Source: MIT Technology Review, April 6, 2022
Authors: Eileen Guo & Adi Renaldi
Translation: WEEX
On a sunny morning in December 2021, Iyus Ruswandi, a 35-year-old furniture manufacturer from Gunungguruh Village in Indonesia, was awakened early by his mother. She said that a tech company was holding a “social assistance gift event” at a local Islamic school and asked him to attend.
- Recent Overview of POW Projects Dynex, Microvision Chain, Neurai
- Polygon accuses zkSync of plagiarism Amidst the showdown between the two ZK giants, Manta claims that part of the controversy is the original creation of its employees.
- Quick look at Coinbase’s Q2 financial report Revenue exceeds expectations, but still loses nearly 100 million US dollars
Ruswandi joined the long queue of residents, most of whom were women, some of whom had been queuing since 6 a.m. In the midst of the economic downturn caused by the pandemic, any form of assistance was welcomed.
At the front of the line, representatives from Indonesia’s Worldcoin were collecting email addresses and phone numbers, or pointing a futuristic metal ball at the faces of villagers to scan their irises and other biometric data. Village officials were also present, distributing numbered tickets to the queuing residents to help maintain order.
WEEX Note: The device used by Worldcoin to collect people’s biometric data is referred to as the “Orb” in the article.
Ruswandi asked a representative from Worldcoin about the nature of the charity organization, but did not learn any new information: as his mother said, they were making donations.
Gunungguruh was not the only village visited by Worldcoin. Representatives from Worldcoin appeared in villages in West Java, Indonesia, as well as on university campuses, subway stations, shopping malls, and city centers in more than 20 countries, most of which are developing countries, collecting biometric data. It is understood that they offer various things in return, from free cash (usually in local currency and Worldcoin tokens) to Airpods, and even promises of future wealth. In some cases, they also pay local government officials. However, they did not provide much information about their true intentions.
This has left many, including Ruswandi, confused: what exactly does Worldcoin do with the iris scans?
To answer this question and gain a better understanding of Worldcoin’s registration and distribution process, MIT Technology Review interviewed more than 35 people from six countries: Indonesia, Kenya, Sudan, Ghana, Chile, and Norway. These individuals either work for Worldcoin, represent Worldcoin, have been scanned, or have participated but were not successfully recruited.
In a registration event in Indonesia, we observed the scanning process, read conversations in social media and mobile chat groups, and reviewed comments on the Worldcoin wallet in Google Play and Apple stores. We interviewed Alex Blania, the CEO of Worldcoin, and submitted a detailed investigation report and list of questions to the company for comments.
Our investigation shows that while Worldcoin emphasizes privacy protection in public information, the actual experiences of users are quite different. We found that representatives of the company used deceptive marketing tactics to collect more personal data than they admitted, without obtaining valid informed consent. These practices may violate the General Data Protection Regulation (GDPR) of the European Union – the company’s own Data Consent Form acknowledges this possibility and requires users to accept these terms, which may also violate local laws.
In early March, during a video interview conducted at the company’s production sphere in Erlangen, Germany, Blania admitted to some “friction”. But he attributed this to the fact that the company is still in its early stages.
“I’m not sure if you realize this,” he said, “but you’ve seen how a Series A company operates. It’s a group of people trying to make certain ideals a reality. It’s not like Uber, where hundreds of people have done it many, many times.”
Identity Verification
Two months before Worldcoin appeared in the village of Ruswandi, a company called Tools for Humanity, based in San Francisco, emerged from stealth mode. Worldcoin is its product.
The company’s website describes Worldcoin as a new, collectively-owned global currency based on Ethereum, which will be distributed fairly to as many people as possible. The company suggests that everyone in the world will receive a free share as long as they agree to use a dedicated device for iris scanning, which resembles a decapitated robot head, and the company calls it the “Chrome Orb”.
The website continues to state that this sphere is necessary because of Worldcoin’s commitment to fairness: everyone should receive their allocated digital currency share – and that’s it. To ensure that there is no double-dipping, the Chrome Orb will scan participants’ irises and several other biometric data points, and then use a specialized algorithm being developed by the company to cryptographically confirm that they are human and unique in the Worldcoin database.
