Joshua Stylman via Substack,
A friend and I got into it recently. He’s smart, freedom-minded, and totally gets the danger of Central Bank Digital Currencies (CBDC).
Expiring money, programmable control, carbon budgets - he sees most of
the expanding tyranny clearly. And yet he dismisses Digital ID as a
distraction. When I try to make the case that digital ID is the gateway to the gulag in the metaverse, he demands I name ONE thing Digital ID gives the government that they can’t already do.

My answer: it enables CBDC.
Of
course, governments have already encroached on our privacy and freedoms
in ways our forefathers couldn’t have imagined. But even with the
creeping surveillance state, the government can’t fully implement
programmable currency without authenticated identity on every
transaction. They’re components of the same beast. Digital ID is the
authentication layer while CBDC is the currency that runs on top of it.
Stop Digital ID and you prevent CBDC from being built at any scale that matters.
The institutions driving this, the usual suspects including the Bank of International Settlements (BIS) and the United Nations,
are quite explicit about their intentions. Their own documentation
spells it out: digital identity is a requirement for centralized digital
currency. And in case the documents aren’t clear enough, Agustín
Carstens, the former GM of the BIS couldn’t have been more explicit
about their goals:
“A key difference with the CBDC is
that central banks will have absolute control on the rules and
regulations that will determine the use of that expression of central
bank liability, and also we will have the technology to enforce that.”
Perhaps we should take these institutions at their word?
When Enforcement Goes on Autopilot
What
my friend is missing isn’t really about capability. The game has never
been about what the government can do. It’s about the cost of doing it.
Right
now, controlling what you buy, where you go, what you read - all of
that requires boots on the ground. Investigations, warrants, real people
making decisions. The friction is the protection.
Digital ID eliminates that friction entirely.
What was once selective tyranny becomes universal tyranny. Code
restricts transactions based on compliance status. No human oversight
required.
Here’s an easy way to think about it: police can break
into your home right now. Most people don’t lose sleep over that. Would
they feel the same about automated drones entering every home
simultaneously based on AI-triggered criteria? The capability itself
isn’t the threat… the automation at scale is.
And
for anyone thinking “the government already has my Social Security
number and my phone tracks my GPS” - you’re missing the difference.
Right now those systems are siloed - your bank doesn’t know what your
doctor said, your DMV doesn’t know your browser history, etc. Digital ID
is the interoperability layer - one key someone else controls - and can
revoke. Five keys for five doors means losing one is manageable. One
master key for everything means someone else decides whether you get in
at all.
In 2021, getting into my own taproom legally required a vaccine card. New York City had rolled out some half-baked digital pass,
but for the most part it was still paper back then. Still, it was
obvious where this was headed. When I started warning friends,
co-workers, the guy in the coffee shop - really, anyone who’d listen -
that this was a dry run for digital identity infrastructure, that the
compliance checkpoint they’d just accepted would eventually become
programmable and permanent, most thought I was insane.
After getting tired of long emails and late-night rants, I started publicly documenting what I thought was coming.
It was painfully obvious that centralized digital money meant rations,
expiring savings, compliance-based access to daily life. A sort of
digital cage. A few people in my life perked up, but most still scoffed.
Fast
forward a few years and what’s being rolled out right now is exactly
what I described - except ultimately, this system won’t just cover
vaccines, it will define and govern all acceptable behavior.
So when I hear smart people wave away Digital ID because “the government can already track you,” it’s maddening.
You're stuck on what they can already do. They're building something
entirely new. It’s like watching speed cameras being installed on every
block and saying “well, they could already give me a ticket.” Sure, one
decision at a time. Now imagine no human involved on any blocks, ever.
The marginal cost drops to zero and the decision isn’t made by a person
but by a line of code.
That’s a profoundly different category of power entirely. And
after what we all lived through in 2021 - watching our neighbors accept
a digital pass as the price of participation without blinking - we saw
the compliance muscle is already trained. Covid was the Milgram experiment, the Stanford Prison experiment, and the Asch conformity test rolled into one and our species failed all three. The only thing missing then was the infrastructure at societal scale.

