Digital euro: Trialogue starts but many technical questions remain

The European Parliament has taken a significant step forward in its legislative process regarding the digital euro, approving its position on the legal framework for the project during the first reading in Strasbourg. This decision paves the way for the formal trilogue discussions between the European Parliament, the Council of the European Union, and the European Central Bank (ECB) to begin as early as next week. The approval came after a vote where 416 members supported the proposal, while 169 opposed it. The parliamentary position was prepared by Fernando Navarrete Rojas, the rapporteur from Spain’s Popular Party (EPP), who had initially advocated for restricting the digital euro to an offline token-based payment system. However, the majority in the parliament's financial committee opted earlier this year for a dual approach, allowing both an offline token version and an online account-linked variant of the digital euro to coexist. Navarrete Rojas emphasized in a press conference that the legislation would reaffirm the equal status of cash and ensure citizens have the freedom to choose their preferred method of payment. He also dismissed rumors suggesting that the account-based digital euro would make transactions more easily traceable. “No one will know what we spend our money on,” he assured during the plenary session. Despite these assurances, concerns remain about the privacy implications of the proposed design. Researchers from the Technical University of Dresden expressed skepticism toward the current plans being developed by the ECB and EU lawmakers. They argued that while the account-based digital euro promises privacy by design and default, the separation of identification data and transaction data—handled respectively by end-user banks and the ECB—does not guarantee true confidentiality. According to the researchers, the numbers issued by customer banks could be easily linked to transaction histories or other data points, potentially revealing user behavior once pseudonyms are compromised. Mikolai Gütschow, a researcher from the Distributed Networked Systems chair at TU Dresden, noted that the centralization of transaction data might make the ECB’s infrastructure an attractive target for cyberattacks. European data protection authorities have similarly raised concerns about de-pseudonymization risks, recommending that the ECB issue dynamic identifiers to mitigate such threats. While data protection advocates generally support token systems for both variants of the digital euro, citing their potential to offer anonymity comparable to physical cash, they caution against the security vulnerabilities inherent in token solutions. Gütschow explained that the problem of double spending remains unsolvable, particularly if the secure element within mobile phones is compromised. Once breached, digital euros could be copied indefinitely. In a detailed paper, Gütschow and colleagues from Hamburg highlighted the list of already cracked secure elements, underscoring the risks associated with this technology. According to the considerations included in the parliamentary text, the ECB would likely bear responsibility for losses arising from infrastructural weaknesses. Beyond the technical challenges, the overall cost of the megaproject has already exceeded initial estimates. A study conducted by researchers from universities in Hamburg, Groningen, and Basel revealed that the original budget of 1.3 billion euros set by the ECB has already been allocated to external service providers. The study, available on the arXiv document server, notes that up to 55.8 million euros were spent on the alias lookup function, which enables payment service providers to identify the bank of the transaction counterparty. For the development of the offline euro token system, which is being prepared by Giesecke+Devrient, the ECB has planned up to 661 million euros. These figures highlight the complexity and scale of the endeavor, which continues to evolve as stakeholders navigate the balance between innovation, security, and user privacy. As the trilogue phase begins, the focus will shift toward refining the legal framework and addressing the remaining technical and ethical questions surrounding the digital euro.