The Authentication Layer

Digital ID is the authentication layer, while CBDC is the currency that runs on top of it.

BY JOSH STYLMAN

View original article at Brownstone.org.

A friend and I got into it recently. He’s smart, freedom-minded, and totally gets the danger of Central Bank Digital Currencies (CBDC). Expiring money, programmable control, carbon budgets – he sees most of the expanding tyranny clearly. And yet he dismisses Digital ID as a distraction. When I try to make the case that digital ID is the gateway to the gulag in the metaverse, he demands I name ONE thing Digital ID gives the government that they can’t already do.

My answer: it enables CBDC.

Of course, governments have already encroached on our privacy and freedoms in ways our forefathers couldn’t have imagined. But even with the creeping surveillance state, the government can’t fully implement programmable currency without authenticated identity on every transaction. They’re components of the same beast. Digital ID is the authentication layer, while CBDC is the currency that runs on top of it.

Stop Digital ID and you prevent CBDC from being built at any scale that matters.

The institutions driving this, the usual suspects including the Bank of International Settlements (BIS) and the United Nations, are quite explicit about their intentions. Their own documentation spells it out: digital identity is a requirement for centralized digital currency. And in case the documents aren’t clear enough, Agustín Carstens, the former GM of the BIS couldn’t have been more explicit about their goals:

“A key difference with the CBDC is that central banks will have absolute control on the rules and regulations that will determine the use of that expression of central bank liability, and also we will have the technology to enforce that.”

Perhaps we should take these institutions at their word?

When Enforcement Goes on Autopilot

What my friend is missing isn’t really about capability. The game has never been about what the government can do. It’s about the cost of doing it.

Right now, controlling what you buy, where you go, what you read – all of that requires boots on the ground. Investigations, warrants, real people making decisions. The friction is the protection.

Digital ID eliminates that friction entirely. What was once selective tyranny becomes universal tyranny. Code restricts transactions based on compliance status. No human oversight required.

Here’s an easy way to think about it: police can break into your home right now. Most people don’t lose sleep over that. Would they feel the same about automated drones entering every home simultaneously based on AI-triggered criteria? The capability itself isn’t the threat…the automation at scale is.

And for anyone thinking “the government already has my Social Security number and my phone tracks my GPS” – you’re missing the difference. Right now those systems are siloed – your bank doesn’t know what your doctor said, your DMV doesn’t know your browser history, etc. Digital ID is the interoperability layer – one key someone else controls – and can revoke. Five keys for five doors means losing one is manageable. One master key for everything means someone else decides whether you get in at all.

In 2021, getting into my own taproom legally required a vaccine card. New York City had rolled out some half-baked digital pass, but for the most part it was still paper back then. Still, it was obvious where this was headed. When I started warning friends, co-workers, the guy in the coffee shop – really, anyone who’d listen – that this was a dry run for digital identity infrastructure, that the compliance checkpoint they’d just accepted would eventually become programmable and permanent, most thought I was insane.

After getting tired of long emails and late-night rants, I started publicly documenting what I thought was coming. It was painfully obvious that centralized digital money meant rations, expiring savings, compliance-based access to daily life. A sort of digital cage. A few people in my life perked up, but most still scoffed.

Fast forward a few years and what’s being rolled out right now is exactly what I described – except ultimately, this system won’t just cover vaccines, it will define and govern all acceptable behavior.

So when I hear smart people wave away Digital ID because “the government can already track you,” it’s maddening. You’re stuck on what they can already do. They’re building something entirely new. It’s like watching speed cameras being installed on every block and saying “Well, they could already give me a ticket.” Sure, one decision at a time. Now imagine no human involved on any blocks, ever. The marginal cost drops to zero and the decision isn’t made by a person but by a line of code.

That’s a profoundly different category of power entirely. And after what we all lived through in 2021 – watching our neighbors accept a digital pass as the price of participation without blinking – we saw the compliance muscle is already trained. Covid was the Milgram experiment, the Stanford Prison experiment, and the Asch conformity test rolled into one and our species failed all three. The only thing missing then was the infrastructure at societal scale.

Photo Credit

The Cover Story May Change. The Agenda Doesn’t.

Most Americans assume they’re exempt from this kind of thing. A few years ago, the majority of people I knew had no idea there were massive protests happening all over the world. It was partly because our media couldn’t be bothered to cover it, but also because we’re that insulated. And maybe that’s by design – because America was built on individual liberty in a way most countries weren’t, and that cultural resistance is exactly why they’re normalizing the infrastructure everywhere else first, then importing it here as “international best practice.” And we’ll sleepwalk right into it.

Make no mistake: if America accepts the authentication layer, the rest of the world loses its last permission structure to resist. Not to beat a dead horse, but we watched a trial run during Covid.

That’s why paying attention to what’s happening abroad isn’t paranoid, it may give us signal for what’s coming.

