Category: Uncategorized

In terms of public safety and national security, the sooner the world moves to a digital cashless economy, the better.

[From Turn In Your Bin Ladens – NYTimes.com]

Most of the cash “in circulation” (I use the quotes because it is not, of course, actually in circulation at all but being hoarded in various places) is used only for criminal purposes: tax evasion, money laundering, drug dealing and so forth.

Somali pirates are reported to have received a total of $12.3m (£7.6m) in ransom money to release two ships. They are believed to have been paid a record $9.5m (£5.8m) for Samho Dream, a South Korean oil tanker, and nearly $2.8m (£1.7m) for the Golden Blessing, a Singaporean flagged ship.

“We are now counting our cash,” a pirate who gave his name as Hussein told Reuters news agency.

[From BBC News – Somali pirates receive record ransom for ships’ release]

Once again, these miscreants aren’t looking for prepaid mobile phones, gift cards or PayPal accounts: they are after cash, and I’ll lay a pound to a penny that they didn’t want Yuan or Roubles or Kenyan Shillings and an M-PESA account in a false name: they wanted dollars, and in $100 bills. The cash was dropped from a helicopter on to the ship. Now, I’ve heard some people — including some people from banks — say that this is fair enough, because the seigniorage on the cash represents a tax on criminal activity and it’s better to collect this stealth tax from the bad guys that impose more taxation on honest, hard-pressed taxpayers. But I have two objections to this line of thinking:

1. First of all, it is not at all clear to me that the state should live off of criminal earnings. If something is legal and taxed, fine. But if it’s illegal, it’s illegal.
2. Secondly, the revenues that accrue to the central bank from this enterprise are small compared to the revenues denied to other parts of government. So in the central bank books, life looks good. But over at the treasury, there’s a black hole where the revenues from honest enterprise should be.

Perhaps the non-central bank parts of government might look to the central bank to use some of seigniorage revenues to subsidise the introduction of electronic payments to parts of the economy dominated by cash. But what kind of electronic payments? I suppose the government could start developing its own form of e-cash, but I’m not sure that’s the best way forward. Maybe there’s another way. Perhaps we need a new form of e-cash (that we haven’t seen yet) for the new economy because we are trapped using money developed in a previous age for the commerce of the next. In his excellent book “The Birmingham Button Makers“, Professor George Selgin explains how the British economy faced that same problem during the industrial revolution.

Today, the big problem of small change is no longer such a big problem, although shortages of wanted coin continue to occur sporadically around the world (e.g. here and here) as well as surpluses of unwanted coin. Nevertheless, the basic problems of private coinage were trust and credibility. Modern issuers of digital cash face the same problems and thus Selgin’s history is a valuable reminder about the scope and potential of alternative monetary institutions.

[From Marginal Revolution: Good Money]

Indeed, and apart from a general interest in the history of money, this is precisely why I found George’s work so interesting. Could we see a similar trajectory in the post-industrial economy? This would suggest that private operators might step in to the market to fill the void and then when the competition had run its course and the “best” coinage had been established, then the government would step in and provide it as a public good. Perhaps the Bank of England should run its own version of PayPal and the government should insist that everyone has an account if they want to receive state payments of any kind: welfare, pensions, wages and so on! Once all of money is digital, as opposed to the current 96.3% (in the UK), who knows where that will take us.

As money becomes completely digitized, infinitely transferable, and friction-free, it will again revolutionize how we think about our economy.

[From The Future of Money: It’s Flexible, Frictionless and (Almost) Free | Magazine]

I think this is true. You’ll have a chance to kick around these kinds of ideas if you come along to the 14th annual Consult Hyperion Digital Money Forum in London on 2nd/3rd March 2011, where George Selgin will be along in person to give a keynote talk.

These are personal opinions and should not be misunderstood as representing the opinions of
Consult Hyperion or any of its clients or suppliers

[Dave Birch] Oh no! According to tonight's news reports, the UK is bracing itself for cyberattack from the "hackers" supporting Julian Assange and Wikileaks. Apparently vital government services are at risk from the group called "Anonymous" launching distributed denial-of-service (DDOS) attacks. A bit like this guy, from the group "Not Anonymous At All":

A 17-year-old from Manchester has been arrested by the Metropolitan Police's e-crime unit (PCeU) on suspicion of being behind a denial of service attack against the online game Call of Duty.

