TRUSTLESS DUAL-USE INITIATIVE
“Among EU member states, it’s hilarious: they claim digital sovereignty but they rely mostly on Chinese hardware, on US American software, and they need a famous Russian to reveal the vulnerabilities.”
Trustless Dual-Use Initiative is the dual-use version of the Trustless Computing Certification Body and Seevik Net. It aims to aggregate leading public and private partners in multiple EU, NATO and non-NATO but like-minded nations to invest €40-200M+ - directly and through EU/national public-private co-funding - to create a multi democratic dual-use IT platform, computing base, ecosystem and IT security certification body, that aims to radically exceed the civilian and military state-of-the-art in the security of tactical and strategic digital communications, while at once solidly preventing criminal abuse and retaining legit cyber-investigation capabilities.
Initially aimed at the most confidentiality-critical and integrity-critical societal scenarios in the area of communications and transaction - and then expanded to availability-critical use case scenarios. The project takes inspiration from the EDA SoC project, but aimed specifically at communications.
This initiative is mostly in standby since 2018 given the difficulties for a small NGO like ours to push forth a pan-EU project, regardless of the very strong interest from European Defence Agencies, 2 German DoD department and top Italian generals. We are recently reviving it in light of renewed interest by the several EU MoDs, some Italian defense companies and new Italian public funding opportunities for our sister-project, that of the Trustless Computing Campus in Rome.
The initial target domains will be sensitive but non-classified civilian market and governmental as a voluntary and international certification label for sensitive (strategic) communications and transactions - the assurance levels it aims to are positioning themselves to be a substantial improvement over current standards for the most sensitive classified governmental civilian and military communications and their democratic accountability, and then extend to other critical governmental sectors.
CURRENT & PROSPECTIVE PARTNERS
We have 24 World-class scientific and governance advisors. and over 25 public and private R&D partners. that participated in R&D initaitive for TCCB and Seevik Net, including the top secret IT standardization agencies of Italy and Austria.
During 2015, we met very extensively with German official that was at the time the former Head of Information Superiority of EDA, and were invited twice to EDA to present our proposal, once to 22 EU ministries of defense, and actively pursue a EDA Cat-B capability building initiative with support from Adm. Ruggero Di Biase.
Over the last few years and months received interest from and engaged with relevant top officials from Switzerland, Italy, Germany, USA, UK, Israel, and Austria including:
Ministry of Defense of Germany. Event in Berlin on May 4th 2018, – with German Ministry of Interior and Defense and Head of R&D of Deutsche Telekom – albeit had to cancel for delays in Italian government formation process.
Secunet, Leonardo, Telsy, Telsy, Rhode & Swartz, CyOne, Hensoldt Cyber, Exprivia, Tinexta.
Ministry of Defense of Austria (Head of Research, CIO, Head of A-SIT), Ministry of Defense of Germany (Cyber Innovation Hub, Internal IT Dept.
Ministry of Defense of Italy (met the twice Undersecretary of the Ministry of Defense of Italy (with delegation to cybersecurity) on July 23rd 2018. Adm Di Biase.
Last January 2022, we graduates from MACH37, the Unites States n.1 cybersecurity accelerator, in Virginia, at 20 minutes from the State Department. We are engaging several US and EU leading open-source high-assurance low-level IT firms to become technical partners to the TCCB and its spin-in.
The Trustless Computing Certification Body was launched and established in Geneva last June 2021, with top current and former officials from Geneva, USA and Netherlands.
We held 8 Editions of Free and Safe in Cyberspace, to promote the civilian part of the initiative, in 3 continents, focused on 4 Challenges leading to TCCB, with over 120 speakers and keynoters, made of top experts, privacy activists, and government officials.
AMBITION & GOALS
These joint initiative aim to sustainably enable the provisioning of end-2-end IT services – and related life-cycle and supply-chain – that are capable of resisting persistent investments of tens of millions of euros, by largely-unaccountable state and non-state actors, aimed at acquiring access to critical remote vulnerabilities in the life-cycle and supply-chain, through discovery or active subversion of all kinds.
The project aims is to create an open-licensed patent-unencumbered publicly-inspectable set of core critical IT technologies, and a highly resilient ecosystem extending from standard-setting body to fabrication oversight. It will uniquely enable unprecedented and constitutionally-meaningful assurance levels of confidentiality, integrity, authenticity and non-repudiability for end-2-end IT services, civilian and dual-use applications while avoiding significant risks of malevolent abuse and obstruction to legitimate cyber-investigations.
