cbdc:public:cbdc_omg:04_doc:15_common:48_natsec:start
Differences
This shows you the differences between two versions of the page.
| Both sides previous revision Previous revision Next revision | Previous revision | ||
|
cbdc:public:cbdc_omg:04_doc:15_common:48_natsec:start [2022/05/07 14:20] nick [Recommendations] |
cbdc:public:cbdc_omg:04_doc:15_common:48_natsec:start [2022/06/17 18:04] (current) terrance |
||
|---|---|---|---|
| Line 1: | Line 1: | ||
| ====== 4.5 National Security Considerations ====== | ====== 4.5 National Security Considerations ====== | ||
| - | [[cbdc:private:cbdc_omg:04_doc:15_common:start| Return to Common Elements]] | + | |< 100% >| |
| + | | [[cbdc:public:cbdc_omg:04_doc:15_common:start| Return to Common Elements]] | <WRAP> | ||
| + | <html><b> | ||
| + | <a href="mailto:[email protected]?Subject=OMG's CBDC WG Response: | ||
| + | 4.5 National Security Considerations | ||
| + | ">Provide Feedback</a></b> | ||
| + | </html> | ||
| + | </WRAP> | | ||
| ===== Overview ===== | ===== Overview ===== | ||
| - | [[cbdc:private:cbdc_omg:04_doc:15_common:48_natsec:start| Return to Top]] | + | [[cbdc:public:cbdc_omg:04_doc:15_common:48_natsec:start| Return to Top]] |
| : **Note:** See the [[https://www.omgwiki.org/dido/doku.php?id=dido:public:ra:xapend:m_acts_laws#appendix_mfinancial_laws_regulations_and_authorities | OMG DIDO-RA Financial Laws, Regulations and Authorities]] for more on Security. | : **Note:** See the [[https://www.omgwiki.org/dido/doku.php?id=dido:public:ra:xapend:m_acts_laws#appendix_mfinancial_laws_regulations_and_authorities | OMG DIDO-RA Financial Laws, Regulations and Authorities]] for more on Security. | ||
| Line 9: | Line 16: | ||
| The following Laws and Regulations governing Privacy, Money Laundering, Terrorism, and Financials apply in the U.S. and need to be part of any DIDO solution concerned with currency, money, financials, or cryptocurrencies. Often these Laws and Regulations are considered obstacles or barriers to innovation, but each law or regulation is developed in response to some situation that occurred in the past. To prevent a "modern" repeat of these situations, the laws and regulations should be upgraded, not ignored or overturned. | The following Laws and Regulations governing Privacy, Money Laundering, Terrorism, and Financials apply in the U.S. and need to be part of any DIDO solution concerned with currency, money, financials, or cryptocurrencies. Often these Laws and Regulations are considered obstacles or barriers to innovation, but each law or regulation is developed in response to some situation that occurred in the past. To prevent a "modern" repeat of these situations, the laws and regulations should be upgraded, not ignored or overturned. | ||
| - | Some of these Laws, Regulations, and Authorities have general applicability to DIDOs when the data stored within the DIDO refers to [[https://www.omgwiki.org/dido/doku.php?id=didopublic:ra:xapend:xapend.a_glossary:p:pii | Personal Identifiable Information (PII) ]] and therefore subject to the tenets of privacy. See [[https://www.omgwiki.org/dido/doku.php?id=didopublic:ra:xapend:xapend.a_glossary:r:right_to_privacy | Right to Privacy.]]. | + | Some of these Laws, Regulations and Authorities have general applicability to DIDOs when the data stored within the DIDO refers to [[https://www.omgwiki.org/dido/doku.php?id=didopublic:ra:xapend:xapend.a_glossary:p:pii | Personal Identifiable Information (PII) ]] and therefore subject to the tenets of privacy. See [[https://www.omgwiki.org/dido/doku.php?id=didopublic:ra:xapend:xapend.a_glossary:r:right_to_privacy | Right to Privacy.]]. |
| Some Laws, Regulations, and Authorities are relevant to DIDO when the DIDO is considered a [[https://www.omgwiki.org/dido/doku.php?id=dido:public:ra:xapend:xapend.a_glossary:f:financial_instrument | Financial Instrument]] or a [[https://www.omgwiki.org/dido/doku.php?id=didopublic:ra:xapend:xapend.a_glossary:s:security_finance | Security]]. Certain [[https://www.omgwiki.org/dido/doku.php?id=didopublic:ra:xapend:xapend.a_glossary:c:cryptocurrency | Cryptocurrencies]] and [[https://www.omgwiki.org/dido/doku.php?id=dido:public:ra:xapend:xapend.a_glossary:i:ico | Initial Coin Offerings (ICOs)]] may be found to meet the definition of an "investment contract" under the [[https://www.omgwiki.org/dido/doku.php?id=dido:public:ra:xapend:xapend.a_glossary:h:howey_test | Howey Test ]] from which the U.S. Supreme Court ruling determined that an Investment Contract must: | Some Laws, Regulations, and Authorities are relevant to DIDO when the DIDO is considered a [[https://www.omgwiki.org/dido/doku.php?id=dido:public:ra:xapend:xapend.a_glossary:f:financial_instrument | Financial Instrument]] or a [[https://www.omgwiki.org/dido/doku.php?id=didopublic:ra:xapend:xapend.a_glossary:s:security_finance | Security]]. Certain [[https://www.omgwiki.org/dido/doku.php?id=didopublic:ra:xapend:xapend.a_glossary:c:cryptocurrency | Cryptocurrencies]] and [[https://www.omgwiki.org/dido/doku.php?id=dido:public:ra:xapend:xapend.a_glossary:i:ico | Initial Coin Offerings (ICOs)]] may be found to meet the definition of an "investment contract" under the [[https://www.omgwiki.org/dido/doku.php?id=dido:public:ra:xapend:xapend.a_glossary:h:howey_test | Howey Test ]] from which the U.S. Supreme Court ruling determined that an Investment Contract must: | ||
