The Black Liszt

The Apple-FBI Fiasco

The brouhaha with Apple and the FBI's investigation of an act of terrorism is tragic, comedic, scary and ridiculous. The only good "side" to take here is a side that few people, and none of the major actors, appear to be on.

Here are some of the major points.

Why the FBI needed help. The FBI should have submitted the phone to Apple for cracking immediately, using Apple's standard procedure for this. Instead, they bungled it. They changed the password and locked themselves out of the phone and its iCloud backup.

Whose phone? Apple got on it's higher-than-high horse refusing to help crack the phone because it protects the privacy of individuals. But the terrorists had already destroyed their personal phones. This was a terrorist's government-issued work phone. No privacy was involved.

The FBI's "unprecedented" request to Apple. Apple has a department that cracks phones. They crack thousands a year, and hundreds a year just for national security cases. Apple has a formalized process for it, which as of today remains on their website. The FBI's request should have been run-of-the-mill. Details here.

The slippery slope. Apple made claims about how responding to the FBI request would create a master key that would soon render all Apple phones insecure. This was bogus, as I detail here.

Privacy uber alles. Apple stood up as the firm defender of personal privacy -- including that of murderers and other criminals.

Lost opportunity. Apple could have come out of this a hero -- a strong protector of personal privacy and a strong ally of law enforcement against terrorists and criminals. Here is how.

Apple's insecure software. Apple's wants us to think their software is wonderful and their security flawless. No one mentions the scores of bugs that riddle their software. With each release, they introduce at least as many new bugs as they fix. Some of the bugs are security holes! White-hat hackers find some of them and tell Apple; Apple responds by eventually fixing the bugs and eventually releasing the fixes.

Finally cracking the phone. After all the sturm-und-drang, a "private company" approached the FBI and offered to crack the phone -- and cracked it, leading the FBI to withdraw their suit against Apple. The company is Cellebrite, which has a commercial service that cracks iPhones in a forensically sound way. Do you think someone at the FBI could have used Google to find this group before suing Apple? Do you think Apple could have referred the FBI to them quietly instead of making a stink?

No one comes out of this mess looking good, including the media, which did little research and simply took sides. For example, I have found no media outlet mention Apple's standard phone-cracking service, which I published here. After this and the recent events in Europe, who can feel good about either the FBI or Apple?

Fintech: the world of cash cards

Cards. Love them or hate them, they are a key part of our lives in general, and of the fintech part of our lives in particular. If you're going to understand fintech, it's important to understand at least the basics of what goes on behind the scenes with cards. Not to mention knowing the proper terminology to use.

You spot a bank. You know you're getting low on cash. You stop and walk up to the machine. You pull out your wallet, and here comes your first choice: which card should I use? You probably don't think much about it, since there's probably a card you're used to using. But what makes your "cash card" special is that you know the four digit PIN code that stands between you and your cash.

But they're not all the same. The most basic and original kind of card is an ATM card. Here's an example:

Notice that the card doesn't say VISA or Mastercard on it. It's an ATM card, which is different! You put the card into the machine:

Then you enter your PIN code on the keypad. The ATM machine is actually connected, perhaps through a series of networks (more on them later) to your bank's computers. The first few of the card numbers identify your bank. Your bank gets the request and checks your balance. If you have enough money in your account, the bank immediately debits your balance, and sends an approval of the withdrawal request to the ATM machine. The machine then counts out your money and you take it:

You take your card and the transaction is complete, just as though you had been with a human teller.

The original ATM machines were connected to the same computers in roughly the same way as human tellers. Each bank had its own ATM machines, just as each one had its own branches.

Shortly after ATM's were deployed, the first interbank network was rolled out. One of the first was NYCE.

NYCE was developed and owned by a set of New York banks to enable a customer of any bank in the network to use any ATM that was also in the network. There are now over 300,000 ATM's in the NYCE network, and a whole lot more in the other networks that sprang up to compete with them.

