In Conversation with Gemini and Brian Kim Johnson
by Brian Kim Johnson
January 31, 2020
This interview with Brian Kim Johnson, a software engineer at Gemini, was conducted and condensed by frank news. The basis of the interview comes from the article, Cold Storage, Keys & Crypto: How Gemini Keeps Assets Safe
frank | There’s a quote in the article that reads, “there are many ways to self secure cryptocurrencies.” What are those ways?
BKJ | There've been a lot of different ways to store historically, but I'll give you a couple of ways that people would do it today. The easiest way someone could self custody Bitcoin today is with a phone wallet. There are many reputable phone wallets available for iOS and Android. You would download one of those, you would open it up, it would prompt you to back it up, to do what's called a feed backup. And that's just to make sure that you don't lose control of your funds. And after that you would be given addresses, Bitcoin addresses, which is what's required.
It’s the equivalent of bank account information, but it is public. If you share your bank account, someone can take your money, but that's not the case with Bitcoin. So that is probably the most approachable way to store money on your own for self custody.
I am assuming there are some security implications with this.
As with all storage of digital assets, this has a lot of security implications.
To offset that, more advanced users will use what's called a hardware wallet, some phone wallets even support having a hardware wallet. In a phone wallet you have to put the so called private key; the private key is the number that is used to sign the money over to someone else that has to reside on your phone. Naturally, if it resides on your phone, that means there could be ways for malicious apps or malicious users to get at that private key and take your money.
The hardware wallet is a separate device, single purpose device. It's not too dissimilar from the secure element that's behind your fingerprint reader or your face ID in iOS. Unlike a phone, which is general purpose, and could do basically anything that someone could program it to do, a hardware wallet does one thing, and that is store digital assets.
A phone wallet is a good introductory self custody and then once anyone gets comfortable with using a phone wallet if they wanted to move on to more advanced forms of self custody then hardware wallet tends to be where they go.
Within the realm of self custody, there was a note about individuals considering their beneficiaries and how other people might recover those funds within this very secure setup. How does that work?
I think it's useful to go back to what self custody means.
Self custody means that the sending and receiving of the funds is purely based off of the holding of a specific private key.
We say that Bitcoin is a cryptocurrency or i.e. based on cryptography. The way that it's based on cryptography is that the receiving of money goes to an address, but that address, the sending out of the money from that address, is purely based off of knowledge of a number. We say private key but a private key is just a really, really, really large number and if you have that number you can send the funds and we say that those are your funds. In Bitcoin there's really only two kinds of money. There's money you can't spend, you can't send to other people because you don't know the key and there's money that you can send to other people because you know the key. And this is why it's sometimes referred to as a bearer instrument.
Now the problem is, you know when people devise these self custody solutions like the phone wallet or even in the case of the hardware wallet. Letting other people know how to recover the money is the same as giving them the money. There isn't actually a lot of difference. Now you can do much more fancy tricks by using more complex Bitcoin scripts. But I would say for most people that is not really an option today and this is actually an area where there's a lot of innovation happening around wallet software.
Regardless, if knowledge of this number is the only way that you demonstrate having the money, then it becomes a real challenge and this is distinct from money in your Gemini account as an example.
Because money in your Gemini account is under the control of Gemini?
Yes. Because your claim to this money is based off of a legal relationship. I guess that brings you to a place where self custody is ultimately about “how do I ensure that someone gets this information but only under those certain circumstances?” This leads self custody users to take keys and put them in bank vaults, coming up with elaborate schemes, but it's certainly an area that requires a lot of work for, I would say, non technical persons to really engage in today.
I want to move into partial custody now – what do third parties do with your information? At least what is normal now?
Can you walk me through talking about partial custody here because the question seems to be about data privacy...
If I'm using a wallet or some sort of service, what is happening with my information? What do the privacy regulations in this space look like?
Oh, I see. In the partial custody model we're talking about an organization where you hold a key and the other organization holds a key. Most partial custody providers, it's a little unclear how they would be regulated.
A couple of things that they would absolutely know – they know everything that you've told them.
If you're required to KYC [Know Your Customer] into that product, then they obviously know that, they will know every transaction that you ever do by virtue of the fact that they have to sign it themselves. And naturally they will know everything that you do on their website or you do in their partner wallet.