| Line 19: | Line 26: | ||
| ===== Details of National Security Considerations ===== | ===== Details of National Security Considerations ===== | ||
| - | [[cbdc:private:cbdc_omg:04_doc:15_common:48_natsec:start| Return to Top]] | + | [[cbdc:public:cbdc_omg:04_doc:15_common:48_natsec:start| Return to Top]] |
| Table {{ref>summaryLawsReg}} summarizes the number of Laws and Regulations covering National Security Considerations. The total number (i.e., **''44''**) indicates the complexity of National Security issues that confront the CBDC. The more Laws and Regulations, the more effort to coordinate the CBDC efforts and work with the Legislative and Executive Branches to keep the Laws and Regulations current with CBDC efforts. | Table {{ref>summaryLawsReg}} summarizes the number of Laws and Regulations covering National Security Considerations. The total number (i.e., **''44''**) indicates the complexity of National Security issues that confront the CBDC. The more Laws and Regulations, the more effort to coordinate the CBDC efforts and work with the Legislative and Executive Branches to keep the Laws and Regulations current with CBDC efforts. | ||
| Line 27: | Line 34: | ||
| |< 30% 20% 10% >| | |< 30% 20% 10% >| | ||
| ^ National Security Consideration ^ No. of Laws and Regulations | | ^ National Security Consideration ^ No. of Laws and Regulations | | ||
| - | ^ [[cbdc:private:cbdc_omg:04_doc:15_common:48_natsec:10_human_traf | Human Trafficking ]] | 14 | | + | ^ [[cbdc:public:cbdc_omg:04_doc:15_common:48_natsec:10_human_traf| Human Trafficking ]] | 14 | |
| - | ^ [[cbdc:private:cbdc_omg:04_doc:15_common:48_natsec:20_drug_traf | Drug Trafficking ]] | 9 | | + | ^ [[cbdc:public:cbdc_omg:04_doc:15_common:48_natsec:20_drug_traf| Drug Trafficking ]] | 9 | |
| - | ^ [[cbdc:private:cbdc_omg:04_doc:15_common:48_natsec:30_corrupt | Corruption ]] | 10 | | + | ^ [[cbdc:public:cbdc_omg:04_doc:15_common:48_natsec:30_corrupt| Corruption ]] | 10 | |
| - | ^ [[cbdc:private:cbdc_omg:04_doc:15_common:48_natsec:40_launder | Money Laundering ]] | 11 | | + | ^ [[cbdc:public:cbdc_omg:04_doc:15_common:48_natsec:40_launder| Money Laundering ]] | 11 | |
| ^ Total ^ **44** | | ^ Total ^ **44** | | ||
| </table> | </table> | ||
| Line 37: | Line 44: | ||
| - | <nspages :cbdc:private:cbdc_omg:04_doc:15_common:48_natsec -tree -r -exclude -subns -pagesInNs -h1 -textNs=""> | + | <nspages :cbdc:public:cbdc_omg:04_doc:15_common:48_natsec -tree -r -exclude -subns -pagesInNs -h1 -textNs=""> |
| Line 43: | Line 50: | ||
| ===== Examples ===== | ===== Examples ===== | ||
| - | [[cbdc:private:cbdc_omg:04_doc:15_common:48_natsec:start| Return to Top]] | + | [[cbdc:public:cbdc_omg:04_doc:15_common:48_natsec:start| Return to Top]] |
| <table securityReq> | <table securityReq> | ||
| - | <caption>Examples of **security** Desirements identified during the White Paper Analysis conducted by the OMG</caption> | + | <caption>Examples of **security** Desirements identified during the White Paper Analysis conducted by the OMG's CBDC WG</caption> |
| |< 100% 20% ->| | |< 100% 20% ->| | ||
| ^ Category ^ Desirements ^ | ^ Category ^ Desirements ^ | ||
| Line 57: | Line 64: | ||
| ===== Discussion of Examples ===== | ===== Discussion of Examples ===== | ||
| - | [[cbdc:private:cbdc_omg:04_doc:15_common:48_natsec:start| Return to Top]] | + | [[cbdc:public:cbdc_omg:04_doc:15_common:48_natsec:start| Return to Top]] |
| - | The "desirements" specified in [[https://www.omgwiki.org/CBDC/doku.php?id=cbdc:private:cbdc_omg:15_summary:start&do=edit | White Paper]] and identified by the [[https://www.omgwiki.org/CBDC/doku.php?id=cbdc:private:cbdc_omg:15_summary:start | OMG's White Paper Analysis]] as **Security Issues** are listed in Table {{ref>securityReqDiscussion}}. | + | The "desirements" specified in [[https://www.omgwiki.org/CBDC/doku.php?id=cbdc:public:cbdc_omg:15_summary:start&do=edit | White Paper]] and identified by the [[https://www.omgwiki.org/CBDC/doku.php?id=cbdc:public:cbdc_omg:15_summary:start | OMG's CBDC WG White Paper Analysis]] as **Security Issues** are listed in Table {{ref>securityReqDiscussion}}. |
| <table securityReqDiscussion> | <table securityReqDiscussion> | ||
| Line 68: | Line 75: | ||
