Blog

As we have seen in this blog post, one of the key flaws associated with the current approach to personal data protection and privacy management is the concentration of power within a few organizations. However, this flaw regards many more reasons, such as censorship and anti-competition issues. The concentration of power referenced here can be due to many factors, such as the spontaneous emergence of hierarchies in natural systems (Bakos et al., 2021) or market dynamics’ effect, such as preferential attachment and manifestation power law manifestation (Lopez et al., 2019). In general, the main risk that leads to this flaw is the existence of a single point of failure.

In systems theory, a system is decentralized when lower-level components operate on local information to accomplish global goals. Such a system operates through the emergent behavior of its component parts rather than as a result of the influence of a centralized part (Wikipedia community, 2022).

In a more technical definition, such systems are decentralized, meaning that their architecture is such that it tries to avoid single points of failure.

With the advent of Bitcoin (Nakamoto, 2009) as the first system providing a Peer-to-Peer (P2P) cryptocurrency, there has been a new wave of development of decentralized systems to combat the single point of failure issue. The first widely used systems of this type date back to the start of the new millennium, making it possible to share and exchange resources such as text files, music, and video, e.g., BitTorrent, Emule, Gnutella, and Napster. Generally speaking, P2P systems usually run on top of an already existing network, like the Internet. The underlying overlay network can be represented as a graph where the nodes are the “peers,” and the edges connect peers directly communicating. Two prominent aspects related to the functioning of a P2P system are (i) how the overlay network is built and maintained and (ii) how messages are exchanged among peers (Serena et al., 2020). Hybrid P2P systems might employ some servers for coordination, while pure P2P architectures do not rely on any centralized entity (Backx et al., 2002). Bitcoin is a DLT built on top of a pure P2P system, with the primary objective of storing transactions of assets in the form of so-called cryptocurrency. To achieve decentralized verification of each block, the entire DLT is replicated among all nodes forming the P2P system. Each peer is randomly connected to others, and transactions are disseminated across the entire network. Each node then independently verifies the transactions received to ensure their consistency and avoid attacks, e.g., double spending of Bitcoins. Different types of DLTs provide different implementations of the ledger that store transactions; however, in blockchains, transactions are collected in blocks, and each block contains the hash of the previous one. Nakamoto revolutionized the decentralized systems’ world (and even finance) by introducing a consensus mechanism to ensure all the copies of the ledger are the same for all peers (Nakamoto, 2009). All the other peers accept a block only if it “solves a puzzle”. To make it solving this “crypto-puzzle,” it is required intensive computation work that consumes time, i.e., at each cycle try and attach a different nonce (i.e., a random number) to the block until the execution of a hash function on the block together with the nonce returns a string prefixed with X zeros. This is a general description of Bitcoin’s Proof-of-Work (PoW) consensus mechanisms (also called mining). Moreover, the X is changed dynamically to make this crypto-puzzle more difficult.

Nakamoto’s is, in fact, a revolution since many industries and financial sectors have been influenced by it. In addition, it has also brought optimism for incentivizing participation models, resource contribution, and consensus that could provide a substrate for a decentralized Internet, i.e., the Web3. While there are many different types of DLT, each built with fundamentally different design decisions, the overarching value proposition of DLT and blockchains is that they can operate securely without any centralized control. However, this permissionless way of operating a sizeable decentralized system has also brought many criticisms. Several authors argue that the central problematic aspect of DLTs is their core notion of being trustless (De Filippi et al., 2020; Finocchiaro and Bomprezzi, 2020; Waldo, 2019). In many ways, their attempt to replace trust with code, i.e., the source code that implements the consensus algorithm, makes these DLTs less trustworthy than non-blockchain systems. Indeed, it can be argued that many permissionless DLTs are not truly decentralized, and their inevitable centralization is detrimental because it is essentially emergent and ill-defined (Schneier, 2019, 2022). In such systems, the need for trusted intermediaries is still present, and they often have more power and less oversight than non-blockchain systems: governance and regulations are needed.

Where does trust lie in permissionless decentralized systems?

A critical part of permissionless DLTs is that anyone can participate in the consensus mechanism. Thus, due to its distributed nature, there are no reference points for placing trust. Schneier (2019) argues that non-DLT systems are based on other general mechanisms that humans use to incentivize trustworthy behavior and that make consensus mechanisms unnecessary: morals, reputation, institutions, and security mechanisms. Morals make a person act in a trustworthy way based on decisions taken individually, while reputation is based on the influence of one’s social group. Institutions have rules and laws that induce people to behave according to the group norm, while security mechanisms such as door locks are employed to fulfill the gaps of the previous three mechanisms. What DLTs’ consensus mechanism does, is to shift some of the trust in people and institutions to trust in the technology (Schneier, 2019). When that trust turns out to be misplaced, there is no recourse. For example, if an individual is the sole holder of a private key used to unlock Bitcoin funds and this one is lost, then there is no remedy. In this case, Scheiner wonders whether it is better to trust a technology or a (or a group of) person(s).

By being open access and fully distributed, a permissionless environment may not be able to incentivize participants to adequately provide functions like quality control or coordination of system development and evolution (Bakos et al., 2021). Centralization emerges de facto because of the investment of expertise, reputation, time, or money of the hierarchy of developers or organizations required to enable open access and decentralized control. The higher the costs, the fewer the people that want to participate (Bakos et al., 2021). Permissionless consensus mechanisms require trust in the various members who execute it, i.e., miners or validators (depending on the consensus algorithm) or in their governance. Verifying that these members are not cheating on the hashing of a block is easy. The more extensive and diverse the group of validators or governance, the less likely anyone is to collude. However, even assuming that the group that computes the blocks is trusted, as is its governance, it is necessary to trust the developers of the software used to manage the blocks, ledgers, and all.

For this regard, Trail of Bits (2022) investigates these matters intending to show how a subset of participants can gain centralized control over the entire DLT. Their work is based on 6 measures of centrality:

• Authoritative centrality - What is the minimum number of entities necessary to disrupt the system? The Nakamoto coefficient represents the reply to such a question, and the closer this value is to one, the more centralized the system. It has been shown that for the most used permissionless DLTs, such as Bitcoin and Ethereum, the Nakamoto coefficient is relatively low. While it might be prohibitively expensive attacks such DLTs for individuals, competing technologies and nation-states might have the requisite resources.
• Consensus centrality - To what extent is the source of consensus centralized? The Bitcoin PoW consensus mechanism is currently not executed by single computers or machines owned by an individual but rather by so-called mining pools that aggregate several individual computing powers into one for the same objective, i.e., solving the crypto-puzzle. Only the four most popular mining pools consti- tute over 51% of Bitcoin’s computing power. This paves the way for the most impactful attacks possible to the DLT (Ye et al., 2018). Moreover, each mining pool operates its proprietary centralized protocol and interacts with the public Bitcoin network only through a gateway node, making them an easy target for single point of failure attacks.
• Motivational centrality - How are participants disincentivized from acting maliciously? The possibility of attacks, such as the 51% attack, shows how most Bitcoin nodes are incentivized to behave dishonestly. Kwon et al. (2019) have shown that there is no known way to create a permissionless DLT that is immune to malicious nodes without having a trusted centralized third party.
• Topological centrality - How resistant is the consensus network to disruption? Through empirical estimates of the degree distribution, the authors show that a dense subnetwork of public nodes in the P2P DLT permissionless network is largely responsible for reaching consensus and communicating with nodes executing the consensus mechanism.
• Network centrality - Are the nodes sufficiently geographically dispersed such that they are uniformly distributed across the Internet? Permissionless DLTs such as Bitcoin can suffer arbitrarily degradation or denial of services to any node because, in the past 5 years, 60% of all Bitcoin traffic has traversed just three Internet Service Providers. Moreover, these or any third party on the network route between nodes can observe and choose to drop any messages they wish, also when the Tor protocol is employed (Biryukov and Pustogarov, 2015).
• Software centrality: To what extent is the safety of the DLT dependent on the security of the software on which it runs? Each DLT has a privileged set of entities that can potentially modify past transactions: software developers and maintainers. They represent a centralized point of trust in the system, susceptible to targeted attacks; for example, there are currently four active contributors who have access to modify the Bitcoin Core code base. Software bugs can lead to consensus errors and change the state of the blockchain. In this case, trust in software development is to accept the immutability of the ledger and believe that the programmers have not introduced a bug. A not-so-popular alternative is to update the code off-chain, which shares the same trust issues as a centralized approach.

