The Issue of Interoperability - TOKEN2049 Singapore 2022

hi everyone thank you so much for joining us today and I was hoping that we are going to have the laser drummers that we had earlier uh for Malcolm's first panel but I think they've skipped those this time we've got a really exciting panel today my name is Alyssa ostrov I'm the chief of staff at crypto compare we are a market data provider based in London um we only have 15 minutes today so in the interest of time I'd like to invite my panelists to briefly introduce themselves and their firms hi hi everyone I'm um rigank so out of the 15 minutes I think Malcolm and I can take uh five minutes each for our introductions and then spend like another five on the panel I know I'm just kidding uh so I'm one of the co-founders and the CEO of Merkel science uh we do blockchain analytics to detect crypto crime we provide compliance solutions to crypto companies and financial institutions it's forensics for government agencies and investigators uh Malcolm Wright so I'm director of reg Affairs for gbbc digital Finance which is the world's largest member body for crypto so we have everything from financial institutions to our members through to crypto firms really looking about how you build best practices so whether that's best practices in crypto or best practices in blockchain it's really there to provide that that forum and advocacy with with regulators and Global bodies such as iosco or fataf and people like that great well let's let's get into it over the last couple of years we've seen really an exponential rise in the number of different blockchains in the crypto ecosystem so the landscape of interoperability has become a key component to improving user experience and defy this has led to many solutions including side chains blockchain routers cross chain Bridges um and we've seen a lot of issues recently as a result of this after all a network is only as secure as its weakest link in your opinion what are some of the challenges that the industry faces in creating an interoperable crypto space um in terms of interoperability I think um the first challenge would be a technology challenge all these blockchains work on different types of Technology they have a few things in common but a lot that's different so um like creating something where you can go from one blockchain to the other without a central body could be complicated in that sense the second complication of interoperability is that I think not all of these parties work together so they don't actually collaborate with each other so you need like third-party providers bridges are typically like a lot of them tend to be third parties or only some of them are by like a key blockchain Network as such so that's another major complication of interoperability and uh the last one obviously is is the fact that everything is global everything is digital so uh accounting for just differences across the globe and coordination that's that's the other major complication uh when it comes to interoperability um I think from my side there's I'll pick on Cheerio men agree everything that Rick said there first one is actually uh regulatory interoperability so we can't have harmonization of regulations but there's just so much Divergence right now between different Regulators looking different things there should be some level of uh ability to move across Borders or to work across borders because it is as Rick said that it's Global we have to be able to operate across Global borders so how do we start to get those conversations taking place um the second one's actually a little bit more close to our heart because I've spent a lot of time involved in this which is this whole travel rule which is Swift for crypto and it's an example of there's a number of different ways to solve this a number of different solutions out there none of them can talk to each other I think as the previous uh speaker said on the previous session you know there's some great marketing you put blockchain after the name and all of a sudden your shares jump It's actually kind of similar you say hey yeah we're interoperable but actually what does that really mean so there there needs to be this this coordination that's coming together so that we can solve these problems together because I think if each of us is isolated in our a bubble then we kind of missed the point and and we end up with a Divergent world that just doesn't come together to solve things you guys have raised a lot of interesting points I think one we haven't touched on yet is Purity um and it's certainly one that's uh top of mind at the moment is this our main concern for interoperability at the moment and is this likely to change in the future well I think I'd agree with Malcolm I think regulations is probably the primary concern but so security I mean for one component of interoperably that's Bridges I think uh the tech aspect of it security is a big problem most technologies that focus on interoperability are new like they would at most be less than two years old so um on account of that because of the fact that they are Cutting Edge Innovative that increases their surface area to attack nothing like this has existed before so it's very difficult to make them fully secure because you can't even predict the type of attacks that they will face I'll go back to my travel rule example um mainly because it's the thing that keeps me awake at night if you are an exchange if you're a custodian you have to share originator and beneficiary information between your counterparties that's just the way the the whole system the whole ecosystem is going to work but for me I see huge risk in that and I look at a lot of the marketing and hey you know you can do it this way it's going to be wonderful it's all going to work nicely but actually what we're creating is this store of a problem um I'm very worried I'm very worried about that level of um the lack of governance that's going with that and the lack of thought I've been involved in I.T security for quite some years in various different roles but actually seeing this now um it's like we've got to fix this before the problem happens because once it happens it'll be too late so um for me I think yes it's it's one of those things at the top of the uh top of the pile that and I think as we've already mentioned um just that General awareness that if you're Building Solutions you have to sort of lock the gates before it gets out there a firm I used to work for um we uh a little while ago we looked at how long does it take for a new product to be exploited and then I'm going back a few years now then it was around seven weeks before somebody would try and exploit it now I think we're down into much shorter time frames so there has to be There's real focus on on security across all levels Marie Gunk you touched on say these are a fundamental tool to achieve interoperability um this year we've had a number of high profile attacks Nomad running Bridge Horizon Bridge just to name a few uh I was wondering if you could go a little bit deeper in terms of what we can do to mitigate the risks of these types of attacks sure so just um like an introduction to bridges for all those who are new to it bridges help you transfer funds from one blockchain to the other they