Nationality is second to being human
Why the infrastructure of recognition needs to be rebuilt from the person up
1. Introduction
Before you are a citizen of anywhere, you are a living human being. The rights that follow from being a living human do not depend on membership in any particular community, and no community can legitimately grant or revoke them. This is not a new claim—it is the foundation of the human-rights architecture that was built after 1945, and it has been affirmed by nearly every state that has signed a human-rights instrument since. What is new is the claim that the infrastructure of recognition should be designed as if it were true.
The systems we have built to recognize people—passports, licences, national identity schemes, and now the platform accounts that stand in for identity for a growing share of the world's population—were designed around a different premise. They treat membership in a community as the primary fact and the person as a derived one, and the consequences of that inversion are the subject of this article.
Two objections will occur immediately to a careful reader, and the argument should answer them before it proceeds, because it depends on neither.
The first is that personhood is not prior to social relations but constituted by them. On this view, the person is an achievement of primary and secondary socialization, and there is no pre-social person for the premise to reference. The argument accepts the substance of this objection. The relationships, communities and cultures that shape a life are real, and a person without them is not yet a person in the fullest sense. What the argument needs is not a pre-social person but an operational primitive: a fact about a living human that is countable, stable across the timescales on which recognition happens, and thin enough not to import a contested account of what a person is. The claim is not that the person is prior to their relationships; it is that the recognition of a living human as one distinct being should not require disclosing which relationships constitute them.
The second objection is that individuation is itself relational—that a biological individual is a stabilized process, not a substance, and that the boundary between one organism and another is an achievement of metabolic, developmental and ecological relations rather than a given. The argument accepts this too, or rather it does not need to deny it. The architecture requires a primitive that is countable and stable across the timescales of recognition, and it is agnostic on whether that stability is the stability of a substance or the stability of a process. A reader who holds either view can accept the architecture, because the architecture does not commit to a metaphysics of the person; it commits only to a primitive that works. The agnosticism is not a hedge. It is a feature: an infrastructure that can be adopted by people who disagree about what persons ultimately are is an infrastructure that can be governed across jurisdictions that disagree about the same thing.
What the architecture does require is that the moral claim and the operational claim be kept apart. The moral claim is that rights follow from being a living human, independent of community. The operational claim is that the recognition of a human as one distinct living being should be possible without disclosing the content of their social identity. The systems we have built conflate the two, and the conflation is the source of both the exclusion failures of centralized identity schemes and the surveillance surface of the same schemes. A person who cannot produce the right documents is excluded not because their humanity is in doubt but because the infrastructure has no way to recognize humanity without documentation. A person who can produce the documents is surveilled not because their community requires it but because the infrastructure has no way to recognize a specific fact about them without revealing the whole of their identity. Both failures follow from the same design choice, and the choice is not forced.
The rest of this article is about what the infrastructure would look like if the choice were made differently, and about whether the alternative is achievable. It is not a manifesto. The premise is ambitious; the mechanism is honest about what it may not achieve. The specification attached to this article states its fallbacks openly, because a mechanism that overclaims on behalf of the premise discredits the premise. The brief attached alongside it is how the project proposes to find out which of its ambitious claims hold.
2. What the current infrastructure gets wrong
The inversion named in the introduction is not an abstraction. It shows up in the ordinary transactions of ordinary life, and it shows up in the same way every time: the infrastructure offers a proof of who you are when what is needed is a proof of a fact about you. The pattern is worth naming before it is illustrated, because the illustrations will otherwise read as a list of inconveniences rather than a single design failure.
Over-disclosure. Consider a car rental. The clerk needs to know three things: that the licence is valid on the day of rental, that it permits the category of vehicle being rented, and that the driver is in the age band the insurer requires. What the licence actually reveals is the holder's full name, date of birth, address, photograph, licence number, issue date, expiry date, categories, endorsements and signature. The clerk sees all of it, and in most jurisdictions the rental agency records a copy. This is not because the clerk wants the information. It is because the only proof the infrastructure offers is "here is the document," and the document cannot be shown in part. The over-disclosure is a consequence of the proof mechanism, not of anyone's intent.
