Group items tagged

"This St. Louis Fed article explores non-custodial crypto asset mixers such as Tornado Cash. We analyze what types of mixers exist and how they work. We discuss opportunities and risks and offer an approach, based on voluntary disclosure, that would allow financial market regulators to combat money laundering and illicit activities, while allowing honest users to interact with privacy-enhancing protocols. We explain how crypto asset mixers play an important role on public blockchains and that privacy may be difficult to attain without them."

"The Right to Financial Privacy Act, originally enacted in 1978 in response to how the Bank Secrecy Act and the third‐​party doctrine weakened the protections of the Fourth Amendment to the U.S. Constitution, has already set a foundation for some of the protections needed today. However, it is largely due to a long list of exceptions in the Right to Financial Privacy Act that much of the financial surveillance over the past 50 years has been permitted to expand-hidden away from the public eye."

The European Data Protection Supervisor recently published a tech dispatch on CBDCs and privacy. It recommends that a CBDC should follow a clear data protection by design and by default approach. If this is not ensured, a CBDC can be a systemic risk for profiling and surveilling users. For a CBDC, privacy enhancing technologies, including advanced pseudonymisation techniques and zero-knowledge proof, should be used to minimize the information shared between transaction partners. https://edps.europa.eu/data-protection/our-work/publications/techdispatch/2023-03-29-techdispatch-12023-central-bank-digital-currency_en

In his final speech as Deputy Governor for Financial Stability, Jon Cunliffe revealed that the Bank of England (BOE) and HM Treasury (HMT) central bank digital currency (CBDC) consultation paper attracted over 50,000 responses. The majority expressed general, high-level concerns about privacy, programmability and the decline of cash. According to the paper, users of a digital pound would have the same level of privacy that they enjoy today when making electronic payments, and the BOE would not see people's data. Also, neither government nor the BOE would program a digital pound or constrain the uses to which it could be put. It would be for private sector firms to develop and offer, for user consent, payment services involving greater programmability. As regards cash, the government recently legislated to ensure the availability of physical cash to those who prefer to use it and the BOE has made clear that it will provide physical cash as long as there is any demand for it. https://www.bankofengland.co.uk/speech/2023/october/jon-cunliffe-speech-at-the-economics-of-payments-xii-conference

The current draft of the digital euro legislation calls for increased privacy for close-proximity offline payments, which is seen as consistent with the European Union AML/CFT framework risk-based approach. The European Data Protection Board (EDPB) and European Data Protection Supervisor (EDPS) suggest increased privacy for low-value online payments too, but not as private as offline transactions, because online transactions would not be limited to proximity payments, resulting in a potentially attractive model for criminals. Hence, they recommend transaction size limits above which complete checks can occur that are lower for online than offline transactions. However, Atakan Kavuklu suggests equalizing the limits at the higher level for all low-value proximity payments (e.g., those using NFC and Bluetooth connections). He believes this could benefit the acceptance and success of a digital euro.

The Hill published an article that calls for leaving the politics and fearmongering designed to squelch meaningful debate around a digital dollar and proceed with caution. Instead, it calls for investing in central bank digital currency (CBDC) research from a technical, legal, ethical and international perspective. That would include reviewing and possibly amending country's legislation, laws and justice system so that it better protects individual freedoms, including the freedom to transact and the right to financial and individual privacy. The article points out that designing a CBDC with privacy controls that prevent government surveillance is possible, and this kind of technical development should continue. "To outright ban research, development and experimentation on CBDCs without attempting to find technological solutions to legitimate privacy risks first is a lazy and incomplete response that borders on censorship."

Crunchfish has recently implemented and patented a novel approach with balance reconciliation. Private transactions are encrypted and sent to the backend, but where the keys used for the transaction are wallet keys, in contrast to prior art using public keys controlled by either the issuer or an escrow agent. In this way the payer is in full control of the privacy of their transactions even if all private transactions are sent to the online ledger encrypted. In this innovative way, regulatory requirements for transactional traceability are balanced with requirements for privacy where the payer is in full control of the encrypted transactional data for amounts below defined thresholds, defined by the issuer and the regulator. If the issuer suspects an attack by the payer, the issuer can contact the payer for permission to decrypt the data. In case the payer is not willing to grant access, the issuer may decide to lock the wallet or disallow any more private transactions.

The European Central Bank (ECB) published a blog post that explains what degrees of payments privacy future users of a digital euro can expect. It claims that it will promise better privacy and data protection than other current electronic means of payment, but not the same degree of privacy as cash although paying with an "offline digital euro" comes pretty close. Online digital euro payments will not be so private, because the commercial banks that run the user-facing parts of the platform will have full access to user identity and transaction information, just like they currently do on their own platforms. However, digital euro holder identities will be separated from the payment data, and the banks will pseudonymize user data so they are not visible to the Eurosystem.

