Messy NFT drop angers infosec pioneers with unauthorized portraits

An unauthorized NFT drop celebrating infosec pioneers has collapsed into a mess of conflicting takedowns and piracy.

Released on Christmas Day by a group called “ItsBlockchain,” the “Cipher Punks” NFT package included portraits of 46 distinct figures, with ten copies of each token. Taken at their opening price, the full value of the drop was roughly $4,000. But almost immediately, the infosec community began to raise objections — including some from the portrait subjects themselves.

The portrait images misspelled several names — including EFF speech activist Jillian York and OpenPGP creator Jon Callas — and based at least one drawing on a copyright-protected photograph. More controversially, the list included some figures who have been ostracized for harmful personal behavior, including Jacob Appelbaum and Richard Stallman.

Responding on Twitter, York tweeted a link to her own portrait and said simply, “I don’t approve of this whatsoever and would like it removed.”

Removing the NFTs has been more complicated than it might seem. The ItsBlockchain team apologized on Twitter for not obtaining likeness rights in advance and said it has removed 28 NFTs from the group and burned two others. But there’s no clear procedure for removing tokens that have already been sold, and ItsBlockchain is mostly counting on the central OpenSea platform to remove the tokens and resolve the issue. ItsBlockchain has appealed to the platform for guidance, but so far it has received little guidance. (OpenSea did not respond to a request for comment.)

“We have been trying to resolve this issue … we want to take it down,” the group said in an email to The Verge. “OpenSea involvement would make the job easy at this stage.”

The incident is a reminder of the potentially thorny legal issues around NFTs, where norms of permissionless innovation often clash with likeness rights and intellectual property law. Typically, US laws around publicity rights hold that a person’s name and identity can’t be used for promotion without their consent — although it’s unclear how such a lawsuit would work in practice when applied to NFTs.