EP 78 - INTERVIEW NICOLE FARRAR - CO-CEO - o1LABS

You are listening to the Blockchain Dialogues Podcast. All views expressed on the show are for educational purposes only and not meant to be taken as financial advice. Hello and welcome to another episode of the Blockchain Dialogs Podcast, video host Krishna and Nikhil. In this podcast series, we analyze various cutting-edge technologies and projects in the field of blockchains, DLTs and cryptocurrencies. Today, we are joined by Nicole Farah, who is co-CEO of OWN Labs, the team behind the Mina Protocol. With that, Nicole, a very warm welcome to the show from both Nikhil and myself. Hi, thank you for having me. Welcome Nicole. So, to start off, Nicole, could you tell our audience a little bit about your background? Sure. So, I have been a lawyer for over 20 years. And I've kind of done the full gamut of things in law. Started in DC and then went to San Francisco. And was at big law firms and then went in-house. And then eventually moved to Fentec, which was kind of my passion. And from Fentec found my way into crypto. So, when I was at Fentec, I got experience at early stage companies. I was a co-founder of a mortgage lending company and had experience doing fundraising, setting up basic business processes, getting the company's first lending licenses, their first commercial credit lines. And then I went from that to lending club, which had just recently gone public. So, kind of other end of the scale in terms of size and complexity. And then from there, I think I'm always driven by wanting to be kind of on the bleeding edge of technology. And I sort of felt like, oh, marketplace lending was really novel and exciting at one point, but it's not now. And so, one day, I sort of had this realization that if I want to be on the bleeding edge of technology in Fentec, crypto is it. And so, I've been in crypto since 2018. I first went to Coinbase, and then after that, I went to Anchorage, which was like a series B company at the time I joined. And so, I've had a lot of experience kind of helping build companies at various stages of growth, and with a focus on product and regulatory things. So, yeah, that's a little bit about my background. Great. Thank you so much for walking us through your journey. So, to move on to your role with O1 Labs today, could you tell us a little bit about the company? You know, what is O1 Labs? What is Mina Protocol? What is the problem that you're looking to solve? I see that O1 Labs began in 2017, and Mina Minute was launched in 2021. So, could you quickly walk us through that journey as well? Yes. So, yeah, after I left Anchorage, I went to O1 Labs, and you know, it's very different being at a crypto project versus a financial services company that's serving crypto products. So, it was a little bit of an adjustment for me. Just not having customers in the traditional sense of customers. The customers are, you know, the developers and the people using the protocol, the ecosystem, the token holders. It's a little more nebulous, and it's also more research-focused. So, what does O1 Labs do? We were founded, as you mentioned, in 2017. Our vision was that we would build this the world's sort of first and fully native ZK blockchain that would be succinct. And what do we mean by succinct? It used recursion with ZK Snarks to keep the blockchain constant size. It's approximately 22 kilobytes. So, one of our claims to fame has always been, you know, it's the world's lightest blockchain. And it was very innovative at the time, and actually continues to be. No one else has built anything like this, although there are projects that are trying to build something like this. But what this enables is both privacy and scalability, because the chain size never grows. And it also makes it easy to verify proofs, because all you have to look at is the very last proof. And you can basically verify the full chain state by verifying the last proof on the chain. And so, we launched that, actually, in March of 2021, so we're actually coming up on our five-year anniversary, which is pretty cool. I joined after Maynet in August of that year. And what we've been doing since is basically working to make the chain more performant to recruit projects to build on it, and then build tools to help developers build in this space. So, we developed O1JS, which is kind of an SDK, or maybe we'd call it a DSL, for building ZK applications on Maynet protocol. And you can also use O1JS to build ZK applications off chain. And yeah, we're just continuing on that mission to help developers build more powerful applications using this advanced programmable cryptography. Great. I guess we shift gears a little bit and maybe to touch on the mean technology that we were just discussing right now, which is zero knowledge proofs. It's something that we've talked about on the show in the past. However, you know, for our audience, say someone who's listening to this podcast and has no idea what zero knowledge is, right? Could you give a brief overview of what is ZK and what its significance is today for the industry? Sure. So, yeah, ZK stands for zero knowledge, and it's a type of advanced cryptography that was actually developed by, you know, very smart people at MIT, I think, sometime in the 80s. And kind of, as far as I know, was a bit dormant. Nobody was really using it. And then now that Web3 has appeared, there's suddenly people are using it quite a bit