Five things all underwriters should know about cryptocurrency

My name is Nicholas Berry and I’m here with Professor Peter McBurney. We were one of the first law firms to realise the potential importance of digital assets to our commercial client base as well as those operating in the FinTech space.

I’m a corporate insurance partner in our London team. We’ve been heavily involved in the innovation of insurance products, looking to cover our FinTech businesses that may transact or provide services in relation to cryptocurrency such as exchanges, but we’ve also been involved in designing products around insurance solutions relating to the storage of crypto-assets.

The policy wording is unique in that it needs to capture and deal with many quite tricky concepts that results from the underlying technology that underpins these cryptocurrencies and as a result, what’s been great about this line of work is we’ve been able to leverage our new Head of Consulting Technology, Professor Peter McBurney, who’s sitting next to me.

Thanks, Nico.

So as Nico said, I’m a Professor of Computer Science at King’s College London. I’m not a lawyer so I’m bringing a computer science or computational perspective to this. There’s a big difference between digital assets and traditional physical assets and the difference is that a copy of a digital asset might be just as powerful or just as valuable as the original, which wouldn’t be the case with a painting, for example. Certainly if you have a copy of someone’s BitCoin private keys, then you can do everything with that copy that the people who have the original private key can do.

So this creates some problems in terms of storage and custody and secure custody. One distinction that people in this field are making now is between hot storage and cold storage. Basically, hot storage is storage of a digital asset in a medium or on a device that is connected to the internet. Cold storage is storing it in a way or on a device which is not connected to the internet. That’s fine keeping things secure, but if you want to actually use that private key to actually do some transactions now and again, then you have to get the private key from cold storage to hot storage and then presumably take it back from hot storage to cold storage.

So that has created issues for insurance of the custody and most insurers that we’ve seen who are willing to insure custody of private cryptocurrency keys, are only willing to insure in the case of cold storage, they’re not generally willing to insure if it’s in the form of hot storage.

Security of the custody depends crucially on the hardware, the software and the processes that apply in keeping the custody of these private keys, so in particular, the various processes that govern key life cycles:. the creation of the keys, the creation of backup copies, the storage of the keys and the backup copies, the retrieval, if you wish to retrieve for transaction purposes, and maybe eventual destruction of private keys. So having hardware, software and processes to govern this whole life cycle is crucial to being able to say the system is secure.

One activity, as Nico alluded to, one activity we’ve done is to give advice to underwriters on proposals from would be insured organisations for how those processes should work, and in some ways, this is a similar exercise in principle to assessing the security of a vault, but we’re not just assessing the physical security, we’re assessing the software, the cybersecurity in effect and the work flow processes that will be involved with people as they move keys from one stage to another stage.