Security: The Battle of the Bits

Linda Punch

With law enforcement’s spotlight on Bitcoin and other digital currencies, a startup called BitMint hopes its approach will inject much-needed trust into the business.

Developers of digital currencies are struggling to find the right mix of features to win over a mass market. One of the latest efforts comes from BitMint LLC, a Rockville, Md.-based company that is testing a digital currency that can be used in the virtual world but also will offer a physical token containing digital credentials designed to close the gap between the digital and physical world.

At the same time, BitMint is trying to offer an alternative to existing digital currencies, including Bitcoin, which have raised concerns among regulators and law-enforcement agencies worldwide about their possible use in illicit activities.

Indeed, BitMint is trying to counter the perception held by many that digital currencies are developed by shadowy groups and frequently used by criminals to launder money or support other frauds, says Gideon Samid, BitMint’s chief technology officer.

Samid’s concerns appear to be valid. Shortly after BitMint received a patent for its digital-currency system, the company began receiving phone calls from interested parties. “We got contacted by people who identified themselves by their first name, said they lived in Gibralter, and they wanted to pay us cash,” Samid says. “We know right away we don’t want anything to do with those guys.”

BitMint’s strategy for building trust with potential users is to work with central banks, tying BitMint coins to the actual currencies of each country. By contrast, many existing digital currencies are totally independent of real-world monetary systems.

“We aren’t coming with a new currency,” says Samid, who is also the author of Digital Transactions’ monthly “Security Notes” column. “We are digitizing the U.S. dollar or the Canadian dollar. We’re talking to all of the central banks and saying, ‘We aren’t a threat to you, we’re not going to print new money, we’re going to digitize your money. Somebody gives us a $100 bill, we give them a $100 in bits, that’s it.’”

Because they are de-linked from national currencies, the value of a Bitcoin and other digital currencies can vary widely. In April, the price of one Bitcoin plummeted to $130 from a record high of $260 in a single day.

A ‘Hybrid’ Coin

To convert currency into a BitMint coin of equal value, users go to the coin exchange on the BitMint Web site (BitMint.com). Users can exchange any amount up to $10,000 for an equal amount in the BitMint digital format.

Users pay by cash, check (personal or cashier), card, or wire transfer. BitMint will deposit incoming dollars in a bank checking account or its equivalent, available for instant redemption, Samid says. He declines to name the bank.

Once BitMint receives the money, a digital coin of equal value is sent to the user’s electronic media via dedicated hardware or as an e-mail attachment. “You come to the BitMintWeb site and pay with your credit card or send us a check—say $200—and you will get $200 worth of bits,” Samid says. “What you do with these bits depends on the application. You could send them as an e-mail attachment to your family in Mexico or make any payment around the corner or across the globe.”

BitMint also is developing what Samid calls a “hybrid coin”—a physical coin that will carry the digitized currency on a USB stick or a Secure Digital (SD) card. The coins can be used to pay offline but are redeemed online. The hybrid coin will be made of a composite material and will be marked with the value represented by the bits. Users can redeem the coin in the same manner as regular currency, paying at the point of sale or giving it to an individual. The value of the coin can be verified by cracking it open, removing the USB stick or SD card, and plugging it into a computer.

Users can specify who will be able to redeem the coin. Options include redeeming the coin to the recipient, redeeming the coin to a recipient with a redemption PIN, redeeming a coin to a named recipient, or redeeming the coin only to the user.

BitMint also will offer users the ability to limit how the money can be spent, Samid says. For example, a parent might send BitMints to a college student to be used only to purchase books or pay tuition. “You can connect it, fuse it cryptographically with its intended purpose,” he says. A user also can designate a time for the value on a BitMint to expire, with the money credited to the user’s account.

A ‘Wild West’ Approach

The hybrid coin represents a “kind of the traditional comfort from a consumer perspective,” says Beth Robertson, a payments industry analyst. “But that’s going to change because we’re getting into the era of more digital transacting.”

BitMint has formed a strategic partnership with Munich-based Giesecke & Devrient GmbH, a company that prints the national currencies of 150 countries as well as develops products and technology for the payment, secure communications, and identity-management sectors.

G&D, whose customer base includes central and commercial banks, mobile network operators, businesses, governments, and public authorities, will serve as the mint for the BitMint currency.

“We go with them to get the full trust that they have,” Samid says. “They are insisting, and we’re in absolute agreement, that every country we’re going to operate in, we first approach the central bank and tell them what we’re doing.”

BitMint will be subject to central-bank regulations and will abide by all monetary laws and restrictions, he adds.

BitMint is taking a different approach to digital currency from that of the more celebrated Bitcoin, says George Peabody, senior director at Glenbrook Partners, Menlo Park, Calif. “Bitcoin, which is utterly without a central authority of any kind, appeals to those who have more of a Wild West monetary approach as opposed to BitMint, which recognizes and builds on the central authority, the central-bank model.”

