Privacy and dApps: Balancing User Privacy with Compliance and Security | ETHDam 2023

foreign [Music] we have Sebastian from Hopper we have Ryan from dusk Issa from Silent protocol and Hadrian wherever you like oh in order I'm on the wrong side oh no now we need to cancel the panel all right let's give it a start with a brief introduction Sebastian yeah hi everyone my name is Sebastian I'm working on privacy on the most bottom layer of the stack so Hopper is a project that focuses on data transport you can imagine Hopper like a more private version of a VPN or tour to send data from A to B and on top of that we are building on top of this general purpose infrastructure we're building rpch which is the first truly private RPC provider that cannot lead to data harvesting of users yeah I'm Ryan I'm head of Business Development at dust Network and uh dusk is a privacy preserving layer one that's focused on tokenizing regulated assets so as the name suggests these are assets which are highly regulated and so it's that clash between compliance and privacy that's very much core to what we do hi I'm Adrian founder of sismo but I won't bore you with more details hi I'm Issa I'm co-founders and CTO of Silent protocol silent is a middleware solution that tries to bring privacy into the user's Comfort Zone on public chains to interact in a privacy preserving manner with the existing regular decentralized applications in a full composable way thank you we share we start this conversation with a few controversial opinions on compliance and security and privacy Sebastian what's your most a controversial opinion on this topic yeah um I think that like what the [ __ ] is compliance even right compliance is some rules that a bunch of dudes typically make up behind closed doors that go beyond the law and are kind of arbitrary and that are hindering other people in their free choices that they make and that's not great right so I think that technology can lead to you know avoiding crimes and Bad actors I very much like this term of Technology regulated venues that I think Mona from enzyme was coining a while ago yeah so I think we should focus Less on traditional compliance and more on technology that prevents users to get harmed top that off Ryan I suppose I'm going to go slightly the other way I guess my my controversial opinion would be that we should probably be quite welcoming of more compliance into the space more regulation into the space I think it allows us good people in the industry to get on with building the things that we need to build in peace and it helps us to keep those uh Bandits I suppose out of the industry and I don't know about everybody else but I'm a little bit tired of going to other Industries and the only people from our industry they've heard of or luna or FTX and I don't particularly want people like Sam to be the ambassador for the entire industry yeah my my guess would be to trust the process and not care that much about the current regulations but like a lot about users and actually incorporate into our products like user protection and actual regulation for instance you can think about like a tornado cache that makes sure that there's no uh Bad actors within this protocol and not care about like what governance that are still outdated I think today I think that they will adapt so it's up to us to show the way the real details that will be here in five years and so yeah let's not cut too much and just build the alternative I think um when we look at the web 2 space how the web to application solves compliance So currently we have the regulations and the main point to be regulatory or compliant with those regulations is to have access consent from the users and all the things just pin to this point and the companies gets the consent and they do whatever they would like to do that is actually the problem right now we are facing on web plus space so in web 3 space since we are on road to redefine the new mechanisms and maintain Innovations technological innovations within the system currently we are facing the problem to distinguish the stolen phones illicit activities and criminal actors from our privacy preserving Solutions so that the these arguments can be nullified yeah if we can manage this part at the first place we can have better their pays to develop more privacy preserving Solutions I believe very well said I think web free is also the moment to reset the whole industry how can we influence the amount of user privacy and depth do you have any idea on that Sebastian yes so I think it's up to the application developers who are here who really leverage decentralized Technologies and make them aware of that you know I think it's up to us to ship applications that are not made available to the user on something that ends on.com dot org dot net and so on every single piece of centralized technologies will get captured earlier or later every single one we're seeing how you know our good friend Uncle Sam is coming after everything that moves um you know in the US that's great that's great because it pushes decentralized and privacy respecting Technologies so in that regard I'm kind of aligned with the end game of Regulation even though in a weird way and that is all our choices so everyone who builds Technologies here builds applications please do respect users privacy otherwise you will get [ __ ] personally Ryan on regulation do you have something to add on that um more uh more broadly I I suppose I bring it back to so many conversations I have with with friends with family members debating with people on on the internet about you know where does where should that trust come from like should we is it is it more risky to trust a government with your data or is it more risky to trust the private company with your data and um I think the answer is you can't really trust either so then seems to me the answer to that question is that nobody should have that data to begin with let's not give it to them and let's not give them the Temptation by allowing them to have it and we have a fantastic opportunity here uh to build this in because if we're talking about web 2 I think it's probably fair to say that the battle for web 2 has already been lost partly because we didn't realize we were fighting a battle until it was already over um but we're just at the start of building web threes we've got a great opportunity to build this in at the foundational level I think a lot of us know Tim berners-lee talks a lot about one of his biggest regrets being not building some kind of identity solution in at the foundation level when he got started but we can actually do that and the proper privacy solutions that come with that we can we can build that right now