Nouriel Roubini on the Big Blockchain Lie

Arcade token

As I have written a number of times already, including in my previous post, I still don’t get (i) why cryptocurrencies create better market conditions for building ventures than good old fashioned money, and (ii) why tokenization – instead of just giving investors and workers plain old money – is the only viable path to building a successful business in the digital era. And when the answer comes in the form of a libertarian soundbite about democratization of money, the burden of regulations or the end of intermediation, I am convinced the speaker knows nothing about history, technology or business. The answer has sham (or gullible) written all over it.

That, of course, doesn’t mean that I don’t believe in distributed ledgers (aka Blockchain technologies) as interesting solutions for solving some important transactional inefficiencies. It’s the whole obsession with tokenization and refusing to use real money that baffles me.

With this in mind, I was very encouraged by a series of Nouriel Roubini tweets over the weekend where Roubini – who made a public name for himself by being one of the few, brave souls to openly predict the 2008 economic crash – unabashedly called out the willful blindness, ignorance and outward deception of Crypto’s most ardent supporters. For example:

I wrote a 30 page testimony that was a thoughtful critique of crypto and blockchain. And no one, not even @VitalikButerin was able to give me a rebuttal of it. Only 100s of rabid crypto barking dogs hurling insults and threats. It says a lot about the intellect of these losers https://t.co/c4eKa3wESc

— Nouriel Roubini (@Nouriel) October 12, 2018

So instead of trusting governments I need to trust an oligopoly of Chinese miners who are shady and plan to shaft me? Get real once and for all: there is NO decentralization in crypto. It is a myth. It is a system controlled by a shady oligopoly of miners in shadier countries https://t.co/OJYCTKsrJ6

— Nouriel Roubini (@Nouriel) October 14, 2018

So the cost per transaction of bitcoin is literally $60. So if I were to buy a $3 latte at Starbucks I would have to pay $63 to get it! So the myth of a “Brilliant new technology that reduces the vast fees of legacy financial systems”! turns out to be a Big Fat Lie! https://t.co/vcOGTNcu7N

— Nouriel Roubini (@Nouriel) October 14, 2018

Bitcoin is indeed an environmental disaster https://t.co/65JMcv3Do3

— Nouriel Roubini (@Nouriel) October 15, 2018

Then this morning, Roubini published this must-read article “Blockchain isn’t about democracy and decentralization – it’s about greed” where he makes all of the aforementioned arguments about the false narratives around cryptocurrencies, including:

In practice, blockchain is nothing more than a glorified spreadsheet. But it has also become the byword for a libertarian ideology that treats all governments, central banks, traditional financial institutions, and real-world currencies as evil concentrations of power that must be destroyed. Blockchain fundamentalists’ ideal world is one in which all economic activity and human interactions are subject to anarchist or libertarian decentralization. They would like the entirety of social and political life to end up on public ledgers that are supposedly “permissionless” (accessible to everyone) and “trustless” (not reliant on a credible intermediary such as a bank).

Yet far from ushering in a utopia, blockchain has given rise to a familiar form of economic hell. A few self-serving white men (there are hardly any women or minorities in the blockchain universe) pretending to be messiahs for the world’s impoverished, marginalized, and unbanked masses claim to have created billions of dollars of wealth out of nothing. But one need only consider the massive centralization of power among cryptocurrency “miners,” exchanges, developers, and wealth holders to see that blockchain is not about decentralization and democracy; it is about greed.

But he also makes an interesting observation about the non-crypto part of Blockchain as well:

Moreover, in cases where distributed-ledger technologies – so-called enterprise DLT – are actually being used, they have nothing to do with blockchain. They are private, centralized, and recorded on just a few controlled ledgers. They require permission for access, which is granted to qualified individuals. And, perhaps most important, they are based on trusted authorities that have established their credibility over time. All of which is to say, these are “blockchains” in name only.

It is telling that all “decentralized” blockchains end up being centralized, permissioned databases when they are actually put into use. As such, blockchain has not even improved upon the standard electronic spreadsheet, which was invented in 1979.

No serious institution would ever allow its transactions to be verified by an anonymous cartel operating from the shadows of the world’s authoritarian kleptocracies. So it is no surprise that whenever “blockchain” has been piloted in a traditional setting, it has either been thrown in the trash bin or turned into a private permissioned database that is nothing more than an Excel spreadsheet or a database with a misleading name.

