David Chaum.

Privacy before the internet

Chaum grew up in Los Angeles, where, he later recalled, he “programmed my first computer using toothpicks to push pre perfed holes out of Hollerith cards”. As a graduate student at the University of California, Berkeley, he took on a problem that email was about to make urgent: “keeping confidential who converses with whom, and when they converse”. His answer, published in 1981, was the mix, a computer that collects a batch of sealed messages, shuffles them and passes them on, so that nobody watching can match what went in with what came out. Wired later credited him with first proposing anonymous remailers, and the designers of Tor, the anonymous browsing network, wrote that “Modern anonymity systems date to Chaum’s Mix-Net design”.⁠^[1][2][4][3]

His 1982 doctoral thesis described computer systems that organisations who don’t trust each other could build and run together. Each computer’s secrets would sit in “a small mechanism, called a vault”, sealed so that “any attempt to open it will cause it to destroy its own information content”. In its acknowledgements he explained where the work had begun. The computer scientist Manuel Blum had told him that “one should never try to predict the effects of ones actions on society”, and “It was the rejection of this principle which lead to the present work.”⁠^[5]

The idea he is best known for came next: the blind signatureBlind signatureA signature on something the signer can’t see. David Chaum published the idea in 1983 so a bank could issue digital cash it couldn’t trace.. In “Blind Signatures for Untraceable Payments”, published in 1983, a bank signs a digital coin without seeing it, as if signing the outside of an envelope lined with carbon paper, the comparison Wired later used. The signature proves the coin is genuine, but when the coin comes back the bank can’t tell whose it was, so a payment can’t be traced to the person who made it. In 2024 the High Court in London, ruling on Craig Wright’s claim to be Satoshi Nakamoto, said it is “generally accepted” that Chaum devised the earliest concept of digital cash.⁠^[6][7][8]

He also helped build the field. At Crypto ’82, a conference he organised, he suggested forming the International Association for Cryptologic Research, which was incorporated the next year. In 1984 he joined CWI, the national research institute for mathematics and computer science in the Netherlands, and led its cryptography group in Amsterdam. In 1985 he set out his case in the journal Communications of the ACM, under the title “Security without Identification: Transaction Systems to Make Big Brother Obsolete”. It opened: “Computerization is robbing individuals of the ability to monitor and control the ways information about them is used.”⁠^{[9][10][1][11]}

DigiCash and eCash

In 1990 Chaum founded DigiCash in Amsterdam. Its first contract came from the Dutch government, which wanted road tolls that didn’t track drivers; his students, he recalled, demonstrated “an eCash payment in a meter of road travel at 100km/hr highway speeds”. In May 1994, at the first conference on the World Wide Web, in Geneva, he demonstrated what DigiCash announced as the first electronic cash payment over computer networks. With it, Chaum said in the company’s announcement, you could “receive $5 owed you by a friend, or just order a pizza”.⁠^[7][1][12]

That October DigiCash began a trial in which several hundred volunteers had a million “cyber bucks” to spend. “If you try to make cash that doesn’t resemble the cash we have today, it’s not going to work,” Chaum told The New York Times. On 23 October 1995 Mark Twain Bancshares, a bank group in St. Louis, began offering eCash, and by 1998, American Banker reported, DigiCash had licensed it to Credit Suisse, Deutsche Bank, Bank Austria and Den norske Bank of Norway.⁠^[13][14][15]

None of these got far. The licensees “never got beyond pilot stages”, American Banker reported in November 1998; Mark Twain’s new owner had ended its trial that September, with 5,000 customers. Each eCash coin had to be checked with the bank as it was spent, so clearing a payment, an analyst told the paper, “required authorization like a credit card”. Chaum told Forbes in 1999 that it had been hard to win merchants and shoppers at the same time, and that as the web grew, “It was hard to explain the importance of privacy to them.”⁠^[16][17]

DigiCash filed for Chapter 11 bankruptcy protection in November 1998, after cutting its staff to about six people, and in August 1999 eCash Technologies of Seattle bought its technology, including the patented blind signature. One story about its end is still often repeated. In January 1999 the Dutch magazine Next! reported, as hearsay, that Microsoft had offered about $100 million to put eCash into every copy of Windows 95, and that Chaum had held out for a dollar or two per copy instead. Neither Microsoft nor Chaum is known to have confirmed it.⁠^[18][19][20]