Photo Credit
The Cover Story May Change. The Agenda Doesn’t.
Most
Americans assume they’re exempt from this kind of thing. A few years
ago, the majority of people I knew had no idea there were massive
protests happening all over the world. It was partly because our media
couldn’t be bothered to cover it, but also because we’re that insulated.
And maybe that’s by design - because America was built on individual
liberty in a way most countries weren’t, and that cultural resistance is
exactly why they’re normalizing the infrastructure everywhere else
first, then importing it here as “international best practice.” And
we’ll sleepwalk right into it.
Make no mistake: if America
accepts the authentication layer, the rest of the world loses its last
permission structure to resist.
Not to beat a dead horse, but we watched a trial run during Covid.
That’s why paying attention to what’s happening abroad isn’t paranoid, it may give us signal for what’s coming.
The UK’s Online Safety Act 2023 mandates
age verification for social media platforms using “ID checks, AI, or
age assurance technologies.” Prime Minister Keir Starmer is
fast-tracking implementation - writing clauses into the children’s
wellbeing bill to “enforce a ban quickly.” Leaked Cabinet Office
meetings revealed ministers discussing Digital ID for every baby at
birth registration. A parliamentary petition against mandatory Digital
ID gathered nearly 3 million signatures. They’re building it anyway.
Just a few days ago, Apple rolled out age verification for all UK users - ID scans or credit card checks to access certain features.
Brits tried to route around it with VPNs: usage more than doubled - from 650,000 daily users to over 1.4 million, according to a UK government report. The government’s response? Not to reconsider the ruling but to start discussing restrictions on VPNs.
The ratchet only turns one way. Mandate identity verification. When
people evade it, they restrict the evasion tools. Each “solution”
requires more control.
One of my best friends, a police sergeant
who lost his job after 24 years without missing a single day (the Cal
Ripken of the NYPD), for refusing to comply with vax mandates - told me
years ago that whenever we’re being told something is being done for our
safety, alarm bells should ring. He was right. Remember “nobody’s safe
until everybody’s safe”?
The cover story is always about protection.
Protect the children, protect women from online misogyny. Lately it’s
been all about protecting us from antisemitism and protecting us from
Islamophobia. Scroll the news on any given day and both are being
amplified in the same cycle.

It
should go without saying - my intention isn’t to diminish anyone’s real
feelings. Just last week I wrote about this at length in The Enemy Is Not Each Other.
The fear is real, and the people experiencing it aren’t wrong to feel
it. My argument is that the infrastructure being built to address those
feelings is the cage. Every emotional trigger - real or not - becomes
the justification for another identity checkpoint.
Australia passed its own age verification law. Kids are already bypassing it with
fake birthdays and unregulated apps. Of course, this law won’t protect
kids in any meaningful way, but it sure does build a new gatekeeper.
In Africa, Gates Foundation-funded biometric ID systems are
rolling out under the banner of financial inclusion. The cover story
changes by region - in this case, aid vs. protection. TikTok requires a
government ID in Europe. Discord requires facial age estimation globally. As Fenigson put it:
“It’s exactly the same. The only difference is that in the West, they
just have to make more excuses so that people can swallow it easily.”
And America?
California signed AB 1043 into
law - effective January 1, 2027, every operating system provider in the
state must implement age verification. Not a bill. Signed law.
Operating System-level identity verification baked into every device.
And that’s exactly what Mark Zuckerberg proposed under oath during
his congressional testimony on child safety. His “fix” was astonishing:
have Apple and Google verify the identity of every smartphone user at
the OS level, for every app. “Doing it at the level of the phone is just
a lot cleaner,” he said. In plain terms: he deflects Meta’s legal
liability while two companies already under antitrust scrutiny get
deputized as identity gatekeepers for the entire internet.