If you pull out that bank card and try to pay for a meal in a restaurant with it, things aren't going to end well. But banks want you to use their cards! So after some time, the debit card was introduced. It looks nearly the same as an ATM card, but not quite. Here's mine, for example:

It has the same general appearance and numbering scheme as the ATM card pictured above, and the same "good thru" date. But it says VISA, and it says "DEBIT," which makes it different!

One way to think of it is a card with two hats on.

Hat number 1, the DEBIT hat: it's an ATM card. You put it in an ATM machine, enter your PIN, get your cash and away you go.

Hat number 2: the VISA hat: it's a "credit card." You hand it to the cashier at the store, it's swiped, and you walk away with your stuff. Except that, instead of being a separate account, the card is associated with your normal bank account, and the money comes directly out of your checking account. No talk of "minimum payments," it just comes out. Hope you've got enough there! Because it's not a "credit" card -- it's, sneakily, a kind of cash card!

That's enough about cards for one sitting. But I hope you can see a theme emerging: there are a number of systems designed and built for different purposes that can be accessed by cards that look and act much the same ... except the underlying technology is completely different.

 

Fintech: Whose rails are you using?

Like most specialist areas, fintech has its own vocabulary, highly meaningful to insiders but opaque to outsiders. The important issue of “whose rails are you running on” is one of those phrases.

Insider vocabulary

Some people learn to play a bit of baseball when they're young:

They learn basic vocabulary like bat, ball, base, hit, grounder, fly ball, catch, throw and out. That's already lots of words! But the pros and other people who are seriously into what the rest of us lightly call the "game" share a greatly extended set of concepts, words and phrases among themselves.

To take a couple simple examples, there is the “squeeze play” and the “infield fly rule.” Those are just a couple I happen to know. I'm sure there are whole piles of words and phrases that are way beyond me. It’s the use of that specialized vocabulary that distinguishes people who “know baseball” from those who merely watch or attend games.

Fintech is no different. There is some shared vocabulary among all the sectors of fintech. In addition, each specific fintech domain has its own set of vocabulary and concepts, arranged in layers according to how deep you are into the business or technology of the specific fintech sector.

Rails in fintech

When someone talks about "rails" in the payments sector of fintech, they're talking about the mechanics of how money gets from a sender to a receiver. It's about transportation.

It turns out that the image of "rails" is appropriate. Rails are what trains run on. They're big, elaborate, fairly expensive things that were developed a long time ago, and have been somewhat modernized. They constitute a system that is completely separate from and incompatible with the larger and more recent system of roads used for trucks and cars.

Even though railroads started decades before the modern road system, they are a valuable part of today's transportation system. They handle certain kinds of transportation far more efficiently than road-based trucks could.

Same thing with financial-system "rails." They are robust, reliable and cost-effective for the kinds of "cargo" they transport (financial transactions), and not about to be replaced any time soon.

Layers of competing technology

Fintech's technology of "rails" is not only separate from the "normal" way data moves around today, it's remarkably complicated. You may think it's pretty simple, just like I did. It's just adding and subtracting, and every once in a while you multiply to calculate interest; how bad can it be? Reality educated me; I was wrong, big time! And what's worse, there is more than one system of rails!

Let's take one rail system as an example: the ATM network, a.k.a. cash machines.

These are older than you might think. Here's what an early cash machine looked like in 1967:

It was just a railroad car; no network yet, and therefore no "rails." But a true networked version soon followed. It's not easy to find out the historic details, but it appears to have happened early in the 1970's:

The ATM network is just one set of rails. The credit card network has a rather different set, which is completely incompatible. Which is why, among other reasons, the choice of rails is important!

Conclusion

The "rails" used by financial transactions in fintech are deep, robust, incredibly complicated and separate down to the roots from most modern technology. The chance that a bunch of bright kids in a garage is going to come up with a bright idea and replace it next year is zero. And there's more than one rail system to use!

