Crypto’s next secrecy frontier

With help from Derek Robertson

Even as cryptocurrency markets have cratered, the underlying technology continues to evolve at a rapid pace — often in ways that governments would do well to pay attention to.

One important shift right now is that the world of crypto is getting more, well, cryptic.

Increasingly, new crypto projects are adopting mathematical techniques called zero-knowledge proofs, which allow users to verify that a certain piece of information is true — but without revealing the underlying information itself. As blockchain experiments proliferate and become more complex, the proofs are being used by all kinds of players — governments, anarchists, entrepreneurs — to bake an extra layer of secrecy into new projects.

Adjusting the balance between “public” and “private” information has been a big part of crypto’s evolution since the beginning. With Bitcoin, the progenitor of all cryptocurrencies, users can access the network without revealing their identities— but the balances and transaction histories of all addresses on the network sit in full public view on the blockchain. (This has created a cottage industry of “on-chain analysis” providers that offer insights into the state of crypto markets )

To create another layer of privacy around transactions, some newer blockchain networks encrypt the information recorded in their distributed databases, so no external observers can read their blockchains. Then they use zero-knowledge proofs to verify that a transaction is valid.

Like the cryptographic techniques behind Bitcoin, zero-knowledge proofs existed in the mathematics literature for decades before being put to use in blockchains.

And as with earlier crypto-breakthroughs, many of the early adopters were criminals. But law-abiding people like privacy, too, so more established actors are following suit:

–Last month, a report by the Atlantic Council on central bank digital currencies recommended the use of zero-knowledge proofs to create systems that protect user privacy while permitting limited government oversight. Governments could, for example, verify that a transaction was less than $10,000 — a threshold that comes with increased reporting requirements — without revealing anything else about the transaction.

—The Red Cross is working on a project in Somalia that would use zero-knowledge proofs to allow people to show they are eligible to receive specific medical care without revealing their names or other identifying information.

“It’s about protection,” says Adam Bornstein, who leads financial innovation for the Danish Red Cross. “They don’t need to reveal who they are. The counterparty just needs to know they’re approved for this, and that’s enough.”

— Then there’s DarkFi. Despite their potential applications for central bank digital currencies, zero-knowledge proofs tend to shift the balance of power away from governments by making it easier for people to interact online in a way that stymies surveillance. A group of anarchist developers is building on the work of early adopters of ZK proofs — like, Monero, a cryptocurrency preferred by criminals, and Zcash, which bills itself as a privacy-focused crypto — to create an entire ecosystem of decentralized apps built around secrecy.

In a manifesto that quotes former FBI director James Comey on the “Going Dark” problem that cryptography creates for law enforcement, the group describes its DarkFi project as a means of “liberating the democratic nation.” In a podcast interview published earlier this month, Rachel-Rose O’Leary, a DarkFi developer from Ireland, said that the project has reached an early private testing phase.

DarkFi is just one of the emerging projects that seeks to use these new techniques to circumvent government surveillance. As O’Leary explained, the advent of blockchain has unleashed a “cambrian explosion” in zero-knowledge experimentation.

If these projects succeed, law enforcement’s “going dark” problem will only get worse. But governments have another reason to pay attention to zero-knowledge proofs: To make use of them.

Michael Mosier, the former acting director of the Treasury Department’s Financial Crimes Enforcement Network, who now works at Web3 startup Espresso Systems, said policymakers would be wise to take advantage of these techniques for CBDCs and other digital upgrades to governance systems. “We should be building in these kinds of advances instead of just replicating the horseless carriage,” he said.

Generally, regulators prefer to have access to as much information as possible. But at a time when mutual distrust is growing between the parties, Mosier, said zero-knowledge safeguards have become an easier sell to political appointees worried about information falling into the wrong hands.

“Saying to the Democrats ‘This could be Donald Trump again,’” or telling Trump appointees “Hey guys, this might be Barack Obama,” has made regulators more willing to entertain privacy features, he said.

People simply expect more from their globe-spanning mega-corporations these days, leading companies as disparate as Ford and Kellogg to begin issuing annual human rights reports in recent years. So it might come as a surprise that Meta, whose human rights record has been the subject of some pretty intense scrutiny, just issued its first on Thursday.

The report features the results of investigations into Facebook’s use for everything from electioneering to human trafficking, describing the company’s risk-mitigation efforts like cracking down on election content in Myanmar and false information about the Covid-19 pandemic. (The report also features the results of a study the company conducted in India, the conclusions of which have been heavily criticized by activists and groups like Amnesty International.)

One subject that’s relatively scarce in the report is, ironically, the company’s new namesake: the metaverse. The company’s human rights director, Miranda Sissons, told Reuters that those assessments are largely taking place this year and will be featured in future reports, but this edition does include a brief section evaluating the company’s “Ray-Ban Stories,” augmented-reality glasses that feature a built-in camera — something privacy activists see as a serious human rights risk in its own right. — Derek Robertson

As the European Union’s big AI legislation is starting to take shape, the country driving the process at the moment is making some major changes.

POLITICO’s Clothilde Goujard reports today for Pros that the Czech Republic, which is currently heading the Council of the EU, made some draft changes to the Artificial Intelligence Act that would reduce the extent to which algorithms focused on insurance and pollution control are regulated, among others.

Taking said algorithms out of the “high risk” category would exempt them from EU-mandated assessments, and would protect their developers from potentially massive fines. (The changes would also narrow the definition of “high risk,” likely exempting more companies.) If accepted, the changes will likely set the council up for a conflict with the European Parliament, which favors stricter rules.

Meanwhile, across the Channel, the U.K. is devising its own, more permissive approach to AI regulation, as Clothilde reports in Europe’s Morning Tech newsletter today (Europe subscribers-only). Emphasizing its “flexible approach,” the U.K. says it plans to largely delegate its AI policy to regulators by industry sector instead of adopting an EU-style blanket law.

And if you’re waiting for similar news on the homefront, don’t hold your breath: The White House said last fall it is developing a “Bill of Rights for an Automated Society,” but since then hasn’t said much about it. Center for AI and Digital Policy founder Marc Rotenberg said Sunday that his group has submitted a FOIA request to the White House for more information. — Derek Robertson

• Mozilla’s annual “Internet Health Report” focuses this year on the risk, and potential, of AI.
• A congressional investigation revealed that the biggest Bitcoin miners have the capacity to use approximately as much energy as the city of Houston.
• The Ukrainian military has rave reviews for the Starlink satellites helping to keep it online.
• Virgin is planning to test flying taxis in the United Kingdom.
• NIST’s post-quantum cryptography competition is revealing the different approaches to a deeply complex mathematical problem.

Stay in touch with the whole team: Ben Schreckinger ([email protected]); Derek Robertson ([email protected]); Konstantin Kakaes ([email protected]);  and Heidi Vogt ([email protected]). Follow us on Twitter @DigitalFuture.

Ben Schreckinger covers tech, finance and politics for POLITICO; he is an investor in cryptocurrency.

If you’ve had this newsletter forwarded to you, you can sign up here. And read our mission statement here.