Congress is writing the laws, while the tech CEOs are designing the system. Worth noting: just last week, a jury found Meta - and YouTube - negligent for harm to children in a landmark lawsuit, and in a separate case, Meta was ordered to pay $375 million for misleading users on child safety.
So, the company that just lost two massive lawsuits for harming kids is
now advising Congress on how to build the identity infrastructure for
the entire internet. What could go wrong?

A bipartisan “Kids on Social Media Act”
is moving through Congress. Florida introduced an App Store
accountability bill that would force Apple and Google to verify the ages
of all users and collect identifying data.
As Derrick Broze pointed out, the White House’s own National Policy Framework for AI,
released in March 2026, leads with “Protecting Children” and calls on
Congress to establish age-assurance requirements for AI platforms. The
language is soft. The infrastructure it enables is the same. This isn’t a
partisan project. Both “sides” are building it.
And in March 2026, more than 400 computer scientists from around the world signed an open letter warning that age-verification mandates enable censorship, centralized power, and loss of privacy - and that the systems could cause more harm than good. They’re describing the authentication layer. They just don’t call it that.
It's Not Just Governments
You actually don’t need government mandates when corporations normalize biometric collection on their own.
And increasingly, you don’t need to choose - the mandates are
converging with initiatives from Big Tech and Big Banking, all built on
the same infrastructure.
I’ve been making this point to friends who have insisted CBDC was off the table once the President said he wouldn’t build it.
Sure, the US government might not - but what about JPMorgan Chase?
Through public-private partnerships, private institutions can be steered
into building the exact infrastructure the government just promised not
to touch. What’s the word for that again?
In November 2025, Apple launched Digital ID in Apple Wallet enabling
the ability for people to scan their passports, take selfies, complete
“facial and head movements” for verification - and then their identities
live on their phone. It has TSA acceptance at 250+ airports and can be
used as driver’s licenses in 12 states and growing. Apple’s press
release promises “additional Digital ID acceptance use cases to come in
the future.” The scope is unlimited by design.
Recently, Discord announced “teen-by-default settings” rolling
out globally to its 200 million users. To access age-restricted content
or modify safety settings, users must complete “age assurance” - facial
age estimation or government ID submission, of course. Discord launched
this in the UK and Australia first, delayed the global rollout after backlash -
not because they reconsidered their plan, but because users pushed back
on implementation. It’s still coming, even if the timeline shifted.
The framing is always the same:
Apple: “security and privacy.” Discord: “teen safety.” Zuckerberg: “protecting kids.”
I’ve
watched this play out in my own life. Friends who laughed at the idea
of a social credit score in 2020 are now paying for Clear and TSA
PreCheck - voluntarily handing over biometrics for the privilege of
skipping a line. I don’t recall a public discussion about the ethical
ramifications of this. It just became normal. That’s the compliance
muscle doing its job.
And here’s the punchline: the databases don’t stay separate. They get sold, merged, subpoenaed, hacked. Discord’s age verification system already leaked 70,000 government IDs in
a single breach. Unlike a password, you can’t reset your face. Once the
infrastructure exists, there’s no doubt “if” it will connect to
government systems - just “when.”
I’d argue there may be a second
motive here that nobody in Congress bothered to examine during
Zuckerberg’s testimony. As a student of online advertising for 30 years,
I find this one fascinating: In a move that actually helped users for
once, Apple blocked third-party tracking,
letting users opt out of being followed across apps - which most did.
Advertisers have been flying blind ever since, operating on educated
guesses about who you are. Remember, Zuckerberg’s proposal puts identity
verification right back at that same OS-level.
Identity verification at the operating system level fixes the ad industry’s problem overnight. Your
real identity, confirmed at the device level, is attached to everything
you do on the device. That means every data broker, every advertiser,
every platform that currently operates on probabilistic identity
matching gets handed a verified identity graph - courtesy of federal
law. Lovely.
Zuck is hardly proposing a solution to
surveillance capitalism... he’s proposing its next infrastructure
upgrade. The kicker is that he’s asking Congress to mandate it.