| Criminal Activity is a broad, extensive topic that requires an understanding of the U.S. Laws and Regulations as well as international treaties and agreements. Within the context of the CBDC, criminal activity can be one more of the following: | Criminal Activity is a broad, extensive topic that requires an understanding of the U.S. Laws and Regulations as well as international treaties and agreements. Within the context of the CBDC, criminal activity can be one more of the following: | ||
| - | * [[cbdc:private:cbdc_omg:04_doc:15_common:48_natsec:10_human_traf | Human Trafficking]] | + | : 1. [[cbdc:public:cbdc_omg:04_doc:15_common:48_natsec:10_human_traf| Human Trafficking]] |
| - | * [[cbdc:private:cbdc_omg:04_doc:15_common:48_natsec:20_drug_traf | Drug Trafficking]] | + | : 2. [[cbdc:public:cbdc_omg:04_doc:15_common:48_natsec:20_drug_traf| Drug Trafficking]] |
| - | * [[cbdc:private:cbdc_omg:04_doc:15_common:48_natsec:30_corrupt | Corruption]] | + | : 3. [[cbdc:public:cbdc_omg:04_doc:15_common:48_natsec:30_corrupt| Corruption]] |
| - | * [[cbdc:private:cbdc_omg:04_doc:15_common:48_natsec:40_launder | Money Laundering]] | + | : 4. [[cbdc:public:cbdc_omg:04_doc:15_common:48_natsec:40_launder| Money Laundering]] |
| </WRAP>| | </WRAP>| | ||
| ^ B0052 ^ Prevent Financial money laundering crimes |<WRAP> | ^ B0052 ^ Prevent Financial money laundering crimes |<WRAP> | ||
| - | There are already quite a few Laws and Regulations within the U.S. to cover [[cbdc:private:cbdc_omg:04_doc:15_common:48_natsec:40_launder | Money Laundering]]. However, within the context of CBDC, these laws need to be reviewed, updated or amended to reflect Digital Currency and how it might be used in Criminal Activities. | + | There are already quite a few Laws and Regulations within the U.S. to cover [[cbdc:public:cbdc_omg:04_doc:15_common:48_natsec:40_launder| Money Laundering]]. However, within the context of CBDC, these laws need to be reviewed, updated, or amended to reflect Digital Currency and how it might be used in Criminal Activities. |
| </WRAP>| | </WRAP>| | ||
| ^ B0053 ^ <WRAP> Provide resiliency to threats to existing payment services—including: | ^ B0053 ^ <WRAP> Provide resiliency to threats to existing payment services—including: | ||
| - | - operational disruptions | + | : 1. operational disruptions |
| - | - cybersecurity risks | + | : 2. cybersecurity risks |
| </WRAP>|<WRAP> | </WRAP>|<WRAP> | ||
| **1. Operational Disruptions** occur when there is a failure in the infrastructure of the CBDC. This implies a compound | **1. Operational Disruptions** occur when there is a failure in the infrastructure of the CBDC. This implies a compound | ||
| [[https://www.omgwiki.org/dido/doku.php?id=dido:public:ra:1.4_req:2_nonfunc | Non-Functional Requirement]] that needs to be levied on the CBDC. The following **Non-Functional** requirements need to be specified for the CBDC: | [[https://www.omgwiki.org/dido/doku.php?id=dido:public:ra:1.4_req:2_nonfunc | Non-Functional Requirement]] that needs to be levied on the CBDC. The following **Non-Functional** requirements need to be specified for the CBDC: | ||
| - | 1. [[https://www.omgwiki.org/dido/doku.php?id=dido:public:ra:1.4_req:2_nonfunc:14_reliability | Reliability]] | + | : 1. **[[https://www.omgwiki.org/dido/doku.php?id=dido:public:ra:1.4_req:2_nonfunc:14_reliability | Reliability]]** |
| - | * [[https://www.omgwiki.org/dido/doku.php?id=dido:public:ra:1.4_req:2_nonfunc:14_reliability:01_matuity | Maturity]] | + | : a. [[https://www.omgwiki.org/dido/doku.php?id=dido:public:ra:1.4_req:2_nonfunc:14_reliability:01_matuity | Maturity]] |
| - | * [[https://www.omgwiki.org/dido/doku.php?id=dido:public:ra:1.4_req:2_nonfunc:14_reliability:02_availability | Availability]] | + | : b. [[https://www.omgwiki.org/dido/doku.php?id=dido:public:ra:1.4_req:2_nonfunc:14_reliability:02_availability | Availability]] |
| - | * [[https://www.omgwiki.org/dido/doku.php?id=dido:public:ra:1.4_req:2_nonfunc:14_reliability:04_faulttolerance | Fault Tolerance]] | + | : c. [[https://www.omgwiki.org/dido/doku.php?id=dido:public:ra:1.4_req:2_nonfunc:14_reliability:04_faulttolerance | Fault Tolerance]] |
| - | * [[https://www.omgwiki.org/dido/doku.php?id=dido:public:ra:1.4_req:2_nonfunc:14_reliability:12_recoverability | Recoverability]] | + | : d. [[https://www.omgwiki.org/dido/doku.php?id=dido:public:ra:1.4_req:2_nonfunc:14_reliability:12_recoverability | Recoverability]] |
| - | 2. [[https://www.omgwiki.org/dido/doku.php?id=dido:public:ra:1.4_req:2_nonfunc:20_maintainability | Maintainability]] | + | : 2. **[[https://www.omgwiki.org/dido/doku.php?id=dido:public:ra:1.4_req:2_nonfunc:20_maintainability | Maintainability]]** |
| - | * [[https://www.omgwiki.org/dido/doku.php?id=dido:public:ra:1.4_req:2_nonfunc:20_maintainability:modularity | Modularity]] | + | : a. [[https://www.omgwiki.org/dido/doku.php?id=dido:public:ra:1.4_req:2_nonfunc:20_maintainability:modularity | Modularity]] |
| - | * [[https://www.omgwiki.org/dido/doku.php?id=dido:public:ra:1.4_req:2_nonfunc:20_maintainability:reuseability | Reusability]] | + | : b. [[https://www.omgwiki.org/dido/doku.php?id=dido:public:ra:1.4_req:2_nonfunc:20_maintainability:reuseability | Reusability]] |