Bloomberg first reported on the company last summer. Sam Altman, co-founder of Worldcoin and former president of Silicon Valley accelerator Y Combinator, told Bloomberg, “I’m very interested in things like universal basic income and redistributing global wealth,” and Worldcoin’s goal is to answer the question of whether “we can use technology to do this globally.”
“The company is just getting started, with the goal of reaching 1 billion registered users by 2023.”
In the same article, Blania, who was 27 at the time (he joined Worldcoin directly after graduating with a master’s degree in physics from Caltech), added, “There are still many people in the world who are unable to use the financial system. Cryptocurrency has the potential to help us achieve this goal.” (Blania and others use “Worldcoin” to refer to both the company and the currency; this article does the same.)
But in addition to these good intentions, Worldcoin also aims to solve the key technical problems of Web3. Web3 is the widely publicized, blockchain-driven third iteration of the internet, where data and content can be decentralized and controlled by individuals and groups rather than a few tech companies.
In an interview with MIT Technology Review, Blania stated that “giving everyone ownership of this new protocol” would be the “fastest” and “largest-scale entry into cryptocurrency and Web3” to date, addressing one of the main challenges of Web3: the relative lack of users.
Furthermore, according to Blania, confirming that the other party is human through biometric identification would address another “fundamental problem” of decentralized technology: the so-called Sybil attack risk, which occurs when one entity in a network creates and controls multiple fake accounts. This is particularly dangerous in decentralized networks that require pseudonymity. So far, it has been difficult to propose a truly Sybil attack-resistant identity verification, which is seen as another obstacle to the widespread adoption of Web3.
Worldcoin has already conducted on-the-ground tests in 24 countries; (from left to right) these promotional images were taken in Sudan, Indonesia, Chile, and Kenya.
Blania said that with these two solutions, Worldcoin can become “an open platform that everyone can use, whether for identity verification or distribution.” This is Worldcoin’s promise: if successful, the protocol could become the universal identity authentication method of the next generation internet. If this is achieved, the currency itself may become more valuable. The company stated in an email statement, “Investors hope the Worldcoin project brings value to the world, thereby increasing the value of these shares and/or tokens.”
This may be why Altman and some big names in Silicon Valley have invested heavily in Worldcoin; Andreessen Horowitz recently led a $100 million funding round, doubling the startup’s valuation from $1 billion to $3 billion.
A Glimpse into the Sphere
As of March, when we interviewed Blania, Worldcoin had already scanned 450,000 eyes, faces, and bodies in 24 countries. Of these, 14 are developing countries (according to World Bank standards), and 8 are in Africa. But the company is just getting started, with a goal of reaching 1 billion registered users by 2023.
According to the company’s description in a blog post, the core of Worldcoin’s issuance is the high-tech sphere itself, equipped with advanced cameras and sensors that can not only scan irises but also capture high-resolution images of “users’ bodies, faces, and eyes, including user irises.” Additionally, its data consent terms state that the company also conducts “non-contact Doppler radar to detect your heartbeat, breathing, and other vital signs.” In response to our questions, Worldcoin stated that it has never implemented vital sign detection technology and will remove this statement from its data consent terms. (As of the time of writing, this statement still exists.)
Biometric identification information is used to generate “IrisHash” – a code stored locally on the sphere. According to Worldcoin, this code is never shared but is used to check if the IrisHash already exists in the Worldcoin database. The company claims to use a novel privacy protection encryption method called zero-knowledge proof to achieve this. If the algorithm finds a match, it indicates that someone has already attempted to register. If there is no match, users can continue to register using their email address, phone number, or QR code, through a uniqueness check, to access the Worldcoin wallet. All of this will be completed within seconds.
Worldcoin states that biometric information is retained on the sphere and will be deleted once uploaded, or at least one day, once the company completes the iris recognition and fraud detection AI neural network training. Until then, it is unclear how these data are processed, apart from vague descriptions such as “personal data… sent through secure, encrypted channels.” “During the on-site testing phase, we collect and securely store more data than we will have upon completion,” the blog post noted. “Once our algorithm is fully trained, we will delete all biometric data collected during the on-site testing period.”
Prior to the publication of this article, Worldcoin stated in response to our questions that the public version of its system will soon eliminate the need for new users to share any biometric data with the company, although it did not explain how this will work.
Useless IOU
However, we know how the registration process works. In order for Worldcoin to enter new users’ smartphones, the company has signed contracts with local “sphere operators” who manage the registration work in their respective countries or regions.
