A Lawyer’s Take on Privacy - Programmable Disclosure I Nicole Farrar

We are going to jump into our next talk. And for this one, I'd like to bring on Oh, Nicole, who's the co-CEO of 01 Labs to tell you about her perspective on legal. Please give her a big round of applause.

Thank you. [applause]

Hi everyone. Um well let's see do I see some speaker notes? Okay thank you so much for coming today and to coming to Pragma coming to see um the talk and um thank you to Global for inviting me to speak um this is what I'm going to talk about lawyers take on privacy programmable disclosure. So, uh, speaking of the speakers, that's me in the middle, and here are all these other, um, distinguished people, um, co-founders, founders, engineers. Um, and I'm none of those things.

And I thought, well, why is everyone in, uh, why do I get to speak here? Um, well, I know what you must all be thinking. It's because I'm the only lawyer. That's a joke. Um but actually speaking of being a lawyer, I do think that I bring a unique perspective um to the space.

Um I wouldn't consider myself a cipher punk. That's not why I got into it. Um I think about defining rights and obligations and how technology can be used in ways to um enforce those rights and obligations and support compliance. So today I want to talk about that um and and specifically around privacy um and how everyone has different uh meanings of privacy and I think that causes a lot of confusion for our industry. So I'm I'm thinking of it not as secrecy or avoidance but as programmable disclosure.

This is how cryptography and specifically zero knowledge proofs can let us prove what's true without revealing anything else. And then applications can be built from the ground up customizable with policies that preserve privacy while also ensuring a lot of auditability and compliance. Um so just real quickly a little bit about about my background. I started out in big law um and thought it was kind of boring. So then I went in house and um I found my passion was fintech.

I I actually uh co-founded a a mortgage lending startup that went under. So that's why it's not on the slide. Um then went to lending club and then at that point that's when I got the cryptobug and thought, you know, I just want to be on the bleeding edge of of fintech. So went to Coinbase and then Ingridge Digital and now I'm at 01 Labs. Um in in my previous roles, I was very focused on product regulatory and commercial things.

Um, and so, you know, in all of these roles, I've seen a tension between what the laws require on the on the one hand and then the asurances and guarantees that regulators need um and then on the other hand, the information that customers are either uh forced to uh to provide or or encouraged to provide and then how businesses collect that data and store it and then also sometimes profit from it. Um, so one thing that really excites me about cryptography and zero knowledge proofs is how they can prove compliance and integrity without violating users expectations of privacy. Um, so yeah, I guess privacy is the word of the day um here at um Global and Dev Connect. Um, it's definitely having a moment. Um, this is a a graph of Zcash uh performance over the last year.

Don't you wish you bought it in September? Or if you're already holding it, don't you wish you bought more? Um, zero knowledge proofs are also having a moment. I don't know if you saw, but Andrew Tate posted something on X just a few days ago saying how you need to, you know, protect your Bitcoin with zero knowledge proofs, CKPs. Um, I'm not a big fan of his, but I do think it's kind of a signal that um this kind of technology is is going mainstream.

Um, and that post got 500,000 views. Um, so aside from like the tracing hype cycles of crypto, um, why is privacy becoming more, uh, urgent now? I think it there's a a number of forces that are are all kind of converging. Um, one is that institutional adoption is real. There's also been some changes in laws that make it better and easier for um for institutions to be on the blockchain.

Um but privacy is a real barrier to them adopting it. Um there's also this this um kind of trend I would say like a global trend that that trust in institutions, governments um and media uh and and um you know enterprises too is is eroding. Um and recent studies have shown that trust in in the US government is at an all-time low and I have to say I trust it less than I used to as well. Um there's also um you know been some instances of very well publicized instances of government overreach um whether it's it's real or perceived. Um 12 years ago was when the the news about uh Ed Edward Snowden came out basically disclosing that there was all kinds of illegal surveillance happening and then more recently tornado cash sanctions um which you know created a lot of fear obviously in our industry um and and actually um concerns about government surveillance are one reason why um you know uh institutions are not super supportive of CBDC species.

