ZK and Privacy Apps - the Legal Path Forward

Transcript

[Music] this water bottle down here because we all need to be hydrating as much as possible right now. Thanks so much for having me. I'm Katherine Kirkpatrick Boss and I'm general counsel of Starkquar. And the reason that I'm equipped to speak with all of you today is my background is really at the intersection of law, strategy, compliance, and crypto. I spent years as a partner at a big evil global law firm representing first TradFi and then crypto in US government investigations. So I would represent an entity that was being investigated by

the Department of Justice, etc. And also representing TRDFI in acquisition due diligence into crypto. I moved in-house as general counsel of Maple, then chief legal officer of SIBO digital, which is a centralized exchange for spot and futures derivatives, and now I am general counsel of Starkware. Starkware is a software developer and data compression services provider that is currently focused on scaling blockchain technologies, building layer 2 solutions over Ethereum and Bitcoin.

And Sarper is absolutely chalk full of zero knowledge proof OGs. Our current CEO Ellie co-invented Zcash and ZK Starks and one of our co-founders also co-invented ZK Snarks. So, I was really drawn to Starkware because basically I'm the stupidest person at Starkware, which is really invigorating. And I'm really intrigued and excited by the prospect of ZK for a multitude of use cases that go well beyond financial crypto. One of those being privacy.

So, in a minute, we're going to talk about ZK and what it can do in this context. For now, I want to ask why do we even care about privacy? There's kind of a depressing sentiment that your average user is willing to make sacrifices for privacy in the pursuit of a more seamless UX. And that might be true to a some degree, but from my perspective being American, privacy was actually originally enshrined in the Constitution as a fundamental expression of morals and values. So a lot of people in a lot of our systems today have lost the thread. It's not about, you know, keeping your financial information private. It's about expressing your values in a way that doesn't, you know,

compromise your ability to express those values freely. I have now seen how privacy is both treated as a risk and as a necessity and how those fundamentally conflict. And I'm talking about a risk meaning a risk from the regulatory perspective where they conflate privacy with wrongdoers, but also a huge risk or sacrificing privacy as a risk as breach hack risk significantly increases when it compromises personally identifiable information. Uh the rise of deep fake technology uh which often trades on and uses PII again. Um, also separate and apart from that, there's the fundamental

question of whether in the trading context, Tradfi will ever fully scale onchain without some degree of privacy. Uh, frankly, it's a sacrifice that they have to make with competitive strategy if their competitors can see all of their onchain flows. Finally, I'll mention that privacy can be a massive mechanism to further compliance. Uh this has been a source of conversation lately because it's been shoved front and center that onchain trading can really facilitate frontr running or market manipulation. And it's good that that conversation has started but it also means that regulators are going to have a magnifying glass over market

manipulation on chain because of the nature of how all this works. I would say that the key of this talk today is about navigating innovation and regulation. This is why good crypto companies seek out good general counsels. It's more about regulatory strategy. I like to be as pragmatic as possible in assessing risk. Legal in crypto, we're not here to eliminate risk. We're here to educate our teams about risk to ensure that they can make the best strategic decision. And yes, in many ways we are a cost center, but we can also help our companies save enormous costs in not spending time and effort on something that's never going

to get off the ground because of regulatory risk or costs. So, moving on to a couple slides. This is basic. I'm not going to spend very much time on this, especially for those who witnessed the previous presentation. Most of you probably know what ZK proofs are. But on a high level, my favorite example for ZK proofs is not everyone else's favorite example. As one of a handful of women in crypto at this conference, um I like to use the example of maybe there's an attractive woman who is 21 years old and she goes to buy liquor and the guy selling at the liquor store is super sketchy and he's hitting on her and she doesn't want to show her driver's license with her home address.

Makes perfect sense. Talk about a real use case right there. ZK technology enables her to prove that she is in fact 21 without showing her address on her driver's license. And crypto ZK technology importantly for this purpose really gives us a new privacy toolkit. But it also gives us accompanying regulatory concerns that I would deem potentially existential which is why this conversation is important and I want to ensure that everyone listening to this has the ability to navigate this legally and constructively.

