Identification empowers others in unpredictable ways.

The short lesson above explores this idea in depth. In it, I explain why identity isn’t just descriptive — it’s functional. It grants access. And when that access is digitised at scale, it becomes infrastructure.

Another Exposure

In February 2026, cybersecurity researchers revealed that a publicly accessible database linked to identity verification firm IDMerit had exposed close to a billion personal records across 26 countries.

The dataset reportedly included names, addresses, dates of birth, national identification numbers, email addresses and phone numbers — precisely the kinds of details institutions use to verify who you are. The exposure was not the result of a dramatic cinematic hack. It was a configuration failure.

But that’s the point.

When identity becomes digital infrastructure, even an administrative oversight can expose enormous volumes of what I call “life keys” — the pieces of information that unlock access to possessions, services and opportunities.

To understand why this matters, we need to step back.

Identity Is Functional

We often treat identity as something descriptive — a collection of facts about who we are.

But in the digital world, identity is functional.
It is infrastructure.
And it governs access to almost everything we value.

Let me explain:

If I asked, “Who are you?” you might list:

• Your name

• Your age

• Your job

• Your address

• Your beliefs

• Your affiliations

These details do not define you as a human being.

But they are how the world recognises and interacts with you.

That process is identification.

Today, accessing almost everything — online or offline — requires it. Instead of saying, “I am this person,” we prove who we are by presenting a bundle of traits:

• Mother’s maiden name

• Date of birth

• Email address

• Phone number

• Address

• Account history

Your bank’s “security questions” aren't trivia. They are pieces of your identity puzzle used to estimate whether you are who you claim to be.

And that’s the key insight:

Your personal information is not merely descriptive — it is functional.

It acts like a set of keys to your life.

Every time you reveal a detail, you create another copy of a key that unlocks something valuable.

Context Protects Us Offline

In the physical world, context limits exposure.

You behave differently at work, at home, with friends, or with your children. Each setting carries its own expectations. You reveal only what is appropriate to that environment.

You wouldn’t show your passport to get on a roller coaster.
But you would to board a plane.

That contextual separation protects you.

If you casually mention your birthday at a dinner party, you’ve revealed one “life key” — but it’s limited to a friendly audience. It’s scoped. It’s bounded. It likely won’t travel far.

Our instincts usually guide us.

Online, those instincts fail.

The “Bundle of Sticks”

Author Phil Windley describes digital identity as a “bundle of sticks.”

No single stick — your name, your address, your hobby — defines you.

But together, they form something strong.

Individually harmless facts combine into something powerful enough to:

• Impersonate you

• Open accounts in your name

• Reset passwords

• Access financial resources

• Damage your reputation

And here’s the unsettling part:

No one tells us how many sticks it takes to form a complete digital identity — or which ones unlock what.

A hometown tag on social media may seem trivial.
But to your bank, that same detail may function as authentication.

Online, data is borderless and timeless. What you share once can outlive you, recombined in ways you never intended.

The IDMerit exposure illustrates this vulnerability. When identity verification firms aggregate massive volumes of personal data, they create repositories of bundled sticks at extraordinary scale.

Even if no malicious actor exploits the data, the existence of such centralized identity stores creates systemic fragility.

Identity has become infrastructure.

And infrastructure, when exposed, affects everyone connected to it.

Identity Invites Judgment

Identity isn’t just functional.

It is interpretive.

The moment you reveal identifying traits, you invite judgment.

Humans categorise constantly — often subconsciously. Accent, profession, nationality, religion, hobbies — each carries meaning filtered through someone else’s experience and bias.

I once overheard a hiring manager say he wouldn’t interview applicants with Indian-sounding names because of one prior bad experience. His crude filter excluded qualified candidates who had done nothing wrong.

The problem wasn’t just unethical bias.

It was the very act of filtering based on identity.

This dynamic extends far beyond hiring decisions. We see it in:

• Social assumptions

• Credit approvals

• Platform moderation

• Political discourse

• Algorithmic decision-making

Identity is the basis for almost all discrimination — fair or unfair.

When identity becomes the primary gatekeeper to opportunity, interpretation becomes power.

Why This Matters in the Age of AI

As artificial intelligence systems increasingly mediate access — to credit, employment, travel, speech, services — identity becomes the raw input.

Algorithms don’t “know” you. They evaluate patterns in your bundle of sticks.

This means:

• Inaccurate data can harm you.

• Biased interpretations can exclude you.

• Correlations can override context.

Identification replaces trust with credentialed compliance.

And once identity systems become deeply embedded, they are difficult to reverse.

The decisions we make now about how identity functions will shape what liberty means for the next generation.

Privacy as Self-Respect

Pursuing anonymity is not a rejection of society.

It is a recognition that identity governs access.

When identity becomes infrastructure, exposure becomes systemic risk.

And when identification replaces trust with credentialed compliance, liberty subtly shifts.

The IDMerit incident is not remarkable because of its scale alone.

It is remarkable because it demonstrates how fragile centralized identity systems can be.

We are building a world in which identification is required to participate in daily life.

The design choices we make now will shape what liberty means for the next generation.

Privacy, properly understood, is not about hiding.

It is about preserving boundaries.

And boundaries are what make freedom possible.