New Delhi, Nov 6 (IANS): As India embarks on its journey towards a digital rupee controlled by the Reserve Bank of India, concerns about cybersecurity and privacy loom large.
US Federal Reserve Chair Jerome Powell recently listed "cyber risk" as his top-most worry relating to financial stability, and a recent UK House of Lords report specifically described cybersecurity and privacy risks as potential reasons not to develop a Central Bank Digital Currency (CBDC).
According to the International Monetary Fund (IMF), these concerns are not unfounded.
"CBDC vulnerabilities could be exploited to compromise a nation's financial system. CBDCs would be able to accumulate sensitive payment and user data at an unprecedented scale. In the wrong hands, this data could be used to spy on citizens' private transactions, obtain security-sensitive details about individuals and organisations, and even steal money," according to an IMP paper titled 'Central Bankers' New Cybersecurity Challenge."
If implemented without proper security protocols, a CBDC could substantially amplify the scope and scale of many of the security and privacy threats that already exist in today's financial system.
As the RBI moves ahead with the e-rupee pilot project, Governor Shaktikanta Das recently flagged cyber security and digital frauds as the main challenges in the new CBDC system.
"Main concern comes from the angle of cybersecurity and possibility of digital frauds. We have to be very careful about that," Das had said.
"Just as a few years ago, we had a major concern was on fake Indian currency notes. Similar things can also happen when you are launching CBDC," said the RBI Governor.
According to the IMF paper, many of the proposed design variants for CBDCs (particularly retail CBDCs) involve the centralised collection of transaction data, posing major privacy and security risks.
"From a privacy standpoint, such data could be used to surveil citizens' payment activity. Accumulating so much sensitive data in one place also increases security risk by making the payoff for would-be intruders much greater," the paper stressed.
According to the RBI Governor Das, in a CBDC universe, "we have to be that much more careful with regard to ensuring cyber security and taking preventive steps to prevent any kinds of frauds because there will be attempts".
However, the risks associated with centralised data collection can be mitigated either by not collecting it at all or by choosing a validation architecture in which each component sees only the amount of information needed for functionality.
"The latter approach can be aided by cryptographic tools, such as zero-knowledge proofs, which authenticate private information without revealing it and allowing it to be compromised, or cryptographic hashing techniques," said the IMF paper.
Several countries have committed to or even deployed retail CBDCs whose underlying infrastructure is based on distributed ledger technology.
Nigeria's eNaira, launched in October 2021, is a good example. Such designs require the involvement of third parties as validators of transactions.
"However, there is not a clear blueprint for devising these regulations in a system as time-sensitive and closely interconnected as a distributed-ledger-based CBDC. This is why the need for international standard-setting and more knowledge sharing between banks is critical at this moment of rapid development and adoption," the IMF paper described.