The operators apply for this work and undergo interviews and approval from the Worldcoin team, although company spokesperson Anastasia Golovina emphasized in an email that the operators “are independent contractors, not Worldcoin employees.” Therefore, their work does not come with contracts or payment guarantees, but commissions are earned based on the biometric data they collect from users. However, Golovina added that they must “comply with local laws and regulations, including local labor laws.”
These national-level operators charge commissions in stablecoin Tether. A stablecoin is a cryptocurrency whose value is pegged to traditional currency (usually the US dollar). They decide the fees to be paid to subcontractors (usually in local currency) as well as the working conditions (full-time, part-time, or temporary work). Both national-level operators and subcontractors are incentivized by a commission-based payment structure to register users as quickly and as many as possible.
On the other hand, currently new users can earn at least $15 worth of Worldcoin by submitting biometric scans, and an additional $5 upon logging into the Worldcoin wallet. The total value of Worldcoin that newly recruited users can receive later changes to $25.
Some users receive this amount as a lump sum, while others receive it in batches of $2.5 per week. Blania says this difference is to test which incentive measure is most effective. Regardless, Worldcoin is not a stablecoin, and since the token (at that time, WEEX) has not been launched, the company “does not yet know how much WLD token is equivalent to $20,” it stated in a written statement.
In order to understand the motivations of users, some people may choose to receive $20 worth of Bitcoin for easy cashing. Worldcoin stated that it found that “the most active users choose to hold onto their WLD,” despite the fact that most of our respondents hold the opposite view.
However, with the termination of the cashing function in autumn 2021, currently, the promised value of $20 or $25 worth of Worldcoin is equivalent to an IOU from the company. Regardless of intent or purpose, all tokens in users’ digital wallets are worthless.
Seizing the opportunity
There are many reasons why users join Worldcoin.
“Out of curiosity” is a common explanation. Another explanation is that the globe operator “looks nice,” or happens to be their brother, cousin, or classmate. Some people hope to get involved early in what could be the next era of Bitcoin, while others have lost their jobs or income during the pandemic, and some feel desperate due to the threat of a resurgence of civil war.
Most people just want free money – some just want to buy lunch. Many people suspect it is a scam, but few are willing to give up the opportunity, just in case it turns out to be true.
Ruswandi is one of those people for the reasons mentioned above. During the pandemic, he lost most of his job as a furniture manufacturer and used his spare time to trade stocks and cryptocurrencies, often frequenting message boards and exchanges related to cryptocurrencies.
“I was curious and thought it wouldn’t hurt to try,” he recalled, considering that the money was attractive given the decrease in income.
But he soon became suspicious. The representatives of the company on site and the village officials were unable to answer basic questions about Worldcoin. He did more research online but found nothing, so he concluded that it was a scam. He believed that the mysterious giveaway was a large-scale data collection activity disguised as some kind of secret offline airdrop – a strategy for cryptocurrency projects to release free tokens to attract users.
After all, many of his fellow villagers have limited knowledge of the internet, only using the Facebook app pre-installed on their smartphones. Therefore, before potential users could receive the new currency, Worldcoin representatives “first had to help many residents set up email and log in to the internet,” Ruswandi recalled. He wondered why Worldcoin targeted low-income communities at the beginning, instead of cryptocurrency enthusiasts or communities, if it was to attract users to use the new cryptocurrency.
The picture shows Iyus Ruswandi at the Worldcoin recruitment event in Gunungguruh, West Java. He had many questions about why the company needed iris scanning, but did not get any answers. (Photo by Muhammad Fadli)
Biometric Identification Issues
In October 2021, when Worldcoin announced “We’re here!”, it immediately faced strong skepticism.
As whistleblower Edward Snowden tweeted, “Don’t classify eyeballs. Don’t use biometric technology for anti-fraud. In fact, don’t use biometric technology for any purpose. The human body is not a turnstile.”
Many people have expressed doubts about Worldcoin’s privacy policy, especially since the company has not released a white paper or opened its code for external evaluation. “This seems like creating a global (hash) database of people’s iris scans (in the name of “fairness”)” and trying to mitigate the impact by announcing “we deleted the scans”. “Yes, they are deleted, but you keep the *hash* generated by the scan, as well as the hash values that match *future* scans,” Snowden said in a tweet.
