Interview The Great Offshore book about Loophole for All, 2021
In 2013, you released the website, could you summarize the project ?

Through a hack in the governmental website of the Cayman Islands Company Register I stole the list of all companies registered in the major Caribbean offshore center. This list is composed of over 200,000 worldwide companies that incorporated themselves at the Caymans to avoid taxes or legal accountability. I then made the data public and I exposed it by creating counterfeited Certificates of Incorporation documents for each company, all issued with my real name and signature.

The counterfeited certificates were published on the website, where everyone was invited to hijack firms' identities through buying Certificate of Incorporations starting at 99 cents.

This massive corporate identity theft benefited from the legitimate Caymans companies' anonymous nature: the secrecy surrounding their real owners allows anyone to impersonate them. In short, this idea turned the main feature of offshore centers into a vulnerability, which was subsequently exploited by forging the legal paper documents of the Certificate of Incorporation.

This performance generated international media coverage and engaged an active audience using the certificates. At the same time it drew outrage from authorities at the Cayman Islands and generated reactions by global banks, the companies' real owners, and accounting firms offering offshore services.

Using aggressive business strategies to compete against Cayman's incorporation services, I set up a scheme to publish the stolen data through a company in the City of London (Paolo Cirio Ltd.) and a server in California, while the identities of the Cayman companies were sold through Luxembourg via to route the profit of the sale to my headquarter in Manhattan. The scheme took advantage of those specific jurisdictions for legal liability, financial transactions, and publishing rights. I also used physical mailboxes in the Caymans, London, and New York City and set up most of this scheme through my passport, ultimately shielding my personal legal liability through my Italian citizenship.

The project was released in 2013, after 3 years of intensive research, a bit before the Offshore leaks release. What was the informational context at the time, regarding tax haven and offshore banking ? What was your methodology of research ?

I started to investigate the offshore world around 2011, at the time the outcomes of the global economic crisis were grim in Europe and there were many initiatives criticizing the banking sector and finance.

However the offshore world was still not well known, it was very surprising to me how hard it was to find information on this subject after decades of offshore finance shaping the global economy. Probably because it was still such a niche topic, I was able to meet in person a few key experts and activists like John Christensen and Jack Blum. About the Cayman Islands there was only one unknown book by William Brittain-Catlin. Then, in the following years, Nicholas Shaxson's book Treasure Islands became a bestseller, from that point on it has been a pleasure to see so many writers, filmmakers, artists, and hackers working on this subject.

My usual method of research is to collect as much as material I can on the subject I investigate, just bookmarking articles, assembling books, and documentaries for years. Then I try to meet experts in the sector, possibly becoming a friend and understand deeply how they see the subject. Then I take all this material and I process it all together with comparing notes in a few weeks. I know how to scan for key information in a large volume of data, connecting points and then being able to assemble comprehensive cartographies of the issue. Then through political and historical knowledge I address the root problems and potential solutions. For instance the list of uses for offshore centers I published for this project was pretty unique[2]. Most analysts focused on tax evasion, but there are other uses of offshore structures such as for intellectual property or insuring high environmental and health risks. The list is the result of three years of my independent research into the subject. The video documentary with my interviews with experts is published on YouTube and it contributes to raise awareness on the global scale of economic and legal abuses as well as possible solutions to them[3].

Could you elaborate a bit on the hacking dimension of the project, in both technical and symbolic terms ? The technical hacking was relatively easy, there was also some social engineering though. Before being able to code a script to hack the online registry I had to request access to it, something I’ve done by emailing to the registry and pretending I was doing research about a company. Once they gave me access to very few entries with a personal password, I realized how little security they had in their platform and how easy it was to scrape all companies by just making queries with incremental id companies. Literally from zero to any incremental number, the platform was screening the associated company, which was then captured from my script and stored in my database. It took much more to clean the data and understand the logic behind their registration system. Before targeting the Caymans registry, for months I attempted to hack the registry of Delaware and other ones, which however had much more security in place.

The hacking with forging the certificate of incorporation was pretty crucial, considering the data I had wasn’t that rich, it was just names of companies and their tax number, without any other details. The real hack was turning that little data into documents that usually are not visible and yet some the most official for firms. Giving the data a visual form, exposing it and having people using it was the real hack.

That’s how it was important to talk about hacking the language for this art project, making it culturally engaging, lowering the barriers for understanding it, having bipartisan political claims, and even by using some irony. And yet the project was effectively threatening the targets, challenging them and being informative for the audience.