I absolutely agree, and for the reasons he states, I actually like private blockchains. Not to change the world, but to improve processes. And if you control those spreadsheets, you are able to give your customers much more flexibility, protection and value. Works for me!

On Talking about Blockchain at South Summit

South Summit

South Summit which aspires to be the “the Leading Innovation Global Platform focused on business opportunities and disruptive trends, that gathers together the entrepreneurial ecosystem” was held last week in Madrid. My employer, Amadeus, was a big contributor to the summit both as a sponsor and by providing speakers on various items related to travel and technology. In a strange twist of fate, my very generous colleagues in the Amadeus Corporate Strategy team – who must know that I adore the stage — asked me to represent Amadeus on a panel about “Rebuilding Industry through Blockchain”. How could I say no to the limelight?

Besides me, the panel consisted of a serial entrepreneur/angel investor, the head of Blockchain at a major Spanish bank, and a Palo-Alta based VC. While the other panelists focused on Bitcoin and the case for cryptocurrencies, I discussed the four main uses cases that Amadeus has identified for the technology: managing traveler identity, more user-friendly loyalty programs, improving payment settlements, and baggage tracking. And while everyone else on the panel hailed Blockchain’s potential to disrupt intermediation in raising capital, I stressed that when evaluating the technology’s use cases, we had to take into account our B2B customers’ needs as well as those of travelers, and that to date the biggest problem our industry faces with Blockchain is that it simply does not meet our customers or their consumers’ demand for real-time transactions, inter-operability and customization.

So imagine that if Visa or Mastercard can process 5,000 transactions per second with the capacity to process more, Bitcoin can only process 12 per second but with the first transaction taking 10 minutes to settle. From what I understand, Amadeus processes over 50,000 transactions per second and over 50 million per day. Slowness and an IT platform’s inability to adapt on demand to customer-specific modifications and enhancements are show-stoppers in our industry. This doesn’t mean that Blockchain is not suitable but that for services like shopping, today the technology is just too slow and missing the necessary interfaces in order to make it end-user friendly.

When we got to the topic of whether cryptocurrencies were a valuable means for start-ups to raise capital, my fellow panelists were all very enthusiastic. As Amadeus does not have a position on cryptocurrencies, I kept my opinion to myself. Personally, I don’t buy the emotional argument that cryptocurrencies give more “control” to the individual over his money, or that they ultimately add value and enhance the marketplace for new ideas in ways that fiat money and the current regulations cannot.

Quite the contrary: investors want liquid markets where they can easily get their money in and out of ventures. Furthermore, efficient market theory tells us that the value of a security should reflect all available information in the market. Tech entrepreneurs may love the idea that they can cheaply raise large quantities of cryptocash without the costs and hassles of having to comply with regulations, but in the long run transparency and certainty create dynamic markets. You can raise more money on the U.S. stock exchange than say on the Indonesian one because investors know that they can easily exist an investment and that the market is efficient.

With the original securities acts of 1933 and ’34, the U.S. government wasn’t trying to protect the sophisticated investor from big corporate greed. The regulations were designed to protect the unknowing from being bamboozled by scams and ponzi schemes. They demanded transparency and disclosure of risks, exactly what today’s ICO market tends to lack with fairly scandalous, yet predictable results:

New data from Fortune Jack has found that ten of the most high-profile ICO scams have swindled a staggering $687.4 million from unsuspecting investors.

A recent study prepared by ICO advisory firm Statis Group revealed that more than 80 percent of initial coin offerings (ICOs) conducted in 2017 were identified as scams. The study took into consideration the lifecycle of ICOs run in 2017, from the initial proposal of a sale availability to the most mature phase of trading on a crypto exchange.

And if you thought you had just raised $30 million over night in Bitcoin, what is your money worth today?