There are also concerns about hardware security. Jeremy Clark, an associate professor at Concordia’s Institute for Information Systems Engineering, who focuses on applied cryptography, questioned the security of the sphere: “The machine itself will have some security measures,” he said, “but no technology is absolutely secure. So this is usually an economic issue… If this project succeeds as they hope, then trying to solve this problem will become more profitable.”
Others have questioned the company’s claim of fairness, as 20% of the tokens have already been allocated: 10% to Worldcoin’s full-time employees and another 10% to investors such as Andreessen Horowitz.
In addition, many in the blockchain community disagree with the fundamental premise that Worldcoin is trying to build: creating an identity on Web3, which is a curse for a movement towards blockchain, DeFi, and DAOs (decentralized autonomous organizations) that explicitly aim for anonymity.
Others still do not believe that Worldcoin can actually benefit everyone in the world, but rather that it will distract attention from the ongoing work of creating new identity paradigms. Identity expert Kaliya Young, while refusing to comment specifically on Worldcoin, said, “In terms of online identity, companies often claim, ‘If everyone in the world is in our system, everything will be fine.’ News flash: not everyone will be in your system, so let’s continue the discussion on how to solve the problem.”
Blania and his team believe that this criticism is incorrect. “Most of our team has a background in cryptocurrency… so we care deeply about privacy,” he told MIT Technology Review. “I completely understand these concerns,” he said, but he believes that they are more of an “emotional intuitive response” rather than “objective criticism.” He added that critics overlook how excellent Worldcoin’s protocol will be in protecting privacy once it is completed.
Stephanie Schuckers, director of the Clarkson University Identity Recognition Technology Research Center, said that this is not impossible because biometric technology has made many advances recently. One of the latest trends is “template security,” which uses encryption technology to transform biometric data. “Once you store this data, if it is stolen, it cannot be reversed engineered back to the original biometric information,” she said.
However, she added that the reason this technology has not been commercialized is that encryption transformation often leads to “performance degradation.” Template security does not match new biometric data with existing biometric samples, but matches the computer algorithm’s interpretation of the data with another stored code through some kind of hash or code. Schuckers said that this increases the margin of error, making “matching biometric data in this encrypted space more difficult.” However, she added that recent progress in template security has addressed some of these flaws.
Template security sounds like something Worldcoin might be doing, but Schuckers warns that it is difficult to determine without seeing their code or more information beyond Worldcoin blog posts.
Since we first contacted the company in February, Worldcoin has promised to open source its code, including repeatedly emphasizing in multiple occasions to MIT Technology Review that this will be achieved “in the coming weeks.”
In addition, the company added in a statement: “It should be emphasized that the purpose of collecting data is not to profit from it or to monitor our users like many other tech companies. Instead, our goal is solely to use this data to develop algorithms to minimize fraud and enhance user privacy.”
Let them join
Many people interviewed by MIT Technology Review revealed that representatives from Worldcoin used a series of suspicious strategies and incentives to attract new users.
Mohammad Ahmed Abdalbagee, one of Sudan’s four former mobile operators, said that when they started operating in Sudan in March 2021, it was difficult for operators to “explain the concept of digital currency to those who don’t even have an email.” Therefore, they held an AirPod giveaway contest to encourage registration, ultimately attracting about 20,000 registrants.
In a high school in West Java, Indonesia, Worldcoin applied to hold a cryptocurrency workshop. Muhammad Hilham Zein, the school’s student activities coordinator, suggested approving the application after reading it, on the condition that the application is “to share knowledge about encryption…rather than encourage students to invest in digital currency.”
“Why did Worldcoin initially target low-income communities instead of cryptocurrency enthusiasts or communities?”
However, the participants (including at least one person who was over 15 years old, which violated Worldcoin’s own terms of use) and our reporter’s firsthand observations told a different story. In the 45-minute meeting, Worldcoin staff were busy registering dozens of students, helping them download the app and register their email, and finally scanning their biometric features to provide information about cryptocurrency, Worldcoin itself, or guide them on how to give consent or revoke consent. (The students at least received the Worldcoin allotted to them, which is distributed weekly).
In recent recruit events held in about 20 villages in West Java, many new users like Iyus Ruswandi were attracted by the giveaways.
