A public service has to know enough to act fairly. A transit program must prevent duplicate passes, an election must count eligible ballots once, and a housing office must distribute a scarce benefit according to published rules. Yet the state or contractor does not thereby acquire a right to map every movement, association, purchase, or prayer. Public infrastructure becomes dangerous when proving eligibility is treated as permission to retain a complete portrait of the person.
Privacy-preserving infrastructure answers a smaller question with a smaller disclosure. Its goal is not to make public systems unaccountable or perfectly anonymous. It is to combine integrity with proportion: accountable issuers, valid and revocable credentials, unlinkable routine use where identity is unnecessary, public audit of rules and outcomes, offline access, and a human remedy when the system is wrong. The cryptography matters, but so do the institutions around it.
Start with a civic decision
Every service should write down the decision it must make, the legal authority for making it, and the minimum fact needed. A museum may need to know that a visitor is eligible for a resident discount, not the visitor's address. A bus validator may need to know that a concession pass is currently valid and has not exceeded its daily use, not the rider's name and route history. A polling place needs eligibility and ballot integrity, not a database connecting a voter to a choice.
This purpose map becomes a data-flow map. It names the issuing office, holder, verifier, service operator, status service, recovery authority, and auditor. It records what each learns during enrollment, presentation, failure, recovery, and complaint. It includes metadata: IP addresses, timestamps, device identifiers, geolocation, payment records, and the ability of two agencies to join their logs. A claim that a system is private is incomplete until these ordinary pathways have been considered.
A civic credential architecture
Imagine a municipal “civic pass” used for transit, library access, and benefits. The civil registry or authorized benefit office is the accountable issuer. It verifies eligibility under a published rule and issues a credential to a wallet, card, or staffed service desk. The credential contains only the attributes needed by named services and has a validity period, issuer signature, policy version, and status reference. Each service receives a purpose-specific presentation, not a copy of the enrollment file.
For ordinary transit, the rider presents a fare entitlement through a pairwise or anonymous mechanism. The validator learns “valid concession pass” and a bounded-use token; it does not learn a civil identity or build a durable journey history. A separate abuse-control mechanism can prevent the same entitlement from being used twice in a prohibited interval without exposing all legitimate rides. If an investigation must connect a serious, defined fraud pattern to an account, a designated authority uses a documented, reviewable process. Routine operations never silently make that exceptional power universal.
Eligibility and integrity together
Privacy is not a license to accept forged claims. Issuers use protected keys, hardware and operational controls appropriate to the risk, and publish key-rotation and compromise procedures. Verifiers check issuer authorization, credential freshness, audience, and status. A service rejects a credential outside its purpose instead of treating a valid signature as a universal pass. Independent auditors can inspect the issuance policy, software version, aggregate usage, and exception decisions without receiving everyone's personal transactions.
The same separation applies to elections. An eligibility office can issue an anonymous voting authorization after a voter is checked against the roll. The polling system accepts one valid authorization, keeps the ballot unlinkable from the voter, publishes a verifiable tally and audit evidence, and provides a paper or otherwise independently auditable record. No privacy protocol repairs a corrupt roll, inaccessible polling place, coercion, poor chain of custody, or an election authority that refuses scrutiny. Integrity includes the whole civic process.
Minimum disclosure and unlinkability
A credential should support selective disclosure. If a rule asks whether someone is over a specified age, the verifier should receive the age predicate, not a birth date and home address. If a benefit requires a household threshold, a qualified agency may verify the threshold while a downstream vendor receives only the resulting entitlement. Different services should use different identifiers so a library cannot automatically join a person's reading record to a transit record.
Unlinkability has a threat model. A pairwise identifier can still be linked by a rare attribute, a repeated timestamp, a payment card, an IP address, a camera, a shared device, or a verifier that demands a phone number alongside the credential. Services should minimize logs, separate operational databases, aggregate public reporting, and explain which actors can correlate events. Privacy is defeated by policy and metadata as readily as by a broken cryptographic primitive.