The other crucial hacking I set up for this project was the legal hack. I incorporated myself in the City of London as Paolo Cirio Ltd. to operate as a company and not as a private individual, therefore shielding my legal liability. The money I was making by selling counterfeited documents was routed to my bank account in New York. Then the stolen data was published on a server in California which has a strong free speech jurisdiction against take down requests. If the Cayman Islands authorities or any of the companies I exposed were going to sue me, I could have gone bankrupt in London, keep the money I made in the U.S. and nevertheless be an Italian citizen with my passport giving me a further legal shield.

Hacking legally to me means to place the project and myself in the grey zones of laws and turn laws into my advantages. In this case, it is a legal checkmate for the target, a company willing to take legal actions against me would need to become public, affirming the real ownership and yet not being able to stop me. That’s why I think the ones that did send me threats (around 40) were proportionally only few compared to the number of companies I exposed.

The final hack that was very important to me was the symbolical and philosophical hack. Symbolically the project questioned what it means being anonymous or transparent, what are the social responsibilities behind those notions, from a personal to a corporate or governmental perspective. Philosophically the hack showed the asymmetry of power at play by attempting to reshape these forms and the paradoxical geometry I created.

With Loophole for all, how one can « incorporate » a Caymanese shell company ?

On everyone could acquire a certificate and use it to invoice as freelance or a company working in their countries. Then their income appears to be exempted from taxes, and if the taxman of their counties wanted to audit the business they would have had to ask questions at the Caymans, where there is total secrecy. At the same time the real owner of the company would not come forward to avoid the hijacking, because that would have compromised their anonymity. This corporate identity theft benefits from the anonymous nature of those offshore companies. Everyone can pretend to be them because of their real owners’ secrecy.

This model was probably used by a few, some even asked me if the certificate could be used to withdraw money in offshore bank branches. I’m not sure how many really adapted the model successfully, that is not the point to me, my real operation was artistic by creating this absurd reality that was a threat to so many legal entities and informing a large public about them. Avoiding taxes by registering a company in the Cayman Islands is legal everywhere. However, the hijacking offshore business was set up mainly as a form of protest and not to scam other people. Having a certificate and not using it is totally legal. As an alternative to hijacking a company, people could send the certificates by mail to their country’s Minister of Treasury as another form of political pressure. I kept mobilizing my audience with these alternative forms of protests, like the idea of the Tax Day Action, when I invite to mail bombing the IRS with the certificates.[4]

What was, and how was shaped, the public reception of the project, from the different types of audiences ?

The project worked on several levels of audience, this was planned in advance by hacking the language of presentation for different types of public. I considered how to get the best reactions from the targets, exposing their vulnerability, then I think about the general public and how they can understand without being experts, this language is then made scandalous for the media outlets. Some other material and language is designed for the ones more involved in the subject, like journalists or academics. Then the final public is the art world, which to me is important as a distribution channel, funding, and personally as a form of expression I prioritize.

All these types of audience were successfully engaged. Journalists and private investigators also made very practical use of this project. The general audience was wide and pointed to the project with coverage by major media outlets, art exhibitions, or networks of activists worldwide.

The target also reacted perfectly, with even statements about the project by the registrar of the Cayman incorporation service. Then I could do interesting further investigations by seeing the owners of the companies coming to my website to check out what I’ve done with their entity’s data and so they left tracks that I could use to hunt them back. In particular, the website received significant amounts of traffic from India, Hong Kong, Singapore, and China. And when they were trying to buy their own counterfeited certificate of incorporation I could also collect their emails, often to discover that were global banks and multinationals being the ones failing in the trap I set up.

Are you still facing lawsuits?

I managed to get away with any lawsuits or courts. I received a number of Cease and Desist letters, some from global banks and companies, other from suspicious financial firms, and also from those accounting firms that actually set up those companies in offshore centers. When I receive those legal threats I negotiate as much as I can to avoid lawsuits, this often results in the taking down of their certificate from the website, but shortly after I make public their legal letter and in doing so I expose them even more. After having applied this strategy, I haven’t received any new threats in years. To steal the identity of a Caymans company is illegal only in the Cayman Islands, however these companies have powerful lawyers who couldn’t know any better the laws to use against me. So I don’t want to take a chance on expensive international lawsuits. I asked some advice to some lawyers to see how I could defend myself against some of the legal accusations I received, but it was basically impossible to find a lawyer willing to defend me in such an intricate legal project played across multiple jurisdictions and with such radical provocation as premise.