That's why one of the most important questions for payments in fintech is "whose rails are you using?" Even if you have no clue how those rails are built, and few people do, the answer is nonetheless important.

Apple can help fight crime while maintaining privacy

Apple can and should maintain the privacy of the information their customers have on Apple devices. But what if the owner is a criminal or terrorist, and the relevant law enforcement agency has a court-ordered warrant? Apple should bend over backwards to help the agency fight crime and terrorism. It can do this without "back doors" or any of the awful things that some people talk about.

The government

The government scares me. I don’t want them anywhere near my private information. They have way too much power. If any little thing goes wrong, someone in government can trample all over me. My fear is equal opportunity. If Republicans are in charge, some of them will be corrupt and will decide to use my private information to trample on my rights. If Democrats are in charge, same thing. And bureaucrats of whatever stripe ... I shudder. I want to be able to have my private information encrypted and secure, so that no one – including the institutions who are supposed to be keeping us safe – has access to it. PERIOD.

Sadly, the government already has whole huge piles of my private information all over the place in their files and computers. Moreover, the government appears to be incompetent at keeping private information private. The IRS has been hacked. The White House itself has been hacked. Even that biggest and baddest of security agencies, the NSA, had a massive insider breach. This is not the sort of thing that’s going to be fixed, because they don’t even have the theory of information security right, much less the practice. Details here.

On the other hand…

There are bad guys out there!

Bad guys are bad. They want to steal things. Some of them want to hurt me. They have all sorts of reasons. Some are crazy, some are sociopaths, some are evil, some are driven by a religious and/or political ideology that leads them to commit acts of violence; sometimes we call them terrorists. People in various institutions have the job of keeping law-biding people safe from the depredations of criminals, crazies and terrorists, and/or tracking them down after they’ve done one of the heinous things they are wont to do. These protectors including various branches of the military and other branches of the government, including the CIA, FBI, NSA and others. Like any normal, sane person, I want to be safe. I want someone to keep me safe from the bad guys, and when bad things happen, I want someone to track down the bad guys to prevent them from doing more bad, and to send a message to other bad guys that they probably won’t get away with whatever bad thing they have in mind.

This means…

The government needs to keep out of the private business of the citizens. We are part of a country ruled by a Constitution. There is a Bill of Rights, the fourth amendment in particular. HOWEVER: The government's job includes keeping us citizens safe while protecting our rights. Part of the job.

The people who keep us safe and dig into crimes when prevention hasn’t prevented need to be able to do their jobs. If the courts agree to issue a subpoena, they need to be able to search for evidence. Under the fourth amendment and codified in long-standing procedure, there is a process for ensuring that the privacy of law-abiding citizens is maintained, while at the same time ensuring that, with proper judicial approval, searches and seizures can be performed to maintain the safety of citizens.

Under the right circumstances and controls, sane people want government law enforcement agents to do their jobs, protect us and catch wrong-doers.

What about Apple?

Prior to iOS 8 and the current brouhaha, Apple responded as it should have to requests of this kind, thousands per year of normal requests and hundreds per year involving national security. See here for details. Suddenly they changed. Here is the choice they made.

Currently Apple has a well-deserved reputation as a criminal’s friend and supporter of terrorists. Do you think the bad guys don't pay attention? They do.

What Apple should do

Apple should become:

• the best friend of law-biding citizens who want to maintain the privacy that is their right under the Fourth Amendment, while at the same time becoming
• the scourge of criminals and terrorists.

Specifically, Apple should strengthen and grow the facility they already operate on their Cupertino campus to receive and crack the devices of criminals and others, under strict subpoena and court order control. As they do today. They can and should extend this valuable, safety-maintaining service to iOS 8 and all future hardware and software.

Would this be expensive? What if it cost, say, $20 million a year? That amounts to less than 0.01% of the CASH that Apple has on hand. It would be a rounding error at ten times the cost.