[From Call of Duty DDoS attack police arrest teen • The Register]

He was, of course, traced from his IP address. I thought it was funny, in a way, that journalists and politicians refer to the LOIC kids as "hackers" when they are anything but. What's more, as I said when Charles Arthur was kind enough to invite me on to The Guardian's Technology Podcast, they have chosen a particularly funny way to join the Anonymous group of internet vigilantes: software that isn't anonymous in the least and that delivers their IP addresses to their intended victims, thus making it easy for them to be traced and arrested. This is, in fact, precisely what has happened.

A 16-year-old boy was arrested in the Netherlands in connection with a series of cyber attacks on Visa, MasterCard

[From Dutch teen arrested over cyber attacks on Visa, MasterCard]

My personal views about Wikileaks and the "Cable Gate" DDOS attacks are irrelevant. (I will say this: that if you don't like MasterCard then cancel your card and leave mine out of it). But they will certainly have an impact on thinking and the calls for "something to be done" mean change. Since there's no way to stop people from copying data (as the music industry has discovered), that's probably not a fruitful line of thinking. So what will happen?

What technology may lead to are "red" and "blue" internets. (Note that "blue and red" are here allusions to the military labelling of secure and insecure networks, they are nothing to do with blue and red pills in The Matrix.) Essentially, there will be secure and insecure internets both running over the same IP networks.

On the red, open, internet people and organisations will exchange encrypted data across an untrusted network. Some people may choose not to connect to the red internet at all and only crazy people (and organisations) will send unencrypted data to unauthenticated counterparties.

On the blue, closed, internet you will need to authenticate yourself before you are allowed to access anything and a digital identity infrastructure will deliver privacy (and in some cases anonymity) through cryptography, not through data protection registrars or privacy ombudsmen. In order to connect to the government, or Facebook, or Amazon, you will have to use the blue internet: they simply won't be connected to the red internet any more. At home, I will probably set my internet connection to blue only.

Now, some of you may be concerned that, as The Daily Telegraph told us, the Chinese government have a master key that can decrypt everything on the Internet, in which case the entire Internet will be — very literally indeed — red forever.

While sensitive data such as emails are generally encrypted before being transmitted, the Chinese government holds a copy of an encryption master key which could be used to break into redirected traffic.

[From China 'hijacks' 15 per cent of world's internet traffic – Telegraph]

But look on the bright side: since the Chinese have "a copy" of this mythical master key, someone else must have the original, and they will be able to read all of the Chinese government's e-mail and put that on Wikileaks too.

To understand why the fuss, and why this is of relevance to the digital money world, you need to understand a couple of technical architectures relating to mobile phones and the role of the Secure Element (SE). The SE doesn't exist in phones yet, but it's important because if we want to implement anything important (such as payments) inside a phone, we need somewhere to store cryptographic keys, and that somewhere needs to be tamper-resistant to a great degree. Thus we need a handset to have an SE. Ah! You might say: but handsets already have a tamper-resistant thingumy inside them, why not use that?

That's a good point. In the modern way of things, the tamper-resistant chip thingumy the handset is more properly called the UICC:

The UICC (Universal Integrated Circuit Card) is the smart card used in mobile terminals in GSM and UMTS networks. The UICC ensures the integrity and security of all kinds of personal data, and it typically holds a few hundred kilobytes. With the advent of more services, the storage space will need to be larger.

[From UICC – Wikipedia, the free encyclopedia]

Historically, we've tended to associate the UICC (in the form of a removable smart card) with one application only, and that application is the Subscriber Identification Module (SIM) that allows the phone to connect to a mobile network and refer to the combination as "the SIM". But…

A UICC may contain several applications, making it possible for the same smart card to give access to both GSM and UMTS networks, and also provide storage of a phone book and other applications

[From UICC – Wikipedia, the free encyclopedia]

It can also contain more than one of each. Thus, you could have multiple "soft SIMS" inside one UICC (that special case where the UICC contains only one application, and that is a SIM, we will refer to henceforth as the "hard SIM"). Now let's consider what happens when Apple add an NFC interface to their devices and therefore need an SE.

The filing also points to the inclusion of near-field communication (NFC) technology in upcoming iPhones — and, for that matter, in Macs and media devices such as the Apple TV.

[From Apple patent seeks to reinvent retail • The Register]

Where can the SE that makes the NFC interface useful go? Either we can plug in an SE (eg, a DeviceFidelity microSD) or we can add an SE to the UICC (the e GSM Association, GSMA, preferred option) or we can build an SE into the device by adding it to the motherboard. The GSMA want to put the applications that control the NFC interfaces to be on the UICC, which kind of makes sense because if you take your UICC out of one phone and put it in another, then you'd want your SE applications (eg, your MasterCard, Oyster etc) to go with it. But not everyone thinks that the SIM is the key to this picture.

