Announcements

We are back! We are now testing a new layout for our newsletter. We are expanding our short updates session and disconnecting our research publications from our weekly pace. That means our newsletter will be more focused on short comments about recent news and on referencing any research publications or announcements we release during the week. We hope you enjoy it!

Weekly updates

End-to-end encryption and law enforcement

The Virtual Global Taskforce has published a statement on Meta’s plans to add end-to-end encryption (E2EE) to Facebook's Messenger and Instagram DMs. They cite concerns about the proliferation of CSAM (you can read more about CSAM on the FBI website) in case Meta implements E2EE. Their concern about the prevention/prosecution of a horrible crime such as CSAM is definitely warranted, but E2EE is a necessary technology to protect the whole society, including children. And there are alternative measures that even communication companies that apply E2EE encryption can adopt to facilitate law enforcement action in the protection of vulnerable groups.

In 2020 the Cyber Peace Foundation (CPF) published a report on the state of CSAM in E2EE applications, such as WhatsApp. Their methodology was particularly interesting because they used the same channels people looking for CSAM material use: they found public WhatsApp group links, joined those groups, and then reported the group and content. There is nothing that prevents law enforcement agencies from doing the same, with possibly much more success than a small group of researchers.

Another important observation of the CPF report was that WhatsApp needs to improve its criminal material reporting (section 6.1.1), to make the response and law enforcement process more effective, which we completely agree with. Ease of reporting of criminal material is fundamental to fighting CSAM.

CSAM fighting and encryption are not opposites. They both enhance the security of children and should be seen as such. It is important that we keep on ensuring that citizens’ freedom of expression and privacy is not destroyed by good intentions with terrible consequences. The protections E2EE adds for society in preventing abuses from governments and criminals are also there to protect children.

Brazil is leading open finance in LATAM… but where to?

In two weeks, the open finance regulation in Brazil will celebrate its third anniversary, but progress has been slow. We would like to take this opportunity to share some recent data about open finance in Brazil and shed some light on what needs to be improved within the ecosystem.

During Q4/22, the ecosystem received 4.9 billion API requests and 18.7 million consents to share data. However, each institution requires separate consent to share banking data with a recipient institution. For example, if a client consents to Itaú sharing their account data with Bradesco and Nubank, there are two consents. If a Nubank client has accounts in four other banks, aggregating all that data in Nubank's app would require four consents. Sharing data with all five institutions would mean 20 consents at a time. In a country with one billion accounts and an ecosystem with 24 reporting participants, 18.7 million consents don't seem impressive at all.
The success rate for APIs is at a staggering 84.5%, meaning a participant may have up to two months of downtime in a year. In contrast, with Pix, the minimum availability for a participant is between 95% and 99.5%, depending on the size of the company. The bigger the company, the more reliable it has to be.
The highest conversion rate this year was only 39.7%, which suggests that more than 60% of all requests were abandoned mid-flow. This raises questions about whether this is due to standard issues, lack of value proposition, or technical difficulties.
Since BCB began reporting transaction data 16 months ago, PISPs in Brazil have made 868,149 transactions, with a total value of R$ 204 million. These numbers pale in comparison to Pix, which hit the same transaction value and volume within just 10 days of its launch. The numbers are not much better in the UK, where PISPs have been operating for a longer time. The number of PISP payments there increased from 25.2 million in 2021 to 68.2 million in 2022, which is equivalent to just 20 hours of Pix operation.

We are working on a paper that highlights some key learnings and what we can expect from the future of open finance in light of this data. We hope to share these results with all of you in time for the 3-year anniversary of open finance in Brazil, on May 4th.

More banking regulation and less competition on the horizon

About a month ago, we wrote:

"From a competition perspective, however, Basel III's heightened regulatory standards and the regulators' general effort to protect depositors' interests have led to higher banking concentration worldwide. (...) Our biggest concern in this turmoil is the profound impact that a new wave of even stronger regulation could have on financial inclusion and other macroeconomic variables".

Little did we know that on the exact same day we wrote these words of caution, the Basel Committee issued a press release revealing that a review of its prudential regulation recommendations could be underway. In the last two weeks, we've been hearing more voices defending a tougher regulatory burden to smaller banks. From the Financial Times:

"Global regulators are considering imposing tougher rules on smaller lenders and requiring all banks to ready themselves for faster runs on deposits as officials search for lessons from the recent turmoil that led to the failure of several midsized US institutions".

We take this movement with great concern for two reasons. First, although the Basel Committee issues comprehensive sets of rules for prudential regulation, each country applies them as they see fit. So the fact the US regulation failed to avoid the SVB collapse does not necessarily mean a worldwide review of prudential regulation is due. Second, the heightened standard for smaller banks may have big a impact on the level of banking competition in any given country. Smaller banks could have a harder time competing with bigger banks. That also means big banks could stand to win from the "stability first" narrative that is gaining momentum.

A lesson about free speech regulation, courtesy of Fox News

Dominion Voting Systems sued Fox News for spreading lies about the 2020 US presidential election (that “stolen election” insane narrative).

In late February, under oath, Rupert Murdoch conceded that Fox reporters endorsed lies about the presidential election. Fox tried to frame what they were reporting as protected discourse under US free speech regulation, but one important restriction of US free speech (and mostly everywhere else) is that intentional lies are not protected.

Proving that someone is intentionally lying is a big burden, though. It is intentionally designed this way to prevent people that are speaking the truth or simply being mistaken from being the target of defamation lawsuits.

Fox settled the lawsuit for USD 787 million before going to trial, accepting that, in some cases, it had intentionally lied about the 2020 US presidential election. This is a really interesting result, as a news company that abused its position to spread lies had to face consequences for its actions.

This result shows that free speech does not mean saying anything without consequences, it means that no one should be punished for saying the truth. One important part of the US freedom of speech discipline is that you should never punish the content, but a specific crime committed through that speech. In this case, the crime was defamation.

From the research hub

We are currently working on two more foundational publications in anticipation of CTPI's official membership launch.

One of them is a whitepaper about Brazil's Pix and how other countries can reproduce its successful design. The other is a more philosophical piece about why we believe we need a new approach to technology in general and especially to information technology.

More on encryption, banking competition, and free speech; plus recent data on open finance