Some other problems are inherent to the P2P nature of decentralized, permissionless systems. Lopez et al. (2019) argue that decentralized, permissionless blockchains remain ill-suited. The first problem they analyze is the free-riding and incentives for peers. The issue is that, generally, peers do not donate their computing, storage, and bandwidth resources for altruistic reasons, i.e., without incentives. This led to the creation of mining pools and large mining industries, making it impossible for an average user to mine with an ordinary desktop computer to receive compensation. The second problem depicted by the authors regards the security and fragility of open permissionless networks, as attackers, in this case, have economic incentives to break the system. The third problem is a performance issue due to instability, heterogeneity, and churn in the P2P network. The “fatal” issue of P2P networks is that they show high heterogeneity and high degrees of churn, i.e., nodes that dynamically come and go in the system. In DLTs, this translates into the scalability trilemma: a DLT can only address two of the three scalability, decentralization, and security challenges. The solution to this is the employment of so-called layer-two or off-chain solutions that increase the system’s complexity. In fact, the fourth problem taken into consideration is system complexity and maintenance. Programming distributed systems that must be fault-tolerant, self-adjusting, and scalable is challenging.

Permissioned decentralized systems come to the rescue

If trust can be a pivotal element in making the promises of (permissionless) decentralized systems vain, at the same time, it can be that element that, if reinterpreted, can tell us why these systems could bring significant benefits in different contexts. Becker and Bodó (2021) define trust as a complex social phenomenon with interrelated individual and systemic aspects, a relational attribute between a social actor and other actors (interpersonal) and/or actors and institutions (institutional) and institutions and actors (shared expectations). The discussion on trust in DLT spans from the technological to the legal-social to the economic context. If we first need to clarify what trust means academically, its relationship with DLTs can be delineated: “does blockchain increase trust, decrease trust, make trust obsolete, or represent a shift in the nature of trust?” (Becker and Bodó, 2021). A DLT can be considered trustless or trust-free, i.e., that takes care of trust issues and frees individuals from the necessity of implementing mechanisms to signal or convey trust (Beck et al., 2016), or not wholly trustless, i.e., replacing interpersonal trust with trust in the DLT itself (miners, consensus mechanisms, nodes), software developers or new intermediaries (cryptocurrency exchanges). De Filippi et al. (2020) define this not wholly trustlessness as confidence, and thus the DLT becomes a “confidence machine” in the sense that it increases the confidence in the operation of a particular system. The authors argue that creating solid expectations about the correct behavior of operations performed by DLTs increases user confidence, thus eliminating the need for a centralized “trusted” authority. Therefore, confidence in DLTs ultimately depends on the proper governance of the system. This means increased confidence is intrinsically related to the degree to which the various actors involved in governance act as expected.

Both trustless and confidence visions mainly apply to the permissionless case, while permissioned DLTs are usually not considered trustless, as they afford one or more organizations in a maintaining role that need to be trusted. Nevertheless, the members of the latter kind of DLT do not necessarily trust each other, as problems such as authorization and auditing are intrinsic to permissioned DLTs. Although not fully decentralized by design, the governance structure of permissioned systems can also ensure some level of decentralization. As discussed above, in the absence of formal checks for the underlying centralization forces of permissionless systems, centralization emerges in practice. On the other hand, permissioned decentralized systems often operate thanks to contractual agreements between the entities that implement the governance aspect for the system’s operations. Permissioned refers mainly to access to information and governance aspects. In this regard, decentralized systems can be characterized on three key dimensions (Bakos et al., 2021):

1. architecture, which can be concentrated or distributed;
2. access, which can be permissionless or permissioned; and
3. control, which can be centralized or decentralized.

Even if permissioned DLTs are often compared to “not so interesting” distributed databases, when these systems are designed to streamline and convey business relations (that already require trust), they can be more effective than a non-DLT system in the transfer, clearing, and traceability of exogenous assets or rights (Bakos et al., 2021). Permissioned blockchains and the execution of smart contracts on top of them may enable trust, or, better say, confidence, between many players for the validation of contractual obligations (Lopez et al., 2019). Business relationships require trust in the operational and institutional setting, action accountability, and reputation. What permissioned DLT can bring is to achieve higher security at lower levels of trust that any single participant can be induced not to deviate from the protocol (Bakos and Halaburda, 2021). Permissioned DLT entities are identifiable outside the DLT, i.e., off-chain, and are thus subject to penalties imposed by the institutional setting.

The permissioned DLT is then a unique framework for collaboration in competition scenarios.

Entities competing at a business level can cooperate for other purposes through permissioned DLTs (Bakarich and Castonguay, 2021). Unlike a traditional distributed database, no central entity manages and protects the data. Instead, all “business-competing” permissioned DLT nodes control, maintain, and guard the information posted to it, providing an additional layer of control if one of the parties attempts to alter or change previously agreed-upon information. In this way, the ledger can securely and efficiently create a tamper-proof log of sensitive activity. The trust placed in off-chain negotiations between two or more entities, whether institutional or shared expectations, can allow for the design of consensus mechanisms where a large number of validator nodes have a say in the validation process (Bakos et al., 2021). Thus, the primary ability that (permissioned) decentralized systems can provide to their users when reinterpreted as a confidence machine is “gaining truth through the ability to share data safely” (Hardjono et al., 2019).

For Lopez et al. (2019), permissioned systems are of great value when used in environments composed by a collection of players or stakeholders that do not fully trust each other: supply chain & logistics, to trace products while different actors and companies handle them, without having to trust every node in the chain explicitly; healthcare, for the secure sharing of health data across hospitals and platforms; education, for validating of academic credentials and certifications, utilities, such as smart power grids with distributed power generation from both residential and businesses. Even if a centralized system for each case were feasible, such an approach would lack the flexibility of the evolution and portability of members and services and interoperability with other external DLTs and/or services. As an example, the European Blockchain Services Infrastructure (EBSI) (European Blockchain Partnership EBP, 2022) could become a superhub for a myriad of lesser national/local networks: DLT islands will emerge around the world in different sectors (Lopez et al., 2019). The EBSI leverages a permissioned DLT where each EU member state maintains nodes to accelerate the creation of cross-border services for public administrations. The DLT enables the EBSI ecosystem to verify the information and to make services more trustworthy, changing the traditional pattern of data sharing due to its distributed nature. In there, the ledger acts as a point of truth that supports the verification of the entities involved in the transaction and the authenticity of information without requiring real-time access to the source of information.

In conclusion, six key aspects can be guaranteed in for the data management in a permissioned decentralized setting:

• DLTs can provide a single source of verifiable truth among organizations and some level of appropriate automation of data processing.
• Organizations can arrange a form of governance to decide the distributed sources of trust and to moderate such permissioned systems.
• The authority can be distributed among many trusted actors so that compromise of one or even a few authorities does not destroy the consensus.
• Intrinsic cryptographical properties of DLTs can enable distributed safe computation and data minimization.
• The networked collaboration environment can be easily exploited for the audit and accountability of operations.
• P2P networks offer a valuable solution for data resiliency and scalability.

More on this in my Ph.D. Thesis…

References

Backx, P., Wauters, T., Dhoedt, B., and Demeester, P. (2002). A comparison of peer-to-peer architectures. In Eurescom Summit, volume 2. Citeseer.

Bakarich, K. and Castonguay, J. J. (2021). Using a permissioned blockchain? The CPA Journal, 91(6/7):48–51.

