The Digital Panopticon: Inside the Global Push for Digital Identity

An investigation into the digital identity and CBDC infrastructure being built across 134 countries - and what the documented record tells us about its risks.

Across the globe, a parallel infrastructure is taking shape. One hundred and thirty-four countries representing 98% of global GDP are now researching or developing central bank digital currencies. The Atlantic Council tracks these programs. The Bank for International Settlements coordinates pilot projects. Major defense contractors and private equity firms are positioning themselves as essential providers. This is what the documented record shows.

The stated goals vary by jurisdiction: financial inclusion, payment efficiency, monetary sovereignty, fraud reduction. But the underlying architecture raises documented concerns that merit scrutiny. This is not a story about intentions. It is a story about what has been built, who built it, and what happens when identity infrastructure intersects with financial access.

The Scale of What’s Being Built

The number is striking: 134 countries. The Atlantic Council’s CBDC tracker maintains a live database of these programs, categorizing them by development stage from research to pilot to launch. The tracker shows that whether a nation is rich or poor, developed or developing, the trajectory is remarkably consistent.

In Europe, the European Central Bank has committed €1.3 billion to the Digital Euro project. The contract awards reveal the vendor ecosystem: Giesecke+Devrient secured the offline payments component. Feedzai was selected for fraud management. Almaviva and Fabrick built the mobile application. Capgemini serves as systems integrator. These contracts are public, and they represent substantial commitments from a central bank that has existed for over twenty-five years.

The technical architecture of these systems warrants attention. The Bank for International Settlements has published extensively on what it calls “programmability” - the ability to embed conditions into digital currency. An BIS paper describes money that can be set to expire, restricted to specific merchants, or configured to enforce policy objectives. Whether these features will be deployed is a matter for central banks. That they can be deployed is established in the technical literature.

The question facing policymakers is straightforward: when financial access can be encoded, restricted, or revoked through software, what safeguards exist?

India’s Aadhaar: A Documented Case Study

Before analyzing programs in Europe, the United States, or elsewhere, the most instructive data point is closer at hand. India’s Aadhaar system is the world’s largest biometric identity program, with 1.4 billion enrolled residents. It was launched in 2009 as a mechanism for welfare delivery. What followed is extensively documented.

In Jharkhand, women were denied food rations because they lacked mobile phones for OTP verification. The enrollment process required a mobile number. The distribution system required authentication. When the two did not align, hunger was the consequence. These cases are documented in journalistic investigations.

In Assam, the National Register of Citizens process excluded millions of people from essential services. The burden of proof fell on citizens to demonstrate their existence through documentation. Biometric verification became the gatekeeper. When the database said you did not exist, you did not exist.

In 2018, India’s Supreme Court ruled that Aadhaar could not be made mandatory for private services. The judgment acknowledged concerns about exclusion and the concentration of biometric data in a single entity. But the infrastructure had already been built. The excluded had already been excluded.

The security record is also documented. Between 2018 and 2023, there were 165 documented security incidents involving Aadhaar data. In 2018, investigative journalists reported purchasing Aadhaar data - names, addresses, phone numbers, biometric identifiers - for a small fee. In 2026, reports emerged of millions of records being offered for sale on underground markets. UIDAI disputed that biometric data was compromised. The distinction between types of compromised data is technically meaningful. The consequence for affected citizens is not.

The lesson from India is not that digital identity is inherently bad. It is that when identity infrastructure is deployed at scale without robust privacy safeguards, the documented outcomes include exclusion, data breaches, and the erosion of institutional alternatives. Western nations watching this experiment have the data. Whether they will use it is a separate question.

Who’s Building This: The Corporate Network

The vendors supplying digital identity infrastructure are not无名. They are well-capitalized, well-connected, and in some cases, deeply embedded in defense ecosystems.

Idemia (formerly Morpho, Safran Identity & Security) built the original Aadhaar infrastructure. The company is now owned by Advent International, a US-based private equity firm that has systematically acquired critical infrastructure companies. Advent owns Idemia (biometrics, acquired 2017), Maxar Technologies (satellite imagery, acquired 2023), and Cobham (defense communications, acquired 2020). Idemia’s website describes the company as a leader in identity tech. The acquisition history describes a private equity firm building a vertical stack of surveillance and intelligence capabilities.

