Unlocking Digital Democracy with ZK Identity - Bangkok 2024

[Music] so um hi everyone I'm Kitty from RAR labs and RAR Labs is a contributor to rmo protocol and Rao protocol is a ZK identity protocol that allows you to not only make your identities private and verifiable but also your social graph so to give an idea of the kind of tech that this unlocks the thing that we're best known for is our surveillance free voting tool Freedom tool and freedom tool was released about 6 months ago and it was almost instantly picked up by opposition in Russia who used it to protest Putin and challenge as inauguration and it was then picked up by dissident in Iran who used it to protest the Islamic Republic in Iran and then most recently we had our first use case with elected elected officials in Georgia where opposition MPS used it to host tamperproof polling in the presidential elections um but in this talk I'm going to go through these use cases and then also discuss how in the process of building these voting tools where privacy can't just be an ideal but really really needs to be robust we discovered a lot of issues with the pre-existing identity Frameworks that exist in web 3 and serious privacy vulnerabilities so I'm going to discuss how we then suck conv vented that and built a system called the ZK identity registry which injects not only like true and robust privacy into identity and web 3 but also permissionless so so as I mentioned Freedom tool is this surveillance free voting solution and it solved a kind of long-term technical challenge in the digital democracy space which is a how do you allow people to prove that they are eligible to vote without also making them vulnerable to tracing and we did this through the magic of zkps so for like anyone who's new to zkps and zero knowledge it's a type of cryptography that lets you like lets one party prove to another party certain things about themselves without revealing any additional data so with voting we allowed users to prove that they are over 18 that they're a unique human and also that there of like whatever citizenship they needed to be to participate in the vote um and it was super easy to use uh the kind of central artifact is the passport so like if you want to cast a vote with freedom tool you just take your passport and you use your phone to like tap the NFC chip inside the passport and freedom tool will verify like all of the data and it will issue you with a zkp that like gives you an anonymous voting pass and then you can cast the vote and the vote itself is registered on the blockchain where it's completely tamperproof and everything happens like client side on the on the phone so nothing ever passes through a centralized server there's no points where it can be hacked it is like so easy to use I really can't like emphasize enough how simple it is like your grandma could do it and that was partly like how this tool became so successful um but on to the first use case so as I mentioned Freedom tool was used in Russia where it was picked up by an opposition activist called Mark Fagen and Mark is the former Riot lawyer and he is currently in Exile and he wanted to use this tool not just to um facilitate protest but also to create like a better feedback loop with dissident in Russia um so like as you can imagine in these kind of environments uh it's very very hard for opposition leaders to have any certainty that they're actually representing the desires of the people that they're seeking to represent like it's so hard to get a gauge on what they want so the vision behind Russia 2024 was that like opposition leaders could host um routine votes to get a sense of what uh the distant population are feeling and the first vote that was hosted on there was um basically giving people an opportunity to protest Putin's inauguration and so it was do you think that the election results were legitimate and over 40,000 votes were cast and the app was downloaded by 25,000 users just in the first 24 hours alone which broke records in web 3 um and obviously like this is quite a small percentage of like the entire Russian population um but the kind of beauty of it was that it again it provides as I mentioned this like feedback loop but also gave dissidents like a chance to express their dissent and the fact that they didn't believe that these votes were legitimate and the biggest challenge of course with any tool like this whether Stakes for using it are so high is creating trust with the public um so we hope that as these tools like continue and people can see that the users aren't being persecuted and aren't being traced and are surviving that more and more will start to use them and this app in particular was actually attacked by the Kremlin several times so one of the kind of strangest like most fascinating like forms of attack that they did was mobilize these um like it turns out the kin have basically like a cabal of like state sponsored app reviewers who just like religiously will tank all of the ratings so that it's like difficult to find and people can't get a hold of it and they did that but they also um the kind of the people who were being paid to like submit these reviews were also sending messages being like we really need this kind of anonymous voting like please keep this app alive um don't you know don't remove it so that was like a very powerful Testament like how critical these tools are and um the kind of outlet that it gave to people in Russia um and off the back of that we had the next use case in Iran where you know it was very similar it was used for protest and we then only a couple weeks ago had our um use case with elected officials and that was with opposition leaders in Georgia and they did something quite interesting with freedom tool where they did this kind of tamperproof polling which is quite similar like functionally to the use cases in Russia and Iran where it's you know like Anonymous voting but they also wanted to use it to combat low voter turnout so they built this quite complex point system where users were rewarded for or kind of anything that um indicated political engagement so you got rewards for polling you got rewards for voting uh you got rewards for reporting voter fraud and all of this like irregardless of political lead political Alliance um and they then pledged that if elected they would use the app to experiment firstly with liquid democracy which is where you vote not just in presidential elections but routinely on legislation um and this is possible with a tool like Freedom tool because the costs of voting are so dramatically reduced so I think it's like quite an interesting Testament to how these tools like not only protect people from surveillance and allow voting to be digital but allow people to experiment with slightly different models for democracy and um they also pledged that they would use the system to digitize a whole load of identity services in Georgia so like notaries Registries all these things and then use the profit from that to distribute Universal basic income and the presidential elections have just taken place in Georgia they're been contested there's a lot of evidence to suggest that they were rigged so at the moment the incumbent are still in power and it's not entirely clear what what will happen um and how much of this will will go live but it was used for the tamperproof polling and it was used for