Blockchain reaction: is your data safe from hacking?

The way some people are talking about blockchain technology these days, you would think it’s the answer to all ills. For most businesses, blockchain is part of a distant future they don’t quite understand, but proponents say it has the potential to transform the engine room of financial services.

Part of the hubris around this technology is the never-ending claim that it is immutable. Like the Rock of Gibraltar, nobody can prise it open or break it apart. Once the information is entered and agreed upon by all the participants in the chain, it is incontrovertible proof; recorded history.

Blockchain works as a series of blocks, each of which contains digital information such as sender ID, recipient ID, time stamp, a consensus protocol such as proof-of-work and hashed (or registered) value of the previous block. Each block contains a full history of the transactions involved, and subsequent blocks in the chain carry that data forward, with each one containing a hash of the previous block.

The distributed ledger system allows each participant (or node) to see clearly where information has come from and gone to – in essence, blockchain is an innovation in record-keeping, a cryptographic chain of proofs.

To alter the blockchain without being obvious, anyone wanting to create a false record would supposedly have to modify every subsequent block, which generally requires everyone using the blockchain to “agree” to the fraudulent transaction. Therefore, proponents say it is extremely difficult to alter data or insert false information.

Blockchain: open and transparent?

It is this openness and transparency that is attracting participants. American multinational retail corporation Walmart is using blockchain to track products back to their roots. Scan an apple and you can eventually follow the chain back to the farm where it was grown. British Airways has used blockchain to ensure that operational flight information is synced and that airports, airline crew, ground services and passengers are all on the same page.

Businesses will be offered private or permissioned blockchains, which use smart contracts, sometimes called self-executing contracts, so they can exchange money, property, shares, or anything else of value. In the blockchain system, these are tokenised into digital form. 

“You can’t lose the private key or let others control it. The biggest risk is key management and cyber management.” Mark Staples, CSIRO

It all sounds like a frictionless environment, where logic rules and real-world problems are cast aside, but not everyone is totally convinced. The real world makes mistakes. 

“If something false is recorded – or even if someone disputes an event, we have to ask: how does the so-called immutable chain resolve that?” says Meg McKechnie, a director of the forensic and technology services practice at law firm Clayton Utz.

How, for instance, would a case of price collusion between certain powerful parties be spotted if entered and later multiplied along the chain? How would blockchain have dealt with the banks’ manipulation of the Libor (London Interbank Offered Rate) interest rate, where a self-policing committee of the world’s largest banks falsely inflated or deflated rates to profit from trades, which also gave the impression participants were more creditworthy than they actually were? There is an argument that blockchain sequencing could have aided and abetted the process.

Falsely inflated prices may not be immediately recognised and could only be changed by an audit trail well after the event, possibly hundreds or thousands of links behind the current chain. 

There are also issues around the private key holders: the controls behind each node or participant. If someone can assume control of 51 per cent of the private keys and hack into the system by pretending to be one or a number of the nodes, the chain could be manipulated.

It is blockchain’s boast of immutability that may, paradoxically, be its weakest link. McKechnie offers the example of a blockchain crossing partly through Europe, where privacy laws now allow people to request the removal of their digital data. How does an immutable blockchain deal with a request to delete someone’s digital data in the chain? It’s a contradiction in terms.

Mark Staples, senior principal researcher of CSIRO research unit Data 61, says that on the permissioned blockchain – as in any database – it should be possible to reverse or correct a mistake that repeats along the chain, just as any reversing entry can be adjusted on an accounting ledger. 

However, not everything can be corrected. Staples references the phenomenon of blockchain poisoning. It could be objectionable material – possibly pornography – being sent down the chain, or simply data that might be illegal in one country, but free speech in another. 

“Once it’s there, it’s there.” Staples says. “That’s one of the challenges.”

Jonathon Miller, managing director of bitcoin trading platform Bit Trade, disagrees that immutability is a weakness. He believes it is blockchain’s main bulwark against hackers or even simple mistakes, because nothing can be changed without the other nodes knowing. 

“A permissioned blockchain is a collusive network – a database with more than one owner – and it requires multiple consents to issue information or to change it,” Miller says.

Public versus private blockchains

Public blockchains have been hacked, but private ones, which use both public and private keys for encryption, are also exposed if hackers seize a private key.

“Most hacks with bitcoin and other public cryptocurrencies have been about people not managing their private keys,” Staples says. “You can’t lose the private key or let others control it. The biggest risk is key management and cyber management.”