before it gets out to the masses while it's still in this relatively small circle we can shape it into what it needs to be before we push it out into the general population so trust nobody and build Adrian yeah I think that there's an opportunity that might be hidden I think it's in the data management so this is more we are here to make your data so random that you use it everywhere with software engineering with privacy and I think that it's less heavy to go into these fields like I think it's hard to do regulations around assets around money around these kind of things because like governments are are very involved in that but if you take a look at the regulations that are more into Data that have started with web 2. there are actually a lot of opportunity to start to um to imp to to to incorporate the same technologies that we use for financial services but I think the opportunity is easier like they are European policies that are trying to have for instance the passport on chain or as a VC verifiable credential and when talking to Regulators they are actually interested with the solutions like sismo so that could be also a nice pass to do things right around data and show them that this Tech is really good and let's do it on the financial services that's uh yeah good opportunity Isa what is the biggest challenge that you face while building your product actually so of course we are trying to provide our Solution on the public chain and let users interact with the decentralized application in a privacy preserving manner so there are some constraints that are coming from the transparent site we need to handle properly and so this was the initial phase for us but we have successfully managed to solve this one by creating Anonymous channels and letting users to accumulate their assets in a privacy preserving environment and then splitting them to interact with the decentralized application by using some peroxide identifiers So within this manner we hope to maintain users to have full composability without having any delay within the mechanism so user-friendliness is the main issue I believe while we are creating attraction to gain much more privacy ever webtree users so we I believe that we have managed this part and of course the second part is to how to manage or how to keep Bad actors from our private environment and for that we are kind of utilizing a solution similar to the one that Amin mentioned earlier today and apart from that we have we are creating a subtle that behaves as a compliance group and if stolen assets had been brought into the system they can evaluate the situation behave as a private advocacy and then if it is certain then it would be possible to provide the necessary details of those track actions or transactions to the regulatory by these Sebastian how do you deal with this yeah so um I think a challenge that we see is that people want to collect user data and specifically one fundamental challenge that I see is on the marketing side we want to know more right we want to understand user Behavior to optimize things and like this mindset shift is is really tricky to to deal with so that's one of the more tricky things that I see but ultimately I think it's fine that we you know want to find out something but make sure that you do so in a way that protect users and kind of how we do that at Hopper is we want to bring you the ability to offer digital products without allowing user tracking on the most fundamental layer right which is IP data IP address based tracking so yeah ultimately it really is a mind shift in embracing privacy going all the way think about the user think about yourself because you know that Regulators are going to come after you if you do [ __ ] up and yeah so protect privacy in all layers because otherwise this is going to backfire badly very clear Ryan hausa in the financial asset aspect industry that you're in challenges um I think uh well there's obviously a lot uh we will be trying to fix Finance if it was already perfect but uh I suppose one of the biggest challenges is that these entities have this huge data spaghetti of existing technology and then any solution that we offer has to go into that or onto that and no asset issuer no Bank no financial institution is going to throw out all their old stack and replace it with what we have since we solve one very particular problem for them and so yeah obviously we can build the most secure the most privacy preserving thing in the world but it has to interact with this other stuff which uh depends we don't know if it will be or not so um we obviously have to work on some solutions to that whether we can assist with that or at least just make sure that our part is as good as it can be but this is a challenge as I said Adrian how do you deal with that in cisma what the changes right yeah I think it's the we are very on the a crypto native side and the yeah the crypto community and I think it's the the it's hard to speak with with regulators and to educate them I guess and there's always this balance to find between being super focused on building the alternative and educating Regulators for instance before launching uh sismo I was working on in defy and I think it was a mistake to go to them too early because you you lose time and then you'll pin yourself in the system so but at the same time if you don't do the education then the society won't benefit from what you're doing so it's finding this past I know that I've made for instance the French government for data and they have interested use cases and they are interested in sisma and so how to make sure that on long term we managed to get into the conversation as if we imagine that we are one of one of the most legitimate Builders how to take the spots without losing your focus that actually being the best Builders so that that will be the challenge I think for for me I think we can agree that you all are embracing regulation and how can we help The Regulators to understand what we're doing and and give user privacy a priority same with compliance and security so actually So currently we have seen different approaches to create so we all agree are in the same fact privacy is and human rights we all know this but when we look at the previous history on the internet style there is a strategic campaign that was kind of preventing that these words are spread out to the massive users so that they can be aware of it and then there is a growth in the Privacy awareness So currently we are paying for this strategy and that is why we have been doing all the events these type of events are contributing in a positive manner we developers taking our part so that we are trying to find privacy preserving Solutions in an user-friendly