The Wallet Is Ours, Whose Is the Key?

On 27 October 2026 a short measure entered the digital-state section of the Presidential Annual Programme for 2027, published in the Official Gazette: in 2027 a prototype of a national digital identity wallet that will hold identity and diploma documents together will be developed, and it will be tried, in real scenarios of use, at a university whose name has not yet been announced. The priority users are public employees. The institution running the work is the Cybersecurity Presidency. The institution it works with is the Ministry of the Interior. Mehmet Taşnikli's piece in Türk İnternet ties the subject to the right question: when identities and diplomas move onto the phone, under whose control will the data be?

This piece follows that question. First a short summary, then the detail: we separate what has been announced from what has not, we take apart, layer by layer, the infrastructure in Türkiye on which this wallet will be built, we tell step by step how such a wallet works technically, we draw lessons from the examples in the world, and at the end we write the class meaning of this work and what we should demand.

The day the piece is published is not a coincidence. Today, on 1 November 2026, the age limit of 15 and age verification through e-Devlet came into force on social media. The logic of the wallet has entered the daily life of millions of people who use social media, a year before the prototype.

---

In Brief

1. Very little has been announced. A prototype, a pilot university, identity and diploma documents, priority for public employees, and the Cybersecurity Presidency as the responsible institution. The architecture, the standard, where the data will be stored, the log policy, whether it will be compulsory, and the legal basis have not been announced.
2. The infrastructure is ready. 69.8 million registered e-Devlet users, a chipped identity card, identity reading by NFC, biometric remote identification at the banks, and the age token that begins today. The wallet is not being built from nothing. It comes as a layer on top of what already exists.
3. The choice of institution is a choice. The identity wallet will be run not by a population office or a service institution, but by a security institution attached to the Presidency, which at the end of 2025 was also given the tasks of the digital state, the e-Devlet gateway and artificial intelligence in the public sector.
4. A good wallet is technically possible. Selective disclosure, zero-knowledge proofs, keys held on the device, and verification that does not "phone home" can make a design that protects the user. The same technology, with small design choices, can also turn into an infrastructure of tracking.
5. The decisive questions are political questions that look technical. During verification, will the state see who logged into which service? Where will the logs be kept? Will service providers be able to ask for whatever data they want, or will there be a limit?
6. The diploma example is instructive. In 2024 a university administrator's e-signature was copied, and within 29 minutes a fake diploma record was made visible on e-Devlet. The wallet will also sign, flawlessly, a record whose source is corrupt. The problem is not the form. It is the control of the source.
7. The world is splitting in two directions. The EU wrote, on paper, the principles of voluntariness, data minimisation and unlinkability, but gaps in the implementation are being debated. In 2025 China built a national internet identity in which the state sees everything and the platforms see nothing. In July 2026 the United Kingdom stepped back from its plan for a compulsory digital identity.
8. The class core. The history of the identity document is the history of binding the movement of labour power, the crossing of borders and obedience to a record. The digital wallet carries the capacity to spread that record to every transaction, every entry and every verification. That the first test subjects are public workers and students matters for that reason.
9. Our demand is not a ban. It is control. Open source code, an open standard, independent audit, a public impact assessment, no compulsion, a paper alternative, no tracking, and logs that stay with the user.
10. The task. Before the pilot begins, unions, professional chambers, student organisations and computing workers should put these demands into public debate. The prototype stage is the only stage at which the architecture can still be changed.

---

What Has Been Announced, and What Has Not

Almost all of the news rests on the text that Anadolu Agency compiled from the Annual Programme. The programme text stands on the site of the Presidency of Strategy and Budget. The measure in question is in the digital-state section. Türk İnternet reports the measure as number 963.1. Let us set what is known beside what is not:

Announced	Not announced
A prototype will be developed in 2027	The timetable from prototype to general use
At the first stage, basic identity and diploma documents	Whether documents such as a driving licence, health and social security will be added
A test at a pilot higher-education institution	The name of the pilot university, and whether participation will be voluntary
Priority for public employees	Whether use will be compulsory for public employees
The responsible institution is the Cybersecurity Presidency, working with the Ministry of the Interior	Who will write the software, the tender and company structure, and whether the source code will be open
The e-Devlet gateway turning into integrated services, with common payment and identity verification	Whether the data will be held at the centre, on the device, or in both
The 2027 target: 71 million e-Devlet users, 10,000 services, 7,500 mobile services	Where the verification logs will be kept, for how long, and with whose access
Pilot scenarios mentioned in the news: campus entry and exit, identity checks at exams, personnel and authorisation processes	The technical standards to be used (EU alignment, document formats, encryption)
	The legal basis, a personal-data impact assessment, independent audit

This table gives us the first lesson: uncertainty at the prototype stage is normal, but it is not normal for the uncertainty to concentrate in these particular areas. The institution, the timetable and the user group are known. Everything that would protect the user, that is the architecture, the log policy, the audit and the question of compulsion, is uncertain.

In some of the news it is also written that integration with banking, transport and notarial transactions is planned for later (Politikam, ShiftDelete). This part rests not on the official text but on commentary in the news, so it should be read with caution. Even so, the direction is plain: an identity wallet, once built, expands by its own nature towards every transaction that requires verification.

---

The Wallet Is Not Being Built in a Vacuum: Türkiye's Identity Infrastructure, Layer by Layer

To understand the wallet, one first has to see the ground it will sit on. The state's identity infrastructure in Türkiye is one of the densest and most centralised in the world.

