to start our uh our afternoon off I'd like to introduce Carol House Carol has recently served as the Director of cyber security and secure digital Innovation for the White House National Security Council and she has led Innovative initiatives at the Nexus of National Security with cyber emerging Technologies and illicit Finance enrolls with the U.S treasury Senate staff the U.S army and two tours within the White House and she's going to be talking to us about the future of responsible development of digital assets ladies and gentlemen Carol House a little stable so watch your totally fair warning for anyone that knows me um so good good afternoon um thanks so much for that incredibly overly generous introduction um and to GBA for inviting me to come speak with all of you brilliant people today um it's great to be here with all of you to share some thoughts on shaping the future of responsible development in digital assets and distributed Ledger Technologies or DLT as I'll call it later up until my recent departure from the US government and from the White House I was honored to support cyber and emerging Tech issues across all you know legislative executive regulatory offices and especially recently LED crypto identity and cyber policy at the U.S treasury's financial crimes enforcement Network the primary regulator for anti-money laundering purposes for crypto firms and then also at the National Security Council supporting the deputy National Security advisor for cyber and emerging tech and neuberger and I think you'll note as we discuss things later that working on issues like cybercrime and identity and crypto it's not by accident all of those three things really tie so integrally together with each other so I'm very grateful for the opportunity to come and speak to you all about things that I care so deeply about an incredibly complex landscape of policy legal National Security issues economic technological developments service the Strategic backdrop for blockchain and digital asset development in this moment in history there are critical challenges today that continue to present themselves in ecosystems around identity privacy discoverability resilience and regulation these issues are also not the responsibility of just one sector both public and private sectors both inside the United States as well as internationally hold the capabilities and responsibilities to help ensure the responsible development of these Technologies and their related assets today I'll share my perspectives on some of those most critical capabilities and responsibilities that can hopefully help Drive the best developments in technology and policy for the future of this ecosystem to Leverage The Incredible potential but also mitigate the very present risks that the space can also present so to set the stage for the discussion first I'll just underscore that my remarks are not aimed to point a finger at either side for the purposes of assigning blame while there certainly have been and remain illicit actors maliciously leveraging digital assets and targeting the vulnerabilities in these platforms many actors in this space are totally illicit trying to drive wonderful developments for economic and technological purposes to serve their businesses or even provide humanitarian Aid so even in light of this recognition it's still important for us to understand where there have been challenges misunderstandings successes and failures that have brought us to this current state in time on the development and Adoption of Technology standards and policies for for the space so my final remark to set the stage before diving into the issues is that I acknowledge that many of the issues that I highlight will be framed specific to or especially for digital assets rather than more broadly blockchain Technologies of course many of the Professionals in this room and across USG are interested far beyond just the financial applications of this of these Technologies and their Associated tokens however given the critical focus and the significant challenges that exist in this space I think it's entirely relevant for us to discuss some of those challenges and what the current landscape is for digital assets since I think that's a consideration for anyone who's looking at building DLT applications um and solutions for blockchain are not just technical they're also policy regulatory Frameworks and how they treat assets and activities that can be supported by these Technologies are are a part of Government blockchain Solutions and I'll note that those Frameworks do not necessarily imply a framework that has to be or should be based on the form of those Technologies so with that scene setting today I'll discuss a couple of things first set the stage on the critical importance of innovation and competitiveness not only in blockchain and fintech solutions but also in regtech Solutions in order to support the responsible innovation in this space and then finally I'll speak in a little detail to some of the key substantive issues that government and Industry are facing that I believe that they will have to address in order to drive the future of innovation and application of these Technologies specifically those issues will be illicit finance and other Financial crimes and consumer exploitation cyber security and resilience identity privacy and discoverability and then finally decentralization and personhood as I like to call it so if you take away just one thing from what I'll say today let it just be that getting Innovation right in the digital asset space is something that requires partnership and a recognition openly and understanding on both sides of those responsibility abilities and capabilities across both government and Industry domestically and internationally so an innovation Innovation is a core feature and sits at the heart of the US economy Innovation drives how we generate jobs and how we seek and grow new Industries and markets how we maintain global