Welcome. To today's presentation where. We'll discuss records. Rewards, and risks, of using this technology. I'm. Very happy to have Dhara. Perry dr.. Horace, Pat Frank's and Amitabh, here. Today to talk. To us about blockchain, and. Records. Management. I, hope. The takeaway, today for. All of you is to get, not. Only an introduction, to this but also go, into that 201a. Level, even, 301, level of the. Blockchain. Technology. But also be. Left with a lot of resources, that, are. Out so. We've got dar, Hoffman she's, an incoming. Assistant, professor, and just, recently completed her, PhD. Congratulations. She is. A professor, for the School of Information San Jose State, University. Also. With. Us is I'm, sorry Dara you you reside. In British. Columbia correct. Yes. Okay. South. Of Vancouver excellent. Also. We have Perry J Swift she's, in the university, records manager at The, Ohio State University. Even. Though I come, from the state of Michigan I'm. Happy to have her here. And. I'm an order Dame fan so it really doesn't bother me guard, see the, Michigan. State Ohio State rivalry. Although it seems like Ohio State is definitely, at. Least in the sport of football American. Football they've. Had, us had our number. Dr., Pat Frank's, professor. And Mara program coordinator, school. Of information at San Jose State University. She's. Also an author of records. Information management her second edition book was. Recently, released there. Is a review on IG guru for. Those who are interested in picking up a copy of her book. And, who is very. She's very much responsible, putting a lot of this content together and will later reference, the the white paper, and. I'm. Your table she. Boss she, bounced off yep, you have operations, and governor. And. I. Know I skipped our pairing referenced Ohio you live in Ohio, I mean, cob you live in. Toronto. If I'm not mistaken correct I know, I live in in. Ottawa, Canada so I'm a little bit more east. Of Toronto, kind of midway between Toronto, and Montreal I don't know that's right, sorry. My my American is show there I apologize that's. Okay no problem I apologize. So. Blockchain. Technology, industry use cases rim challenges, and the unknowns risk auditing considerations, are going to be covered today, I'm. Listed as the moderator, but I'm not really going to moderate anything. Each of the presenters has a. Has. A presentation. They're going to give that's a short presentation, on these sections and. If. I'm not mistaken, we. Are going to be taking. Questions at the end. So. If you could please hold. Your questions till then or type. Your questions in the chat box and then we'll answer them at the end and we'll have that specific. Speaker. Or presenter and or others, chime in so. Without further ado. We. Can go ahead and advance the slide and, have, dr.. Dhara. Start. Good take it away. And. So. This. Is a 25,000. Feet view there are people who write lengthy. Papers, full of math equations, and pseudocode about every, tiny technical, aspect of different types of block james that's not me I am, your you know plastic liberal arts fluffy type and so, we'll be talking I'll talk about it from a very high, level what this is and how it works so this is the inter chorus which is an archival, research group.
Definition. The ISO, is working on their standards, for flock chain and that will probably become the accepted definition, but it's not out yet but, blockchain, is basically, a, trusted. And mutable, ledger. Of transactions. That, is. Centralized, and distribute. So I'm gonna kind of talk about each of those aspects, in turn. So. Let's start with Ledger's, I think. Most, of us who are archivists. Records managers, we're all familiar with Ledger's even people who aren't necessarily in. The archival field still have a vague sense ledger, is just basically a collection, of related transactions, and that related. Transactions, part is important, because once. You start throwing the whole kitchen sink into a ledger you lose, that sense of connection, you lose a sense of relatedness and it becomes a lot harder to make the ledger serve its purpose which, is one. Of the problems or blockchains that try to do too much is that, you lose the ability to form. The connections between the record and to maintain what archivists, would call the archival, bond, so. We've got a ledger so, how is this different from any other ledger, this. Picture you'll see almost anyone, who talks about blockchain presents but it's not a blockchain picture, it actually comes, from a, rant, study, back. In the nineteen, sixties or 50s about. Nuclear, war and what. The picture represents, is how. We can, make communication, systems, more robust, in the event of a nuclear attack and so, you see the first picture here on the left that is a centralized. System all, you need is one nuke to take everybody, to have it that way then, you have a decentralized, system, where. There are more more, than one controlling, nodes but you still only need to take seven now whereas. When you have a deep, distributed. Network like you have on the right the, idea is that all that redundancy, having, all these different nodes in communication, with one another leads. To a lot of robustness. And it makes it a lot harder to destroy the system just by destroying one. Two or even seven nodes and, so you see the same idea at, play behind the, distributed. Network in the blockchain, because. By, having, lots of nodes in contact, with one another you. Have you can't just take down the whole system by taking down one dough and so. For, example you, see people who advocate, the use of block chains to prevent censorship, this is part of the reason even if. Repressive. Regime a takes, down all the nodes in there country, the. Resistance, can still be communicated, using notes outside the country for example and, so, this. Distributed. Network is a really important part of how