Editor's note: This is an article from MIT Technology Review's in-depth investigation demystifying Worldcoin published in 2022. Carbon Chain Value believes that the content of the article is an information supplement for everyone’s current understanding of Worldcoin, personality certification and iris scanning, and it also has some reference value and inspirational value. Therefore, Carbon Chain Value and WEEX Exchange spent 2 days recompiling this article for readers.
The startup promises to provide a fairly distributed universal basic income based on cryptocurrency. But so far, all it has done is build a biometric database based on the bodies of the poor.
Source: MIT Technology Review, April 6, 2022
作者：Eileen Guo & Adi Renaldi
Compiled by: WEEX Exchange
On a sunny morning in December 2021, Iyus Ruswandi, a 35-year-old furniture manufacturer in Gunungguruh Village, Indonesia, was woken up early by his mother. She said a technology company was hosting a "social aid giveaway" at the local Islamic elementary school for him to attend.
Ruswandi joined a long queue of residents, mostly women, some of whom had been queuing since 6am. In a pandemic-ravaged economy, any kind of aid is welcome.
At the front of the line, representatives from Indonesia's Worldcoin were collecting emails and phone numbers, or pointing a futuristic metal ball at villagers' faces, scanning their irises and other biometric data. Village officials were also present, handing out numbered tickets to residents lining up to help maintain order.
Worldcoin’s identifier for collecting people’s biometric data, called “Orb” in the article
Ruswandi asked a Worldcoin representative what charity it was, but learned nothing new: just like his mother said, they were making donations.
Gunungguruh wasn't the only village Worldcoin visited. In villages in West Java, Indonesia, as well as on university campuses, subway stations, shopping malls and city centers in more than 20 countries, most of them developing countries, Worldcoin representatives will appear for a day or two to collect biometrics. data. They are understood to be offering everything from free cash (often local currency as well as Worldcoin tokens) to Airpods to promises of future wealth in return. In some cases, they also made payments to local government officials. But they didn't provide much information about their true intentions.
This has confused many, including Ruswandi: What exactly is Worldcoin scanning irises for?
To answer this question and better understand Worldcoin’s registration and distribution process, MIT Technology Review interviewed more than 35 people from six countries: Indonesia, Kenya, Sudan, Ghana, Chile, and Norway, who either worked for Worldcoin work, either on behalf of Worldcoin, has been scanned, or participated but was not successfully recruited.
We observed scanning at a sign-up event in Indonesia, read conversations in social media and mobile chat groups, and reviewed reviews of Worldcoin Wallet in the Google Play and Apple stores. We interviewed Worldcoin CEO Alex Blania and submitted a detailed list of findings and questions to the company for comment.
Our investigation shows that Worldcoin emphasizes privacy protection in public information, but the actual experience of users is very different from this. We found that the company’s representatives used deceptive marketing tactics, collected more personal data than they admitted, and did not obtain valid informed consent. These practices may breach the EU's General Data Protection Regulation (GDPR) - the company's own Data Consent Form acknowledges this possibility and requires users to accept the terms - or may violate local laws.
In a video interview in early March in Erlangen, Germany, where the company makes the spheres, Blania acknowledged that there was some "friction." But he attributes this to the fact that the company is still in its early stages.
I'm not sure if you realize it," he said, "but you've seen the test run for a Series A company. It's a few people trying to bring certain ideals to life. It's not like Uber, where hundreds of people do it many times. .
personal I.D
Two months before Worldcoin appeared in Ruswandi's village, the San Francisco-based company Tools for Humanity emerged from stealth mode. Worldcoin is its product.
The company's website describes Worldcoin as a "new, collectively owned global currency that will be equitably distributed to as many people as possible" based on Ethereum. The company proposes that everyone in the world will receive a free share if they agree to have their iris scanned using a specialized device that resembles a decapitated robot head, which the company calls the Chrome Orb. ).
The site goes on to preach that the sphere is necessary because of Worldcoin’s commitment to fairness: everyone should get his or her share of the digital currency — and nothing more. To ensure there is no double-dipping, Chromium Ball will scan participants’ irises and several other biometric data points, then use specialized algorithms the company is developing to cryptographically confirm they are human and that in Worldcoin is unique in the database.
