Great chewing the fat with @Discovering Bitcoin 🔶👀. We wandered off piste a few times!

Super fun, thanks for having me.

KYC is framed as protection, but when identity data is required to use a service, the information collected for safety can later be used for extortion.

One of the points I made, quoted in Cointelegraph was:

“We need to stop treating identity verification and surrendering your identity as though they are the same thing.”

Revolut released identity files after requests were sent from a legitimate Italian law enforcement address. The piece looks at:

- what went wrong
- why collecting documents is not the same as proving a fact
- how we can verify without storing so much personal data

Efrat Fenigson of You're The Voice warns: “When regulators keep mandating a model that guarantees this outcome, while the technology to verify without storing already exists, it raises a red flag.”

Lyudmyla Kozlovska of the Open Dialogue Foundation highlights another weakness: “EU AML law imposes no verification duty on the bank and provides no meaningful mechanism to check who is really behind an authenticated state request.”

Evin McMullen of Billions Network sums up the wider problem: “This is a governance and standards problem wearing a technology costume. You cannot lose what you never held.”

This is a really important piece from Christina Comben, bringing together the risks around how identity data is collected, stored and shared and the possible alternatives that already exist.

Read the full article here:

https://cointelegraph.com/magazine/revolut-id-thefts-highlight-kycs-dangers-heres-how-to-fix-it

@Efrat Fenigson @Lyudmyla Kozlovska @Bitcoin Policy UK

The government said national digital ID was cancelled in July. The work around GOV.UK Wallet, digital driving licences and One Login carried on.

GOV.UK Wallet is still live, the Veteran Card is already digital and the driving licence is next. The government’s own technical documentation was updated again on 1 and 3 September, including work on issuing and revoking test digital driving licences.

One Login is still growing as the gateway into government services, with more than 23 million users. This week, licensed premises in England and Wales can also accept certified digital proof of age for alcohol sales.

What was taken off the table was the politically visible product. The systems for issuing, storing and checking digital credentials kept developing.

Some of the government’s data incidents:

- Electoral Commission: around 40 million people affected by a cyber breach.
- MoD: data linked to more than 18,500 Afghan applicants exposed.
- PSNI: details of 9,483 officers and staff published online.
- HMRC: stolen identity data used to reach about 100,000 online tax accounts.

If more of our official documents and identity credentials are going into reusable digital systems, I want to know:

- who can request them?
- what is recorded?
- when they are used?
- how is it stored?
- who has access?
- how long that information is kept?
- whether people who refuse the digital route will still have an equivalent way to access the service?

The public was told “digital ID cancelled”. The government’s own development record shows the digital identity work carried on.

The technical documents for GOV.UK Wallet, including the September updates on digital driving licences, are here:

https://docs.wallet.service.gov.uk/

Today England and Wales put digital ID on the bar.

Licensed premises can now accept certified digital proof of age for alcohol, allowing someone to confirm they are over 18 through an app rather than handing over a passport or driving licence.

The government says the venue does not need to see details such as your name or address, with services including Yoti and Post Office EasyID operating under the UK digital verification trust framework.

This is separate from the digital driving licence and GOV.UK Wallet.

That sounds privacy friendly at the point of sale because the pub only sees the proof. The identity provider behind the app is still responsible for verifying and handling the underlying data, which is where the privacy and security questions sit.

Digital identity becomes normal when it gets built into everyday life, one convenience at a time.

The more we rely on that infrastructure, the harder it becomes to question how far it should go.

That debate needs to happen before convenience becomes dependency.

Press release:

https://www.gov.uk/government/news/new-rules-pave-the-way-for-businesses-to-adopt-digital-proof-of-age-for-alcohol-sales

BBC article:

https://www.bbc.co.uk/news/articles/cm4gl6j53w19o

KYC requirements keep expanding while the systems holding our personal data repeatedly fail to protect it.

A few recent incidents:

- Revolut: ID and account histories sent after fake official requests.
- Swiss Bitcoin Pay: emails, IBANs and transaction data accessed
- Pocket Bitcoin: data on 5,411 people exposed
- SafePal: almost 40,000 customers affected

Global context:

- 43% of UK businesses hit by a cyber breach or attack last year.
- Average data breach cost: $4.44m globally
- FATF effectiveness scores ~28% globally

The policy response remains more KYC, more collection and more sharing.

We are building ever-larger stores of identity and financial data without clear evidence that this level of surveillance is delivering proportionate results, while the systems holding that data continue to fail.

You can check whether your data has been caught up in a breach at Have I Been Pwned:

haveibeenpwned.com

We should be careful about expanding surveillance in the name of safety. Decades of extra data collection have not eliminated financial crime.

With Bitcoin, 'more data' can mean permanently linking people to visible stores of value on a public ledger.

That is a different risk from banking, and it is hard to unwind once it is done.

Bitcoin has an access problem in policymaking.

Well funded tech, financial and crypto firms often have the easiest access to policymakers, giving them disproportionate influence over the rules.

Those are the same rooms where the rules are being written.

Bitcoin is still being regulated as part of a cryptoasset regime built around “same risk, same regulatory outcome”, despite having very different characteristics from much of the sector.

I spoke to CK about what I’ve seen working in UK policy, political influence, digital ID and CBDCs.

Treating Bitcoin like “crypto” could be one of the biggest policy mistakes we make as a country.

Bitcoin, freedom, privacy, power…

... and yes, that’s a box under my feet again.