Bakos, Y. and Halaburda, H. (2021). Tradeoffs in permissioned vs permissionless blockchains: Trust and performance. NYU Stern School of Business working paper.

Bakos, Y., Halaburda, H., and Mueller-Bloch, C. (2021). When permissioned blockchains deliver more decentralization than permissionless. Communications of the ACM, 64(2):20–22. i, ii, iii, v, vi

Beck, R., Czepluch, J. S., Lollike, N., and Malone, S. (2016). Blockchain–the gateway to trust-free cryptographic transactions. In Twenty-Fourth European Conference on Information Systems (ECIS), ˙Istanbul, Turkey, 2016, pages 1–14. Springer Publishing Company.

Becker, M. and Bodó, B. (2021). Trust in blockchain-based systems. Internet Policy Review, 10(2):1–10.

Biryukov, A. and Pustogarov, I. (2015). Bitcoin over tor isn’t a good idea. In 2015 IEEE Symposium on Security and Privacy, pages 122–134. IEEE.

De Filippi, P., Mannan, M., and Reijers, W. (2020). Blockchain as a confidence machine: The problem of trust & challenges of governance. Technology in Society, 62:101284.

European Blockchain Partnership EBP (2022). European blockchain services infrastructure. https://ec.europa.eu/digital-building-blocks/wikis/display/EBSI/Home.

Finocchiaro, G. and Bomprezzi, C. (2020). Legal analysis of the use of blockchain technology for the formation of smart legal contracts. Media Laws Rivista di Diritto dei Media.

Hardjono, T., Shrier, D. L., and Pentland, A. (2019). 2 TOWARDS AN INTERNET OF TRUSTED DATA, pages 15–40. MIT Press.

Kwon, Y., Liu, J., Kim, M., Song, D., and Kim, Y. (2019). Impossibility of full decentralization in permissionless blockchains. In Proceedings of the 1st ACM Conference on Advances in Financial Technologies, pages 110–123. iii

Lopez, P. G., Montresor, A., and Datta, A. (2019). Please, do not decentralize the internet with (permissionless) blockchains! In 2019 IEEE 39th International Conference on Distributed Computing Systems (ICDCS), pages 1901–1911. IEEE.

Nakamoto, S. (2009). Bitcoin: A peer-to-peer electronic cash system.

Schneier, B. (2019). Blockchain and trust. https://www.schneier.com/blog/archives/2019/02/blockchain_and_.html. ii

Schneier, B. (2022). On the dangers of cryptocurrencies and the uselessness of blockchain. https://www.schneier.com/blog/archives/2022/06/on-the-dangers-of-cryptocurrencies-and-the-uselessness-of-blockchain.html. ii

Serena, L., D’Angelo, G., and Ferretti, S. (2020). Implications of dissemination strategies on the security of distributed ledgers. In Proceedings of the 3rd Workshop on Cryptocurrencies and Blockchains for Distributed Systems, pages 65–70.

Trail of Bits (2022). Are blockchains decentralized? Technical report, Trail of Bits.

Waldo, J. (2019). A hitchhiker’s guide to the blockchain universe. Communications of the ACM, 62(3):38–42.

Wikipedia community (2022). Decentralised system. ipfs://zdj7WX5pBeuj18FDbNqxv55msheeEwFnmcRExintmC2men7ZS/wiki/Decentralised_system.

Ye, C., Li, G., Cai, H., Gu, Y., and Fukuda, A. (2018). Analysis of security in blockchain: Case study in 51%-attack detecting. In 2018 5th International conference on dependable systems and their applications (DSA), pages 15–24. IEEE

versione in italiano

The ideological and technological foundations of Web 2.0 have been exploited by social media and, in general, by online services to build platforms that enable the creation and exchange of users’ generated content (Kaplan and Haenlein, 2010). Primarily by leveraging mobile personal devices, online services provide users the foundation for information dissemination, content generation, and interactive communications of the modern era. Information Communication Technologies (ICTs) and their ubiquitous computing are modifying our world by creating new realities and promoting an informational interpretation of our lives (Floridi, 2014). An example is Web 2.0, which at the start of the new millennium has favored a process that broke the boundaries between Internet consumption and participation: the users of the Web produce the data that other users consume. This great innovation has led to reduced friction in disseminating information online, with great benefits for the entire world population. However, this significant influence on informational friction brings with it great concerns about the privacy of the users who inhabit the online/offline (onlife) world (Floridi, 2014). Internet users act not just as content consumers but mainly as content creators. It implies that the content they share often consists of highly personal data belonging to them or their family, friends, and colleagues. Location, interests, their general behavior are all data points derived from their textual data (comments, posts), actions (sharing, reactions, likes), social network topology (friendships, following system), hyperlinks, or metadata.

It is a revolutionary fact that “new” ICTs, such as Online Social Network (OSN) platforms, do not produce most of the data they handle by themselves, as the “old” ICTs, such as broadcast-based traditional and industrial media, usually do. This kind of data concerns ICTs users’ static personal attributes and, due to the spread of mobile devices, also dynamic information extracted by their activities (Altshuler et al., 2012). Smartphones are the primary source of this information since, through their mobile computation, set of sensors, and Internet connectivity, they can measure several aspects of an individual’s physical environment. Hence the birth of a digital world, created upon peoples’ actions, interests, and desires given in input in the form of data to firms that operate ICTs on a large scale. There is a large number of vendors in the digital marketing industry whose only purpose is to collect ICTs users’ data and transform it into actionable information, i.e., create detailed profiles and user segments for prediction, attribution, and insights. Raw users’ generated data is accessed and transformed by data aggregators and brokers, processed to obtain more sophisticated forms, referenced by analytics vendors, and sold to third parties (e.g., retailers, market researchers, brands) for prediction, attribution, and insights (Acquisti et al., 2016; Banerjee, 2019).

In the following subsections, we will go into the details of the protection and portability of personal data and the privacy threats arising from the current uses of new ICTs.

How a piece of information can be influential to your privacy

First of all, let us clarify that throughout this article, the reference to privacy will be mainly associated with the concept of informational privacy.

Informational privacy is an individual’s freedom from informational interference or intrusion achieved by a restriction on facts about him or her that are unknown or unknowable.

At the basis of this vision of Floridi (2014), we find the vision of Westin (1967), stating that privacy is the claim of individuals, groups, or institutions to determine for themselves when, how, and to what extent information about them is communicated to others. Generally speaking, the privacy threat associated with Web-2.0-based services is that, although many users have some information they keep private, they are not aware that a significant part of information about them is generated from other information sources (Acquisti et al., 2016; Forbrukerrådet, 2020; Kamleitner and Mitchell, 2019). It makes each individual less free from informational interference. It creates a lack of control to determine information about them is (possibly) communicated to others.

The reason for this lies in the foundations of the current ICTs structure. The exploitation, i.e., economics, of personal data is helped by the more pervasive nature of today’s digital world. When fundamental aspects of one’s life are recreated online, his or her “digital twin” can be depicted not only by using his or her information but also by others thanks to social networks (Forbrukerrådet, 2020). Thus, it becomes easier to understand one’s activity choice and lifestyle patterns (Hasan et al., 2016) and then to make intrusive recommendations using this information (Bothorel et al., 2018; Partridge and Price, 2009). In practice, informational interference techniques can reduce some data protection mechanisms to render these almost ineffective. For instance, adding “side information”, even with a small amount of background data, most anonymous or pseudo-anonymous datasets regarding users’ online platforms interaction can be de-anonymized (Ma et al., 2010). De Montjoye et al. (2013) provide a study that shows how just four approximate location data points are sufficient to identify an individual in 95% of cases. When personal data are enriched with Point of Interest, people’s activities can be inferred (He et al., 2019). Home and work location information are usually the first (and the easiest) to be inferred (Pontes et al., 2012). Then, simply by knowing these two locations, it is possible to recognize one’s activity patterns through his or her peers (Phithakkitnukoon et al., 2010) or his or her friends (Cho et al., 2011). When social media site information comes along, it can only get better (or worse, depending on the point of view). Qian et al. (2016) use knowledge graphs to combine background knowledge and anonymous OSNs data to identify individuals and discover their personal attributes. OSNs often track and collect the location of their users when providing their services. This monitoring can continue even when users are not logged in or have never used those services. Sadilek et al. (2012) show how to infer social links, i.e., friendship in OSNs, considering the patterns in link formation, the content of users’ messages, and their location. Bonneau et al. (2009) demonstrate that eight public social links are enough to infer the entirety of your social circle. Jurgens (2013) shows how, by exploiting only a small number of initial locations, it is possible to infer fine-grained users’ location even when they keep their location data private, but their friends do not. Indeed, it is not enough for an individual to fully protect his or her activity information if it is possible to obtain “co-location” information from his or her friends (Olteanu et al., 2014). Co-location may consist of data, e.g., a friend’s picture or message posted on the OSNs (Ajao et al., 2015), and metadata, e.g., two users connecting to the OSNs with the same IP address or spatiotemporal correlations in OSNs streams (Yamaguchi et al., 2014).