“This was held during the pandemic when the government usually distributes social assistance packages,” explained Ece Mulyana, the principal of an Islamic elementary school who was informed the night before that his school would be used as a Worldcoin registration site. “I couldn’t refuse this request,” Mulyana said, because the directive came from a higher-level official – Ade Irma, the street management officer who is helping coordinate village registrations for Worldcoin.
Mulyana said Irma paid 2,000 Indonesian rupiahs (approximately 14 cents at the time of writing) for each successful scan. Mulyana estimated that 170 people participated, totaling 340,000 Indonesian rupiahs (approximately $23.8).
Irma’s superior, Heni Mulyani, the street leader who approved these activities, said the money is used for “buying coffee and cigarettes,” a euphemism for payment to government officials to assist with the requested activities. She said the money paid was not used for rent, but added, “We assure you that this money does not come from village funds or budgets.”
Gunungguruh at night, one of about 20 villages visited by Worldcoin for recruitment events. (Photo by Muhammad Fadli)
On the contrary, the money comes from a company named PT Sandina Abadi Nusantara, co-founded by a person named Muhammad Reza Ichsan and his mother, who happens to be Worldcoin’s “best-performing operator” (according to a blog post published by Worldcoin). The company is the legal entity for Worldcoin’s activities in Indonesia; his mother’s job is to contact local government officials to coordinate recruitment events.
Ichsan told MIT Technology Review, “We don’t pay the villages, but we provide an operating fund for those who help us gather the public on-site.”
Even though Mulyani did not misuse village funds, according to Indonesia’s anti-corruption and anti-bribery law, these tips (with very few exceptions) are also illegal and both givers and receivers may face criminal penalties.
In response to questions about payments to village officials, Worldcoin representatives said they were unaware of this and called it an “isolated incident,” saying they have initiated an investigation to learn more. While they are unable to draw conclusions yet, Golovina wrote, “Most or all of these payments may be legitimate operating expenses, such as expenses required to conduct business in schools or other facilities, or fees for licenses or permits required to operate in certain places.” This contradicts the descriptions from officials and their operators.
Worldcoin also refers to other examples they provide us as “the independent and isolated work of local globe operators,” including the AirPod gifts in Sudan and the fraudulent behavior in Indonesian schools, adding that “we are fully focused on incentivizing operators to register active users who are excited about using Worldcoin.”
As for the villagers, they were not informed that at least some officials were receiving compensation to promote Worldcoin; in fact, as recalled by school principal Mulyana, many people thought the event was organized by the government. “We have to explain to them that this is not a government project,” he said, “Worldcoin is a foreign company and they need the assistance of village staff after they arrived.”
Now, some villagers doubt whether they will receive money because they were told that Worldcoin representatives would return to the village to distribute funds in late January 2022, which has already passed (note: this article was published in April 2022). For those who are proficient in digital technology, they have not seen the function of trading Worldcoin in their wallets.
Operational Blind Spots
Mixing and incorrect information may not necessarily be intentional. The globe operators we interviewed often mentioned that they received very little information from the Worldcoin representatives who recruited them, even though they were well aware that their compensation was tied to the number of registrations they completed. (Worldcoin states that it provides a code of conduct for its national-level globe operators, and secondary operators must also adhere to this code of conduct, and they are phasing out the practice of paying commissions based on the number of registrations.)
Bryan Mtembei is one such operator. He is a civil engineer who recently graduated from a university in Nakuru, the fourth largest city in Kenya. After being scanned on campus in September last year, he became a freelancer for Worldcoin.
He hoped to receive “short training or basic knowledge about Worldcoin.” Instead, the only instruction he received was “to get more people involved and earn more money for yourself,” he said, “the rest depends on my social marketing skills.”
Therefore, he did his best to answer questions from new users, the most common of which were about privacy: Mtembei estimated that about 40% of the people he contacted expressed concerns about sharing their biometric data.
When he initially expressed similar concerns, a representative assured him that all of his questions had been addressed in the Worldcoin “white paper”. But in reality, there was no such document. According to the company, this was done for design considerations – people are unlikely to read “lengthy, highly technical academic-style papers,” and their shorter blog posts can be considered as white papers.
In the end, Mtembei’s need for money overcame his concerns. He registered 150 to 200 people, earning a commission of 50 KS (Kenyan Shillings, equivalent to 44 cents) per scan.