Bloomberg first reported on the company last summer (Editor's note: 2021). Sam Altman, co-founder of Worldcoin and former president of Silicon Valley accelerator Y Combinator, told Bloomberg: "I am very interested in things like universal basic income and global wealth redistribution." Worldcoin's goal is to answer "Is there a way for us to use technology on a global scale?" Make it happen".
"The company is just getting started, and its goal is to get 1 billion registered users by 2023."
In the same article, the then 27-year-old Blania, who joined Worldcoin directly after graduating from Caltech with a master’s degree in physics, added, “There are still many people in the world who don’t have access to the financial system. Cryptocurrencies have the opportunity to help us do that. One goal.” (Blania and others use “Worldcoin” to refer to both the company and the currency; this article does the same.)
But in addition to these good intentions, Worldcoin will also solve key technical problems of Web3. Web3 is the much-hyped, blockchain-powered third generation of the internet, in which data and content can be decentralized and controlled by individuals and groups rather than a handful of technology companies.
In an interview with MIT Technology Review, Blania said that "letting everyone own this new protocol" will be the "fastest" and "largest entry into cryptocurrency and Web3" to date, solving one of the main challenges of Web3: user relative scarcity.
In addition, according to Blania, confirming that the other party is human through biometrics will solve another "very basic problem" of decentralized technology: the risk of the so-called Sybil attack, when one entity in the network creates and controls multiple fake This attack occurs when the account is accessed. This is especially dangerous in decentralized networks where pseudonyms are required. So far, it has been difficult to come up with an identity certificate that is truly resistant to Sybil attacks, which is seen as another obstacle to the large-scale application of Web3.
Worldcoin has been field-tested in 24 countries; (left to right) these promotional images were taken in Sudan, Indonesia, Chile, and Kenya.
Blania said that with these two solutions, Worldcoin can become "an open platform that everyone can use, whether for identification or distribution." That's the promise of Worldcoin: if successful, the protocol could become the universal method of authentication for a whole new generation of the Internet. If this is achieved, the currency itself may become more valuable. "Investors hope that the Worldcoin project will bring value to the world, thereby causing these stakes or tokens to appreciate in value," the company said in an emailed statement.
That's probably why Altman and some of Silicon Valley's biggest names are investing heavily in Worldcoin; Andreessen Horowitz recently led a $100 million funding round that tripled the startup's valuation from $1 billion to $3 billion.
peep sphere
As of March when we interviewed Blania, Worldcoin had scanned 450,000 eyes, faces, and bodies in 24 countries. Of these, 14 are developing countries (by World Bank criteria) and 8 are in Africa. But the company is just getting started, with a goal of gaining 1 billion registered users by 2023.
According to the company's description in a blog post, the centerpiece of the Worldcoin offering is the high-tech sphere itself, which is equipped with advanced cameras and sensors that can not only scan the iris, but also photograph "the user's body, face, and eyes, including the user's iris." high resolution images. Additionally, its data consent terms state that the company also conducts "non-contact Doppler radar detection of your heartbeat, respiration, and other vital signs." In response to our questions, Worldcoin said it has never implemented vital signs detection technology and will remove this language from its data consent terms. (As of press time, that statement still exists.)
The biometric information is used to generate an "IrisHash" - a code stored locally on the sphere. According to Worldcoin, the code is never shared, but is used to check if the iris hash already exists in Worldcoin's database. To do this, the company said, it used a novel privacy-preserving encryption method called zero-knowledge proofs. If the algorithm finds a match, it indicates that someone has already tried to register. If there is no match, the user passes the uniqueness check and can continue to register using an email address, phone number, or QR code to access the Worldcoin wallet. All this will be done in seconds.
Worldcoin said the biometric information remains on the sphere and is deleted once uploaded, or at least one day, once the company completes training of its AI neural network that recognizes irises and detects fraud. Until then, it's unclear how the data is being processed, aside from vague descriptions such as "personal data...sent over secure, encrypted channels." "During the field testing phase, we are collecting and securely storing more data than when completed," the blog post states. "Once our algorithms are fully trained, we will delete all biometric data collected during the field testing period."
In response to our questions before this article was published, Worldcoin said that a public version of its system would soon eliminate the need for new users to share any biometric data with the company, although it did not explain how this would work.