Thales Group (Euronext: HO) is a French defense and security company with significant government contracts. ThalesRaytheon Systems, a 50/50 joint venture with Raytheon, holds approximately 40% global market share in air defense command and control systems. The same company produces the secure elements in European e-passports. It also provides hardware security modules for banking and payment systems. The dual-use nature of this capability is not hidden - it is present in annual reports and product descriptions.

R3 is the blockchain company whose Corda platform underpins the majority of CBDC pilot programs worldwide. The company was founded by David Rutter and initially backed by a banking consortium that included major global banks. Today, R3’s Corda platform is used by over 100 financial institutions globally. The entities that control national money supplies are, in many cases, the same entities building the digital currency infrastructure.

Feedzai, selected by the European Central Bank for Digital Euro fraud management, is backed by KKR, one of the world’s largest private equity firms. The company specializes in financial crime prevention - determining, through algorithmic analysis, which transactions are legitimate and which warrant intervention. The same technology that prevents fraud can also restrict financial access. The capability exists. How it is used is a governance question, not a technical one.

The Defense-Digital Pipeline

The structural overlap between defense contractors and digital identity vendors is notable but not coincidental. It reflects business model evolution rather than conspiracy.

Thales makes 72% of its revenue from defense. Idemia emerged from Safran, an aerospace and defense group. Advent International’s portfolio spans satellite intelligence (Maxar), defense communications (Cobham), and biometric identity (Idemia). These companies are not secretly coordinating. They are openly pursuing adjacent market opportunities.

What merits scrutiny is the absence of meaningful separation. The same companies that supply surveillance infrastructure to defense ministries are supplying identity infrastructure to civilian governments. The same technologies used to identify threats in conflict zones are being deployed to identify citizens in peacetime. The market incentives favor expansion into civilian applications. This is documented in segment reporting, investor presentations, and press releases.

The question is not whether this constitutes a conspiracy. The question is whether existing regulatory frameworks are adequate to manage the conflicts of interest that arise when defense contractors become civilian infrastructure providers.

The Human Cost: What the Data Shows

When digital identity systems fail, the consequences are measurable. When financial access becomes dependent on biometric verification, exclusion has quantifiable outcomes.

In the United States, over 77,000 people died from drug overdoses in recent years, according to CDC NCHS data. Over 650,000 people experienced homelessness on any given night, according to HUD estimates. The mortality rate for homeless individuals is significantly higher than the general population. These statistics exist independently of digital identity systems. But if financial access becomes contingent on digital verification, the population experiencing exclusion expands.

In Europe, thousands die annually from drug-related causes, according to the European Monitoring Centre for Drugs and Drug Addiction. In the United Kingdom, hundreds died while homeless in recent years, according to official statistics. The intersection of digital exclusion and these populations has not been studied, in part because the infrastructure is still being deployed.

In India, the excluded number is documented in the millions. The NRC process in Assam excluded millions from documentation. The Jharkhand ration denials affected thousands of women. When your existence depends on a digital identity tied to biometrics, and those biometrics fail to verify, the system’s response is silence. There is no customer service for the undocumented.

What the Implementation Record Shows

The stated promises of digital identity and CBDC programs are reasonable on their face. Financial inclusion is a real need. Fraud prevention saves money. Digital government services can be more efficient. These claims should not be dismissed.

But the implementation record tells a different story. Privacy-preserving architectures are technically possible and have been described in academic literature. Whether they have been implemented in deployed systems is a separate question - and one that security researchers have struggled to answer, because the code is not available for audit.

The European Union’s Digital Identity Wallet is in pilot phase. The regulatory framework (eIDAS 2.0) establishes the architecture. Data localization requirements remain under negotiation. Whether European citizens’ biometric data will be stored on servers in Europe, the United States, or elsewhere is not fully resolved.