Another interesting reaction from the release of Loophole4all was PayPal’s. What does mean PayPal's reaction ? After a few weeks from the launch of the project PayPal banned my account and froze all the earnings I made from the sale of the certificates. The reason: « PayPal may not be used to send or receive payments for items that encourage, promote, facilitate or instruct others to engage in illegal activity ». I denied the accusations since the project promoted a form of civil disobedience and an art performance against corrupt and unjust laws. Meanwhile, PayPal is a company based in Luxembourg, an offshore country, and its own legality is questionable for evading taxes to the rest of the world it operates.

By negating the Caymans legitimacy, you frame their laws as illegal. Could you elaborate on this dimension of the project ?

I often say that this project is not really on offshore finance, but it’s rather about the notions of law and sovereignty. The idea of the law is relative, but often its meaning is used in absolute and imperative terms. I think it’s a question of language first that eventually enters in the field of anthropology.

On the practical level, of course it’s all about geopolitics and political dominance, directly related to military power. Every country can legislate within their own territory and they have sovereignty rights on the laws they want. However such sovereign legislation is a sort of soft power that can't be leveraged as the hard economic and military power. This is how we have jurisdictions in weak and small countries that can be corrupted, others that compete to create the most favorable legal frameworks, and then we have the most powerful jurisdictions that allow this to happen or even set up loopholes purposefully. The United Kingdom, the United States, China, Russia, and Europe all have their own offshore centers; these aren’t anomalies, but actually central for their economy via foreign small corruptible jurisdictions. Of course what is legal or not is all relative to the enforcement and political willingness of global powers.

After this project the question of laws in our globalized world became very urgent to me. Seeing the global economy flowing through a country like the Cayman Islands and causing austerity in Europe and poverty in the world made me think beyond economic inequality and I started to think in terms of people's agency over worldwide flow of laws. We live in a nonsense political democracy, where people have the right to vote only every few years about legislatures in their own countries, while instead all the political and economic decisions are taken on an international level at the speed of financial transactions made by unknown people in power without any political accountability.

This is why after Loophole for All I was eager to research and work on outlying an advanced global participatory democracy, which became the project Global Direct[5]. In this creative political philosophy I envisioned the laws are not fixative but dynamic and they apply in multiple jurisdictions. Everyone in the world can have a say about these laws and they can be improved constantly, while maintaining autonomy with decentralization based on a centralized worldwide constitution.

The Paradise Papers have promoted an approach « legal but not moral », which ultimately helped Offshore banking in a process of normalization, rather than successfully helped toward its regulation. What could definitely expose, quoting Alain Denault, this massive scale « legalized theft » ?

I don’t know if they have been normalized only recently. They were already structural to the global economy for the past decades, simply there wasn’t much data and information about them. I think what changed is that from being an open secret for the few in the financial sector, it’s now something that has been more popularized and so everyone is aware of how it works and that it’s not only the mafia and the monarchy using offshore, but every multinational company and even small businesses.

After all, it’s like to ask if colonialism was ever normalized and if it was a legalized theft. I think with offshore finance we make this old question about the same financial system that just uses different machines. Historically, colonialism exploited other economies through weapon machines, from canons to bombardiers. Then, when these kinds of wars became too invasive, colonialism moved to offshore finance, a legal machine for making colonized countries impoverished with unfair trade and tax agreements. Now I think colonialism makes use of algorithms and networks machines, creating loopholes in jurisdictions might become obsolete when wealth, information, and culture can be transferred and manipulated remotely and the colonized countries become just users of platforms built by colonizer countries.

With its structure changing, where could be located the weak points of the offshore capitalist system, where to attack to disrupt it?

In response to tackling offshore centers, I would propose three simple solutions. First of all banning trade with corporations registered in a place without employees, manufacturing, or sales. Then also banning the promotion and advertising of offshore instruments, since law firms and accountants are often directly involved in the set up of offshore structures and even legislations. Most importantly, we ultimately need to establish an International Tribunal of Economic Crimes. Today we can’t talk about economic justice and addressing seriously inequality without an international agency to do so. Domestic courts can’t bring justice to inequality when most of the economic crimes and the money flow worldwide. And of course when we talk about criminal justice, then we talk about laws and who can enforce them. At the moment the United States is the only country able to conduct international financial criminal investigations and seize capitals abroad. So if we talk about a tribunal, this must be as fair and independent as possible.