block chains are built now. That an big, buzzword in the blockchain world is immutability. Mutability. Is the idea that once something goes onto the blockchain it can't be changed and. The. Reason the block chains are supposed to be immutable is because. The, way that they work is basically. I have. A transaction, I'm. Going to buy something from dr. Patz, and so. Before. That transaction. Gets written on the ledger. Someone. Let's say andrew is going to check to make sure that pat has the twenty bucks and I have I have the twenty bucks that I'm offering Pat and Pat has the shirt in her inventory the. Transaction. Then gets verified, it gets written onto. The, onto, a block and then you get a block of ten transactions. And so. Each of those transactions. Has a fingerprint. Taken and, every. Single fingerprint, and the, fingerprint. Is actually an alphanumeric code, that's done. Through. An algorithm, but, you have a block with ten fingerprints, the, very first, fingerprint. Of the next block is going, to be all ten of those hashed, together into a handprint, the, hash is the name for the fingerprints, and so. If I change something in, block, one if I change the fingerprint, for mine and Pat's, transaction. Then, the fingerprint, in block two is going to be wrong as well and, so that's the idea behind blockchain. Immutability, is that, each block. Is changed. Together with. That previous, hash, with those previous, fingerprints, now. Then block chains are theoretically. Immutable. To certain attacks like a 51%, attack for the Bitcoin blockchain if I, control 51%, of, those nodes that I showed you in the distributed, chain then, I can change all of the, transactions. That I want and no one can check me in the wiki CACI so, I prefer to say that the blockchain is highly, tamper resistant, as opposed, to. Immutable, that. Said it's a highly, evolving, space. There, are lots of different types of blockchains and their, technology.
The Technology is advancing rapidly but, as it stands right now I would say most block chains are tamper, resistant, and, tamper. Resistance, is both a strength and a weakness because, of course if. You, make an error it can be very challenging to, correct, the record if the record is on chain, you basically have to create a new record so it's an interesting space for us as as. Researchers, especially as archivists. Now. The disintermediation, this, is what the really interesting thing about the block chains and this. Is specifically, in what you would call a public permissionless. Block chain is where this is the strongest, and that, means it's a block chain that anyone can use and that no one has special, permissions, different, rights on there. Are other types of block chains where you do have for example have people with certain rights like voting rights or where. The blockchain is only accessible to certain people we see those for example in medical, research or, in. Certain, financial areas, where we want higher degrees of protection but. The idea of disintermediation, is, that, instead. Of asking a lawyer or a banker or some trusted, party, some trusted entity to, take kick to, intervene. In transactions. The blockchain itself. Does it so in the Bitcoin blockchain you, have a consent, mechanism, whereby. People can mine and whoever, solves, the cryptographic puzzle, first gets to check mine in Pat's, transaction. See if. It's good and it. All happens, without, direct. Human intervention, that's the idea behind this intermediation, but. Of course it's intermediation, again, you see this Janus like coin throughout clock tech technology, because if there's. No, intermediary. Then, who's responsible if things go wrong the. Blockchain is this interesting, thing especially the public permission, of the slot chains that seems to be owned by everyone, and no one which, comes, to makes it a very fascinating. Space. For. From. A legal perspective which is by, bypass, life before I came in target and so, where. Does liability, fall when something gets messed up who's. Responsible. For example, if, a. Court finds that there is personally, identifiable, information and/or, incorrect information on, a blockchain, that, needs to be redacted in some way who's, responsible, for making that happen if you don't have any particular intermediary. To point to someone who is legally responsible it's. A really challenging question, to deal with and we see this I'm sure I, think parties gonna talk about this later but with the new general data protection, regulation. Out of Europe that the, huge privacy, regulation. That came out two years ago there's, a lot of big questions about how to manage. Block. Chains in the existing, legal frameworks. So. This. Is basically a nice picture from NIST, about how it actually works, so the hash there, is the fingerprint I was talking about the. Algorithm, runs over the transaction. If you change a bit you change the hash it's. 256. Alphanumeric, characters, a timestamp. Is exactly. When it happened a nonce, is a little bit of nonsense, and. Then of course the hash the block data and you, see that each of these blocks is chained together with. The, hashes. From the previous, blocks and hence the clever name of blockchain. So. Really, one of the big things, the blockchain is meant to deal with is this question of trust. The, idea. Behind the blockchain and Satoshi. Satoshi's. White paper which were it's only in 2009, which, might seem very long ago to some of you but it's quite, recent, for in. Terms of technology. The. Idea was to create a cryptocurrency that could be. Used. Between parties, who don't know each other don't trust each other without. Third, party intervention and so it's really a big question of trust, we can't trust people so. We're. Going to trust the technology, because, you, know there's, this idea that technology. Doesn't lie technology. Is a bias technology, doesn't have interests.