Sensitive personal data, such as location data combined with other data (Keßler and McKenzie, 2018), are substantially different from the rest of personal data. The ability to track individuals’ locations and movements and to combine this data with other metadata and background knowledge allows first and third-party companies to make inferences such as, for instance, visiting a church weekly (i.e., religious affinity) or attending climate strikes (i.e., political views). Data protection thus becomes crucial, as it concerns the vast majority of the population, who are often unaware of how the underlying ICTs work and how most sensitive information can be deduced simply by using other information obtained from them.

The above inference techniques demonstrate that the “nothing to hide” approach to privacy, often raised by some people, is fundamentally flawed for many reasons: the main one is that everyone has information they want to keep private. However, many do not know that such information can be deduced from other data sources generated from someone else (Kamleitner and Mitchell, 2019). Citing Floridi (2014) in his work on how ICTs affect our sense of self and interaction with the world, he defines ourselves as informational organisms, mutually connected and embedded in an informational environment, i.e., the infosphere. The informational organism, i.e., inforg, is a set of points obtained by interacting with other organisms that are natural agents, e.g., family, friends, strangers, or artificial agents, e.g., the same digital ICTs that gather these data points. In the infosphere, individuals are de-individualized, re-identified as crossing points of many “kinds of”, and then treated like a commodity and sold or bought in the advertising market (Zuboff, 2019). Acquiring personal information enables large firms and organizations operating in the digital world to provide personalized or more valuable services in digital and physical spaces. However, it could also have potentially harmful consequences for the privacy and autonomy of users and society at large. Lack of privacy control, for instance, leads an individual to be thrown into a “filter bubble” that can affect his ability to choose how he wants to live, simply because the companies that build this bubble choose which options he can be aware of (Pariser, 2011). On a social level, this scheme can lead to a deeper polarization and manipulation of society (Cadwalladr and Graham-Harrison, 2018; Christl et al., 2017) and to “geoslavery” in the case of location information (Dobson and Fisher, 2003). After being categorized through personalities, predispositions, and secret desires, each consumer’s digital twin is bought and sold on a vast market that operates largely outside his sphere, namely the digital marketing and the adtech industry. All to persuade individuals to buy particular products or to act in a certain way (Forbrukerrådet, 2020).

The legal support to personal data protection and portability

The General Data Protection Regulation (GDPR) was enacted into law in 2016 (European Parliament, 2016) to protect the personal data of European Union (EU) citizens and to allow the free movement of such data within the EU. According to Article 4(1), personal data are “any information relating to an identified or identifiable natural person; (…) identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the (…) identity of that natural person”. The GDPR builds upon, or better “runs in parallel to”, the Privacy and Electronic Communications Directive (ePrivacy Directive) (European Parliament, 2002) that applies to the data protection and privacy in electronic communications networks and services for the EU citizens. The ePrivacy Directive includes language requiring providers to secure the data they carry by taking “appropriate technical and organizational measures to safeguard the security of its services”. Generally, it regulates how third parties collect consent to access information stored on individuals’ devices. After the 2009 amendment, it explicitly deals with web cookies, requiring the user’s consent for processing. The GDPR, on the other hand, conveys control to the data subject, i.e., any natural person identified or identifiable by the kind of data defined above, by imposing several accountability measures on the actor responsible for the data processing and by assigning a set of rights to subjects, i.e., as “natural persons should have control of their own personal data” (Recital 7). The data controller, i.e., the natural or legal person, public authority, agency, or other body which, alone or jointly with others, determines the purposes and means of processing personal data, plays a central role in the interactions between the various interested parties. Indeed, they are being called into action by the data subjects for the exercise of their rights, and they are rendered liable in the event of a violation of the rules by the data processors, i.e., the body which processes personal data on behalf of the controller. Processors have their obligations under the GDPR, although they ultimately report to the data controller. Within this framework, because of increased technological complexities and multiple data-exploiting business practices, it is becoming harder for ICTs users to gain control over their data. Individual control, particularly concerning one’s person, has been described as a reflection of fundamental values such as autonomy, privacy, and human dignity. In regards to this, the GDPR sets first some legal obligations about data processing: (i) data must be processed lawfully, fairly, and transparently; (ii) data must be collected for specified, explicit, and legitimate purposes only (purpose limitation); (iii) data must be limited to data required for the entity’s defined purposes (data minimization); (iv) data must be accurate and up-to-date. The idea of control over personal data, then, comes to the front in the provisions of six legal bases (Article 6(1)(a)) for data processing:

1. Consent, the data subject has given consent to the processing of his or her data for one or more specific purposes.
2. Performance of a contract, the data processing activity is necessary to enter into or perform a contract with the data subject.
3. Legal requirement, the processing activity is necessary for a legal obligation, such as information security, employment, or consumer transaction law.
4. Vital interest, the processing activity that could be necessary to save someone’s life.
5. Public interest, the processing activity for a task carried out in the public interest or in the exercise of official authority vested in the controller.
6. Legitimate interest, the processing activity of data subjects’ data in a way they would reasonably expect and which would have a minimal impact on their privacy.

The GDPR impact on businesses

The GDPR has had (and is having) a worldwide impact on establishing how to promote a view in favor of the interests of individuals as opposed to large companies and corporations (Li et al., 2019). For instance, it has been followed by other regulations around the world, such as the California Consumer Privacy Act (California State Legislature, 2020) in the USA. In economic terms, however, it can be argued that the GDPR affects the options available to firms to collect the data they need for their operations and the resulting ability to achieve economies of scale in data analysis (Gal and Aviv, 2020). Ensuring the lawfulness of data processing, such as obtaining each data subject’s explicit and informed consent for all the specific uses of the data pertaining to him or her, is costly, and large and diversified data controllers enjoy an advantage. Moreover, a data controller is liable to the data subject to ensure that her data are used only under his or her rights. Thus, the costs imposed by this requirement may include ongoing monitoring, screening, and auditing of the processing performed by a data receiver. The declared intention of the GDPR is not to prevent the exploitation of personal data but to ensure that such exploitation is performed in accordance with the data subjects. However, this approach has a direct impact on business activities for (Ziegler et al., 2019): (i) risk management, the necessity to better control the risks related to personal data protection and the exposition to GDPR-related sanctions and penalties; (ii) data subject rights ownership and control, the design and implement systems with the data subjects at the core of the model; (iii) purpose consistency, when the controller wants to substantially extend the use of the collected data, it should collect a complementary consent; (iv) data transfer to third parties, firms must map, manage, monitor, and control the way they process and share data; (v) cross-border transfer, the requirement to control cross-border data transfers toward non-trusted countries.