economic leadership and competitiveness this Innovation benefits us Beyond just economic purposes also in national security tools that help to reinforce the effectiveness of sanctions and anti-money laundering regimes as well as provide us the various strategic benefits that the United States reaps from being from playing this Central role inside of the U.S financial system and all of this is incredibly important for us to keep in mind in the context of efforts by certain authoritarian regimes to drive changes in the digital world order and assert digital authoritarianism and irresponsible behavior in cyberspace at the recent special competitiveness studies project global technology Summit I think some of you are there I recognize you um I was thrilled to hear National Security adviser Jake Sullivan continue to emphasize the critical work that the administration is striving and work that must still be done to ensure U.S competitiveness and emerging Technologies like artificial intelligence biotechnologies and clean energies to make sure that these critical emerging Technologies work for and not against democracies and security I fundamentally believe that DLT and digital assets are a critical part of that story of U.S competitiveness perhaps not so coincidentally on the day of that Summit of
the special competitiveness studies project the White House released its fact sheet on the US government's comprehensive framework for responsible development of digital assets however a key part of that Narrative of competitiveness is that responsible Innovation does not mean unchecked technological advancement without regard to implications for society security and Democratic Values to ensure the advancement of responsible innovation in blockchain Technologies and digital assets both the US government and Industry must play a role and have played a role on the government side those capabilities and responsibilities often take the form of them playing regulator and enforcer against unsound and criminal practices enabling broader industry and government advancement through standard setting and supporting research and development and promoting trade education and adoption so each of these roles is critical the Department of Commerce spoke to each recently in their publication for the report on the responsible advancement of U.S competitiveness in digital assets they also emphasized the critical importance of consistent engagement between public and private sectors so federal agencies for years have leveraged some mechanisms to try to understand and enable Innovation whether through the fincen's Innovation program the sec's fin Hub lab cftc and also grants that have been leveraged by NSF and others to support development of privacy enhancing Technologies as well as blockchain analytics Solutions but especially exciting to me were some of the announcements that were made recently driven by the efforts underneath the White House Banner where the US government has announced supporting some r d efforts related to DLT for example DARPA just announced a partnership with Inca digital via the small business Innovation and research program to map the impact of digital assets so including how they're linked to illicit Finance how they may affect or be affected by a traditional Financial systems or Trad Phi the National Science Foundation committed to build a digital assets research and development agenda very excited about this as well as to back research to support digital systems that are usable inclusive Equitable and accessible and in this year's U.S government multi-agency research and development priorities memo the White House listed Financial Technologies which they previously outlined in the critical emerging Technologies list to include digital assets distributed Ledger Technologies and digital identity infrastructure as a priority for agencies to collaborate on for research and development efforts states have also embraced measures to understand and enable its Innovation whether through regulatory sandbox approaches like you've seen in Wyoming and some other states or examples like the New York Department of Financial Services Tech Sprint on digital asset technologies that I participated in in 2021 but I would be remiss not to underscore that part of that responsibility of the US government to drive Innovation is also to make sure that the regulatory framework is one that enables appropriate Innovation to thrive all of these pieces must work together to be able to complement each other to achieve these goals so that means for optimal Innovation to be able to thrive a regulatory framework would hopefully be clear it would be understood it would be enforced and complied with by the industry and it would evolve based on a true understanding of the risks and evolve to make sure that it was addressing those really those those key issues that were arising so a couple of key issues that often come up in the context of a regulatory framework meeting the needs of innovation um I often hear criticisms on both sides one saying it's the wild west this stuff is innovating without any regard for Humanity um and for and for illicit Finance concerns and fraud and consumers and on the other side we're we're crushing and stifling Innovation because of too much uh overly regulatory burden um I think these are interesting that some view it as a wild west since the U.S has a very comprehensive regulatory framework that's been in place since at least 2011 by fincen you have as you have a sanctions framework you have a tax framework you have Capital markets there's there's so much coverage here the core issue tends to be around opportunities for points of clarity or covering certain Prudential obligations at the federal level but for the most part the fragmentation that exists in in the crypto regulatory system in the U.S is the same as the fragmentation that
