Privacy Enhancing Technologies (PET) and the Privacy Dilemma for CBDCs
Mustafa Syed
Senior Manager | Solution Architect | PhD Doctoral Researcher | Postgraduate Finance & Enterprise Solutions | CBDC/ Stablecoins/ Digital Assets SME | Digital Compliance/ E-invoicing SME
Introduction
Central Bank Digital Currencies (CBDCs) are digital versions of fiat currencies issued and backed by central banks. They aim to provide a secure and efficient means of digital payments and transfers. CBDCs can potentially enhance financial stability, increase financial inclusion, and provide a more efficient and effective payment system.
One of the key concerns associated with CBDCs is privacy. The central banks that issue CBDCs have the ability to track and monitor all transactions, thereby undermining the privacy of users. This raises questions about the government's role in monitoring citizens' financial transactions and the potential for misuse of this information.
This article will highlight the number of ways in which CBDCs can affect privacy. For instance, if a CBDC is built on a public blockchain, the transactions are visible to anyone who has access to the network. This makes it easy for governments or other entities to monitor financial transactions and gather data on citizens. On the other hand, if a CBDC is built on a private blockchain, the central bank has complete control over the network and can monitor transactions at will.
In addition, we will discuss how CBDCs can impact privacy through the use of Know Your Customer (KYC) and Anti-Money Laundering (AML) regulations. These regulations require financial institutions to verify the identity of their customers and report suspicious transactions. With CBDCs, the central bank can easily enforce these regulations and monitor transactions for illicit activities, but this comes at the cost of sacrificing the privacy of users.
Finally, we will touch on how CBDCs can also affect privacy through the use of smart contracts. Smart contracts are self-executing contracts with the terms of the agreement directly written into code. With CBDCs, the central bank can enforce smart contracts and monitor transactions, but this also increases the potential for privacy violations.
Introducing Privacy
Privacy is a fundamental right that refers to the ability of individuals to control access to and use of personal information. It allows individuals to protect their personal and sensitive information from being disclosed to others without their consent.
When it comes to CBDCs, privacy has a significant impact on the overall design and implementation of these digital currencies. CBDCs are essentially digital versions of traditional fiat currencies and are issued and backed by central banks. With this in mind, the central bank can have access to all transactions and user information, which raises questions about privacy and the potential for misuse of this information.
There seems to be a general consensus when you read the literature, especially on central bank digital currencies, that it's more or less impossible to combine true anonymity and regulatory compliance because you can't be regulatory compliant if you don't know where money is coming from and going to. Therefore, there needs to be a way to combine these two worlds, so at least some of it is already coded of course.
How the payment asset issuer can exert control over settlement rules and maintain adequate, tamper-proof evidence of the amounts in circulation while also minimizing access to sensitive information—defined as "any information that allows the operator of a ledger to link transaction data to an individual user"—and considerations related to "back-end" IT are among the issues that has been covered by the ECB and will continue to be an important part of future discussions [6].
There are several ways in which CBDCs can impact privacy. For example, the central bank can monitor all transactions, thereby undermining the privacy of users. This can include tracking of financial transactions, monitoring of smart contracts, and the enforcement of know your customer (KYC) and anti-money laundering (AML) regulations. These regulations require financial institutions to verify the identity of their customers and report suspicious transactions, but they can also lead to the central bank having more control over the financial transactions of citizens.
In order to ensure that CBDCs do not undermine privacy, it is essential to consider the privacy implications at every stage of development. This may involve using privacy-enhancing technologies such as zero-knowledge proofs, homomorphic encryption, and ring signatures to protect the privacy of users. It may also involve balancing the need for privacy with the need for security, such as by using a hybrid approach that combines public and private blockchains.
The growing dominance of e-commerce has profound implications for the economics of payments. Since more and more transactions are conducted online, physical currency (“cash”) is becoming less effective as means of payment for a growing share of economic activity [1].