So if you look at types of ZK proofs, as I mentioned before, obviously Starkware is the king and queens of of uh ZK in my opinion. Although I'm bi biased, there's many different types of ZK proofs. Uh snarks are more compact and require a trusted setup. Starks are transparent and more scalable most of the time. Each of these different types of ZK proofs have different legal implications. A really good example of that is ensuring that you have the ability to audit a trusted setup process. So that would be the first step that you would consider.

What kind of proof are you using? How are you using it? And what does that mean? A theme throughout from a very practical perspective. If you're not a lawyer, you have to understand that lawyers in crypto can be conversant in the tech. And we are conversant. I like to pretend that I am fluent in the tech at this point, but a lot of lawyers are just never going to get to the level of understanding and expertise with devs. So, the best lawyer wants to learn and the best dev or the best engineer is willing to be patient and walk their lawyer through the tech and how it works, thus enabling them to issue spot along the way.

Why are ZK groups an absolutely necessary part of this conversation? because they are the single best mechanism for selective disclosure. I am not talking about absolute privacy or anonymity. Um I'm talking about selective disclosure meaning without some sort of selective disclosure maintenance of data apps will be problematic in the eyes of regulators. Full stop. We can talk a little bit more about that in a few minutes. But selective disclosure more generally aligns with a concept called data minimization which is a key global legal principle. You'll find it all over the place. It very straightforward. It just means that you should limit data gathering to the absolute minimum. The

less that exists, the less that's being stored, the less there is to steal. And of course, ZK proofs are also used to enable trustless verification, which is a key part of decentralization. And decentralization is a bit of a spectre in this conversation because for a lot of this functionality you have to ask how does this pertain to my decentralization roadmap. So moving on there are a lot of privacy apps today. There's a lot of privacy apps. There's a lot of really exciting use cases. There's a lot of projects being built. I would categorize those in these rough five buckets. And I'm sure I'm missing some but this is on a very high level summary falling into these areas.

Many organizations or investors or tradi are absolutely terrified of privacy. They view it as a four-letter word because they view it as a lightning rod for regulatory scrutiny. I think that that's a fair concern, but I'm here to say that you can navigate it responsibly and me and many others in Washington are advoc advocating for privacy as a path forward and educating regulators and legislators on things like ZK technology as not only this is not a bad thing, but this is a good thing. For example, this could help shield American data in the in President Trump's executive order consolidating all of the federal PII

data, which is actually a really troubling concept that a lot of people aren't aware of. Many of these apps, if not all, they're not elicit apps, and many of them are really being built with compliance in mind. A quick note on that, I mentioned that I used to do acquisition due diligence. This is when you have a potential big acquisition. Sometimes it's a crypto acquisition of crypto, sometimes it's trady of crypto, etc. You often, those companies will often bring in thirdparty experts like lawyers to go in and look behind the curtain and basically weigh in on how many skeletons are in the closet and what is the potential negative impact of those skeletons. So, what I'm saying is if you're building a project, if you

build it with compliance in mind, you are 10x more valuable as a potential acquisition target. Now, I don't mean to be cynical here. Many of us are in crypto not because we want to be acquired or not because we want to make money. I can absolutely tell you I took a big pay cut leaving law firm partnership to go be GC of Maple and I loved every minute of it. But this is just something to be conscious of. If you want to scale, if you want to be acquired, you need to consider compliance. You need to consider regulatory risk because if you're ever acquired, your acquiring entity will assess that as number one. you know, what are the chances we're going to acquire this and then we're going to get hit by a multi-year, you know, $50 million Department of Justice investigation.

Let's talk very briefly about one use case you've probably heard a lot about. Actually, if you saw the last presentation, it's relevant. ZKYC, there are three big buckets or I like to categorize the three big buckets of risk in crypto as one, two, three. One, hack risk, smart contract integrity, security risk. Two, civil regulatory risk. So, SEC, CFTC in the US context. Three, existential criminal risk. And this is what I'm talking about here. It's money laundering, sanctions, etc. Uh, and every regulator worldwide, this is bad.