And So. You, see this idea too even in. In. The. Archival, field you know we, have the site neutral, third parties trustworthiness. Blah blah blah and so, the, idea becomes, that people. Can't be neutral but maybe a machine or mathematics, kid so does that mean all of our trust problems are solved. Nope. Not, so much. What. It, comes down to and you're seeing this a lot for example in the. Research about accountable. Ai's for example if you bring another technology, in is that. We have a lot of problems, and Trust and with bias. And, with neutrality, that still haven't been dealt with even with the blockchain, that's it it's a fascinating technology, with lots of possibilities and, I will now turn it over to my. Colleagues to explain them to discuss thank, you. This. Slide real, quick is uh it's. A, ontology. Of Records trustworthiness, to dr. Victoria, Lemieux who heads, a blockchain at the University of British Columbia. Based. On an. Ontology of trustworthiness, and in torus came up with because when we talk about trusting, records we talk about three, things accuracy. Reliability and, authenticity and, while, blockchain, is fantastic. And ensuring the integrity of the records for, example if you're hashing records that happen off the chain there's, nothing that a blockchain can do to make those records reliable, they were either reliable. Or not before they got hash to the chain and so, it's just an example of all the work that still needs to be done in the space with this technology to, meet our needs for. Reliability. And trustworthiness. And. That's all, I got, to say about that. All. Right industry use cases and we're on slide number one for you go ahead ok, so the. First challenge, I think in, deciding, if a blockchain is. The, right solution for you is. To take a look at some of the use cases and, we see a number of use cases that are here. Including. Credit history, elections, health care and so on, so. This, matrix you may have seen quite a bit and it, explains, the, questions. That you have to ask yourself, and then answer, if you're an organization to, decide if you think, the blockchain is the right solution. On the left-hand side and I won't spend, a lot of time on this but. There are three questions that are important, do, you need a shared, database, for multiple, users do you need it to be immutable, time-stamped, and, keep. A log of all entries, and do you have trust, issues among, the users, if. All, of those answers, or any of them are no you might, want to think about perhaps. Finding. A way to use a traditional database, but, if those answers, are yes and you want to move on to the right-hand side of that matrix. Where. You ask yourself, well any of the data stored need to be modified, or deleted in, the future you, heard, darah, talk about the gdpr, and, the fact that some, information, may have to be deleted will. Personal, and/or sensitive, data be stored that, you want to be sure is not revealed. Will. Big data be stored. If. Any, of those answers, are yes you might want to consider other solutions. But it doesn't mean the blockchain is not right it may, mean that you would store a hash, of the data on the chain and then, you would store the data itself, off the chain if the, answers, are no then, it's. Pretty evident, that the blockchain may, be, right for you. So. I want you to keep, this in mind, it's. A quadrant, and I'm, taking a look at two different issues. Here one. Is, the. Public and private, modality. Who. Can write or, creates, on the blockchain all, right, is. It, just certain people who've permission. If so then it would be private but if it's anybody, out in the public then. Of course it's going to be public but what about reading. And consuming. Is that different, it. May very well be it, may be that only certain people can. Read. The, information that's, on the, blockchain or, everybody. Can I want, you to think about this acronym. That databases. Can. Be used to describe a database it's crud have you heard that see are you d it means, create, and read and.
Modify. Update. By, updating, or deleting, so you have your CR. UD create, read update and delete. That's. A database but, a blockchain can't. Do all of that a blockchain can only do the create. And. The. Reach that's, all you're thinking about here so that's the difference between the, two different types of technologies. Keep. This in mind maybe draw yourself a, little rectangle with, four blocks and I'm going to go. Quickly over for. Different use cases and, then I'm going to see if you could put them in the right quadrants, there. So. The first use case is e-voting, and I thought this would be interesting, because we're all concerned, about voting. Right now with the presidential, elections, coming up and West Virginia back, in 2018. Tried, blocking, voting. In their. Midterm elections, they used vote as which is a mobile voting. System. Platform. And, they. Thought it was successful, asked, in an independent group that took. A look at the results, however recently. There. Was another study that said. Maybe this can, be violated, in some way not necessarily the, blockchain layer, but. Other aspects. Of it so they're, not sure that they're going to be using that for the presidential, election, but. What the idea was there is that it would be really good for our military personnel stationed. Overseas they, would be able to use their mobile devices. In order, to register and, in order to vote. Denver. Used it for their municipal. Election, as well and. They. Thought it was quite successful as, did an independent study. Showed. That it, was very useful for them, that. Was the second pilot using, the same system vote, s now. What about blockchain. For. The presidential, election, then well I, like, this a little bit of a headline here this Trump know that blockchain, is nominating. Him what they really mean is that two states, Utah, nara's use, blockchain. To select the delegates, who are going to go to the convention in August. And nominate. President Donald Trump for his reelection bid. So. The third is. Gambling. And. I, don't know if you enjoy going to concede, knows my, husband does so I I frequent. Casinos, and the, idea there is that everybody. If they're a mate should be, able to gamble, to visit a casino. But. There's always a question about the house payoff you know is that, really legit, what's happening behind the scenes and the, same thing goes with our quick draw or whatever, the states may be doing for a lotteries, we want to know what's the percentage, payout. Well, blockchain. Can be used