How Anonymous is Bitcoin?

After a number of discussions at Porcfest, the Free State Project's annual get together, I think I now understand the essentials, although not the mathematical details, of how Bitcoin works. If I correctly understand it, it is well suited to be a private online currency but poorly suited as an anonymous currency, although there may be ways of converting it into one.

This is how I think it works—those more familiar with it are welcome to correct any errors:

1. A bitcoin is created by "mining," finding a solution to a particular mathematical problem. The problem has a known number of solutions, about half of which have so far been found, so about half of all bitcoins that will be mined have been.

2. Someone who has mined a bitcoin informs all other users of bitcoins that he has done so in a way that demonstrates the existence of his solution and prevents anyone else from claiming to be the miner of that particular bitcoin. It is now his.

3. Any transfer of bitcoins (or fractional bitcoins—they are very divisible) is publicized to all users of bitcoins. Hence, at any instant, every user has access to a complete list of who owns every bitcoin or fractional bitcoin in existence.

4. Users are identified not by realspace identity but by the public key of the wallet in which they store bitcoins. One individual can have an unlimited number of wallets.

5. Any disagreement about who owns what bitcoin can be settled by checking the lists of two or more users—many more if someone is trying to deliberately spoof the system by creating fake lists that show him owning bitcoins that he does not actually own.

One way of understanding the economics of the Bitcoin system is to analogize it to a hundred percent reserve commodity money. Each bitcoin corresponds to a one ounce ingot of gold. All of the gold sits in a bank somewhere which keeps track of who owns which ingot or fractional ingot. Payments are made by changing the label on the ingot. Mining bitcoins corresponds to mining physical gold, casting it into a one ounce ingot, and putting it in the bank labeled as belonging to the miner.

Seen from this standpoint, the bitcoin system has both the advantages and the disadvantages of a commodity money or hundred percent reserve banking system. The disadvantage, relative to a fiat money or fractional reserve system, is that the creation of money consumes real resources—time and effort to mine gold, computer processing time to mine bitcoins. The advantage (and disadvantage) is that the value of the money depends on factors not under the control of any government or central bank. That is a disadvantage if you expect a central bank to do a good job of managing a currency or expect the factors controlling the supply and demand for a commodity currency to change unpredictably. It is an advantage if you are concerned that central banks (or governments) will do bad job of managing a currency, for instance inflating for short term political benefits, as a way of funding government via money creation, or as a way of inflating away government (or private) debts.

The Bitcoin system differs from what I have analogized it to in three interesting ways.

1. The record of ownership is radically decentralized—there is no bank holding the bitcoins and keeping track of who each one belongs to. This means that the system does not depend, as other schemes for anonymous digital currency do, on a trusted bank, hence that it does not depend on the existence of a government willing to defend it. A fully anonymous digital currency makes money laundering laws unenforceable, which means that most governments don't want such a currency to exist, which is probably why, prior to Bitcoin, there were no such currencies.

2. The value of bitcoins, like the value of gold, depends in part on mining technology. But the total quantity of bitcoins has a known upper bound. This is both an advantage and a disadvantage from the standpoint of making future value predictable. A bitcoin hyperinflation due to a large increase in supply is impossible, however cheap computing power might become. But bitcoins are more vulnerable than a gold currency would be to changes in value, in particular increases in value, due to changes in demand. If the demand for gold increases, the resulting increase in its price will result in more gold being mined, holding down the price increase (increase in the price of gold, corresponding to a fall in prices measured in gold). The corresponding effect for bitcoins is limited by the limited quantity of bitcoins available to be mined, a much tighter limit than the limit on total gold available to be mined.

If you hold bitcoins, an increase in their value is a good thing. But if you are making future contracts in terms of bitcoins, uncertainty in their value, in either direction, is a bad thing, since it means that the real terms of your contract are subject to random change.

What about reduction in value due to a decrease in demand? In the case of both gold and bitcoins, the existing stock is already out there, so a drop in value only reduces the rate at which it is increased by mining. But gold, unlike bitcoins, has nonmonetary uses, which limit by how much its value will fall in response to a drop in monetary demand. Bitcoins have no nonmonetary demand.

3. A bank holding deposits of gold has a record of what account owns which ingot, but that record need not be public. The record of what wallet owns each bitcoin, on the other hand, is available to every user.  This means that bitcoins, used as I have described, are not only not an anonymous currency, they are in a sense the least anonymous currency ever created. 

The distinction between wallet and owner provides some degree of anonymity, analogous to the anonymity provided by a numbered Swiss bank account. To see the limits of that anonymity,  imagine that the FBI decides that the Free State Project is a subversive organization—as, in a sense, it is. An FBI agent procures some bitcoins and uses them to pay for his registration at Porcfest. He now has the public key of a wallet connected to the Project—call it wallet A. If he wants to find out whether some suspicious person that uses bitcoins has ties to the Project, he makes a payment to that person's wallet and then checks to see if it has ever sent or received a payment to or from wallet A, or to a wallet that has sent or received a payment to or from wallet A, or ...  . He can, in other words, engage in traffic analysis using only public information—no need to tap any phones.

There are, I gather, solutions to this problem, ways in which a group of wallets can put their bitcoins into a pool, retrieve a corresponding number from the pool, and so break the link between coin and wallet. I do not believe that any such solution is currently in routine use, but would be happy to discover that I am mistaken.

Corrections on that or any other part of this description welcome.

P.S. Lots of interesting corrections of details and additional information in the comment thread.