Internet of Outdated Things Will Payback

Internet of Things

Industry is failing in securing connected products on mid- and long-term support. Furthermore, we see the influence of lobbying trying to lower the barriers and liabilities to provide security for connected products. There is no doubt, if vendors do no care on future support for the connected products they build, they will trap themselves and their customer in uncertain future cybersecurity risks.

Risks that not only affecting the user of a single unsecure product. As everything will be connected this risk are multiply towards risks for our infrastructure, society and freedom.

Paradigm shift in product lifecycles

The average lifecycle of a car in Germany is 19 years. Machines in for industrial production are often build for lifetimes with 25 years and more. Residential Homes are built for a lifespan of 70 -100 years. This is manageable in maintenance, as long the product was not connected. Keeping the products secure was limited to take care on physical parts by replacing timeworn elements as long the replacement is economical feasible. The mindset of all stakeholders – starting from industry towards costumer is shaped by this experience.

But the connected era has changed everything. The product lifecycles of digital products have accelerated. The first iPhone was sold in 2007. Can you imagine using a Nokia 3310 mobile Phone instead you Smartphone today? 2018 we are used on the comfort of our iPhone X or Samsung Galaxy 9. Also, we are used that our Smartphones will be changed every two years on the next new model. We are getting continuous update support for iOS and Android which provides rather stable protection from cybersecurity risks. But there are no more software updates for the Symbian Operating System of a year 2000 Nokia 3310. Well, even Nokia as Vendor does not exist anymore.

Smart Things are only smart on short term lifecycles

The struggle is starting, when we turn our “classical” products into “smart” products without challenging the product lifecycle paradigm shift. Let me explain this on two examples.

First autonomous driving:
there is this brilliant vision of autonomous car fleets with in a full digital user experience. Cars are optimizing mobility in intelligent swarms and providing their users digital service platforms. To keep such systems safe and secure needs permanent service and support. Keeping apps up to date and providing patches in case of vulnerabilities in its operating systems. This service and support with software updates is necessary for quality of service. Without such autonomous mobility is not possibility.

But providing continuous services is not possible in the current business model of selling cars, where car ownership is leading into product lifecycles of 19 years. It’s impossible to keep the digital hardware components and software up to date on such a product lifespan. Outdated hard and software components, certification schemes and drain of knowledge will bring vendors support to economic limits.

If you want to step into autonomous smart vehicle area you have to change an entire business model from car ownership to mobility on demand. In the mobility of demand the connected vehicles are owned and managed by fleet operators. The vehicle lifecycle is the maximum 5 years of long term operating system software support. In this 5 years the vehicle usage is optimized by the mobility operator equal the 19 years “owned” car model.
But currently the automotive industry is trapped in the old 19 years business model. And that’s where they start to doom us all. Turning current cars models into “smart” connected vehicles will create a Tsunami of out of software maintenance cars in the next 5 years. Cars with old hard- and software. Their owner will become potential targets for cybercriminals or cyber weapons. Owning a connected car is a bad idea, if you desire to hold it longer than 5 years. Selling such products to consumers is a ticking time bomb.

Second example the smart home:
turning buildings into energy optimized and assisted living areas. No doubt, smart homes have a high potential for example in supporting elderly or handicapped people. By assisted living they can life in their familiar household instead being replant on stationary care. Expending self-determined living will have an enormous positive effect on individuals and the overall economy. But domiciles are also high sensitive areas towards privacy. This status is a human right and protected by our constitution. Defending this extraordinary status from cyberattacks on privacy and security is a must. In the age of smart homes this basic human right is tied to the support of smart products during their lifetime. Only a continues updated smart home system is a secure and safe habitat.
But at this point the industry and policymakers are failing. In Germany, the liability for physical building construction elements is usually 4 years but only 2 years for the electronic devices installed inside a building. There is no perception, that an unsecure electronic device can harm habitants as badly than a bungling roof.