Bitcoin and the mint

The Bitcoin white paper doesn’t name Chaum, but it describes the model eCash followed: a trusted “mint” that checks every transaction, so that “the fate of the entire money system depends on the company running the mint”. Bitcoin replaced the mint with a public record that a network of computers keeps and checks. In February 2009, when a member of a mailing list asked whether Bitcoin was “akin to David Chaum’s anonymous digital money”, Satoshi replied that the biggest difference was the lack of a central server: “That was the Achilles heel of Chaumian systems; when the central company shut down, so did the currency.”⁠^[21][22]

Satoshi blamed the failures of the 1990s on the same thing. Many people saw digital money as a lost cause, Satoshi wrote, “after more than a decade of failed Trusted Third Party based systems (Digicash, etc)”, but “it was only the centrally controlled nature of those systems that doomed them”. Bitcoin also took a different route to privacy. eCash kept payments private by blinding the bank; in Bitcoin every payment is public, but, as Satoshi put it, “Identities are not used”.⁠^[23][24][25]

Chaum has praised Bitcoin, with reservations. “Bitcoin has launched a worldwide movement and attracted millions of people to the promise and importance of digital currency. That’s a wonderful achievement,” he told CWI in 2019, while pointing to its “limitations, particularly calculation speed and energy expenditure”. Of Satoshi’s aim he told The Block the same year: “The instinct was right, the first ten words of creating a peer-to-peer consumer cash. But it didn’t turn out that way.”⁠^[26][27]

Did he invent the blockchain?

Chaum’s thesis has since been read as an early blueprint for a blockchainBlockchainBitcoin's shared record of every payment since 2009, stored in blocks that each link to the one before — which is what makes it a chain., the chain of records that Bitcoin keeps. In 2018 the computer scientist Alan Sherman and colleagues at the University of Maryland, Baltimore County, argued that “many of the elements of blockchains are embodied in David Chaum’s 1979 vault system”, which the thesis set out in detail. Each of its computers kept a running checksum of everything the group had agreed, “chained”, in Chaum’s word, through the whole history, much as each Bitcoin block carries a fingerprint of the one before. The work went unnoticed, they wrote, because Chaum “never made any effort to publish it in a conference or journal”. The idea has spread: when Università della Svizzera italiana gave Chaum an honorary doctorate in 2021, its citation listed “the first blockchain” among his contributions.⁠^[28][5][29]

The same paper qualifies the claim. Its case opens with “Arguably”. It calls the thesis’s way of agreeing on records “a weak form of transaction consensus”, and notes that the thesis “does not include the ideas of proof-of-workProof of workA puzzle that takes a computer real effort to solve, so the answer proves the effort was spent. Bitcoin’s miners use it to add each block.”, the puzzle-solving that lets Bitcoin’s computers settle on one history with no one in charge; in Chaum’s design, trustees chose which computers could take part. Sherman has also worked with Chaum on voting systems. And the Bitcoin white paper cites earlier papers on timestamping records by Stuart Haber and W. Scott Stornetta, not Chaum’s thesis.⁠^[28][30][21]

Later work

Chaum went on to design voting systems that let people check their votes were counted without revealing how they voted. On 3 November 2009 Takoma Park, Maryland, elected its mayor and council with one of them, Scantegrity II, which its designers called the first time such a system “has been used in a binding governmental election”. Voters revealed codes printed in invisible ink on their ballots, MIT News reported, so that they could look them up online afterwards.⁠^[30][31]

In January 2016 he presented PrivaTegrity, a messaging system built on a faster kind of mix network. Wired called one feature “sure to be far more controversial”: a way to unmask anyone doing something “generally recognized as evil”, but only if server administrators in nine countries all agreed. Chaum called it “a backdoor with nine different padlocks on it”. In November 2019 he announced the xx network, which, he says, lets people “communicate and exchange value without revealing information about their activities to third parties”.⁠^[32][33][1]

Asked in 2019 whether he had been too far ahead of his time, he said: “I wasn’t that far ahead of the times: I’m still around to see the times come around!”⁠^[26]