Privacy, data protection, and the user control

There is an essential distinction between privacy and data protection that would be limited to the discussion in this article but that has been discussed extensively in other studies (Kokott and Sobotta, 2013; Westin, 1967; Zuboff, 2019). Assigning a value to informational privacy is different from the protection of the actual personal information related to the individual making the assignment. Privacy controls are mainly in the hands of individuals and the system’s users. However, privacy also depends on the protection of personal data, which, on the contrary, is primarily the responsibility of the entity controlling the data, i.e., entities operating in the ICTs digital world. From the point of view of the user of an ICT system, being a data subject, it is possible to distinguish it into three types of personal data (Pangrazio and Selwyn, 2019):

1. volunteered, data that users give to ICTs systems they are using in exchange for an often “free” service and that may be unconsciously disclosed;
2. observed, data that ICTs systems extract from their users by monitoring them;
3. inferred, data that ICTs systems obtained by processing the last two types created often beyond their users’ knowledge.

These types of personal data are moved through three main links along the data value chain: collection, processing, and use of data-generated information and knowledge (Gal and Aviv, 2020). The collection is the extraction of the data and its “datafication”, i.e., the recording, aggregation, and organization of information. Processing consists of optimizing, cleaning, parsing, or combining different datasets to organize the data for future extractions and to find correlations. It can transform the raw data into information and can create knowledge. Finally, data use means employing data-based information or knowledge for prediction and decision-making in relevant markets.

How does GDPR enhance ICTs systems users’ control over personal data in this data value chain? The GDPR, indeed, according to the principle of accountability, imposes the obligation to adopt and account for protection measures to the data controller. This one needs to ensure that data is protected and that the level of privacy its users have set is implemented. Therefore, the question that brings up the central issue here is: even if the data controller makes sure to adopt an “adequate” response in proportion to the assessment it has made of the level of risk to the rights and freedoms of the data subject, is the latter able to determine the level of privacy concerning the personal data being protected by the former? The answer to this question requires two layers of analysis: a surface layer and a deeper layer.

Privacy at the surface layer

The first layer comprises the interface methods with which users interact to assess privacy levels and determine the level at which they want to set their privacy. Interfaces here consist of the hardware and software tools that inform and make users decide on actions that have direct consequences on data protection and indirect consequences on data privacy. We specifically refer to smartphone apps, browsers, websites, and similar. In the context of the GDPR, consent is the one that is usually leveraged in these cases in order to process collected data. However, the general problem here is that users often do not seem to think about the consequences of providing (or refusing) consent but, instead, consent whenever they are confronted with a request (Custers et al., 2013). Users generally interface with informed consent through privacy notices (e.g., cookie notices) and user control options at the operating system level. However, these are ineffective for users because they are presented in different and inconsistent ways across services and platforms; worse, most are not GDPR compliant (Mehrnezhad, 2020). Many of the current notices implementations offer no meaningful choice to users. For example, in the case of third-party cookies, a more appropriate implementation would require service providers to use consent notices that would effectively result in less than 0.1% of users consenting to their use (Utz et al., 2019). Cookies, in particular, can assume the form of personal data and are essential by themselves because they have become the backbone of a vast market infrastructure based on their ability to transform information about users’ online behavior into data assets (Mellet and Beauvisage, 2020).

In their work, Van Ooijen and Vrabec (2019) identify three stages in consent-based data processing: (i) the information receiving stage, (ii) the approval and primary use stage, and (iii) the secondary data use (reuse) stage. In the first stage, the threats to users’ control are given by the fact that, even if data collectors may provide individuals’ information employing a data use policy, these have difficulties in cognitively processing such information. As a result of the rapid development of technology, such policies are becoming more time-consuming and more complex, resulting in increased pressure on the cognitive functioning of individuals. Moreover, this approach fails to address the problem of information complexity, as it needs to explain the real implications of automated decision-making for an individual. What the GDPR guarantees, with the right to explanation, is an ex-ante motivation that merely refers to the system’s functionality. Icons may be more successful in mitigating informational complexity, but there is a risk that they may worsen the problem of bias in decision-making (Rossi and Palmirani, 2020). The threats to users’ control at the second stage, i.e., the approval and primary use stage, are steered by subtle changes in the context wherein consent is requested, such as system architectures based on default settings. These can unconsciously steer users’ behavior in a phenomenon coined “the malleability of privacy preferences” (Acquisti et al., 2016). Consumers generally prefer and choose the option marked as the default when presented with several choice options. GDPR addresses these threats by validating consent only on the presupposition that a data subject has fully understood the consequences of his or her approval. However, this must be implemented in a way that indeed empowers individuals. Finally, in the third stage identified by Van Ooijen and Vrabec (2019), the threats over users’ control are given by the limited scope of the right to access and portability for individuals. The authors foresee the use of electronic data platforms where individuals can manage their own data.

Privacy at the deeper layer

The second layer of analysis, which is deeper than the previous one, interests the relationship between a user and the information itself in terms of information complexity and privacy perception. In perceiving privacy when they disclose personal information, users come across a privacy paradox that most of the time is not in their favor: while the attitude of users is to profess their need for privacy, in their behavior, most of them remain consumers of the same technologies that collect their personal data (Norberg et al., 2007). Two resolutions can be attributed to this: firstly, the fact that attitudes (e.g., the attitude of practicing high privacy awareness) are usually expressed generically, while behaviors (e.g., the actual data disclosure act) are more specific and contextual (Fishbein and Ajzen, 1977); secondly, users engage in a mental trade-off between privacy concerns and disclosure benefits, performing a “privacy calculus” (Laufer and Wolfe, 1977). When consumers are asked to provide personal information to companies, they will disclose their information based on a decision made after a risk-benefit analysis, i.e., the privacy calculus, analogously to estimating the perceived value. Xu et al. (2011) define this perceived value of information disclosure as the individual’s overall assessment of the utility of information disclosure based on perceptions of privacy risks incurred and benefits received. However, two main challenges hinder the correct estimation of this value. First, there is a problem of information overload that stands in the way of a correct estimation in the privacy calculus. This is because users need to consider all the information that is made available in the collector’s data use policies, together with the vast amount of information spread across different devices, media, and services. This richness of information threatens the ability and motivation of individuals to examine the critical details needed to make informed privacy decisions (Van Ooijen and Vrabec, 2019). Secondly, a problem of information complexity arises (Acquisti et al., 2016).

Most ITCs users need to learn the sophistication of how they can be tracked or to be aware of possible alternative solutions to their privacy concerns, e.g., the use of privacy-enhancing technologies (PETs).

Taking as an example a specific kind of sensitive personal data, i.e., location data, the perception of location privacy falls under the same assumptions of the privacy calculus. In particular, the determination of location privacy can assume a numerical quantity, as shown by Shokri et al. (2011), based on the idea that users’ privacy and the success of an “adversary” in his location-inference attacks are two sides of the same coin. The authors quantify location privacy as the error of the adversary in estimating the actual user’s location information (given an attack model of reference). In a more consumer-oriented definition, location privacy consists of the user’s ability to regulate external audiences’ access to information about his or her current or past locations (Banerjee, 2019). This view is in line with Westin’s and IAPP’s definitions of information privacy, i.e., based on the assumption that “privacy is not the opposite of sharing – rather, it is control over sharing” (Acquisti et al., 2016)

A solution for the long (and perhaps also short) run

Distributed Ledger Technologies (DLT) no longer need to be introduced. Its ledger, distributed among a network of nodes, and the decentralized protocol eliminate the need for a trusted authority and replace it with a system of publicly verifiable evidence. This technology provides the means for disintermediation as it increases confidence in the functioning of its particular system and indirectly reduces the need for trust in the system (De Filippi et al., 2020). The “Web3” or Web 3.0 comes along trying to exploit the advantages that decentralized system might provide in order to build upon Web 2.0, a version of the Internet in which users are truly sovereign over their data and actions, e.g., by owning the unique piece of information that might enact an operation such as a private key. From the perspective of individuals, these technologies help to move computing applications, data, and services towards the edge of the “Internet of Persons”, i.e., closer to them, as personal devices compose the frontiers of such a network of devices. For many scholars, DLTs, combined with decentralized identity mechanisms, could become the necessary building blocks for the decentralized Internet of the future that can benefit users’ privacy (Kondova and Erbguth, 2020; Lopez and Farooq, 2020; Lopez et al., 2019).