| - | * [[https://www.omgwiki.org/dido/doku.php?id=dido:public:ra:1.4_req:2_nonfunc:20_maintainability:analysability | Analyzability]] | + | : c. [[https://www.omgwiki.org/dido/doku.php?id=dido:public:ra:1.4_req:2_nonfunc:20_maintainability:analysability | Analyzability]] |
| - | * [[https://www.omgwiki.org/dido/doku.php?id=dido:public:ra:1.4_req:2_nonfunc:20_maintainability:modifiability | Modifiability]] | + | : d. [[https://www.omgwiki.org/dido/doku.php?id=dido:public:ra:1.4_req:2_nonfunc:20_maintainability:modifiability | Modifiability]] |
| - | * [[https://www.omgwiki.org/dido/doku.php?id=dido:public:ra:1.4_req:2_nonfunc:20_maintainability:testability | Testability]] | + | : e. [[https://www.omgwiki.org/dido/doku.php?id=dido:public:ra:1.4_req:2_nonfunc:20_maintainability:testability | Testability]] |
| - | 3. [[https://www.omgwiki.org/dido/doku.php?id=dido:public:ra:1.4_req:2_nonfunc:28_manageability | Manageability]] | + | : 3. **[[https://www.omgwiki.org/dido/doku.php?id=dido:public:ra:1.4_req:2_nonfunc:28_manageability | Manageability]]** |
| - | * [[https://www.omgwiki.org/dido/doku.php?id=dido:public:ra:1.4_req:2_nonfunc:28_manageability:02_types | Types of Manageability Functions]] | + | : a. [[https://www.omgwiki.org/dido/doku.php?id=dido:public:ra:1.4_req:2_nonfunc:28_manageability:02_types | Types of Manageability Functions]] |
| - | * [[https://www.omgwiki.org/dido/doku.php?id=dido:public:ra:1.4_req:2_nonfunc:28_manageability:04_costs | Manageability Costs]] | + | : b. [[https://www.omgwiki.org/dido/doku.php?id=dido:public:ra:1.4_req:2_nonfunc:28_manageability:04_costs | Manageability Costs]] |
| - | * [[https://www.omgwiki.org/dido/doku.php?id=dido:public:ra:1.4_req:2_nonfunc:28_manageability:06_system | System Manageability Issues]] | + | : c. [[https://www.omgwiki.org/dido/doku.php?id=dido:public:ra:1.4_req:2_nonfunc:28_manageability:06_system | System Manageability Issues]] |
| - | * [[https://www.omgwiki.org/dido/doku.php?id=dido:public:ra:1.4_req:2_nonfunc:28_manageability:08_software | Software Manageability Issues]] | + | : d. [[https://www.omgwiki.org/dido/doku.php?id=dido:public:ra:1.4_req:2_nonfunc:28_manageability:08_software | Software Manageability Issues]] |
| **Note:** Although the OMG DIDO-RA provides general definitions for these non-functional requirements, only the Federal Reserve, in conjunction with the [[https://www.omgwiki.org/dido/doku.php?id=dido:public:ra:1.4_req:2_nonfunc:28_manageability:08_software | CBDC Stakeholders]], can define these requirements in terms of the CBDC. This process takes time and there are no shortcuts. It is part of the System Engineering process. | **Note:** Although the OMG DIDO-RA provides general definitions for these non-functional requirements, only the Federal Reserve, in conjunction with the [[https://www.omgwiki.org/dido/doku.php?id=dido:public:ra:1.4_req:2_nonfunc:28_manageability:08_software | CBDC Stakeholders]], can define these requirements in terms of the CBDC. This process takes time and there are no shortcuts. It is part of the System Engineering process. | ||
| **2. Cybersecurity Risks**, as with **Operation Disruptions**, represent a compound non-functional requirement for the CBDC. The following [[https://www.omgwiki.org/dido/doku.php?id=dido:public:ra:1.4_req:2_nonfunc:25_security |Securability]] **Non-Functional** requirements need to be specified for the CBDC: | **2. Cybersecurity Risks**, as with **Operation Disruptions**, represent a compound non-functional requirement for the CBDC. The following [[https://www.omgwiki.org/dido/doku.php?id=dido:public:ra:1.4_req:2_nonfunc:25_security |Securability]] **Non-Functional** requirements need to be specified for the CBDC: | ||
| - | * [[https://www.omgwiki.org/dido/doku.php?id=dido:public:ra:1.4_req:2_nonfunc:25_security:confidentiality | Confidentiality]] | + | : a. [[https://www.omgwiki.org/dido/doku.php?id=dido:public:ra:1.4_req:2_nonfunc:25_security:confidentiality | Confidentiality]] |
| - | * [[https://www.omgwiki.org/dido/doku.php?id=dido:public:ra:1.4_req:2_nonfunc:25_security:04_data_integrity | Data Integrity]] | + | : b. [[https://www.omgwiki.org/dido/doku.php?id=dido:public:ra:1.4_req:2_nonfunc:25_security:04_data_integrity | Data Integrity]] |
| - | * [[https://www.omgwiki.org/dido/doku.php?id=dido:public:ra:1.4_req:2_nonfunc:25_security:nonrepudiability | Non-repudiation]] | + | : c. [[https://www.omgwiki.org/dido/doku.php?id=dido:public:ra:1.4_req:2_nonfunc:25_security:nonrepudiability | Non-repudiation]] |
| - | * [[https://www.omgwiki.org/dido/doku.php?id=dido:public:ra:1.4_req:2_nonfunc:25_security:authenticity | Authenticity]] | + | : d. [[https://www.omgwiki.org/dido/doku.php?id=dido:public:ra:1.4_req:2_nonfunc:25_security:authenticity | Authenticity]] |