Keep in mind, houses are built for 70-100 years and ownership of houses is an envisaged model. There must be an answer, how we keep smart homes up to date in future, otherwise we are running into real trouble for habitants and for our critical infrastructures in smart cities. Smart homes will become primary targets for cybercriminals and cyber weapons. To face this challenge, we need common efforts of politics and industry to create incentives on keeping the hard- and software of smart buildings up to date during their lifetime.

We need to stop stepping into smart connected future with our mindset from analog age. This is a challenge for consumers, industry and politics.

You like to listen my talks on cybersecurity in Internet of Things? Visit my next sessions at:

11.12.2018 in Frankfurt


Wenn der Teddybär im Kinderzimmer spioniert

Hacker : Gefahrim Kinderzimmer

ARD schockte Millionen Zuschauer mit sprechenden Puppen Tatort Kinderzimmer: Die Gefahr für die Kleinen ist bereits sehr real Stuttgart

Millionen Fernsehzuschauer waren am Sonntagabend geschockt: Ist es wirklich möglich, Kinder über internetfähiges Spielzeug zu manipulieren und ohne das Wissen der Eltern ihr Vertrauen zu erschleichen? Der ‚Tatort‘-Krimi aus München wirkte an manchen Stellen überzeichnet – im Kern wies er allerdings auf eine reale und bereits existente Bedrohung hin.

Mirko Ross, beratender Experte für Sicherheit im Internet der Dinge der European Union Agency for Network and Information Security (ENISA), appelliert daher in der Vorweihnachtszeit an alle Eltern, Großeltern, Onkeln und Tanten: “Augen auf beim Kauf von intelligenten und vernetzten Spielzeug-Geschenken!” Im ‚Tatort‘ gelang es einer Gruppe, per manipulierbarem Spielzeug das Vertrauen der Kinder und somit letztlich die Kontrolle über ihr Verhalten zu gewinnen. Eine harmlos aussehende Puppe konnte über Bluetooth angesteuert werden, die Täter führten in Echtzeit mit dem Kind Unterhaltungen – und konnten so das Kind manipulieren.

Tatsächlich keine Fiktion und natürlich geht die Gefahr im Kinderzimmer nicht nur von manipulierbaren Puppen aus, so Mirko Ross: „Intelligente Spielsachen und Unterhaltungsgeräte für Kinder integrieren zunehmend Technologien, die ihre Verhaltensweisen auf der Grundlage von Benutzerinteraktionen lernen und anpassen“.

Der Experte ist Gründungsgesellschafter und CEO der digital worx GmbH, einer mobilen Software Developing Company mit Sitz in Stuttgart, und seit 2017 beratender Experte der ENISA. Ross weiter: „Derartige Spielsachen enthalten beispielweise Sensoren, Mikrofone, Kameras, Datenspeicherkomponenten und andere Multimedia-Funktionen – einschließlich Spracherkennung, Bluetooth-Connection und GPS-Optionen. Diese Merkmale können die Privatsphäre und die Sicherheit der Kinder gefährden“.

Jedes internetfähige Spielzeug bietet grundsätzlich ein Einfallstor für Hacker, betont der Stuttgarter. Im Auge behalten sollten Eltern daher die Internet- und Geräteverbindungs-Sicherheitsmaß-nahmen eines Spielzeugs. Ob Authentifizierung, wenn ein Gerät mit Bluetooth verwendet wird oder Verschlüsselung bei der Übermittlung von Daten vom Spielzeug zum Wi-Fi-Zugangspunkt und zum Server – überall lauern potenzielle Gefahren.

Mirko Ross: „Einige Geräte fragen auch nach Geburtstagen oder Informationen über die Vorlieben eines Kindes. Hier ist große Vorsicht geboten.“ Reale Fälle und erste Verbote „Inzwischen ist es glücklicher Weise so, dass Gefahren, die Kindern aus dem World Wide Web drohen, öffentlich wahrgenommen werden. Insofern hat der ‚Tatort‘ am ersten Advent tatsächlich etwas zur Aufklärung beigetragen“, so Ross.