More on this in my Ph.D. Thesis…

References

Acquisti, A., Taylor, C., and Wagman, L. (2016). The economics of privacy. Journal of economic Literature, 54(2):442–92.

Ajao, O., Hong, J., and Liu, W. (2015). A survey of location inference techniques on twitter. Journal of Information Science, 41(6):855–864.

Altshuler, Y., Aharony, N., Fire, M., Elovici, Y., and Pentland, A. (2012). Incremental learning with accuracy prediction of social and individual properties from mobilephone data. In 2012 International Conference on Privacy, Security, Risk and Trust and 2012 International Confernece on Social Computing, pages 969–974. IEEE.

Article 29 Working Party (2014). Opinion 06/2014 on the notion of legitimate interests of the data controller under article 7 of directive 95/46/ec.

Banerjee, S. (2019). Geosurveillance, location privacy, and personalization. Journal of Public Policy & Marketing, 38(4):484–499.

Bonneau, J., Anderson, J., Anderson, R., and Stajano, F. (2009). Eight friends are enough: social graph approximation via public listings. In Proceedings of the Second ACM EuroSys Workshop on Social Network Systems, pages 13–18.

Bothorel, C., Lathia, N., Picot-Clemente, R., and Noulas, A. (2018). Location recommen- dation with social media data. In Social Information Access, pages 624–653. Springer.

Cadwalladr, C. and Graham-Harrison, E. (2018). Revealed: 50 million facebook profiles harvested for cambridge analytica in major data breach. The guardian, 17:22.

California State Legislature (2020). California consumer privacy act.

Cho, E., Myers, S. A., and Leskovec, J. (2011). Friendship and mobility: user movement in location-based social networks. In Proceedings of the 17th ACM SIGKDD international conference on Knowledge discovery and data mining, pages 1082–1090.

Christl, W., Kopp, K., and Riechert, P. U. (2017). How companies use personal data against people. Automated Disadvantage, Personalized Persuasion, and the Societal Ramifications of the Commercial Use of Personal Information. Wien: Cracked Labs.

Custers, B., van Der Hof, S., Schermer, B., Appleby-Arnold, S., and Brockdorff, N. (2013). Informed consent in social media use-the gap between user expectations and eu personal data protection law. SCRIPTed, 10:435.

De Filippi, P., Mannan, M., and Reijers, W. (2020). Blockchain as a confidence machine: The problem of trust & challenges of governance. Technology in Society, 62:101284.

De Montjoye, Y.-A., Hidalgo, C. A., Verleysen, M., and Blondel, V. D. (2013). Unique in the crowd: The privacy bounds of human mobility. Scientific reports, 3:1376.

Dobson, J. E. and Fisher, P. F. (2003). Geoslavery. IEEE Technology and Society Magazine, 22(1):47–52.

European Parliament (2002). Privacy and electronic communications directive 2002/58/ec.

European Parliament (2016). Regulation (eu) 2016/679.

Fishbein, M. and Ajzen, I. (1977). Belief, attitude, intention, and behavior: An introduc- tion to theory and research. Philosophy and Rhetoric, 10(2).

Floridi, L. (2014). The fourth revolution: How the infosphere is reshaping human reality. OUP Oxford.

Forbrukerrådet (2020). Out of control – how consumers are exploited by the online advertising industry.

Gal, M. S. and Aviv, O. (2020). The competitive effects of the gdpr. Journal of Competition Law & Economics, 16(3):349–39 Hasan, S., Ukkusuri, S. V., and Zhan, X. (2016). Understanding social influence in activity location choice and lifestyle patterns using geolocation data from social media. Frontiers in ICT, 3:10.

He, R., Cao, J., Zhang, L., and Lee, D. (2019). Statistical enrichment models for activity inference from imprecise location data. In IEEE INFOCOM 2019-IEEE Conference on Computer Communications, pages 946–954. IEEE.

Jurgens, D. (2013). That’s what friends are for: Inferring location in online social media platforms based on social relationships. In Seventh International AAAI Conference on Weblogs and Social Media.

Kamleitner, B. and Mitchell, V. (2019). Your data is my data: A framework for addressing interdependent privacy infringements. Journal of Public Policy & Marketing, 38(4):433– 450.

Kaplan, A. M. and Haenlein, M. (2010). Users of the world, unite! the challenges and opportunities of social media. Business horizons, 53(1):59–68.

Keßler, C. and McKenzie, G. (2018). A geoprivacy manifesto. Transactions in GIS, 22(1):3–19.

Kokott, J. and Sobotta, C. (2013). The distinction between privacy and data protection in the jurisprudence of the cjeu and the ecthr. International Data Privacy Law, 3(4):222–228.

Kondova, G. and Erbguth, J. (2020). Self-sovereign identity on public blockchains and the gdpr. In Proceedings of the 35th Annual ACM Symposium on Applied Computing, pages 342–345.

Laufer, R. S. and Wolfe, M. (1977). Privacy as a concept and a social issue: A multidi- mensional developmental theory. Journal of social Issues, 33(3):22–42.

Li, H., Yu, L., and He, W. (2019). The impact of gdpr on global technology development.

Lopez, D. and Farooq, B. (2020). A multi-layered blockchain framework for smart mobility data-markets. Transportation Research Part C: Emerging Technologies, 111:588– 615.

Lopez, P. G., Montresor, A., and Datta, A. (2019). Please, do not decentralize the internet with (permissionless) blockchains! In 2019 IEEE 39th International Conference on Distributed Computing Systems (ICDCS), pages 1901–191 IEEE.

Ma, C. Y., Yau, D. K., Yip, N. K., and Rao, N. S. (2010). Privacy vulnerability of published anonymous mobility traces. In Proceedings of the sixteenth annual international conference on Mobile computing and networking, pages 185–196.

Mehrnezhad, M. (2020). A cross-platform evaluation of privacy notices and track- ing practices. In 2020 IEEE European Symposium on Security and Privacy Workshops (EuroS&PW), pages 97–106. IEEE.

Mellet, K. and Beauvisage, T. (2020). Cookie monsters. anatomy of a digital market infrastructure. Consumption Markets & Culture, 23(2):110–129.

Norberg, P. A., Horne, D. R., and Horne, D. A. (2007). The privacy paradox: Per- sonal information disclosure intentions versus behaviors. Journal of consumer affairs, 41(1):100–126.

Olteanu, A.-M., Huguenin, K., Shokri, R., and Hubaux, J.-P. (2014). Quantifying the effect of co-location information on location privacy. In International Symposium on Privacy Enhancing Technologies Symposium, pages 184–203. Springer.

Pangrazio, L. and Selwyn, N. (2019). ‘personal data literacies’: A critical literacies approach to enhancing understandings of personal digital data. New Media & Society, 21(2):419–437.

Pariser, E. (2011). The filter bubble: What the Internet is hiding from you. Penguin UK.

Partridge, K. and Price, B. (2009). Enhancing mobile recommender systems with activity inference. In International Conference on User Modeling, Adaptation, and Personalization, pages 307–318. Springer.

Phithakkitnukoon, S., Horanont, T., Di Lorenzo, G., Shibasaki, R., and Ratti, C. (2010). Activity-aware map: Identifying human daily activity pattern using mobile phone data. In International Workshop on Human Behavior Understanding, pages 14–25. Springer.

Pontes, T., Magno, G., Vasconcelos, M., Gupta, A., Almeida, J., Kumaraguru, P., and Almeida, V. (2012). Beware of what you share: Inferring home location in social networks. In 2012 IEEE 12th International Conference on Data Mining Workshops, pages 571–578. IEEE.

Qian, J., Li, X.-Y., Zhang, C., and Chen, L. (2016). De-anonymizing social networks and inferring private attributes using knowledge graphs. In IEEE INFOCOM 2016-The 35th Annual IEEE International Conference on Computer Communications, pages 1–9. IEEE.