Apple could brand the center as the scourge of criminals and terrorists, and make their phones something that bad guys actively avoid using. That way, anyone who uses an iPhone is proclaiming that they’re a good guy – and they’re also proclaiming that Apple keeps their private information safe and secure, unlike (I’m sad to say) most government agencies.

Is this possible? Yes. Apple has wisely avoided denying that they are incapable of cracking a phone that is in their physical possession. Which are the only phones they should be cracking anyway. Should they give their tools to anyone else? NO WAY!

What about phones that are in the field? Could Apple remotely hack them? Of course they could! Strictly under court order, strictly from the Cupertino Bat-cave, and solely the identified phone under Warrant.

Apple's ability to crack phones under these strictly limited circumstances has NOTHING to do with creating dangerous "back doors" or somehow defeating amazing encryption. It's about hardware and the software that runs on it, both of which are entirely of Apple's design and under their control.

Apple has the opportunity to protect the privacy of its customers much more effectively than the government does, while at the same time helping law enforcement protect us against criminals and terrorists. I hope they'll step up and do the right thing.

Fintech Business Strategies

The business strategies employed in fintech aren't much different from general tech strategies, and they all leverage the fundamental drivers of innovation that drive all the tech in fintech.

Behind every fintech business strategy are a few simple principles:

• Eliminate places
• Eliminate people
• Eliminate things
• Reduce time
• Reduce cost

Every fintech business strategy is a specific implementation of technology that employs some combination of the principles above.

The leading strategies include:

Expand the pool of consumers/users

Who would have thought that people who operate web sites are good candidates for loans? But like many other businesses, they have to pay suppliers (like data centers) promptly to avoid getting cut off, while their customers (like advertisers) aren't as prompt as they might be in paying their bills. Rapidly growing Fastpay meets this need in a sophisticated, integrated way that includes lending money, but goes way beyond just lending money. For example, here's one of their latest services:

Expand the pool of producers/providers/sellers

What if you sell stuff at the local farmer's market? People keep coming up to you wanting to buy your produce. They don't have enough cash, but they have a credit card. What if you could accept their money without going through the nightmare of expense, hassle and non-portable devices regular stores put up with? Enter Square, whose little device and app turn the smartphone you probably already have into a POS terminal and card acceptance device:

Apply technology to make an existing service: better, faster, cheaper

Lots of fintech is direct to consumer, but important fintech companies operate completely behind the scenes, largely invisible to normal consumers. An exciting company that has a new, machine-learning-based approach to credit card fraud prevention is a good example. By doing a far better job of preventing fraud, Feedzai reduces the cost of providing credit card services dramatically. Here's one way they express the issue:

Replace and enhance existing technology

Sometimes, the innovating fintech company is able to completely replace a legacy product. This is ambitious and difficult to pull off, but the rewards are great if you can do it. Everyone is familiar with point-of-sale (POS) terminals and credit card charge terminals that are normally separate devices. For example, here's a card terminal at my local pharmacy:

Poynt has invented a single device that replaces the card terminal the consumer uses to swipe or insert their card as pictured above, but also POS terminal used by the retail clerk. Here it is:

Cut out a middle-man (disintermediation)

This has been a favorite business strategy since long before 1-800 Flowers started cutting out local florists. It's alive and well in fintech-land. A good example is Insureon, which uses the web to attract very specific groups of small business people and sell them insurance that is completely directed to and appropriate for their needs. For example, how many local insurance offices do you suppose cater specifically to the needs and perspectives of dog walkers?

There are hundreds of fintech companies working to extend and disrupt the financial services industry. The business strategies described above are typical, but not exhaustive; and some companies pursue combinations of them. (Note: all the companies used as examples except Square are ones in which Oak HC/FT has an investment.)

 

Fintech Innovation: the Drivers

What are the underlying principles driving innovation in Fintech? The same, identical, unchanged principles that drive innovation of tech in general. Nothing new! It's just applied to Fin.