Useless IOU
However, we do know how the registration process works. To get Worldcoin onto new users’ smartphones, the company contracts with local “sphere operators” to manage registration in their countries.
Operators apply for the job and are interviewed and approved by the Worldcoin team, although company spokesperson Anastasia Golovina emphasized in an email that operators "are independent contractors and not Worldcoin employees." As such, they work without contracts or payment guarantees, instead receiving commissions based on the user biometric data they collect. However, Golovina added that they must "comply with local laws and regulations, including local labor laws."
These national operators receive commissions through the stablecoin Tether. A stablecoin is a cryptocurrency whose value is pegged to a traditional currency, usually the U.S. dollar. It is up to them to decide how much to pay subcontractors (usually in local currency) and the working conditions (full-time, part-time or casual). National operators and subcontractors are incentivized by commission-based payment structures to sign up as many users as quickly as possible.
On the other hand, new users can currently earn at least $15 worth of Worldcoin by submitting a biometric scan, and can earn another $5 by logging into the Worldcoin wallet. The total value of Worldcoin earned by new users recruited later changes to $25.
Some users will receive the payment in one lump sum, while others will receive it in weekly installments of $2.50. The difference, Blania says, is to test which incentives work best. Regardless, Worldcoin is not a stablecoin, and since the token (at the time, editor's note) had not yet launched, the company "does not yet know how many WLD tokens $20 is worth," it noted in a written statement.
To understand user motivations, some have the option to receive $20 worth of Bitcoin for easy cashout. Worldcoin said it found that “the most active users choose to keep their WLD,” although the majority of our respondents held the opposite view.
But with the redemption feature ending in the fall of 2021, for now, the pledged $20 or $25 worth of Worldcoin is equivalent to the company's IOU. For all intents and purposes, all tokens held by users in digital wallets are worthless.
seize the opportunity
Worldcoin users join for many reasons.
"Out of curiosity" is a common expression. It’s also said that because the orb operators “look nice,” or happen to be their brothers, cousins, or classmates. There are those who want early participation in what could be the next Bitcoin, those who have lost their jobs or income during the pandemic, and those who are desperate because of the threat of a renewed civil war.
Most people just want free money - someone just wants to buy lunch. Many suspect it's a hoax, but few are willing to give up trying, what if it isn't?
Ruswandi for several reasons. He lost most of his job as a furniture maker during the pandemic and spent his spare time trading stocks and cryptocurrencies, frequenting cryptocurrency-related message boards and exchanges.
“I was curious and thought it wouldn’t hurt to try it out,” he recalls, making the money attractive given his reduced income.
But he soon became suspicious. Neither company representatives nor village officials on site could answer basic questions about Worldcoin. He did more research online and came up with nothing, leading him to conclude that it was a scam. He believes the mystery giveaway was a massive data-gathering campaign disguised as some kind of covert offline airdrop — a ploy by cryptocurrency projects to issue free tokens to lure users.
After all, many of his countrymen’s knowledge of the internet was limited to the Facebook app pre-installed on their smartphones, so before potential users could receive the new currency, Worldcoin representatives “first had to help many residents set up email and log into the network,” Ruswandi recalled. explain. If it was to attract users to new cryptocurrencies, he wondered, "Why did Worldcoin target low-income communities in the first place, rather than cryptocurrency enthusiasts or communities?"
The picture shows Iyus Ruswandi at the Worldcoin recruitment site in Gunungguruh, West Java. He has many questions about why the company needs iris scans, but none of them have been answered. (Photo by Muhammad Fadli)
biometrics problem
In October 2021, when Worldcoin announced "Here we come!", it was immediately met with strong doubts.
As NSA whistleblower Edward Snowden tweeted, "Don't sort eyeballs. Don't use biometrics for fraud. In fact, don't use biometrics for anything." Purpose. The human body is not a wicket."
Many have expressed doubts about Worldcoin's privacy protocols, especially since the company has yet to publish a white paper or open up its code for outside evaluation. "It looks like a global (hash) database of people's iris scans was generated (in the name of "fairness")" and the impact was neutralized by announcing "We removed the scans." It was deleted, but you saved the *hash* generated by the scan, and the hash that matches *future* scans," Snowden tweeted.