in the Web3 space. But what it is just at a basic level is allows one person or one party. You could call that person the prover to prove some statement or fact without revealing any underlying information that you might otherwise need to verify that that fact is true. So, just to give a really simple example that I think a lot of people can sort of relate to, let's say you go to a bar and you want to show that you're 21 or you're buying alcohol at a grocery store, you could use a zero knowledge proof to say I'm over the age of 21. And the person that is receiving that statement, the verifier, can without knowing, you know, without looking at your driver's license or knowing your address or anything else about you, they can know that that statement is true because the statement is verifiable through advanced cryptography that uses basically math. So, that's what it is at a basic level, but then there's all kinds of potential applications of that. That's a bit overview. At a high level, that's definitely a good overview. One of the things we talked about the mean up protocol in Hounds, the case, this and that. Can you kind of help me understand a little bit more about what are the use cases for the mean up protocol? What are you guys? So, you see, you mentioned that you're talking, your customers are developers. What are the kind of businesses of apps that you're developing, that you have, that you envision your protocol being used for? Sure. And I would say a lot of the people building on MENA right now are still more focused on infrastructure, but just to give some examples, there's ZECCO, which is building an L2 on top of MENA. And what that will enable is basically just faster applications, faster transaction times. So, applications that might not directly be feasible on MENA because it has slower block times or is not as performant can be performed efficiently on the L2. So, that's one example. There's a project Nory, which is building a two-way bridge between MENA and Ethereum. So, what it would allow is you could verify the state of Ethereum and basically port that state to MENA and vice versa. And in terms of like actual applications, there's ZK noise, which is doing a lot in the gaming space. There's a project, Silvana, which is providing sort of cloud proving services that will enable things like real world assets and focus on financial transactions. They're actually partnering with the Canton network. So, there's a lot that's being built right now, but I would say it's still kind of more at the infrastructure level. Now, what could it potentially support in the future? We're exploring right now and some of the things we're looking at are privacy is obviously a big thing and something that was very integral to the architecture of MENA. MENA is private because there is no execution environment on chain. So, by default, everything you do is private and then you only put on the blockchain the proof itself, you know, the piece of information that you want to provide to others and prove. So, privacy chains with the growing interest from institutions to move on chain is something that we're looking at and we're building Protokit, which is, I would say like an application framework and execution environment that would support these types of private block chains. We're also looking at use cases around verifiable databases. One area I'm super interested in is compliance, like potentially in financial services and other areas. So, yeah, there's a lot of potential, but there's, you know, we're not quite there in terms of, like, I think, where that potential can be reached. Right. And you're a good point about the regulation, or I mean, obviously, when you talk about regulation, there is the financial regulations, all of that, and then there's specific regulation around crypto as well. So, that's maybe, I want to kind of leverage a little bit about, if you're back on the set, you're a lawyer and you've been in this industry for a while, and that's kind of stuff. So, the opportunity for me to learn a little bit about that. So, can you give me kind of, like, when you're understanding, you know, your overview of the evolution of the correlation, you know, some, when you get got into the industry and where it's very safe, how do you see it coming up over the years? Yeah. I mean, just crypto regulation generally. Yeah, we've come a long way, but we also have a long way to go. And I do follow international laws some, but I'm obviously US focused. So, this answer will focus on what's happening in the US. But, you know, like five years ago, there wasn't anything. Even two years ago, there wasn't any type of regulation. The only regulation was what everyone would call kind of regulation by enforcement. You had an SEC that was basically determined to call any kind of cryptocurrency as security. And there was a lot of kind of fear in the industry and a lot of people, a lot of companies actually left the US. And actually, I will say that as a lawyer, sometimes it would make me nervous being in this industry. And I would always say you have to have kind of a certain risk tolerance to be willing to be in this industry. Thankfully, things are changing. Just in, I think it was July of last year, the stable coin legislation was passed. I forget, I always get genius and clarity mixed up. I think that's the Genius Act. Yeah. And so, you can just see how regulation can really support business. Because