Staatliche Organisationen wie das FBI in den Vereinigten Staaten von Amerika oder die deutsche Bundesnetzagentur hatten sich bereits 2017 mit drastischen Warnhinweisen an die Öffentlichkeit gewandt. Und sogar mit Verboten reagiert: Kinderuhren, die über eine SIM-Karte und eine eingeschränkte Telefoniefunktion verfügen, die über eine App eingerichtet und gesteuert werden, fallen unter ein solches Verbot. Was als „Babyphone“- oder „Monitorfunktion“ relativ harmlos daherkommt, ist nach Definition der Bundesnetzagentur eine „unerlaubte Sendeanlage“. Der App-Besitzer konnte damit nämlich bestimmen, dass die Uhr und dessen Umgebung eine beliebige Telefonnummer anruft. So hätten unbemerkt die Gespräche des Uhrenträgers und dessen Umfeld abgehört werden können. In Deutschland ist dies inzwischen verboten.

Kinderpuppe als potenzieller Spion

Mirko Ross: „Letztlich basiert der ‚Tatort‘ übrigens auf einem realen Fall aus den USA“. Damit sich die Jüngsten mit ‚My Friend Cayla‘ unterhalten konnten, wurde die Puppe über Bluetooth mit einem Smartphone verbunden. Ein verstecktes Mikrofon nahm die Fragen der Kinder auf, eine App wandelte diese in Text um. Dann wurde eine Antwort im Internet gesucht – und die Puppe antwortete über einen Lautsprecher. Genau in dieser Bluetooth-Verbindung lag allerdings auch das Problem. Jedes bluetoothfähige Gerät in Reichweite von etwa zehn Metern hätte eine Verbindung zur Puppe aufbauen und Lautsprecher und Mikrofon nutzen können. Sicherungen waren seitens des Herstellers nicht vorgesehen. Exakt derselbe Fall, mit dem die Münchner Kommissare in der ARD zu kämpfen hatten. Ergebnis: Herstellung und Verkauf der Puppe sind im realen Leben verboten. Der größte bislang bekannte Zwischenfall, der Kinderspielzeug betraf, war nach Angaben von Ross der des Hongkong-basierten VTech, der die Daten von 6,4 Millionen Kindern ausspähte. Aus den Kinder-Profilen wurden Namen, Geschlecht und Geburtsdatum ausgelesen. Noch befremdlicher wirkt ein Beispiel aus den USA: Dort war ein Teddy-Bär mit Internet-Schnittstelle durch einen Datendiebstahl betroffen. Hacker drangen in den Server des Anbieters CloudPets ein, stahlen über 800.000 Kundendaten und hatten so Einblick in persönliche Sprachnachrichten zwischen Eltern und Kindern.

Mirko Ross bei den Frankfurter IT-Tagen

Mirko Ross, international anerkannter Experte für Cybersicherheit, wird kommende Woche eine Session bei den Frankfurter IT-Tagen leiten. Von 10. bis 13. Dezember steht die hessische Metropole ganz im Zeichen der IT-Sicherheit, wenn sich die Top-Spezialisten der Branche im Kongresshaus Kap Europa an der Frankfurter Messe treffen. Am Dienstag, 11. Dezember, 12:30 Uhr, berichtet Ross über „die schlimmsten Fehler des IoT und was Produkt-Entwickler daraus lernen können“.

Europäische IT-Experten des Projekts IoT Crawler tagten in Stuttgart

2small_iotcrawler-meeting-group-picture-stuttgart

Auf Einladung der digital worx, einem von zehn internationalen Partnern, trafen sich jetzt IT-Spezialisten aus ganz Europa im Wizeman Areal. Das Projekt „IoTCrawler“ arbeitet im Auftrag der Europäischen Union an einer Suchmaschine für das Internet der Dinge.

Nach getaner Arbeit hatten die Gastgeber noch eine Überraschung für die Teilnehmer parat: Zum Ausklang ging es auf den Cannstatter Wasen, wo die Projektteilnehmer Stuttgart bei Bier und Göckele von einer ganz anderen Seite kennenlernten.

