Lessons from the Field: Threat Modeling for the Everyday Use of Digital Currency

Good morning, Bogota. Awesome. But, that's a little too much, okay? Don't Don't get too excited. I wasn't kidding about the oxygen.

There is a sensor there that's literally measuring the CO2 in this room. If you get too excited, we might suffocate. I'm Andrew Fissiri. Uh I work at GiveDirectly. I'm on the innovation team.

Uh and this is the presentation lessons from the field threat modeling for the everyday use of digital currency. Uh before we talk about the uh presentation though, I want to take a step back and ask, why are we here at Devcon? This was the topic that was first brought up yesterday at the kickoff on this stage. Why South America? Why Bogota?

Because Ethereum is for everyone. It's not just for financial capitals, it's not just for the most comfortable developed places. It's for people who are uh still in places where they might not have financial inclusion. There might be more corruption. Uh there might be more censorship.

And those are the people who really have the most to gain from uh using Ethereum. GiveDirectly sends cash directly to people in poverty poverty, the kind of people who are in those settings. We've reached over a million recipients. We've raised nearly a billion dollars. We work in more than a dozen countries.

And we've had some of the greatest partnerships that that you can in the development and aid space. Uh and that has really uh been made possible by our approach. Giving people cash is really simple, right? If you want to financially include someone, financially include them. I think this really brings me back to yesterday's talk about subtraction.

About keeping things working very hard to keep things simple and effective. It's really easy in charity to uh say, "We're going to get the best experts. We're going to decide exactly what people need." Uh and I think it's a little bit more respectful and in fact, it's been proven to be more effective to give them cash because they know what they actually need. So, let's talk a little bit about our approach.

And at GiveDirectly, our approach always starts with recipients first. So, what does a recipient look like? This is Liz Awuor. She's from Kibera, Kenya. And that's her house on the left.

So, this house, you can see, it's very modest. It's made out of a whole bunch of different materials, whatever she had on hand. It probably doesn't have a door that locks. It probably doesn't have windows that close. But, Liz does have some access to technology.

Specifically, she might have what's called a feature phone. Uh if you're old enough, you might have had one. Maybe you skipped that, you went right to smartphones. But, this is a very simple phone. You can make calls.

You can send SMS. And you can use USSD. Now, that third one might be less familiar. This is when you can go through a series of menus where the app is being served on the other end by your telco. So, you could go through those menus and you could see how much airtime you have left, top up.

Basic things. So, in her setting, she might not have reliable access to electricity. It truly does make sense for her to have a phone like a feature phone that can last for many days without being recharged. And we want to meet people where they are when we're trying to help them. And so, when we look at our process, we have four steps and each one of them is designed to uh meet the recipient in their environment.

Target, enroll, transfer, monitor. So, what is target? Targeting is of course to figure out who is in extreme poverty, who could benefit from this. Or in some cases, if we're doing humanitarian work, who's been affected by the most recent flood or uh what area needs uh some help to achieve uh equal rates of gender participation in education. So, there all sorts of criteria we could use to try to figure out where to send money.

And that's the targeting step. The next step is enrollment. So, this is uh very relevant for the talk that uh we've just heard. We need to verify people's identities. We need to make sure that they're real people, that we're not just sending money to uh some account somewhere which uh was set up for the purposes of fraud.

And we need to be in person. There's no such thing as a free lunch. I think everybody is skeptical. If somebody came to you and said, "I'm going to give you what is more than a year's worth of your salary tomorrow for free." You wouldn't believe them.

It has to be a scam. There has to be a catch. And so, it's really important actually that we go there and we can talk with people, we can build rapport with them, and they can hear about other villages nearby, other people who've already gone through this process, and they can know that this is truly unconditional cash. It will be theirs. They can do whatever they want with it.

The next step is transfer. Presently, these transfers use centralized digital currency systems. These are mobile money systems that are operated by telcos. These are very popular in Africa. In Kenya, over 90% of households use M-Pesa, which is Safaricom's uh mobile money.

These sorts of systems truly are the best systems that we have at the present day. It would not be sensible to give somebody literal cash, although it would be more private and more decentralized. Their house doesn't have locks. You know, that would expose them to a lot of risk and danger. And finally, we have monitor.

So, we follow up, we make sure everybody was able to receive their cash, that they were not threatened, they weren't bribed, nothing bad happened to them because of it, uh and that they continue to understand how to use their phone, how to use it safely, securely, to protect their PIN code, etc. So, let's talk a little bit in more detail about fraud prevention, and then we can talk about how we might reimagine the system with Web3. So, GiveDirectly lost $241,000 in 2021. And that's about what we would expect. Now, that's a lot of money, but at the same time, because GiveDirectly operates at such a large scale, that's only 0.