since that was passed, there's been this explosion of, you know, companies being founded in this space. We've seen a lot of announcements around, you know, big partnerships with stable coin issuance. You know, there's the tempo is launching a chain that will support stable coins for financial institutions. So, it's very exciting. And so, the next step, I think, is to bring some clarity to other parts of crypto. And so, right now, Congress is debating something called, or negotiating, I guess, the Clarity Act. And what that would do is regulate market structure around cryptocurrency and also better delineate the, you know, which ones fall under like a securities law designation, which is regulated by the SEC, and which ones would be regulated as commodities by the CFTC, and provide better coordination and accountability between those agencies. So, I think, you know, once that passes, I think it's going to make the US a much better place to be building in this space. But right now, it seems to be solved. Everybody's fighting about certain aspects of the legislation, which, I guess, two big sticking points. One is under the Genius Act, which was, as I mentioned past last year, there was a provision that said that stable coin issuers cannot pay rewards to their customers. So, banks negotiated that so that they could continue to pay interest and sort of have a monopoly. But this was, you know, highly negotiated. And if you were not the issuer yourself, you could still pay rewards. And so, now, banks are realizing that the actual terms of the statute enable payment of rewards could sort of indirectly. And they're feeling very threatened, I think. So, that's a really big sticking point. And they're trying to sort of go back and renegotiate that. And then a second piece that is a big sticking point is around DeFi. And I think this is a really tough issue because I think a lot of people, certainly in the crypto industry, see the potential of DeFi and how it can open up so much more opportunity, you know, for consumers. But there's also, you know, a concern about, you know, if it's under-regulated, does it, you know, increase the risk of terrorist financing? And so, it's a very difficult question to answer. You know, I guess, one extreme taken by, you know, a lot of legislators that are less crypto-friendly is they want to regulate basically everything, any kind of software that is used basically could be, could fall under the purview of it. And I don't think that's the right solution, but I don't know what the right solution is. It's obviously somewhere in the middle. But that's another thing that's holding that legislation up. I can also talk a little bit about the status of laws that, that might support or not support zero-knowledge proofs in certain spaces, so that one that comes up a lot is people say, "Oh, you could use zero-knowledge proofs for KYC." Well, KYC, as you probably know, it stands for "know your customer." And it's kind of a general statement of an umbrella of laws, the first one being the Anti-Money Laudering Act, which was passed many years ago. I think maybe around 1970 or something, and then there have been several updates to that law over the years, the Patriot Act in 2001, and there was even an amendment as recently as, I think, 2020. So, what these laws require are things like, first of all, you have to, if you're a financial services company, you have to add a minimum, no, your customer's name, date of birth, social security number, or taxpayer ID, and their address. But then there's, you have to collect this sort of treasure trove of documents to verify that plus a bunch of other things. And zero-knowledge proofs could be used to prove these things and limit the collection of data. But the problem is that the statutes themselves or the implementing regulations either don't allow for it or there's some ambiguity. So, just to use the KYC example, banks are required to verify the identity, and they can do that through documentary methods, such as collecting a driver's license, or non-documentary methods, such as comparison to databases or other sources. So, there's a little bit of wiggle room on the non-documentary side, and particularly other sources could put, I think, potentially be read to include the use of zero-knowledge proofs. But nobody is doing that now, and I think people, frankly, are a little scared to try to use some novel technique like that when, you know, well, everyone's just collected documents, and you know that that works, and regulators are okay with it. I personally think what we should be doing is working with regulators and law makers to start testing out these newer technologies that actually, I think, are better than the human eye to examine a document and provide, you know, a cryptographically provable statement about someone's identity, and we should be working towards getting pilot programs in place, maybe even regulatory guidance, you know, like an interpretive statement saying that a zero-knowledge proof system could be used to satisfy this, you know, verification through as another source. So there's a lot of work to be done, but there's also a lot of potential, and I think with just the prevalence of data breaches, I was researching this recently, and I can't remember the number, but basically the global cost of data breaches and a remediating them is rising rapidly, and use of ZKPs would allow you to minimize the amount