Logos | Web3 privacy, infrastructure turn and lessons of the Crypto Wars. - Agata Ferreira

So, welcome. Uh my name is Agata Ferreira. I'm a CLO of Institute of Free Technology. And our main project being Logos, which is decentralized privacy-preserving full tech stack with a blockchain and messaging and storage layer. So, today I will talk to you about Web3 privacy infrastructure turn and the lessons from the crypto wars.

I'm a lawyer. Uh so, I'm I'm not a technologist, but um I think a lot and deal a lot with laws and regulations. So, what I wanted to start with is a statement that there has never been a medium, not one, in the history of money or the history of communication that exposed everything about everyone to everyone else and forever. So, this is unprecedented because there wasn't there was never a ledger book or nor the telegraph, not the wire transfer, not the clearinghouse. Every system we have ever built for moving value has been confidential by default with disclosure that was carved out of it in some way to a counterparty, to an intermediary, to a court.

So, disclosure was always an exception and confidentiality was always the base. And then we built public blockchain and we inverted that. The transparency was a deliberate uh design choice, but I think what was not anticipated was how completely analytics would strip out not uh strip out pseudonymity that made that trade-off tolerable. So, what we have now is a system that where the total permanent global disclosure is the norm and privacy is that thing that you have to justify. And I would like to convince you of something that may sound strange coming from a lawyer at the Cypherpunk Week event, but you are not the radicals in this room and the ledger that exposes everything is actually a radical design.

And privacy that we are all building is actually restoration of a norm that every previous system already had. And I'm I'm here also to tell you that the law, if you read it carefully, is closer to your side that you think most of the time, anyway. So, let me start with a story which most of you probably know. 1993 and strong cryptography was on the United States munition list. Not metaphorically, it was actually legally included there alongside tanks and fire aircraft.

And when Daniel Bernstein wanted to publish his encryption source code, the State Department's position was that putting it on the internet where a foreigner might read it constituted an arms export. So, think about what that means. The thing that you have in your browser right now, the padlock, in our living memory was actually considered a weapon. Now, what the government proposed at the time, which is also a useful lesson, was something called Clipper, which which was a chip with a key split between between two federal agencies that could be reassembled under lawful authority. So, there would be privacy for individual, but access for the authority.

Everybody wins. Yes? Well, no. Clipper failed. Failed in three ways in 3 years.

It failed technically because someone found a protocol flaw that let you bypass the escrow entirely. It failed politically because there was a strong opposition to that solution in the Congress. And it failed commercially because nobody really wanted to buy it. So, I would like you to hold on to that because I will come back to Clipper. I believe Clipper is one of the more important lessons from the '90s, and it's often overlooked.

So, going back to encryption, what happened? What actually changed? Uh and actually it was not the court case because Bernstein court case is nowhere near as clean a precedent as we remember it being. It wasn't really a victory of any massive social movement either. What changed is that the encryption stopped being something you choose and became part of the infrastructure.

So, solutions like PGP, which I'm sure you're familiar with, that involved a decision. Individual had to install it, therefore they had a reason that was legible, and they could be that reason could be held against an individual. But TLS, that is not a choice. When encryption descended into transport layer, into browsers, into servers, and it got there not because of activism as such, not because of any mission or philosophy, but very pragmatically because of economics. Because Visa and MasterCard needed it for online commerce.

So, it was pragmatic economic calculation. Commerce prevailed. And once encryption became part of the infrastructure layer, once that privacy was in the infrastructure, then the legal question changed entirely as well. Because nobody asks a bank today why they encrypt. And in 2016, GDPR named encryption as appropriate security measure in Article 32.

So, the law now endorses encryption. By 2018, Google was labeling unencrypted sites as not secure, which is to say that actually the absence of privacy, the absence of this protection, this encryption security is considered a defect now. So, the padlock now is invisible, universal, and nobody sees that as any concession to the wrongdoers. So, that's the trajectory. That's it.