way much more efficient way and also trying to solve the use cases within this manner I think from the developers and the hackers perspective we are doing our best I guess within the same manner by being regulatory friendly but still we will be having the struggles as we have seen from the tornation education and Alex Unfortunate Events so but in the end I believe that we are in a good path and we will conquer this and we will kind of reach out to our dreams in a much more faster manner I believe nice education is still a big topic Sebastian how do you think we can help educate The Regulators yes so um I think being more actively engaged in the process is something that many especially technically um interested folks are not really interested in doing but that's our future right so we can try to go against regulation we can try to go and on and so on for most of us for most people who actually build products that doesn't work so I would just say engaging in the process engaging with lawyers not because you want something from them but also because you can help them understand is super damn important if they don't understand what we are building here they will come up with [ __ ] regulations right so it's up to every single one of us here who is Building Products Who's involved in the infrastructure side of things to really engage and educate them I've seen that in Switzerland play out pretty pretty nicely so we have what is called a DLT law which is kind of a technology neutral law that allows you to issue for example shares as a first-class citizen in the eye of the law and that's pretty cool like you know you had law firms that were um like really leading law firms in the country which were in working groups drafting laws you know it's it's not some random people who write laws it's typically working groups that are working very deeply in a very engaged Fashion on that and yeah do reach out to these folks and offer your help they are very grateful because to them it's really like a foreign language that they have to understand they're struggling right and they contacted me in for example saying hey can you help us understand what is this hard Fork thing like you know how do we deal with that when you issue shares and now there's two shares like what what happens so there's a lot of really technological insights that have huge impact for Regulators please do help these guys many of them do not have bad intentions many of them do want to do rights by their mandate to protect the people right and we're going to help them that's my answer Ryan developers and now is at the table will that solve everything in the regulation say again sorry developers and lawyers at the table does that solve all the issues I think it really goes a long way I mean generally I couldn't agree more with Sebastian about engaging with The Regulators you can I would just tag on and say there are also other ways to educate uh to educate the legislators because for example here in the EU we've got um a couple of very nice schemes the the DLT pilot scheme which allows you to build things like mtfs or trading and settlement system on the DLT infrastructure and also the regulatory sandbox which allows a broader scope of regulations now you're actually building within these rules so this is not so much in the literal sense about educating The Regulators you're building but you have to explain to them what you're going to build in layman's terms in tldr terms they have to understand it they have to sign off on it and then you give them updates along the way uh and so again when they sit down and decide they're going to write rules they're going to write rules based on what they've seen and they'll have seen your stuff so it makes sense that you should be building taking advantage of these opportunities to build on on these things right now and put it right in the front of the regulator's minds for when they decide to come up with some final legislation Hadrian do you think it's a perk that you're in France France is a bit more Innovative and regulations while Europe should be one united front it differs per country um could you repeat just to be sure do you think that you're be you being based in France as a perk because the regulation there is a bit more Innovative and stressed already um from I said I wouldn't say that I would say that they are all somehow the same trying to figure out things and so to to about education again I think that we all have a different role to play but we should be all together and one way to get there into the education is to get into a leadership position and do it well meaning that that's a way to be like you can think about F text and coinbase for instance both were leaders some of the one of the uh one of the two has better are actually trying to regulate itself for the sake of users and so that's also a good pass to be is just take the leadership position try to satisfy users and then you can have an impact and show the things so that's that's also one way to educate I think it's to focus on having a large base of users and respect them and prove that your solution is better that than their solution for regulating and protecting users so privacy by Design if we all build that and would that solve all compliance and security issues So currently we are facing the problem of the definition within the web 3 space yeah so from the lawful perspective we still don't have a proper definition for the different assets and there they have been trying to build one and even that is the case based on the regions based on the countries those heuristic systems are different so the first thing before coming to developer part is to finalize these definitions I believe and it seems that it will take some more time so that we can still have time to innovatively develop different projects and utilize different sold different use cases but the case is that so we need to handle this part in a two different manner we need to accept that we should have whole private environment l1's so on so forth but on the other side we currently have transparent albums as well so for in both of these phases we can utilize the Privacy by Design in our privacy preserving solutions by also taking into account regulatory Parts as well so that is our life of course some parties may try to gain as much data as possible that is the thing we need to fight against so basic regulations already satisfy and should comply the user privacy so that is the part we will be kind of facing some issues I believe but still I'm very optimistic in this way and we are in the good good track and we will be able to provide Solutions in this manner thank you thanks to all the panelists we have some audience questions