The over-disclosure does not end at the rental desk. The clerk's copy is stored, and the stored copy is one of the things that leaks. In 2024, US organisations issued over 1.3 billion breach notices, a 211% increase over the previous year, driven by a handful of mega-breaches at companies that had no particular reason to be holding the data they lost. The FTC received 1.1 million identity theft reports that year. The structural point is not that breaches happen—every reader knows they do—but that the current architecture makes the identity document the unit of verification, and any system that verifies by collecting documents will accumulate a store of documents, and any store of documents will eventually be breached. A verification mechanism that does not require the verifier to hold the document does not create the store.
Bilateral recognition. The same licence, presented at a border or a rental desk in another jurisdiction, is accepted or not through arrangements negotiated between the two jurisdictions. Those arrangements are real achievements of diplomacy, but they are bilateral, per credential type, and renegotiated as credentials change. The number of arrangements required to recognize a credential across n jurisdictions grows with the square of n, not with n. This is why cross-border recognition is slow to extend, uneven across credential types, and largely absent for credentials issued by institutions other than states—a university degree, a professional certificate, a platform account. The infrastructure has no shared substrate for recognition, so recognition is a diplomatic achievement rather than an architectural one.
Personhood conflated with identity. Now consider a person who needs to prove a single fact—that they are one person, once, for an election, a benefit, or a platform's one-account rule. The infrastructure offers no way to prove this fact alone. To prove that they are one person, they must prove who they are, which means producing an identity document, which means the system that checks one-per-human also learns the person's name, address, and often their biometrics. The conflation is not incidental: it is the reason centralized identity schemes hold the data they hold. A system that needs to know "is this one person, once" builds a registry of persons, and the registry then becomes the thing that can exclude, surveil, or leak.
The three failures share a shape. Each is a case where the infrastructure has one mechanism—the identity document, the bilateral arrangement, the central registry—and that mechanism cannot answer the question being asked without revealing far more than the question requires. The failures are not bugs in the implementation of the mechanism. They are the shape of a system designed around the premise that the primary fact to be established is membership, and that everything else follows from it.
The exclusion case makes the shape clearest, because it shows what happens when a person cannot produce the document the infrastructure requires. A person who has lost their documents, or never had them, or whose civil registry is incomplete, cannot prove the facts about themselves that the infrastructure would accept—not because those facts are false, but because the only proof on offer is a document they do not have. The same design choice that over-discloses for the documented excludes the undocumented. The two failures are not opposite; they are the same failure seen from two sides.
What would an infrastructure look like that did not have this shape? It would need to offer proofs of facts, not proofs of documents. It would need recognition to scale with the number of jurisdictions rather than with the square of it. And it would need to separate the question "is this one person, once" from the question "who is this person," so that answering the first does not require answering the second. Each of these is achievable, and none of them is achievable by improving the existing mechanisms. They require a different architecture, which is the subject of the next section—but before that, the alternatives deserve a fair hearing, because the most likely future is not the one this article proposes but the one that will happen by default.
3. The alternatives, fairly stated
The most likely future, if this project does not exist, is not the status quo. It is platform identity federated across vendors. A person proves who they are by proving control of an account held by one of a small number of technology companies, and the company attests to the relying party that the account is in good standing. This is already how a large share of the world's population proves identity for ordinary transactions, and it has real strengths. It requires no new institutions, so it can be adopted without treaty or legislation. It reaches across borders, because the platform does. It is convenient, because the account is already there, and it is fast, because the verification is a message between servers rather than a visit to an office. A serious argument for the project has to say what platform identity gets wrong that outweighs these advantages, and to say it without pretending the advantages are not real.
What platform identity gets wrong is the primitive. The unit of recognition is the account, not the person. This is not a detail of implementation; it is the foundation of the model, and it produces three consequences that matter against the needs Section 2 identified.
First, the account is not the person. A person may hold several accounts, and a company may suspend an account for reasons that have nothing to do with the person's standing as a human being. When the account is the primitive, the person's recognition is contingent on a commercial relationship they did not choose and cannot appeal outside the company's own processes. The premise that recognition should be prior to membership in a community is inverted twice: not only is the person recognized only through a community, but the community is a company whose terms of membership are set by its own interests.
