The role of Blockchain in Information Governance
Something is exciting about diving into innovative technology and figuring out how it can improve the way you do business. The blockchain is one of those technologies and in the information management world there are some interesting ways it is helping increase data security, accountability, and transparency.
Blockchain – just the basics
With many resources out there that define and describe blockchain, I’m not going to spend a lot of time defining it. Here are a couple worth checking out:
A blockchain is a type of digital ledger technology (DLT) used to protect digital records. It is a series of blocks or data records that record transactions (like a change to a document, a digital signature) grouped in a chain. Every block contains a single transaction, and they are never overwritten or deleted – each one builds upon the other.
The blockchain is distributed across a peer to peer network with each computer (node) containing its own copy of the blockchain. When someone makes a change to the data, it’s recorded in a block with a hash – a unique code that tells each block apart. Before that block is added to the chain, it’s validated by all nodes in the network following defined algorithms. Every node has to approve the new change, or it won’t be added. You cannot delete blocks, so you have an audit trail of everything that happened and a complete version history.
The simplest way to explain a blockchain is to think about a peer to peer (P2P) media sharing site (e.g. Napster, Kaaza). Someone uploads a song or a movie and it’s shared with every computer in the network. When a new version of the music is uploaded, all copies are replaced with that new version. That’s the simple view. Now add verification of updates, version tracking, and an audit trail within blocks, and essentially that’s blockchain.
There are a couple of important aspects to blockchain technology to call out:
- You can’t overwrite the data on a block – so everything that happens to the record – every transaction – is recorded and an audit trail is created.
- Because every transaction, or change, goes through a verification process defined by algorithms and performed by computers, your record is secure against unauthorized access or changes.
Leveraging Blockchain in Information and Records Management
“Trusted information, immutable data along with automated and audited process activities underpin the technical capabilities for future records and information management.” – Records Management and Blockchain, Proceed, but with caution
Everteam is investigating ways in which our solutions can leverage blockchain technology to improve records management, a key element of information governance.
As an example, we have been building enhanced integrity into our audit trails and audit journals as part of our compliance with ISO 14641. This international standard (which initially started as the French standard NF Z42-013) requires all audit trails for records processing activities should be stored in audit journals (e.g. an XML or JSON file) at least once per day and that each operation on a record is identified with its fingerprint (hash).
These journals cannot be modified (think about someone wanting to hide illegal activities by deleting or adjusting your organization’s audit trails). To support this, each daily journal with all the operations for that day is signed itself with a hash, and that signature is appended to the next journal, essentially linking (chaining) all the journals together. A change in one journal would corrupt all future journals.
To further extend this level of audit trail immutability, and to avoid having someone modify a journal and then reset the signatures in all other journals, our R&D Team developed a blockchain integration to store all these signatures. The signatures are now immutable forever, adding enhanced integrity to the audit trails and audit journals in Everteam’s records management solution.
It sounds simple, but immutability is a critical aspect of records management and 101 to ensure the probative value of a record.
Deciding if Blockchain is Needed
Blockchain can help improve records and information management, but it’s not right in every situation. In Records Management and Blockchain, Proceed, but with caution, authors Alan Pelz-Sharpe, Rob Begley and Jon Bushell write about the value blockchain technology can bring to the records and information management, including immutability and trust.
The paper provides several reasons you would use distributed ledger technology (like blockchain):
- Need a shared database that many people can contribute to and access
- Want an immutable, time-stamped log of all additions or changes to the database
- You have concerns around trust
However, if you want to be able to delete data at some point, then they advise not to store the actual data in the blockchain, but the hash only. You also shouldn’t store personal or sensitive data, because the information is public to everyone in the blockchain and you can’t delete it. So if you have to comply with privacy regulations like GDPR and CCPA, storing actual data in the blockchain will not work.
Another benefit of blockchain comes with Smart Contracts, which can help control the transfer of assets. They used the example of an automated deletion policy that cleans up unwanted legacy documents.
It’s important to understand, as the authors point out, that blockchain ( and DLTs overall) do not replace the requirement for good records management. If anything, it increases it. If the blockchain makes records immutable, then you want to be sure they are accurate from the start.
Finally, the report talks about the effects of in-place records management – something that is becoming more and more the desired approach to records management in organizations today. Every system where records are stored will need to be compliant with the blockchain (similar to a Bitcoin Wallet), presenting challenges when you start to think about what will need to change to make that happen. You have to be sure the result would be worth the effort (including can it be done at all).
Blockchain Will Play a Role in Information Management
In the AIIM Industry Watch, Automating Governance, and Compliance, almost 10% of information management and governance budgets will be spent on blockchain to help improve the management of information. It’s not a huge amount, but it demonstrates that organizations are forward-thinking. They are looking at how innovative technologies can help them deal with the ever-increasing growth of information. Products such as Everteam.archive demonstrate the value that blockchain technology brings to the enterprise and helps pave the way to the leveraging innovative technologies for improved information management.
Learn more about Everteam’s work with blockchain technology and its implementation in everteam.archive.