Mit dem IoT Crawler wollen die beteiligten Länder und Institutionen eine Lösung schaffen, die die Interaktion und Integration über verschiedene Systeme und Plattformen hinweg ermöglicht. Zusätzlich zu der Suchmaschine sollen verschiedene benutzerfreundliche Prototypen in den Bereichen Industrie 4.0, Social IoT, Smart City und Smart Energy entwickelt und aufgebaut werden. Das von der EU geförderte und finanzierte Projekt ist mit einem Budget von fünf Millionen Euro ausgestattet, die zunächst angesetzte Projekt- und Entwicklungszeit beträgt drei Jahre. Die Stuttgarter digital worx GmbH ist einer von zehn Partnern aus fünf Nationen, die im EU-Projekt an einem „Google für das IoT“ forscht.

Nach ihrem Meeting im Wizemann Areal tauschten die IT-Experten ihre Arbeitsplätze dann gegen die Bänke im Festzelt. Bei Musik, Bier und Göckele auf dem Cannstatter Wasen herrschte prächtige Stimmung.

Mirko Ross, Geschäftsführer der digital worx GmbH und Gastgeber des Projekttreffens: „Für viele unserer Kollegen aus Spanien, Dänemark, Österreich und Großbritannien war der Wasen eine ganz neue Erfahrung. Ich denke wir haben neben der professionellen Organisation unseres turnusmäßigen Meetings auch eindrucksvoll gezeigt, was deutsche und Stuttgarter Gastfreundschaft bedeutet“.

Getting lost in the digital forest

Winter Forest

This post is a summary of my past talks and lectures on human transformation caused by the ongoing digital evolution of Internet Of Things. Currently we see the Internet of Things merging humanity from Wide Area Networks (WAN) over Local Area Networks (LAN) to Body Area Networks (BAN). Internet connected devices will penetrate our homes, cars, body or just everything and everywhere of our daily life – from birth to death.

This is not only technical evolution. The Internet of Things is an evolution of mankind. An evolution which is not progressing by random. Many technical devices and services are resulting in the philosophical framework of tech industries, mainly developed in the early 40s, 50s and 60s and now enhanced in the Silicon Valley. It’s the purpose of technology to “serve” humans and enhance their capabilities. Today we see digital assistants growing everywhere. The voice controls at home enhanced with AI are just the beginning. Silicon Valley’s product development is driven to assist. Virtual AI assistants will burden the tasks of our daily life and we can focus on the important aspects of life. So far so… I don’t know.
A second important aspect of the tech industry is focusing on life span. Technology is used to track and measure our behavior, mood, health conditions and vital signs. All of that, to support in healthier living: less stressful, improved Cardio training, weight control and optimized mental health. We do not need to be aware of our body and mind. The tech industry is providing assistance for every aspect to expand lifetime.

The digital transformation is also a transformation of skills

Assistance everywhere. What’s their impact on human personality? It is one aspect of human personality that we grow our own skills by tackling challenges. In a world, full of digital assistance less challenges will may leading into a less opportunities to acquire skills for shaping personality.

Let’s travel back in time, and follow me on a true story of my childhood

35 years ago, when I was a kid I loved to explore nature. Being an adventurer stepping into the deepest German Forrest (nearby my parents’ house) to get deeper into, than ever as a kid before. Walking beside the paths into darkest Forrest was part of the game – the challenge to explore new own routes in an unknown territory. One time I got completely lost. No glue on the right direction to get out of the forests and find the way back to home. Time passes by and the day was going to end. I know that my mother was expecting me to return from playing outside, which was adding additional pressure on the challenge to find my way out of the dark woods. At one point of this challenge I was seriously thinking about to build a shelter to spent the night or may the rest of my life in that jungle. It was frightening and disappointing to imagine to have no way out and getting completely lost. But building a shelter was only the last option. While the sun was setting, I continued to search a path back home. And somehow in the deepest minutes of being lost, my search on finding a path was successful. I found a way leading out of the deep Forrest and back home to my parents, just for the right time agreed.

This was a basic lesson for life, shaping personality. Even if the situation seems hopeless lost, I managed by own skills to get back orientation. What a great feeling to manage this challenge and what good experience on own capabilities to grow a self-confident personality.