Second, the company sees every verification. This is not a flaw the company can be asked to correct; it is what makes the model work. The platform attests because it observes, and it observes because it is the intermediary for every transaction. The surveillance surface is the model, not its misuse. A reader may accept this as the price of convenience, and reasonable people do; but the price should be named rather than assumed.
Third, platform identity cannot supply state-grade issuer trust. A platform can attest that an account is in good standing, but it cannot attest that the person holds a valid driving licence, that they are enrolled at a university, or that they are entitled to a benefit. Those facts come from issuers the platform is not, and the platform's attestation of them is only as good as the platform's relationship with the issuer—which is to say, in most cases, it does not exist. Platform identity is excellent at the questions it answers and silent on the questions states and institutions actually ask.
The other serious alternative is national digital identity, extended across jurisdictions by treaty. This model gets right what platform identity gets wrong. The issuer is the state, so the trust is state-grade. The unit of recognition is the citizen, which is at least a political status rather than a commercial one, and the citizen has rights against the state that an account-holder does not have against a platform. Cross-border recognition is possible through treaties, and the European Digital Identity Wallet is a working example of what such a treaty can produce.
What national digital identity gets wrong is the primitive, and it is the same primitive failure seen from the other side. The unit of recognition is the citizen, and the infrastructure that recognizes citizens is the same infrastructure that defines who is a citizen and who is not. The conflation is structural: the registry that answers "is this one person, once" is the registry that answers "is this person entitled," and the two answers come from the same institution. This is why centralized identity schemes have the exclusion failures they have—a person whose civil registration is incomplete is not recognized, and the failure is not one of documentation but of the infrastructure's inability to recognize a human without a civil status. It is also why they have the surveillance surface they have: the state that issues the credential is the state that can revoke it, and the registry that answers questions about eligibility is the registry that can be queried about a person's life.
The two alternatives are usually presented as opposites. They are not. They share the premise that recognition is a function of membership—in a company, or in a state—and they differ only on which membership counts. The project's claim is that the premise itself is the thing to change, and that the architecture that follows from the changed premise is not a hybrid of the two alternatives but a different structure. That structure is the subject of the next section.
A reader who favours one of the alternatives will have noticed that the argument has not yet shown the alternative is achievable. It is one thing to say that platform identity and national identity are both built on the wrong primitive; it is another to say that a system built on the right one can do the work. The next section states what the architecture would be, and Section 5 states what would have to be measured before the claim could be believed. The reader is owed both, and they are what follows.
4. The architectural claim
The architecture that follows from the premise is not a hybrid of the two alternatives. It is a different structure, and the difference is at the level of the primitive. If recognition should be prior to membership, then the infrastructure that recognizes people must be able to establish that there is one living human here without establishing which community they belong to, and must be able to attach the facts about a person—their credentials, their entitlements, their institutional affiliations—without those facts becoming the mechanism of recognition itself. The architecture has three layers, and each separation is a consequence of the premise rather than a design preference.
The uniqueness layer. The first layer establishes that there is one living human here, distinct from other living humans, and establishes it once. It does not establish who the person is, what they are entitled to, or which community they belong to. It establishes only that the person exists, and that the person is countable. The primitive this layer uses is the living human at the timescale of recognition—countable and stable across the transactions the infrastructure supports, agnostic on whether that stability is the stability of a substance or the stability of a process. The layer's output is a commitment, held on the person's device, that can prove "one person, once" in a given context without revealing anything about the person to whom it refers.
The credential layer. The second layer attaches facts to the person—a licence, a degree, an entitlement, an institutional affiliation—and lets the person prove only the fact a verifier needs. The issuer signs a credential bound to the person's commitment, the person holds it on their device, and the proof reveals the predicate the verifier asked for rather than the underlying attribute. The credential layer can exist without the uniqueness layer: a person can hold credentials before they have enrolled, and their credentials survive enrolment without being re-issued. The two layers are separable because the claims they make are separable—the uniqueness layer asserts that a person exists, the credential layer asserts something about them—and the separability is what makes it possible to have credentials without a registry of persons.
