Closing the Loop on Blockchain and Governance Course

Back in September I published what I thought was a tentative course schedule or outline for an independent study in Blockchain and Governance that I was asked to supervise. This course was definitely a "Build as you fly it" kind of thing, so the end product ended up not looking a whole lot like the starting product, but here it is in all of its glory. In all, I was pretty happy with the course; I think it lent a nice development of a multi-factor approach to governance in blockchain applications.

I think the key insight that came out of this course, is that governance isn't just on one tier of the platform, but all tiers of the platform and that governance decisions need to include the holistic, and complicated, interactions of multiple nodes. In short, and by way of example, Ethereum (or HyperLedger or Bitcoin or Ripple), isn't just the platform/protocol layer, but also consists of the application layer, and the "user" layer and each layer has some stake in the governance of the other layers. Any governance in any layer that doesn't account for that will fail. For example, see this Maersk article about their partnership with IBM on a HyperLedger-based shipping application that is struggling to find adoption. By locking down governance in the protocol and application layer, users are, unsurprisingly, saying they don't want to participate. And, indeed, without considering the implications of governance decision in other protocols, there is general reticence to adopt the technology more generally.

We can look at models of international governance through network modes of governance and how it integrates both the international organization theories of governance and even the governance theories of anarchy to show that the complex system of blockchains is much more than letting miners vote whether to fork or not.

2018 - Fall Semester 

  

Wk 1 Blockchain Basics 

Wk 2 Proof of Work 

Wk 3 Proof of Stake 

Wk 4 Hashgraph 

Hashgraph White Paper 

Wk 5 Ethereum Fork  

https://qz.com/730004/everything-you-need-to-know-about-the-ethereum-hard-fork/ 

SEC DAO Report (see Readings) 

https://www.etherchain.org/hardForks  

review forks 

why did the “unplanned forks” happen? 

what were the “planned” forks intended to resolve? 

Wk 6 Intro to Managing Decentralized Development 

Kogut & Metiu - Open-Source Software Development and Distributed Innovation (see Readings) 

Krahmann - National, Regional, and Global Governance (see Readings) 

Crane - From governance to Governance (see Readings) 

Wk 7 - Anarchy 

Oye - Explaining Cooperation Under Anarchy 

Axelrod and Keohane - Achieving Cooperation Under Anarchy 

Mercer - Anarchy and Identity 

Wk 8 - International Organizations 

Morrow – Modeling the Forms of International Cooperation 

Abbott – Why States Act Through Formal International Organizations 

Barnett – The Power, Politics, and Pathologies of International Organizations 

Wk 9 - Network Governance 

Provan and Kenis - Modes of Network Governance (see readings) 

Hafner-Burton, Kahler, and Montgomery – Network Analysis for International Relations 

Banczyk and Potts – City as Neural Platform: Towards a New Economics of Cities

Dear Anyone #2 - October 5, 2018

Book I'm Reading: Bored and Brilliant: How Spacing Out Can Unlock Your Most Productive and Creative Self. Normally I avoid anything that looks like a business or self-help book. This book was recommended to me by a colleague at a different university, so I felt obligated to at least read it. I did so thinking I would give it the yeoman's effort and then give it up about 1/2 way through. It's been more interesting than I expected. The folksy writing gives it the air of a transcribed podcast (not too surprising, I think). But, I was also looking for justification (to myself) for less "phone time." It turns out, in the grand scheme of things, I'm actually not that bad with my phone; I thought I was a "heavy user" but it turns out I'm barely on the heavy side of average.

Best Thing I Read This Week: The Myth of the Infrastructure Phase - Dani Grant and Nick Grossman. A great article about blockchain protocol development. This feeds into my theories on blockchain governance that we (software developers) typically think of things like governance as being an application-level issue. But recent problems with security, and with building robust usability in blockchains themselves, have many experts thinking security and governance need to be built into the protocol itself.

Best Music I Listened to This Week: I went to the We Were Promised Jetpacks show at The Majestic Theater in Madison last week. The opener was a lady/band called Jenn Champion. Openers can be really hit or miss; she was a grand slam.

Open Source Licenses as Blockchain Governance

Bitcoin Core is licensed under the MIT License - a permissive, non-copyleft, open source license. Ethereum is licensed under GPL v.3. IBM Hyperledger is closed source core, but its Fabric (smart contract development framework) and Composer (application development framework) products are licensed under Apache.

The choice of how to license the core of the blockchain is a governance decision and it has consequences for the future of these chains. For example, by failing to put any significant conditions on its license, just about anyone is free to fork Bitcoin Core for any purpose. For example, a joke coin designed as a satire for cryptocurrency itself, or a coin whose every transaction is truly anonymous and thus a facilitator for global terrorist transactions.