From a technology that is classified as a weapon to this being an expected baseline in about 30 years time. Another example is Tor. It's a similar trajectory, maybe even a better comparison because Tor hides who is talking to whom, not just what they said. And onion routing came out of the US Naval Research Laboratory. And then it was for a long time associated with the dark web.

And today is partially funded by the State Department Bureau of Democracy, Human Rights, and Labor. Its normalization also happened. It's not complete because there are countries that try to block it. And there are countries where it's being debated whether running an exit node is a crime. But it is still used every day by millions of people.

So, I'm not predicting that Web 3 privacy will go through exactly the same trajectory. But what I'm extracting here for analysis is that legal approach changes when privacy becomes an infrastructure. And the lawyer's version of it explains the enforcement actions we have witnessed. Uh like Tornado Cash, for example. Because elective privacy, privacy you have to uh opt into, uh produces the things that liability is built from.

There is a user that makes a privacy choice. There's an identifiable actor. There is an intent. There is a circumstance. So, if somebody has to make a proactive choice to go private, you can ask them why.

What they have got to hide. And you can ask whoever built that thing they are using what they intended. But, when privacy is simply how the system works, then there is no decision or election that can be legally interrogated. So, this should be intuitive already because it's the logic of an anonymity set. A single encrypted page in a field of plain text is not protection.

It's actually a beacon. Same for a single privacy app or a single privacy protocol on top of transparent ledger because privacy that flags itself protects no one. Now, the part I actually came to say here as well as um the whole privacy debate gets often confused and collapses into a single argument. And almost every argument about Web3 privacy treats privacy as a binary between transparency and opaqueness. And it is not.

Because in decentralized stack, it it is several different properties. And they behave completely differently both technically and legally. So, one is content. What is the transaction? Amounts, parties, balances.

And this is what shielded transactions and message encryption protects. The second is metadata. Not what was said, but who talks to whom, who proposes the next block and when, what is the peer graph, what does it look like. And you all know that traffic analysis reconstructs enormous amounts without ever breaking the encryption. And then there is execution layer and execution state.

What action was taken? What changed the nature of the state transition? Now, watch what happens when you keep those apart. At the infrastructure layer, privacy is not in tension with security. It is actually security.

In most proof-of-stake networks, the people performing purely technical roles, like validators, are visible. The proposer schedules are public, predictable, validators map to IPs, IPs to operation operators. And And once you can see who is about to make a decision, and once that person that makes a decision sees what they're validating, then you can act on that decision. You can flood validators so that they miss the slot. You can pay and bribe them.

You can pressure them legally uh what to include and what to know in to not include. And this is a risk not only to operators, but it what it is what makes neutrality of the network negotiable. Because neutrality holds when there is nobody to pressure. But it doesn't if you don't give these participants privacy. If you make them visible, identifiable, then they become the targets.

And we saw what happened uh with the Tornado Cash because the relays became began filtering and at the peak majority of Ethereum blocks were produced by OFAC compliant relays. And that was not caused because Ethereum protocol rules have changed. There was no governance vote. Uh it was visibility and lack of privacy of validators that created legal risk. Then risk produced filtering and then neutral infrastructure quietly became mediated infrastructure.

So privacy embedded at that layer would remove it. And this is the property of resilience of the network. And there is another framing um and it's the one with the most leverage actually because the whole privacy debate has been framed around financial use, payments, and the regulations that attach to them. But an execution layer uh and the um the the execution layer records not only financial state but non-financial, votes, governance decisions, memberships, credentials, attestations, registers. So consider an on-chain governance system with a permanent public vote history in a society where the secret ballot is a settled norm.

And it is settle it's a settled norm for a reason because when your vote is visible, you can be bought and you can be punished. Article 3 of Protocol 1 of the European Convention guarantees that protection. Or take freedom of association. Compelled disclosure of your affiliations is actually treated in European and American law as an interference with freedom of association in itself. Or identity attestation.