The UK’s Online Safety Act 2023 mandates age verification for social media platforms using “ID checks, AI, or age assurance technologies.” Prime Minister Keir Starmer is fast-tracking implementation – writing clauses into the children’s well-being bill to “enforce a ban quickly.” Leaked Cabinet Office meetings revealed ministers discussing Digital ID for every baby at birth registration. A parliamentary petition against mandatory Digital ID gathered nearly 3 million signatures. They’re building it anyway. Just a few days ago, Apple rolled out age verification for all UK users – ID scans or credit card checks to access certain features.

Brits tried to route around it with VPNs: usage more than doubled – from 650,000 daily users to over 1.4 million, according to a UK government report. The government’s response? Not to reconsider the ruling but to start discussing restrictions on VPNs. The ratchet only turns one way. Mandate identity verification. When people evade it, they restrict the evasion tools. Each “solution” requires more control.

One of my best friends, a police sergeant who lost his job after 24 years without missing a single day (the Cal Ripken of the NYPD), for refusing to comply with vax mandates – told me years ago that whenever we’re being told something is being done for our safety, alarm bells should ring. He was right. Remember “nobody’s safe until everybody’s safe?”

The cover story is always about protection. Protect the children, protect women from online misogyny. Lately it’s been all about protecting us from anti-Semitism and protecting us from Islamophobia. Scroll the news on any given day and both are being amplified in the same cycle.

It should go without saying – my intention isn’t to diminish anyone’s real feelings. Just last week I wrote about this at length in The Enemy Is Not Each Other. The fear is real, and the people experiencing it aren’t wrong to feel it. My argument is that the infrastructure being built to address those feelings is the cage. Every emotional trigger – real or not – becomes the justification for another identity checkpoint.

Australia passed its own age verification law. Kids are already bypassing it with fake birthdays and unregulated apps. Of course, this law won’t protect kids in any meaningful way, but it sure does build a new gatekeeper.

In Africa, Gates Foundation-funded biometric ID systems are rolling out under the banner of financial inclusion. The cover story changes by region – in this case, aid vs. protection. TikTok requires a government ID in Europe. Discord requires facial age estimation globally. As Fenigson put it: “It’s exactly the same. The only difference is that in the West, they just have to make more excuses so that people can swallow it easily.”

And America?

California signed AB 1043 into law – effective January 1, 2027, every operating system provider in the state must implement age verification. Not a bill. Signed law. Operating System-level identity verification baked into every device.

And that’s exactly what Mark Zuckerberg proposed under oath during his Congressional testimony on child safety. His “fix” was astonishing: have Apple and Google verify the identity of every smartphone user at the OS level, for every app. “Doing it at the level of the phone is just a lot cleaner,” he said. In plain terms: he deflects Meta’s legal liability while two companies already under antitrust scrutiny get deputized as identity gatekeepers for the entire internet.

Congress is writing the laws, while the tech CEOs are designing the system. Worth noting: just last week, a jury found Meta and YouTube negligent for harm to children in a landmark lawsuit, and in a separate case, Meta was ordered to pay $375 million for misleading users on child safety. So, the company that just lost two massive lawsuits for harming kids is now advising Congress on how to build the identity infrastructure for the entire internet. What could go wrong?

A bipartisan “Kids on Social Media Act” is moving through Congress. Florida introduced an App Store accountability bill that would force Apple and Google to verify the ages of all users and collect identifying data.

As Derrick Broze pointed out, the White House’s own National Policy Framework for AI, released in March 2026, leads with “Protecting Children” and calls on Congress to establish age-assurance requirements for AI platforms. The language is soft. The infrastructure it enables is the same. This isn’t a partisan project. Both “sides” are building it.

And in March 2026, more than 400 computer scientists from around the world signed an open letter warning that age-verification mandates enable censorship, centralized power, and loss of privacy – and that the systems could cause more harm than good. They’re describing the authentication layer. They just don’t call it that.

It’s Not Just Governments

You actually don’t need government mandates when corporations normalize biometric collection on their own. And increasingly, you don’t need to choose – the mandates are converging with initiatives from Big Tech and Big Banking, all built on the same infrastructure.

I’ve been making this point to friends who have insisted CBDC was off the table once the President said he wouldn’t build it. Sure, the US government might not – but what about JPMorgan Chase? Through public-private partnerships, private institutions can be steered into building the exact infrastructure the government just promised not to touch. What’s the word for that again?

In November 2025, Apple launched Digital ID in Apple Wallet enabling the ability for people to scan their passports, take selfies, complete “facial and head movements” for verification – and then their identities live on their phone. It has TSA acceptance at 250+ airports and can be used as driver’s licenses in 12 states and growing. Apple’s press release promises “additional Digital ID acceptance use cases to come in the future.” The scope is unlimited by design.