Gaining skills in the digital area

Today my daughter is ten years old. She is growing up in connected and full assistant world. The forest is no more an unknown wild territory – as we it is a full sensor equipped a monitored environment (to be honest: at my company digital worx and LoRa Networks we are working on agriculture and forestry Internet of Things Platforms, so Daddy is building on the environments, as well). Smartphones take care of us, as we can track and trace ourselves by geo services of Google and Apple. Getting lost is a challenge in this connected environment. By the fully connected and assistant digital world, this seems not easy.

But what does this mean for the growing personality of my child? Where can she explore situations “out of control” to train skills to solve the problem of being lost.

The answer is might not easy. We can’t protect our children from immersive technology in childhood forever, as with digitalization the connections will start more earlier and technology is more bonding. My experience of “getting lost” is something which is gone forever in the upcoming generation. May it’s the same “losing” of skills than to light a camp fire only with two wood sticks – an essential experience and skill mankind needed more than 30.000 years. We’ve lost that ability and for sure we certain important challenges to develop personality. But on the other side we were facing new challenges (WTF, where is the lighter!) and we developed new skills.

But at all we did not outsources our tasks and challenges to digital assistant systems. This may the biggest change we are now facing in history.

So, the solution is might absurd. Turning back from tech is not possible, or limited to quite exclusive situations and controlled environments. So maybe tech industries will fill the gap of skill training by assisted programs to support the generation of my daughter with “augmented” and “virtual” trainings. Just to serve personalized tasks and training to develop skills, which are needed to challenge the digital full connected and assisted life.

Why we need more trust and security in the Internet of Things

asvin - secure update distribution and management for Internet of Things

By the rise of up to 20-30 billion connected devices with in the next 2 years the Internet of Things (IoT) industries is in more need of product reliability.

This includes the demand to keep IoT products safe during their lifetime. Today this is already a big challenge. With more and more devices at the edge it will become a huge challenge. IoT Edge devices have no direct TCP / IP connection to the Internet. But vendors and service operators needs to patch and update them to keep this sensors and actors operable and safe. As most of the 20-30 billion devices will be at the edge, we need reliable solutions. A mass of unpatched and unsecure edge devices will be a massive problem for a working and secure infrastructure.

Secure Updates for Internet of Things with asvin.io

Secure Updates for Internet of Things with asvin.io

That’s what we are working on asvin.io. It’s our mission to make the IoT safe beyond the edge. For IoT vendors and operators we are providing an easy to implement solution, which enables secure patch and update distribution through the application stack: from software version control system to cloud distribution and gateways forwarding to edge devices. In this stack, trust and security is provided by Blockchain and encryption layers. We are strongly committed to open source and we believe, that this is the only way to provide a transparent secure stack and sustainable solution during IoT product lifetime.

Our journey into trusted and secure Internet of Things has just begun. We all in IoT Industries are producers and consumers as well. Let’s make our IoT future safe. asvin.io is one building block.

This article has been originally posted on asvin.io website

asvin rockt 10. Sicherheitskongress

asvin - secure update distribution and management for Internet of Things

Die wachsende digitale Vernetzung von Unternehmen birgt auch sich verändernde Risikoszenarien. Hierauf die richtigen Antworten zu finden ist das erklärte Ziel des Stuttgarter Sicherheitskongresses, den die IHK der baden-württembergischen Landeshauptstadt bereits zum 10. Mal veranstaltete.

asvin.io, ein Spin-off der Stuttgarter Technologie-Schmiede digital worx, begeisterte die Fachleute dabei mit einer Live-Anwendung des Produktes, der Update-Versorgung für Unternehmen auf allerhöchstem Sicherheitsniveau.

Die Digitale Transformation ist längst kein Schlagwort mehr, sondern hält mit atemberaubender Geschwindigkeit Einzug in nahezu alle Bereiche der Wirtschaft. Damit verändert sich auch die Zusammenarbeit mit und zwischen den Unternehmen – egal ob Mittelständler oder Konzern. Die denkbaren Konstellationen sind vielfältig: Veränderungen in Lieferketten, Entwicklung neuer Geschäftsmodelle, Kooperationen zwischen etablierten Unternehmen untereinander aber auch mit Startups.