There is also the issue of hardware security. Jeremy Clark, an associate professor at Concordia's Information Systems Engineering Institute who focuses on applied cryptography, questions the security of the sphere: "There will be some security protections in the machine itself," he said, "but no technology is absolutely secure. ’. So it’s usually an economic issue... If the project succeeds as they hope, it becomes more profitable to try to solve the problem.”
Others questioned the company's alleged fairness, since 20 percent of the tokens had already been allocated: 10 percent to Worldcoin's full-time employees and another 10 percent to investors such as Andreessen Horowitz.
Additionally, many in the blockchain space disagree with the basic premise that Worldcoin is trying to build: creating an identity on Web3, which is especially true for a movement moving toward blockchain, DeFi, and DAOs (“Decentralized Autonomous Organizations”). is a curse, a movement whose express purpose is anonymity.
Others remain unconvinced that Worldcoin can actually truly benefit everyone in the world and, instead, will distract from the ongoing work of creating a new identity paradigm. Identity expert Kaliya Young declined to comment specifically on Worldcoin, but said, "When it comes to online identity, companies often claim that 'if everyone in the world was in our system, then everything would be fine.'" New News Yes: Everyone is not going to show up in your system, so let's move on to how to fix the problem. 』
Blania and his team believe this criticism is misplaced. "Most of our team has a background in cryptocurrency ... so we care a lot about this (privacy)," he told MIT Technology Review. "I completely understand the concern," he said, but he said it was more of an "emotional gut reaction" than an "objective critique." What critics miss, he added, is how good the Worldcoin protocol will be at protecting privacy once it is finalized.
Stephanie Schuckers, director of the Center for Identification Technology Research at Clarkson University, said this is not impossible because of the many recent advances in biometric technology. One of the latest trends is Template Security, which uses encryption to transform biometric data. "When you store that data, if it's stolen, it can't be reverse-engineered back to the original biometrics," she said.
But she added that the reason the technology hasn't been commercialized yet is that encryption switching often results in "performance degradation." Rather than matching new biometric data to an existing biometric sample, sample security matches a computer algorithm's interpretation of the data with another stored code via some kind of hash or code. This increases the room for error, making it "more difficult to match biometric data in this encrypted space," Schucker said. But she added that recent advances in sample safety have addressed some of these shortcomings.
Sample security sounds like something Worldcoin might be working on — though Schucker cautions that it's hard to know for sure without seeing their code, or more information beyond the Worldcoin blog post.
Since we first contacted the company in February, Worldcoin has committed to open sourcing its code, including repeatedly stressing to MIT Technology Review on multiple occasions that this would happen "in the coming weeks."
In addition, the company added in a statement: "It is important to emphasize that our purpose of collecting data is not to profit from it or to spy on our users like many other technology companies. Instead, our goal is simply to use this data Used to develop algorithms to minimize fraud and enhance user privacy."
let them join
According to many people interviewed by MIT Technology Review, Worldcoin representatives used a series of questionable tactics and inducements to attract new users.
Mohammad Ahmed Abdalbagee, one of Sudan’s four former sphere operators, said that when operations began in Sudan in March 2021, operators found it difficult to “explain the concept of digital currency to people who don’t even have email.” So they held an AirPod prize contest to encourage registrations, which eventually attracted about 20,000 registrants.
At an Islamic high school in West Java, Indonesia, Worldcoin applied to host a cryptocurrency seminar. The school’s student activities coordinator, Muhammad Hilham Zein, read the application and recommended approval, but only if the application is “to share knowledge about crypto…rather than encourage students to invest in digital currencies.”
“Why did Worldcoin initially target low-income communities instead of cryptocurrency enthusiasts or communities?”
But first-hand observations from attendees (at least one of whom was over 15, in violation of Worldcoin's own terms of use) and our reporters told a different story. During the 45-minute meeting, Worldcoin staff were busy registering a dozen students, helping them download apps and sign up for emails, and finally scan their biometrics to provide information about the cryptocurrency, Worldcoin itself, or instruct them on how to consent. or withdraw consent. (Students at least receive their allocation of Worldcoins, which are distributed on a weekly basis).