Blockchain advocates like to give the impression that a chain is instantaneous. This is all about real time. The World Bank recently asked the Commonwealth Bank of Australia to issue a bond using blockchain technology. World Bank head of capital markets operations Paul Snaith has boasted that what is now being done in T+2 days will reduce to “T+2 minutes”.

Miller, whose firm runs Bit Trade Labs, consulting on blockchain applications to third parties, says the systems now in use are slow and ponderous. 

“You are waiting for everyone in a network to agree that what you have inputted meets the protocol and has been taken up by enough nodes to become a consensus.” 

Nick Addison, a blockchain solutions architect, agrees. “It all runs on a single thread,” he says. Bitcoin can sequence around seven transactions per second, he estimates, while Ethereum, another commonly used open-source blockchain platform, can handle about a dozen per second.

Professional Development: Fintech value pack. This value pack includes ten courses on financial technology (Fintech) with a focus on blockchain, bitcoin and other cryptocurrencies, artificial intelligence (AI) and robotics. Learn more.

Deloitte Australia partner Jonathan Perkinson adds another factor: there may be operational limitations to a system where control is by mutual consent. As adjustments to the ledger need 51 per cent consensus, others have to check your work before you can update your own records.

“You need to understand the operational implications of that,” Perkinson says. “It can have a customer impact. Delays and troubles incurring from others not agreeing on a change could become a business interruption problem.”

When blockchain becomes mainstream, McKechnie predicts we will see a deluge of providers (of varying quality) offering blockchain as a service. There will need to be questions about references, the ultimate ownership of keys and the service’s financial backing (see inset). There is a risk that if the blockchain solution provider fails, its system may not be easily transferable.

“If it is managed by an outsourced company, who has the ultimate system admin access?” McKechnie asks. “And how good is the data back-up and disaster recovery they’re offering? What are we seeing put in place at the moment?”

There will also have to be policies and procedures regarding compliance of the blockchain with legal obligations relating to data breach laws, privacy, modern slavery, the Anti-Money Laundering and Counter-Terrorism Financing Act 2006 and cybersecurity, she adds.

Developing blockchain

Blockchain is still a work in progress and its uses will differ from one potential user to another. Cross-border trade finance is an obvious candidate, where buyers, sellers, insurers, banks and customs agents are all party to a single transaction. 

“They all need to interact on the same record and have the same understanding [of] where the transaction is along the cycle,” Perkinson says. “This will reduce execution risk for all different parties to a transaction.”

Such undeniable transparency, where all people can see a transaction through its entire life cycle, is not for everyone and certainly not for businesses that need to maintain privacy for competitive reasons.

Consider the aforementioned Walmart apple example. “When you’re buying an apple do you want the person you’re buying off to know you’re in short supply?” Addison asks. 

“Likewise, if you’re selling to supermarkets, do you want them to know you’re overstocked?” The real world simply may not want a cryptographic chain of proofs on display for all people, all the time.

There are still plenty of kinks to iron out, Addison says. “There’s key management and scalability for one, but there’s also an issue of privacy. Not all businesses want – or should have – total transparency.”

McKechnie says potential blockchain users should beware of what is a new and largely untried technology. 

“In essence it is good technology but those planning to use it need to go in with their eyes open to the risks,” she warns. “Make sure you deal with them at the time of implementation.”

Blockchain: questions to ask a potential provider

• Is the blockchain on premises, or is it supported by another company offering blockchain as a service?
• If it is deployed as blockchain as a service, is it in the cloud?
• Where is the data centre hosting the blockchain physically located? (The jurisdiction may have ramifications in terms of data collection laws.)
• If it is managed by an outsourced company, who has the ultimate system admin access?
• What level of access is offered by the blockchain? 
• What reporting functions are offered?
• What’s the throughput speed of using the blockchain and are there any performance testing matrices/specs?
• What are the security standards of the blockchain?
• Is it private or public?
• How does the front end interface interact with the blockchain? 
• What’s the verification protocol? What’s the hashing method of the blockchain? What programming language is used to calculate the hashing method?
• Which network is the blockchain based on (eg. Ethereum, IBM, etc)?
• What audit requirements are in place to maintain blockchain integrity?
• What application programming interfaces (APIs) are offered and what software can the blockchain connect to?
• If the blockchain is currently based on one provider’s technology (eg. Ethereum or IBM), how easy is it to move the data off the current blockchain and deploy to another provider’s blockchain environment?
• What other software platforms can be integrated with the blockchain? 
• What’s the data back-up plan/disaster recovery plan for the blockchain?

This article was originally published in IN THE BLACK | Publication date: 01 December 2018