For Civic Institutions

Civic institutions run on a contradiction. Election authorities, regulators, media councils, standards bodies, and advocacy organisations all have to know who they are dealing with. The people they deal with are frequently the ones most harmed by being identified: a donor to an opposition campaign, a journalist reporting on the state that licenses them, a whistleblower filing against an employer.

The usual resolution is to collect identity anyway and promise to protect it. That promise is only as good as the database, and the database is the thing being attacked.

human.tech removes the trade-off. An institution can verify the fact it is legally required to check, and hold no copy of the person who proved it.

The challenge

Eligibility is a legal requirement, identity is a liability. Campaign finance law requires contributors to be domestic persons. Election law requires voters to be enrolled and to vote once. Neither law requires the operator to retain a permanent, linkable record of who did what. Most systems retain one anyway, because that is the only way anyone knew how to build it.
The register is the attack surface. A list of political donors, a list of media owners, a list of petition signatories: each is a target for the actor most motivated to see it. Breaching it once undoes every promise made to everyone on it.
Self-reported data is unverifiable and unattributable. Disclosure regimes collect filings as spreadsheets and PDFs. Nothing proves the filer was entitled to file, nothing proves the record was not altered afterwards, and nothing links a filing in one jurisdiction to the same entity in another.
Duplication is trivial. One operator can register forty outlets, sign a petition four hundred times, or open fifty accounts, unless uniqueness is established at the person level rather than the account level.

How human.tech helps

Prove eligibility, not identity. A zero-knowledge proof establishes residency, citizenship, age, or accreditation without transmitting the underlying document (Human Passport, Zero-Knowledge Identity).
One person, one record. Uniqueness holds across systems that never share a database, so a single operator cannot present as many (Human Passport).
Attributable submissions. A filing carries cryptographic proof that it came from a party entitled to make it and has not been altered since. Disputes become a question of evidence rather than of trust.
Screening without exposure. Beneficial owners, funders, and counterparties can be checked against sanctions and politically-exposed-person lists, with a verifiable result attached to the record and the identity never published (Proof of Clean Hands).
Disclosure by rule. What is published, what goes only to the regulator, and what stays sealed is decided in advance and enforced cryptographically, not left to an operator’s discretion (Shield).
No wallet required. Participants authenticate with an email address. Keys are derived and held by the person, never by a custodian (WaaP, Human Network).

Worked example: Lobby3

Lobby3 is the advocacy organisation founded by Andrew Yang to give ordinary people representation in Washington. It was human.tech’s first civic deployment, in 2022.

The constraint. United States federal campaign finance law prohibits contributions from foreign nationals. Any organisation accepting contributions for political advocacy must establish that every contributor is a US person. The standard way to satisfy that is to collect government ID from every donor.

Why that was unacceptable. Lobby3’s members were participating in political advocacy. A retained list of who donated to which political cause is exactly the record that should not exist, and its members knew it. Collecting it would have contradicted the organisation’s own reason for existing.

What we built. A proof of residency that the contributor generates from their own government ID, phone number, or social security number, and which reveals a single bit to Lobby3: this person is a US resident. Lobby3 verified the proof. It never received the document, the number, or the name. We called the pattern know-your-anon.

The result. Every contribution was demonstrably compliant with federal law. There was no donor identity database to subpoena, breach, or leak, because none was ever assembled.

Where the same pattern applies

The Lobby3 deployment resolves one instance of a general problem: an institution must verify a legally required fact about a person, and both the institution and the person are worse off if that person’s identity is retained. The same three primitives resolve the rest.

Voting and electoral integrity

Requirement	Conventional approach	With human.tech
Voter is enrolled and eligible	Roll lookup against a central register at the point of voting	Proof of enrolment, verified without querying a register that logs the query
One person, one vote	Mark the roll, creating a record of who voted	Cryptographic nullifier: a second vote is rejected, and no link is created between voter and ballot
Result is auditable	Trust the operator’s tally	Every ballot verifiable, every proof independently checkable
Overseas and remote voting	Postal ballots, or identity documents transmitted to a portal	Residency and citizenship proven from a phone, document never transmitted

The property that matters is the nullifier. It enforces one-vote-per-person while making it cryptographically impossible to reconstruct which ballot belongs to which voter. Ballot secrecy stops being a procedural promise and becomes a mathematical one.

Democratic participation beyond elections

Petitions, public consultations, participatory budgeting, and citizens’ assemblies all fail in the same way: they are trivially astroturfed, and the usual defence is to demand identity from participants, which suppresses the participation the exercise exists to gather.

Proof of personhood gives a consultation response the weight of one real, unique resident of the relevant jurisdiction, without recording who responded. An institution can state defensibly that a response set represents real people, which is the claim currently impossible to make about any online consultation.

Privacy-preserving registries

Beneficial ownership registers, lobbying registers, asset declarations, licensing registers, and conflict-of-interest disclosures share a structure: a mandatory filing about a person, some of which belongs in public and some of which does not.

A stable identifier per entity, resolvable across jurisdictions, so filings in one country can be joined to filings in another without a shared central database.
Filings signed by an authorised party, with proof of that authority and tamper-evidence after the fact.
Owners and funders screened against sanctions and politically-exposed-person lists, with the screening result published and the identity not.
A disclosure rule fixed in advance. Public fields are public. Regulator-only fields are encrypted and disclosable under stated conditions. Nothing is left to the operator’s judgement in the moment.

This is the shape required by transparency regimes now arriving in force, including the European Media Freedom Act’s ownership and state-advertising provisions.

Trust infrastructure for media and information

The information space has an authenticity problem that identity infrastructure can address at three distinct layers.

Outlet layer. A media outlet holds a verified organisational credential. Its ownership and funding disclosures are attributable filings, its beneficial owners screened for state linkage, and none of that requires publishing the name of an owner whose safety depends on anonymity.
Author layer. A journalist proves accreditation, or proves membership of a press body, without revealing which journalist. Pseudonymous reporting keeps its accountability: the credential can be revoked, and the same person cannot operate forty pseudonyms.
Audience layer. Comment sections, review systems, and platform feedback can require proof of unique personhood. One human, one voice, no names collected. Coordinated inauthentic behaviour becomes expensive rather than free.

The common thread is that authenticity and anonymity are not opposites. What breaks the information space is not anonymity, it is unlimited duplication and unverifiable claims. Both are solvable without collecting identity.

What an institution actually integrates

Define the fact. State precisely what must be true of a participant: resident of a jurisdiction, over an age, enrolled on a roll, accredited by a body, not sanctioned.
Choose the disclosure rule. Decide, in advance, what is public, what goes only to a regulator, and what stays sealed.
Verify the proof. The participant generates a proof; the institution checks it. Typically an API call and a signature verification.
Keep the receipt, not the person. Retain the verifiable proof for audit. The identity behind it was never transmitted, so it cannot be lost.

Talk to us

Running an election, a disclosure regime, a public register, or a media transparency programme? Contact us.