Bryan Mtembei met a Worldcoin representative for the first time on a university campus in Nakuru, Kenya. He was scanned and later became an operator. (Photo by Brian Otieno)
Mtembei is not alone. Willis Okach, a university student in Nairobi, was recruited as an operator after being scanned, just like Mtembei. He joined for the money. “You don’t have it, and someone gives you some,” he explained, believing that Worldcoin “feels that students don’t have much money, so they would sign up.” In two days of work, Okach registered 50 people. For every group of biometric data they brought in, he earned 100KS (0.88 USD).
Worldcoin spokesperson Golovina said, “All users registered during the on-site testing period are fully informed of what data we will collect and how it will be used, and they are required to give their consent before registering. Any individual who consents to the collection and use of their biometric data can withdraw their consent at any time, and the data will be deleted.”
However, none of the interviewees were explicitly informed (or the operators did not inform others) that they were “test users.” Their facial photos and videos, as well as 3D body scans, were taken and used to train the “anti-fraud algorithm” of the sphere to “distinguish different people.” The way their data was processed differed from that of subsequent users, or they could request the deletion of their data.
Ángel Rodriguez, a subway security guard in Santiago, Chile, recalls selecting a checkbox in the Worldcoin App to agree to the terms of service, which were in English, even though he didn’t understand English. Furthermore, according to Worldcoin, the links to its App and data consent terms were not available until “the end of 2021,” by which time the on-site testing had already been underway for at least a year.
Occasionally, new users were asked to provide additional personal data, but Worldcoin claims they have never made such requests. Almost everyone we interviewed was asked to provide an email address to log into their wallet (even after Worldcoin introduced QR code login). Some people were also asked to provide a phone number.
Golovina denied in multiple email statements that registration requires an email or phone number, but “we do offer certain features for users who choose to provide a phone number or email address, such as the ability to send and receive Worldcoin. However, such things are always optional.” Worldcoin did not explain what users can do with their tokens if they are unable to send or receive them.
Meanwhile, in Nairobi, several students said that sphere operators took photos of their ID cards. According to Okach’s recollection, this was done to confirm that he was “not… a robot.” Worldcoin stated that they never asked users to provide national identification documents, only requiring sphere operators to do so.
When we shared these responses with the interviewees, they disagreed. Mtembei emphasized that personal information has never been optional, and without email and phone numbers, it is impossible to register on his sphere. “He is lying,” he said.
Mohammad Ahmed Abdalbagee is one of the four sphere operators employed by Worldcoin in Sudan. He added that it was his team’s efforts that convinced Worldcoin to add phone numbers as the preferred login method. “Before they operated in Sudan, they used email as the primary identifier, but we told them that it wouldn’t work in Sudan. Many university students don’t even have email addresses, and they register on social media using their phones,” he said.
Implicit Colonialism
Some scholars specializing in the relationship between the technology industry and countries in the southern hemisphere are concerned about Worldcoin’s behavior, but not surprised.
LianGuaiyal Arora, a digital anthropologist and author of “The Next Billion Users: Digital Life Beyond the West,” said, “It’s a race to see who can obtain the most data in this AI-driven economy.” She said that more stringent data protection laws in Europe and the United States mean that ambitious entrepreneurs in those regions cannot obtain the necessary training data from their own people, so they have to look to developing countries.
In fact, according to a blog post published by Worldcoin, the company is unable to operate in the United States and China due to regulatory restrictions. Bloomberg reported that for similar reasons, the company has also halted on-site testing in other countries, including Turkey and Sudan. However, Worldcoin has registered many American users in demonstrations held at cryptocurrency conferences, although the company does not consider its activities in the United States as on-site testing.
“Undertaking this data collection action in places with limited funding and weak legal protection is cheaper and easier.”
Pete Howson, Senior Lecturer at Northumbria University researching international development of cryptocurrencies, categorizes Worldcoin’s behavior as a form of crypto-colonialism, where “blockchain and cryptocurrency experiments are imposed on vulnerable communities because… these people cannot fight back,” he told MIT Technology Review in an email.
Howson explained that compared to other forms of digital colonialism, crypto-colonialism is more harmful because the core principle of blockchain, decentralization, means that “when problems arise… the responsibility is very limited.” “You often hear the term DYOR because these people don’t care much about rules and regulations.”
