Kenya Concerns About Worldcoin Data: WHAT Data?

Biometric Update linked to an AFP article (via Africanews) that referenced a statement by the Ministry of the Interior Cabinet Secretary Kithure Kindiki, portions of which were quoted by Citizen Digital.

“Relevant security, financial services and data protection agencies have commenced inquiries and investigations to establish the authenticity and legality of the aforesaid activities, the safety and protection of the data being harvested, and how the harvesters intend to use the data,” read part of the statement.

“Further, it will be critical that assurances of public safety and the integrity of the financial transactions involving such a large number of citizens be satisfactorily provided upfront.”

From https://www.citizen.digital/news/government-suspends-activities-of-worldcoin-citing-safety-concerns-n324708

The big brouhaha has occurred because Worldcoin is using a device called the Orb to collect images of people’s irises.

And Worldcoin is also collecting…

…well, nothing else.

And even the iris image data that Worldcoin DOES collect isn’t retained unless people request it.

Since no two people have the same iris pattern and these patterns are very hard to fake, the Orb can accurately tell you apart from everyone else without having to collect any other information about you — not even your name.

Importantly, the images of you and your iris pattern are permanently deleted as soon as you have signed up, unless you opt in to Data Custody to reduce the number of times you may need to go back to an Orb. Either way, the images are not connected to your Worldcoin tokens, transactions, or World ID.

From https://worldcoin.org/privacy

Ah, but Worldcoin does retain…an iris code. A lot of good THAT’S gonna do a scammer.

Your biometric data is first processed locally on the Orb and then permanently deleted. The only data that remains is your iris code. This iris code is a set of numbers generated by the Orb and is not linked to your wallet or any of your personal information. As a result, it really tells us — and everyone else — nothing about you. All it does is stop you from being able to sign up again.

Since you are not required to provide personal information like your name, email address, physical address or phone number, this means that you can easily sign up without us ever knowing anything about you.

From https://worldcoin.org/privacy

And no, you cannot reverse engineer an iris image from the iris code. In fact, you can’t reverse engineer any biometric image from its biometric template.

And even if you could reverse engineer an iris image, what are you going to do with it? You don’t know who owns it. It probably doesn’t belong to Bill Gates. It probably belongs to an impoverished Kenyan. (Good luck getting that person’s US$2.00. Which they probably already sold.)

Because—and here’s the thing that people forget about Worldcoin—”Worldcoin’s World ID emphasizes privacy so much that it does not conclusively prove a person’s identity (it only proves a person’s uniqueness).” (Link)

So how are governments and companies supposed to use Worldcoin?

Companies could pay Worldcoin to use its digital identity system, for example if a coffee shop wants to give everyone one free coffee, then Worldcoin’s technology could be used to ensure that people do not claim more than one coffee without the shop needing to gather personal data, Macieira said.

From https://www.reuters.com/technology/worldcoin-says-will-allow-companies-governments-use-its-id-system-2023-08-02/

Yup, that’s the use case. To allow 8 billion people to each claim one cup of coffee.

• Not just the people who are members of the coffee company’s rewards club.
• Not just the people who have purchased a certain amount of coffee.
• Not just the people in the United States and Colombia.

Worldcoin can’t do those things, because even Worldcoin doesn’t know anything about its users.

Which means, by the way, that the World ID can’t be used in elections or national/state government welfare benefits distribution.

• Sure it can be used to prove that someone hasn’t voted twice, or received benefits under two different names.
• But it has no way of knowing whether the individual is qualified to vote or receive benefits. Maybe the person doesn’t live in the local jurisdiction. For voting, maybe the person lives there but is not a citizen. For benefits, maybe the person has too much income to qualify. Worldcoin doesn’t have a clue if any of these things are true.

So apparently the Kenyan authorities are worried that Worldcoin is gathering too much data.

I’m worried that Worldcoin is gathering not enough data for most practical use cases.

Well, unless you want to buy the world a Coke.