Law Enforcement’s Gaze

Bitcoin uses its complete independence from government-based monetary systems as a selling point to its users. Bitcoin, which is maintained by a decentralized network of unnamed cryptologists and application developers, offers anonymity, international utility and inflation protection, and has no connection to the existing payment systems.

It appeals to users who want to transfer money anonymously, avoid banking fees and regulation, and protect their money from the impact of economic collapse.

Users download software from a number of so-called exchanges that provide Bitcoins at prevailing exchange rates. Specialist processors serve merchants. To send Bitcoins, users enter the recipient’s e-mail address and the amount to be transferred. The user’s computer than digitally signs the transaction and sends the information to the Bitcoin network.

The network verifies that the person sending the Bitcoins is the current owner. Once the transaction is validated, recipients can spend the Bitcoins. The process, which typically takes a few minutes, is not reversible.

Because of the clandestine nature of the Bitcoin system, it has caught the eye of law-enforcement agencies and government regulators worldwide. The Federal Bureau of Investigation has warned that criminals could use the Bitcoin electronic currency for money laundering and other illicit activities because of the anonymity its system provides.

Last month, the U.S. Dept. of Homeland Security (DHS) obtained a court order shutting down the ability of users to withdraw or deposit Bitcoin virtual-currency funds using the Dwolla mobile-payments service via Mutum Sigillum LLC, better known as Mt. Gox, the leading Bitcoin trading platform.

The government alleges Mt. Gox is an unlicensed money transmitter. Des Moines, Iowa-based Dwolla says it is not a party to the dispute between Mt. Gox and DHS, according to published reports.

And the wild fluctuations in the value of Bitcoins has prompted the U.S. Commodity Futures Trading Commission to consider whether the virtual currency should be subject to its rules. Meanwhile, the U.S. Treasury Department in March said Bitcoin exchanges are subject to the same money-laundering rules that govern money-services businesses like The Western Union Co.

Bitcoin proponents say the benefits of the digital currency outweigh the risk of any criminal use because Bitcoin gives consumers a digital currency that can’t be manipulated by government enforcement agencies, like national currencies or payment methods based on those currencies.

Random Data

BitMint’s decision to work with existing payment systems would appeal to not only “people on the regulatory side but to many consumers that might be concerned about how a digital currency might be used or how to protect their own personal security,” says Robertson, the payments analyst.

But aligning with central banks isn’t the only strategy BitMint is employing to build trust. The company also is using stronger encryption than the Europay-MasterCard-Visa (EMV) standard used by Bitcoin and other digital currencies, Samid says.

While EMV is the standard used by the cryptographic community and the payments industry, the ciphers will eventually be broken either by advanced computers or “a new Einstein” that can detect patterns in the codes, warns Samid.

“They’re trying to say this is the strongest cryptography,” he says. “Yes, it’s the strongest today but we don’t know what tomorrow is. You can’t lure people to take their money out of the bank and risk it on an algorithm that tomorrow will be cracked.”

In fact, Bitcoin and other digital currencies have experienced a number of high-profile data breaches. In one instance, a Bitcoin transaction-services company announced that hackers had broken into one of its brokerage accounts, stealing more than $12,000 worth of the digital currency.

In another breach, hackers gained access to a Bitcoin exchange’s e-mail, did an online password reset, and siphoned $12,480 from its account.

BitMint’s encryption is based on so-called equivocation, a sequence of data generated at random, Samid says, adding that without a pattern, a hacker can’t break into a BitMint coin.

‘Computer Nerds’

For now, BitMint views Bitcoin as its primary competitor. But other digital currencies are on the horizon.

Indeed, BitMint is “not the first to have a creative reaction to what Bitcoin represents and what Bitcoin is,” Glenbrook’s Peabody says. “We’re going to see quite a bit of innovation around the use of these virtual currencies, whether they are stores of value long-term or they are used as transaction currencies or they are an intermediate set of rails to move money between government-issued currencies at either end.”

And BitMint, like other digital currencies, still has a long way to go to earn consumers’ trust. Most people don’t “necessarily know who’s behind BitMint or whether they trust that entity,” Robertson says.

While companies like BitMint face enormous hurdles, digital currencies eventually will become mainstream, says Jeff Green, director of the emerging technology advisory service at Mercator Advisory Group, Maynard, Mass.

“It’s going to take some time for the Joe Schmo consumer to embrace virtual currencies,” he says. “Right now, [digital currencies] appeal to the computer nerds out there. But you’re seeing some pretty sizable venture capital going into some of these companies.”

Bitcoin’s Wild Ride

It’s been a heady year for Bitcoin, the digital currency that somewhat mysteriously burst on the electronic-payments scene in 2009. No one knows for sure who Bitcoin’s creator is. He (or she) disappeared from the Internet shortly after introducing the currency, having programmed a limited number of Bitcoins for eventual distribution. Bitcoin grew slowly at first, confined as it was to Web-savvy cognoscenti with a healthy distrust of greenbacks. But this year it’s found its footing. The downside? Government agencies are paying attention too, concerned with the currency’s potential to be used as a tool for money laundering and other illicit activities.