However, the inequality in information and internet access makes the spirit of “DYOR” almost impractical for many people in developing regions. Similarly, the vast economic disparity means that, for example, in Kenya, a promise of less than half a dollar can make people give up their biometric data, while in Norway or the United States, such a promise would not have much effect.
In short, conducting this data collection action in places where funds are scarce and legal protection is weak is cheaper and easier.
Data Errors and Policy Loopholes
Although most of Worldcoin’s field tests are conducted in developing countries, the company emphasizes that it is also active in developed countries, including several countries in Europe. The company told us: “Worldcoin has always been trying to conduct field tests in globally representative countries.”
This represents its own challenge. When collecting, controlling, and processing personal data of “data subjects” as defined by the European Union (i.e., anyone within the EU, including citizens, residents, and potential visitors whose data is collected), Worldcoin is bound by the EU’s GDPR.
GDPR was enacted in 2018 and requires data subjects to be fully informed about why their data is being collected, how the data will be used, who will process the data, where the data will be transferred, how to delete the data, and how to stop data processing. Failure to adequately protect data can result in fines of up to 4% of global revenue or €20 million, depending on the severity of the violation.
In addition, if companies outside of Europe collect or process personal data of European data subjects, GDPR also applies. Therefore, companies like Worldcoin, registered in Delaware and headquartered in San Francisco, may not necessarily be exempt.
However, this is exactly what Worldcoin mentioned in its data consent terms. Before submitting a questionnaire to MIT Technology Review, the company asks users to accept the following statement:
-
“We [Worldcoin] voluntarily comply with GDPR policies.”
-
“We have not yet adopted board-approved data privacy and security policies to describe the means and methods by which we plan to protect your data in accordance with the general standards of GDPR.”
-
“Our policies and procedures may not be sufficient to meet GDPR requirements.”
-
“If we fail to comply with regulations, it may be more difficult to protect your privacy rights in U.S. courts.”
Marietje Schaake, the International Policy Director of the Stanford University Cyber Policy Center and former Member of the European Parliament, reviewed the document and stated that this policy attempts to create “exceptions”. However, according to GDPR, there are no exceptions. Moreover, the fact that Worldcoin has a subsidiary in Germany already subjects it to GDPR.
“As an EU citizen, you have the right to challenge it,” Schaake said, referring to any potential violations. These challenges will be reviewed by European data protection authorities and ultimately debated in European courts, not in U.S. courts as Worldcoin claims.
Worldcoin stated that it fully complies with GDPR and is registered with the Bavarian Data Protection Authority. They have hired a data protection officer and have conducted a data privacy impact assessment, although they refuse to make the data protection officer or assessment results public. Worldcoin also added that the statements in their consent terms “previously included a lot of warnings…they no longer appear in the latest version of our data consent terms.” However, at the time of publication, this wording is still present online.
Aida Ponce del Castillo, a researcher at the European Union Institute for Trade, is responsible for studying the regulations of emerging technologies and also serves as the organization’s data protection officer. For her, the lack of transparency is unreasonable. “DPIA is not confidential business information,” she told MIT Technology Review. Although publication is not mandatory, she pointed out that the European Commission recommends that companies “consider publishing at least some content, such as summaries or conclusions.”
The Bavarian Data Protection Authority has not responded to MIT Technology Review’s request for an interview regarding the company’s registration.
“This is manipulation”
In addition to ethical issues, there are also practical problems, such as how well Worldcoin actually works.
For some test users and sphere operators, the answer is not good at all.
Sometimes, this is due to issues with the sphere. In Sudan, local iris recognition operator Abdalbargee said that the iris recognition device requires up to 6 attempts to recognize a person’s face. “In fact, my friend spent a whole week before the device recognized his iris,” he added.
The sphere is also prone to malfunctions, which slows down the recruitment process, and repairs need to be done in Germany. When Buzzfeed News found similar sphere malfunctions in a recent investigation, Worldcoin used the same statement it had repeated to us: calling a particularly serious case “an isolated anomaly.”
Meanwhile, during the upgrade process from web wallet to app wallet, some users lost their entire accounts or all their tokens. For others, the app has been found to have flaws that drain battery life or trap them in a vicious cycle of loading and reloading.