exists in just the regular Financial regulatory system so most of those concerns really are not specific to crypto um on the other side of being overly burdensome on the regulatory framework um I think again many of the concerns that are presented are the same are the same kinds of obligations that exist for all Money Services businesses that PayPal and Western Union also face on having to get MSB licenses to operate in 50 different states so none of this means that there's no point for opportunities for clarity and for evolution it just points out that some of the concerns that are raised in the U.S I think don't necessarily come with appropriate type of context for industry innovating especially on the technology side is a role and responsibility that they often naturally rise up to so since originating research in cryptography and distributed computing in the 1980s and 90s that led us to the Genesis block and now to Innovative platforms like ethereum and cardano Solana hedera all enabling higher order developments in dapps and digital identity and broader applications there's incredible potential and incredible growth here but this is also where industry must take steps to sufficiently account for the risks that exist in this space and where I expect industry to and I feel that many many have already been driving these Innovations to make sure that we are at the Forefront of driving world-class Innovations and reg Tech and the Security Solutions that will make sure that these Solutions work for and not against democracies in the American people so this requires a sympathetic eye sometimes from industry to governments to understand that the government rightfully has has a duty to understand and monitor and mitigate the key risks that exist in this space and whether they're risks related to climate impacts from computationally intensive algorithms and protocols or entire assets and holdings of consumers disappearing from rug pulls or cyber crime these These are the kinds of concerns that the government exists to try to mitigate so we have to understand what they're looking for and then look to Industry to see where we can Implement solutions that can address those core issues to make sure that that agencies feel comfortable with the current state and the future state of the industry so this is where industry can take a role to ensure that keeping Pace with those Innovations these developments can also innovate to address those critical risks um and one and one more point on the fact that it really requires a deep understanding of the different implementations in the technology and I know that that's often brought up by industry these coins and platforms look very different from each other the risks and benefits are also unique to those specific implementations some systems claim to be immutable or decentralized those are typically not a binary those are typically on a spectrum nothing is completely immutable nothing is completely decentralized at least so far as what I've seen examples like proof of work blockchain systems people love them for their potential decentralized and democratized access to financial services and systems but they present potential challenges for climate implications and impacts however when you look at proof of stake systems you might get the benefit of not being so computationally intensive but there's other Progressive values that might that might be a cost there if you if you leverage A system that potentially makes the wealthiest wealthier some critics have pointed out so there definitely has has to be Movement by by industry and and they've definitely done a lot to try to rise to the occasion to address some of the critical issues through the space when you go through the stack the kinds of technologies that you can apply whether through technological or governance controls vary they can be securing mining Hardware tiering Version Control DNS whitelists block headers and Fields to facilitate information transfer and compliance with the travel rule I hope all these things make sense to the folks in this room they can be highly highly technical or specific to the anti-money laundering framework where I'm most learned on the regulatory side creating Registries for a trusted dapps and virtual asset service providers or building in digital Identity or transaction thresholds there are people in Industry that are building in all of these things so it really just requires looking specifically at the implementation the risks and figuring out what's needed to make sure that the system is built securely so now that I've covered extensively some of the views on responsibility and capability across industry and government to support this to support this responsible Innovation let me speak briefly on a couple of those key issues that I think are really going to shape the future of this space first illicit finance and other Financial crimes consumer exploitation I like focusing on this one first because it was the first one really on the international policy stage the financial action task force standards to set the first ever International standards related to digital assets however illicit Finance remains a persistent problem we have North Korea and other cyber criminals that are stealing hundreds of millions of dollars and then laundering it through this system I hear Industries say well it's a public Ledger like yeah but when it's not sufficiently regulated so the key core issue of jurisdictional Arbitrage still being a problem I can watch it on a public Ledger go to a place and I can't do anything about it because there's no identity on the other side there because no one has regulated and is properly enforcing that system I believe that we can drive Innovations in this space technologically as well as as well as through policy and governance to make sure that we could eventually dare criminals to launder on these public ledgers and to one day through the programmability and other features of these systems make sure that that digital assets are actually less of a risk for money laundering