Bull run? Crypto-currencies are bust. BTC down 70% this year. Other major ones down 80%. The rest down 95%. Major cryptos down another 10% yesterday alone. In which La La Land do these Crypto Lunatics live? They can’t think as they lost 90% in less than a year. Wake up! https://t.co/dFQIJ6oRJR

— Nouriel Roubini (@Nouriel) October 11, 2018

So why should we think that the marketplace needs cryptocurrencies to raise capital? Certainly new ventures like AirBNB, Whatsapp, Facebook, WeChat, Twitter, Instragram, Uber, Booking.com etc successfully raised capital with old fashioned money. The more I hear someone claim that cryptocurrencies will democratize money, the more I am convinced that the speaker has either absolutely no idea what he is talking about or is full of crypto-crap. That doesn’t mean that the current VC model is not a scam itself. To a certain degree it is. But paying workers in tokens instead of money or promising investors they’ll get rich quick without full disclosure is not the solution. It’s a swindle.

If you ask me, we shouldn’t be talking about Blockchain at all. Yes, I think it will be an important back-office tool to improve efficiencies, but not life-altering. What we should all be talking about is Artificial Intelligence which — for better or worse — is the real game changer.

Finally, I really enjoyed the opportunity to speak at the event. When I got off stage, I remembered something that Bill Clinton once said shortly after leaving the presidency: the hardest thing about no longer being president was walking into a room and not being greeted with the presidential anthem. In other words, being on stage is addictive. It feels good to be listened to and treated with undeserved respect. Earlier in my career, I spent a lot of time speaking in public, and last week at the South Summit, I remembered how much fun it was to be on center stage, especially when afterwards you get to interact with very smart people. And the icing on the cake: running into friends and former colleagues at South Summit and reminiscing about the good old days.

Thanks all around to everyone involved, especially my excellent colleagues in CST.

Why Technology Favors Tyranny

Harari Technology Tyranny.png

You all are going to think I am the Grim Reaper of new technologies, crying that the sky is falling at every turn. Yes, I am using this blog as a forum – amongst other things — to discuss the difficult decisions that businesses, lawyers and society need to face when looking at how new technologies like Artificial Intelligence, Blockchain and Biometrics may impact our lives. (examples, here, here and here).

Working for a tech company that invests millions in innovation, I am very interested in seeing how we can use new technologies to improve society. But in order to do that, we need to be very vigilant. The consequences of not doing so could be disastrous and significantly change the course of humankind.

Am I exaggerating? In a must read article in The Atlantic, Yuval Noah Harari (author of Sapiens: A Brief History of Humankind and Homo Deux: A Brief History of Tomorrow) makes precisely that argument:

More practically, and more immediately, if we want to prevent the concentration of all wealth and power in the hands of a small elite, we must regulate the ownership of data. In ancient times, land was the most important asset, so politics was a struggle to control land. In the modern era, machines and factories became more important than land, so political struggles focused on controlling these vital means of production. In the 21st century, data will eclipse both land and machinery as the most important asset, so politics will be a struggle to control data’s flow.

Unfortunately, we don’t have much experience in regulating the ownership of data, which is inherently a far more difficult task than regulating land or machines. Data are everywhere and nowhere at the same time, they can move at the speed of light, and you can create as many copies of them as you want. Do the data collected about my DNA, my brain, and my life belong to me, or to the government, or to a corporation, or to the human collective?

. . . Currently, humans risk becoming similar to domesticated animals. We have bred docile cows that produce enormous amounts of milk but are otherwise far inferior to their wild ancestors. They are less agile, less curious, and less resourceful. We are now creating tame humans who produce enormous amounts of data and function as efficient chips in a huge data-processing mechanism, but they hardly maximize their human potential. If we are not careful, we will end up with downgraded humans misusing upgraded computers to wreak havoc on themselves and on the world.

If you find these prospects alarming—if you dislike the idea of living in a digital dictatorship or some similarly degraded form of society—then the most important contribution you can make is to find ways to prevent too much data from being concentrated in too few hands, and also find ways to keep distributed data processing more efficient than centralized data processing. These will not be easy tasks. But achieving them may be the best safeguard of democracy.

The world my children and their children will inhabit will be vastly different from ours in ways we cannot even begin to imagine.

Five Things Companies Can Do

fb congress

Earlier this week I wrote a long-winded post describing steps companies can take – in light of recent concerns about companies misusing personal data – to make sure their technologies are offering us all something of value.

