Zero Knowledge Is The “Only Way To Achieve True Security”

The Crime Survey for England and Wales (CSEW) recently reported on a growing concern that official crime statistics have not accurately captured the true scale of fraud. Although crime is down, from 19 million events in 1995 to under 7 million in 2015, the figures change dramatically with the inclusion of cybercrime.

“It has been argued that crime has not actually fallen but changed, moving to newer forms of crime not captured by the survey measurement.”
— – Crime Survey for England and Wales

To better inform decision makers about the extent of the problem at hand, CSEW tackled the demand for more comprehensive statistics. The report focused on expanding information collection, and drawing on new sources.

“We are conducting work to extend the main victimisation module in the CSEW to cover fraud and elements of cyber-crime experienced by the population resident in households.”
— – Crime Survey for England and Wales

The result of this new focus is the addition of an estimate of 5.1m reported online fraud incidents, and 2.5m cybercrime offences. The Office for National Statistics (ONS) have now included these figures in their crime estimates for England and Wales, and as a result, figures have soared to more than 11.6m offences, although many of the reported cyber offences are less than £20. This is the first survey of its kind to be included in the ONS statistics, and further questions are being developed for a follow up in January 2016.

Cybercrime concerns were also raised in May this year, at eCrime 2015, the Anti-Phishing Working Group (APWG) four day event that bridges the gaps between cybersecurity operations, research and consumer messaging. The event dove into current research projects and future areas of interest for cybercrime investigation, forensic techniques and infrastructure defense.

Government agencies, banks, universities, private companies and consulting firms were all in attendance.

“eCrime 2015 Barcelona promises to be a powerful event drawing together the most potent minds in cybercrime management from Europe and the Americas. We plan on presenting the best papers in cybercrime research and help the best minds in the space muster new research initiatives.”
— – Anti-Phishing Working Group

At the event, during the CaixaForum, a panel of experts warned that research in the digital currency sector is falling behind criminal practice. Dave Jevans, APWG Chairman, stated that "[Digital currencies] have their own world of crime and fraud that we need to explore and understand in the coming years. They also are deeply integrated in the fraud that we deal with today: phishing, ransomware and money laundering.

Digital currency companies are taking matters into their own hands, implementing the concept of Zero Knowledge. The format gained traction in 2014 after whistleblower Edward Snowden stated that dropbox was “hostile” to privacy. Snowden used Spideroak, an alternative solution that claims,  “Most people don’t care about privacy. We do. Keep control of your life with our Zero Knowledge cloud-based backup solutions.”

Due to the endorsement, Spideroak immediately received an increase in demand. The company signed up over 1 Million users during the remainder of 2014. Since then, more companies have adopted Zero Knowledge as the future of online security.

Airbitz is a Zero Knowledge, blockchain inspired, open source global information security solution. Their Zero Knowledge Edge Security platform was announced only a few weeks ago.

“After decades of striving to secure personal info, money, financial info, and sensitive documents on centralized servers, we’ve discovered that it simply can’t be done. There is too great an incentive to break into the treasure troves of digital data on globally accessible internet servers.”
— – Airbitz

Zero Knowledge means Airbitz knows nothing about the encrypted data that it’s client software interfaces with, so there is nothing to steal. This design means nothing leaves the client device until it is encrypted and nothing can ever be decrypted until it is unlocked with the user’s password on their device. “It’s not just ‘end to end encryption’,” states the company, “It is Zero Knowledge which is the only way to achieve true security.”

Zerocash is another company embracing the practice. The protocol is designed to provide a privacy-preserving version of Bitcoin, and protect the identity and information of users through anonymity.

The company provides a mixing service, which exchanges bitcoin for anonymous receipts, which also act as transferable coins. The coins/receipts can be thought of like blank envelopes full of cash. However, they are able to be divided or merged, and paid to other people.

Matthew Green, co-author of Zerocash: Decentralized Anonymous Payments from Bitcoin, adds that “the only information that makes it into the [public ledger] is the fact that a transaction occurred. Should you want to make a traceable purchase, you can always redeem the receipt and spend the equivalent amount in the base currency.”

Green believes the protocol will be able to “do everything you ever wanted to do in a completely anonymous fashion.”

Zero Knowledge is not restricted to the digital currency industry. Sync.com was launched as a proof of concept in July 2013, and only recently announced accepting bitcoin as payment.

“Sync.com, the 100% private cloud storage and file sharing platform with over 100,000 users, announced today they now accept Bitcoin as a payment method, via BitPay. With Bitcoin, our customers can enjoy absolute privacy in the cloud for both their data and payments."
— – Sync

Sync’s growth in the last two years demonstrates the significant awareness and demand for data protection in the cloud. "Protecting customer data is our number one priority here at Sync. As it should be for any business storing sensitive customer information," stated Sync CEO, Thomas Savundra.

Anonymity is by no means universally accepted, and is incompatible with many laws. Regulatory bodies and financial industries connect anonymity with aiding illicit activities and criminal activities, Know Your Customer and Anti Money Laundering legislation requires the exact opposite. Zerocash provides an alternative perspective, “criminal users can already anonymize their activities via existing financial systems (e.g., by using cash) or Bitcoin (e.g., by using mixers).”