My last post was a visceral reaction to a cautionary tale about blockchain. The article that I referenced reinforced my notion that there are many challenges blockchain (or any distributed ledger technology) will have as it attempts to move into the mainstream. It did not, however, provide anywhere near a complete and well-defined summary of these challenges. This post attempts to remedy that situation—providing a somewhat more rigorous argument for your consideration.
I start this post by stating three things:
- I have been following the blockchain phenomenon for several years now. It initially interested me because I was in the payments business and it provided the potential basis for disruption in our market, i.e. a possible replacement for the technology we were using to process payments in the construction industry. My ongoing interest has been focused on trying to determine if there is anything to the technology and to find real opportunities to justify its implementation and possibly create some real value;
- I further believe that Bitcoin (the product that introduced many of us to blockchain) and other blockchain-based products were a legitimate attempt to provide an alternative to traditional trusted 3rd party ledger mechanisms in the wake of the 2007 financial crisis. Further, I believe that much of the allure of the technology is a natural reaction to the greed and general intemperance that precipitated that crisis but not necessarily, by itself, an objective reason for thinking that a distributed ledger is superior to the trusted 3rd party; and
- Finally, I have come to believe that there are good reasons to be very skeptical about the competitive advantages of distributed ledger solutions (as exemplified by blockchain) relative to more traditional trusted 3rd party implementations. I believe that any perceived advantage of a distributed ledger needs to consider the challenges I have outlined below.
Uses for Blockchain
As background, I note that there are a several kinds of transactions (and associated recordkeeping) that are currently managed by third parties for which blockchain enabled solutions are being proffered. They include:
- Electronically facilitating payments (moving value from one party to another) that are recorded on a blockchain. This is like the service EFT, ACH and credit card companies provide, except that the transaction is recorded on a secure distributed ledger (Bitcoin, Ethereum) instead of being processed by a trusted third party, i.e. NACHA, Visa or Mastercard;
- Journaling of transactions—tracking Movement of Assets (real estate titles, automobile titles, equities, or tracking products) between owners or through a supply chain. These transactions, need to be accurately and durably recorded on a ledger and that recordkeeping is currently facilitated by trusted 3rd parties; and
- Smart Contracts—by tying payment to the execution of agreements that are executed electronically when one party completes their commitment (e.g. provides the agreed product or service) and the other accepts that the commitment has been delivered thereby automatically releasing payment. Textura, the construction payment company that I co-founded, is a trusted 3rd party that facilitates payments based on the completion of contracted services and might be disintermediated by blockchain-based smart contracts.
There are five challenges to blockchain’s adoption as a mainstream technology as outlined above:
- Flawed Implementations— This is a problem in any system. In fact, many of the issues with the security of databases maintained by trusted 3rd parties are the result of flawed implementations and blockchain systems have exactly the same risks of being poorly implemented as trusted 3rd party implementations.
I organize the possibilities for flawed implementations into two categories: 1) defects in the system’s design; and 2) issues with the operation and maintenance of the systems. Make no mistake, these are complex systems and the same issues that plague the systems that trusted 3rd parties use will find their way into blockchain implementations. This isn’t a reason not to build blockchain systems, it just levels the playing field when comparing them to those that are being used by trusted 3rd parties.
- Insider Malfeasance—This is a problem with the people who operate/manage the services being delivered through a blockchain implementation. The players in the article I referenced in my last blog post are great examples of folks who shouldn’t be trusted to operate a financial institution. They don’t appear to have been criminals, but they were not competent in all the skillsets that are necessary to operate what is essentially a financial institution. There is an important lesson here: There are a variety of skills that are needed to operate a technology-driven business and tech savvy is only one of them. That said, given the complexity of these systems it would not be hard for insiders (if the operation isn’t properly managed) to (through either operational manipulation or defects in the code that run the systems) corrupt the processing of transactions or even impair the integrity of the blockchain itself. It could be done, and it wouldn’t be difficult.
- User Error—blockchain implementations have not attained the intuitive interface of an iPhone. For instance, most people don’t understand how Bitcoin actually works. I am not talking about how the underlying technology works, but mechanically how you hold and spend your Bitcoins. How many of you can honestly say you understand why you might want a Bitcoin wallet and how to choose the best one for you?
And, the picture doesn’t get that much better when you move into the commercial realm. The technology is complicated. And, the implementations have not in many cases been developed in ways that minimize the complexity that those managing the technology or using the applications built upon the technology must deal with. And, everyone knows that complexity drives errors.
- Weakest Link—When faced with a formidable security measure (such as are implemented in blockchain), smart adversaries look for ways around the hardened locks. Have you ever wondered why carjacking became the preferred method for stealing a car? It was a result of improved security which made it nearly impossible to steal a car without the key. So, people who want to steal cars don’t even try to work around the car’s locking mechanisms; they just take the key from the owner.
By similar reasoning, it is unlikely that someone will try a direct assault on blockchain, i.e. try a brute force attack on a blockchain. They are more likely to either try to corrupt information that is being encoded on the blockchain or go after the wallets that contain the encryption keys that prove ownership.
Let me give you an example. When I worked for PricewaterhouseCoopers, one of the auditors told me that he was going to a refinery to test and make sure that there was oil in the tanks at a refinery that we were auditing. Embezzlers had learned that it was easier to fill the tanks with water (with just a little oil on top) than to change to accounting ledgers. So, they made sure that the information going into the ledger was corrupted (by making the oil tanks appear to be full of oil, which would get recorded on the ledger, when they clearly were not) before it got there. Anyone who thinks that auditors are going to be made obsolete by blockchain are sorely mistaken.
- Cost of Verification—Blockchain was conceived to ensure the integrity of transactions that will be posted to the ledger. Blockchain uses a technique known as “proof of work” to require that enough effort must be expended to ensure that it isn’t feasible to hack a blockchain and be able to change the contents. Blockchain is generally accepted as being virtually incorruptible, but at a cost.
“The mining of a single bitcoin block—a block of transaction data on the bitcoin network—consumes enough energy to power more than 28 U.S. homes for a day”.1 In aggregate Bitcoin mining alone consumes the same power as Ireland.
And the problem gets worse. The algorithm is designed to make the proof of work more difficult as the processors become more powerful. This direct positive relationship between the difficulty of the proof of work and the power of the processer is an essential attribute of “proof of work”, i.e. it must be difficult (lots of effort must be necessary to encrypt the links in the chain) to ensure the integrity of the ledger. So, substituting quicker processors might allow one to more quickly (than their less capable competitors) perform their proof of work (winning the race and the associated reward), but it will only increase the amount of effort (energy) required to solve mine coin.
None of these, by themselves (or together for that matter) would be reason to pass on blockchain. They should however be considered when looking at it as an alternative, because doing blockchain right will be (in terms of engineering and operations) very expensive which is one of the primary reasons provided for preferring a distributed ledger over a trusted 3rd party implementations.
This blog post is a challenge to those supporting blockchain-based products to respond and prove me wrong. This would require that your (proposed) offerings be objectively compared to the trusted 3rd party alternatives using the criteria I have outlined above, in addition to those that you are already using.
1Why Cryptocurrencies Use So Much Energy—and What to Do About It Communications of the ACM, July 2018
Copyright 2018 Howard Niden
— you can find this (days earlier) and other posts at www.niden.com
and if you like this post: 1) please let me know; and 2) pass on your “find” to others.