Atlantic Council looks at how to maintain central bank digital currency cybersecurity

The U.S. thinktank Atlantic Council released a report Wednesday on cybersecurity issues related to central bank digital currencies (CBDC). The authors provide a generalized discussion of CBDC security, but with a clear focus on the United States and issues specific to it.

They determined that the security risks presented by a CBDC depend heavily on its design, with performance, security and privacy being balanced variously in different designs. The report looked at six design options, only three of which are being considered or deployed in real life.

Privacy was identified as the main risk from a CBDC for consumers. In some designs, a CBDC could store a record of user activity and transactions, leading to the risk not only of thetheft of funds but also the theft of users’ personal information. The report says that:

“A CBDC could contain large volumes of personally identifiable information ranging from what prescription drugs you buy or where you travel each day.”

Reduced regulatory oversight was seen as a risk from the introduction of a CBDC of any type as well. Nonetheless, increased privacy can enhance security, the report said, while still providing “some level” of regulation. The Fourth Amendment to the U.S. Constitution, protecting against unreasonable search and seizure, should apply to the CBDC ledger, the report noted, forcing prosecutors to obtain a court-issued warrant before accessing it.

The report provided a range of recommendations for the design of a CBDC. It emphasized that the current system of wholesale and retail payment systems faces significant and complex risks, many of which are the same as a CBDC would face and recommended using existing security systems to safeguard CBDCs when possible.

The fast recovery of payment volumes on Fedwire, the U.S. Federal Reserve’s domestic funds transfer system, after the attacks on September 11, 2001, which knocked out critical infrastructure, was cited as evidence of the system’s resilience. The hacking of the Bangladesh Bank in 2016 was held up as an example of the vulnerability of the public-private wholesale payment system as a whole.

The report also summarized the 20 pieces of CBDC-related legislation now before the U.S. Congress.

‏‏‎ ‎