If you get a call or a letter from the criminal regulators to mitigate that existential risk or if you want to appeal to institutional players, regulated players, you have to at least consider KYC. May may consider it, may assess it, may talk to your lawyers, may reject it, but you have to consider it and you have to think about it or some form of KYC, right? Like blockchain analytics. With this, a user proves their identity without revealing it on chain. The verifier confirms compliance offchain and the user gets a ZK proof that then proves that then allows that that individual user to stay pseudo anan anonymous while onchain. The key however and we'll talk more about this in a

minute is that the identity must be able to be traced back to the individual for regulatory purpose. That data has to be stored. It has to be a theoretically available somewhere in case there is some sort of subpoena, some sort of inquiry, some sort of national security related issue. And then this obviously raises some key questions surrounding decentralization. And I don't really have the answers to those questions right now. More to come. None of this is perfect, right? A proof's existence can become public. There's a massive lack of dynamic updates in existing KYC solutions. But I would argue that these solutions are much better than just having a huge honeypot of data living on

a server filled with PII. Very briefly, why does this make sense for the market? It's a little obvious. Um, we're seeing a rise in user demand for privacy. We're also going to see increased regulatory pressure surrounding the need to and the ability to appropriately handle sensitive data. So if you have a bulletproof mechanism for this that is again both a competitive and practical advantage. There's also a massive institutional up appetite um you know I I speak on at crypto conferences but I also love to speak at tradi conferences and I actually think sometimes that's the most valuable exercise because we're all sitting in this massive echo chamber

for me as starkware's advocate. It helps me hone my advocate that my advocacy to understand what Tradfi thinks, what motivates them, um, you know, how they perceive certain aspects of our ecosystem. And one of the things that Trad is very confused about is onchain transparent trading and flows. They're very confused. They're like, wait, this doesn't make any sense. Like, why would I ever want to do that? Again, that onchain visibility. ZK can unlock hybrid trad models by customizing the onchain data visibility, financial institutions, regulated entities, and I'm talking in and out of

crypto. They want compliance. They want something that's going to be acceptable to regulators, but they also want confidentiality when it comes to onchain competitive financial flows. So, moving on to more talk about risk, and this is why no one ever invites me to the parties. Lawyers are the most fun people in the room, always. I mentioned the three buckets of risk earlier, but I want to hone in more on the third, which is that anti-moneyaundering, sanctions, and illicit finance risk. This is very real risk. I want to say that with the development in the US regulatory environment that we've all been very

heartened to see. I mean a year ago everyone was sitting here in extreme agit regarding the US SEC. Of course that has changed dramatically. The new commissioner uh Paul Atkins has actually even recently spoken about a technologyoriented exemption to the securities laws which is very encouraging. The current SEC's crypto asset tra t task force has been shockingly transparent, encouragingly cooperative with the industry. Great. So we look at the quiet regulatory environment, meaning the civil regulators like the SEC's, like the CFTC, even in the EU, Mika, the markets in crypto asset regime for crypto, the the

comprehensive regulatory regime for crypto in the EU, it came into full force in January. We've seen very little enforcement activity to date. Although I think we're all waiting with baited breath, but what are we going to see more of in the US? I anticipate we're going to see much more activity surrounding criminal regulators. There's always a bit of a cyclical flow when it comes to regulatory investigation and there's always a dramatic uptick in investigations, oftentimes fraud related investigations post uh you know bare market in crypto. So, we've gotten over that hump, you know, the FTX related slew of investigations, but criminal regulators are also aware of the increase that we've seen in scam related

activity and wrongdoers taking advantage of the bull market. So, the investigation environment is probably going to become more active and remain active in this space and theoretically fill a perceived gap that has emerged with legislation and with the quiet authorities. The other thing I'll say, and this is a little scary, is when you talk about sanctions risk, and this is not a US risk. This is huge in the EU, huge in the UK. In the US, what's a little terrifying about sanctions is there's criminal sanctions where you go to jail, but there's also civil sanctions. And all criminal conduct in the United States, you need an intent to violate the law. You cannot be convicted of

money laundering if you didn't intend to launder money or facilitate the flow of dirty money. Now, you can be convicted if you have what is called willful blindness, meaning you're aware that this is happening and you bury your head in the sand, but you need that intent. Otherwise, you are not vulnerable of, you know, when it comes to criminal risk. OFFAC civil sanctions. However, you can be convicted of violating OFFAC's civil sanctions regime on what they call a strict liability basis, which means you did not have intent to violate sanctions. If you didn't follow your policies or if you didn't have good enough policies, you could theoretically be on the hook for violating OFAC civil law. So, it's a little scary because

what I mean by pointing that out is the threshold is just a lot lower than other criminal risk. If we look at the global regulatory snapshot, and I'm not going to spend a lot of time on this because frankly there are too many acronyms and too many regulators, but I just want to briefly mention we have the Department of Justice or DOJ that I've mentioned. They really prosecute all of the crimes, all of the federal crimes, which means the the the borderless or crossing border crimes. You have OFAC which is sanctions. They administer and enforce sanctions. They uh enforce civil sanctions and then they refer criminal issues to DOJ. You also have a whole host of regulators like the FBI. They investigate and if they think a crime has been committed, they refer to DOJ.