for gambling and you see here that it. Even can be integrated with virtual reality so. You have the whole feel of going, into a casino to, do your gambling, and we see a couple of examples, of. Blockchain, technology, use for gambling. Or gaming right here on this slide so that's a third example. And. Then. Our fourth. Well. Actually I guess our third supply chain. In. The, wake of the romain do you remember the co co e coli, scare where. Leafy. Green romaine. Lettuce. Was, the cause of e.coli. And they. Were trying to trace this back to the source you know what happened, along. The way that. Would cause this problem and where did this let, us come from it's. Very difficult, to figure that out when. You. Have, to trace back the supply. Chain, so. Walmart. Decided. That they were going to experiment. With blockchain. Technology. In order to follow. The, chain of supply, for their leafy green vegetables. And. They. Did a two-year pilot and, as part, of it they try, to, trace. Back the source of sliced mangoes, of all the kinks and it took seven. Days for Walmart employees. To locate, the farm in Mexico. That grew the fruit so seven, days after. First thought. That they should trace, this back however. Using, IBM's. Blockchain. They. Were able, to trace, this back in a matter of seconds. Big. Difference, so now, you would, be able to know exactly, which greens. Were. Contaminated. Where they came from and if customers, knew this they would be able to check to to. See if they were in danger or if they had to discard what they had purchased. So. The last one is law, enforcement, so blockchain, used this. Blockchain. Can be used for law enforcement but, for a lot of different, reasons I'm, just showing one here but, it could be used to spot crypto, crime to, standardize, distributed.
Crime Reports, to secure, interoperable. Interagency. Data sharing, of the, illustration, that is used here is that blockchain. Can be used for. Keeping. Track of. Evidence. So a tamper, proof chain of evidence. For. Law enforcement and, in, this case we're. Using one, of us say a different type of blockchain. Solution, in order, to provide. This service. So. Ok we get back to this little. Quadrants, again and. We. Can think about the four different examples. That I gave you so let's, think about that very first, one and see if you were correct in voting. We want everyone, to vote right, but. Really. Does everybody, see that vote, I don't think so even. As far as the documents. That were used if you were using paper in order to vote or the OCR, stands. Or whatever maybe we, have election, officials, that are privy. To that information and just give, us the results, so where, would our voting. Come, into play on this, quadrant. All. Right so it would be public. For writing, but, it would be closed for, reading ok, the, next example, that we had was the gambling, so I mentioned everybody, should be able to gamble if they're of age and if they would like to do that but, at the same time everybody, would like to make sure that, they, could see the payoff staff said they know that the system is transparent. So what. Does this mean as far as. Creating. And reading. The information. Gambling. All right so in this case writing. Is public. We can all take part in this if we'd like and then, reading is also, open, so that we can see the type of statistics, the payout that is happening, with the gambling, that's. Going on all. Right the next example. Was the supply chain with those leafy, green, vegetables. Going. From seed, all the way to your table, in, this case only those that are involved in the supply chain should, really be writing to it so the distributor's, the growers, whoever that may be but. All of us would like to know where the heck that came from if there is a scare we want to be able to find a way to, trace back what we have purchased, and the grocer's would like to do the same so. That they can see if this is part of that contaminated. Batch or not so there you go your supply chain is private. As, far, as writing but it's open as far as reading and that leaves us with the last quadrant. Which is going to be our law enforcement, when I think law enforcement, I think secret right we wanted write and. Make sure our records, are secured, not everybody can see them and at the same time we want to only have certain, permission. To people read, the information that's, there so. I'm wondering how you all did if you were able to figure that out and I want to thank you for your. Attention, and now, I'd like to turn this over to Perry, Swift of the. University, records manager at Ohio State, and Perry, go ahead. Thanks. Pat well, one, of the questions that I saw come in was. How each of us got involved, in blockchain, and I. Got. Involved in blockchain, because. As. A Records, Manager I feel like I needed to know enough about it in order to be able to have the conversations, and be involved in the conversation, with, the IT, teams, and other. Teams involved, in it and I, think that I soon realized, that I. Didn't. Understand, it at all and what I thought I understood was wrong, so. That's. How I got involved so that I made sure that I knew enough. About it to have those conversations that, I was, able to clear up what I was misunderstanding. About blockchain, and that. Is why I have, the records, and information management, challenges. And unknowns. Because, currently, while. We're starting to understand, blockchain, we don't know much about how records management, is going, to work with blockchain, nor. Do we have a lot of case law on how blockchain, is going to stand up to legal. Standards and challenges, so. Represent. Information management teams. Are often not consulted. When it comes to IT projects, not just blockchain, projects, all IT, projects. So. It, may be that we're. Not even going to be aware when, our organization, is considering, blockchain. However. System. Design can, really, impact. The. Records, management functions, within. Blockchain, whether, its private, whether it's public. Understanding. Where documents. Related. To the transactions, on blockchain are stored, is very, important, especially, if they're not on the blockchain if they're somewhere else, so. Records, management should not just be a part of the project team working on just the system design but, it should also be represented in, change management, change. Management is, also one of those functions that's often led by IT when. In fact it's the records professionals, that have a deep understanding of, how people's. Records creation, and record-keeping.
