Identity, Immutability, and the Irreversible Brittle Society | Will Scott (October 2025)

So, uh, thank you for that and also for the actual event, too. I'm going to do two things because I only got 10 minutes here. I'm going to quickly talk about the digital identity side of things and then I'm going to like do what I did at the event and slightly hijack it um, and talk a little bit about some other stuff that's related to digital identity. But firstly, yeah, there was a major track at um as Will just said the the at the cipher punk retreat um around digital identity. Uh and in I was there just to quickly introduce myself.

Uh I run a small research organization um which is currently uh under attack. Talk a little bit more about that too. Um and as the head of research at the World Ethical Data Foundation, it was like the dual role that I was there. Um and what we found is that when the sessions were came up, there was a really clean um thread of digital identity looking at things from threat modeling perspectives, uh looking at new approaches to everything from zero knowledge to um uh interfacing with states, uh self c like self-custody, things like that. And what was this is being filtered through the lens of what I do.

Um what was clear about that was that there was a lot of people who for the first time had consensus about identity being uh difficult from a perspective of that the threat model had changed. The situation had changed in the world and as a result of that digital identity which is kind of the cornerstone of a lot of digital systems um has reached a point where we need to rethink that very clearly. This again was just set on the stage here as well. And so there was a lot of discussion about the the scope of that uh but not as much discussion on solutions straight up. There a lot of people there producing really great work uh and having maybe bits of pieces of the puzzles but nothing quite uh cohesive in one big block.

And I kind of want to sort of breeze into that a little bit and talk a little bit about what I mean here when I say like the irreversible brittle society because I feel like um there was this nice convergence uh between the work that I'm doing right now and the the overall work that was happening in in the discussions in the identity space. So as I said before I run a research organization named New Design Congress and they just launched a small R&D lab called Paral Limited. That's my LinkedIn. Um, but there's another QR code coming up in a second that's much more interesting. And the um, when I was there, one of the big points of discussion was this report that's coming out pretty soon um, that we worked on at New Design Congress over the last four years called the digital identity event horizon, which is a 4-year red team analysis of digital ID systems um, that show how digital ID systems create riddeness, exploitation, and enable abuse.

Um it's a really it's an absolute banger of a document. It has um 678 references. Um unprecedented access to 45 expert participants for military intelligence, cyber security, policy, law enforcement, executive leaderships and tech, including people working in um electoral systems. And it also has eight case studies looking at different digital identity systems from around the world. Um both emerging ones and existing ones.

Um, and it does this through the lens that digital identity creates brittle society because no digital identity defends against social engineering. What that means is that there's a separation logically between uh the authentication of a person and the human cognition of understanding the that someone is who they say they are in the system. We're always, no matter what, whenever we have a digital system that has identity, we're always only looking at a representation of them, not then themselves. And so because of that, and because of the increasing sort of hostile data analytics and things like that, what we see are uh sophisticated attacks now that don't require any kind of technical ability, just your mom's credit card and some compute and you can do some really crazy things. Um, for example, what started historically as just like, you know, a social engineering attack would be let's take a email address and change one like an L in an email address to a one and then email someone and pretend to be somebody else.

It's a basic example of social engineering, but that worked so well. It's one of the reasons why email has even though it's a federated system consolidated into a handful of providers because the trust that we required to have um these systems could be easily defeated by simply um pretending to be someone else in the in the subject line or from the sender line. And so things have gotten substantially more sophisticated uh since then. And in the report we detail how biometrics, crypto, zero knowledge, all of these different systems um uh get close to solving for this but never quite make it. And so as a result of that, we are stuck in that situation.

Um and so what I wanted to just quickly do, we only got 10 minutes. I'm probably already over. I wanted to just quickly read, not read, but I'm going to just jump over this from the report. So in the report around about finding four which talks about how um emerging technologies um are not examined very well such as biometrics and things like that and they lead to entrenchment before we get to uh really evaluate their their potential consequences. Um and this is specific to some of the discussion that was had at the event.

We talk about how in the run-up to U Na Ball's 2019 electoral victory in El Salvador that there were a number of crypto maximist maximalists who um campaigned for Bali and um in Bitcoin and actually raised a lot of funds. Um and then after that Tether moved their um their headquarters to El Salvador and raised a lot of money um uh by basically opening up its reserves. And then there was a uh $1 billion bond issue that would be converted into Bitcoin for the state's treasury and bypass the IMF. Um and as a result of that, within three months of the Tether deal, Belell passed the Bitcoin law. Some of you know about this already.

Um which made cryptocurrency legal tender and for brief for a brief period of time mandated that every adult needed to enroll in a biometric cryptocurrency wallet called Chro, which then promptly leaked all of its user data. And this is a screenshot from a dark web forum um with 144 GB of personal data including uh highdeition head shot and personal information names, birth dates, addresses and identity numbers for more than 5.1 million Salvadorans. And that is digital identity in a nutshell. But this gets more sinister because simultaneously while they were raising money, they're also building the CCO met mega prison.

They started it in 2022 as this terrorism confinement center which is eight concrete blocks where cells designed for more than 100 inmates have 80 bunks, minimal ventilation and two toilets. At capacity each princip only has 0.6 m of space in the two years since its opening. Human rights groups have tracked mounting mounting debts. 2024 uh Christosio report states at least 265 detainees have died in it.

And of course, as we know, this is where the Trump administration, which has direct connections to the people involved in El Salvador's um Belell rise of Belle, um immediately started shipping um people with legal status to this prison uh in 2025. So what we have is an example of one of unfortunately the most successful web 3 projects that leverages digital identity to produce this system of a cryptocareral pipeline that um takes the promise of crypto's libertarian um future and then translated it into like a hard policy for authoritarianism. And so the pro the the problem here is that that is the the baseline I think that the the digital identity track um really operated under as as well as a a lot of concern around the European equivalent such as IDAS 2.0. Um and so if I just drop this out now don't save.

Okay. So this is kind of the takeaway. Um the most successful web 3 project built a cryptocarero pipeline using mandatory biometric identity um and and um blockchains. And this is what happens when technical execution outpaces political and privacy analysis. Um and this is something that you know has been coming for a while um and exists like even within the state where people begin to crystallize this kind of threat and the fact that things have changed quite dramatically in the world for us.

So if we want different outcomes and different legacies for web 3, personally I think that like I'm not too happy that that's the most successful sort of political project at this point in time in web 3. Um arguably um we must both understand what went wrong um that something so perverse is able to um is able to exist within this uh this community, this space, this um this promise of this technology. And then we need to design security architecture and uh defensive postures, red team the hell out of this stuff to prevent this political weaponization of web 3 entirely. Um and that was generally the underlying um uh consensus I think of the uh identity track was that it was incredibly interesting and also incredibly frustrating because what we walked away with were no solutions but at least a um shared understanding that the problem is extremely serious in 2025. Thank you so much.

And that is the report there. Oh, I didn't mention as well, the reason why I'm giving you a um a QR code uh is because uh we got a cease and desist about the report in August. So, it's a not a legitimate cease and desist, but someone doesn't like it very much. So, it's not the cease and desist doesn't say we can't it says we can't publish. Doesn't say we can't share it.

Sorry, I'm sharing it.