Clearly, and without judgment, Bitcoin Developers are OK with these forks. But we could imagine a universe where a blockchain developer were not OK with these applications. In such a way, one mechanism for avoiding undesirable forks would be to impose license conditions that prohibit the undesired activity. Provided that a fork followed the conditions (e.g., don't use this code to directly or indirectly aid terrorist activity - a condition that, for example, ZCash could not fulfill because it can't guarantee its compliance). Of course, post hoc compliance isn't exactly optimal; if (in our example) ZCash violated the license, then, Bitcoin may feel that its complicity in terrorist activity is complete despite the violation of the license.

On the other hand, Bitcoin could institute multiple governance methods to ensure compliance with its license. It could create a license approval process that every developer, user, node, or miner (or an approval panel) in the Bitcoin chain could vote whether to permit the fork or not. It could institute Digital Rights Management schemes that enforced license compliance. There are a universe of other mechanisms that could be instituted that wouldn't require taking the drastic step of making the code closed source.

I know a lot of these words are "bad words" to the crypto and blockchain purists, but I see them as tools of governance - of creating a platform/protocol for doing business and transacting on the web. Moreover, I've railed incessantly about "private blockchains" being stupid (they are). Adding licensing restrictions wouldn't close the chain's permissions, just the permissions for forking and further chain development; in other words, to paraphrase Hashgraph, it's a permissionless chain, but permissioned source code.

Governance in Blockchain in the Government

I was asked to supervise an independent study for an undergraduate student in International Studies. The student came to me interested in the use of blockchain in Government, and, in particular, the use of blockchain in Estonia in creating their digital identification system that underlies many of the social and financial services.

I thought I would share the course outline and initial readings for anyone interested in this subject. I'm wondering how and if this might turn into a course, but I haven't gotten that far yet - so ignore the non-teacher-y parts of these data dumps.

COURSE OUTLINE

1. Technical Governance v. Meta Governance
1. Blockchain Basics
2. What is Consensus?
1. Proof of Work
2. Proof of Stake
3. Hashgraph
3. What is a Fork and why do they happen?
1. Ethereum Forks
2. Kogut Article - What can Open Source Development teach us about decentralized governance?
2. What is the Role of Government
1. Anarchy: State-to-State Negotiation and Accountability
2. International Organizations
3. Decentralized/Network Governance
3. Technological Issues
1. Interoperability
2. Scalability
3. Decentralization
4. Institutional Legitimacy
5. Security
1. Blockchain Security Issues(Upper Tier Attacks)
1. Lack of Governance: Who determines what happens with the chain when something goes wrong and what are their motivations? Transparent democracy or closed dictatorship?
2. Bad Contract Code (Middle Tier Attacks)
1. Replay (51%) Attack: duplicate transaction on each node in chain
2. DDoS Attacks: Forks 2 and 3
3. Lack of Quality Control and Certification (The DAO Attack)
3. Wallet Security Issues (User Attacks)
1. Phishing, Spoofing (wallet, address), etc.
4. Case Studies
1. Case Studies: Decred and Hashgraph (Governance)
2. Case Studies: Z-Cash (Privacy)
3. Case Studies: Ripple (Blockchain in Banking)
4. Case Studies: Cicero/Accord (Blockchain in Law)
5. Case Studies: Estonia (Blockchain in Government)

Reading List (so far, this is very incomplete - the outline is pretty set, particularly the first half of it, but I'm still working on the reading list; if you (is there a you out there??) have any thoughts, let me know.

• Hashgraph White Paper (see Readings)
• https://qz.com/730004/everything-you-need-to-know-about-the-ethereum-hard-fork/
• SEC DAO Report (see Readings)
• https://www.etherchain.org/hardForks
• Kogut & Metiu - Open-Source Software Development and Distributed Innovation (see Readings)

In the "You Don't Know What You Don't Know" Dept

On May 25, 2018 the General Data Protection Regulation ("GDPR") goes into effect in the European Union. That's this Friday for those of you playing along at home. It is a comprehensive system for the protection of "Personal Data" applicable to any resident of the European Union.

The GDPR is quite comprehensive, and I won't go into all of it. Relevantly, though, it requires that "Data Controllers" (entities that collect data from users) or "Processors" (entities that process data for Data Controllers) disclose the collection of  "Personal Data" ("any information relating to an individual, whether it relates to his or her private, professional or public life. It can be anything from a name, a home address, a photo, an email address, bank details, posts on social networking websites, medical information, or a computer’s IP address") and require that "Data Subjects" have control over the Personal Data. There is a whole litany of resources on how Data Controllers and Processors can comply with the GDPR.