Practices Are, going to be impacted, by, whatever the new system is, if. You can go ahead and click. So. Not. Only loops we, go back I'm sorry I have animations, in mine. So. Blockchain. Projects, are often pretty excited, without, consulting, records, manager on whether, the records. Or the data or the transactions. Are an. Appropriate use, or whether blockchain is an appropriate use for those things. Oftentimes, the project. And the solution. Go. Hand in hand somebody is going to come and say we, want to do this project using this solution and minds, are made up before, that analysis, even takes place, and. Then unfortunately sometimes, records, management is seen as throwing. Up roadblocks to these projects, we're slowing it down. But. Really what we want to do is make sure that that, it's going to work not just for the business units present, functions. But, that we're going to be able to comply. With. Records. And information management laws. So. One thing in particular we want to make sure as we've, already mentioned that, personally. Identify, lit a file, information, is not held within the blockchain. So. While the basic definition. Of a record is the same across the board whether it's in Arma, or essays. Dictionary. Or other standards, or, even state and federal law the. Components. That make up what, a record is, can, vary across, jurisdictions. And so that's something that we have to deal with, we. Have to figure out you know in our jurisdiction, is metadata, considered, a part of the record or a, separate, record in and of itself, do. Multiple, documents, or pieces and parts make up a single record or, is each one of those a different, record and again. This is all going to depend on the, definition, of record in your. Jurisdiction. And. Can those different portions have different records management requirements. I, have. Spent my entire 20-year. Career in government. At all levels, so, accessibility. Is something, that's incredibly important. To me. Whether it's FOIA. Or public. Records requests, or even. Ediscovery, and. Just discovery, so, in the case of blockchain, are those pieces and parts are they stored in other, places and, how. Does that implement. Disposition. How does it affect, how we get access to those. Records. You know we have to take. Into consideration is. There an encryption key that. Certain. People need to have whether, it's the attorneys in your. Litigation division. Or. Anybody, who's responding to public records requests, are we going to have that encryption, key are we always going to have it and then there's the lack of classification. Which. In with with in blockchain, are we going to easily be able to locate. And provide. Access to the information, that's being requested and again, this goes back to how, our specific, state or federal laws, when it comes to access, worded, each. Of those could be different and then. Do we have the ability to redact, if we, need to redact in a situation, like that is blockchain, going to give us that ability. So. One. Of the challenges in records, management and blockchain is retention and defensible. Disposition. We. Want you know we always learn in records management we want to make sure that we get rid of records per retention, schedules. And. Sometimes. We there's, a liability if, we don't. It. Can be a liability to, our organization. Or. It. Could be going. Against certain laws or regulations. You, know one of the things that I've already come up is gdpr and the right to be forgotten, people. Have a right to say I don't want that information out there about me are we going to be able to go in to blockchain. And delete. That information. Privacy. Laws now often. Require a minimal, retention, we used to say or. A maximum, retention I'm sorry that's that's incorrect on my slide we, used to say retentions a minimum you have to keep it at least this long but now privacy, laws are saying you, really shouldn't have it any longer than you need it for the original purpose for which you collected, that information, or created that record, and we. Haven't been able to determine, yet with law chain are we going to be able to get rid of that when, we need to and. Then.