At recent recruitment events held in about 20 villages in West Java, many new users like Iyus Ruswandi were attracted by the giveaways.
"It was held during a pandemic, when the government usually gives out social assistance packages," explained Ece Mulyana, the principal of an Islamic primary school who had been told the night before that his school would be used as a Worldcoin registration site. “I couldn’t refuse the request,” Mulyana said, because the instructions came from a higher-level official, Ade Irma, head of street management, who was helping Worldcoin coordinate village registration.
Mulyana said Irma pays 2,000 rupiah (about 14 U.S. cents at the time of writing) for each person successfully scanned. Mulyana estimated that 170 people attended, for a total of IDR 340,000 (approximately US$23.80).
Irma's boss, Heni Mulyani, the street leader who approved the activities, said the money was used "to buy coffee and cigarettes," which is a euphemism for paying government officials to facilitate the activities they requested. She said none of the money paid was used for venue rent, but added, "We assure you that this money did not come from the village fund or the budget."
A night view of Gunungguruh, one of about 20 villages Worldcoin visited for its recruitment drive. (Photo by Muhammad Fadli)
Instead, the money came from a company called PT Sandina Abadi Nusantara, which was co-founded by a man named Muhammad Reza Ichsan and his mother, who happens to be Worldcoin’s “top performing operator” (according to Blog post published by Worldcoin). The company is the legal entity under which Worldcoin Indonesia operates; his mother's job is to contact local government officials to coordinate the recruitment.
Ichsan told MIT Technology Review, "We don't pay the village, but we provide an operating fund for those who help us bring the public on site."
Even if Mulyani did not misuse village funds, the tips (with rare exceptions) would be illegal under Indonesia's anti-corruption and anti-bribery laws, and both giver and recipient could be subject to criminal penalties.
In response to questions about the payment to village officials, Worldcoin representatives said they were unaware of the incident, calling it an "isolated incident" and saying they had launched an investigation to learn more. While they can't yet conclude, Golovina wrote, "It's possible that most or all of these payments are genuine operating expenses, such as the cost of operating a business in a school or other facility, or payments to maintain operations in certain places." Fees for permits or licenses required to operate.” This contradicts the official account and those who operate it.
Worldcoin also referred to other examples we provided them of as “independent and isolated work by local globe operators,” including an AirPod giveaway in Sudan and deceiving schools in Indonesia, adding, “We are entirely focused on incentivizing operators to register Active users who are excited about using Worldcoin."
For their part, the villagers were not informed that at least some officials were being paid to promote Worldcoin; indeed, as the school principal Mulyana recalled, many believed the event was run by the government. “We have to explain to them that this is not a government project,” he said, “Worldcoin is a foreign company and they need the assistance of the village staff when they come.”
Now, some villagers doubt whether they will receive the money because they have been told Worldcoin representatives will return to the village to distribute funds in late January 2022, which has passed (WEEX Note: This article was published in April 2022). For those who are digitally savvy, the ability to trade Worldcoin in the wallet is also missing.
Operation blind spot
Mixed information and misinformation are not necessarily intentional. The sphere operators we interviewed often mentioned that they received very little information from the Worldcoin representatives who recruited them, even though they were well aware that their compensation was tied to the number of people they signed up for. (Worldcoin says it provides its national sphere operators with a code of conduct that sub-operators must also abide by, and that they are moving away from paying commissions based on signups.)
One such operator is Bryan Mtembei, a civil engineer who recently graduated from a university in Nakuru, Kenya’s fourth-largest city, and became a Worldcoin CEO after being scanned on campus last September. of freelancers.
He hopes he can receive "a brief training or basic knowledge about Worldcoin." Instead, the only instruction he was given was to “get more people involved and make more money for myself,” he says. “The rest came down to my social marketing skills.”
So he tries to answer questions from new users, the most common of which are about privacy: Mtembei estimates that about 40 percent of the people he contacts express concerns about sharing their biometric data.
When he initially expressed similar concerns, a representative assured him that all of his questions had been addressed in the Worldcoin “white paper.” But in fact there is no such document. According to the company, this is by design—people are less likely to read "long, highly technical academic-style papers," and their shorter blog posts can be considered white papers.