Here are the five things, in abbreviated form, that companies can start doing now:

Privacy by Design (and security by design): Put the end user at the center of your technology’s architecture, minimize the amount of personal data you will need to provide the service, give the end-user control, and be transparent. If you concentrate on what the end user will be comfortable with and empower her with control over her data, then you are on the right track.
Value Proposition: Make privacy protections and good practice a central point of differentiation. Make it core to your overall value proposition.
Business Model. Re-think the business model. Propose different fee structures or revenue sharing options that give end users more control and something of value in return for handing over their data.
Product Ethics: Before thinking about the legality of a new product or service, focus on it from an ethical viewpoint. Consider a products ethics committee, including bringing in an ethicist. Look not just at data use but the potential for a product or service to be misused (even if hacked) with results that are contrary to the company’s values. Remember the last thing you want is for your CEO to have to sit in front of lawmakers struggling to explain why your service was linked to a major human rights violation, political scandal, or massive leak of sensitive personal data.
Data Use as a Corporate Social Responsibility: Make data use and innovation part of your company’s CSR policies where you commit to (i) not use the personal data and technology at your disposal in a way that has a negative effect on your community and stakeholders, and (ii) affirmatively use technology and innovation for the good of your community and stakeholders.

Put all together, the most important thing a company can do is to take the time to have open, internal conversations about the effects that its products and services may have on users and society. That way senior management can make informed decisions in line with the companies core values and identity. Lawyers don’t like surprises, and neither do their client.

The Cryptocurrency Swindle

Arcade token The more I hear Blockchain evangelists preach about tokenization and how cryptocurrencies will democratize technology, the more I am convinced that cryptocurrencies are one big swindle. I have already discussed this more in depth here, but allow me to add a few more points.

As mentioned, the reasons for tokenizing Blockchains would be:

To incentivize developers/computer owners (aka, miners) to verify transactions on the Blockchain and support and maintain the platform
Financing of start-ups (ICOs)
To bring more transactions to a platform
To engage in unregulated transactions (ie, black money)
Speculation

With the exception of engaging in unregulated transactions, there already exist well established and extremely successful and effective means for meeting those objectives. Yet the crypto-pushers – other than rolling off catchy soundbites about democratization and oppressive regulators – haven’t made a compelling case why tokenization is so central to the success of Blockchain-based technologies.

So what makes a Blockchain start-up so uniquely different from any other tech venture? Weren’t Facebook, Google, Microsoft, and Apple all built from scratch without the need for raising capital through tokens or paying their developers in tokens? Why shouldn’t companies financing through cryptocurrencies be required to disclose to investors and consumers the same amount of information they would if they were issuing other types of securities? What is the benefit to investors, consumers and society from having less access to information or fewer legal protections against fraud?

And what is so democratic about paying your labor force in kind from the company store? That reeks of crypto-feudalism. It’s like a drug lord paying his corner dealers in product. The dealers can then decide whether to resell their cut of the product or to use it themselves. In fact, that is exactly how so many dealers become junkies or enter the game. So why not pay them with money they can freely exchange? And if the solution is to have one or two major cryptocurrencies, then how is that so different from just using US dollars or Euro? Or are the crypto-pushers too naïve to see that the most likely result of a successful cryptocurrency economy is that corporations end up issuing their own coins and control money supply? Instead of democratization and disintermediation, you are left with a Brave New Crypto World? FB Money

This is all reminiscent of the Web 2.0 bubble when VCs and entrepreneurs were trying to make a quick billion by selling user generated infrastructure. The idea was that if you had a big enough user base – to whom you gave stuff to for free in order to build your network – a big company would buy your user base even though your network was not profitable. The exit strategy was the entire business model. Now it seems like the crypto-pushers are looking to raise a quick million without having to build a sustainable or even convincing business model, while hoping they can get the open source developer community to finance, build and maintain their infrastructure, if not for free, with an I-owe-you executable at the company store.

It’s a shame because if you ask me, tokenization is a major distraction from the real value of Blockchain-based technologies. The major challenge for Blockchain is not how to tokenize or make bank, but how to find scalable use cases for a technology whose main value at the end of the day is the not very sexy back office task of processing and recording transactions.

Maybe the GDPR Isn’t So Bad for Blockchain After All?

In two recent posts, thinking that I was really smart and clever, I questioned whether the GDPR posed a major hurdle for Blockchain-based technologies. Again, thinking that I was so smart and clever, I proudly took my arguments to one of my favorite privacy lawyers, confident I was about to impress her.