of data you collect that becomes sort of a honey pot for fraudsters and scammers and hackers. Oh yeah, this is actually one of the things that I was also thinking about, so over the last year, I'm not sure if it's dead in the US so much, but I think in some of the states in the US as well, there has been a rise of requiring age proof to connect to websites and to make sure that only, you know, adults can access certain resources. So a lot of the websites basically are now implementing KYC type protocols, because that's what's available. They require you to set up and give your show proof of ID next to your face, and then there's an automated thing that verifies whether you're, you know, whether you're allowed to get in further, and one of the problems with that is that all of these websites now are gathering their data and storing it, because that's part of their audit reports, and so now you can just imagine how multiply that is gone. So now you have to know as a consumer of the internet, worry about, okay, now my ID, and it's not just a user name and password, it's my actual ID, my real world ID, is stored in, you know, so many different places, and, you know, the, and depending on whether that, how big that website is, their resources to protect themselves against hackers is not necessarily the greatest, right? So this is kind of like a, you know, almost tailor-made situation for ZK kind of proofs, where basically I don't have to go all of that. I use a ZK to proof that I'm off-age or off-the-right, I'm allowed to actually, I meet the requirements for that website. So yes, these are kind of, because it's kind of like, like you're very correctly pointed out, it's only multiplying, and the danger and risk that we take as digital citizens is only exploding. Yeah, I mean it's crazy to think the amount of information that is being collected, and five years ago, it would make sense, okay, I'm opening a bank account online, that I expect to provide that kind of information. But just to use a website, it's crazy, you know, just to buy something, and it's, I think it's encouraging sort of a surveillance state, which I don't think is good. At the same time, I understand why websites are taking measures to verify people's age, I mean, and it's not just for things like accessing a porn website, you know, in the US there's the, it's known as COPA, the Children's Online Privacy Protection Act, and this is the statute that basically says, you know, you have to at least be 13 years old to access certain websites and services online. And I'm pretty sure, I should check this, but I'm pretty sure social media falls under that. So you're not allowed to let someone under the age of 13 open a social media account, unless it's, I think you can, if there's a parent that signs off that they're monitoring it, and maybe you can, I don't know the specifics on the law. But, you know, social media services are being faced with potential liability, if they're serving things to, you know, consumers who are under the age of 13. So I understand why they're collecting more and more information, and I think it's good that they're taking measures to verify these things. I'm the mother of almost 12-year-old, and I wouldn't want her accessing certain things on the internet. But I also don't want her information to be all over the internet, just because that's what she needs to do to access a service once she turns 13. So I think zero-knowledge proofs are a really good fit for this kind of a use case, but just the infrastructure and the regulatory support aren't quite there. There are some interesting developments, though, happening in this space. I was researching what states have issued mobile IDs or other digital IDs, and many, or most of digital IDs, have, like, you know, they're cryptographically supported. So you could use them to sign a cryptographic statement about something on that ID. And there's a growing list of states that are issuing these already, or have issued them. And so I think there's a real opportunity here to create a better digital online world. Yeah, absolutely, I agree. And like I said, it's a great use case. One of the things I think sometimes people, at least from the technology side of it find hard, is that, you know, there is a tendency amongst tech folks to kind of go down, grab it holes, and really over-explain. So zero-knowledge already is something that is mathematically quite heavy, right? And so basically, one of the challenges I've always dealt with zero-knowledge, and explaining zero-knowledge is to come up with a, you know, a nice high level of view that, you know, gives enough information to be useful. At the same time, does that kind of cause the listener to kind of have his eyes glaze over and over, right? So that's something one of the things that over time, we've had to kind of come up with these ideas. And that's I think where these use cases become really useful to kind of explain as well. One thing I was curious about, so you talked about, you know, you're researching how, you know, we can use decay tech for these large problems. Given your Volvindale, the US and your knowledge about these laws, typically even how close to and how far away do you think lawmakers are and how does that actually, I mean, if you were to say, okay, tomorrow, as old labs, we have a solution for you, and we want to get that to be certified as, okay, this is meets the regulation. What kind