promote interoperability between blockchains almost all large bridges have been hacked it's literally the smaller ones that are less prominent that have not been hacked now um in terms of the types of attacks it varies like uh Ronin Wormhole are the two biggest ones I think both of them were like a 500 million and a 300 million dollar attack um there's sometimes it's validators like there are these entities validating transactions and bridges and sometimes there's other types of attacks where uh there's fake deposits false deposits and that causes an issue now what would help with I guess increasing Security in bridges so number one would probably just be maturity right so to give you an example the first time in the world that a bridge was actually built like I mean like a physical Bridge it probably wasn't the best and there were multiple points of failure right so as the industry matures there's multiple bridges that are operating and there's maturity then you kind of know the vectors of attack there number two would essentially be regulation right the more regulation governance um even to that extent some amount of self-governance that becomes a standard in the industry right so um I know Malcolm works for a lot of these regulatory bodies if they come up with more guidelines on how bridges can have self-governance uh that would lead to better security on these Bridges and uh number three again is the biggest the last problem is is like really big as well there aren't enough specialists in the space right there's literally um less than 10 000 people who know about the space most new people who come into the space have to learn about it so uh you can't have someone who's been there done that because this is purely new technology right so I'd say these are the three areas that need to be addressed uh the so education would probably lead to more people knowing about it in that sense so is there anything you would advise your clients to do in the event of an attack um so I I think the process is fairly uh simple whenever it doesn't attack and number one be very transparent about it I think a lot of bridges uh Bridge hacks like they try and wait till everyone knows about it or or they're not very transparent in terms of what happened how it happened because they're afraid that their brand will get damaged that that never works because if customers have lost money and you can't give it back to them everybody will know anyways um number two engage with law enforcement get a blockchain analytics provider like like Merkel science or any of the others so and a lawyer of course so all these three pieces are essential for you to help in retrieval of funds and uh making sure that you limit the damage right so those would be the primary two steps you take whenever if your Bridge protocol gets hacked yeah so much I wanna I wanna go back to this issue of Regulation and obviously we're really in an era now of more regulation than ever before particularly on the D5 side this year with tornado cash sanctions um we have the EU putting its final touches on Mika right now um and we have fat F's travel rule I was hoping Malcolm you could walk us through the travel Rule and what its key components are yeah sure I think um I kind of touched on a little bit but the the key for me I think is is that this is something that's going to apply to C5 and D5 so just if you're in D5 doesn't mean you're escaping it it's coming um the whole ecosystem if you are transferring value then you're likely to get caught in it unless it's going to an unhosted wallet and even those unhosted wallets to a certain degree are going to be um let's look at another word compliant so we're moving into this world of of best put responsible Innovation and that will cover a whole range of things whether it's um you know security or or consumer protection as I spoke about earlier and things like that but travel really requires you've got kyc and you can transfer that information as needed to the opposite side what are we actually trying to solve for here it's so one of two things one can you detect and find are are there people on your network they shouldn't be doing what they're doing or on your platform and the second one is if law enforcement come to you with a legitimate request can you respond to it and make that information available who are the parties to that transaction who was on both ends of that transaction to then be able to say I can give you that information and then they take their further action as they need to that's the real underlying part part of travel that's what it's all about is there for that now I mentioned earlier about data privacy and security I've written a whole load of stuff on that on on LinkedIn um for me I think it is just very important that we're driving this in the right way that we're really getting that privacy security right but at the same time we're achieving those goals of how do you keep the bad actors out of the system how do you allow legitimate trades legitimate Investments to take place for legitimate tokens to grow and develop and everything like that but at the same time you can you can close the gate almost to to a poor Behavior thanks so much for that so we've just got I think a couple minutes left here um but I'd love to ask both of you and you might have some different Vantage points here how do you help institutions comply with changing regulation in the space and what kind of regulatory support might we need to enhance interoperability going forward great I I think the approach would have to be twofold like the primary concern here is of course collaboration so there needs to be very active collaboration between the multiple players in the private sector like even the competitors as well as Regulators across different jurisdictions so that would help with interoperability and even security from that sense the more collaboration the more education there is about the space because it's just a very new space and the second I think key thing that would help is just um more regulation coming in more clarity or just more work around what some sort of guidelines are I think that would help the space a lot as well um I think collaboration is the the key word here um it's what we do at gbbc digital Finance it's about collaboration within the industry so talking to one another and actually coming to some sort of alignment on things but then also that's public private Partnerships so how do we engage with law enforcement how to engage with legislators who are the first point of contact for regulation and then Regulators who supervise and license the behaviors and everything they're after so it's about how do you bring everybody to the table at once and and then determine what's the best way forward how do we actually achieve the goals we want to achieve to um to make the system more secure more more robust Without Really stifling growth and allow allow the projects to continue to grow and develop and this whole ecosystem to thrive I think you both have the nail on the head there with the collaboration piece um I think we're just about out of time here but I want to thank both of you so much for a great discussion thanks everyone for being here um and reach out to these two after the panel to collaborate thank you thank you