Suppose that instead of adding an SE, Apple add a UICC and put the SE in that? What this means in practice is that the UICC will be inside the iPhone or iPad or Mac, on the motherboard. But the SE need not be the only contents of the UICC. Why not put soft SIMs in there as well and do away with fiddly microSIMs? If I walk into the Apple Store in London and buy a 3G iPad, say, then the UICC could come with a default SIM application. Let's say this is O2. When I take the iPad to France, instead of paying outrageous 3G roaming charges (and therefore leaving my iPad at home), my iPad will download a French operator's SIM application and start using that. I won't choose the operator — in fact I won't even know this is going on, because Apple will simply negotiate with mobile operators to provide commodity service.

In other words, perhaps we move to a world in which the operators' SIM connectivity function becomes just software running on someone else's physical card.

[From Dean Bubley's Disruptive Wireless: Apple, embedded SIMs, NFC and mobile payments – some speculation]

Dean is spot on. And you can see plenty of positives in this architecture. If you're not a mobile operator, that is. If you're a mobile operator, this is another step towards being nothing more than a pipe. As a customer, I think I'd be quite happy with the mobile operators as a pipe, selected purely on a cost/QoS basis (and competing with each other on that basis). After all, they haven't (in Europe) got very far with "smart pipe" services such as, just to name two examples, digital money and digital identity. So the Apple UICC containing soft SIMs and an SE may not be such a bad architectural option for consumers. But…

The operators are privately saying they could refuse to subsidise the iPhone if Apple inserts an embedded subscriber identity module, or Sim card.

[From FT.com / Telecoms – Apple warned over built-in Sim cards]

There are other people in this value chain too, such as smart card manufacturer Gemalto who were rumoured to be making the Apple UICC.

Gemalto explained to us why such a deal, which involved a significant amount of devolution from the mobile phone operators to the mobile phone manufacturers, is unlikely to happen without the tacit approval of network carriers themselves.

Gemalto has been a strategic partner for mobile phone operators for more than a decade now (the company is the biggest SIM manufacturer in the world) and gets the majority of its revenue (more than 60 per cent of last year's 1.654 billion Euros).

[From Gemalto : No Apple iPhone 5 Deal On The Table Yet | ITProPortal.com]

Quite. But let's just go back over another main point: in order to provide payments, or other useful services, via NFC it is not necessary to have the co-operation of the carriers.

Visa's approach "shows that basically there's nothing that the carriers can do that the [payment] networks can't do without them," McPherson said.

[From Mobile Payments Set for Surge, But Who ll Set the Pace? – American Banker Article]

The mobile operators have no acceptance at retail POS so they have to work with payment scheme partners to reach scale, but other payments players don't need the operators. They can put stickers on the back of phones, plug microSD into handsets or use the NFC interfaces that will be built in by Google, Apple and RIM. Since customers will come to expect these services, they will eventually get built in to all handsets. Unless the operators can launch highly functional NFC platforms quickly (which they probably should have started doing a couple of years ago) then they will be out of the loop.

Issuing hard SIMs is expensive, so if the operator's connection with the customer is downgraded, there is no point in doing it and the operators would save money by providing soft SIMs to any UICC that they can bill to. So I think the situation is this: in the future, many devices will a UICC built-in. This UICC will function as an SE for NFC interfaces. The UICC will store a number of soft SIMs, not only for mobile phone communications but for future 4G and 5G communications. The UICC will also hold standard digital money and digital identity applications. And instead of Vodafone and Telefonica controlling the matrix, Apple and Google will.

These are personal opinions and should not be misunderstood as representing the opinions of
Consult Hyperion or any of its clients or suppliers

I was thinking about online identity — again — because I was working on a report for a client of ours and I was thinking about some issues around multiple identities. In cyberspace, multiple identities make sense in a way that has no analogue in the analogue world, if you see what I mean. Now, a fundamental objection to letting people have multiple identities is that it will enable them to get up to no good. And it is certainly true that there are people out there getting up to no go. When I was writing a post about virtual commerce over on Digital Money, I came across this interesting piece about the activities of fraudsters after virtual gold.

Operationally, gold frauding is much cheaper than gold farming as you don't need to spend time building up characters, farming assets, and waiting to be banned. Since you are hitting accounts and looting them on a one-time basis, you are not going to trigger traditional gold farming detectors…. and if you get banned, on to the next victim.