TARGET USE CASES & DOMAINS, FEATURES & PRJ STAGES
Initially aimed at dual-use strategic communications, its technologies and certification processes are nonetheless designed to be extended at a later stage to high-resiliency systems for military mission use, and “mission-configurable services in a secure cloud”, by supporting systems addressing resiliency and availability at the same level of assurance.
Aimed in its 1st stage at very basic mobile and desktop text/voice communications for the most critical scenarios, it is designed to act as a veritable EU Trustworthy Computing Base for a wide variety of high-assurance computing domains, including mass-market business consumers. The initial stage is conceived to enable the 2nd stage to make the project extensible, adaptable and scalable to:
(1) Communications, cloud and/or e-transactions (such as e-banking, e-government, e-health, e-signatures) end-2-end services and devices, in mobile, kiosk and governmental POS; including large-scale mass-market business and consumer scenarios with high-user friendliness.
(2) A wide variety of highest-assurance communications, cloud and IoT domains that – in addition, or alternative to confidentiality, integrity, authenticity and non-repudiability – require the highest levels of assurance for availability and resiliency, albeit compatible with the form factor, performance and power consumption of the 1st stage architecture.
UNIQUE SECURITY PARADIGMS
(1) The project will achieve previously unimagined levels of trustworthiness by uniquely merging best-of-breed industry-proven blockchain technologies with radically-unprecedented levels of endpoint security – by removing all unverified trust all the way down to CPU, hosting management, fabrication oversight, and standards-setting governance – and therefore essentially reducing cybersecurity to a cyber-social governance problem.
(2) To achieve and maintain such trustworthiness levels, it will involve world-leading partners and scientists to devise radically new ideas and concepts, and extend, merge – and apply to end-user ICT systems – best-of-breed “zero trust” socio-technical paradigms from different scientific fields, including: (a) socio-technical principles of highest-trustworthiness dual-use ICT and civil aviation systems; (b) citizen-witness-based and voting-booth organizational procedures from democratic governance, and; (c) organizational constituent processes, and statutory architectures, aimed at extreme transparency, user/citizen-accountability and technical-proficiency.
(3) It achieves such trustworthiness levels by uniquely ensuring complete verifiability, adequate verification relative to complexity, and “constituent-witness” oversight, of any and all potentially critical service components, from standard setting to ICs fabrication oversight to server room access procedures. Extreme safeguards for transparently reconciling lawful access and personal confidentiality will be key for its legal sustainability – and radical mitigation of potential malevolent use – and therefore foster a critical mass of EU dual-use investments to create a comprehensive a resilient “EU trustworthy computing base” and ecosystem.
(4) Key to all will be the design of an extremely trustworthy, proficient and accountable international certification body. A key innovation will be the use of peer-witness, for the fabrication phases, and peer-jury procedures, for all server room accesses, to radically reduce the risks of abuse by insiders and 3rd parties; similar in principle to what was enact by the NSA with its 2-man rule after Snowden.
RELATION TO SIMILAR EUROPEAN MILITARY CAPABILITY INITIATIVES
TRUSTLESS pursues a scope similar to that of the EDA SoC project, except ours aims initially at communications; has a much higher ecosystems resilience; does not rely on upfront trusted components, providers or fabrication processes. Third parties will be able to utilize the open-licensed results to create systems compliant with “national crypto standards” – for the state and non-state clients – delivering a much higher assurance that no additional “exceptional access means” or critical vulnerabilities, malicious or accidental, exist in such systems.
Last June 2018 there was a deadline for the System-On-Chip/System-in-Package Call within the Preparatory Action on Defence Research. Although our project ha several similarities, it does not replicate but complements it for the following reasons:
(1) Does not merely rely on current EU STATE SECRET standards, but devotes substantial effort in creating a new certification schema (and its governance) to achieve deeper and more comprehensive certifications, while still aiming to be EU SECRET compliant after an initial go-to-maker in the private consumer and enterprise sectors.
(2) It is conceived as dual-use from the beginning to facilitate very wide economic and public inspection synergies to create a larger critical mass to support the increase of the level of security and features of the resulting technologies and certifications.
(3) Does not attempt to create an ecosystem around fabrication standard of under 28nm. Our deep research has shown that foundries with such capabilities are way too complex to allow the necessary level of security oversight, are located outside EU and/or controlled by global groups with strong current and future pressures from non-EU nations.
DOCUMENTS
An August 2018 60-pager Trustless Dual-Use Framework Proposal PDF