um I have a nice one for you Sebastian your comment on innervation is the worst enemy of all regulate uh no sorry Innovation Wars enemy of regular regulations sorry Innovations Worse Enemy are regulators so um in a way yes Regulators are holding back Innovation on the other hand I think it's important to focus on what is the mission right what is the reason for Regulators to exist they exist so that individuals don't get screwed all day long I think that is largely aligned with the goals of web3 like we're building self-custodial technologies that empower the individual so that you are protected from overreaching organizations governments and individuals so in a to some degree we are mission aligned even though sometimes we are you know getting entangled a bit I have one for you as well Ryan what's up with the fact that Regulators are always affected politically parties rather than focusing on the benefits of the majority of the population one more time sorry what's up with the facts um that Regulators are always affected politically rather than focusing on the benefits of the majority of the population that's a great question that's unfortunately something that you cannot avoid when you talk about Regulators they do work for governments it does depend on the country though it's not always the same everywhere there are countries where Regulators are part of the Civil Service and they're somewhat politically neutral compared to the people that are telling them what to do but we are unfortunately living in a period of time where um the political neutrality of things like the civil service is maybe getting lower than it has been in the previous decades which is unfortunate that we're in that particular period but at the end of the day though if we're talking about countries where there's a vote a democratic vote you can you can be politically aligned but you still have to win an election at some point so you do have to think about winning a majority of hearts and Minds at some point um so still compared to the Alternatives I think I'd rather have the system okay clear I think that's also one of the issues with Regulators they're there for just a certain amount of time and every four years or other terms their terms change their election agenda changes and yeah Innovation doesn't go over four years all the time so it takes time to write legislation as well to have all the consultations to get all the groups involved to get the opinions to write it down you know these things sometimes they might not be finished within a single political term they could take course over two or three political terms in which case the parties could change that could be a good thing potentially to get different inputs along the way thank you um then I have a nice closure question for Adrian who who cares enough about privacy to take action and not just talk about it I think the way to care about privacy is to realize that was what I was explaining in my talk but that privacy is not only a feature it's not like I can do it in public and I can do it in private that with privacy you can do so much more web 3 is about taking ownership of our identity on the internet of our assets and with privacy you can do so much more in the so much safest safer way so it's bringing value to actual people so if it should be obvious so let's just build it and we have the Technologies today it was not the case 20 years ago neither 10 years ago actually so yeah Builders can build and make users enjoy without even knowing about it that's what we're trying to do that uses feel the power of privacy without needing it like one of the very known sentences users don't care about privacy that was through in the web 2 world where they didn't get access to all the data so of course they don't care about privacy like it's privacy by design by webto companies because it's head hostage in service but now that we get back the power of data to users we need privacy to make like products that were not possible before so hopefully they won't care still that they won't they will enjoy it Sebastian yeah maybe it's just a last shout out here if you care about privacy I guess most of you know it you should run your own notes if you want to run your note but don't have one uh there's actually a raffle going on right now shout out to DAP node you can win a hopper branded uh top-notch top note check out the Twitter accounts of Ethan Hopper and depth node and somebody's running around here carrying a dub note if you can solve the puzzle nice one well thank you oh um any questions from the room still nobody well let's all care Emmanuel go ahead we are normally talking about two different things what's your take about that and how compliance and law enforcement play different roles fully open ing summarizing how does the panel look at compliance and law enforcement who wants to take this one oh don't be shy so in the low enforcement informant site so if I understand by this do you mean the illicit activities so that that should those should be discriminated from the legitimate users yeah you mean that one I believe if I understand it correctly so if this is the case of course we should be providing or we should be trying to distinguish these Bad actors from the normal user perspective so this is one part but when we come to the compliance part I think it is a very broad term as it is in the case of the Privacy definition so I remember the days there was a quotation probably it was Google's previous year one of the previous years he said that okay if you have something to hide you shouldn't be doing it for the first place he said in one of the broadcasted programs so we and in those days we were still having the regulations and we all know that privacy is still human right so there that is why I said a strategy campaign where in place against this type of regulations so we need to have a proper definition but before we need to define the assets then we need to define the compliance again with respect to data minimization so that is the cure part here because there are lots of cases and lots of data has been collected about the users their financial interactions their social environment any personal identifiable information are tried to be stored somewhere so that they can Harvest some extra business logic use cases so that is the part when what we are discussing actually and here when we are talking about this the definition with respect to data minimization should be in place within those regulations so that we can be compliant and also respecting the human right at the same time I believe thank you so much I would suggest to discuss this further outside of the stage thank you all and well let's all care about our privacy foreign