In the EU, you obviously have Mika, which I mentioned before, but the keystone in the EU is what's called the anti-moneylaundering directive, which requires certain centralized operators to report suspicious transactions. Uh, I mean, Mika was in part designed to mitigate the risks of moneyaundering. You also have a whole host of extremely ownorous data protectionoriented laws in the EU. And then the last one I'll mention is FATF or the Financial Action Task Force. And this is an independent intergovernmental body that develops and promotes policies that are meant to be used worldwide to protect the global financial system against anti-moneya against moneyaundering and terrorist financing. We don't have time to go through all of FATF guidance and nobody

wants to hear about that. But FATF has issued specific guidance on anonymity enhancing technologies and they have certain themes that can and probably should be applied to certain types of crypto projects. things like ongoing monitoring of emerging technologies, consideration of the travel rule, which has been the bane of centralized exchanges existence. It requires vast or virtual asset service providers to exchange customer information when transferring crypto. I think why is this relevant for all of the projects in this room, many of which aren't centralized exchanges, right? A lot of this may or may not apply to you. I actually think it's absolutely essential to monitor the regulators and what they're doing to the

centralized exchanges because there's no better way to look inside their head and understand what motivates them, how they approach the ecosystem, how they view different kinds of projects and different sectors of the industry and then that enables you to effectively look at your own regime, your own project, your own strategy. I mean nine times out of 10 there's no law that governs what we can and cannot do in crypto. There's no law, there's no precedent, there's no rule. For me, my strategy has always been and remains ensuring that if there is a risk, I understand and assess that risk and I formulate a proactive, reasonable, justifiable argument so I could sit across the table from the SEC or from an

EU member state and I could articulate exactly why we're doing it and why it's justified. And if you haven't done that, and if you're engaging in a high-risisk activity, privacy or not related, that's a problem. You know, think through what you're doing and why you're doing it and why you think it's okay legally to do it. It you just have to have an argument that is reasonable and is justifiable. The projects that get in big trouble just aren't prepared to have those conversations. So, very briefly, tornado cash, what not to do, right? I can't fully opine on this because nobody really knows what went down here, right? Okay. Nobody really knows what tornado cash did and did not do. And I certainly don't mean

to, you know, cast fault at tornado cash, but I I point this out to first say if you are centralized, regulators will insist that you have obligations. Full stop. So consider that most of crypto is not fully decentralized. Okay, Ethereum being an exception, but if your project is centralized, you will probably have obligations and you have to understand why you are not subject to those obligations. Two, if you get an inquiry from criminal regulators, you have to answer it. You have to answer it. You have to engage. But before you take my word for it, this is one area where you need to have good counsel.

Like, this is one area where you don't want to cheap out on your counsel. You need to have good counsel. And you need to have counsel that is well equipped to deal with the regulator that is spearheading the inquiry because there is a lot of niche strategy when it comes to any given regulator. And I have seen a lot of crypto projects struggle because they end up using their go-to outside counsel or maybe just their general counsel to handle a government investigation and that individual or those individuals are just not equipped. So that's something that's essential. Regulators just view privacy tools when controls are missing as basically the devil. So we need to come in and understand that perspective and build for that.