| - | * [[https://www.omgwiki.org/dido/doku.php?id=dido:public:ra:1.4_req:2_nonfunc:25_security:accountability | Accountability]] | + | : e. [[https://www.omgwiki.org/dido/doku.php?id=dido:public:ra:1.4_req:2_nonfunc:25_security:accountability | Accountability]] |
| Securability is also a layered stack: | Securability is also a layered stack: | ||
| <figure> | <figure> | ||
| - | {{ :cbdc:private:cbdc_omg:04_doc:15_common:48_natsec:layers_of_security.png?400 |}} | + | {{ :cbdc:public:cbdc_omg:04_doc:15_common:48_natsec:layers_of_security.png?400 |}} |
| <caption>The layers of Security.</caption> | <caption>The layers of Security.</caption> | ||
| </figure> | </figure> | ||
| Line 118: | Line 125: | ||
| The layers of Security: | The layers of Security: | ||
| - | - [[https://www.omgwiki.org/dido/doku.php?id=dido:public:ra:xapend:xapend.a_glossary:p:physicalsecurity | Physical Security]] | + | : 1. [[https://www.omgwiki.org/dido/doku.php?id=dido:public:ra:xapend:xapend.a_glossary:p:physicalsecurity | Physical Security]] |
| - | - [[https://www.omgwiki.org/dido/doku.php?id=dido:public:ra:xapend:xapend.a_glossary:d:datasecurity | Data Security]] | + | : 2. [[https://www.omgwiki.org/dido/doku.php?id=dido:public:ra:xapend:xapend.a_glossary:d:datasecurity | Data Security]] |
| - | - [[https://www.omgwiki.org/dido/doku.php?id=dido:public:ra:xapend:xapend.a_glossary:n:networksecurity | Network Security]] | + | : 3. [[https://www.omgwiki.org/dido/doku.php?id=dido:public:ra:xapend:xapend.a_glossary:n:networksecurity | Network Security]] |
| - | - [[https://www.omgwiki.org/dido/doku.php?id=dido:public:ra:xapend:xapend.a_glossary:p:platformsecurity | Platform Security]] | + | : 4. [[https://www.omgwiki.org/dido/doku.php?id=dido:public:ra:xapend:xapend.a_glossary:p:platformsecurity | Platform Security]] |
| - | - [[https://www.omgwiki.org/dido/doku.php?id=dido:public:ra:xapend:xapend.a_glossary:a:applicationsecurity | Application Security]] | + | : 5. [[https://www.omgwiki.org/dido/doku.php?id=dido:public:ra:xapend:xapend.a_glossary:a:applicationsecurity | Application Security]] |
| - | - [[https://www.omgwiki.org/dido/doku.php?id=dido:public:ra:xapend:xapend.a_glossary:c:securityculture | Culture Security]] | + | : 6. [[https://www.omgwiki.org/dido/doku.php?id=dido:public:ra:xapend:xapend.a_glossary:c:securityculture | Culture Security]] |
| </WRAP>| | </WRAP>| | ||
| Line 130: | Line 137: | ||
| ^ P0024 ^ CBDC would need to comply with the U.S. robust rules |<WRAP> | ^ P0024 ^ CBDC would need to comply with the U.S. robust rules |<WRAP> | ||
| ^ Criminal Activity ^ Approx. Number of Laws and Regulations ^ | ^ Criminal Activity ^ Approx. Number of Laws and Regulations ^ | ||
| - | ^ [[cbdc:private:cbdc_omg:04_doc:15_common:48_natsec:10_human_traf | Human Trafficking]] | 14 | | + | ^ [[cbdc:public:cbdc_omg:04_doc:15_common:48_natsec:10_human_traf| Human Trafficking]] | 14 | |
| - | ^ [[cbdc:private:cbdc_omg:04_doc:15_common:48_natsec:20_drug_traf | Drug Trafficking]] | 9 | | + | ^ [[cbdc:public:cbdc_omg:04_doc:15_common:48_natsec:20_drug_traf| Drug Trafficking]] | 9 | |
| - | ^ [[cbdc:private:cbdc_omg:04_doc:15_common:48_natsec:30_corrupt | Corruption]] | 10 | | + | ^ [[cbdc:public:cbdc_omg:04_doc:15_common:48_natsec:30_corrupt| Corruption]] | 10 | |
| - | ^ [[cbdc:private:cbdc_omg:04_doc:15_common:48_natsec:40_launder | Money Laundering]] | 11 | | + | ^ [[cbdc:public:cbdc_omg:04_doc:15_common:48_natsec:40_launder| Money Laundering]] | 11 | |
| ^ Total ^ **44** | | ^ Total ^ **44** | | ||
| </WRAP>| | </WRAP>| | ||
| ^ P0028 ^ Require significant international coordination to address issues such as:<WRAP> | ^ P0028 ^ Require significant international coordination to address issues such as:<WRAP> | ||
| - | - common standards | + | : 1. common standards |
| - | - infrastructure, | + | : 2. infrastructure, |
| - | - the types of intermediaries able to access any new infrastructure, | + | : 3. the types of intermediaries able to access any new infrastructure, |
| - | - legal frameworks | + | : 4. legal frameworks |
| - | - preventing illicit transactions | + | : 5. preventing illicit transactions |
| - | - the cost and timing of implementation | + | : 6. the cost and timing of implementation |
| </WRAP>|<WRAP> | </WRAP>|<WRAP> | ||
| ** 1. Common Standards: ** | ** 1. Common Standards: ** | ||
| There are lots of "common standards" that can apply to Blockchains. See within each of these sections for a list of applicable standards: | There are lots of "common standards" that can apply to Blockchains. See within each of these sections for a list of applicable standards: | ||
| - | * [[https://www.omgwiki.org/dido/doku.php?id=dido:public:ra:xapend:xapend.b_stds:tech | DIDO RA - Technical Standard Bodies ]] | + | : a. [[https://www.omgwiki.org/dido/doku.php?id=dido:public:ra:xapend:xapend.b_stds:tech | DIDO RA - Technical Standard Bodies ]] |
