In this paper, the authors present an analysis of several issues in the field of electronic commerce. The authors begin by presenting a definition of money; they follow this by developing a list of properties of money that must be supported by electronic versions of money. The main portion of the paper focuses on several case studies, which analyze how privacy issues of standard monetary systems compare against electronic commerce systems.

The goal of the paper is to compare two rival electronic commerce systems: Digicash and NetBill. Digicash is an electronic commerce developed by David Chaum that uses anonymous tokens as a form of money. NetBill is an electronic commerce developed by the authors, which uses a notational system to provide similar services. The authors wish to point out the reliability and privacy differences between the two systems to argue that the system they have developed is superior.

In Token and Notational Money, the authors define three functions that any monetary system must provide. These are that money must be:

• Medium of Exchange – The money must be able to facilitate purchases and sales, replacing a barter system with an intermediary form of exchange.
• Standard of Value – The money must be a benchmark with which one can measure the worth of a product or service.
• Store of Wealth – The money should not fade or degrade over time.

The authors then distinguish two kinds of money. They describe token money as objects such as currency or other symbols of wealth. They then describe notational money, which is money represented by notations in a record book. In short, the debiting of one account and crediting of another account. In a notational system, no symbols of wealth are exchanged between parties only records of transactions.

The authors point out that although there are differences between notational and token money, both kinds of money must have a common set of properties to enable transactions to be conducted. This set of useful characteristics contains the four ACID properties of database transactions and a group of additional properties that are desirable in commerce systems. The following is a brief summary of these characteristics:

• Atomicity - Both Goods-Transfer and Money-Transfer atomicity are desired, so that you can guarantee that ‘you get what you pay for’ but also ‘you pay for what you get.’
• Consistency - Two kinds of consistency are desired: temporal consistency states that both parties agree on details of a transaction; transactional consistency ensures that individuals can’t create money.
• Isolation - A series of transactions on an account should appear as a sequence of transactions.
• Durability - Both parties must be able to agree whether a transaction occurred, even in the event that one of the parties crashes. Also, money must not expire or fade after a period of time.
• Divisibility - Transactions must be able to support very large as well as very small transactions; therefore, the cost of a single transaction must be low.
• Scalability - A commerce system must support large numbers of customers and merchants.
• Interoperability - Owners of one form of money should be easily able to convert their money into another form of money for it to be accepted by users.

A final desirable property of a commerce system presented by the authors is the notion of privacy. There is considerable tension in the degree of privacy that is desired by customers, merchants, and the government. The authors claim that there are various pieces of information about the transaction that parties may which to keep private. Information about the identities of the buyer and seller, the item purchased, the price, and other information may seem at first to be innocuous, but could be exploited by an observer or a malicious party to cause harm to one of the parties. For example, a merchant could analyze data about its customers to determine the maximum price its customers would be willing to pay. On the other hand, a customer with bad credit could use anonymity to prevent a merchant from recognizing him as a bad credit risk.

The third party brought into this tangled web is the government. On one hand, many people fear that granting the government access to information about transactions will somehow enable a government which can scrutinize the actions of the general population in a hunt for criminals (perhaps searching a database of all transactions to determine who cheated on their taxes). On the other hand, government claims it needs to determine if individuals are exploiting anonymity to purchase illegal goods or using the system for money laundering.

In case studies of various kind of money, the authors point out that different types of money have different privacy attributes. Cash tends to be almost completely anonymous, while a form of money such as a check reveals almost total information. The authors point out that Digicash’s privacy structure, which aims to be completely anonymous, actually affects the other important characteristics of the system. Digicash tokens must be presented to a bank quickly since it is possible for the tokens to expire. Furthermore, after an interrupted transfer of money tokens, neither party can agree who owns the token. Finally, the authors point out that the privacy structure violates U.S. law for transactions of greater than $10,000 unless parties voluntarily report the transaction.

NetBill makes an importance trade-off to resolve some of the issues that are brought up by Digicash. In short, it sacrifices privacy so that all of the desirable properties can be achieved. Privacy in the NetBill system is virtually nonexistent, except for privacy protection from electronic observers. The authors claim that this trade-off must be done in order to achieve the desired robustness and to comply with set laws. They point out that using intermediaries can achieve anonymity, however the NetBill would still know the identity of the buyer and the seller.

• Privacy - It is clear from the paper that there is a discrepancy in the kinds of privacy desired by various parties involved in a transaction, however it is not clear how this difference can be resolved. In fact, it is not clear whether there is an ideal privacy structure that would be agreed upon by all parties.

• Intermediaries – It is interesting to note that in any form of electronic commerce, or other transaction system, a third party agent can be used to achieve anonymity. However, the user must then trust that the agent completes the transaction (rather than run off with the user’s money).

• Security - The authors gloss over the security details, they claim that they use well-known security methods however it is clear from the Burrows paper (A Logic of Authentication) that proving a protocol is secure can be difficult.
• Trusting NetBill - Finally, as we read in Thompson’s Trusting Trust it is not clear if we can trust an electronic commerce provider to maintain our cryptographic and account information, since we have not examined the code, compilers, libraries, and other components used to put together the system.
• Motivation for Profit - There is certainly a motivation for profit in claiming that one system of electronic commerce is better than another does. This seems to counter the idea that research should be unbiased - perhaps this is a naïve notion.
• Current Money System - Our current system of money has evolved over literally thousands of years, from bartering, to coins, to paper money, and now plastic money. Interestingly, electronic commerce seems to be waiting to skip over the evolution phase in enter a ‘final’ form immediately.