Um there's also um a growing movement for self- sovereignty and that's this is evidenced by um well for one thing like the growth in sales of of hardware wallets. Um and then finally there's data breach fatigue. Um I mean I don't know if you've heard there's some website I think it's called I've been pawned or something like that. Anyway you can go look at it and find all the all the ways where data was breached. I did it recently and and there were some companies that I don't even remember using their services.

Um so we're all kind of getting fed up with that and realizing that you know having centralized data stewards isn't really working. Um and let's see it was IBM published a report recently saying that the the average cost of a single data breach is now almost $5 million and it's just growing every year. So, what does that what has the the lack of privacy done for us in web 3? Well, I would argue that we've kind of gone between two fairly extreme states. Um, on the one hand, originally everything was transparent.

Um, yes, it turns out you need special software to track it. Um as someone mentioned earlier um but you know this is a on the left hand side is uh yeah your left um is the um a blog post from Nansson saying you know whale alert and look you can actually mimic this person's behavior um and and you know copy their trades um if you're a trader do you want somebody copying you know what you're doing and then on the other hand um we had this uh because of this lack privacy. We had kind of workarounds that were built um because we didn't have the right tools. So, one example was uh mixers and this is actually from point center. It's an illustration of how a mixer works and I think it's kind of funny that it shows a washing machine in the center because um that definitely makes me think of money laundering um even though plenty of people using mixers are doing it for legal purposes.

Um so um I'm gonna go to the next slide. So we need to think about a privacy a privacy in a way that that um you know that will allow us to uh meet different objectives and be flexible. Um so one thing I wanted to talk about is how privacy kind of changes over time and changes with technological ways. So, you know, privacy is um kind of one of the oldest instincts um kind of a basic human right. It's codified in a lot of laws and constitutions.

Um so, for example, in the United States, there's the Bill of Rights. The Fourth Amendment um prevents uh unreasonable search and seizure. Well, what did that what does that mean? Um a long time ago, it meant that, you know, a policeman can't come and barge into your home and and like arrest you. They have to have a warrant and to to have a warrant you have to have reasonable costs.

Um but then came drones and sat satellites and this new technology now permits seeing into people's homes and learning details of their private lives. So should the technology be prevented or should we create rules to restrict how the the technology is used? Um and then when you think about uh the advent of the internet, privacy I think initially meant this notion of not being tracked. You know like where are those cookies? What websites are you visiting?

And then uh as the capabilities of the internet uh evolved um you it became more about like the kind of data that you're submitting and how it can be used. Um, and I think it's even more pressing on blockchains because blockchains are decentralized. And so if your data is exposed there, it's um, arguably permanently exposed um, because of the immutability of blockchains and smart contracts. Um so there's also context specific privacy um which you know obviously like if you're at a stadium have a different expectation of privacy than um you know in your own home and I would say that even uh on the blockchain uh there's different expectations of privacy depending on what your role is and your experiences. So um the regulators when they think of privacy I think the prevailing notion is um like unlawful secrecy secrecy for the purpose of of evading enforcement.

Um and and frankly as a lawyer that kind of was my view until recently as well. Um and then if you're um a developer or cryptography privacy might mean encryption. If you're um a cipher punk or a libertarian, it means avoiding government uh surveillance and and oversight. Um and if you're an enterprise, it means, you know, costly overhead, having to comply with all these data privacy laws. So, I want to propose a new definition.

Maybe definition is not the right word, but a new sort of model or framework to think about privacy. And I've called it programmable disclosure. Um, and so what it means is using zero knowledge proofs and and also potentially other privacy preserving technologies, but this is the one that I'm most familiar with. Um, that's a cryptographic proof that allows a party to prove a statement to another party without revealing the underlying information. I bet you all know that being in crypto.