There's. The whole issue of archival. Survivability. One. Of those issues is just, doing appraisal. Blockchain, presents, a completely. Different. Scenario for, doing appraised anarchists, are used, to archivists, are used to, having. Having. A group of Records and having a context. Behind it and a classification, scheme, and, creating. That in order to make it available to researchers. In. Now. With, blockchain, were unable to separate. Records. Out without, invalidating. The, rest, of the chain and then, we lose that integrity, that is such, a big important. Thing when it comes to blockchain. The. Other issue with archival, survivability, is simply the long-term survivability, of. Records. On a blockchain if they, do need, to be kept permanently if they really are historical. In nature or, provide, that long-term legal, value. Are. We going to be able to access these. Into. The future and for how long we're. Going to need to have access to that encryption key and not, lose it I mean we've heard stories on, cryptocurrency. Where, people have, lost their key and they've. Lost, their money basically. We. Haven't looked into a transfer, protocol, that, I'm aware of really how are we going to get. Records. From the blockchain to the archives, are we going to send a node. To the archives and we're going to send all the notes to the archives we're going to try to get it out of blockchain. Which. Often, at this point there are a lot of proprietary. Block chains as with, any other type of electronic, record. And. Then, you know we've talked about watching. Is is decentralized, is that a positive or negative when. It comes to getting. These records to the archives and making them available and finally. Of course there's the cost when. We are talking about a, chain. That keeps growing that's, never deleted, that, is using, multiple, nodes from, all over the place that. Comes, at a huge cost as. Far as preservation, as far, as the power to keep, it up and running and, I. Think that there are more, and more studies being done on that aspect, of, blockchain. Now. I will, say because. Sometimes it does sound like I might, be squarely. In the con side of blockchain. That is, the more I do study it the more there is some good that, can, come out of it I was on a presentation. Recently and, they, were talking about. Identity. Management. Particularly. We we were talking about Identity Management with. Say student, records you know I have a daughter that's going off to college she, needs her high school transcripts, in, order to prove that she's taken certain classes, to get into college and, one. Of the things that I realized is that when. It comes to archival preservation, if we. Can use blockchain for. Identity. Management she, doesn't necessarily need to have that copy of the transcript, to send a copy of the actual transcript, to, a whole bunch of different places that preserves the original and, it means that there's less copies, of that, information, about, my daughter out, there because, all they really need to do is use that blockchain, and those transactions, to prove that she did in fact earn, this. Particular degree, in. These areas. There. Are some legal challenges that. Come with us as well. Record-keeping. Laws are not keeping up with evolving technology, that's not just a blockchain issue, that's. Just, an issue, in general and so, we are trying to take modern. Technologies. Such as blockchain, and squeeze, it into laws that were written a couple decades ago and maybe, only tweaked here and there and it doesn't fit how we do business anymore. As. I mentioned defining, the record in defining, the pieces in the parts of a record is is a challenge, that hasn't. Hasn't. Been dealt with yet, and. Then, what's, considered, destruction, does it have to be a complete, destruction. Or, can we simply, destroy. The encryption. Keys so that the record is unreadable this, is another thing that hasn't been tested in, courts. Yet. Another, consideration is, are the nodes in different jurisdictions and, could, that present challenges to, legal, retention, requirements, especially if the requirements, are different in those, different jurisdictions. And. Who takes ownership. When. It comes to litigation. Records. Could be retained that, hold an organization, liable, and litigation is. Not regularly, deleting, on blockchain because, it's not that easy to do, we. Have to understand, that some, of that information could, be harmful to, us so that's a consideration to take into account when you're, thinking about what to put, on. Blockchain. Is if, we can't get rid of this is going to come back and hurt us in any way and then, as I mentioned there are increased costs but there are also increased, costs and resources for, discovery, and then. Finally privacy, law, limits. The distribution, of information so.
Here We're talking about a system where. The same information is repeated on nodes across the country possibly across, the world and yet that seems to be in conflict, with. These privacy, laws that want to limit the distribution of information. So. There are some questions that as a Records Manager you can pose in this process, I, first. Question, simple question what's their attention period and then, following up with are there potential liabilities, if we don't destroy it for retention usually, we're coming up with a retention period because we. Should be getting rid of information, when that expires. And. Then another question is are there multiple reference, record series represented. In a single blockchain. Next. Is there. A benefit, to recording, a transaction. Or is, that transaction, part of another, record or is it a standalone record so is it just the transaction, that's a record or are, there records stored elsewhere that, that, transaction, reflects I also. Ask who needs access to the data and are, these persons, going to change throughout, the lifecycle of the record what. Tools are they going to need and how are we going to pass those tools on from. Person to person so. What, are the pros and cons of using blockchain, for a particular, project are there existing, solutions, that are already sufficient, maybe we go back to one of Pat's first slides in. Thinking, about that and she had that nice little flow chart there. Finally. What are the costs. And. -, the benefits, of using blockchain, justify, the, costs, of, it a. Couple. More questions are, there privacy, and security concerns. People. Talk about the Chane being wonderful, for security, but. At the same time that is great for securing, the information. Is it in conflict, with some privacy laws and finally. What our organization, has control, over where, the nodes are located and, that comes down to what, are the laws in your jurisdiction or, in the