And as is often the case when I am feeling smart and clever, I was quickly put in my place by someone who actually knew what she was talking about. First, let’s be fair to me. The GDPR does pose challenges for Blockchain-based technologies, as it does for any service whether on or offline that stores personal data. Data controllers will need to procure consent from data subjects and storage of data will need to be limited in time based on the purpose for which it is being stored.

The concern I originally raised was the conflict between Blockchains’ main feature of creating a permanent and unalterable record with the legal rights of a data subject to be able to modify or delete her personal data upon request (aka, the right to be forgotten). But a much smarter and more clever colleague – let’s call her Jane – explained to me that the right to be forgotten is not absolute.

Imagine you buy property. The local property registrar records the purchase with your name listed as the property owner. You may later sell that property, but you do not have a right under the GDPR to have your name removed from the public records relating to your purchase and ownership of that property. The purpose of registering property ownership is to have a permanent record of chain of ownership.

To the same extent, should you consent to making a transaction through a Blockchain-based service where you have knowledge that the record of that transaction will be permanent, your right to delete your personal data only comes into play when the purpose for retaining your data ceases to exist. For a Blockchain, that will likely be never.

power article

Think of a newspaper that publishes an article which features my name. The newspaper circulates thousands of copies. Like a Blockchain, the newspaper is distributed amongst thousands of people who have copies of the exact same story. We can verify that a single copy of that story has not been manipulated because we can compare it with thousands of other ones. Fake news aside, newspapers have the goal of being official accounts of events or newspapers of record. We should not then expect that upon request, every library and individual who has a copy of that newspaper article be required to destroy it or remove my name. Besides not being practical, it is contrary to the reason for having newspapers in the first place.

This morning I read a recent Grant Thorton report written by the Spanish lawyer Sara Esclapés Membrives on how the GDPR actually presents an opportunity for Blockchain-based technologies. The report corroborates Jane’s interpretation of the law, stating that the challenge for a Blockchain is to find methods for the future removal of an individual’s personal data “when the purpose for which the data were collected has finished.” But as with the newspaper example, the purpose of storing data in the Blockchain is permanency, which means that unless the Blockchain ceases to have activity and a reason for remaining in existence, it should be allowed to continue storing my name without me being able to invoke the right to erase my personal data.

Ultimately Blockchain-based technologies that store personal data need to focus on privacy by design, meaning developing an architecture that maximizes the individual’s ability to grant consent and opt-out of the service while providing the appropriate level of security for the storage of the data. But more importantly to be commercially viable, these technologies need to gain consumers’ confidence and trust. Otherwise consumers will not be comfortable sharing their data and will simply not use the service.

The Future of Money

FB Money

Last year CNN asked “What if Companies Issued their own Currency” where printed money bore the images of corporate celebrities instead of George Washington or European landmarks. Although neither George Orwell or Aldous Huxley’s dystopian futures predicted a world governed by corporations as opposed to authoritarian governments, it may be more plausible to imagine a world where corporations control the money supply, not with coins and bills but cryptocurrencies. In fact, the fad amongst many technologists today is to encourage the disintermediation (or deregulation) of money by moving to Blockchain-based cryptocurrencies like Bitcoin. But instead of removing the middleman, we are more likely – contrary to the idealists’ ambitions — to open the door to empower big tech companies like Amazon, Facebook and Google to tokenize their platforms, replacing one currency regulator with corporate ones. Let me explain.

At the beginning of the year, the encrypted messaging system Telegram announced plans to issue its own cryptocurrency. Telegram’s vision was to create its own Blockchain-based cryptocurrency around its chat-service where its users could engage in all sorts of transactions and make payments through Telegram’s own digital platform. By leveraging the mass hysteria around Bitcoin, Telegram hoped to raise tens of billions of dollars in financing from its ICO.

An ICO (or Initial Coin Offering) is the process of raising capital through the use of cryptocurrencies, instead of issuing debt or equity. For those new to the concept, cryptocurrencies (to paraphrase Wikipedia) are digital assets designed to work as a medium of exchange (generally through a Blockchain) that use cryptography to secure transactions, control the creation of additional units (ie, the monetary supply) and verify the transfer of assets.

Arcade token Think of cryptocurrencies as those tokens at a video arcade where in exchange for hard currency (or services), you are given tokens that can be used at the arcade. The tokens would generally have no value outside of the arcade, unless there is demand for exchanging goods, services, or other currencies for those tokens.