Loophole for all envisioned a « democratization » of the offshore system. This particular comment seems to have never been so accurate…

It’s true that the project’s aim to democratize offshore became today’s reality. It’s always easier to get incorporated abroad and countries began to offer offshore services to self-employed and small businesses, like Estonia[6], Ireland, Portugal[7] or with the “Digital Nomads” programs. True that some countries have been normalized too for big firms, like Luxemburg has become the « normal » headquarters for most young mega multinationals, like Amazon, Uber, Airbnb, etc. Or if you look at the boom of the crypto currency market and fintech, then today’s offshore market really goes all over the map.

However, leaks and offshore regulations have been also weaponized for political warfare. I think Brexit came out from a war over sovereignty on financial regulations. Europe wanted to crack down on the British offshore network. Just put on the same timeline European financial regulations, the Tobin tax proposal, and see when Brexit was designed and financed by oligarchs and ultra wealthy. Interesting enough at the same time, leaks of offshore accounts by British politicians were used in the media against the Labour party. These developments are very interesting compared to the time when offshore finance was so opaque and not even considered an issue.

Regarding what we could call the « immunitary system » of capitalism, every crisis seems to reinforce and strengthen its structure. Is there also a risk, for projects like Loophole4all to reinforce the system ?

These are symbolic hacks. Sure by hacking such systems I reveal a vulnerability that can be then fixed and to make the systems stronger. However it would be naive to think that an individual hack could take down the entire system too. This is also about the limits of hackers and the transparency or attacks they can bring about. The power asymmetry is much more unbalanced than it seems, the hacker power is neutralized quickly, even if at the time of the attack a single hacker seems able to defeat a large power structure. I think what went wrong with the hackers revolution of our time is that there wasn’t enough politics with it. Wikileaks, Snowden, Panama Papers were audacious phenomena but they didn’t have a political program, just the ideology of radical transparency is not enough. The only way to challenge capitalism is creating consensus on an alternative economic and political system. I often consider my artworks as performances, they are enactments of hacker actions which I embody with all the practices, outcomes, and risks. These are the aesthetics of my works. Nevertheless, beyond being performances and conceptual art, my works are meant to be empowering for engaging people in complex issues and mobilizing to bring solutions. Having done the hack of the Cayman Islands just a few years before Paradise Papers and then the Panama Papers, sometimes I feel some of my performances are creations of realities that are inevitably about to come.

As a conclusion, did the project foresee what one could call an Offshore Governance ?

You can find offshore everywhere you look around you. Offshore is behind most of the brands we have in our daily reality, the material objects made from natural resources, the political figures who govern us, the celebrities we watch and listen in the media, the drugs we use for medication or recreation, our money in bank accounts or private pensions, the funds of universities and hospitals.

Offshore centers facilitate political corruption, misreport manufacturing costs and retail prices, obfuscate investments and trade to maximize profit, steal revenues from undeveloped countries, hide capitals and debts by wealthy individuals, laundry money for organized crime and oligarchs. Today, if you expand this notion of offshore finance, you see the same model on the sovereignty of data, where most of the Silicon Valley companies use the United States favorable jurisdiction to store and process personal data, push content and manipulate behaviors on world wide population without juridical accountability.

I then started to see offshore in my job too. With the art market, offshore couldn’t get closer to me. My potential clients of the fine art world are often billionaires or business people with bank accounts in offshore centers. However they won’t buy my art, but they rather make anonymous financial transactions in art auctions or mega art galleries to manipulate the value of artworks and artists they speculate on. These manipulations eventually change the value of my art too, they chose the artist to recognize valuable by corrupting the market and its institutions such as art museums and critics. These were the issues I then addressed with the project Art Commodities[8] shortly after tackling offshore finance and then most recently with Art Derivatives[9], investigating and directly targeting financial speculation and secrecy in the art market.

[1] Entretien réalisé entre le 24 novembre et le 7 décembre 2020, autour du projet de Paolo Cirio, « Loophole for all », réalisé en 2013.

[2] See :

[3] See the video documentation of the project :


[5] « Global Direct », 2014 ; lire aussi, le texte de présentation de l’artiste :



[8] Art commodities, 2014, ; lire le texte de l’artiste :

[9] Art Derivatives, 2019, lire aussi l’entretien avec Aude Launay dans la revue Zéro Deux

Interview to be published in april 2021 in "THE GREAT OFFSHORE", a collection of text on offshore, edited by RYBN.ORG, UV Editions

home | cv & bio | works | archive works | press | archive press | events | contact | top