Thanks for having me, this was a lot of fun!

100%

The same pattern in the private sector: https://primal.net/e/

The government said national digital ID was cancelled in July. The work around GOV.UK Wallet, digital driving licences and One Login carried on. GOV.UK Wallet is still live, the Veteran Card is already digital and the driving licence is next. The government’s own technical documentation was updated again on 1 and 3 September, including work on issuing and revoking test digital driving licences. One Login is still growing as the gateway into government services, with more than 23 million users. This week, licensed premises in England and Wales can also accept certified digital proof of age for alcohol sales. What was taken off the table was the politically visible product. The systems for issuing, storing and checking digital credentials kept developing. Some of the government’s data incidents: - Electoral Commission: around 40 million people affected by a cyber breach. - MoD: data linked to more than 18,500 Afghan applicants exposed. - PSNI: details of 9,483 officers and staff published online. - HMRC: stolen identity data used to reach about 100,000 online tax accounts. If more of our official documents and identity credentials are going into reusable digital systems, I want to know: - who can request them? - what is recorded? - when they are used? - how is it stored? - who has access? - how long that information is kept? - whether people who refuse the digital route will still have an equivalent way to access the service? The public was told “digital ID cancelled”. The government’s own development record shows the digital identity work carried on. The technical documents for GOV.UK Wallet, including the September updates on digital driving licences, are here: https://docs.wallet.service.gov.uk/

Today England and Wales put digital ID on the bar. Licensed premises can now accept certified digital proof of age for alcohol, allowing someone to confirm they are over 18 through an app rather than handing over a passport or driving licence. The government says the venue does not need to see details such as your name or address, with services including Yoti and Post Office EasyID operating under the UK digital verification trust framework. This is separate from the digital driving licence and GOV.UK Wallet. That sounds privacy friendly at the point of sale because the pub only sees the proof. The identity provider behind the app is still responsible for verifying and handling the underlying data, which is where the privacy and security questions sit. Digital identity becomes normal when it gets built into everyday life, one convenience at a time. The more we rely on that infrastructure, the harder it becomes to question how far it should go. That debate needs to happen before convenience becomes dependency. Press release: https://www.gov.uk/government/news/new-rules-pave-the-way-for-businesses-to-adopt-digital-proof-of-age-for-alcohol-sales BBC article: https://www.bbc.co.uk/news/articles/cm4gl6j53w19o

KYC requirements keep expanding while the systems holding our personal data repeatedly fail to protect it. A few recent incidents: - Revolut: ID and account histories sent after fake official requests. - Swiss Bitcoin Pay: emails, IBANs and transaction data accessed - Pocket Bitcoin: data on 5,411 people exposed - SafePal: almost 40,000 customers affected Global context: - 43% of UK businesses hit by a cyber breach or attack last year. - Average data breach cost: $4.44m globally - FATF effectiveness scores ~28% globally The policy response remains more KYC, more collection and more sharing. We are building ever-larger stores of identity and financial data without clear evidence that this level of surveillance is delivering proportionate results, while the systems holding that data continue to fail. You can check whether your data has been caught up in a breach at Have I Been Pwned: haveibeenpwned.com

We should be careful about expanding surveillance in the name of safety. Decades of extra data collection have not eliminated financial crime. With Bitcoin, 'more data' can mean permanently linking people to visible stores of value on a public ledger. That is a different risk from banking, and it is hard to unwind once it is done.

Bitcoin has an access problem in policymaking. Well funded tech, financial and crypto firms often have the easiest access to policymakers, giving them disproportionate influence over the rules. Those are the same rooms where the rules are being written. Bitcoin is still being regulated as part of a cryptoasset regime built around “same risk, same regulatory outcome”, despite having very different characteristics from much of the sector. I spoke to CK about what I’ve seen working in UK policy, political influence, digital ID and CBDCs. Treating Bitcoin like “crypto” could be one of the biggest policy mistakes we make as a country.

Bitcoin, freedom, privacy, power… ... and yes, that’s a box under my feet again.

Imagine losing your Bitcoin collateral and still ending up with a tax bill. That is one of the problems we have raised with HMRC on the draft lending rules. We have asked HMRC to tighten the draft on: - “low risk of loss” for Bitcoin - native vs wrapped Bitcoin risk - transitional treatment for positions already in place We are also still pressing HMRC on CGT for everyday Bitcoin payments. The overall direction is right, but the devil is in the detail. The full submission is linked in the post below.