Worldcoin’s Shady History and Data Collection Practices: MIT Technology Review

Worldcoin has been courting users with a plan as ambitious as it is controversial and was recently launched on July 24, 2023. Built on the promise of an equitably distributed, collectively owned digital currency, the company aims to amass a billion users by leveraging an unusual sign-up mechanism: iris scans.

Unearthed by ZachXBT on Twitter and citing an MIT Technology Review from 2022, they stated that the most unsettling part is “how the WorldCoin team has boasted about how many users they have. When in reality they have been exploiting people in developing countries.”

2/6 Most alarming to me is how the WorldCoin team has boasted about how many users they have.

When in reality they have been exploiting people in developing countries.https://t.co/8pc84CQyVc pic.twitter.com/b9smMB4yqa

— ZachXBT (@zachxbt) July 24, 2023

In 2022, MIT investigated how Worldcoin was able to amass as many iris scans as it could. Reporting that Worldcoin promised that “biometric information remains on the orb and is deleted once uploaded—or at least it will be one day” and $15 of Worldcoin, the research questioned just why Worldcoin targeted the Global South instead of crypto enthusiasts — those who have been even scanning their irises for content.

“In villages across West Java, Indonesia […] Worldcoin representatives were showing up for a day or two and collecting biometric data. In return they were known to offer everything from free cash (often local currency as well as Worldcoin tokens) to Airpods to promises of future wealth.”

Worldcoin’s strategy centers around a proprietary device called the “chrome orb,” designed to scan user irises, preventing fraudulent multiple accounts. This ‘biometric uniqueness’ is transformed into an “IrisHash,” a distinct identifier that the company claims is stored locally and never shared.

MIT interviewed a man named Iyus Ruswandi from Indonesia, asking him about his experience with Worldcoin. He stated that “neither the company representatives on site nor the village officials could answer even basic questions about Worldcoin.” Thinking it was a scam, he told researchers that he thought it was “a mass data collection effort disguised as some kind of secret, offline airdrop.”

And, while internet literacy was limited to a pre-installed Facebook application on people’s cell phones:

“Worldcoin representatives ‘first had to help many residents in setting up emails [and] logging in to the web,’ Ruswandi recalled. If it was about attracting users to a new cryptocurrency, he wondered, ‘why did Worldcoin target lower-income communities in the first place, instead of crypto enthusiasts or communities?’”

While Worldcoin promises privacy protection, MIT stated that they found that there was a lack of informed consent — but a lot of deceptive marketing and extraneous personal data collecting — when it came to signing up for Worldcoin.

Meanwhile, US-based users are not even allowed to participate in the airdrop due to privacy laws. The majority of the countries where people interviewed originated from — Indonesia, Kenya, Sudan, Ghana, Chile and Norway — do not have as stringent privacy and investor protection laws as countries in Europe or the United States do, for example:

“Simply put, it’s just cheaper and easier to run this kind of data collection operation in places where people have little money and few legal protections.”

Security experts, including Edward Snowden, have expressed concerns in 2022 about Worldcoin’s iris scanning process and the potential misuse of a global iris database.

This looks like it produces a global (hash) database of people’s iris scans (for “fairness”), and waves away the implications by saying “we deleted the scans!”

Yeah, but you save the *hashes* produced by the scans. Hashes that match *future* scans.

Don’t catalogue eyeballs. https://t.co/uAk0NYGeZu

— Edward Snowden (@Snowden) October 23, 2021

“The human body is not a ticket-punch,” Snowden further tweeted.

Despite professing fairness in currency distribution, the company’s commitment is under question due to an early allocation of 20% of coins to Worldcoin’s full-time employees and investors (one being a16z), respectively.

Meanwhile, critics point out that this allocation contradicts the very ethos of the company’s stated intentions:

“Creating one identity across Web3 was anathema to a movement that had turned to blockchain, decentralized finance, and DAOs for the express purpose of not being known.”

Worldcoin’s user recruitment strategy, involving independent contractors or “orb operators,” and the company’s shaky technical infrastructure have also come under fire. Instances of users seemingly losing access to their accounts and the uncertain value of Worldcoin tokens pre-launch add to growing concerns about the venture’s transparency and viability, MIT reported.

Even as the company dismisses these findings as “isolated incidents,” the question remains: Are Worldcoin’s revolutionary aspirations for financial inclusion capable of withstanding the critical security and privacy concerns surfacing in the wake of its bold endeavor?