And for anyone who thinks there’s a freedom-friendly version of this, look at Sam Altman’s Worldcoin, now rebranded as “World.” As an aside, I can’t think of a better name for this character than Alt-Man.
Worldcoin’s pitch is “Proof of Human” - a decentralized, privacy-preserving answer to AI-generated fakes. Legendary tech investor Marc Andreessen is endorsing it.
On paper, it could even sound libertarian. The mechanism is iris
scanning. You stare into a corporate-owned orb, it captures your
biometric data, and you get a cryptographic ID that proves you’re human.
They say the image isn’t stored - just a mathematical hash. But a
unique identifier derived from your body is a biometric, regardless of
what format it’s saved in.
Thirty-three million people have already scanned. The app now stores government-issued IDs too. And the recruitment started in the Global South - the same places MOSIP (a
Gates Foundation-funded digital ID platform) is being installed. The
entry point is AI safety. The infrastructure is the same.
But Who’s Building It?
Anyone
in my orbit knows I’ve been yelling about the danger of CBDC for the
last few years. Once they understood the components - programmable
money, expiration dates on savings, control over what you buy and when -
some people got it right away. But, most just brushed it off. As per
usual, convenience for privacy. No big deal.
Now
you’ve seen the infrastructure being installed across every continent
and every sector. But who designed this? Gee, I wonder.
A few months ago, Bill Gates went on camera and told us. The stack: digital identity systems combined with digital financial switches. He named the components - MOSIP for identity, Mojaloop for payments. Called them both “necessary tools” for the future they’re building. Not two separate things. One integrated system.
Perhaps most disturbingly, the blueprint for this plan predates the crisis that normalized it. Texts from the recently released Epstein files show private discussions about
digital identity infrastructure going back to as early as 2017. The
correspondent? Dr. Melanie Walker - neurotechnology adviser to Gates,
World Bank director, Gates Foundation deputy director, WHO adviser, and
co-chair of the WEF’s Global Future Council on Neurotechnology.
She was texting Jeffrey Epstein about creating “a new type of social
security number, used for all types of identity, with health as a single
use case.” Sayer Ji has documented the full DARPA connection in detail.
The strategy: “Start with health.” The vision: “The magic is to make all the systems communicate.”
In
those same texts, Walker mentions that DARPA’s Geoff Ling and Raj Shah
(USAID, now Rockefeller) both recommended her for Surgeon General. She
tells Epstein that the heads of MGH, Cleveland Clinic, Hopkins, and Mayo
are “all working together” - and that she told them about him.
Epstein’s response? “Are they doing digital idea already? Do they have a
lead or a strategy?”
This was 2017. Three years before vaccine
passports made ‘showing your papers’ a daily reality for billions. The
plan being deployed now was being privately discussed by people embedded
in the Gates, World Bank, and DARPA networks years before any public
health crisis made it politically viable.
Chatham House,
the Royal Institute of International Affairs, published their framework
for global digital platform regulation in January 2024. Whitney Webb has documented how
the WEF’s Partnership Against Cybercrime pushes the same framework from
the cybersecurity angle - tying every person’s internet access to a
digital ID. The logic is simple: manufacture consent through crisis. The
entry points consistently multiply and the destination never changes,
no matter who is in power.
Remember what I said about international best practices? Well, the White House is promoting the SAVE Act -
framed as election security - by pointing to India and Brazil’s
biometric voter databases as the standard America should meet.
Naturally, the bill lists REAL ID as the first accepted proof of
citizenship. The entry point here may be voting, however, the
infrastructure remains the same.
Hiding In Plain Sight
Christine Lagarde announced the European Central Bank’s timeline:
pilot in 2027, full rollout by 2029. That’s not speculation, it’s their
stated plan. And it’s not some long-term dystopian vision - we’re at
the crossroads right now.