Im IoT-Umfeld (Internet of Things) ist die Aktualisierung der Software auf den Endgeräten eine besondere Herausforderung für Wirtschaftsunternehmen aller Branchen. Installierte Software muss aktuell sein und Sicherheitsupdates müssen so schnell wie möglich eingespielt werden. Spezialisierte Software-Update-Systeme für IoT – insbesondere für den Mittelstand – sind allerdings kaum auf dem Markt zu finden. Diese Lücke schließt asvin. Bereits seit 1998 beschäftigt sich die Stuttgarter digital worx GmbH mit Software-Entwicklung für Online-Anwendungen und ist Dienstleister in den Bereichen Internet, mobile Apps, Internet der Dinge und Industrie 4.0. Die geballte Kompetenz für die Sicherheit im Internet of Things wird künftig im Spin-off asvin.io zusammengefasst. Aktuell befinden sich die Systeme in der Testphase, an der auf Einladung auch geschlossene Testkunden beteiligt werden. Der finale Roll-out wird im Laufe des Jahres 2018 erfolgen.

asvin ist eine einfach zu benutzende Update-Sicherheitslösung für alle Geräte im Internet of Things. Der große Vorteil: asvin ist sehr einfach zu installieren – und über ein übersichtliches Dashboard jederzeit sicher zu bedienen. Beispielsweise werden individuelle Update-Rollout-Pläne ebenso möglich wie automatische Updates. Die höchstmögliche Sicherheit wird durch Distriputed Ledger und Blockchain Technologie realisiert – somit sind Updates besonders abgesichert und vor der Manipulation durch Dritte geschützt. Und: künftig werden außerdem automatische Updates von Maschine zu Maschine möglich.

Im Rahmen des 10. Stuttgarter Sicherheitskongresses, bei dem zahlreiche namhafte Unternehmen als Aussteller fungierten und ihre Spezialisten als Kongressbesucher teilnahmen, zogen die Gründer von asvin das Fachpublikum mit einer Live-Anwendung in ihren Bann. Die Steuerung von Updates per App auf dem Handy demonstrierte eindrucksvoll, wie einfach IT-Sicherheit für den Anwender sein kann. Prominentester Besucher am Stand des Stuttgarter Start-ups war Dr. Bruno Kahl, Präsident des Bundesnachrichtendienstes. Der aus Berlin zum Kongress angereiste Behördenchef zeigte sich sichtlich beeindruckt, als ihm asvin-Gründer Mirko Ross die Funktionsweise erläuterte.

CEO Mirko Ross erklärt Dr. Bruno Kahl - Präsident des BND - asvin.io

CEO Mirko Ross erklärt Dr. Bruno Kahl – Präsident des BND – asvin.io

asvin.io – Our Mission to Secure Update Distribution in the Internet of Things

asvin - secure update distribution and management for Internet of Things

“As’vin” (sankskrit) is the name of the divine twins, the healer of gods in Hindu mythology. The spirit of these twins is embedded into the core mission of asvin.io:

“Healing the Internet of Things from security flaws and vulnerabilities by providing an easy and blockchain secured update distribution service.”

Like twins, asvin.io provides a mirrored secure update solution between parties of Internet of Things applications: for the embedded device controller (edge devices) and for server side device applications in the cloud. Today unpatched vulnerabilities on IoT devices are door opener for diseases as DDoS attacks, Ransomware, Hacking and Data theft. Updating unsecure IoT systems is analogy applying medicine to sick patients. There is a growing need for continuously healing infected or unsecure devices in the Internet of Things.

Secure Update distribution in the internet of Things- asvin.io

The assvin twins, healer of gods: Our Mission Patch Secure Update distribution in the internet of Things.

That’s why we call our solution asvin.io.