of, you know, roadmap or what kind of challenges would it is? Yeah, that's a great question. There are a number of challenges, unfortunately, I would say one thing is that we need regulators and lawmakers, as you said, to actually understand the technology and to believe that it works. And so that's going to require a lot of education. I also think that something that will support advancements in this space are the government, not, you know, I don't think the government should say this is the type of proof system you should be using, but much, much like, you know, with the development of the internet in the 90s, the government can perform sort of a coordination function of bringing people together, you know, scientists, researchers, policymakers, businesses, to create a space where open standards can be discussed and then adopted. And another role of government is like, particularly around identity, they, you know, much like states issuing these mobile drivers licenses. They can actually do things that will support this technology. And they can, you know, like, well, providing also clarity on, well, how do you verify a proof? Okay, so someone submits a proof that says, I'm over the age of 18, you know, and let's say, oh, one labs were some kind of service provider that would allow you to verify that proof. Well, how do people know that they can trust our verification? So it could be that the government would certify, you know, that providers in this space, or, you know, I really don't know, but I think we're, we are a long way, way, unfortunately. But seeing that these mobile drivers license are coming out, I think is, you know, very encouraging. Another encouraging development is Google and I think Apple as well have both integrated zero knowledge proof functionality into their digital wallets. And so you can, there are already places where you can make attestations about certain aspects of your identity and use your mobile wallet to show that. What I think the path is, I think it's twofold. One is implementing these types of things in less regulated spaces first and showing that they work. So maybe it would be something like, I don't know, a dating app where, you know, you know, yeah, like if you're on a dating app and someone says, oh, I'm, I'm, whatever, I'm 47 years old and then you meet them and you're like, oh, actually, I'm, you do not look 47, you look like you're, you know, 70. That's one space where I, as far as I know, that's not a super regulated space. And that could be something that the dating app could use, actually, as kind of a way, like a market driven solution, because I think people using the apps would, would like that. So I think that's one avenue to explore. And then the other one, I think, is to explore with regulators, getting pilot programs in place, you know, safe harbors or, I mean, a safe harbor is, you're, you're much further along by the time you have a safe harbor. A safe harbor basically says, if you do A, B and C, then you have complied with this legal requirement. But short of that, you could have a regulatory sandbox that says, we're going to allow you to experiment with this technology, provided that you are, you fall within these parameters. Maybe it's, you know, the transaction volume or, sorry, the aggregate transaction volume or amount can't exceed a certain dollar amount, you know, or it has to be limited in scope in terms of the number of customers participating. And, and this has happened already in lots of other spaces around Fentech. So I think that's the second path is, you know, show regulators have pilot programs that show that it works. And, and I think what these programs will show are that it actually works better than the existing system. It might be a case where, you know, also the ask of forgiveness, right? You might have, like, you know, the discos and then, and maybe you don't know it in the US, you do it in, and in another jurisdiction or in another country and kind of say, okay, hey, this is, this is the day we did it out here. It's working great. You can, you can check it out and you can see how the whole thing works together and then that becomes a model that you're going to have later. Yeah, I think that's a really good point, you know, when you said ask for forgiveness, I kind of, I get the lawyer inside of me kind of stiffened up and thought, oh, because the penalties for violating money laundering laws. But I think you have a really good point about going to other jurisdictions. In the US, the language, a lot of these, you know, financial services, money laundering laws are very, very prescriptive, you know, like this is what you have to do. You have to look at these documents, you know, you have to have this audit trail. In other jurisdictions, they're more sort of principles based or outcome based. And I've heard that actually the EU tends to legislate in more like principles based way. So we're not going to say this is how you have to do something, but you have to do it and show that your methods are reasonable. And so I think that's a very good point of, you know, maybe and also in Europe, I think they care more about data protection, you know, consumer privacy. There's also, you know, GDPR, which is a law that, that are, you know, set of standards that really requires you to minimize data collection. So I think that's a great point. Yeah, and there are, it's not like there aren't any US states that are