[From World of Warcraft under stress from Gold Frauders via Phishing and Key Loggers – PlayNoEvil – Game Security, IT Security, and Secure Game Design Services]

While the theft of virtual gold may well be a serious problem, in the great scheme of things it's probably not the no.1 priority of law enforcement (which is why kids use two-factor authentication for these kinds of games). But we have to recognise that there are much more serious problems.

Michigan resident and twice-married mother-of-five has been charged with “using the Internet to entice a minor into sexual activity”, after she seduced a 15-year-old boy while playing World of Warcraft. 35-year-old Angie L. Jenkins told the teenager she was 21, while he swore he was 20.

[From 35-year-old woman charged with seducing minor on World of Warcraft]

Without minimising the seriousness, I do find this example particularly useful: both participants in an online exchange were lying! What can we do about this? Well, to continue with the World of Warcraft (WoW) theme, let's looks at what Blizzard actually tried to do: they decided to introduce a "RealID" system (not to be confused with the US government's "RealID" system because the WoW system was intended to be secure).

the RealID system also identifies you by your real name instead of a character name or alternate identity. Friends who may have previously known you by your character name will now know you by your real name, whether you've ever told them or not. This is information pulled straight from Blizzard's account information and billing system – information that was previously private.

[From Player Perspectives – A Pain in the RealID – MMORPG.com]

How on earth could anyone have imagined that this was a good idea? Apart from anything else, the "real name" associated with the account that my kids use is me, not them, because it's my card that's used to pay for their subscription. I'm very uncomfortable with them using their own debit cards online precisely because I don't want them to give out their real name. But the story gets even more crazy.

Another enhanced feature of RealID is the ability to see friends of friends. Once you're on a friend's RealID list, you can now see the (real) names of anyone they have added to their RealID. The idea behind this function is to allow players to easily add mutual friends without having to ask a dozen people for their e-mail address. The potential use behind it to find out more information about someone that trusts you with their RealID is far worse.

[From Player Perspectives – A Pain in the RealID – MMORPG.com]

This is so wrong. I spoke about the "chatroom paradox" (an example I often use to illustrate this point) at the BCS ISSG "Privacy Day" recently. The point is that people seem to want the "real" identity of counterparties but don't want to disclose their "real" identity in case the counterparty misuses it. Blizzard really misjudged what people want and so they had to abandon their plan.

Sidney Eve Matrix, a film and media professor at Queen's University in Kingston, Ont., who studies cyberculture. "They know the culture requires to some extent an online persona. … It was a cultural misstep, really."

[From CBC News – Technology & Science – Battle to preserve online anonymity rages in video game community]

It isn't just about having a persona, it's about having a persona that can demonstrate certain credentaials (eg, I am over 18, I live in the UK, whatever). In fact, it's about having a number of persona and, I would argue, it's about having persona that are relevant to transactions.

“Who are you?” equates narrowly to Identity. It is only Identity at a sufficient level of trust the meet the requirements of a specific entitlement. In the simplest case, the person can be completely anonymous; in a municipal car park, only the ability to pay makes sense. However, they may keep a record of your car registration number. Requests for Housing Benefits are at the other end of the scale. The identity offered does not need a unique code.

[From Idiotic Identity Fallacy – No2UID « Quarkside]

I prefer to see these issues separated: I think that you do need a unique identifier, but that that identifier should not be part of transactions, and I think that there should be privacy rather than anonymity for low-value payments, but the central point is correct. I wonder if the attitudes forged by WoW and such like mean that the next generation will be far more tuned-in to what identity means in cyberspace: we have to stop forcing our "cardboard age" notions of identity on to them or we'll never make any progress in solving real problems.

Incidentally, if you are interested in the idea that WoW and the like are more than just games, I happen to have on my desk a spare copy of the excellent "Fun, Inc." signed by the author Tom Chatfield. I will cheerfully send this interesting book free to the first person to respond to this post with the name of the WoW character, who became popular due to a video of the game that circulated around the Internet, who famously led his friends to their doom because he wasn't listening to the other players plotting their moves. The phenomenon has since spread beyond the boundaries of the gaming community into other online and mainstream media, so that the name has become a byword for a team member whose reckless enthusiasm and inattention to plans leads to disaster.

These are personal opinions and should not be misunderstood as representing the opinions of
Consult Hyperion or any of its clients or suppliers