So this is actually maybe the most valuable slide when we're considering practical steps forward from this overview. And I would say design for privacy with compliance in mind. It can be front of mind. It can be back of mind depending on where your project is situated. And by no means do I mean that you need to do all of these things. Absolutely not. Some of them may not be appropriate for your given project or user base or audience, but I think that you should consider all of these things and consider if it works for you, for your UX, if it works technically, if it makes sense. Some of these are far more important than others. One, selective disclosure. You know, are you gathering the minimum amount of information? Are

you maintaining it in a way that it's protected? Uh regulated access points. I mean, we're seeing more and more in DeFi. And when I say that again, I mean, are you even using blockchain analytics? Are you using an elliptic, a TRM, a chain analysis for the bare minimum to ensure that you're screening sanctioned wallets? Uh, do you have that data repository for regulatory inquiries? And I'll talk more about that in a minute and what that mechanism could look like. That is incredibly important and because again in a worst case scenario, are you going to have an answer to their questions or are you going to say too bad we're a private we don't we can't help. That's not that's just not going to go over well. like cooperation goes a long way and cooperation can be

strategic when it comes to the regulators and they also understand that um if everyone is seeking a resolution that not only helps the entity itself but also makes sense from for example the presidential or messaging perspective that's also strategy the other thing that's been really interesting is proactive engagement with regulators I would not always suggest this but a great example is privacy pools. Um, you know, they have an they have a really fantastic piece of scholarship co-authored by Vitalik. Um, and they engaged extensively with the US regulators before moving forward on their privacy pools project. And that not only helps them from a legitimacy

perspective, it also helps them when they're seeking out strategic partners because then they go in front of GC's like me and I'm like, "How is this okay? How have you vetted XYZ?" and they can say we've blessed this with the regulators. The regulators often will not say green light, you're good. They won't give out no action letters. That is very unusual. And you know during the Gensler administration in the US unfortunately if you engage with the regulators you were often rewarded with a subpoena. But these days, depending on the regulator, you could consider proactive engagement and consider whether that process could give you value either intellectually, commercially strategically.

Uh the last point I'll just make on here is appropriate marketing. Very practically, if you have a privacy project or a protocol that becomes a lightning rod for bad guys, it's just game over. Full stop. uh one of the things that you can do to deter bad actors from using your project is to ensure that they're aware of any compliance mechanisms. So, you know, if you have that repository of data for regulatory inquiries, make sure your marketing isn't like absolute privacy for absolutely everything in every circumstance. Ensure that you know your users are engaging with full transparency both because it will dissuade regulators but it's also

appropriate that your users are aware of what is happening to their data if anything where it's going what's happening that transparency is also protective and often legally required under for example the EU's GDPR very ownorous privacy laws. So if we think about principles for ZK privacy acts, privacy apps, we want to talk about again about transparency about capabilities, marketing to disincentivize wrongdoers, auditability and accountability.

Understanding how this all works and ensuring it works correctly is going to be key. I like to call it the legal layer of ZK. In a weird way, you're considering and you need to discuss and consider how you can embed policy into code. And what I mean about that is, you know, hearkening back to the previous slide, are we thinking about or should we consider some form of permission to access, some form of revocable credentials, blockchain analytics, onchain attestations, consultation with competitors, not just regulators, but competitors.

Understanding the market standard for privacy is also really important. I'm not saying you have to go directly to competitors and have a face-to-face conversation, but you can also get a sense from the market as to what they're doing, how they're doing it. Does it make sense? Again, nobody's looking to copy a competitor, but understanding why they've decided to make a choice and seeing if it fits for you for compliance and regulatory purposes. Basically, not being the ugliest house on the block is a big strategic advantage when it comes to regulatory issues. Last point, consider getting feedback from regulated entities. You know, crypto is absolutely terrible about, you know, building for for an economic use case or creating

business plans or having, you know, an economic bottom line. You know, before you build, before you scale, before you get full into the infrastructure, ensure that your target audience is clearly articulated and that that target audience can engage with you. you know, don't build this for JP Morgan until you've engaged with JP Morgan. And I think a lot of people really do not fully understand what it takes to get past Tradfi Legal. You know, I mentioned before I was CLO of of CBOE Digital. So, SIBO Digital was the subsidiary, a suite of crypto subsidiaries of SIBO Global Markets, which was it's a huge financial conglomerate. It's ultra regulated. It

has eight securities exchanges. It was actually fantastic for me to get insight on what exactly it took to wind it its way through SIBO legal and compliance. It's a very high threshold. So, you need to engage with those entities to understand like are you going to get zeroed out? It doesn't matter how excited the business is about something, are you going to get zeroed out by legal? Like if you are, you need to understand and potentially modify accordingly if that's your target market. So one of the things that's really exciting for us is Starkware is building right now for Starknet. We want to build something customized because you know different entities have extremely different appetites for risk again in and out of crypto and that's okay. You

