Zimmermans' relevance for discussions on human rights and ICT-security surveillance

If we look at economic and social risks of new technologies, outsiders will often immediately fall into the trap of considering this to be about the illegal use of peer-2-peer networks, applications such as bitcoin etc, for socially unwanted activities or even criminal activities. From there on it is a small step to forbid such activity, regulate it, overregulate it. But we should take a wider perspective here.

For me, Phil Zimmerman was the person who made a lasting impact, when he explained, somewhere in the late 1990s, during a speech at a digital money conference his considerations behind developing Pretty Good Privacy (see also his explainer himself: Why I Wrote PGP). His argument was mainly that the new digital society has to be built in such a way that it guarantees a situation in which a people are still able to communicate and act in way which is not invaded or controlled by government tools/techniques. Whereas the old analogue world would allow the people smart analogue ways of creating their own spaces for communicating and fooling government with fake analogue id's and such, it would be much harder to do this in a digital world. Hence the need for a peer-2-peer simple mechanism as Pretty Good Privacy.

Zimmerman outlined one very significant theme during his speech. He noted that the assumption of a continuous benevolent government is not realistic. Governments come and go, some may be more democratic than others and even strong democracies may turn into dictatorships, depending on the circumstances. It is therefore important to design society, governments and the technologies that we use to manage society, guarantee that a balance exists between the powers of government and those of the public. The public, the people should always be allowed to remain digitally out of sight of government. Such a robust structure would be important to ensure a fair treatment of the people over a long period of time.

It is clear that this requirement: to allow for and to actually create areas where the government cannot see what happens means that those areas are scary for regulators. Will they facilitate crime by doing so? Perhaps. Will they allow for huge pockets of creativity? Certainly ! But it will be the strong governments that are able to allow this. They will act from a position of strength and not be afraid. The weak governments, or the scary governments, or the ill-intending governments will seek to monitor everything and control all digital activities. This will certainly fail. But while doing so, they may instil tools that are very dangerous tools in the hand of governments when they turn from benevolent to evil. It will tilt the balance towards a situation that ill-intending governments can no longer be overturned by a social revolution.

There is no need for governments to be afraid of technological progress in the hands of the people. It is a good thing, to be cherished and to be allowed. The simple labelling of such activity as possibly criminal is the wrong frame. The reverse is also wrong: regulators with good intentions are not by definition tools in the hands of dictators. The right frame is: dictators exist just as criminals. Society should ensure that neither of these can become too powerful due to technological of legal measures and it is for this reason that we need to balance our human rights to privacy with the goal to prevent criminality.

Finding this balance is not easy but over the last weeks we have witnessed too many occasions where governments seem to go to far. German police wanting access to home devices. The FATF-ruleon surveillance for virtual assets. Ghost accounts into Whatsapp. Giving your social media handles when entering the US. We should not let ourselves be caught in this wrong direction over intrusive government behaviour.

There is a very legitimate reason to develop and create new technologies that safeguard the public and it is a pity that many policy makers in the world may not have been hearing the clear message that Phil Zimmerman sent them. They really could do with open their minds more. So for them I’m embedding this video. Just to be able to learn from history.

Satoshi rumours reminds me of being John Malkovich

These days, there's a rumour going around that an Australian guy would actually be Satoshi, the inventor of bitcoin. Next morning, this guys house was raided by the police, in search of all kinds of evidence.

To me, it seems sufficient evidence to assume that the true Satoshi will choose never to reveal his or her identity. If all kinds of law enforcers incorrectly wish to blame the inventor instead of the users of his invention, you better steer clear of such hassle.In addition I could well imagine Sathoshi to be a bit of a hermit.

In that sense, even getting a Nobel price or the Turing Award would make no difference. We won't know who Satoshi is, which means we may get stuck with all kinds of impersonisations of him. Which reminds me of the movie: Being John Malkovich (see trailer here) .

In the movie, people may enter the brain and become John Malkovich for some time, until being spit out and landing at the side of a road. My best guess is that we will witness similar events for those who wish to be Satoshi.

ECBs renewed virtual currencies report: implications for the Third Payment Services Directive

This week the European Central Bank (ECB) revisits the subject of virtual currencies (VCS) in a renewed virtual currencies report with a further analysis. I have read the publication with interest to discover that the previous position on the subject essentially remains the same:
- virtual currencies don't come near money or legal tender concepts,
- the uptake of virtual currencies is still very limited
- the wait and see approach of the ECB will be continued.

The typical paragraph that summarises this approach is:
The usage of VCS for payments remains limited for now, which implies that there is not yet a material risk for any central bank tasks, including promoting the smooth operation of payment systems. However, a major incident with VCS and a subsequent loss of trust in VCS could also undermine users’ confidence in electronic payment instruments, in e-money and/or in specific payment solutions. 