And so in this way, every bit of information that you would trust to your third party custodian, you are either explicitly or implicitly giving away in your partial custody custodian. So in self custody, I guess the only users that can watch you are the ones on the chain and whoever wrote your wallet software. But in partial custody you actually have to submit every transaction that you are doing to another individual. At least that's the state of the art today. But partial custody is primarily for businesses. There are some partial custody for, retail users or normal people on the streets like myself.
Partial custody is generally speaking a business level offering.
So it's a little bit different. I mean, if you happen to use a third party custodian that uses a partial custody arrangement, then you aren't just sharing the information with your own custodian, you're sharing it with some second business in addition. I think that's always a consideration for users who are signing up for a fully hosted wallets.
Moving into fully third party custodians – who regulates these companies? To me it seems a lot of the driving narrative and the premise of crypto and what is so exciting is that it's decentralized and there's nobody in charge. So who holds anybody or any company accountable?
That's a great question. We think about this a lot at Gemini. I think you're right that what's most exciting about Bitcoin is the possibility that it scales down to the individual. This is the part of the technology that we haven't seen before. This is why the space is compelling, but it also makes it pretty complicated. Third party custodians are an important part of the development of the industry today. So who regulates third party custodians?
It really depends jurisdiction by jurisdiction and in some cases, in the US it depends state by state. If someone is a full custody provider like Gemini, then we certainly take the position that in the United States you will be regulated as a money transmitter. In New York you'll be regulated under having both a bit license. But we, Gemini have gone further in getting our trust license. And there are a lot of different services that are trying to push at the margins of these offerings to see whether or not they can be less regulated.
It certainly seems by recent SEC actions, and other regulatory actions, that these organizations, while not being banks, will end up being subject to much of the regulation that banks are subject to.
A lot of this is about company driven choices. Gemini decides to do this or decides to do that, are there laws in place that say yes this is okay, or no this is not okay?
It depends on which jurisdiction you're operating in. FINRA gave guidance around wallet software in may or June of last year.
They went into detail and actually maybe for the first time went into detail around exactly how money transmission license would date. At least in their mind transmit to responsibility for third parties. And it's actually pretty instructive I think for organization now, every single organization, depending on where they're domiciled, depending on where they operate, would have to make these choices. But certainly Gemini has always maintained this posture from the beginning that this is money transmission, that this is the same. That full custody should require the same level of security, the same level of due diligence and financial regulation.
It remains to be seen how the space will progress. But certainly in the US it's getting a lot more clear year over year.
Carolyn Vadino [Head of Communications, Gemini] | To add on that, in the state of New York, you're required to have either a Trust or a BitLicense. I would suspect its the reason that many companies don't headquarter out of New York, you going through a more rigorous process to establish the company. But in addition to the Trust License, we also are subject to things like KYC procedures. Because that's again how financial institutions verify their customer identities.
Gemini is subject to those rules and regulations as well. Since we're a Trust company, we're subject to that and we must adhere to strict goverence and procedures regarding how we store and use personal information. That's also why we have an audit trail and we have our SOC 2 type 1. So there's a bit of a rabbit hole we can go down to talk about how we demonstrate those levels of security compliance. But that's what comes with getting a Trust License. And part of those stringent specifications on how we store and protect data as well, in addition to how we actually onboard people onto our platform. Which inlcude AYC, AML requirements as well.
That's clarifying and helpful. It's interesting how local it all is considering the whole thing is on the internet and has no physical manifestation.
If you're approaching this through the lens of, I fully believe in decentralization and I want to self custody, then I think that thinking 100 percent applies. But if you're an individual who chooses to go to a third party to hold your keys, IE. your Bitcoins, then you get into that gray area of money transmission and banking laws. Gemini has always taken the position that if you're going to choose to use an institution to, either buy, sell or store your cryptocurrencies that institutions should have regulatory oversight. Which is why Gemini has taken the approach that we've taken. I think there's a world in which both of those approaches exists and we're not advocating that if you're self custodying that, that should be regulated, but if you're certainly coming to a third party, there should be oversight of that third party.