Rodriguez, the Chilean metro security guard mentioned earlier, has been struggling with his wallet issues shortly after being scanned. After registering in February, the app asked him to enter his email, phone number, and use a QR code, but the app caused performance issues on his phone, so he uninstalled it completely. When he tried to download the app again, he found that his username no longer existed.
The local sphere operator told him that to resolve this issue, he had to find the sphere and rescan his biometric data. But if Worldcoin is as it claims, rescanning will only match his iris with the existing iris hash. In other words, once the account is lost, it cannot be recovered, which Worldcoin later confirmed.
There are also cases of identity fraud that the sphere cannot detect. In mid-2021, an Indonesian businessman was able to register and access the wallets of over 200 users who had already completed scanning and identity verification, and transferred assets that were stored in the form of Bitcoin at the time. Worldcoin stated that this occurred in cases where users accessed the wallet through the web interface rather than the app in the early stages, and “since the upgrade… we have not encountered similar fraudulent behavior.”
Meanwhile, those who were concerned that the whole thing might be a scam wondered what they had lost. “50 KS is not enough to attract attention,” said Okach, a university student in Nairobi who spent a weekend recruiting others to join Worldcoin. “It’s manipulation, using students without clearly stating what they are doing or what they want.”
Forgetting Early Users
When we started reporting on this story, we noticed that three out of the five countries initially cited as successful case studies for on-the-ground testing—Indonesia, Sudan, and Kenya—are classified by the World Bank as low-income or lower-middle-income countries. Power and economic disparities seemed ethically concerning, so we started digging.
We wanted to know: What does it feel like to be an early user of this global crypto experiment? Do participants actually understand cryptocurrency, Worldcoin, and the consequences of surrendering biometric data? Or were they told anything? Did they provide informed consent—what does informed consent even mean in this case? Finally, many of our interviewees raised the same question—what is the real purpose of iris scanning?
From left to right: Sadili, Solihin (community leader), and Eli, neighbors of Ruswandi, are among the 170 villagers being scanned.
Finally, it was a comment made by Blania during an interview in early March that started to shed light on Worldcoin.
He said in response to strong questions about privacy in the fall of 2021, “Before we actually deploy the system on a large scale, we will have privacy experts dissect the system over and over again.”
Blania had just shared how his company got 450,000 people to join Worldcoin, meaning its orb scanned 450,000 sets of eyes, faces, and bodies, storing all the data to train its neural network. The company recognized the problems with this data collection and planned to stop doing it. However, they did not provide the same privacy protection to these early users.
We were perplexed by this seemingly contradictory phenomenon: Are we lacking foresight and a broader perspective? After all, compared to the company’s stated goal of 1 billion registered users, 450,000 might still be small.
But each of these 450,000 people is an individual with their own hopes, lives, and rights, all of which have nothing to do with the ambitions of a Silicon Valley startup.
The conversation with Blania clarified something that we have always struggled to understand: how can a company be so enthusiastic about discussing its privacy protection agreement while blatantly violating the privacy of so many people?
Through our interviews, we discovered that for Worldcoin, these numerous test users are not their ultimate target users to a large extent. Instead, their eyes, bodies, and lifestyles are merely raw materials for the Worldcoin neural network. At the same time, they only need to pay a small amount of money to the lower-level sphere operators to feed their algorithms, while these operators often struggle with their moral concerns in private. Ironically, for those who have made efforts to teach Worldcoin’s AI to recognize who or what is human, this project is so inhumane.
When we submitted the 7-page report of our investigation results and questions to Worldcoin, the company’s response was that almost all of the negative issues we discovered were “isolated incidents” and ultimately inconsequential because the next (public) iteration will be better. The company wrote, “We believe that privacy rights and anonymity are crucial, which is why in the next few weeks, everyone who registers with Worldcoin will be able to do so without sharing any biometric data with us.” The fact that nearly 500,000 people have already undergone testing seems to be irrelevant.
What truly matters, however, is the outcome: Worldcoin will have a significant number of users to support its sales pitch as the preferred identity solution for Web3. And when the real, monetizable products—whether it’s the sphere, Web3 passports, the currency itself, or all of the above—are launched to their target users, everything will be ready without any artificial signs or human organs in the background.
Like what you're reading? Subscribe to our top stories.
We will continue to update Gambling Chain; if you have any questions or suggestions, please contact us!