2% of the funds. And you can see on this chart here that 2021 and 2020 were relatively similar. And you can see that we have a breakdown of the types of of fraud that we discovered. The first is theft. Makes sense.

Somebody coerced uh a person to give them their money or perhaps uh tricked them. Uh lied to them, tricked them into revealing their PIN code. Uh the next is impostors. This would be people who should not be eligible for a program. Uh perhaps they um are assuming a false identity or they've pretended to move into where they don't actually live.

And the final are bribes. Uh people who have uh asked for payment for some sort of favor uh which is not appropriate, which is an abuse of their power. So, the rest of the presentation, I'll talk more about theft and bribes. While impostors are important, I think theft and bribes affect individual people directly, and that's of course uh makes them even more important. So, some of our uh measures that we take.

We have our standard approach, uh which we've already talked about. We're going to give them training when we first meet with them. There's a hotline where they can call us. We do follow-ups to make sure everything went well. Additionally, there's a recipient advocacy team.

So, this is an entire team that's firewalled from the day-to-day work, the people who are doing targeting, operations, etc. Those people don't even know who the recipient advocacy team are. And that allows us to do audits. We audit that nobody on our team asked somebody for a favor in order to be included with a program. And finally, we'll do risk assessments.

So, sometimes in a certain setting, it's actually quite uh sensitive. And so, we'll we'll take additional actions. We'll randomize when we send people to the field. If we know that our our uh field officers are being tailed by scammers or people who are trying to take advantage, we'll make it as hard as possible for them to figure out who was in our program. Additionally, we'll conceal who's uh being enrolled, and we'll stagger payments.

If we pay everybody at once, they all go to the market at once. It's very obvious that XYZ village was the village that most recently received their payments from GiveDirectly. So, that was an interesting system, but I think we can make it a lot better. And to that end, let's talk about uh what GiveDirectly currently does. Splitting that into two categories, funds in.

We've received crypto donations since 2014. We've been uh very happy to receive more than $50 million in direct crypto donations. And I think that speaks to how well our visions are aligned. Uh GiveDirectly and Ethereum are both focused on financial inclusion. They both are focused on empowering and respecting individual people and their privacy.

Uh and for that reason, I'm very happy to be able to speak here today. Uh in terms of funds out, we're still working on uh piloting these programs. But, it's been surprisingly an interesting learning for me this year that I always assumed it would be really painful to use cryptocurrency. You know, it's so much easier if you have a smartphone. If you're in a setting where you don't have a lot of technical expertise, you only have a feature phone, I would have expected it to be quite quite difficult.

But, in our initial pilots, it's second nature. If you can make the product feel like what they've used before, feel like mobile money, then suddenly everything makes sense by analogy. And in fact, there were very few questions about how it worked and more questions about what are the fees, what are the exact details of of the financial uh incentives here. So, in the interest of time, I won't go through the centralized versus decentralized. I think people in this audience probably know that uh there's a lot of value to be got had by more decentralized system.

What are the privacy threats that we see? And uh specifically, what would be happening in a in a naive implementation with a public ledger? Contrast, presently, we're using centralized systems. So, they have some degree of privacy as long as nobody leaks the information. It's not published anywhere.

And we would imagine in in a public ledger, some of these types of adverse events might become more common. Maybe the first thing to say is that while in a naive implementation, people are anonymized, they just have a wallet address, that's probably not going to be enough. The first time you transact with somebody in an everyday setting, you've paid them for a good or service, um they've gone to a store that has a known wallet address. It's very easy to quickly de-anonymize uh everybody in your local community. So, thinking about that, uh theft becomes very easy.

If you're sitting outside of a store and you wait for somebody to walk in and you're refreshing the blockchain on that store's address, you could see the most recent transaction, you could see the balance of that person and you could say, "It's worth it for me to take the risk to mug this person because I know that they have enough money that I will uh potentially benefit." Bribery, similarly, people pay legitimate fees all the time. Once they've paid that feed, if you can look at their balance, you can know exactly how much you can extort them or they'll be able to pay. You'll see I'm not wearing any GiveDirectly clothing, in fact, there doesn't exist any. We're very serious about preventing phishing and just showing up in a village wearing GiveDirectly clothing is enough to let you social engineer much more than would be uh safe for our recipients.

And if you imagine what somebody could do with a public ledger, be calling somebody who had been in a GiveDirectly program, that person has already been sensitized to expect a call because GiveDirectly follows up, they would speak to that person and say, "Hey, I know that we've given you a transfer in exactly this amount at exactly this date. I see you bought a sandwich yesterday that was $1.50. Uh was that you? Great.