Ultimately, Mtembei's need for money overcame his concerns. He registers 150 to 200 people and gets a commission of 50 KS (Kenyan shillings, or 44 cents) for each scan.
Bryan Mtembei first met Worldcoin representatives on the university campus in Nakuru, Kenya. He was scanned and later became an operations officer. (Photo by Brian Otieno)
Mtembei is not alone. Willis Okach is a university student in Nairobi who, like Mtembei, was recruited as an operations officer after taking part in the scans, and he also got involved for the money. “You don’t have (money), someone gives you some,” he said, explaining that Worldcoin “feels like students don’t have much money, so they sign up.” In two days of work, Okach signed up 50 people, each bringing With a set of biometric data, he can earn 100KS ($0.88).
Worldcoin spokesperson Golovina said, "All users who register during the field test will be fully informed about what data we will collect and how it will be used, and they will be asked to give their consent before registering. Anyone who consents to our collection and use of their biometric data Individuals can withdraw their consent at any time and the data will be deleted."
But none of the people we interviewed were explicitly told (or the operations staff didn't tell others) that they were "test users" whose faces and videos and 3D body maps were taken and used to train the spheres. "Anti-fraud algorithms" to "distinguish different people" treat their data differently from those of others behind them, or they can ask to have their own data deleted.
Ángel Rodriguez, a subway security guard in Santiago, Chile, recalled checking a box in the Worldcoin App to agree to the terms of service, and the instructions were in English, which he didn't understand. Additionally, according to Worldcoin, the link to its app and data consent terms won’t be available until “late 2021,” when field testing has been going on for at least a year.
Sometimes, new users are asked to provide additional personal data, but Worldcoin claims they are never asked for this. Almost everyone we interviewed was asked to provide an email address to log into their wallet (even after Worldcoin introduced QR code login). Some were also asked to provide their phone numbers.
Golovina denied in multiple email statements that an email or phone number was required for registration, but “we do offer certain features, such as the ability to send and receive Worldcoin, to users who choose to provide a phone number or email address. But such things Always optional.” Worldcoin did not explain what users could do with their tokens without being able to send or receive tokens.
Meanwhile, in Nairobi, several students said sphere operators took photos of their ID cards, in an effort to confirm, Okach recalled, that he "was not...a robot." Worldcoin stated that they have never asked users to provide national identification documents, only sphere operators.
When we shared these responses with our interviewees, they didn’t agree. Mtembei stresses that personal information has never been optional and registering on his sphere is impossible without an email and a phone call. "He's lying," he said.
Mohammad Ahmed Abdalbagee, one of four sphere operators employed by Worldcoin in Sudan, added that it was his team's efforts that convinced Worldcoin to add a phone number as the preferred login method. "Before they operated in Sudan, they used email as the primary identifier, but we told them that would not work in Sudan. Many university students don't even have email addresses and they use their phones to register on social media," he said.
implicit colonialism
Some academics who specialize in the relationship between the tech industry and countries in the Global South are concerned, but not surprised, by Worldcoin’s behavior.
Payal Arora, a digital anthropologist and author of "The Next Billion Users: Digital Life Beyond the West," said: "This is a race to see who is in this AI-driven world. It’s a race to get the most data in the economy.” Stricter data protection laws in Europe and the United States mean ambitious entrepreneurs in those regions can’t get the training data they need from their own populations, she said, so they must set their sights on development Chinese home.
In fact, according to a blog post published by Worldcoin, Worldcoin is not available in both the United States and China due to regulatory restrictions. Bloomberg reports that the company has also halted field testing in other countries, including Turkey and Sudan, for similar reasons. However, Worldcoin has already signed up many US users during a demo held at a cryptocurrency conference, although the company does not consider its US activities to be a live test.
“It’s cheaper and easier to carry out this kind of data collection in places where funding is scarce and legal protections are weak.”
Pete Howson, a senior lecturer in the international development of cryptocurrencies at Northumbria University, classifies Worldcoin’s actions as a form of cryptocolonialism, in which “blockchain and cryptocurrency experiments are imposed on disadvantaged communities, essentially because ...These people can't fight back," he told MIT Technology Review in an email.