um voter incentives so that's the kind of overview of how the appli works but what I want to talk about now is what's happening under the hood and how like in the process of building this as I mentioned we were able to create like a model for stronger and like more robust privacy in web 3 so one of the biggest challenges that we face when we're building uh Freedom tool and that like most identity protocols will struggle with is uniqueness so like in the case of voting it's quite intuitive like why you would want to be able to guarantee that users are unique right like you don't want one people or like a bunch of people coming in and just like endlessly voting and corrupting the results um and you know you only need to look at stuff like air drops and like bot farming to get a sense of like how critical uniqueness is for like any identity protocol that's kind of like one of the core characteristics you need to prove but it's extremely difficult to do it and also make it private like you know you're trying to check that somebody is who they says they are and they're not these other people and they're not in the system more than once and yet you can't like you know get access to anyone's personal data in the process so what's happened so far in the space is that almost every other existing framework has found themselves forced to rely on third party attest usually in NPC so in this kind of model say they were using like you know we use passports for uniqueness but say they were using fingerprints you would go you would scan your finger and a nullifier of that fingerprint would be created and then would be like checked against all the other fingerprint nullifiers in the system to make sure you're not the same person like you know voting again and again and then every time you want to prove your uniqueness you would send like a request to the third party and you would ask them to issue a proof of uniqueness and this creates like huge um maybe not huge it creates significant privacy risks um because it means that if someone gets a hold of the Testo or the NPC that's been used they can see specifically what actions the user is participating in and if you are like operating a very highrisk use case like voting in regimes where even participation itself could be criminalized like this was a risk that we felt was too high um and there were also a whole bunch of like other downsides that are associated with this kind of third party attester model so the first is that it's very vulnerable to regulatory interference like you can be fine it can be shut down there can be data requests but I think like even more alarming is that it's not truly decentralized and it's not permissionless so it kind of perpetuates the system that we're all trying to move away from like in identity in web 3 of like users having to ask to issue their identity and having to rely on like somebody else to give it to um and I think like we are in this very nent and early stage of decentralized identity and like these are the risks that are only visible now but if we continue to build on infrastructure and Frameworks that does have third party attests and it's not permissionless it's like there will likely be all kinds of other issues that like stem from that that developed down the line that aren't even like conceivable now so it's like really important we go back to this like core framework and this core model and make sure it is permission and it is um you know truly private and so that is what we did um and we built what we call raros permissionless CK identity registry um so this represents like an entirely new paradigm for issuing identity it completely gets rid of third party testers and instead it lets issue it lets users issue that self-issue their identity so it kind of ends this cycle of dependency um and the sort of like light bulb moment that made us realize a model like this was possible um was when we recognized that like passports are already issued so you don't need to like reissue them a second time and what we did instead is created a system where when you scan in your passport the nullifier of that passport is published on chain and any into the ZK identity registry itself and anytime you like want to prove your uniqueness you yourself can generate a proof of inclusion in this registry like you don't have to go and ask anyone you can just straight away do it and the beauty of the system is not just that it you know gives users agency and control over their identities but it also provides much stronger privacy guarantees because you cannot figure out what activity the user is participating in so even in like the worst case scenario like if someone stole your passport or if like I don't know a tyrannical government got a hold of your passport Keys the most that they would be able to verify is that you're published in the registry they wouldn't be able to figure out what you're doing so like you could be using it to cast votes you could be using it to collect meme coins whatever and we kind of christened this the Privacy as Network effect because the more users in the system and the more apps the more impossible it becomes to make logical deduction about um how users are behaving so yeah stronger privacy self issuance um and this kind of I you know this model that I think like much more closely represents what we're actually seeking with web 3 infrastructure and the real like beauty of this system as well is that it isn't just limited to passports so the passport registry was simply like the first registry that we built and there were all kinds of sub Registries that can sit inside it too so one thing that like we're really focused on at the moment is uh what we call the reputation sub registry and this is where you're bringing the social graph so history of your interactions like your social networks all of that into this model and this is like pretty groundbreaking because traditionally in um the identity space like you've only ever been able to go Anonymous but kind of like one of solutions you haven't been able to store like historical interactions and social relationships in a private but verifiable fashion and this has seriously limited the use cases that you can um you can build like and kind of have privacy with so um with this ZK reputation registry we're seeing all sorts of social apps and experiments with social media happening on top of them um and just to name like a couple we've got um an experiment with um a social media platform that kind of uses history of what you've engaged with and what you've liked to develop new types of algorithms and matching um that's private we've got prediction markets that are using reputation systems to give people scores for having like Rich conversation underneath the markets that they're batting on so the markets don't just become um you know Financial tools but also like homes to really WR dialogue it's kind of like a Reddit meets a betting um platform so there's a lot more to come um this was just like a very basic overview and if you're interested in building in raro or finding more about the project um or if this just like inspired you in any way got to do the slides um you can follow us on Twitter and you can follow me and you can DM me and I'll also be just like floating around the venue for a little bit so um thank you so much for having me and I hope that was interesting [Applause] [Music]