With an ICO, an investor acquires those tokens, which may be either the issuer’s own (often newly) minted token or another existing one like Bitcoin or Ether. As mentioned, the tokens acquired through the ICO are not debt or equity. They are digital claims to future rewards or services. Investors acquire the tokens in expectation that there will be a dynamic market to buy, sell, or transact using those tokens. Because the tokens are exchanged on a Blockchain, each transaction is logged and permanently traceable (though encrypted). In theory, an ICO is more cost effective than a traditional securities offering because it does not require the efforts of a VC or financial institution and is not regulated.

Well, we thought ICOs were not regulated. According to the Wall Street Journal, a number of companies that issued ICOs are currently being investigated by the US Securities and Exchange Commission.

The sweeping probe significantly ratchets up the regulatory pressure on the multibillion-dollar U.S. market for raising funds in cryptocurrencies. It follows a series of warning shots from the top U.S. securities regulator suggesting that many token sales, or initial coin offerings, may be violating securities laws.

One might cynically say that regulators are predisposed to dislike cryptocurrencies because they cannot control them. On the other hand, if ICOs are not regulated, then there will always be a risk to the consumer, something that the 1933 and ’34 Securities Acts were designed to address with significant success over the past century. As mentioned in the article:

Many of the coin offerings happen outside the regulatory framework designed to protect investors. Hype around last year’s bitcoin bubble led to many cryptocurrency offerings for startup projects. Some of them had little, if any, basis in proven technologies or products, and many were being run outside the U.S. In some cases, investors caught up in schemes that turn out to be fraudulent may have little hope of recovering their money.

A soon-to-be published Massachusetts Institute of Technology study of the ICO market estimates that $270 million to $317 million of the money raised by coin offerings has “likely gone to fraud or scams,” said Christian Catalini, an MIT professor.

Overall, there are a number of reasons for dealing in cryptocurrencies:

To incentivize developers/computer owners (aka, miners) to verify transactions on the Blockchain and support and maintain the platform
Financing of start-ups (ICOs)
To bring more transactions to a platform
To engage in unregulated transactions (ie, black money)
Speculation

As mentioned, companies like Telegram and many technologists (even some investors) may also find the use of a cryptocurrencies attractive because they have largely been outside of the control of governments and regulators. But this raises the question about whether fiat money is actually more stable than cryptocurrencies and therefore in the long run better suited for investors and society. One of the foremost concerns of any investor is that she has a viable exit, meaning that she is investing in a liquid market where she can put in and take out her money easily. So the question is whether a cryptocurrency can give the same stability that a government-backed currency can.

When you start thinking about Telegram creating its own private market of tokens for transactions through its chat platform, remember going to the video arcade to play PacMan and having to convert your money into tokens. Now imagine a future where Amazon does the same thing. It issues its tokens that become the only currency available for transactions on amazon.com. Then imagine trying to download apps, stream music, movies or other content on your Apple devices and having to use Apple tokens. Maybe each major platform will have its own tokens, and its developers and maintenance crews (aka miners) will get paid in their employer’s respective cryptocurrency. Workers will only be able to spend their hard earned salary at the company store. We can call it the digital hacienda or crypto-feudalism. Welcome to the new crypto-world order.

When you were a kid at the arcade you had no problem spending all of your tokens at once before your parents dragged you home. But as an adult, if you have your money tied up in Amazon tokens, WeChat tokens, or Facebook tokens, what happens when that company goes bankrupt? Or what is the conversion rate from one token to the other? Wasn’t the advantage of using US greenbacks that they were backed by the U.S. Fed, were easily exchangeable and that US government wouldn’t go under? Will these companies have to create their own monetary departments to control the supply of their tokens, and fight against inflation? In other words, instead of removing the role of central banks, companies would become central banks themselves. In fact, the more I read about cryptocurrencies, the more the macroeconomic fundamentals behind hard currencies makes sense. Or I am just old fashioned?