Revocation and changing facts
Eligibility changes: a license expires, a benefit ends, a card is stolen, or an issuer key is compromised. The status design should let a verifier reject a credential without exposing the holder's entire history. Short-lived credentials, privacy-preserving status lists, or periodically refreshed tokens have different availability and freshness tradeoffs. A public agency must state whether it prefers a temporary inability to verify, a short window of stale acceptance, or additional disclosure for a real-time check.
Revocation needs due process. An administrative correction should not silently turn a person away at a gate. Notify the holder when feasible, explain the reason and effective date, provide a replacement or paper route, and preserve an appeal. Status systems must distinguish expiry, voluntary cancellation, suspected compromise, and a finding of fraud. Otherwise a technical “invalid” response becomes an accusation that no one can challenge.
Access beyond the ideal smartphone
A public credential that requires a modern phone, continuous data, a charged battery, a camera, or fluent English is not neutral infrastructure. Offer smart cards, printed recovery codes, staffed kiosks, telephone assistance, and a paper process with equivalent entitlements. Let a trusted delegate help without taking permanent possession of the person's data. Design for screen readers, captions, large text, motor impairments, low literacy, language differences, and people who cannot safely use a shared device.
Offline access requires clear boundaries. A validator can accept a signed short-lived token and synchronize a bounded anti-fraud record later, with a policy for conflicting updates. Emergency access should not be denied because a network outage prevented status checking. At the same time, offline tokens need expiry, key protection, rate limits, and replacement after loss. The fallback must not be a second-class queue that publicly marks someone as suspicious.
Public audit, accountable issuers, and remedies
Public confidence requires more than a vendor's security certification. Publish the rules, data categories, threat model, retention schedule, key authorities, software versions, procurement contracts, accessibility tests, aggregate error rates, and independent audit reports. Let civil-society organizations and affected communities inspect assumptions. Explain a denial in words a person can understand, not only with an error code. Procurement should preserve the agency's ability to export, migrate, and audit data rather than creating a permanent proprietary gatekeeper.
Issuers remain accountable for bad facts. A signed credential proves a relationship to an issuer; it does not prove that the issuer investigated competently or applied a just rule. The agency needs correction, restoration, and compensation procedures. A verifier that stores an unnecessary copy can be sanctioned. A contractor that correlates presentations for advertising or policing outside its authority should lose access and face appropriate legal consequences. Exceptional identity disclosure requires an identified official, a defined threshold, independent authorization, a log, notice when lawful, and post hoc review.
Anti-fraud without a surveillance default
Fraud controls should target the abuse in question. One-person-one- benefit may use a single-use authorization or bounded nullifier; credential theft may require device recovery and issuer confirmation; forged documents may require an in-person enrollment channel. A global device fingerprint, permanent location trail, or biometric database may reduce one risk while creating a far larger capability for abuse. Test false positives across disability, age, language, housing, and connectivity conditions. When confidence is low, route a person to a human reviewer rather than treating technical failure as guilt.
Objections and safety boundaries
“Anonymous use makes enforcement impossible.”
It makes some forms of enforcement less convenient, which is the point. Routine service does not need to identify everyone. Bounded rate limits, auditable issuers, one-use authorizations, and a narrowly governed exceptional disclosure process can address defined abuse. If the agency cannot name the abuse, legal authority, and review threshold, it should not collect identity “just in case.” Serious investigations can remain possible without making every ordinary ride or benefit claim a permanent dossier.
“A centralized registry is cheaper and more accurate.”
Centralization may simplify operations and can be appropriate for some authoritative records. The concern is not that every database must be distributed. It is that every verifier should not gain unnecessary access to the central record, and that one compromise should not expose every service. Role separation, minimal views, independent audits, retention limits, and offline alternatives can improve a centralized design. Decentralization is not a substitute for accountable administration.
“Privacy harms the common good.”
Privacy can protect participation, conscience, family life, political association, and safety. There are legitimate public duties to investigate harm and allocate resources fairly. The proper answer is proportional authority: collect what the public purpose requires, restrict secondary use, protect confidential sources, and make exceptional access reviewable. A population that must reveal everything to obtain ordinary services is not more solidaristic; it is more vulnerable to whoever controls the archive.