than traditional Financial systems I know some people point to the fact that it's a public Ledger and that you can support that traceability to mean that it's already less risk um that of course like you can see it so it's better than cash but of course cash takes time and space and physics to move from point A to point B um crypto does not it's like sending a wire transfer from my pocket to yours anywhere in the world there's something that stops me from being in Iran or you from being in North Korea um so of course those features of global reach instantaneous value efficiencies these are great features that we want for for potentially providing safe and affordable Financial Services more broadly to people those are also features that are incredibly attractive to illicit users and that's why we have to figure out how to build in the right protections and the right regulatory framework that will shape that future for us so on cyber security and resilience I know I've spoke to that a little bit based on some of the targeting that we've seen um just this year on hundreds of millions being stolen from crypto exchanges and blockchain platforms due to poor resilience and I believe you already had a keynote speaker earlier today speaking to some of those issues so that's going to continue to be an issue that will drive the future of the space that will drive trust from consumers in this space willingness to actually keep assets and hold them there will be critically defined by if we establish the right standards and build in these appropriate protections now for the the really sticky stuff identity privacy and discoverability so this is a tough issue identity is key it's very sensitive and the reason why it's so tough is because now with with blockchain Technologies you have two pipes that traditionally have been bifurcated information transfer in the internet where there are technologies that allow for establishing trust and identity but it's not implicit a part of your information transfer you don't have to have your identity attached to it value transfer we're very used to having identity attached to that in digital payment systems now you have a platform that can facilitate both happening simultaneously and if you put the right encryption on top of it you can't even tell if it was information or value transfer that's why Regulators are concerned of course the future of Technologies zero knowledge proofs and homomorphic encryption these developments are going to help us solve these problems but that is a core issue that I think both industry and government bodies have to be aligned to to understand why it's so tough and why we have to get that right and then finally the final tough issue decentralization and pers and personhood like I mentioned before most of these tough issues are or these features that the assets are not are not binary they're on a spectrum nothing's completely one way or the other so far that what we've seen um I think the cftc's recent action against a Dao um decentralized autonomous organization um that through a lot of a lot of the sector um up in arms um was very interesting and points to the fact that they view the adao in this instance under these facts and circumstances was a person underneath their authorities it will be very interesting to see if fincen and under the bank secrecy act also views daos or some daos because it will be facts and circumstances dependent to be a person I know much of Industry ends up looking through the first letter in Dao decentralized to say I'm not regulated I would encourage them to think about the third letter in Dao organization literally in the definition of person under the bank secrecy act doesn't mean that all dowels are persons does not definitely depend depends on their organization the level of centralization their role Etc but it does mean that they need to think very hard about what function you are serving and whether you are operating and administering a financial um a financial institution platform so there's a lot of assumptions that have been made about decentralization I hear industry think about well if I can just efficiently decentralize then I won't be regulated right like if there's just if it's just people totally peer-to-peer there'll be no regulation I I don't think that's likely the future um well first off I don't think that getting rid of intermediaries is likely the future we like intermediaries I don't keep all my cash underneath my mattress for a reason I like having an intermediary that I can go to and sue if all my money gets stolen but I recognize that some people will potentially like using this disintermediated system however a regulatory framework is a living framework the bank secrecy Act was a living framework I would totally expect that if the future really is totally decentralized finance and there are in fact no intermediaries at least that are currently defined as financial institutions Regulators may look at others that are not FIS like minors or they may consider if they have to impose obligations on end users and consumers like the cmir when you're on a plane and you have to say if you're carrying 10 grand cash over a border that's an obligation I place on Americans not on a financial institution or sorry that I used to when I was a regulator I'm not a regulator anymore um but so I'm not saying that that's advisable desirable or even likely and certainly not near term I don't imagine that happening it's more of an assumption that I hear industry make sometimes that if you decentralize it there won't be any regulation I don't think that that is likely the future so instead the best steps that everyone can take is try to figure out how to build in these controls how to make sure that Tech is evolving in a responsible way and make sure that those risks never have to be mitigated in such undesirable fashion so thank you all very much this was a wonderful opportunity to chat with you and thank you questions
2022-10-15