Whereas at first sight the report doesn't lead to a lot of new insights, the broader scope of its definition of virtual currencies does beg a number of fundamental questions with respect to the future regulation of payments. These questions lead me straight into a renewed regulatory approach, to be used in the Third Payment Services Directive.

An improved definition
The major improvement of this Eurosystem-report over the previous one lies in its correction of the definition used for virtual currencies. In an earlier blog I commented that the definition was too vague:
“A virtual currency is a type of unregulated, digital money, which is issued and usually controlled by its developers, and used and accepted among the members of a specific virtual community”.
With this report, the definition of virtual currencies has formally changed into:
"a digital representation of value, not issued by a central bank, credit institution or e-money institution, which, in some circumstances, can be used as an alternative to money."

I am quite pleased with this change as it allows for a better understanding and classification of the subject of virtual currencies. Interestingly, the elimination of the element of decentralized issuance leads to a far broader range of virtual currencies than previously discussed. And this leads to an interesting follow up question.

Virtual currencies are suddenly everywhere... 
The table below lists the major payment options in the Netherlands, with the virtual currencies listed at the far right. When looking at the turnover figures, one can understand why the Eurosystem will be primarily monitoring the virtual currency scene. The most interesting observation is however that all the blue coloured segments of the table are now also considered to be virtual currencies.

We can see that in particular the giftcard and transport payments (which are out of scope of the payment regulations for a number of reasons) do amount to quite a substantial payments volume. Literally these payments are now also considered to be payments with virtual currencies. And from an analytical perspective, this is a logical consequence.

Regular (e-) payments	OV-Chipcard	Mobile telephone	Retailer Giftcards	Bitcoin / alt-coins
16 million per day	5 million per day (includes loads)	Premium services	500.000 - 1.000.000 per day	Less than 1000 trx per day in NL
€ 903	€ 2 - € 20	€ 2- € 5	€ 12	€ .?
Payment Services Directive (PSD)	Exemption under PSD1	Explicit exemption of PSD1	Out of scope when issued as a single retailer	Out of scope of PSD

Effectively we can now better appreciate today's payments world, seen from the eyes of the consumer. Because the consumer is not bothered by the details of Payment Services Directives and obscure exemptions of mobile payments. The consumer will use the mobile or ticketing payment means as a matter of convenience (or: obligation) and will have to undergo the payment experience as a fact of life.

Particularly in the Netherlands this leads to the interesting situation where a sloppy and easily hackable implementation of NFC is being widely used for public transport payments, alongside a safer NFC implementation of banks that is still working on its nationwide roll-out. Users use them both.

Similarly interesting was the occurrence, last month, of a virtual currencies bank run. As retailer V&D threatened to go out of business, one could witness the sale of its pre-paid gift cards on Marketplace (the Dutch ebay) for considerable discounts. At the same time everyone in the Netherlands dug up and spent their old gift cards, before it was too late.

What the third Payment Services Directive will have to look like 
If we take the wider definition of virtual currencies that the ECB uses, it becomes clear that the user experiences with virtual currencies (and losses: for example the sudden vaporisation of retailer gift card value after a period of 18 months) happen alongside the heavily PSD-regulated instruments and mechanisms.

Based on some prudential rules we now burden some forms of payments with a whole lot of rules, while we neglect all schemes that are out of scope (but may still have relevant consumer effects). This difference is - in my view - too big and requires a changed approach to be used for the Third Payment Service Directive (PSD3).

Under the Third Payment Service Directive, we should recognise that payments can and will be made and offered by everyone to everyone. The PSD3 should thus define a light-weight conduct supervisory framework for all payment mechanisms, regardless of the institutional status of the issuer. Alongside this wide conduct framework, we keep the current prudential framework intact, which outlines the prudential rules applicable to the different institutional payment setups (e-money, payment institution, bank).

The new conduct based framework would apply to payment mechanisms and e-money alike and have as a goal that the user is always properly informed on the basic terms and conditions, redeemability etcetera. The control-mechanisms should not be supervision based, but could be reputation-based for example, allowing the market to monitor and redress, rather than costly supervisors. Only in exceptional circumstances would a European conduct supervisor step in.

In sum: more analysis ahead
The broader scope of the Eurosystems definition of virtual currencies begs a number of fundamental questions with respect to the future regulation of payments. In particular the area of non-regulated payment schemes at the fringes of the PSD might deserve more attention than they do receive right now.

Not only could the question be whether or not a separate regulatory conduct-framework should apply, the European Retail Payments Board might also decide to expend its analysis towards these mechanisms, particularly when they reach a volume/scale which is equivalent to that of the regular payments.