We all know what those principles are. We've become used to them as wave after wave of improvement washes over the devices and services we use every day. In normal, physical things the changes are dramatic, going from literally using horse-power:

To steam-powered engines on rails:

To jet-powered planes that fly us in the sky:

Compared to last year, things get: faster, cheaper and better. That's it!

But when electronics and software are involved, as they are in most of fintech, the rate of change is even greater. That's why most of the disruptive changes we see in fintech are little more than fintech catching up with other sectors that have pioneered and are already using the technology. Like for example, "gee, people seem to like their smartphones. There are an awful lot of them out there. Maybe we could figure out a way to put the tech in fintech; maybe build an app or something?!"

What this amounts to is simple in principle, though often challenging in practice.

So how does faster, cheaper, smaller/better underlie innovation in fintech? The main ways include:

Replace physical objects large and small with digital

This reduces cost and speeds things up.

Devices instead of places

Don't go to a place (which is expensive to build/buy, maintain and staff), use your computing device. Call up the specific banking-like function you want on your device, and get your job done, right now. Consumers prefer it because it eliminates travel time, wait time and hassle. For example, money transfer with Abra:

Replace people with data and algorithms

This reduces cost and speeds things up. Consumers prefer it for the same reason they'll use an ATM even when human tellers are available. Don't make an appointment, get dressed up and see the loan officer at the bank; enter your data in the loan app and get an immediate decision with immediate access to the money. For example:

Summary:

• Use the device you have to get the job done.
• Eliminate the man in the middle; no people.
• Digital beginning, middle and end.

Result: faster, cheaper, better!

 

What is Fintech?

Fintech. It’s new. It’s big. Everyone wants a piece of it. Better jump into Fintech before it’s too late!

But what is Fintech? Fin? Like the thing that fish have? That Chinese people put in soup for special occasions?

No, it’s not the technology behind Shark’s Fin soup.

It’s “Financial” Technology.

Oh, that’s simple. Fintech is about money! I know what that is!

But since when is money new? And everyone has always wanted a piece of it. So “Fintech” can’t just be money, if it’s both “hot” and “new.”

And it’s not. “Fintech” is the name for a diverse collection of companies and products, each of which applies modern technology to some aspect of financial transactions.

Phew! That’s quite a mouthful! And kind of vague. So let’s dig in and see what’s really going on.

Fintech and real people

First of all, let’s be clear that the vast majority of people, normal people, not only don’t know what “fintech” is, they don’t need to know and don’t really want to know. Who feels the urgent need to replace their old “fin” with a fancy new “fintech,” after all?

Just think about phones. Maybe you didn’t envy the people who walked around with giant phones with antennae sticking out of them yakking away on the street.

But the second you saw someone pulling a ringing flip phone out of their pocket and answering the call, you probably felt the urge. And then when the iPhone came out? There were lines snaking out of Apple stores. Everyone knew what phones were and how they worked, and all you had to do was see one of the fancy new ones to want one.

“Fintech” is something investors, market analysts and corporate types in financial companies think and talk about. Regular people? Nope. It’s more like "energy sector” or “entertainment;” it’s a group term that covers lots of stuff that’s only vaguely related. For example, here’s a graphic that shows one group’s view of fintech:

And then when you dive into just one sector of Fintech, Bitcoin/Blockchain, here’s something that shows the intense interest of big corporate players in it:

Over 70 strategic investors have put real, old-fashioned money into these startups!

Conferences

Let's talk about conferences. Big ones. That, as a normal, everyday kind of person, you've probably never heard of.

Like Money20/20, an amazing conference that started just four years ago, whose subject is "disruptive ways in which consumers and businesses manage, spend and borrow money."

Another conference is smaller, but is all about people who invest in the kinds of small companies at Money20/20:

And who among us "normal" people might have even gotten close to the right answer to the question, "How much money was invested in Fintech companies last year?"

Perhaps now you're starting to get a sense of why Fintech is new ... and why it's hot, hot, HOT!!