progressive on that point, right? Like you have the California, they have been following their own version of the GDPR, which is quite similar. And so, so there is, it doesn't, it doesn't mean that, you know, you have to look only it's only. But, you know, let's see how it goes. Okay, so we talked about crypto and we talked about it here, or a great little knowledge and, you know, how they kind of work together and how they kind of complement each other. Do you see that as the main thing for overlaps, or are you, I mean, actually, it was a little bit of a piece about, you know, what they're using is the next concrete thing or the next, the most low-hanging food for your company to pursue. That's a great question. So I would say we have, like in the near term, we have some commitments we've made that we want to deliver on. So, very concretely, we are shipping an upgrade to the mean of protocol, which will provide major performance improvements, and increase the overall ability to build more flexible and more expressive ZK app transactions. And so that's something that we, people don't like us putting a timeline on it because it's very hard to estimate how long, you know, engineering work takes, although we're trying to get better at that. But I think, you know, the first half of this year, so we're very focused on that. We're also focused on supporting the teams and the ecosystem that we have building on Mina. And so a lot of times they come to us and they're blocked by certain aspects of how the protocol works, or maybe it's not that they're blocked, but if we could add a certain feature to the protocol, it would make their lives easier and allow them to be successful. So we're really committed to making those teams successful. At the same time, what we're building with Mina is a public good. It's not proprietary, it's open source. Anyone can contribute to it. And, you know, we are, you know, we're not a non-profit, we are a business. And so, you know, we need to make money. What we're working on now is exploring basically applications in the verifiable computation space, both on and off Mina. And so, you know, we're looking into, as I mentioned, identity, privacy, and, you know, from my perspective, data, integrity, and compliance, I think, are really big opportunities. So I can't really give you a very specific answer, except to say that, yes, we are committed to this space of, you know, verifiable computation. But we really don't know where it's going to lead. So, you know, that's one reason why I'm doing things like going on podcasts and going out to, you know, meeting people and talking to them. Because I think there's just a whole lot of opportunity. And, you know, we've been in this space, we're pioneers in this space. So we're well positioned to bring solutions to the market. That sounds really like you, you have a, you know, you have a plan and you kind of like, the main thing is to get the rest of the world, you know, out, ready for taking on CK and taking on this, the opportunity that is available. Just, yeah, I mean, I think, just a few other times, I just want to quickly wrap up as well. So I mean, it's, the time has flown, Nicole, I really enjoyed our conversation, you know, and it's been really great learning more about how ZK and regulations go together and how things are moving in the US as well. And before we end, Nicole, if there's anything you'd like to tell our audience, you know, where to find more information about the company or any other announcements, please feel free. Oh, that's a, that's a great suggestion. Um, yes, thank you both for having me on the podcast. And yeah, just I wanted to mention one more thing to build on the, the last question. I would say just more broadly, our shift is from right now, we're making a shift from building infrastructure, we are, we're still building and, and improving that infrastructure, but now we're committing to bringing applications. And so we're very focused on talking to customers, getting feedback, building things, not just in a vacuum, but building things that working with, with others, to get real-time inputs on, you know, what problems they're solving and how they can work better. So on that, that note, you can, if you're interested in learning more about Oh One Labs, you can just go to our website, which is Oh One Labs dot org. And then if you're interested in mean a protocol, you can go to meanaprotocol.com. And then if you're interested in talking to me, or my co-CEO, DeepD, we're now partnering with me being sort of more of the business operational side, and DeepD being the technical person, she's been on our team almost since the beginning as well. So if you have deep, deep technical questions, you should probably go talk to her. But you can find me on LinkedIn, on, on X. And yeah, that's about it. We also have a discord channel for Oh One Labs in the meanaprotocol. So yeah, thank you both. This was really fun to do this, and it's getting me excited about, you know, it's a hard path, but there's, there's work to be done, and it's going to be a lot of fun. Great. Once again, Nicole, I want to thank you for taking the time to speak with us today, and all the best to your team. Okay, thank you very much. That was Nicole Farah from Oh One Labs. You can subscribe to this podcast on iTunes, Amazon Music, and Spotify. Also, you can learn more about us at BCDalox.com. Thanks again for joining. See you next time.