| - | * [[https://www.omgwiki.org/dido/doku.php?id=dido:public:ra:xapend:xapend.b_stds:defact | DIDO RA - de facto Standards Bodies]] | + | : b. [[https://www.omgwiki.org/dido/doku.php?id=dido:public:ra:xapend:xapend.b_stds:defact | DIDO RA - de facto Standards Bodies]] |
| Unfortunately, within the //"blockchain"// world, there is confusion about what constitutes a standard. Often, if something is Open Source, it is considered a standard. However, often these projects lack the rigor needed to be considered a //"standard"//. Also, see the discussion in the DIDO RA on [[https://www.omgwiki.org/dido/doku.php?id=dido:public:ra:xapend:xapend.b_stds:defact:todo:start | Talk Openly Develop Openly (TODO)]] and look at the DIDO RA definition of a [[https://www.omgwiki.org/dido/doku.php?id=dido:public:ra:xapend:xapend.a_glossary:s:sdo | Standards Developing Organization (SDO)]]. | Unfortunately, within the //"blockchain"// world, there is confusion about what constitutes a standard. Often, if something is Open Source, it is considered a standard. However, often these projects lack the rigor needed to be considered a //"standard"//. Also, see the discussion in the DIDO RA on [[https://www.omgwiki.org/dido/doku.php?id=dido:public:ra:xapend:xapend.b_stds:defact:todo:start | Talk Openly Develop Openly (TODO)]] and look at the DIDO RA definition of a [[https://www.omgwiki.org/dido/doku.php?id=dido:public:ra:xapend:xapend.a_glossary:s:sdo | Standards Developing Organization (SDO)]]. | ||
| Line 163: | Line 170: | ||
| ** 4. Legal Frameworks: ** | ** 4. Legal Frameworks: ** | ||
| There are already legal frameworks in place to handle: | There are already legal frameworks in place to handle: | ||
| - | * [[https://www.omgwiki.org/CBDC/doku.php?id=cbdc:private:cbdc_omg:04_doc:15_common:45_privacy:start | National Privacy Considerations]] | + | : a. [[https://www.omgwiki.org/CBDC/doku.php?id=cbdc:public:cbdc_omg:04_doc:15_common:45_privacy:start | National Privacy Considerations]] |
| - | * [[https://www.omgwiki.org/CBDC/doku.php?id=cbdc:private:cbdc_omg:04_doc:15_common:48_natsec:start | National Security Considerations]] | + | : b. [[https://www.omgwiki.org/CBDC/doku.php?id=cbdc:public:cbdc_omg:04_doc:15_common:48_natsec:start | National Security Considerations]] |
| Although these frameworks were developed without a CBDC, they already //"comply with the United States are subject to robust rules"// and are continuously being reviewed, updated, and amended based on new information obtained from the field. As part of this process, these frameworks need to add to the existing frameworks rather than created new frameworks. | Although these frameworks were developed without a CBDC, they already //"comply with the United States are subject to robust rules"// and are continuously being reviewed, updated, and amended based on new information obtained from the field. As part of this process, these frameworks need to add to the existing frameworks rather than created new frameworks. | ||
| Line 171: | Line 178: | ||
| There are two areas within the existing legal frameworks covering Illicit transactions: | There are two areas within the existing legal frameworks covering Illicit transactions: | ||
| - | * [[https://www.omgwiki.org/CBDC/doku.php?id=cbdc:private:cbdc_omg:04_doc:15_common:48_natsec:40_launder | Money Laundering]] | + | : a. [[https://www.omgwiki.org/CBDC/doku.php?id=cbdc:public:cbdc_omg:04_doc:15_common:48_natsec:40_launder | Money Laundering]] |
| - | * [[https://www.omgwiki.org/CBDC/doku.php?id=cbdc:private:cbdc_omg:04_doc:15_common:48_natsec:30_corrupt | Corruption ]] | + | : b. [[https://www.omgwiki.org/CBDC/doku.php?id=cbdc:public:cbdc_omg:04_doc:15_common:48_natsec:30_corrupt | Corruption ]] |
| Although these frameworks were developed without a CBDC, they already //"comply with the United States are subject to robust rules"// and are continuously being reviewed, updated, and amended based on new information obtained from the field. As part of this process, these frameworks need to add to the existing frameworks rather than created new frameworks. | Although these frameworks were developed without a CBDC, they already //"comply with the United States are subject to robust rules"// and are continuously being reviewed, updated, and amended based on new information obtained from the field. As part of this process, these frameworks need to add to the existing frameworks rather than created new frameworks. | ||
| Line 181: | Line 188: | ||
| </WRAP>| | </WRAP>| | ||
| ^ D0013 ^ Design should facilitate compliance with a robust set of rules already intended to combat <WRAP> | ^ D0013 ^ Design should facilitate compliance with a robust set of rules already intended to combat <WRAP> | ||
| - | - money laundering | + | : 1. money laundering |
| - | - the financing of terrorism | + | : 2. the financing of terrorism |
| - | - customer due diligence | + | : 3. customer due diligence |