Data privacy commissioners from Australia, Albania, Burkina Faso, Canada, the EU, the U.K., the U.S., shared concerns that "while Facebook and Calibra have made broad public statements about privacy, they have failed to specifically address the information handling practices that will be in place to secure and protect personal information.

Payments platform Nuggets is working with the Bank of England to develop a privacy and identity layer for a potential digital pound. The platform, which enables decentralized identity, plans to design a private and secure system to prevent the tracking and correlation of transactions, as well as prevent fraud and money laundering. Nuggets said that it plans to implement zero-knowledge proofs on its privacy layer, which will enable people to verify their identity without sharing their data. https://nuggets.life

For fans of "straw man" arguments, the Cato Institute published a digital dollar takedown. Most of the report is actually quite good, and I agree with most of the things the authors say about the dubious case for a US Fed-issued central bank digital currency (CBDC). But starting on page 7, they go down the privacy/control rabbit hole by assuming that a digital dollar will be designed as a control/surveillance coin, completely ignoring the possibility that it could be designed to offer the same privacy and user control as physical cash (see my IMF F&D article). Rather than completely diss CBDC, they could have made their paper a call for action to insist that at least one layer of the digital dollar offer complete offline usability and privacy, or lend support to the ECash Act.

"With a zero-knowledge proof (ZKP), a party can prove that a statement is true without revealing any information except for whether it is indeed true or not. The obvious benefit is privacy since the prover does not need to reveal any additional information, and the second benefit is that it can significantly reduce the cost of verifying the correctness of a statement. ZKPs are increasingly adopted in blockchain applications, where privacy and efficiency still have a lot of room for improvement. While it is expected that ZKP technology will also become ubiquitous in many other areas, the term remains cryptic to many people without a computer science background. In this review article, we shed light on what ZKPs are and how they improve privacy and efficiency and describe applications for blockchains and other use cases."

"Our analysis shows that automated loss recovery for digital cash through an expiry date could provide substantial benefits to consumers. A potentially important aspect that we consider in the paper is privacy in payments (Garratt and Van Oordt 2021, Borgonovo 2021). While our model does not explicitly account for privacy preferences, results in our paper do suggest that a digital cash that provides more privacy may achieve a higher level of social welfare despite weaker loss recovery. Finally, some consumers may feel uncomfortable with expiring digital cash for reasons that are outside of our economic model. It might therefore be beneficial to consider providing an option to allow users to opt out from automated loss recovery at their own financial risk."

"Open banking allows users to access financial information and services through consent-based data portability. This paper brings together the views of private and public experts from a wide variety of countries to explore opportunities and challenges of open banking for financial regulation, privacy protection, and competition. It discusses the different approaches taken by jurisdictions across the globe, and the importance of regulation and standards. While open banking empowers users in sharing and re-using their data across digital services, online platforms, sectors and borders, uncertainty in the interactions with data protection and privacy regimes remains challenging. This paper informs OECD work to consider how cross-sectoral cooperation between financial, competition and data protection authorities could help further open banking."

Blockchain developer Pieter Wuille unveiled two Bitcoin Improvement Proposal (BIP) that offers new plans for bitcoin's next big upgrade or "soft fork." The two proposals describe Taproot, a code change increasing bitcoin's privacy, and paving the way for privacy and scalability improvements to bitcoin.

Edward Snowden thinks Bitcoin isn't private enough-and that an upcoming software update could make it worse. Taproot, which was first proposed in early 2018, is in the process of making its way from developers' brains to the Bitcoin protocol itself. When it does come online, it's supposed to improve privacy as well as scalability and security.

"Technology gives us ways to deliver appropriate levels of privacy into this kind of transactional system and to do it securely and efficiently within a democratic framework. In particular, privacy-enhancing technology gives us the apparently paradoxical ability to keep private data on a shared or public ledger, which I think will form the basis in new financial institutions (the "glass bank" that I am fond of using as the key image) that work in new kinds of markets."

This is the fourth part in an article series by the Human Rights Foundation on privacy and cryptocurrency. This part in the series will explore private methods for acquiring cryptocurrency and stablecoins in different areas of the world.

"There is an inherent tension between government control (viewed as "safety") and individual liberty (viewed as "privacy"). And, generally, the Founding Fathers believed that liberty should prevail over government rights or this mischievous concept of "safety"."

Blockchain technology may offer greater levels of security than the internet at large, but a new research paper claims its approach to privacy may be in violation of European "right to be forgotten" laws. Once someone's details are embedded in a blockchain, the system never forgets. Those details might be encrypted, but they are also part of an irreversible ledger, and one that's on the cloud. As long as a blockchain is in existence, it clashes with the European ruling that people have the right to retract data. All of this leaves the blockchain industry in a massive quandary, because the technology's transparency and immutability is one of its biggest selling points. https://journal.acs.org.au/index.php/ajis/article/view/2801