Hey Mr. Blockchain, the GDPR is Coming at You Fast

etch a sketch

Last week I wrote about the upcoming GDPR and mentioned that it posed a potential risk for Blockchain-based technologies:

The more I think about it, the more I see the GDPR posing a problem for a Blockchain’s permanent, irreversible and inerasable ledger whenever any personal data (even when encrypted) is included in a node. Individuals will have the right to delete their data and be forgotten. If one of the values of Blockchain technology is that no one person or entity can modify a node, then the Blockchain will need to modify its architecture and governance to allow for such node modification. And if it is a public Blockchain with no centralized intermediation, then who is the data controller? And who will be able to delete your data upon your request and protect your rights? Will each miner become a data controller, potentially subject to fines?

Just now I read that Blockchain is on a collision course with the new GDPR, making my same exact point:

The bloc’s General Data Protection law, which will come into effect in a few months’ time, says people must be able to demand that their personal data is rectified or deleted under many circumstances. A blockchain is essentially a growing, shared record of past activity that’s distributed across many computers, and the whole point is that this chain of transactions (or other fragments of information) is in practice unchangeable – this is what ensures the reliability of the information stored in the blockchain.

For blockchain projects that involve the storage of personal data, these two facts do not mix well. And with sanctions for flouting the GDPR including fines of up to €20 million or 4 percent of global revenues, many businesses may find the ultra-buzzy blockchain trend a lot less palatable than they first thought.

€20 million is a great incentive for technologists to find creative ways to keep personal data outside of their Blockchain aspirations. Start the brainstorming now!

Challenges Blockchain May Face

Sara Pavan We keep hearing that governments will kill cryptocurrencies or at least regulate them to death. They fear what they cannot control (or tax). I tend to keep a more open mind.

But according to my colleague Sara Pavan, Blockchain currently has other pressing challenges:

Scalability is a major concern: most existing blockchains (Bitcoin, Ethereum, etc.) have significant scalability challenges. For example, the Bitcoin network can only process about 7 [transactions] per second. In comparison, Amadeus processes 100,000 end-user transactions per second in peak times.

Transaction cost will be another issue to consider. Blockchains typically require a lot of computing resources given that data is held multiple times and there is significant cryptographic computation to be undertaken.

In systems like Bitcoin and Ethereum, this means there is often a prohibitive fee associated with each transaction, which can represent several percentages of the value being exchanged, making them inappropriate for many use cases.

Finally, integration with existing systems will be another major hurdle. Today it is hard to make blockchain interoperable with existing IT systems.

If a hotel booking is made on a blockchain system, how will it integrate with a system that isn’t on blockchain?

Even if Blockchain technology could eventually be faster and less expensive, one of Blockchain’s key raisons d’être – to squeeze out the middleman – may have its own challenge. From what Sara says intermediation isn’t going anywhere and will continue to be central to the value chain in a Blockchain world. Beside needing someone to establish and evolve a Blockchain’s governance and drive critical mass, you will always need someone to build interfaces and applications, and support, maintain and enhance them. It’s like the Internet. We love it, not because it has value in and of itself, but because of the Facebooks, Amazons, and millions of other intermediaries that deliver content, products and services to our screens (or with Siri, Alexa etc to our ears).

And what happens when Blockchain’s other key selling point of secure and trusted transactions is blown to smithereens by faster encryption-busting technologies? What if what we are hearing about quantum computing is true?

. . . the advent of quantum computing will jeopardize the security of all existing cryptographic encryption methods, including RSA tokens. Quantum computers will affect the security of the entire finance and banking industry, not just the blockchain.

Even so, I’m surprised that security is not a more common conversation throughout the blockchain community. For a group deeply rooted in futurism, this seems shockingly shortsighted. It feels as if we’re building the blockchain for the next 50 years, but what if we only get to the next five or 10? What can be done to ensure that blockchain is dynamic enough to outlive quantum computing?

I tend to be an optimistic skeptic, meaning that I don’t trust the hype but trust that there is always a solution to every problem. As a lawyer, though, the solution is usually an imperfect negotiated one.

The GDPR is Coming

Paul_Revere's_ride — A very American icon for a very European law

The GDPR is coming, the GDPR is coming. At a recent offsite leadership meeting I attended with the business unit I support, I was dubbed Mr. GDPR. They all knew it was coming and because I am their lawyer, I became their GDPR guy.

To be honest, I am no GDPR expert and certainly don’t want to become one. I have these really great privacy lawyers who sit next to me. They answers my questions but more importantly help steer our company in the right direction to make sure that data privacy is one of the key value propositions we offer our customers.