Recently, Discord announced “teen-by-default settings” rolling out globally to its 200 million users. To access age-restricted content or modify safety settings, users must complete “age assurance” – facial age estimation or government ID submission, of course. Discord launched this in the UK and Australia first, delayed the global rollout after backlash – not because they reconsidered their plan, but because users pushed back on implementation. It’s still coming, even if the timeline shifted.

The framing is always the same:

Apple: “security and privacy.” Discord: “teen safety.” Zuckerberg: “protecting kids.”

I’ve watched this play out in my own life. Friends who laughed at the idea of a social credit score in 2020 are now paying for Clear and TSA PreCheck – voluntarily handing over biometrics for the privilege of skipping a line. I don’t recall a public discussion about the ethical ramifications of this. It just became normal. That’s the compliance muscle doing its job.

And here’s the punchline: the databases don’t stay separate. They get sold, merged, subpoenaed, hacked. Discord’s age verification system already leaked 70,000 government IDs in a single breach. Unlike a password, you can’t reset your face. Once the infrastructure exists, there’s no doubt “if” it will connect to government systems – just “when.”

I’d argue there may be a second motive here that nobody in Congress bothered to examine during Zuckerberg’s testimony. As a student of online advertising for 30 years, I find this one fascinating: In a move that actually helped users for once, Apple blocked third-party tracking, letting users opt out of being followed across apps – which most did. Advertisers have been flying blind ever since, operating on educated guesses about who you are. Remember, Zuckerberg’s proposal puts identity verification right back at that same OS-level.

Identity verification at the operating system level fixes the ad industry’s problem overnight. Your real identity, confirmed at the device level, is attached to everything you do on the device. That means every data broker, every advertiser, every platform that currently operates on probabilistic identity matching gets handed a verified identity graph – courtesy of federal law. Lovely.

Zuck is hardly proposing a solution to surveillance capitalism…he’s proposing its next infrastructure upgrade. The kicker is that he’s asking Congress to mandate it.

And for anyone who thinks there’s a freedom-friendly version of this, look at Sam Altman’s Worldcoin, now rebranded as “World.” As an aside, I can’t think of a better name for this character than Alt-Man.

Worldcoin’s pitch is “Proof of Human” – a decentralized, privacy-preserving answer to AI-generated fakes. Legendary tech investor Marc Andreessen is endorsing it. On paper, it could even sound libertarian. The mechanism is iris scanning. You stare into a corporate-owned orb, it captures your biometric data, and you get a cryptographic ID that proves you’re human. They say the image isn’t stored – just a mathematical hash. But a unique identifier derived from your body is a biometric, regardless of what format it’s saved in.

Thirty-three million people have already scanned. The app now stores government-issued IDs too. And the recruitment started in the Global South – the same places MOSIP (a Gates Foundation-funded digital ID platform) is being installed. The entry point is AI safety. The infrastructure is the same.

But Who’s Building It?

Anyone in my orbit knows I’ve been yelling about the danger of CBDC for the last few years. Once they understood the components – programmable money, expiration dates on savings, control over what you buy and when – some people got it right away. But, most just brushed it off. As per usual, convenience for privacy. No big deal.

Now you’ve seen the infrastructure being installed across every continent and every sector. But who designed this? Gee, I wonder.

A few months ago, Bill Gates went on camera and told us. The stack: digital identity systems combined with digital financial switches. He named the components – MOSIP for identity, Mojaloop for payments. Called them both “necessary tools” for the future they’re building. Not two separate things. One integrated system.

Perhaps most disturbingly, the blueprint for this plan predates the crisis that normalized it. Texts from the recently released Epstein files show private discussions about digital identity infrastructure going back to as early as 2017. The correspondent? Dr. Melanie Walker – neurotechnology adviser to Gates, World Bank director, Gates Foundation deputy director, WHO adviser, and co-chair of the WEF’s Global Future Council on Neurotechnology. She was texting Jeffrey Epstein about creating “a new type of social security number, used for all types of identity, with health as a single use case.” Sayer Ji has documented the full DARPA connection in detail.

The strategy: “Start with health.” The vision: “The magic is to make all the systems communicate.”

In those same texts, Walker mentions that DARPA’s Geoff Ling and Raj Shah (USAID, now Rockefeller) both recommended her for Surgeon General. She tells Epstein that the heads of MGH, Cleveland Clinic, Hopkins, and Mayo are “all working together” – and that she told them about him. Epstein’s response? “Are they doing digital idea already? Do they have a lead or a strategy?”

This was 2017. Three years before vaccine passports made ‘showing your papers’ a daily reality for billions. The plan being deployed now was being privately discussed by people embedded in the Gates, World Bank, and DARPA networks years before any public health crisis made it politically viable.