The GDPR, among other things, contains some interesting rights, for example:
- The Right of Erasure
- The Right to Data Portability
- The Right to Rectification

Here's the interesting rabbit hole: The GDPR recognizes the concept of "pseudonymization" - “[T]he processing of personal data in such a manner that the personal data can no longer be attributed to a specific data subject without the use of additional information.” So, this isn't "anonymization" or removing any marker of Personal Data, but rather adding an intervening step to figure out to whom the Personal Data belongs. Perhaps through the process of "hashing" or "encryption."

It turns out that such pseudonymous Personal Data is not exempt from the GDPR, and thus it is still subject to the Rights enumerated therein (unlike truly anonymized data which is exempt).

You say: "That's not that interesting"

"Ah, but what about THE BLOCKCHAIN?" I say.

I'm not going to into too much detail here because multiple authors have tackled this better than I possibly could (see, Van Humbeeck, Andries, The Blockchain-GDPR Paradox, The Ledger, Nov 21, 2017 and Luvai, Kennedy, How Blockchains May Comply with GDPR Mandates, May 2, 2018). But the basic gist is this: when data is written to a blockchain, it is, more or less locked in place and can't be deleted (the word is "immutable"). New data does not overwrite old data, instead new data is "appended" to the chain. Moreover, data on public and private blockchains is frequently "hashed" and/or "encrypted" because blockchains, by their nature, are transparent. Meaning that any node can see transactions that occur on its chain; if there is data stored in a block, that data is often hashed or encrypted to prevent it from being truly public.

I'm sure you are beginning to see the problem: if the data in a block on a blockchain is GDPR Personal Data and the GDPR mandates that Data Subjects have a Right of Erasure of their Personal Data, it is functionally impossible for the blockchain operator (we'll ignore the question of how we even determine "who" the Data Controller or Processor is and assume we can even identify such an entity on a particular blockchain) to comply with the GDPR Right of Erasure.

Thus it seems that that the unstoppable force (blockchain) has met its immovable object (GDPR). Grab your popcorn for this show!

Decentralization, Technology, and the Realization of a New World Order? Or not.

Part 1 - What are we protecting anyway?

I think we need to assume that without rules or formalized order that systems tend toward chaos. Without this hypothesis, imposed order is unnecessary, right? If we think that without laws and rules that everyone will just peaceably get along, why do we need rules making murder illegal?

Maybe that's overly simplistic. Murder rarely happens even amongst animal species incapable of rule making because basic survival is a strong motivator for even unorganized groups to self-enforce basic concepts like "don't kill someone physically and/or emotionally near to others in our proximity." Still, we have examples of humanity, even in law-based systems, who through their own strength manage to murder large numbers of people who disagree with their worldview without immediate (or even proximate) consequence. Many (although it would be hubris to say all) have been brought to account before law-based tribunals. So, perhaps this itself is proof of the hypothesis. But, even for the sake of argument, let's assume that something so "fundamentally" (I know that's a loaded word) wrong as murder is self-executing.

But at what point do these self-enforcing mechanisms break down? Other basic needs, such as food and shelter, do not seem to be so "fundamental." Theft is relatively easy to justify based on perceived need (self-interest). Destruction is easy to justify based simply on revenge or relative worth. Even these simple transgressions require enforcement of the underlying concept of "exclusive ownership" (whether by the individual or by the community isn't particularly relevant at this point)^[1]. Let alone more complicated concepts that are fundamental to modern governance such as antitrust, freedom of speech, and environmental protection.

It is easy to simply point at today's somewhat universal system of law and order and say that we've proved the point. The fact that every group of humans have created laws and enforcement mechanisms is proof that such a system is de facto better than a system without laws and enforcement. To my knowledge there is no large group of people that operate under a functional anarchy.

To date, it seems that centralized rule and order (nations) have organized, roughly, along geographical borders. For most of human history this seems pretty obvious. Yet it seems increasingly obvious, that geography may not be the best control mechanism for groups of people to be organized and interact with each other.

So, one of the central questions that this series of posts will ask is this: if we could get rid of the current geography-based systems and, using modern technologies, re-align ourselves, what would that look like? Would we still engage in dispersed centralized behavior (i.e., we would still be centralized, but not around geography)? Or is "true" decentralization (in essence, anarchy; each individual acting, for all intents and purposes in their individual interest) possible in a modern techno-utopia or desirable?



^[1] It might interesting to look at societies that managed to survive for long periods that had "political" systems that did not have an underlying belief in "exclusive ownership." Even a system like communism believes that resources are "owned" by "the people" such that taking a "community" item for "personal use" would be transgressive. Without more research, it seems that a more apt candidate might be some Native American systems that view some types of property (such as land) as "unownable."