| - | - record-keeping | + | : 4. record-keeping |
| - | - reporting requirements | + | : 5. reporting requirements |
| </WRAP>|<WRAP> | </WRAP>|<WRAP> | ||
| ** 1. Money Laundering: ** | ** 1. Money Laundering: ** | ||
| - | There are roughly **''11''** Laws and Regulations in the U.S. covering [[cbdc:private:cbdc_omg:04_doc:15_common:48_natsec:40_launder]] that have taken years to create, usually in response to known or discovered Money Laundering schemes that are continuing to evolve. In many ways, it is an //"Arms Race"//. The people with a need to launder money keep developing new ways around existing rules, requiring the government to create new rules. | + | There are roughly **''11''** Laws and Regulations in the U.S. covering [[cbdc:public:cbdc_omg:04_doc:15_common:48_natsec:40_launder]] that took years to create, usually in response to known or discovered Money Laundering schemes that are continuing to evolve. In many ways, it is an //"Arms Race"//. The people with a need to launder money keep developing new ways around existing rules, requiring the government to create new rules. |
| The CBDC must at least start from the same place as the existing systems with as many of the rules in place as possible in order to prevent the entire system from imploding. It also needs to assess the current sets of Laws and Regulations to determine if there are required updates or amendments that need to be made before the CBDC can "go live". | The CBDC must at least start from the same place as the existing systems with as many of the rules in place as possible in order to prevent the entire system from imploding. It also needs to assess the current sets of Laws and Regulations to determine if there are required updates or amendments that need to be made before the CBDC can "go live". | ||
| ** 2. Financing of Terrorism: ** | ** 2. Financing of Terrorism: ** | ||
| - | The main way to finance terrorism is to engage in [[cbdc:private:cbdc_omg:8_append:20_glossary:financial_crimes]]. There are four main areas of Financial Crimes used to fund terrorism: | + | The main way to finance terrorism is to engage in [[cbdc:public:cbdc_omg:8_append:20_glossary:financial_crimes]]. There are four main areas of Financial Crimes used to fund terrorism: |
| - | * [[cbdc:private:cbdc_omg:04_doc:15_common:48_natsec:10_human_traf | Human Trafficking ]] | + | : a. [[cbdc:public:cbdc_omg:04_doc:15_common:48_natsec:10_human_traf| Human Trafficking ]] |
| - | * [[cbdc:private:cbdc_omg:04_doc:15_common:48_natsec:20_drug_traf | Drug Trafficking ]] | + | : b. [[cbdc:public:cbdc_omg:04_doc:15_common:48_natsec:20_drug_traf| Drug Trafficking ]] |
| - | * [[cbdc:private:cbdc_omg:04_doc:15_common:48_natsec:30_corrupt | Corruption ]] | + | : c. [[cbdc:public:cbdc_omg:04_doc:15_common:48_natsec:30_corrupt| Corruption ]] |
| - | * [[cbdc:private:cbdc_omg:04_doc:15_common:48_natsec:40_launder | Money Laundering ]] | + | : d. [[cbdc:public:cbdc_omg:04_doc:15_common:48_natsec:40_launder| Money Laundering ]] |
| The U.S. and much of the rest of the world have developed extensive systems of Laws and Regulations to combat these crimes and the design of the CBDC should use and leverage these existing systems rather than try to build something new. | The U.S. and much of the rest of the world have developed extensive systems of Laws and Regulations to combat these crimes and the design of the CBDC should use and leverage these existing systems rather than try to build something new. | ||
| Line 205: | Line 212: | ||
| There are two main tools of the [[https://www.omgwiki.org/dido/doku.php?id=dido:public:ra:xapend:xapend.a_glossary:a:aml | Anti-Money Laundering (AML)]]: | There are two main tools of the [[https://www.omgwiki.org/dido/doku.php?id=dido:public:ra:xapend:xapend.a_glossary:a:aml | Anti-Money Laundering (AML)]]: | ||
| - | * [[https://www.omgwiki.org/dido/doku.php?id=dido:public:ra:xapend:xapend.a_glossary:k:kyc | Know Your Customer (KYC)]] | + | : a. [[https://www.omgwiki.org/dido/doku.php?id=dido:public:ra:xapend:xapend.a_glossary:k:kyc | Know Your Customer (KYC)]] |
| - | * [[https://www.omgwiki.org/dido/doku.php?id=dido:public:ra:xapend:xapend.a_glossary:c:cdd | Customer Due Diligence]] | + | : b. [[https://www.omgwiki.org/dido/doku.php?id=dido:public:ra:xapend:xapend.a_glossary:c:cdd | Customer Due Diligence]] |
| - | Both of these are well understood and documented in the existing system by Intermediaries. Regardless of the [[cbdc:private:cbdc_omg:04_doc:15_common:08_currency_models:start | Currency Model]] used for the CBDC (i.e., [[cbdc:private:cbdc_omg:04_doc:15_common:08_currency_models:10_cash:start | Digital Cash Model]] | + | Both of these are well understood and documented in the existing system by Intermediaries. Regardless of the [[cbdc:public:cbdc_omg:04_doc:15_common:08_currency_models:start| Currency Model]] used for the CBDC (i.e., [[cbdc:public:cbdc_omg:04_doc:15_common:08_currency_models:10_cash:start| Digital Cash Model]] |