Rossi, A. and Palmirani, M. (2020). What’s in an icon? promises and pitfalls of data protection iconography. Data Protection and Privacy: Data Protection and Democracy, pages 59–92.

Sadilek, A., Kautz, H., and Bigham, J. P. (2012). Finding your friends and following them to where you are. In Proceedings of the fifth ACM international conference on Web search and data mining, pages 723–732.

Shokri, R., Theodorakopoulos, G., Le Boudec, J.-Y., and Hubaux, J.-P. (2011). Quantify- ing location privacy. In 2011 IEEE symposium on security and privacy, pages 247–262. IEEE.

Utz, C., Degeling, M., Fahl, S., Schaub, F., and Holz, T. (2019). (un) informed consent: Studying gdpr consent notices in the field. In Proceedings of the 2019 acm sigsac conference on computer and communications security, pages 973–990.

Van Ooijen, I. and Vrabec, H. U. (2019). Does the gdpr enhance consumers’ control over personal data? an analysis from a behavioural perspective. Journal of consumer policy, 42(1):91–107.

Westin, A. F. (1967). Privacy and freedom. Atheneum. ii, vii Xu, H., Luo, X. R., Carroll, J. M., and Rosson, M. B. (2011). The personalization privacy paradox: An exploratory study of decision making process for location- aware marketing. Decision support systems, 51(1):42–52.

Yamaguchi, Y., Amagasa, T., Kitagawa, H., and Ikawa, Y. (2014). Online user location inference exploiting spatiotemporal correlations in social streams. In Proceedings of the 23rd ACM International Conference on Conference on Information and Knowledge Management, pages 1139–1148.

Ziegler, S., Evequoz, E., and Huamani, A. M. P. (2019). The impact of the european general data protection regulation (gdpr) on future data business models: Toward a new paradigm and business opportunities. In Digital business models, pages 201–226. Springer.

Zuboff, S. (2019). The age of surveillance capitalism: The fight for a human future at the new frontier of power. Profile books

(versione in italiano)

Single point of failure: part of a system that, if it fails, will stop the entire system from working [1].

Arguably, the existence of a single point of failure involves our lives in many ways. The centralization of power in a few entities’ hands is likely to threaten many aspects of our daily lives significantly. Life on the Internet now covers most of our day-to-day routines, and, in this very system consisting of computer networks, the founding principle is control and not freedom, as desired at its inception [2]. This may be due to many factors, such as the spontaneous emergence of hierarchies in natural systems [3] or market dynamics effects, such as preferential attachment and the manifestation of the power law [4].

But what can its opposite, i.e., de-centralization, do? What does decentralization mean?

In systems theory, a system is decentralized when lower-level components operate on local information to achieve global goals. Such a system operates through the emergent behavior of its component parts rather than as a result of the influence of a centralized part [5].

In a more technical definition, systems are decentralized in the sense that their architecture is such that it seeks to avoid single points of failure. With the advent of Bitcoin [6] as the first system providing a Peer-to-Peer (P2P) cryptocurrency, there has been a new wave of development of decentralized systems to combat the single point of failure issue. The first widely used systems of this type, in fact, date back to the start of the new millennium for making it possible to share and exchange resources such as text files, music, and video, e.g., BitTorrent, Emule, Gnutella, and Napster. To date, Nakamoto’s blockchain has brought a revolution in many industries, and his invention has influenced financial sectors. In addition, this new P2P wave has brought optimism for incentivizing participation models, resource contribution, and consensus that could provide a substrate for a decentralized Internet, i.e., the Web3. Nakamoto has made possible the coordinated operation of peers in a network without needing to control their access to the system itself, i.e., a permissionless transactional decentralized system. Transactions are placed in a block, which all the other peers accept only if it “solves a puzzle.” To make it solving this ``crypto-puzzle,’’ it is required intensive computation work that consumes time. This creates a consensus, an order within decentralization, i.e., a chain of blocks.

Is it any good?

A critical part of a permissionless blockchain is that anyone can participate in the consensus mechanism, and thus one does not have a point of reference for placing its trust [7].

The blockchain brought many criticisms as well, above all, the issue of trust. In many ways, blockchains’ attempt to replace trust with code, i.e., the source code that implements the network consensus algorithm, makes these technologies less trustworthy than non-blockchain systems. Indeed, it can be argued that many blockchains are not truly decentralized, and their inevitable centralization is detrimental because it is largely emergent and ill-defined [7]. Bruce Scheiner argues that non-blockchain systems are based on other general mechanisms humans use to incentivize trustworthy behavior that make consensus mechanisms unnecessary: morals, reputation, institutions, and security mechanisms. Thus, what blockchains’ consensus mechanisms do is shift some of the trust in people and institutions to trust in the technology. When that trust turns out to be misplaced, there is no recourse. Moreover, in such a permissionless environment, it may be infeasible to incentivize participants to adequately provide functions like quality control or coordination of system development and evolution. Thus centralization emerges de facto [3], such as the hierarchy of the small number of developers controlling the blockchain software or the few numbers of centralized networks that control the consensus mechanism execution, i.e., mining pools [8].

Permissioned blockchains to the rescue

In permissioned blockchain, the nodes executing the consensus mechanism are identified and the access to the P2P network restricted.

Permissioned blockchains might resemble append-only distributed databases that are “completely uninteresting” [7]. However, unlike a traditional database, no central entity manages the information, but different interested parties control, maintain and guard the information that is stored on it. Different actors with different interests (possibly clashing between themselves) constantly monitor their “adversary-peers” and control if one of them attempts to alter or inadvertently change previously agreed-upon information. These systems enable confidence between a collection of parties, negotiations, and validation of contractual obligations, with clear business relations that already require trust and reputation [3,4]. Relying on multiple validators for blockchain maintenance allows the system to induce single parties not to deviate from the protocol. A permissioned decentralized system such as a blockchain, thus, becomes uniquely effective when used as a framework for collaboration in competition scenarios [9].

Solving one threat at a time: de-centralize personal data management

Blockchains can provide individuals with functionalities that are impossible in traditional cloud services. In particular, they favor the creation of decentralized Personal Information Management Systems (PIMS), guaranteeing, by design, data sovereignty and enabling users to control what personal data they want to share.

Permissioned decentralized systems, including blockchains, can be pivotal in placing individuals at the center of personal data management and in relieving the absence of technical instruments and standards that make the exercise of one’s rights simple and not excessively burdensome (as envisioned in the European strategy for data [10]). Decentralized PIMS can be considered consent management tools or trusts built on distributed software architectures that act as new neutral intermediaries in the personal data economy. These empower individuals with tools and means to decide at a granular level what is done with their data to provide, among many benefits, greater oversight and transparency over the data. These decentralized systems would also allow data collectors to prove their compliance with regulations. Not only that, but it could also benefit the creation of a single data market that capitalizes on data interoperability between data spaces for the social and economic good [10]. The current practice of data collectors, in fact, is to store data in disconnected silos that are inaccessible to innovative services, researchers, and often to the individual who generated them.

The creation of a new Decent(ralized) Data Intermediation Service

A data intermediary can be defined as a mediator between those who wish to make their data available and those who seek to use them while providing some degree of confidence about how the data will be used [11].

Data intermediary services (DIS) can be built based on permissioned decentralized systems to avoid the natural rise of dominance hierarchies in the exchange and handling of personal data. Intermediaries in a Decent(ralized) DIS aim to provide a neutral service with respect to the exploitation of individuals’ data, i.e., the sum of the privacy threat forces in the system of intermediaries is equal to zero. A permissioned blockchain maintains this balance. The primary ability that a permissioned decentralized system can bring in this case to the final users is “gaining truth through the ability to share data safely” [12]:

• a blockchain can provide a single source of verifiable truth among organizations and some level of appropriate automation of data processing.
• organizations can arrange a form of governance to decide the distributed sources of trust and moderate such permissioned systems.
• the system authority can be distributed among many trusted actors so that the compromise of one or even a few authorities does not destroy the consensus.
• intrinsic cryptographical properties of blockchains can enable distributed safe computation and data minimization.
• the networked collaboration environment can be easily exploited for the audit and accountability of operations.
• P2P networks offer an essential solution for data resiliency and scalability.