The trust layer. The third layer establishes which issuers and verifiers are recognized, across which jurisdictions, for which credential types. Recognition is recorded as an explicit, signed record between jurisdictions rather than negotiated bilaterally and separately for each credential type, so the number of recognition records scales with the number of jurisdictions rather than with the square of it. The trust layer is where states remain sovereign: each jurisdiction decides who may issue within its territory, and the trust layer records that decision so other jurisdictions can rely on it. The layer is thin by design. It records who signed what, not whether the claim is true.
The three layers are separable in the sense that matters: each can exist without the others. A credential layer without a uniqueness layer is a credential system for people who have not enrolled. A uniqueness layer without a credential layer is a personhood primitive for services that need one-per-human and nothing else. A trust layer without either is a registry of issuers. The architecture as a whole is the composition, but the composition is not required for any single layer to be useful, and this is what makes the architecture adoptable incrementally rather than all at once.
The layering is also what makes the premise architecturally load-bearing rather than merely aspirational. If the premise is that recognition is prior to membership, then the layer that recognizes must not be the layer that defines membership. In the architecture, the uniqueness layer recognizes and does not define; the credential layer defines facts and does not recognize; the trust layer records recognition and does not define either. Each layer does one thing, and the one thing it does is the one thing the premise requires of it. A system that conflated these layers—as the current infrastructure does, and as both alternatives do—would fail the premise regardless of how well it was implemented, because the failure is at the level of what the system is, not at the level of how it works.
The agnosticism the introduction named is a feature of the architecture, not a hedge. The uniqueness layer's primitive is the living human at the timescale of recognition, and the layer does not commit to a metaphysics of what the human is. This means the architecture can be adopted by people who disagree about the metaphysics—a process ontologist and a substance ontologist can both accept it, because the claim they are accepting is operational rather than metaphysical—and it means the architecture can be governed across jurisdictions that disagree about the metaphysics, which is the only kind of governance that trans-jurisdictional infrastructure can have. A system that required agreement on what a person ultimately is would require agreement on questions that no trans-jurisdictional body can settle; a system that requires only agreement on what recognition needs to count is a system that can be governed.
What this architecture does not yet show is that it can be built. The layers are coherent; whether they can be implemented at the scale the premise requires is a question for measurement, not for argument. The next section states what would have to be measured before the claim could be believed, and the attachments state how the project proposes to measure it.
5. The honest mechanism
The architecture is ambitious, and the honest thing to say about it is that not all of it may be achievable. The premise deserves a mechanism that is honest about its limits, because a mechanism that overclaims on behalf of the premise discredits the premise. This section states what the project does not yet know, and what would have to be measured before its central claims could be believed.
The hardest of the claims is the uniqueness layer. To establish that there is one living human here, once, at the scale of the world's population, the architecture relies on privacy-preserving biometric matching across a consortium of operators in multiple jurisdictions — a design that keeps templates off any single party's servers, that never links a template to the person's identity, and that can tolerate the failure of any one operator without losing the ability to match. Whether this design reaches the accuracy the premise requires at ten billion identities is not known. The published evidence on iris and fingerprint matching at scale suggests the target may be beyond current modalities, and the honest position is that the project does not yet know whether fusion of multiple modalities closes the gap. A Phase 0 benchmark is designed to find out, and its primary output is not "pass" or "fail" but which of the project's fallbacks the evidence supports.
The fallbacks are real and they are stated in the specification. If the accuracy target cannot be met, the project can publish achievable rates rather than a zero-duplicate claim, size the adjudication process to the measured error rate, apply full rigor within each jurisdiction and a looser threshold across them with the cross-jurisdiction duplicate rate published, grow the claimed design population in stages rather than all at once, and use an optional DNA module as an adjudication tie-break rather than a primary matcher. Each of these is a weaker claim than the architecture's headline, and each is a coherent claim. The honest mechanism is the one that can state which one the evidence supports before the project commits to any of them.
