Problems with anonymous escrow 1--response

[tcmay@netcom.com (Timothy C. May)]

I welcome Hal's comments. Between this meaty discussion of crypto anarchic
issues, along with the equally meaty comments by Eric and others about
financial instruments, maybe we've temporarily exorcised the run of
"cyphernukes" trivia postings. (Not that nukes are trivial...I understand
that even one of them can ruin your whole day.)

Hal split his post up into three parts (that I've seen so far), but my
response would probably not be split the same way, ideally. But I'll go
ahead and answer each of his posts in order, or at least get started.

First, let me clarify some points very briefly, points that would
ordinarily come up in the response to the second and third parts.

* I've never thought that anonymous escrow agents would be large
corporations, or even companies of several or more people. In fact, many
trading and investment services are handled today by a single person. Many
underworld financial services--e.g., offshore banks--are handled by a
single person. New computer technology makes this more feasible than ever.
Additional staff, especially at the spear carrier level (office workers,
clerical staff, etc.), are security leaks, as Hal notes.

* Family-based businesses are also common, where blood ties establish a
web-of-trust. Very common in Asia, the Middle East, and in other areas
where mistrust is a dominant concern. (The Mafia is known as the Family, of
course.) In many of these cultures, defections (in the game-theoretic
sense) are strongly disincentivized, by the blood ties and the
repercussions (ostracism at best, death in many cases).

* I agree strongly with Hal--and have argued this in several posts over the
past couple of years--that the "ecology of interacting anonymous agents"
merits much more study. We cite the fictional scenario of "True Names," and
we have limited exposure to such ecologies from the criminal underworld
(Triads, Mafia, Russians, Jamaicans, etc.), but few economic studies have
been done of such systems.

(My explicit focus in many of my posts on outlaw communities and outlaw
actions is not because I admire violent criminals, but because these
communities are obviously unable to use the legal systems of the modern
world and thus have developed and evolved their own legal codes of
sorts--sometimes with greater refinement than the so-called legal world.
David Friedman once agreed with me that much more study of underground
markets, criminal enterprises, and black markets in general is needed.)

On to Hal's comments. I'll only respond now to #1, then to #2, #3, etc.
later today.

>There has been some discussion here about how anonymity/pseudonymity
>can be applied to a wider range of relationships.  One possibility
>that Tim May and others have mentioned is to have escrow agents be
>anonymous.  (I will use "anonymous" and "pseudonymous" more or less
>interchangeably because the former term is more familiar.  But I am
>really referring to a case where the agents maintain a certain amount
>of continuity via secret keys and such.)
>
>(Let me make it clear that I am not arguing that there SHOULD NOT be
>anonymous escrow agents.  I am questioning whether they are likely to
>be viable entities due to the problems I am listing here.)

I'm not arguing, by the way, that such anonymous escrow agents (AEAs, for
brevity) will dominate conventional escrow agents, such as banks,
securities firms, etc. (all of which have certain escrow functions). But I
do expect that as more transactions leave the conventional "legal
world"--not because they are ipso facto illegal or criminal, but because
they are between parties who don't each others identities or nationalities
and hence are unlikely to agree that Afghani law, for example,
applies--that cyberspatial escrow/PPL agents will be more common. And if
they exist, outside the conventional legal structure for the reasons just
given, what reason is for them to be _non_-anonymous, that is, for them to
voluntarily reveal their phsysical identities, locations, etc.?

Hal mentions someplace that non-anonymity allows customers to check the
bona fides. Several points:

* Bona fides are easily faked. Cf. my posts on the 60,000 people in the
Witness Security Program (aka Witness Protection), most with
full-backstopped legends. The various governments of the world are expert
at creating such legends, including banks that meet their needs, transport
companies, and (probably) escrow services. So non-anonymity is not
necessarily what it's cracked up to be.

* Non-anonymity will likely expose the escrow agent to various pressures
and sanctions, including: lawsuits, subpoenas, threats by the parties
involved in an escrow, taxation, etc. Lots of complications. I can readily
imagine these pressures totally swamping the advantages of escrow. I
certainly know that any "non-anonymous" escrow agent will immediately be
beset by various pressures, legal, financial, and physical. I can't imagine
one operating for long in the U.S., for example.

* Non-anonymous escrow services in most jurisdictions (Hint: the operative
word is "jurisdiction") will of course not be able to handle transactions
that are illegal, e.g., information sales, drug money holding, etc. And
they likely face "know your customer" laws in many jurisdictions. [I
consider the idea of a non-anonymous escrow agent a non-starter, offering
essentially nothing of interest to identity-blinded users and instead
introducing unacceptable risks, pressures, and red tape.]

