7 under police probe for allegedly buying and selling Worldcoin accounts

Source: Straits Times
Article Date: 16 Sep 2024
Author: Wong Shiying

Launched in July 2023, the Worldcoin project involves capturing users’ biometric data by getting them to stare into a silver orb found in many cities in the world, including Singapore.

The police are investigating seven people for their suspected involvement in offering the service of buying and selling accounts and tokens related to a biometric cryptocurrency project.

Worldcoin, a cryptocurrency project co-founded by OpenAI chief executive Sam Altman, allows users to scan their irises in exchange for a digital ID and free tokens.

In a written parliamentary reply on Sept 9, Deputy Prime Minister Gan Kim Yong said Worldcoin does not perform a payment service under the Payment Services Act, according to information from the Monetary Authority of Singapore.

“However, persons who buy or sell Worldcoin accounts and tokens as a business may be providing a payment service,” he said, adding that this may constitute an offence.

Launched in July 2023, the Worldcoin project involves capturing users’ biometric data by getting them to stare into a silver orb found in many cities in the world, including Singapore.

The data can then be used to verify accounts on platforms, such as Discord and Shopify, to distinguish humans from bots and artificial intelligence.

The Straits Times in July reported that people had been queueing at the basement of GR.iD shopping mall in Selegie Road to have their eyes scanned as part of the registration process for their Worldcoin accounts.

Many in the queue were migrant workers who seemed to be following the instructions of some “agents”, who did not appear to be directly affiliated to Worldcoin.

A migrant worker told ST that each of them was paid about $45 in cash in exchange for handing over control of their newly created Worldcoin accounts and tokens to the agents.

The police said on Aug 7 that five people, comprising four men and a woman, were arrested for allegedly offering the service of buying and selling Worldcoin accounts or tokens belonging to others.

ST understands the five suspects are among the seven people under investigation who were mentioned in DPM Gan’s parliamentary response.

In a separate written parliamentary reply on Sept 9, Minister for Digital Development and Information Josephine Teo said the Personal Data Protection Commission (PDPC) has been engaging Worldcoin on its obligations under the Personal Data Protection Act (PDPA).

She said the PDPC will continue to monitor Worldcoin’s collection, use and disclosure of personal data, including biometric data.

“The PDPC may take enforcement action against organisations in Singapore that are found to have breached their obligations under the PDPA,” said Mrs Teo.

She added that the PDPC worked with the Ministry of Manpower to disseminate notices to migrant workers to raise awareness of the importance of keeping their personal data safe.

Unlike passwords or other tokens, Mrs Teo said, biometric data cannot be changed once compromised as it is generally unique.

She added: “Stolen biometric data can therefore be misused by malicious actors to spoof an individual’s identity – in order to access information or systems, or conduct scams or other fraudulent activity.

“Such misuse is harder to defuse because biometric data cannot be changed.”

Mrs Teo said organisations that handle such data must ensure they put in place the necessary data protection and security arrangements to address these risks when designing and operating their systems and processes.

They must also obtain consent from consumers before collecting their data by giving all necessary information in a manner that is understandable to the consumer.

Several countries – including India, Kenya, Spain and Portugal – have reportedly clamped down on the Worldcoin project over privacy concerns.

The Hong Kong authorities raided six Worldcoin Orb operators in January, and in May ordered Worldcoin to cease all operations there, citing risks to privacy and personal data.