jurisdiction, where these, nodes could potentially, be located, so, those are just a few of the questions and I think that the more we start to use. Blockchain, and learn and understand it you know we're going to come up with some more questions and we're going to be able to refine this list of questions. So. I thank. You very much for that and I'm gonna turn it over to, Bob. Circosta. Great. Hi thank, you Carrie. Yes. I so my name is. I'm. Speaking a little bit about the risks that a new technology, presents and of. Course new technology, and its benefits, and versus versus. The the, the. Risks so obviously. You've seen some of the benefits, and certainly it's a lot, of new ways of doing things using, blockchain technology. So, some of the risks that I'll be speaking about are actually discussing, a bit more in detail the white paper that PAP, was referring to which is understand block change roles. And risks in Custis systems. So. We're all familiar with the technology s-curve, and obviously, the new technology try to solve problem out there but. Obviously as with any new new technology, you know there's. Some hype around it and of course there's going to be, improvements. As the technology, moves from the, left hand side to the right hand side and so. Therefore any new technology requires, a cost-benefit, analysis, so. As the technology moves through its improvement phases, you know it'll have its early adopters, you go through your first. Generation, of technology second and so and so forth so. During the improvement, there's obviously, a lot of hype you know they're trying to sell solutions, to, problems. That might not exist out there and, or. They try and look for problems that may not exist so it's important, to really cut. Through the hype and understand. The risks versus, the benefits, and determine, if in fact there is a problem that needs to be solved. So. Reports, that. We that we took is we to look at the risks from four. Different levels for, so for risk, assessment levels. Really. Moving from a high level which is the. You. Know the kind of strategist should I use the blockchain then. You get into your level two it's a little bit more detail which is around design then. Of course the implementation and, then. More detail is really the, the operational, risks and. So. Here you see the, D for risks are laid out in a, kind of quarter circle to see the little circle going, from strategic, called it to operational. But. One thing to look at really is the, design because, the designers, will really, help. Define the scope of the potential, solution, assuming, you've decided to use the bulk chain solution, so. That's really important, and going, back to some other, speakers, spoke.
About It's. Important to understand indications. Of information, risk management, and the strategy, for. That risk management as you consider the design solution. So. The next one which is the design risk we identified, seven. Key risks, from. Governance, all the way down to the two to project planning and I'll. Certainly get into these a little. Bit more but, what's important to understand, is that there. Are a lot of questions. That both effects, you know the technology. That. Also affect the, the use, of the technology more from processes, and of, course in how you're going to actually move, forward in terms of implementing a project. So. Let's, look at the some of these design. Risks, in a little bit more detail, with. Respect to implementation risks. So. What, you have here are the, seven risks so we're at level two so obviously at level one was the, block chain solution so that's the strategist, whether or not to actually move forward then. You catch a design risk and. We see the designers, have a number of implementation. Risks underneath, so what we have here is really a risk breakdown. Structure, or RBS or short, so. If people are project. Management, you will be kind of familiar with this and so. What this lays out is a hardware structure of the risks in terms of how they can either proclaim. Up words. Or you, can look at this from high-level and move downwards, to a little bit more detail so of course you know this refers back to the force for, risk levels, that we talked about a couple slides back. So. You know for example governance. Which is rerun is selecting the the blockchain solution. Provides. Oversight and, compliance of, course records management you. Can do some of the operational structures, and. How to manage monitor the blockchain solution, you, have looked at the organization's, reputation if, the solution fails. Or other, things happen, they. Of course is a technical, architecture, and, the different options there and we've talked a bit about that as well you. Do get into areas around legislation, and regulation, personal. Formation we've talked about that data. Residency, which just kind of mentioned a little bit earlier you. Also are looking to the, IT operations running. From advance we've talked about -, I know, you, defend, the chain, cryptography. So number of areas from an IT perspective, then. Of course you get into the, project, planning so many, of your regular. Project management, activities, you know you piss objectives, your business case and. We all know many times that these are not done. Properly sometimes. In the brush together so she moved out so it pushed out so, certainly, that. Requires. A partial match oversight so. Let, me walk through. Two. Examples, and then we can look at some of the level four operational, risks. So. Let's name you look at the, governance. So that of, course had for, implementation. Risks, so, here, are some of the questions that. What. Should be considered you know such as do. You have the electronic, records for your mission critical dish, assets, you know do. You have a large volume of initial content, so these are the questions one, should ask tip could. Could potentially be more questions but this is a way, to kind of get started for. Example the last bullet point and the records management say we said do you need to validate information, from off of change. Sources, before hashing, the information to, the blockchain so we've talked about some of these if, the compliance, questions. Give. Access if safer. That's the last bullet. You. Need to establish provenance. Of the. Off chain information before hashing the information, to the blockchain so you have some of those examples if. You look at for example business impact, analysis, which is the fourth column. Do, you understand, the specific, recovery, time objectives, and recovery point objectives, farm from from the back perspective, so anybody that does backups. You understand, that big. Thing which gets missed many times is do you have buy-in from the board and senior management level.