* If the customers, Alice and Bob, are anonymous (actually, pseudonymous,
of course), and are not associated with any jurisdiction, why should they
be interested in using a non-anonymous escrow agent, one who may be find in
favor of one party or another based on local law, based on pressures
applied by one party, etc.? Anonymous parties should be more comfortable
with AEAs, all other things being equal.


>The obvious problem I see with anonymous escrow agents is that it is
>much harder for them to become and stay trustworthy.  With an
>identified (non-anonymous) agency, you can have a lot of information
>on which to base your judgement.  You can look at its assets, at its
>employees and hiring procedures, at its record.  You look at the
>jurisdiction in which it operates and judge what protection the legal
>system may offer.  You can look at other agencies in that jurisdiction
>and what their track record has been.

Eric Hughes' "encrypted open books" protocol may be useful in verifying
assets. Pinging works, as do "reputation-rating services" which rate escrow
agents.

I look to the success of underworld escrow agents (a standard role for
criminal syndicates is to enforce certain transactions "fairly"). Granted,
they are not anonymous. But reputations do indeed build up, even with
pseudonyms (one might say _especially_ with nyms). Lots of issues.

>
>I would guess that most of that information would not be available
>from an anonymous escrow agent, at least not in a validated form.
>Perhaps some of it could be done with credentials (a blinded statement
>from a reputable accounting firm that (this?) escrow agency has assets
>of $X).  But generally thinking I think it will be very difficult to
>get nearly as much high-quality information about an anonymous escrow
>agent.

By the way, Hal several times talks about the "assets" of the escrow agent.
In general, a bonding is not needed, as the held items are *of no value* to
the escrow agent, in many cases I can see. There are two cases to consider:

1. Items held by AEA are unusable to the AEA, e.g., encrypted secrets and
money. (There's the issue that the AEA doesn't know if it's holding
worthless bits or valid digicash, for example. Again, ways of approaching
this, and the protocols will likely evolve with time.)

2. Items, or one half of them at least, are usable by the AEA. For example,
the equivalent of $100,000 is transferred to the AEA.

It's mostly this second situation I'm dealing with, as Hal is. But I
mention the first to give a hint about using protocols which blind the
transactions even from the AEA. How it all shakes out is, not surprisingly,
unclear.

Also, webs of AEAs, somewhat like "reinsurance" amongst insurers, can have
positive effects. A complicated point to discuss here, but related to the
difficulty of maintaining frauds consistenly in the presence of multiple
agents, all unknown to each other.

>
>This leaves the possibility of using its public record to judge
>trustworthiness.  It may be able to offer certified statements (again,
>credentials of a sort) from earlier customers to show that it behaved
>honestly.  Tim has suggested "pinging" such businesses, performing
>various dummy transactions to make sure that they are still behaving
>honestly.  All this can help establish a record, but how well can this
>be extrapolated into the future?

Bear in mind that an anonymous escrow agent (AEA) is effectively no
different from a _digital bank_! I thought this point was pretty clear, as
I was discussing AEAs in the context of being a slightly different kind of
bank, but maybe it wasn't.

Consider one's bank today, even a small, poorly-capitalized one. It can
always 'defect' and claim that one's money was already withdrawn, (Yes,
there are complicated crypto protocols designed to prevent this, or lessen
the chances. The crypto community is generally interested in mathematical
rigor, not surprisingly, but reputations are crucial as well. Time-binding,
evolutionary game theory, etc.)


>One of the problems with anonymity which has no underlying identity
>certification is that you are pretty much forced to adopt the stance
>that "the key is the identity."  Your only channel of communication
>with the agent is via its key, and any message signed with that key
>has to be assumed to be coming from the agent.  There is nothing else.

Yes, the purist stance. What else could there be and still act as we wish
it to? This is not to say that customers could not voluntarily arrange all
sorts of additional checks and balances, such as:

- biometric security (retinal, thumbprint, earlobe shape, voice, handwriting)

- protocol limits ($1000 a day withdrawal, required "co-signers," etc.)

(co-signers, time delays, guardians, all are possible, and may even be a
good idea...I, for one, would take steps to make sure that my total assets
are not accessible via a single number. Nothing unusual about this, just a
small matter of programming.)