The DecentDIS implementation

This project aims to create an infrastructure for the joint management of data intermediary services. A permissioned network of intermediaries provides:

1. an IPFS-protocol-based [13] Personal Data Space (PDS) to store data,
2. an Ethereum-based [14] private blockchain to provide a distributed authorization mechanism, and
3. a distributed execution of codified policies based on standard ontologies to reply to data requests.

Data are encrypted and stored in the PDS, while blockchain’s smart contracts govern their access. Data subjects select their data-sharing policies in an intelligible and machine-readable way. Data holders (or subjects themselves) manage data and encryption keys through a threshold cryptosystem. Intermediaries assist both by executing policies through smart contracts and distributing keys to eligible data recipients. Hash-based URIs, together with an on-chain token representation, enable the indexing and validation of data, policies, and their relation. The private blockchain enables the tracing of data access and policies, and its untamperability is strengthened through a multi-DLT architecture, in which periodical commitments are stored in a permissionless DLT.

The relevant open source software can be found in Zenodo:

Ethereum smart contract authorization using a Threshold Proxy Re-Encryption scheme in Rust

DOI: 10.5281/zenodo.6548262
In this implementation, a network of nodes provides access to eligible data recipients by releasing the keys used to encrypt personal data stored in a PDS. An Ethereum private permissioned blockchain is used as a sidechain, and the public permissionless audit DLT as the mainchain where to store periodic commitments. The primary use of the permissioned blockchain is the execution of smart contracts implementing personal data access control. Access to the personal data stored in PDS can be allowed by the data holder through smart contracts through a data structure, namely an access control list (ACL). For the encryption, decryption, and keys distribution phase, a Threshold Proxy Re-Encryption (TPRE) scheme is used. In this scene, network nodes maintain fragments of a key. Such fragments are re-encrypted using a re-encryption key generated by the data holder in favor of an eligible recipient.

Decentralized intelligible identity and certification based on DID and VC and IPFS storage

DOI: 10.5281/zenodo.7132777 The Intelligible Identity set of technologies enables any subject to share information with third parties by proving to those the ownership of certain attestations or attributes that are self-asserted or issued by a trusted entity. Such a model is a specialization of a Decentralized Identifier (DID) [15], i.e., a type of identifier for verifiable self-sovereign digital identity. The intelligible identity allows it to bring with it the relevant operational and legal context of this identity and to trace the processes that involve it easily. The Intelligible Identity model is a combination of: (i) asymmetric cryptography key pairs, i.e., a public key and a private key; (ii) a Non Fungible Token stored on a blockchain; (iii) a metadata document. In this document, intelligibility is conveyed by linking (i) the resources that make up the document or define their legal contexts, (ii) the agents that are involved in the document life cycle, and (iii) the digital resources that describe how to perform operations with the identities. Information is stored on the InterPlanetary File System (IPFS) in the form of IPFS objects. These are identified by a CID (Content IDentifier), i.e., the result of applying a hash function to a file representing the object.

Handling policies in smart contracts based on access control and DPV ontology

DOI: 10.5281/zenodo.7132775 The general idea is to enforce policies and enable access control mechanisms and maintain an untamperable log of data accesses. Policies can be expressed using standard ontologies for access control, such as ODRL [16] or the MPEG-21 framework [17]. Those are integrated with the Data Privacy Vocabulary (DPV) [18], i.e., a specification containing taxonomies related to the privacy and data protection domain and specifying terms such as processing purposes or legal basis. For instance:

<ipfs://someCID/Pippo>
        a           dpv:DataProcessor ;
        rdfs:label  "Data Processor" .
<ipfs://someCID/Catullo>
        a           dpv:DataController ;
        rdfs:label  "Data Controller" .
<ipfs://someCID/Susy>
        a           dpv:DataSubject ;
        rdfs:label  "Data Subject" .
<ipfs://someCID/permission0>
        a                       mvco:Permission ;
        mco-core:implements     <ipfs://someCID/textClause1> ;
        mvco:issuedBy           <ipfs://someCID/Catullo> ;
        mco-core:permitsAction  <ipfs://someCID/actionConsult> ;
        mco-core:hasRequired    <ipfs://someCID/factConsent>.
<ipfs://someCID/latLonXY>
        a               dpv:PseudoAnonymisedData .
<ipfs://someCID/locationDataZ>
        a                       dpv:SensitivePersonalData ;
        mvco:isMadeUpOf         <ipfs://someCID/latLonXY> ;
<ipfs://someCID/actionConsult>
        a               dpv:Consult ;
        mvco:actedBy    <ipfs://someCID/Pippo> ;
        mvco:actedOver  <ipfs://someCID/locationDataZ> .
<ipfs://someCID/factConsent>
        a                       dpv:Consent ;
        dpv:hasDataSubject      <ipfs://someCID/Susy> ;
        dpv:hasDataController   <ipfs://someCID/Catullo> ;
        dpv:hasPurpose          <ipfs://someCID/purpose1> ;
        dpv:hasProcessing       <ipfs://someCID/processing1> .
<ipfs://someCID/purpose1>
        a               dpv:SocialMediaMarketing .
<ipfs://someCID/processing1>
        a               dpv:Consult .

References

1. Wikipedia community. Single point of failure. (2022). ipfs:///zdj7WX5pBeuj18FDbNqxv55msheeEwFnmcRExintmC2men7ZS/wiki/Single_point_of_failure
2. Galloway, Alexander R. Protocol: How control exists after decentralization. MIT press, 2004.
3. Bakos, Yannis, Hanna Halaburda, and Christoph Mueller-Bloch. “When permissioned blockchains deliver more decentralization than permissionless.” Communications of the ACM 64.2 (2021): 20-22.
4. Lopez, Pedro Garcia, Alberto Montresor, and Anwitaman Datta. “Please, do not decentralize the Internet with (permissionless) blockchains!.” 2019 IEEE 39th International Conference on Distributed Computing Systems (ICDCS). IEEE, 2019.
5. Wikipedia community. Decentralised system. (2022). ipfs:///zdj7WX5pBeuj18FDbNqxv55msheeEwFnmcRExintmC2men7ZS/wiki/Decentralised_ system
6. Nakamoto, Satoshi. “A peer-to-peer electronic cash system.” (2008).
7. Schneier, Bruce. Blockchain and trust. (2019). https://www.schneier.com/blog/archives/2019/02/blockchainand.html
8. Trail of Bits (2022). Are blockchains decentralized? https://assets-global.website-files.com/5fd11235b3950c2c1a3b6df4/62af6c641a672b3329b9a480_Unintended_Centralities_in_Distributed_Ledgers.pdf
9. Bakarich, Kathleen. “Using a Permissioned Blockchain?.” The CPA Journal 91.6/7 (2021): 48-51.
10. European Commission. A European Strategy for data. (2020). https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A52020DC0066
11. Janssen, Heleen and Jatinder Singh. “Data intermediary”. Internet Policy Review 11.1 (2022). https://policyreview.info/glossary/data-intermediary
12. Hardjono, Thomas, David L. Shrier, and Alex Pentland. Trusted Data, revised and expanded edition: A New Framework for Identity and Data Sharing. MIT Press, 2019.
13. InterPlanetary File System (IPFS), https://ipfs.io/
14. Ethereum, https://ethereum.org/
15. Decentralized Identifier (DID), https://www.w3.org/TR/did-core/
16. Open Digital Rights Language (ODRL), https://www.w3.org/TR/odrl-model/
17. Wikipedia community. MPEG-21. (2022). ipfs:///zdj7WX5pBeuj18FDbNqxv55msheeEwFnmcRExintmC2men7ZS/wiki/MPEG-21
18. Data Privacy Vocabulary (DPV), https://w3c.github.io/dpv/dpv/