Committees For the after business impact analysis report. Many. Times it's done it's you spend, a lot of money and this sits on a shelf someplace. So. So, those were some of the risks, but so what, we have here is kind of a risk assessment matrix, so obviously. You've got your for implementation, risks for governance so you, know you an assign a priority to those risks you know probably, sign somebody on the team to. Manage those risks but. Certain audit, activities. Such as objectives, audit, or controls. Education. And the, frequency so these are fairly common audit activities, this, is not meant to be an audit framework by by no stretch of the imagination. But. Certainly you know these are things that should be considered when. You're looking at it for audit perspective, let's. Maybe take one more example. So. What you see here are the operational risk for the blockchain architecture. And some of these have been covered, so, again do you want to use permission, permission lists you know so for example as last, bullet does the permission is blocked institution have passed to scale up as transaction, volumes increase. You. Know then, again you look at on-premise, vs. cloud based, you're. Looking at blocks you know the service versus, a proprietary. Blockchain. Consensus. Protocol is very critical so if you look at the second. Bullet. Do you want to do a proof-of-work, or delegate proof of state consensus, algorithm and of. Course that's, important, because one. May. Not be able to handle high. Volumes, as well as as the, other, mining. Architecture, again, they're, questions to consider in, terms, of the ability to perhaps. Handle. Increasing. Volumes so, these are just some examples of, questions that should be asked, from in input. Five sly from operational, perspective meaning, the level four risks. So. Again the, same type of questions. Should be asked so in this case we had, five. Implementation. Risk areas, and so. Again the rest parity who's, gonna measure risk and again the types. Of audit activity, that that one should carry out so, the purpose of this matrix. Is again to be able to map each of the implementation risks. Back, up to the, soil operation rest's back up to the implementation back. To the design and be, able to be able to then obviously determine. Where, the or ization needs to focus its attention and, its energy. So. In conclusion, I, think blockchain. DLT does represent a lot of trees but as with any technology I think there are risks. And really. I think it's I, mean. The technology to do sometimes fail but. Not because. The technology, itself but I think because of not understanding that the technology's risks and its benefits, so, therefore the initial hype has to be tempered with a proper risk benefits. Assessment, before committing, the organization to, this direction, and. That's. It for me thank you so much for listening. I hey, my contact details and I'll turn it over to Andrew. All. Right thank you very much. At, this time. We. Do have. Moments. For questions here. And there. Is a question, here posed. By. Andrew. Looks. Like andrew creme Tomsky P, I could be held on chain without contradicting, privacy, laws he's wondering how is that possible.
Question. Is located in the chat window. I'll. Jump in I. Agree, with Natasha and and, Natasha, if I recall correctly you're a lawyer in Russia right and, so. You're. Right if there is specific law supporting. The use of a blockchain that, meets XYZ. Considerations. For holding PII then of course it can be legally done to. The best of my knowledge we, don't have all, that necessarily supports, that or at least that deals with the conflict between privacy. Law and. For. Example we do have evidence law in Arizona, about, blockchain but, as far as I know we don't have any laws that specifically, provide that for that in north or in Canada and the United States at this point but if someone, knows otherwise I'd be more than happy to hear that. Excellent. Thank you Dhara anyone. Else want to jump in or do we have any other further questions. You're. Welcome. All. Right dr., Franks you want to put in some closing remarks here. I'd. Like to thank, everyone for attending today. I. Really. Appreciate it we had quite a a large, group also. Make sure that you visit. The. 3d. PDF consortium. Link. I AMA, table had mentioned, the white paper that was published in, January and, you. Will see much, more information about the risks. And the audits, that amitabh. Just pulled some, sections, out of that white paper to illustrate, today but, there's much more information there, as well, there. Is no question that chat window from John. Well. That's quite interesting, I had not thought about that, seasonality. Issues, federal. Holidays, are infrastructures. At risk I. Imagine. That would be the same as with any other technology. That. We're, trying to protect, from. Adverse. Influence. Or partners, there but does anybody have a comment on that are you work in government what, do you think I. Mean. I think that it depends on the type of blockchain that. Is being used if if. It is a public blockchain, I think that there could be more of a risk involved. In, it if it's a private blockchains within. The government, there might not be. Any. More risk than any of the other systems that we. Have. Yeah. I'd, agree with that I mean mostly these systems are designed to be run you, know 24, by 7. I'm obviously their regular main test windows so. Depending on the type of box chain, architecture. One, chooses. Those. Things should be part of the architectural, design, so. So you know holidays. Don't really affect the availability of, that, of, that type or chain technology. Any. Other questions, are just comments things, that you've been think about that we haven't touched on. Okay. Then I, lots. Of miners could be using the same cloud cloud goes down blockchain, is in peril, yes. Okay. I want to thank everyone it's. Past our time here I appreciate. Your attending, and if, you, have any questions, for any of us you see our email addresses, and on the screen there just grab them and get in touch with us thank. You everyone. You.
2020-06-09