Unlinkability is therefore a service-specific choice, not a universal promise. For benefits, transit, health, and elections, name the asset, adversary, error tolerance, emergency threshold, and recovery path: some investigations or duplicate-use controls cannot be performed from an unlinkable transaction alone. Exceptional disclosure should require dual authorization, a logged purpose, later review, and compensation or correction when it causes harm. Pilot the credential alongside paper, staffed, offline, and low-literacy routes, measuring false rejection, recovery time, accessibility, correlation leakage, duplicate detection, and appeal outcomes. In voting especially, privacy credentials do not replace voter-verifiable paper, transparent administration, or safeguards against coercion; they address only a bounded part of the trust problem.
Catholic social judgment
Gaudium et Spes 26 defines the common good as social conditions that allow persons and groups to reach fulfillment, and 27 calls for respect for every human person. The Catechism treats privacy, a good name, and the inviolability of conscience as real goods (CCC 1782, 1905–1912, 2477–2492). Quadragesimo Anno 79–80 grounds subsidiarity: a higher authority should support, not absorb, the responsibilities that lower communities can carry. These principles do not dictate a credential protocol, but they reject both total legibility and private gatekeeping without remedy.
Catholic public design also requires solidarity. A privacy feature that works only for the technologically confident excludes the poor, the elderly, migrants, people with disabilities, and those in crisis. Participation means accessible alternatives and a voice in the rules. Human dignity means a benefit recipient is not merely a fraud risk, and a voter is not merely a row in a roll. Technical systems should support prudent administration while leaving responsible officials answerable for the people affected.
Sources and qualifications
Technical sources include David Chaum, “Security without Identification: Transaction Systems to Make Big Brother Obsolete,”Communications of the ACM 28, no. 10 (1985), 1030–1044; the W3C Verifiable Credentials Data Model 2.0; NISTDigital Identity Guidelines SP 800-63-4; and the OECDGuidelines on the Protection of Privacy and Transborder Flows of Personal Data (2013). Election integrity should also be judged against the National Academies, Securing the Vote (2018), especially its recommendation for voter-verifiable paper records. These sources describe design and governance practices, not a promise that any implementation is secure.
Legal qualifications matter. The GDPR principles of lawfulness, fairness, transparency, purpose limitation, data minimization, accuracy, storage limitation, integrity, and accountability appear in Article 5, with rights to rectification and erasure in Articles 16–17 and safeguards around solely automated decisions in Article 22. The Americans with Disabilities Act, Section 504 of the Rehabilitation Act, and accessibility standards such as WCAG 2.2 may apply in relevant services. Catholic claims draw on Gaudium et Spes 26–27,Quadragesimo Anno 79–80, and CCC 1782, 1905–1912, and 2477–2492. This essay is not legal advice; duties vary by jurisdiction.
Synthesis: public trust needs public restraint
Privacy-preserving infrastructure is not a magic anonymity layer. It is a chain of choices: an accountable issuer asks a limited question, a holder presents the smallest useful claim, a verifier checks integrity for one purpose, and a status service handles change without exposing a life history. Anti-fraud controls are specific and proportionate. Offline and accessible paths prevent privacy from becoming an elite feature. Audits expose the rules, while remedies let a person challenge an issuer, verifier, or automated denial.
The public square is safer when institutions can verify what they are entitled to verify and no more. That restraint is not administrative weakness. It protects conscience, participation, and the possibility that a person can receive a public good without consenting to permanent observation. Integrity and anonymity, where appropriate, are not enemies: both are parts of a civic order in which power serves persons and remains answerable to the common good.
Source Notes
The Council’s account of the common good, participation, and respect for every person in public institutions.
The original technical proposal for privacy-preserving transactions and unlinkable use without making public systems unaccountable.
A standard model for issuer, holder, verifier, selective disclosure, and purpose-bounded credentials.
Risk-based guidance for identity proofing, authentication, federation, and assurance in public-facing services.
International privacy principles for collection limitation, purpose specification, use limitation, safeguards, participation, and accountability.
Authoritative election-security guidance emphasizing voter-verifiable paper records and the limits of technology alone.
Editorial revision note
This essay completed one self-editing, cross-essay consistency, and strongest-criticism pass. Its controlling thesis was preserved while objections, qualifications, evidence limits, and practical consequences were strengthened.