In the United States, there is no federal digital identity infrastructure comparable to Aadhaar or the Digital Euro. There are also no federal privacy protections comparable to those in the European Union. The gap between capability and regulation is substantial.

The Bank for International Settlements coordinates these programs without controlling them. Each central bank makes its own decisions. The risk is not global governance. The risk is that national programs, developed independently, happen to share the same corporate vendors, the same technology stack, and the same architectural assumptions about citizen identity.

The COVID Catalyst

Digital identity programs did not begin with the COVID-19 pandemic. But the pandemic accelerated them dramatically.

Contact tracing applications were deployed across continents. Emergency legislation expanded government digital service mandates. Digital vaccine certificates created the architecture for health-based access restrictions. The World Economic Forum published extensively on the relationship between COVID-19 response and digital identity adoption. The forum’s analysis described the pandemic as an “accelerant” for digital identity deployment.

By 2020-2022, programs that would have taken a decade were deployed in months. The public health emergency provided legitimacy for measures that would have faced scrutiny under ordinary circumstances. The infrastructure remains. The emergency provisions, in many cases, have not been repealed.

What’s Known and What’s Not

The documented record establishes several things with reasonable certainty.

One hundred and thirty-four countries are developing or deploying CBDC programs. The vendor ecosystem includes defense contractors, private equity-owned biometrics firms, and banking consortia. India’s Aadhaar program produced documented cases of exclusion and data breach. The technical capability for programmable money with restrictions exists and has been described in central bank publications.

What is not established: whether these capabilities will be deployed, under what circumstances, or with what safeguards. Privacy-preserving CBDC architectures have been proposed. Security audits of deployed systems have not been made public. Biometric failure rates in deployed systems are not published. Defense-to-identity cross-subsidization is not documented because it would require access to proprietary pricing data.

The appropriate response to this gap is not suspicion. It is transparency. The burden of demonstrating adequate safeguards should rest with the implementers, not with the citizens who will depend on these systems.

The Path Forward

The infrastructure is being built. Whether it includes meaningful privacy safeguards, audit rights, and fail-safes for the excluded is a question that remains open.

Citizens can demand transparency. Journalists can investigate the vendor contracts. Policymakers can require security audits before deployment. Regulators can impose data localization requirements. These are not radical proposals. They are the baseline expectations for infrastructure that will determine whether hundreds of millions of people can access financial services.

The documented record from India shows what happens when digital identity is deployed without safeguards. The documented record from Europe shows the vendor ecosystem that is positioning to supply the same infrastructure globally. The documented capability of programmable money shows what is technically possible.

What happens next is not predetermined. But the direction of travel is clear, and the historical evidence from similar programs is available for those willing to read it.

Sources

• 1 Atlantic Council CBDC Tracker - https://www.atlanticcouncil.org/cbdctracker/

• 2 ECB Digital Euro - https://www.ecb.europa.eu/euro/digital_euro/html/index.en.html

• 3 BIS Report on CBDC Programmability - https://www.bis.org/publ/othp89.pdf

• 4 Scroll.in: Apps and Anganwadi exclusion - https://scroll.in/article/1092864/

• 5 Supreme Court of India: Puttaswamy v. Union of India (2018) - https://main.sci.gov.in/supremecourt/2017/41248/

• 6 Idemia Official Website -

https://www.idemia.com/

• 7 ThalesRaytheon Systems - https://www.thalesgroup.com/en/what-we-do/thalesraytheon-systems

• 8 R3 Official Website - https://www.r3cev.com/about

• 9 Feedzai Official Website -

https://www.feedzai.com/

• 10 CDC NCHS Overdose Data - https://www.cdc.gov/nchs/nvss/drug-overdose-deaths.htm

• 11 HUD Community Planning - https://www.hud.gov/program_offices/comm_planning/

• 12 EUR-Lex: eIDAS 2.0 Regulation - https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32021R1213

• 13 World Economic Forum: COVID-19 and Digital Identity - https://www.weforum.org/agenda/2020/06/covid-19-digital-identity-travel/

• 14 BIS Press Release - https://www.bis.org/about/press_rel.htm?pr=297