Compared with other forms of digital colonialism, crypto-colonialism is more harmful, Howson explained, because blockchain’s core tenet of decentralization allows for “very limited liability … when things go wrong.” "You'll hear the term DYOR a lot because these people don't care much about rules and regulations."
However, inequalities in information and internet access make the “DYOR” spirit almost impractical for many people in developing regions. Likewise, huge economic disparities mean that in, say, Kenya, a promise of less than half a dollar would get people to give up their biometric data, whereas in Norway or the United States, such a promise would not have much effect.
In short, it is cheaper and easier to carry out this kind of data collection in places where funding is scarce and legal protections are weak.
Data lapses and policy gaps
While most of Worldcoin's field testing has been conducted in developing countries , the company stresses that it is also active in developed countries, including several countries in Europe. “Worldcoin has been trying to live test it in representative countries around the world,” the company told us.
This represents its own challenges. Worldcoin is subject to the EU GDPR when collecting, controlling and processing personal data of "data subjects" as defined by the EU (i.e. any person within the EU, including citizens, residents and potential visitors whose data is collected).
The GDPR, enacted in 2018, requires data subjects to be fully informed about why their data is collected, how it will be used, who will process it, where the data will be transferred, how to delete the data and how to stop the processing of the data. Failure to adequately protect data could result in fines of up to 4% of global revenue or €20 million, depending on the severity of the breach.
Additionally, the GDPR also applies if companies outside Europe collect or process personal data of European data subjects. Therefore, a company like Worldcoin, registered in Delaware and headquartered in San Francisco, would not necessarily be exempt.
However, this is exactly what Worldcoin mentions in its data consent terms, and before MIT Technology Review submits a list of questions, the company requires users to accept the following statement:
"We [Worldcoin] voluntarily comply with the GDPR policy"
"We have not yet adopted a board-approved data privacy and security policy that describes the means and methods by which we plan to protect your data to meet the prevailing standards in the GDPR."
"Our policies and procedures may not be adequate to meet GDPR requirements"
"If we fail to comply, it may be more difficult to defend your privacy rights in U.S. courts."
Marietje Schaake, director of international policy at Stanford University's Cyber Policy Center and a former member of the European Parliament who reviewed the document, said the policy sought to create "exceptions." But according to GDPR, there are no exceptions. Moreover, the fact that Worldcoin has a German subsidiary already makes it subject to the GDPR.
"As an EU citizen, you have the right to challenge it," Schaake said, referring to any potential violations. The challenges will be reviewed by European data protection authorities and ultimately argued before the European Court of Justice and not, as Worldcoin has suggested, a U.S. court.
Worldcoin says it fully complies with the GDPR and is registered with the Bavarian Data Protection Authority. They employ a data protection officer and have carried out a data privacy impact assessment, although they declined to make the data protection officer or the results of the assessment public. Worldcoin added that the statement in their terms of consent “previously contained substantial caveats...they no longer appear in our most recent version of the data consent terms.” However, as of the time of publication, the statement remained online.
For Aida Ponce del Castillo, a researcher at the European Union Institute for Trade Research who studies regulations for emerging technologies and also serves as her organization's data protection officer, the lack of transparency is unreasonable. “The DPIA is not confidential business information,” she told MIT Technology Review—while publication is not mandatory, she noted that the European Commission recommends that companies “consider publishing at least some of the content, such as a summary or conclusion.”
The Bavarian Data Protection Authority has not yet responded to MIT Technology Review's request to confirm the company's registration.
"This is manipulation"
Beyond ethical issues, there are more practical questions, such as: How well does Worldcoin actually work?
For some test users and sphere field operators, the answer is, not at all.
Sometimes this is caused by problems with the sphere. In Sudan, local iris reader operator Abdalbargee said it takes up to six attempts for the iris reader to recognize a person's face. "It actually took my friend a full week for the device to recognize his irises," he added.
The spheres are also prone to malfunctioning, slowing down recruitment, and repairs need to be made in Germany. When Buzzfeed News found a similar sphere glitch in a recent investigation, Worldcoin used the phrase it repeated to us: calling one particularly severe case an “isolated anomaly.”
Meanwhile, some users lost their entire accounts or all their tokens during the upgrade from the web wallet to the app wallet. For others, the app has proven to be buggy, draining battery life or causing them to get stuck in a vicious cycle of loading and reloading.
