Secure opinions

[Dave Birch] At the Mobile Banking Security conference in Vienna — which was very good, by the way — I gave a short introductory talk explaining to the delegates that I felt that security needed to improve at all levels to push the development of the sector: the regulatory level, the business level and the technology level. In his talk, however, Ivan Mortimer-Schutts of BNP Paribas asked a question that I didn’t, and which should frame some of the debate about security at all of these levels: is there a tradeoff between security and innovation in the mobile space and, if there is, is that tradeoff currently positioned correctly. You can see what he means: if we demand complete security at every level, aren’t we going to hold back innovation and stifle competition? And if we are, is that good or bad? After all, you might reasonably argue that some parts of the banking world might have benefited from substantially less innovation over recent times.

Ivan highlighted the particular issue of customer acquisition for mobile banking and payments where (particularly in emerging markets) the rigorous demands of KYC/AML raise the costs of the mobile channel to the point where it may no longer be viable to deliver mobile banking to people who really need it. Many potential customers — perhaps most of them — either do not have a valid ID document of any description or even if they do, there is no way of verifying it. He suggested that allowing banks to use third-party identification might be a way forward (ie, allowing people to open basic account using a letter from their employer or from a utility company that they have been paying) but I think I’d go further and remove the requirements altogether. Dominic Peachey from the Financial Service Authority (FSA) was also speaking and he touched on the problems that are to be found in attempts to reconcile financial inclusion goals with law enforcement ( because of anti-money laundering, terrorist financing, proceeds of crime legislation). Frankly, I think some of the law enforcement agenda is driven by paranoia rather than by facts on the ground, a suspicion that the bad guys are one step ahead and are already using the new technologies to whisk their ill-gotten gains around the globe undetected.

I am sure sooner or later we will stumble upon a seamlessly operating ‘underworld digital currency’ on a global scale while the legitimate financial world will continue to debate and get only their feet wet in the deep waters of digital currencies.

[From Money laundering through digital currencies]

We need to support, as Dominic put it, “evidence-based” regulation for new payment mechanisms. And before I start getting complaints that I am being too liberal on this front, let me once again point out that the best money-laundering technology, the one preferred by criminals, terrorists, corrupt politicians and ne’erdowells of all kinds is the one controlled by the European Central Bank:

The euro is the criminal fraternity’s currency of choice because it short-circuits much of the laundering process. Legal tender for 313 million citizens living in 12 E.U. states, four other European countries, two territories in the Balkans, plus a group of smaller jurisdictions around the world, euros automatically separate the currency from the crime, eliminating the need to prewash. No one then knows if your euros are the result of drug trafficking in the Netherlands, car thefts in Germany or people smuggling in Italy… Unlike sterling with its UKP50 note, the €500 note ($630) is a godsend to criminals. If the [British armed robbers] had stolen $97 million worth of €500 notes, their haul would have reduced by over 85% — a small enough stash to stuff under the seats of an suv and drive undetected across borders.

[From The Criminal’s Currency of Choice – TIME]

So let’s not crucify mobile and demand it provide a level of security infinitely beyond that in the marketplace today.

These opinions are my own (I think) and presented solely in my capacity as an interested member of the general public [posted with ecto]