Um, but you can customize an application to disclose only the information you want to disclose and protect everything else while having the whole system set up with policies and auditability to show integrity and compliance. Um, so I'll just give a little brief plug about MINA. 01 Labs is the company that that launched Mina and Mina is the world's uh first and only succinct zk native blockchain. Um and one thing that's the thing that a few things that make it different are um everything is done with off-chain execution and then only the proofs are submitted onchain. Um there's no data and then the the chain uses recursion to make it succinct.

And so this means that all you have to do is verify the last proof and then you can verify basically every proof that was ever submitted to the chain. And so one thing this does is it enables composability. You can combine different proofs into one. And it's also cheap and lightweight and cheap to verify those proofs over and over again. Um so this allows the developer to basically choose the the level of privacy they want um based on user expectations and where where appropriate even legal requirements.

So I'll give um some examples. I think KYC is kind of an identity. It's kind of like um one of the first kind of most obvious uh use cases where we can apply zero zero knowledge proof technology. Um but here's an example of how you can use that to even make composable statements about your identity. So let's say you want to invest in a private securities offering in the US and you're a US citizen.

So, they're doing that off uh offering under regulation D. So, first of all, you want to prove that you're over the age of 18 because that's the legal age to enter into a contract. Um then you want to prove that you're an accredited investor, which means you meet certain uh minimum requirements around income or net worth. Um you need to prove the source of your funds so that it's not coming from some sort of illicit source. So, the source of my funds in this case is my salary.

Um, and then finally, I'm not on any government sanctions list. So, with Mina, you can combine all of these statements into a single proof that can be easily verified over and over. Um, these are kind of more theoretical, but I just wanted to give a couple of examples. Um, in healthcare, you could prove that a patient meets the the uh criteria for to participate in a particular study. So those criteria might be like I have genetic mutation XYZ, I have a particular type of cancer and I've received a certain type of treatment that has, you know, my cancer hasn't been responsive to that that uh treatment.

And you can show this by submitting proofs of statements about your medical records. Um so another example is in supply chains, you might want to show that all of your suppliers have some certain kind of certification. like maybe you're selling food and you want to show that it's organic. Um but you don't want to necessarily reveal who your suppliers are. That might be considered even competitive information.

Um and so you know in both of these cases the whoever's verifying the eligibility doesn't necessarily want or need your data. Um but by h by using zero knowledge proofs they can verify that that you meet the requirements. Um and then also in medical studies it could even be an advantage because you don't want the studies to be influenced um by you know the uh the characteristics of the individuals. Okay. So what's needed for us to um make this a reality?

We're obviously nowhere close um at this point, but I think we're making a lot of progress. Um I think [clears throat] that technological advancements aren't really the the biggest barrier anymore. They still are a bit of a barrier, but there have been a lot of advancements in the in the space. You know, faster proof systems, um folding schemes, lattice space proofing, and even some postquantum uh you know, uh proof systems are being developed. Um there's also a fair amount of infrastructure.

There's proofer markets like um succinct and boundless are a couple of examples of those. Um we do need more applications leveraging this. Um and then finally I think the the most important things we need are education advocacy and ultimately some changes in laws. Um and some things I would propose to accelerate that process are um let me think about this for a minute. Um okay so you might have a um one idea is you run duplicate systems for a while.

Um for example like some institutions when they first tokenize things on blockchains they had a paper version and they had the the tokenized version. So I think that's one way where we can start to prove that this technology really works and let regulators and others who are skeptical check the technology over and over and see that it works. Um we can also uh advocate for regulatory sandboxes where you can um you know apply the technology in a very limited space that's kind of overseen by a regulator. Um, and finally, we we do, I think, need some changes in laws because, um, in a lot of cases, it's either not clear that that this type of technology would be acceptable to verify a certain thing or it's clearly not allowed by current laws. Um but I think um there's a bright future out there and um you know just as some takeaways um privacy does not always mean secrecy but it can um zero knowledge proofs allow you to control what you disclose.

Um we need frameworks and regulations to catch up with the technology and that requires education and advocacy. But finally, programmable disclosure I hope is a model that everyone can align on even with their different um perspectives. So, thank you very much.