National Security Implications of Virtual Currency
Examining the Potential for Non-state Actor Deployment
- Why would a non-state actor deploy a VC? That is, what political and/or economic utility is there to gain? How might this non-state actor go about such a deployment? What challenges would it have to overcome?
- How might a government or organization successfully technologically disrupt a VC deployment by a non-state actor, and what degree of cyber sophistication would be required?
- What additional capabilities become possible when the technologies underlying the development and implementation of VCs are used for purposes broader than currency?
This report examines the feasibility for non-state actors, including terrorist and insurgent groups, to increase their political and/or economic power by deploying a virtual currency (VC) for use in regular economic transactions. A VC, such as Bitcoin, is a digital representation of value that can be transferred, stored, or traded electronically and that is neither issued by a central bank or public authority, nor necessarily attached to a fiat currency (dollars, euros, etc.), but is accepted by people as a means of payment. We addressed the following research questions from both the technological and political-economic perspectives: (1) Why would a non-state actor deploy a VC? That is, what political and/or economic utility is there to gain? How might this non-state actor go about such a deployment? What challenges would it have to overcome? (2) How might a government or organization successfully technologically disrupt a VC deployment by a non-state actor, and what degree of cyber sophistication would be required? (3) What additional capabilities become possible when the technologies underlying the development and implementation of VCs are used for purposes broader than currency? This report should be of interest to policymakers interested in technology, counterterrorism, and intelligence and law enforcement issues, as well as for VC and cybersecurity researchers.
Non-State Actors Can Use VCs to Disrupt Sovereignty and Increase Political and/or Economic Power, but Unlikely to Use Established VC; Many Challenges Posed by Creation of VCs
- VC deployments are attractive in developing countries and in countries undergoing internal turmoil, where the existing financial infrastructure is either insufficient or weakened.
- The rapid deployment of a VC over a large geographic area would likely be less complicated than deploying more common currencies, such as those based on commodities or paper-based currencies.
- A non-state actor's VC (including Bitcoin-like currencies) would likely be vulnerable to cyber attack by a sophisticated adversary; more generally, creating new, usable yet reliable VC may pose great challenges, particularly for a non-state actor without technical sophistication.
- Promoting adoption of VCs among population is difficult due to newness, lack of legitimacy, and familiarity with physical tangibility of currency.
- Deployment of a VC by non-state actors, such terrorist organizations, insurgent groups, drug cartels, and other criminal organizations, would be easier if supported by a nation-state with advanced cyber expertise.
- Despite numerous hurdles, trends indicate a future in which VCs could be deployed by non-state actors or other organizations.
VCs Are Vulnerable to Attacks, Especially by a Technologically Sophisticated Adversary
- It would be difficult for a non-state actor to structurally design a VC that would be both resilient to attack and usable by all persons in the non-state actor's geographic area of influence.
- Unsophisticated attacks are possible by governments, other non-state actors, and users of another VC; more sophisticated attackers could target services that are more centralized, even for decentralized VCs, such as digital wallets and, if applicable, mining pools.
Development and Implementation of VCs Could Add to Security-Related Technological Developments That Could Aid Non-State Actors
- VCs demonstrate a resilient means of storing data in a highly distributed fashion that is very hard to corrupt; possible implications of this include information dissemination (blogs, social media, forums, news websites) that is eventually completely resilient to nation-state interference.
- The need to develop security mechanisms for VCs could encourage the development of advanced cryptographic techniques, such as secure multiparty computation, which seeks to perform distributed computation while preserving the confidentiality of inputs and outputs in the presence of malicious activity.
- VCs represent the latest step toward decentralized cyber services. In particular, the historical trend suggests the development of a resilient public cyber key terrain, which this report defines as the ability of unsophisticated cyber actors to have persistent, assured access to cyber services regardless of whether a highly sophisticated state actor opposes their use. This has implications for national firewalls, access to extremist rhetoric, the feasibility of nation-state cyber attacks, and the ability to maintain uninterruptible and anonymous encrypted links.
- The Department of Defense should be aware of the following: (1) VCs are an increasingly technologically feasible tool for non-state actors to deploy in order to increase their political and/or economic power; (2) efforts to destabilize confidence in a new VC are effective, while popular sentiment is still untrusting of VCs for common transactions; (3) VCs are just like any other service in cyberspace, and methods to successfully attack them are not meaningfully different than for any other cyberspace operation; (4) decentralization affords more, though not total, resilience to disruptions from cyber attacks; (5) the trend toward decentralized cyber service will only make it easier for unsophisticated cyber actors to have increasingly resilient access to cyber services, which is a two-way street that could enable unprecedented global access to information and communication services that, at its core, is agnostic to the national security interests of the United States.