Rodriguez, the aforementioned Chilean subway security guard, had been struggling with his wallet shortly after being scanned. After signing up in February, the app required him to enter his email address, phone number and use a QR code, but the app caused performance issues on his phone, so he uninstalled the app entirely. When he tried to download the app again, his username no longer existed.
Local sphere operations staff told him that in order to fix the problem, he would have to find the sphere and rescan the biometrics. But if Worldcoin is what it claims to be, a rescan will only match his iris with an existing iris hash. In other words, once an account is lost, it cannot be recovered, as Worldcoin later confirmed.
There are also cases of identity spoofing that the sphere cannot detect. In mid-2021, a businessman in Indonesia was able to register and access the wallets of more than 200 users who had completed scanning and authentication, and transfer assets held in Bitcoin at the time. Worldcoin said this happened in the early days when the wallet was accessed through the web rather than the app, and "since the upgrade... we have not discovered similar fraud."
Meanwhile, those concerned that the whole thing might be a hoax wonder what they have lost. “50 KS is not enough to attract attention,” said Okach, a university student in Nairobi, who spent a weekend recruiting others to join Worldcoin. "It's manipulation, taking advantage of students without clearly stating what they're doing or wanting."
Forget about early adopters
When we began reporting on this story, we noted that 3 of the 5 countries originally cited as case studies for successful field testing—Indonesia, Sudan, and Kenya—were classified by the World Bank as low-income or lower-middle-income countries. Power and economic disparities seemed ethically fraught, so we started digging.
We wanted to know: What is it like to be an early adopter of this global crypto experiment? Do participants actually understand cryptocurrency, Worldcoin, and the consequences of giving up biometric data? Or what were they told? Did they provide informed consent—in which case, what does informed consent mean? Finally, many of our interviewees asked the same question – what is the real purpose of iris scanning?
From left to right: Ruswandi's neighbors Sadili, Solihin (community leader) and Eli were among the 170 villagers scanned.
Finally, it was a line that Blania dropped in passing during an interview in early March that got us started on Worldcoin.
"We'll have privacy experts tearing the system apart over and over again before we actually deploy it at scale," he said in response to strong questions about privacy in the fall of 2021.
Blania just shared how his company got 450,000 people to join Worldcoin, which means its sphere scanned 450,000 sets of eyes, faces, and bodies, storing all the data to train its neural network. The company recognizes that this data collection is problematic and intends to stop doing so. However, they did not provide the same privacy protections to these early users.
We are puzzled by this seemingly contradictory phenomenon: Are we lacking foresight and the big picture? After all, 450,000 may be small compared to the company's stated goal of 1 billion registered users.
Each of these 450,000 people is an independent person with his own hopes, life and rights, but none of this has anything to do with the ambitions of a Silicon Valley startup.
Talking to Blania clarified something we've always struggled to understand: How can a company be so keen on talking about its privacy practices while clearly violating the privacy of so many people?
Through interviews, we can see that for Worldcoin, these large number of test users are not their final target users to a large extent. Instead, their eyes, bodies, and life patterns are just the raw material for Worldcoin's neural network. At the same time, they pay low-level sphere operators a small amount of money to feed their algorithms, and these operators often privately struggle with their own ethical doubts. Ironically, the project is so dehumanizing to those who have worked so hard to teach Worldcoin’s AI who or what to recognize as human.
When we submitted the seven-page report findings and questions to Worldcoin, the company responded that almost all of the negative issues we found were "isolated incidents" that would ultimately not matter until the next (public) iteration will be better. “We believe privacy and anonymity are vital, which is why in the coming weeks, everyone who signs up for Worldcoin will be able to do so without sharing any biometric data with us,” the company wrote. Do it.” Nearly half a million people have been tested, and that doesn’t seem to matter.
And what really matters is the result: Worldcoin will have a significant user base to support its sales pitch as the identity solution of choice for Web3. And when the real, monetizable product — whether it’s a sphere, a Web3 passport, the currency itself, or all of the above — rolls out to its intended audience, it’ll all fall into place, without any messy artificial signs or behind-the-scenes human organs.
Recommended reading:
How does V God view the world currency?
< END >