Did You Know? Blockchain + Cheese

Did you know that the first international commercial transaction to use the blockchain as a verification mechanism was for cheese?

Back in September, Irish cheese cooperative Ornua (purveyors of Kerrygold for those hip to the know here in Wisconsin), sold a $100,000 letter of credit for cheese and butter to Seychelles Trading Company using the blockchain.

How did it work? The blockchain is a secure and inherently authenticated record-keeping mechanism. Thus, much of the lengthy contract due diligence of confirming who the parties are is short-cut merely by using the system. Second, now that the parties are authenticated, secure documents can be transferred digitally. Finally, the transaction is posted to the blockchain ensuring transparency and confirmation of the transaction.

[S]uch transactions typically involve a complicated paper trail that requires international courier services, is vulnerable to document fraud, and can take as long as a month to be completed. ... [U]sing blockchain technology, [] a process that normally takes between seven and 10 days [was cut] to less than four hours

Smart Contracts are a Future

People like to say "such and such is the future of the law." I happen to believe that "the law" is not "a thing." There are numerous laws - just ask a Public Defender to write an Operating Agreeement, or a patent lawyer to write a will, you'll see what I mean.

It's a cliche to say, but technology is changing the practice of law. For you senior partners, just recall the integration of computers into the workplace. For you managing and active partners, you'll recall the introduction of online research. For senior associates think abou the social media revolution and how that has changed not only marketing, but client communication. For new associates, well, you don't get paid to think - just finish your assignment and get that brief to Janet.

Technology is already playing a role in access to legal services. Skype enables access to lawyers for clients in rural areas. Services like UpCounsel can find you an expert anywhere in the country. It is also playing a role in the performance of legal services - from online research to cloud-based practice and document management. Every courtroom is now equipped with multiple computers for everything from docket management to displaying evidence.

So far, though, technology has largely been used to bring lawyering into the 21st century. Being a lawyer today from a practice perspective is still functionally identical to being a lawyer in the 90's, 80's, 70's, 60's, 50's, 40's, 30's, 20's, etc. etc. The practice of law itself has not been fundamentally changed by technology in the way that, say, advanced manufacturing has completely restructed production of goods. People who cut dies are no longer high school dropouts - they are college-trained computer and manufacturing engineers programming advanced robotics. Not to mention cloud-storage being the "killer app" to tree-based document production.

Smart contracts are going to start the re-invention of the practice of law in the same way that robotics has redefined manufacturing. It won't be better or worse, but it will be different - and it will require very different skills.

What is a "smart contract"? A smart contract is a set of "computer protocols that facilitate, verify, or enforce the negotiation or performance of a contract." It is not only a contract that is self-enabling, but it is self-enforcing. We already deal with some smart contracts in our every day lives - think about iTunes and the music you "purchase" from iTunes. As you are aware, that "purchase" is not a "purchase" at all, but a license from Apple to use a music file that contains a bit of music on it; you may use it subject to some terms - for example, you can only download and play it on up to 5-7 Apple devices. There is a bit of code embedded into every music file that checks how many different devices it has been downloaded to and whether those devices are Apple devices - if either test fails, you can't play your music. That license is self-enforcing - it doesn't need a lawyer at your house to audit where you download it and what kind of devices you play your music on.

In one of the earliest papers on smart contracts (1997), Nick Szabo (himself an enigma wrapped in a puzzle) describes another such smart contract: A car loan. In his hypothetical, he describes the contract as such: a consumer gets a car loan that requires repayment for a term and is secured by the car. At the time of the loan a lock is installed on the car and lock is programmed to do the following: 1) let in the owner but exclude third parties; 2) a second opening option for the creditor; 3) the creditor option is only turned on if the borrower fails to pay for some period of time; 4) upon final payment of the loan, the creditor option is disabled. Again, we have a self-enabling and self-enforcing contract. While it would require sophisticated electronics (verified that it only does what it says it will do and cannot be hacked), it requires nothing more than the technology to enforce the contract.

The parenthetical caveat to that hypothetical, while an aside, is probably the most important part of the sentence. Without security (technological, not legal security) to prevent hacking the contract cannot be self-enforcing. Without technology to truly and unmistakably verify the participants and the payments, the contract cannot be trusted. While it would be hubris to suggest that those problems are "solved" (they aren't), it would certainly be true to suggest that they are very close to being solved.

Without getting into too much detail, the technology that underlies Bitcoin (itself, possibly, maybe, invented by Szabo), called the blockchain, might form the basis for solving the verification and security of smart contracts. New technologies, like Ethereum, are making this a reality. Originally, this was going to be the whole centerpiece of this article. But, I see I'm running long, so I'll cut it short here and just say that I'll describe how Ethereum works and its potential applications in a later post.