see this type of customized risk setting in the blockchain analytics perspective. You know, some crypto projects are blocking pretty much all the risks. Like they're blocking mixers, they're blocking DeFi, others are only blocking actual criminal activity. That kind of risk customized risk setting or risk scoring has actually been used forever in Tradfi. We are working with builders on two things, a private ERC20 and privacy pools. I have an overview on this slide. I'm not going to take the time to go into it and I'm happy to talk offline or refer you to my absolutely brilliant, brilliant builder Maya on these issues, but we have a number of different compliance aspects built in and are considering these compliance

aspects. And I'll also mention that for the purposes of facilitating and being hyperconscious of decentralization, we also have a model where a governing body, not the builder, not the user, can define acceptable sets andor acceptable risks. But most importantly with these models that we're talking about and my favorite aspect and the reason that I'm comfortable with it, we have view keys. Meaning someone or something with these keys, whether it's the governing body or somewhere else, potentially separate from the governing body, but a trusted source, can use those keys to unlock the underlying data. And ideally, that unlock is actually pursuant to a very clearly articulated set of terms. For

example, a subpoena. And judgment does not solely exist within humans. and also for marketing. The existence of these keys will be made absolutely clear. I'm gonna wrap up because I want to take just a couple minutes for questions. I think we'll have three minutes at the end. I'll just say my overall message is that the legal path is annoying, but it's important and you have to balance the risk with the upside. ZK is the way. It's the foundational path for privacy. And again, your devs, your lawyers, and your comm's team should all be working together. Lawyers don't often understand what is technically possible and engineers don't often understand what is legally possible. So if those two contingents are not talking to each

other then you're just going to have a subpar project. So I think we have a few minutes for questions if we have any questions from the audience. Nothing. Nothing. Final call. Do we have one out there? Oh, I think we have one. a brave individual. Guys, I used to bill $1,400 an hour, so like, bring it on. Come on. Hey, can you hear me? I can hear me. I hear you. Um, thank you. You spoke a lot about Well, it's weird to hear myself. You spoke a lot about compliance and traceability of transactions for centralized exchanges.

But I'm wondering how comes the decentralized exchanges think it's none of their problem because in the end of the day if because of them and North Korea can trace fundings to their platform they should still bear some responsibility for it. It's a it's a great question and you know I I think Katherine Murk who's CLO of UNI um her and I actually just had a had a mini debate on why she believes KYC should not exist within DeFi. and she actually has a legally justifiable, extremely wellthoughtout perspective on that. So, I give Uni credit for, you know, having a really strong CLO that has grappled with these issues, that has engaged on

these issues. I will mention that as everyone here knows, there's a massive spectrum of DeFi, right? And certain DeFi, I mean, we we could even call DeFi permissioned there, certain permission DeFi is considered DeFi by some circles. A lot of DeFi is using what I would call behind the-scenes compliance. You know, they're using blockchain analytics, for example. They're using compliance mechanisms that the user doesn't even know are there. So, I think a lot of DeFi is okay conceptually with that with scanning wallets, for example, as long as it doesn't disrupt the UX. So the question is and this is what makes me so bullish on ZKT tech as a mechanism for compliance and for privacy is obviously

you can integrate certain facets of you know ZK proofs in a way that doesn't overly disrupt the user experience. I think if you could offer DeFi holistically a way to absolutely ensure that wrongdoers didn't use their protocols DeFi would take it unequivocally. Um, well, I don't want to go so far because obviously it's disruptive of the whole theoretical concept of crypto at its heart, but the problem that DeFi is going to grapple with and has already grappled with is DeFi is often used as basically a scapegoat. Like look at the huge volumes of dirty money flowing through these dexes. So, who knows? is we've already seen a mini reckoning during the Gensler

administration where there were two sets of rules that were promugated that were existential for DeFi. Both of those have actually been since struck down by the courts in the US. But DeFi keeps having these close calls. So the more that DeFi could do to effectively say we are not the bad guys and we're not here to facilitate the flow of North Korean money, the better for DeFi as an ecosystem. I think we have one or a couple more questions if we have time now. We have three. We might be out of time. I think we are. Thanks all.

[Music]