Because the GDPR is coming, it is worth saying something about it here. Today I read eMarketer’s Western European Digital Trends for 2018 which gave an excellent summary of how the new law will affect companies and consumers:

GDPR requires that any entity collecting or handling consumers’ personal data must know how and where those processes take place, what data is kept, where it is kept, where it goes if it is distributed further, and how data integrity is preserved at every point where that entity is responsible—and be prepared to divulge those details. The rules also require digital devices and browsers to make consumers aware that their data is about to be collected, and let users make a single decision about how their data can be gathered and handled, which all companies, websites and apps must adhere to. Individuals will be able to refuse any entity access to their personal data. Individuals will also be empowered to access, manage and delete their personal data held in digital databases. Firms failing to comply face a fine of €20 million ($22.1 million) or up to 4% of global revenues, whichever is greater.

In a December 2017 blog post, Jean-Michel Franco, senior director of product marketing at Talend, wrote that “the stakes go well beyond regulatory compliance. In this data-driven world, trust has become the new currency. Now that insights and innovations depend on big data, there’s no option but to have total control [over] your data, otherwise, your customer won’t buy in. … Most of the privacy rules that come with GDPR were already expressed in former regulations, but the principle of accountability makes it game-changing.”

This will likely pose a challenge to companies like Google and Facebook who want you to give it away when using their platform. I mean give it all away: your photos, your posts, your instant messages with very limited ability to opt-out without having to forgo using the entire platform. This is from an article on how the GDPR will disrupt Google and Facebook from last summer:

Google and Facebook cannot confront their users with broad, non-specific, consent requests that cover the entire breadth of their activities. Data protection regulators across the EU have made clear what they expect:

“A purpose that is vague or general, such as for instance ‘Improving users’ experience’, ‘marketing purposes’, or ‘future research’ will – without further detail – usually not meet the criteria of being ‘specific’”.

A business cannot, for example, collect more data for a purpose than it needs and then retroactively ask to use those data for additional purposes.[4]

It will be necessary to ask for consent, or present an opt-out choice, at different times, and for different things. This creates varying levels of risk. We estimate these risks on the “GDPR scale”, shown below.

The scale ranges from zero to five. Five, at the high end of the scale, describes the circumstances that many adtech companies that have no direct relationship with Internet users will find themselves in. They need to get the consent of the people whose data they rely on. But they have no channel of communication through which they can do so.

Four, next highest on the scale, refers to companies that have direct relationships with users, and can use this to ask for consent. However, users have little incentive to “opt-in” to being tracked for advertising. Whereas a user might opt-in to some form of profiling that comes with tangible benefits, such as a loyalty scheme, the same user might not be willing to opt-in to more extensive profiling that yields no benefit. The extensiveness of the profiling is important because, as the note at the bottom of this page shows, users will be aware of the uses of their data when consent is sought. Thus adtech tracking across the web might rank as four, but a loyalty scheme might rank as three on the GDPR scale.

A slightly more attractive prospect, from Google and Facebook’s perspective, is to inform a user about what they want to do with the personal data, and give the user a chance to “opt-out” beforehand.[5] This is two on the scale. This opt-out approach has the benefit – from the company’s perspective – that some users’ inaction may allow their data to be used. The GDPR permits the opt-out approach when the purposes that the companies want to use the data for are “compatible” with the original purpose for which personal data were shared by users. In addition to the opt-out notice, users also have to be told of their right to object at any time to the use of their data for direct marketing.

One on the scale refers to activities that currently involve the processing of personal data, but that do not need to do so. With modification, these activities could be put beyond the scope of the Regulation.

Activities at the zero end of the scale are outside the scope of the Regulation, because they use no personal data.

The more I think about it, the more I see the GDPR posing a problem for a Blockchain’s permanent, irreversible and inerasable ledger whenever any personal data (even when encrypted) is included in a node. Individuals will have the right to delete their data and be forgotten. If one of the values of Blockchain technology is that no one person or entity can modify a node, then the Blockchain will need to modify its architecture and governance to allow for such node modification. And if it is a public Blockchain with no centralized intermediation, then who is the data controller? And who will be able to delete your data upon your request and protect your rights? Will each miner become a data controller, potentially subject to fines?