Digital payments, in contrast to cash, provide vast amounts of data, and private businesses have an incentive to use that data for profit. The increased accessibility of personal information might have significant welfare ramifications, which raises privacy concerns. 3 Despite the efficiency that a proliferation of data promises. Gains aside, the dominance of data-centric business models and their propensity to hinder competition, prevent creative destruction, and engage in price discrimination have concerned policymakers. Incidents like the one involving Facebook and Cambridge Analytica have made people more aware of the importance of data privacy in the context of the digital economy [2].
Privacy Initiatives by Banks
The UK's presidency of the Group of Seven (G7) nations last year saw the publication of 13 public policy guidelines for the implementation of retail CBDCs. According to the document titled "Public Policy Principles for Retail CBDCs," "Rigorous norms of privacy, accountability for the security of users' data, and clarity on how information will be secured and used is necessary for any CBDC to command trust and confidence. [7].
Recently, the inventor of eCash, the forerunner of Bitcoin, and more recently of the cryptocurrency elixxir, David Chaum, highlighed the democratic world can have a form of CBDCs that respects privacy. He is collaborating with the Swiss National Bank (SNB) on Project Tourbillon, which is intended for central bank money that prioritizes privacy [3].
The Bank of International Settlements (BIS) Innovation Hub will oversee the project's development, the agency said on Thursday. The initiative will increase the number of CBDC pilots already being developed by the BIS Innovation Hub, including the Helvetia and Mariana projects, both of which also involve the SNB.
According to the BIS statement, the technology underlying Project Tourbillon will integrate Chaum's quantum-resistant cryptography and privacy-preserving functions. According to the press release, the system will also be scalable because it will "use an architecture that is compatible with, but not predicated on, distributed ledger technology." The idea was developed by Chaum and Thomas Moser, an alternate member of the SNB governing board, and is based on Chaum's blind signature approach.
He acknowledges that “CBDCs are a big deal” in the world at the moment and is well aware of the fact that many believe CBDCs will be “the end of privacy in money.”
The Bank of Canada has conducted several studies on the privacy of CBDCs. One of the key findings from their research is the importance of balancing privacy with other functional requirements, such as security and accessibility. They have found that the trade-off between privacy and these other requirements must be carefully considered in order to design a CBDC system that meets the needs of both individuals and the government.
Another key takeaway from the Bank of Canada's research is the need for clear and concise privacy policies to ensure that users understand the extent of their privacy in a CBDC system. The bank has also explored the use of privacy-enhancing technologies, such as zero-knowledge proofs and ring signatures, to help preserve privacy while still enabling efficient transactions [5].
What is Privacy Enhancing Technologies
Privacy Enhancing Technologies (PETs) are a set of tools, protocols, and methods that aim to enhance the privacy of digital transactions while still maintaining their security. In the context of Central Bank Digital Currencies (CBDCs), PETs play a crucial role in ensuring the privacy and confidentiality of transactions, particularly in an era where financial data is a valuable commodity that is highly sought after by both government agencies and malicious actors [4].
One of the key aspects of CBDCs is the transparency of transactions on the ledger, which makes it easy for governments and other entities to track financial activity. PETs help to mitigate this issue by obscuring sensitive information, such as the identities of parties involved in transactions, the amounts involved, and transaction histories. This protects the privacy of users and ensures that their financial information remains confidential.
There are several types of PETs that can be applied to CBDCs, including Zero Knowledge Proofs, Blind Signatures, Tiered Ledger Systems, and Privacy Threshold Limits. Each of these technologies provides a different approach to enhancing privacy and has its own advantages and limitations [5].
领英推荐
Privacy Enhancing Technologies
Privacy Framework
Privacy Enhancing Framework for CBDCs should address the following questions:
Knowing the CBDC business model, attributes and technology platform is essential to choosing the right constructs and combining them appropriately.
For example, consider a system where private transactions are verified by banks. If the business model states that banks are highly trusted, then privacy protocols can be simplified by assuming verifiers are honest. If not, the chosen protocols must guard against dishonest verifiers, which entails higher complexity. If amounts are hidden and policy dictates an interest-bearing CBDC, then chosen schemes must support encrypted computations of interest payments.