Let me secure your account. Please open up your app. I will need your phrase." And suddenly, they've lost all their money. Uh the next category is scams.

Of course, scammers are always trying to find the people who are the most vulnerable, who don't have people who can intervene and say, "Wait, this doesn't sound right." So, they're looking for people who are elderly, people who are illiterate, people who are going to be more likely to be scammed. Uh and we don't want to make that any easier for them. We don't want them to be able to cross-reference, "These are all the elderly people and these are their account balances in this village and therefore we'll target uh so-and-so." And finally, maybe the most uh hard to pin down is social pressure.

It's supposed to be unconditional cash, it's supposed to allow people to make decisions for themselves. And if that decision is, for example, to send your daughter to school, that might not be the norm in the place that you live. And it's very important for that person to be able to make that decision for themselves and for their family without people uh giving them undue scrutiny. So, of course, there are mitigations for this, that was all assuming a naive implementation. Uh you might have heard of Aztec that's uh layer two focused on privacy and they have many of these features, balance and transaction privacy.

It's enabled by default. Uh for example, if if uh I told somebody, "Hey, there's a way to be private, you're going to go use the smart contract called a tumbler. You're going to add to that tumbler in uh one amount and when you subtract, you'll subtract in a different amount and each time you subtract, you're going to make a new wallet address." Now, if you understood that, you are probably afflicted with a terrible disease. You're probably a developer and I'm sorry to say it's terminal.

Okay, maybe that joke wasn't that good. Okay. Um but for normal people, that's like way too much. Okay, they're not going to be able to do that. You need something that's more akin to Venmo, you can easily swap between private and public and you can be given a little warning that prompts you, "Hey, this is public, people will read it in the future, do you understand those implications?"

And finally, the fees need to be reasonable. Uh in a setting where you spend in your entire day less than $2.15 to feed and house and everything, even a fee that's 5 cents kind of precludes you from doing stuff on an everyday basis. You know, you you buy three meals, you've spent 15 cents, you're getting close to spending 10 or 20% of your daily budget just on fees. So, going to extremely extremely low fees can be important.

And given that privacy features generally require more gas, more uh transaction fees, you know, this is a challenge and luckily, there are a lot of solutions uh on the road map to help with those scaling issues. So, if we assume that we exist in this private L2 in a future state, maybe post-surge where the fees are low, uh we still need to think about how do we actualize this? How do we bring it into the real world and have people comfortable with it existing in their country? I think it's important to think about in this hybrid model where there are real world world activities, but there's also uh blockchain underlying the mechanisms that we can have censorship resistance as a feature, but we can't have it as a strategy. And what do I mean by that?

I often hear proposals of people who may not be thinking about the recipients or people in extreme poverty and they say something like, "Oh, okay, if if if people don't like this, we'll go the permissionless route. Just try to ban us. Just try to just try to stop us, you can't really, it's decentralized." So, that works if you're only making a financial product and you're okay uh with uh operating in a in a hidden manner. Uh but the moment that you think about a hybrid method where you actually need to go out and meet people and build rapport and you need to follow up with them, all those uh activities become impossible with that approach.

Now, what's what's a good example of censorship resistance? You might be in a refugee camp and your refugees are, of course, in a very precarious situation. They may be rehoused, moved somewhere else, depending on political changes, they might be supported in one regime and not the next. And so, it is really important in those cases that we have something which is really owned by the people themselves. So, if there change, if they move somewhere else, if they go to a place where a different Telco operates, all their funds and their livelihood isn't tied up in mobile money, it's something that they can continue to have access to.

So, if we assume that we have cryptography and we are going to try to work with governments and have uh this be a force for good government, uh we are going to need a couple more features. So, selective disclosure would allow us to continue to have the kinds of systems and institutions in place that democratic societies often create. So, I'm talking about having legal recourse, having regulations, even taxation. And I know that's not a really popular subject, but we just want to imagine for a moment uh if somebody was interacting with you in a truly fully private system and uh they claim they pay you and you claim they never paid you and you sue each other and you go to court and you're in discovery, ideally, you should be able to say to the person who said that they paid, "Prove that I paid." Uh and they should be able to do that without exposing their public key with or the private key, rather, without giving you access to their funds, they should just show you that one transaction.

Um so, that would be an example of how uh I think presently, we have some solutions where there's a viewing key, you can see everything that ever happened associated with that account. That's probably a little bit invasive of privacy. Uh and so, I look forward to uh better ZK proofs where we can answer the specific legal question that's at hand for only as much information as needs to be communicated to resolve the issue. So, takeaways from this talk, I hope you uh agree that Ethereum is for every person and if we think about every person, the people who have the most to gain are the people in extreme poverty or in places where their institutions are really not functioning very well today. We have to think about each person as existing in their own ecosystem, right?