>The problem with this is that keys are not people.  People, and
>businesses, have a certain continuity, a certain predictability.  Keys

Well, Hal, this argument applies to all pseudonymous exchanges, not just
the AEA idea. (A meta-point I've made in several ways is that parties to
these transactions will be "first-class" objects, that is, there is no
compelling reason to have a distinction between "customers," "merchants,"
"bankers," and "escrow agents." Such niche distinctions may evolve, as
agents fill various roles more than others, but the software structures
need not skew the transactions in any preferential way. I can imagine many
transactions in which agents fill several roles. Indeed, we all do this
with cash all the time: we act as buyers, sellers, holders of money in
trust, cashers of checks, etc.)


>do not.  A key may change its personality, literally overnight, and
>you will not have any warning about this.  In an identified business,
>if it changes hands, acquires new management, or has some other change
>which might lead to new behavior, you generally have some warning
>(especially if it is a business which is selling trustworthiness, in
                      ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

A nice turn of phrase, and a key one. AEAs are nothing if not sellers of
trustworthiness. You all know the drill here.

>which case it will probably provide customers with an unusual degree
>of access to the business's internals.)  But with an anonymous
>business this is not the case.  An escrow agent who has been as steady
>as the sunrise for years may, without any warning, become totally
>dishonest.  Hidden behind the shield of anonymity there is no way for
>its customers to discover the change.

Webs of anonymous escrow, the "laying-off" of escrowed amounts to a set of
other AEAs (picked by customers, mutually, like a jury perhaps) could
further lessen risks. (My hunch: Sets of AES, picked this way by the
parties, could increase confidence exponentially. My hunch is that the math
of DC-nets and remailer networks is isomorphic. I'll think about this some
more.)


>What are the motivations for an anonymous escrow agency to stay in
>business, to not take the money and run?  Legal sanctions would
>presumably be ineffective.  One proposal is that as long as the
>expected future stream of income is worth more than the current value
>of all contracts being held by the agent, it is worthwhile for it to
>be honest.

This is a powerful incentive, history has shown. (On a tangent, one reason
'dishonesty' is now rampant, with people wiggling out of contracts and
finding ways to reneg on deals is that we've largely replaced local
sanctions--including things like tarring-and-feathering cheats--with
"governmental actions," which can take many years to reach justice, if
then.)

>
>There are a couple of problems with applying this.  First, it is
>necessary to know about how many contracts the agent is holding at one
>time.  But this will be complicated by the possible desire on the part
>of many customers to keep their activities secret (even beyond their
>presumed shield of anonymity).  So there must always be the worry that
>more contracts are in progress than you suspect.  This is especially
>true when you consider the possibility that other agencies may
>secretly be owned by this one.

Hence the use of multiple AEAs, picked by the customers "randomly" (or
based on private reasons) and mutually (protocol: each submits list of
acceptable AEAs, intersection is picked, or variants of this idea). Makes
collusion more difficult. (Anonymity helps becasue pressures cannot
directly be applied. Back channels exist, though, perhaps. Playing
"Anonymous Monopoly" might be a useful thought experiment.)

...
>But combine this with the ease with which a key can change its
>personality without warning and it suggests that even a long track
>record of stability could be fragile.  The business is passed from
>father to son, it is acquired, it is coerced away, the owner
>experiences a change of circumstances due to illness or other
>catastrophe, and suddenly the agency has changed.  Now, future income
>doesn't look so attractive compared to present money.  Now, the owners
>have an incentive to close the business and (I firmly think the word
>applies) cheat their customers.

Yes, this is a risk. But also a risk in non-anonymous transactions. (The
people boarding the jets to Brazil.)

Well, this ends on a minor comment rather than a major essay point, but
perhaps this is best.

Meanwhile, the best sunshine part of the day has passed without me getting
down to the beach, so I'll close now and try to get out and catch some
remaining rays.

The remaining posts from Hal I'll respond to tonight.


(ObNukeThread: Micronukes with yields of a kiloton or less are possible
with as little as 10 grams of Pu. The key is the computer-intensive design
and precise implosion sequenve. But such secrets will be amongst the first
high-value secrets sold in digital black markets. I'm not worried: so we'll
lose a couple of cities someday. Big deal. Six billion people and
more...they'll make more.)

--Tim May

..........................................................................
Timothy C. May         | Crypto Anarchy: encryption, digital money,
tcmay@netcom.com       | anonymous networks, digital pseudonyms, zero
408-688-5409           | knowledge, reputations, information markets,
W.A.S.T.E.: Aptos, CA  | black markets, collapse of governments.
Higher Power: 2^859433 | Public Key: PGP and MailSafe available.
"National borders are just speed bumps on the information superhighway."