Further, the selection of privacy techniques will depend on the chosen platform. Typical proof systems are made up of provers (e.g., end-users) who generate proof and verifiers (e.g., the systems) that check them. In a DLT system, multiple nodes perform verification, so system designers would need to ensure verification protocols are highly efficient. Centralized systems could tolerate slower verification.
Another consideration is the trade-off between prover efficiency and proof size—algorithms that achieve fast proof generation generally result in large proofs. This could be a challenge in device-based solutions constrained by limited storage. Device-based solutions must also ensure that selected schemes can operate within the restrictions of sporadic CBDC network connectivity and limited computing capacity [5].
In addition, a CBDC system must adhere to laws and regulations (e.g., KYC and AML). The degree of privacy and the choice of privacy techniques can be determined by this. Entities may be required by KYC to classify and store personal data appropriately. Generally speaking, maintaining high degrees of privacy while abiding by laws is challenging. However, a designer could create a system with mixed levels of privacy. This allows for both regulated and unregulated assets and transactions to exist side by side, each with its own set of restrictions (such as a maximum amount).
How to Solve Double-Spend in a Token-based CBDC?
The relationship between CBDC privacy and double spending is indirect, but they are both important considerations in the design of a CBDC system.
Double spending refers to the ability of a user to spend the same digital currency multiple times, potentially undermining the integrity of the system. To prevent double spending, a CBDC system must have a mechanism in place to ensure that each digital currency unit can only be spent once. This typically involves some form of central authority, such as a central bank, that maintains a ledger of all transactions and ensures that each unit is only spent once.
Privacy, on the other hand, refers to the protection of individuals' financial information, such as the details of their transactions and their balance. In a CBDC system, privacy considerations can arise if the central authority that maintains the ledger of transactions is able to access and use individuals' financial information for purposes beyond ensuring the integrity of the system.
While the relationship between CBDC privacy and double spending is indirect, it is important to consider both issues when designing a CBDC system. For example, a system that relies on a central authority to prevent double spending may also increase the risk of privacy violations if the central authority is able to access and use individuals' financial information. On the other hand, a system that prioritizes privacy may need to use alternative methods, such as cryptographic techniques, to prevent double spending and ensure the integrity of the system.
Therefore, in designing a CBDC system, it is important to balance the need to prevent double spending with the need to protect privacy, and to carefully consider the trade-offs between these two important considerations.
Double-spending is a problem that can occur in a token-based DLT system where a user tries to spend the same token multiple times. Although Blockchain is secured, it still has some loopholes. Double spending refers to using the same digital currency more than once to obtain various services. Users can create duplicate copies of money due to a technical error. A malevolent person can make many copies of the same currency file and utilize it in other locations because digital currencies are nothing more than files. This problem may also arise if the network is changed or if only copies of the money are utilized, not the original.
Double spending also provides hackers with the ability to make a transaction happen twice. By doing this, the user loses money twice: once for the original block and once for the phony block the hacker produced.
To prevent this, several techniques can be employed in a CBDC system. Some of these include:
To prevent double-spending in a token-based CBDC system, it is essential to have a secure and efficient system that verifies transactions and ensures the uniqueness of tokens. The choice of the right combination of techniques depends on the specific requirements of the CBDC system and the trade-offs between security, scalability, and efficiency [8].
Summary
CBDCs have the potential to revolutionize the financial sector and provide a more efficient and secure payment system. However, it is essential to consider the impact of privacy when developing CBDCs. A balance must be struck between ensuring privacy and ensuring the safety and security of the financial system. It is up to central banks and policymakers to determine the best approach to ensuring that CBDCs do not undermine privacy.
Privacy is a crucial consideration for CBDCs. While CBDCs have the potential to revolutionize the financial sector and provide a more efficient and secure payment system, it is important to ensure that privacy is not compromised in the process. By striking a balance between privacy and security, CBDCs can ensure that users have the ability to protect their personal and sensitive information while also enjoying the benefits of a digital currency.
Citations: