abuse scenarios (what could go wrong)
- Recommend improvements
Time Investment: 3-4 hours
A) Legitimate uses are faster
B) Legitimate uses have democratic legal basis, due process, proportionality, and accountability; abusive uses lack these
C) Legitimate uses are for larger amounts
D) There is no meaningful distinction
Correct Answer: B
A) It proved programmable money works
B) It demonstrated that financial accounts could be frozen for political protest participation without traditional court process in a democracy
C) It showed that banks cannot freeze accounts
D) It was unrelated to programmable money
Correct Answer: B
A) Full censorship capability
B) Medium censorship resistance (harder than centralized stablecoins, easier than Bitcoin)
C) Near-impossible to censor
D) Completely uncensorable
Correct Answer: B
End of Lesson 13
- Previous: Lesson 12 - Privacy and Programmable Money
- Next: Lesson 14 - Legal and Regulatory Frameworks
Key Takeaways
Programmable money enables comprehensive control
: Transaction blocking, account freezing, spending restrictions, and value modification are all possible.
Legitimate uses exist
: Fraud prevention, sanctions, court orders, and AML have real purposes—but scope tends to expand.
Abuse is not hypothetical
: Canada's convoy freezes, China's social credit, and various authoritarian examples show control in action.
Censorship resistance varies
: From full censorship (authoritarian CBDC) to near-impossible (cash, Bitcoin), implementations differ significantly.
Limits require active design
: Due process, proportionality, transparency, accountability, and preserved alternatives must be deliberately built in. ---