Chatham House, the Royal Institute of International Affairs, published their framework for global digital platform regulation in January 2024. Whitney Webb has documented how the WEF’s Partnership Against Cybercrime pushes the same framework from the cybersecurity angle – tying every person’s internet access to a digital ID. The logic is simple: manufacture consent through crisis. The entry points consistently multiply and the destination never changes, no matter who is in power.

Remember what I said about international best practices? Well, the White House is promoting the SAVE Act – framed as election security – by pointing to India and Brazil’s biometric voter databases as the standard America should meet. Naturally, the bill lists REAL ID as the first accepted proof of citizenship. The entry point here may be voting, however, the infrastructure remains the same.

Hiding in Plain Sight

Christine Lagarde announced the European Central Bank’s timeline: pilot in 2027, full rollout by 2029. That’s not speculation, it’s their stated plan. And it’s not some long-term dystopian vision – we’re at the crossroads right now.

She’s not hiding the model. As Efrat Fenigson noted: “Christine Lagarde and the ECB say that China is the blueprint for their digital euro. They’re copying the ECNY, the Chinese central bank digital currency.” And what does China’s system require? Authenticated identity on every transaction. The blueprint is the authentication layer. It always was.

The West used to be the antidote. Now it’s copying the surveillance state’s homework.

There is no CBDC without Digital ID – not at any meaningful scale, not with enforcement features, not as a system of control. Every transaction requires authenticated identity. Every rule requires someone to apply it to. The authentication layer isn’t a convenience feature – it’s the control mechanism.

And yes, theoretically privacy-preserving alternatives exist. But stuff like zero-knowledge proofs and decentralized ID aren’t what’s being built, funded, or legislated. In fact, quite the opposite. What’s being rolled out is centralized, biometric, and state-adjacent.

Once built, it doesn’t get unbuilt. When in human history have those in power gained a capability and voluntarily given it back?

Anyone who has been paying attention over the last few years understands what I’m outlining isn’t science fiction. Canada famously froze bank accounts of truckers who protested vaccine mandates, as well as those who donated to their cause. China’s social credit system already restricts travel for people with low scores. PayPal published a policy allowing fines for “misinformation” – at their sole discretion – and only retracted it after backlash, claiming it was an error. The fine mechanism for intolerance stayed, naturally.

Those were manual, clumsy, one-off interventions that required human decisions, but imagine all of that happening automatically, instantly, attached to everything – your electric car, your kid’s ability to go to school, even your ability to buy a morning coffee.

Nobody targets you, nobody makes a decision, the transaction just doesn’t go through.

And there’s no one to appeal to, because there was no person involved in the first place.

If you want to see what the full stack looks like deployed on cleared ground with no legacy systems, there’s already a working model. The Substack writer esc – for my money, one of the more important voices around right now – has been documenting Gaza’s reconstruction in extraordinary detail. The GREAT Trust plan issues digital tokens to Palestinian landowners in exchange for land rights – ownership converted into conditional access on a programmable ledger. Kushner presented AI-powered smart cities at Davos: six to eight planned cities where, according to the trust’s own slides, all services and economy will be run through ID-based AI-powered digital systems. E-wallets have already been distributed to over 245,000 recipients – before the reconstruction has even formally begun. No cash. No anonymity. No interaction outside the system.

The architecture I’m describing in this essay isn’t theoretical. Gaza appears to be the laboratory. Unless it’s stopped, I suspect we can expect strategic deployment all over the world in the coming months and years.

What You Can Do

The system requires your participation to work. The catch is that this may also be its biggest weakness. It only becomes a cage when adoption is near-universal. In other words, when opting out means you can’t participate in daily life. When cash still works, and analog alternatives survive, resistance may be inconvenient but still livable. That’s why they need you to volunteer.

Don’t give it.

Use your passport to fly, pay cash wherever you can. Most importantly, resist Real ID compliance at all costs. They’re trying to eliminate friction so the more we can slow them down by adding it, the harder their plan becomes to implement.

For the detailed practical playbook – how to navigate banking, travel, and daily life outside the system – I’d point you to the work Catherine Austin Fitts and the Solari team have been doing for years. They’ve been busy mapping the resistance infrastructure while most normies are still debating whether any of this was real.

If we value the ability to live outside the reach of a technocratic government – one that takes elements of cancel culture, ESG, and surveillance and parlays them into a programmable monetary system controlled by the state – this is the hill to die on. Not because we’ll win every battle after – I’m pretty sure we won’t. However, losing this one makes everything else exponentially harder. Once the authentication layer is everywhere, every other control mechanism merely becomes a software update.

The cage isn’t locked. Not yet. My friend still thinks Digital ID is a distraction. I’m not sure I’ve convinced him yet. But I’m also not sure he’ll have the luxury of being wrong about this much longer.

Don’t help them build it.

Republished from the author’s Substack

---

More articles

Donate