Sam Altman’s Worldcoin Promised Them Free Crypto For An Eyeball Scan. Now They Feel Robbed.

Blania described a futuristic world awash in Orbs of varying shapes and sizes, where each person would be assigned a unique and anonymized code linked to their iris that they could use to log in to a host of web and blockchain-based applications.

Blania did not rule out the possibility that Worldcoin would charge a fee for providing this service, but the startup primarily plans to make money through the appreciation of its currency. “You distribute a token to as many people as you can,” Blania said. Because of that, the “utility of the token increases dramatically” and the “price of the token increases.”

Key to all of this technology is the Orb itself, and the contract that Orb operators sign underlines the company’s focus on stress-testing it. “Your role is to help us evaluate the Orbs and how people interact with them,” the contract says. “You should think of yourself as a product tester.”

Blania told BuzzFeed News that the company was primarily using its field tests to see how the Orbs performed in different environments — from Kenya’s heat to Norway’s freezing cold. “In Kenya where there was like, 40-degree heat, and just the reflection on the Orb is something we have never seen here in Germany in the office,” Blania said.

Adam Schwartz, a senior staff attorney for the Electronic Frontier Foundation, said the ambiguity about Worldcoin’s goals is troublesome. “The question is, is this a digital currency company, or is this a data broker?” he said. “Either way, the practice at hand, which is paying people for their biometrics, is very problematic to privacy and to equity.”

“Worldcoin is not a data company and our business model does not involve exploiting or selling personal user data. Worldcoin is only interested in a user’s uniqueness — i.e., that they have not signed up for Worldcoin before — not their identity,” Worldcoin said in a statement.

The company’s efforts to build its database could also run afoul of data privacy and processing laws in Kenya, where the company has extensive operations. Kenya recently passed a data protection law that forbids companies from transferring biometric data abroad without approval from the newly constituted Office of the Data Protection Commissioner. Worldcoin currently processes user data in the US, UK, Germany, Japan, and India, according to its data consent form.

Immaculate Kassait, Kenya’s data commissioner, told BuzzFeed News that her office “was not aware” that Worldcoin was collecting the biometric data of Kenyans and transferring it abroad.

The company has until July 14 to register itself with the commission and submit a detailed Data Protection Impact Assessment under Kenya’s newly implemented data privacy laws, Kassait said over email. Worldcoin told BuzzFeed News that the company would soon engage with Kenya’s Data Commission and had already conducted a “rigorous” privacy impact assessment.

Bryan Ford, who heads the Decentralized/Distributed Systems (DEDIS) lab at the Swiss Federal Institute of Technology and wrote one of the pioneering papers on proof of personhood in 2008, said solving the authentication problem in a way that preserves user privacy would be a significant advance. Ford, however, isn’t convinced by Worldcoin’s solution. The company’s decision to build and store a giant, centralized database of irises and iris-hashes, he said, is a massive invasion of user privacy.

“We dispute the characterization that collecting images of Worldcoin users is an invasion of privacy: If collecting images of people with their consent was an invasion of privacy, CLEAR” — the biometrics identification company — “the UN and Aadhaar would all be examples of invasions of privacy too,” Worldcoin said in a statement to BuzzFeed News.

Privacy advocates and security experts in India have long characterized Aadhaar, India’s massive biometric identification system, as a privacy nightmare. Experts also dispute whether Worldcoin has done enough to ensure that it has obtained informed consent from people, given that the company’s extensive terms and conditions, privacy policy, and data consent forms are in English.

“Informed consent means that you are in a position to fully understand what is going on,” said Elias Okwara, Africa policy manager for the advocacy group Access Now, noting that a majority of Kenya’s population speaks Kiswahili. “So right off the bat, it becomes difficult to be able to explain to an individual what the data processing means.”

Worldcoin said it would soon roll out its privacy form in six languages and suggested that the Orb operators were live-translating and explaining the company’s voluminous policies to people who do not speak English. “In all these local countries, we have Orb operators, and their whole purpose and role is to explain to people what they consent to in their local languages,” the company said.

Any large biometric database is also susceptible to hacking, Ford said, explaining that the database could be compromised if someone hacks into the thousands of Orbs that the company plans on distributing. “Basically no hardware is reliably unhackable,” Ford said.

Blania conceded that “there has never been an uncracked hardware device” but said that Worldcoin was building fraud-detection mechanisms to identify compromised Orbs.