The second claim that may not hold is the leakage budget on the matching index. The architecture's privacy property depends on the index revealing at most a bounded number of bits about any enrolled template, and whether the bound can be met at the design population is a question for measurement rather than for argument. If it cannot be met, the project has fallback index designs to consider, and if none of them meets the bound under a defensible attacker model, the privacy property itself has to be renegotiated — which is a decision for the governance bodies rather than a technical one. The point of stating this now is that the project's privacy claim is a claim to be measured, not a claim that follows from the architecture by itself.
The third claim is about scale. The periodic all-pairs matching that detects cross-jurisdiction duplicates at the strict threshold is a different workload from the one-at-a-time matching that happens at enrolment, and whether it can run inside secure multi-party computation at the design population, at an interval short enough to keep the residual duplicate rate acceptable, is not known. If it cannot, the tiered-rigor fallback is foreclosed and the project's choice narrows to full rigor with a smaller claimed population. The Phase 0 benchmark is designed to answer this too, and its output will be a cost and an interval rather than a pass or a fail.
What the article is asking the reader to take from this section is not a list of things that might go wrong. It is that the project's claims are of a kind that can be measured, and that the project has designed its first phase around measuring them before it builds anything that would be expensive to change. A project that promised the architecture without measuring would be a project that asked for trust rather than evidence. This one is asking for Phase 0.
The attachments to this article are the two documents that carry the measurement work. The specification states the requirements in full, including the fallbacks, the open issues and the governance model that would ratify any of the fallbacks the evidence supports. The Phase 0 brief is the document that would be handed to the assessors who run the measurements, and it is short because the measurements are narrow. Neither document is written to persuade; the article has tried to do that. They are written so that a reader who is persuaded can see exactly what the project would do, and so that a reader who is not can see exactly what the project is claiming and exactly what would have to be true for the claim to hold.
6. Conclusion
The article began with a premise that is older than the project: before you are a citizen of anywhere, you are a living human being. The rights that follow from being a living human do not depend on membership in any particular community, and the recognition of a human as one distinct being should not require disclosing which communities they belong to. The premise is not new, and the project does not claim to have invented it. What the project claims is that the infrastructure of recognition should be designed as if the premise were true, and that the architecture that follows from the premise is coherent, separable, and governable across jurisdictions that disagree about what persons ultimately are.
The systems we have now were designed around the opposite premise. They treat membership as the primary fact and the person as a derived one, and the failures that follow — over-disclosure, bilateral recognition, the conflation of personhood with identity, the store of documents that leaks — are not accidents of implementation. They are the shape of a system designed from the wrong end. The two alternatives that would replace them by default share the same shape, differing only on which membership counts. Platform identity makes the account the unit of recognition; national identity makes the citizen the unit. Both are versions of the inversion, and neither can correct it by being improved, because the correction is not a matter of improvement. It is a matter of starting from the other end.
This architecture starts from the other end. It separates the question of whether a person exists from the question of who they are, and it makes the first separable from the second, so that credentials can exist without a registry of persons, and personhood can be recognized without disclosing the content of a life. The separability is not a detail of the design; it is the design. It is what makes the premise architecturally load-bearing rather than merely aspirational, and it is what makes the architecture adoptable by people and by jurisdictions that disagree about the metaphysics and politics of personhood but agree about what recognition needs to count.
Whether the architecture can be built at the scale the premise requires is not known. It is measurable, and the project's first phase (Phase 0) is designed to measure it before anything expensive is built. The measurements may show that the ambitious claims hold, or they may select the fallbacks the specification already names. Either outcome is honest, because the premise deserves a mechanism that is honest about its limits, and a mechanism that overclaims on behalf of the premise discredits the premise.
Nationality is second to being human. If that is true, the systems that recognize people should be designed as if it were. The architecture this article has described is what that design looks like. The measurements the project proposes are how it would find out whether the design holds. The reader who has followed the argument this far has everything needed to decide whether the premise is worth that work, and whether the architecture is the right response to it. The rest is in the attachments.
Downloads