She’s not hiding the model. As Efrat Fenigson noted:
“Christine Lagarde and the ECB say that China is the blueprint for
their digital euro. They’re copying the ECNY, the Chinese central bank
digital currency.” And what does China’s system require? Authenticated
identity on every transaction. The blueprint is the authentication
layer. It always was.
The West used to be the antidote. Now it’s copying the surveillance state’s homework.
There
is no CBDC without Digital ID - not at any meaningful scale, not with
enforcement features, not as a system of control. Every transaction
requires authenticated identity. Every rule requires someone to apply it
to. The authentication layer isn’t a convenience feature - it’s the
control mechanism.
And yes, theoretically
privacy-preserving alternatives exist. But stuff like zero-knowledge
proofs and decentralized ID aren't what's being built, funded, or
legislated. In fact, quite the opposite. What's being rolled out is
centralized, biometric, and state-adjacent.
Once built, it doesn’t get unbuilt. When in human history have those in power gained a capability and voluntarily given it back?
Anyone who has been paying attention over the last few years understands what I’m outlining isn’t science fiction. Canada famously froze bank accounts of truckers who protested vaccine mandates, as well as those who donated to their cause. China’s social credit system already restricts travel for people with low scores. PayPal published a policy allowing fines for “misinformation” -
at their sole discretion - and only retracted it after backlash,
claiming it was an error. The fine mechanism for intolerance stayed,
naturally.
Those were manual, clumsy, one-off interventions that
required human decisions, but imagine all of that happening
automatically, instantly, attached to everything - your electric car,
your kid’s ability to go to school, even your ability to buy a morning
coffee.
Nobody targets you, nobody makes a decision, the transaction just doesn’t go through.
And there’s no one to appeal to, because there was no person involved in the first place.
If
you want to see what the full stack looks like deployed on cleared
ground with no legacy systems, there’s already a working model. The
Substack writer esc - for my money, one of the more important voices around right now - has been documenting Gaza’s reconstruction in extraordinary detail. The GREAT Trust plan issues
digital tokens to Palestinian landowners in exchange for land rights -
ownership converted into conditional access on a programmable ledger.
Kushner presented AI-powered smart cities at Davos:
six to eight planned cities where, according to the trust’s own slides,
all services and economy will be run through ID-based AI-powered
digital systems. E-wallets have already been distributed to over 245,000 recipients - before the reconstruction has even formally begun. No cash. No anonymity. No interaction outside the system.
The
architecture I’m describing in this essay isn’t theoretical. Gaza
appears to be the laboratory. Unless it’s stopped, I suspect we can
expect strategic deployment all over the world in the coming months and
years.
What You Can Do
The system requires your participation to work. The
catch is that this may also be its biggest weakness. It only becomes a
cage when adoption is near-universal. In other words, when opting out
means you can’t participate in daily life. When cash still works, and
analog alternatives survive, resistance may be inconvenient but still
livable. That’s why they need you to volunteer.
Don’t give it.
Use
your passport to fly, pay cash wherever you can. Most importantly
resist Real ID compliance at all costs. They’re trying to eliminate
friction so the more we can slow them down by adding it, the harder
their plan becomes to implement.
For the detailed practical
playbook - how to navigate banking, travel, and daily life outside the
system - I’d point you to the work Catherine Austin Fitts and the Solari team have
been doing for years. They’ve been busy mapping the resistance
infrastructure while most normies are still debating whether any of this
was real.
If we value the ability to live outside the reach of a
technocratic government - one that takes elements of cancel culture,
ESG, and surveillance and parlays them into a programmable monetary
system controlled by the state - this is the hill to die on. Not because
we’ll win every battle after - I’m pretty sure we won’t. However,
losing this one makes everything else exponentially harder. Once the
authentication layer is everywhere, every other control mechanism merely
becomes a software update.
The cage isn’t locked. Not yet.
My
friend still thinks Digital ID is a distraction. I’m not sure I’ve
convinced him yet. But I’m also not sure he’ll have the luxury of being
wrong about this much longer.
Don’t help them build it.