Proving that you are over 18 or resident or unique human without having to reveal all data about you is actually data minimization in its purest form. And European data protection law has an article that requires exactly that. So, none of these can be characterized in money laundering terms. And this is when the real design question sits in my view. Because in at the infrastructure layer, privacy should be ambient and universal because anything else is a beacon.

But state, state is semantic. A payroll run or a treasury movement or a personal vote or a corporate filing, they all carry different requirements. So, what should be universal at the execution layer is the capability, not settings. The protocol should run the same program over private state or public state, indifferent to which. What the state actually is, whether it's a payroll or a vote or a filing, this is what determines the setting.

And if you think about it, this is exactly how finance and civic life worked before we built transparent ledger. Confidentiality by default and disclosure depending on circumstances. So, privacy is actually not radical. It's not proposing anything new. It's about stopping doing something unprecedented, exposing everything to everyone about everything.

And want once you separate the layers, most of the paradox around privacy evaporates. And not through advocacy, not through those kind of efforts, but really if you look at different legal instruments, they address different actors. So, take data protection laws. They actually govern processing of personal data. And they require data minimization and privacy by design.

In turn, if you look at crypto asset services and AML rules, they impose duties on regulated intermediaries, like exchanges. And neither set of laws requires that the protocol underneath is transparent and exposes everything. So, it's a HTTPS pattern. TSL hides the traffic in transiting transit and bank still can do KYC at the counter. So, encryption remains.

The obligations like that, they sit on intermediaries, not on infrastructure. And when and where regulated intermediary has to handle financial data, then we have tools like selective disclosure, zero knowledge proofs, that can be used for compliance, but at that level only. Now, here is the residue and I will not smooth it. But, things like EU new AML regulations from 2027 will prohibit regulated providers from offering anonymous accounts or mechanisms enabling enhanced obfuscation. However, it still binds providers, not protocols.

So, some privacy technologies will need compliance tooling before licensed intermediary can interact with them. Some will not need any. And some are built for context when there is no intermediary at all. And that's the spectrum of fit. It should not be seen as a spectrum of legitimacy.

This is a perimeter and privacy should not be seen as a risk category. And some activity was never inside that perimeter in the first place. So, two people exchanging a banknote, this has never required to record or report on each other. Same as peer-to-peer transfers between self-custodied wallets. It's the same thing in a different medium.

So, this is not a loophole. Now, I promised to come back to Clipper. And the usual telling of the story of Clipper is that the government tried to mandate backdoors, and we won. Hooray. But that's not the useful lesson in my view.

The useful lesson is what Clipper was. And it was an attempt to have both real cryptography and a standing capability to reveal held centrally by authorities. So, a blanket backdoor in effect. And it failed on every front. So, let's treat it as a constraint to hold on to.

Access must never be a standing central blanket capability. Not as a revealed key in the substrate of infrastructure, but also not revealed off chain. Because that second one is actually the the failure mode that can creep in by default. If you have a beautiful beautifully shielded chain, but then a compliance layer which reproduces mass data collection off chain that is pulled permanent and correlatable, then uh the map of who does what with whom permanently disappears from chain, but moves off the ledger into opaque centralized databases. And that is even worse.

Because the honest transparency that is even worse, because at least transparent ledger announces its surveillance. So, um proving specific fact without the revealing the rest, that is the actual frontier. And it is not solved yet. So, let me end when I where I started. The debate has been framed as privacy versus transparency.

It is not. It is whether misuse gets addressed at the edges, intermediaries, on-ramps, or by the entire financial and civic substrate of a society being permanently and globally transparent by default. And the answer is clear. It should be the edges. Not because the critics before were completely wrong about potential misuse, but because a permanently transparent default turned out to be dangerous design previously.

And the privacy layer was what made the previous new medium, Internet, fit for the ordinary large-scale scale legitimate use that it was always going to carry anyway. So, with privacy, you are not asking for something unprecedented. You are actually asking to stop something unprecedented, which is global, permanent, retrospective, and indiscriminate exposure. So, let's lower the temperature of the debate of privacy because privacy is not the radical position. It is actually a conservative one.

Thank you very much for your attention.