Why blockchain works for records management

Records management is one of four blockchain business initiatives that can save money and provide generate revenue, according to Gartner. The technology has the potential to impact all records management processes and extend their capabilities. It also has broad implications for securing and authenticating intellectual property at a lower cost and higher efficiency.

This article is not a primer on the blockchain; however, I will outline some of the specific challenges with records management for government and how the distributed ledger technology can provide a solution.

Protecting government records is a massive and complex undertaking. The number of data breaches has increased more than 400% in 2018, exposing almost 15 billion records, according to the identity intelligence company 4iQ, and the average cost of a security breach is $17 million. In 2015, when the Office of Personnel Management discovered its databases had been breached, officials revealed that hackers obtained personally identifiable information -- including Social Security numbers, fingerprints, employment history and financial data -- for about 22 million individuals.

Government records need to be secure while ensuring that parties to a transaction have maximum privacy and confidentiality and can access data solely on a need-to-know basis.  But this is easier said than done. Centralized databases expose a single point of failure and are prone to costly security breaches. Reconciling multiparty transactions across individual and private ledgers is slow and expensive and often results in unreliable and inconsistent data. Digital signature technologies come at a high cost, and the certificates are difficult to acquire. Additionally, there's also uncertainty around the impartiality of third-party providers.

Besides technology hurdles, the significant growth of global cross-industry regulations over the past 10 years further complicates records management. Government records must be maintained to satisfy regulatory compliance, and organizations may need to demonstrate to auditors or litigators that there has been no negligent or malicious corruption of data.

Records integrity through blockchain

Blockchain is used to create and store a cryptographic hash that serves as a data reference check against a record, its workflow and signatures. If any of the aforementioned is changed, the hash no longer works. Blockchain is appealing to auditors and litigators as it effectively certifies corrupt-free data.

Government blockchain systems should use private permissioned distributed ledger technology. It is ill-advised to use a public blockchain for storing personally identifiable information or even the corresponding hash. Data stored on the blockchain is forever accessible on an immutable public ledger, and the quantum computers on the horizon may be able to break today's encryption algorithms. So the best practice is to store all private data off-chain and exchange it only over encrypted, private, peer-to-peer connections. Additionally, the public blockchain is permissionless, and it conducts its transactions pseudonymously, making the identities of the parties to the transaction difficult to establish and violating regulations that dictate the participants be identifiable.

Smart contracts

With smart contracts, agencies can execute transactional elements of a legal agreement as software on the blockchain. The smart contract may need to be reconciled or synchronized with its corresponding digital contract records. Contract professionals (including lawyers and auditors) may also soon need to be able to read and decipher smart contracts, if not learn how to write them.

This simple use case steps through how blockchain can be leveraged for records management.

1. Ann uploads a contract record into a records management repository and generates a URL for the document.
2. Ann digitally signs the contract using a blockchain application programming interface and generates a unique cryptographic hash for the document.
3. Ann configures a workflow where she is the contract proposer and Bob is the reviewer.
4. When Ann clicks save, a smart contract is created on the permissioned distributed ledger. She includes the cryptographic hash and document URL as unique references.
5. Bob receives an email with a link to review the contract and is prompted to accept or reject the contract proposal.
6. Bob accepts the proposal and is redirected to sign the contract record.
7. After signing the contract record, the original smart contract is archived and a new fully executed contract is created on the distributed ledger with Ann and Bob having entered voluntarily into the contract.
8. The smart contract is now synchronized with the contract record, joined by a reference to the hash and the document URL.

Blockchain-based records management architecture will ultimately be a next-generation, secure, transparent and regulatory compliant infrastructure, synchronizing the records, workflow processes and signatures for smart contracts and contract records for multiple parties to a transaction.

For a detailed introduction to blockchain technology, particularly as it relates to records management, please see this National Archives and Records Administration white paper.