The Internet of Things has become a reality, with tens of billions of devices expected to be connected to the Internet by 2020. At the same time the number of cyber threats is continuously growing. The scale of the problem makes the need to act even more urgent. Recent cybersecurity reports figures show that digital threats are evolving fast. Unsecure unpatched products and less responsibility in the supply chained has been identified by cybersecurity authorities as one main sources of the problem.

asvin.io provides a mirrored secure update solution between applications parties of Internet of Things: for the embedded device controller (edge devices) and for server-side device applications in the cloud. Today unpatched vulnerabilities on IoT devices are door opener for diseases as DDoS attacks, Ransomware, Hacking and Data theft. Updating unsecure IoT systems is analogy applying medicine to sick patients. There is a growing need for continuously healing infected or unsecure devices in the Internet of Things

asvin is targeting the market below large enterprise customers. In this segment, the knowledge of providing stable and secure updates is for customers less available with in-house teams and the cost pressure for providing stable service over product life-cycle is extremely high – especially for consumer goods and small to mid-size industrial IoT (IIoT) companies.

The core functionality is delivered as open source. As components of asvin are implemented on customer products we chose that, to lower the barriers of using. This open source license types grants unleash usage during costumer product lifetime. As the libraries are free to use, asvin creates revenues based upon two open source business revenue models:

1. SaaS – Software as a Service
2. Service and Support

Let’s have a look at our asvin.io website and twitter @asvin_iot to get news

Forcing Blockchain to be compliant with GDPR is no solution

GDPR and Blockchain

The General Data Protection Regulation (GDPR) is now enforced. This has major impacts towards Blockchain and Distributed Ledger technology. In general: these technologies are not compliant to some certain demands of the GDPR.

The World Economic Forum titles in a statement “Will GDPR block Blockchain?”. And unfortunately, I have to agree yes, it might will.

Let me state in some words, why we need to force adjustments on GDPR regulations towards to blockchain and distributed ledger technologies. And why it’s absurd attempting backwards fixing to force GDPR compliance on that technologies.

The core of Blockchain: Trust and Resilience

Blockchain technology and Distributed Ledgers (DLT) power is based in resilience and trust. Both is created by the distribution principle, where nodes are storing transaction in their ledger and consents between ledgers is needed to determine if the transaction is valid. As nodes location can (and should) be scattered, it’s hard to answer the question on which geolocation data is stored and proceeded in the Blockchain network and by that which jurisdiction is to be effective.

For large public chains in case of doubt: everything and everywhere.

Additional the main principle of building trust inside the Blockchain makes it impossible to delete written transaction. Also updating existing transactions can’t be done, since they are immutable. Therefore, the demand of GDPR on the right to delete data is not directly representable in these cryptographic principles.

The demand to erase data in GDPR is allegeable from a “pre Blockchain” area, where state of technology was the storage of data in relational or object based databases – or more advanced in cloud storages. Deleting data in such architectures is a feasible demand. But blockchain principle of data treatment was not on the radar, when European legislation was formulating the GDPR. Blockchain is a “young” but highly accelerating technology, started in 2008 below the “radar” of legislation stakeholder groups debates. And it’s a perfect example that technology can leapfrogs ahead regulation and leaves legislators behind.

Why “HASHING” is not the answer for GDPR compliance

The situation is absurd. We have a powerful technology, but by basic architecture principle it’s not compliant to the demands of the GDPR. The industries answer is “hotfixes” on Ledgers, where personal data is involved. One popular recommendation is not storing personal data but “hashed” relations in the chain. This means that no personal data is stored in the Ledger and by that the system is compliant to GDPR – as there is no more need to erase personal data.

But on the other hand, you need to link the Blockchain proceeded hash to data sets outside the ledger. This must be done by tying the hashes to datasets on relational or object-oriented databases. Of course, we can do – but basically this workaround weaken the trust and resilience level of the system. Compromising the data in the linked databases is compromising the Blockchain trust level. When the data relation has been changed the testify by “hashed” Blockchain records is useless. You need no Blockchain procedures for testifying the trust and integrity of data and transactions in such architectures with relational dependencies. You can remove the Blockchain part of such system but you keep the same level of trust and resilience. Blockchain in terms of trust and resilience makes no sense on such GDPR compliance workaround architecture.

We can adjust Blockchain by GDPR workarounds but will lose the fundamental advantages of this technology. Or we can adjust the GDPR.

It’s our challenge force the right actions.

1 2 3 56