Worldcoin suspended in Kenya after iris scan drive

The rollout of US cryptocurrency Worldcoin has been suspended in Kenya after the company commenced a mass drive to sign up customers by scanning their irises as part of its global launch.

The Kenyan government’s move presents a setback in the global launch of the product and puts the spotlight on issues such as the harvesting of personal data by tech companies in less developed countries and claims that cryptocurrencies can reduce inequality in global wealth distribution.

Why iris scans?

Worldcoin is a company whose products include the synonymous cryptocurrency, which was launched worldwide on 24 July. It has been developed by San Franciso-based technology company Tools for Humanity (TFH), co-founded by US tech entrepreneurs Sam Altman, Max Novendstern and Alex Blania.

Worldcoin claims that its cryptocurrency “will be distributed fairly to as many people as possible” and has said that it would launch by giving “a free share to everyone on Earth”.

Co-founder Altman, who is also CEO of OpenAI, developers of ChatGPT, believes it will become increasingly challenging to distinguish humans from machines, as the current-day problem of bots mimicking humans online is made worse by sophisticated AI fakes.

The company says that iris scans are a way to ensure everyone represented in its network is a real person and only controls one identity in the system – known as “proof of personhood”. The scans are performed using a proprietary device known as an “Orb”.

Since its creation in 2019, the company has argued that its system is designed to protect individual privacy, with no identification apart from the iris scan needed to access services such as its World App wallet. The company says the scan is deleted after an iris code has been created.

“Once established, it gives the individual the ability to assert they are a real person and different from another real person, without having to reveal their real-world identity,” says a company whitepaper.

Taking the scan enables users to claim their share of Worldcoin tokens and to use Worldcoin’s other services. Those who receive the tokens have the option to sell them for USDT (a stablecoin pegged to the US dollar) on crypto exchanges or to “brokers” in exchange for cash.

Criticisms of business model

“They are using one of the oldest tricks of the tech industry: provide people with seemingly ‘free’ products in order to extract data from them, create a need and, ultimately, dominate a particular section of the market,” says Toussaint Nothias, a senior research scholar at Stanford University’s Digital Civil Society Lab. 

“All these initiatives marketed ‘for free’ come at a hefty cost. There are privacy risks, there are speculation risks and there are legitimacy risks,” he says. “Between its aggressive marketing tactics, scaling up VC culture, and dystopian crypto-hype rhetoric, Worldcoin does not inspire confidence.”

Last year, while Worldcoin was running field testing in 24 countries, including Sudan and Kenya, an investigation by journalists at the MIT Technology Review found that “the company’s representatives used deceptive marketing practices, collected more personal data than it acknowledged, and failed to obtain meaningful informed consent.”

“These practices may violate the European Union’s General Data Protection Regulations (GDPR) – a likelihood that the company’s own data consent policy acknowledged and asked users to accept – as well as local laws,” says the report.

In a video interview with the investigators, Blania acknowledged that there had been some “friction” but put it down to the fact the company was in a startup phase.

“It’s a few people trying to make something work,” he told them.

On 24 July, Worldcoin announced its global launch, with Nairobi chosen as one of two locations for the rollout in Africa.

According to the company’s website, Orb operators – who are commissioned by Worldcoin to conduct the scanning and provide remuneration – were present in 18 venues across Nairobi before they had to converge on the Kenyatta International Convention Centre when tens of thousands of Kenyans showed up.

However, in a joint statement issued on 3 August Kenya’s Ministry of the Interior and Ministry of Information said that the Kenyan government had suspended Worldcoin’s activities in the country and that investigations had been launched “to establish the authenticity and legality of the aforesaid activities, the safety and protection of the data being harvested, and how the harvesters intend to use the data.” 

The statement noted it had been reported that customers had been offered tokens worth around 7000Ksh ($49) for the scans.

It said that Worldcoin was registered as a “data controller” entity, but that such certification does not endorse its compliance with Kenya’s Data Protection Act – a law passed in 2019 and based on the framework of the EU’s GDPR.

The statement insisted that Worldcoin was not registered as a local entity in Kenya and had used a local firm to carry out the activities. It said that Worldcoin had initially been suspended in May 2022 for 60 days pending investigations and that, after a spot check, the Office of the Data Protection Commissioner (ODPC) had contacted the firm in late May 2023 ordering the immediate cessation of processing of sensitive data. 

‘Temporary pause’

In a statement, the Worldcoin Foundation said that a temporary pause in the Nairobi verification services had been enacted “out of an abundance of caution and in an effort to mitigate crowd volume” after tens of thousands waited for over two days.  

“During the pause, the team will develop and onboarding program that encompasses more robust crowd control measures and work with local officials to increase understanding of the privacy measures and commitments Worldcoin implements, not only in Kenya, but everywhere,” said the statement.

The company says it is committed to resuming its services in Kenya and working closely with local regulators. 

In a tweet, co-founder Blania said that “TFH has paused World ID verifications in Kenya as we continue to work with local regulators to address their questions. We apologize to everyone in Kenya for the delay. World ID is built for privacy.” 

Ministry stresses need for awareness

The statement by the two Kenyan ministries said that there was a need to sensitise “Kenyans on the risk of cybersecurity attacks, data breaches, and the need for full disclosure before giving consent.”

It said that the ODPC had not lifted its suspension of the processing of personal data by Worldcoin and had “raised concerns on whether the consent sought from individuals was voluntary or illusory. In this regard, the Office noted that persons are requested to give consent on a monetary incentive provided for the exchange of sensitive personal data.”

To keep up with the latest in African tech, subscribe to Tech54

Our Tech54 newsletter delivers an incisive look at the continent’s tech scene every fortnight. Subscribe here.