They exist in a house that doesn't have locks, what does that mean for them? They exist in a place where their government is going to need to be a a partner if we're going to help educate them and bring them services in real life. And finally, uh I would like to thank everybody for their work and remind you that today's uh EIP is tomorrow's family tree. That's kind of a lame rhyme, uh but it's the case that some of these really uh I don't know, bland or at seemingly at first glance uh not very intriguing improvements actually fundamentally change how usable this technology is. Um so, if you read the text of EIP 4844, uh you might not get it at first.

If somebody explains it to you, it makes rollups less expensive. Thank you to Proto for providing me with this uh chart. How much less expensive? If you look at gas fees on Optimism, for example, the L1 data fees are like 97, 98% of the expense of each block. So, if you can imagine that we create this uh EIP, we're going to suddenly be in a case where instead of paying 5 cents for every transaction, you're paying a fraction of a cent and you can actually use it every day and it's a zero to one change, it's a step change that I'm very excited to see happen hopefully in in just a few months.

So, thank you again. I would encourage you to support uh all the relevant EIPs and of course, the surge. Uh reach out if you think we should work together. My Twitter is also just at my name. And if you're interested in donating to GiveDirectly, that QR code will direct you to all of our addresses.

Thank you. If you have questions, feel free to raise your hand and one of the volunteers will hand you a mic. Um so, we can go ahead and take some questions. There's a question right here in the front row. Thank you very much for this.

I I'm kind of impressed that you raised $50 million from philanthropists that are sort of handing over the decision-making of where the money goes. That's impressive. Do you have any kind of idea who um are the sorts of people that uh that that uh that do this? I think that a few of them are uh giving their donations under an anonymous circumstance. I mean, it's just a crypto uh wallet address, you anybody can send to it.

Um but I know that Vitalik has been one of our top donors and, you know, thank you to him. Usman, there's a question in the back and there's also a question over there. Hi, man. Uh great job what you're doing, man. I just heard about how about your project and what you're doing.

Uh what's the landscape in Latin America like? What are your what what do you think about Latin America? Here we have so many problems that you describe like crime, corruption, bribery. Worst governments, you know, like there's it's really bad and I see that you support a lot of African countries. So can you tell us about Latin America fits in your I don't know roadmap or or not or or when?

Yeah, absolutely. Great question. So we've done projects in many places throughout the world. Africa tends to be the primary source because many of our funders are looking for where is the place where the poverty is the most extreme, the most widespread and so their dollar will go the furthest. Now I don't think that that precludes us from being other places, but it's a question of finding the funding of people who are specifically interested in seeing change in Latin America.

And luckily there are a lot of things on the horizon. I know that there are some US government and other international organizations that have recently proposed some more aid. So hopefully Give Directly will be able to bring some of that to Latin America soon. Awesome. I believe there's a question over there too on the yeah, with the gentleman in the black shirt.

Hey GM, amazing presentation. Thank you for that. I'm Russ, founder of 40 Acres DAO and Chief Impact Officer and we we kind of echo a lot of the same sentiments that you talked about today. Really through trying to create self-sustaining communities of color utilizing blockchain technology. As we've seen like the biggest hurdle has been just this convoluted language and vernacular in which we use everyday that makes sense to us, but for other people just goes over their head.

Liquidity pools, yield farming, AMMs. So we've been trying to aggregate all that information through education, empowerment and engagement. And so the question I really I mean you guys been doing beautiful work raising $50 million. And so as far as allocation goes, do you guys focus on protocols? Is that something you've been thinking through helping aggregate it to certain communities versus just individuals themselves?

Thank you, great question. So right now we're at the prototyping stage. So our our funds presently are used to test delivering cryptocurrency directly to recipients. And I think that we obviously want to have that kind of killer app that says why did it make more sense to do this on a general purpose blockchain? And that goes back to I think at the beginning of of this event they spoke a little bit about overemphasis on financialization, right?

That there should be non-financial apps. And I think that that's an incredibly important point to show that this isn't just an alternative to mobile money, but this is actually something new and different. This is infrastructure. This is part of a functional society. So I don't have a particular protocol that I can say today.

We're kind of proving that first step, which is it's at least as good as mobile money. And once we have that information, hopefully the ecosystem will have a lot of great partners that we can start proving why it's beyond present day solutions. I know that we have just run out of time, but thank you again. I'll be off to the side after the talk and I'll be with you at dinner once you invite me there. Thank you so much Andrew for your talk.

I think it was so important to remember the human aspect behind blockchain.