| - | or [[cbdc:private:cbdc_omg:04_doc:15_common:08_currency_models:15_accounts:start | Digital Account Model]]), it should embrace these existing sets of tools and adapt them as need be. | + | or [[cbdc:public:cbdc_omg:04_doc:15_common:08_currency_models:15_accounts:start| Digital Account Model]]), it should embrace these existing sets of tools and adapt them as need be. |
| ** 4. Record Keeping: ** | ** 4. Record Keeping: ** | ||
| Under the [[https://www.omgwiki.org/dido/doku.php?id=dido:public:ra:xapend:xapend.a_glossary:u:us_patriot_act_-_title_iii | US Patriot Act, Title III: Anti-money-laundering to prevent terrorism of 2001]] Title III facilitates the prevention, detection, and prosecution of international money laundering and the financing of terrorism [[https://www.omgwiki.org/dido/doku.php?id=dido:public:ra:xapend:xapend.a_glossary:u:us_patriot_act_-_title_iii#second_subtitle | Second Subtitle]] attempts to improve communication between law enforcement agencies and financial institutions, as well as expanding **record-keeping** and **reporting requirements**. | Under the [[https://www.omgwiki.org/dido/doku.php?id=dido:public:ra:xapend:xapend.a_glossary:u:us_patriot_act_-_title_iii | US Patriot Act, Title III: Anti-money-laundering to prevent terrorism of 2001]] Title III facilitates the prevention, detection, and prosecution of international money laundering and the financing of terrorism [[https://www.omgwiki.org/dido/doku.php?id=dido:public:ra:xapend:xapend.a_glossary:u:us_patriot_act_-_title_iii#second_subtitle | Second Subtitle]] attempts to improve communication between law enforcement agencies and financial institutions, as well as expanding **record-keeping** and **reporting requirements**. | ||
| - | Also, under the definition of [[cbdc:private:cbdc_omg:8_append:20_glossary:financial_crimes]] provided by the Federal Reserve, financial institutions must comply with a robust set of rules that are designed to combat Financial Crimes. These rules include [[https://www.omgwiki.org/dido/doku.php?id=dido:public:ra:xapend:xapend.a_glossary:c:cdd | Customer Due Diligence]], record keeping, and reporting requirements. | + | Also, under the definition of [[cbdc:public:cbdc_omg:8_append:20_glossary:financial_crimes]] provided by the Federal Reserve, financial institutions must comply with a robust set of rules that are designed to combat Financial Crimes. These rules include [[https://www.omgwiki.org/dido/doku.php?id=dido:public:ra:xapend:xapend.a_glossary:c:cdd | Customer Due Diligence]], record keeping, and reporting requirements. |
| - | Therefore, the CBDC should rely on the existing Intermediaries to help provide well documented, tried and true Record Keeping. Blockchain Technology may help alleviate some of the record-keeping responsibilities, but the blocks must include enough information to support **record-keeping** and **reporting requirements**. | + | Therefore, the CBDC should rely on the existing Intermediaries to help provide well-documented, tried, and true Record Keeping. Blockchain Technology may help alleviate some of the record-keeping responsibilities, but the blocks must include enough information to support **record-keeping** and **reporting requirements**. |
| ** 5. reporting requirements: ** | ** 5. reporting requirements: ** | ||
| Line 223: | Line 230: | ||
| </WRAP>| | </WRAP>| | ||
| ^ D0016 ^ Design should include offline capabilities to help with operational resilience of the payment system |<WRAP> | ^ D0016 ^ Design should include offline capabilities to help with operational resilience of the payment system |<WRAP> | ||
| - | See the answer to [[cbdc:private:cbdc_omg:04_doc:20_comments:dsn:q18]]. | + | See the answer to [[cbdc:public:cbdc_omg:04_doc:20_comments:dsn:q18:start]]. |
| </WRAP>| | </WRAP>| | ||
| ^ D0017 ^ Design should include digital payments in areas suffering from large disruption, such as natural disasters | <WRAP> | ^ D0017 ^ Design should include digital payments in areas suffering from large disruption, such as natural disasters | <WRAP> | ||
| - | See the answer to [[cbdc:private:cbdc_omg:04_doc:20_comments:dsn:q18]]. | + | See the answer to [[cbdc:public:cbdc_omg:04_doc:20_comments:dsn:q18:start]]. |
| </WRAP>| | </WRAP>| | ||
| + | | **''B''** = [[cbdc:public:cbdc_omg:04_doc:12_summary:start#benefits| Benefit Considerations ]] ||| | ||
| + | | **''P''** = [[cbdc:public:cbdc_omg:04_doc:12_summary:start#policy_considerations| Policy Considerations]] ||| | ||
| + | | **''R''** = [[cbdc:public:cbdc_omg:04_doc:12_summary:start#risks| Risk Considerations ]] ||| | ||
| + | | **''D''** = [[cbdc:public:cbdc_omg:04_doc:12_summary:start#design| Design Considerations]] ||| | ||
| </table> | </table> | ||
cbdc/public/cbdc_omg/04_doc/15_common/48_natsec/start.1651947618.txt.gz · Last modified: 2022/05/07 14:20 by nick