The first layer: the population record

At the base of everything is MERNIS, and the Identity Sharing System (KPS) built on it. The 11-digit T.C. identity number is the joining key of almost every record, from the bank to the hospital, from the operator to the cargo company. The cost of this joining key is also known: in 2016 the MERNIS records of about 50 million people were published on the internet. In the years that followed, illegal services sold under the name of "query panels", joining address, family, title-deed and vehicle information, were news again and again. We reached the same point when we wrote The KVKK's Email Decision and the Limit of Workplace Surveillance and When AI Becomes the Boss's Eye: when data is not protected in the state's hands, telling the individual to "be careful" turns into irony.

The second layer: the chipped identity card

The T.C. identity card issued since 2017 carries a contactless chip. The chip holds identity information, a facial image and fingerprint data, and the card can carry an electronic-signature certificate. The chip can be read by NFC. This feature is the basis of the wallet's "enrolment" step: the phone reads the card, verifies that the chip was signed by the state, checks that the card is not a copy, and compares the facial image on the card with the face in the phone's camera.

The third layer: the e-Devlet gateway

According to e-Devlet statistics, as of 30 September 2026 there were 69,759,661 registered users. The total number of logins has passed 28.4 billion, 11.8 billion of them mobile. 207 central public institutions, 207 universities, 557 municipalities and 129 private institutions offer their services through this gateway. According to Biometric Update, in February 2026, 33.9 million users logged in with a password verified by SMS, and 30.9 million with a password envelope. Most access to e-Devlet today is done by methods that are relatively weak in security terms. The wallet also claims to carry identity verification to a "high assurance" level, that is, to the chip and to biometrics.

The fourth layer: financial identity

In September 2026 the Central Bank of the Republic of Türkiye changed the regulation on remote identification for payment and electronic-money institutions (CNBC-e). The identity document will now be read first by NFC, and biometric methods may be used. If NFC fails, optical character recognition or a card reader will come in. The "turn your face to the right, to the left" screens at the banks are the commercial application of the liveness test that we will also meet at the wallet's enrolment step.

The fifth layer: the age token that begins today

The Regulation on the Provision by Social Network Providers of a Separated Service Specific to Children, and on Age Verification, published on 10 October 2026, came into force today. According to bianet, a user opening a new account is directed to e-Devlet, a digital token is produced through the Cybersecurity Presidency, and the platform learns only whether the user is under 15, between 15 and 18, or over 18. The name, the identity number and the date of birth do not go to the platform. Existing accounts will be verified by 31 March 2027. The technical structure of the token has, under article 12 of the regulation, been left to a guide that will be published separately.

This is the first application in Türkiye in which an attribute attestation arranged by the state is offered to private companies at a mass scale. The core logic of the digital identity wallet is exactly this. We drew attention to this gate while reading Thirty-One Points: The Freedom on the Net 2026 Report and the Screen Tied to Identity and while writing The Child-Protection Excuse of Those Who Begrudge Children a Single Meal, and the Surveillance Gate on Social Media. The wallet is the paving of the road that passes through that gate.

The sixth layer: a promise given for a long time

The idea is not new. In January 2023 the then Vice President, Fuat Oktay, announced that citizens would enter e-Devlet with a "blockchain-based digital identity" in an e-wallet application (Webrazzi). The 2025–2027 Medium-Term Programme also promised a "blockchain-based new-generation digital identity management infrastructure" (CNBC-e). In the 2027 programme the word "blockchain" did not make it into the news. This is a good sign: a state has no real need of a blockchain for an identity it issues itself. What is needed is a signature, a trust list and a revocation mechanism. But this also shows that which way the design will turn has not yet become clear. The October 2026 table of eID Easy, which follows the EU wallets, records Türkiye as a project named "Digital Türkiye Wallet", with a developer repository and taking part in wallet interoperability events (eID Easy). The technical teams are watching the EU ecosystem. There is no explanation of this turned towards the public.

---

The Institution Itself Is a Message: the Cybersecurity Presidency

Who runs the identity wallet matters as much as how it will work. The Cybersecurity Presidency was established in January 2025, attached to the Presidency. Cybersecurity Law No. 7545, which became law in March 2025, was criticised at the draft stage above all for the provision of two to five years in prison for the act of "creating the perception that a data leak has taken place", and for powers of search and seizure (bianet). Reporting a leak itself became an area that carries a criminal risk.

With Presidential Decree No. 192, published on 25 December 2025, the Presidency's tasks were widened (bianet, BirGün):

• the institutional architecture of the digital state, and the development of the e-Devlet gateway,
• administrative, financial and technical standards for public computing products,
• artificial-intelligence legislation in the public sector, principles of data governance, and a common data-space infrastructure,
• the establishment of a General Directorate of Public Artificial Intelligence and a General Directorate of the Digital State,
• the power, by presidential decision, to found companies at home and abroad.

Now add the identity wallet to this list. Under the same roof the following are gathered: the identity-verification infrastructure, the public common data space, artificial-intelligence applications in the public sector, cyber-incident response, and a legal frame that can start criminal proceedings in this field. Technically this can be presented as a choice of efficiency. Politically it means defining identity as a security problem. A service institution asks: "How can the citizen use this document most easily?" A security institution asks: "Who did this transaction, when, and from where?" The second question sees the keeping of logs not as a fault but as a duty.

We write this not as an accusation, but as a structural observation. Whatever the institution's intention, an infrastructure is shaped by the priorities of the institution that runs it. That is why our demand, as we will set out below, is for guarantees written into the design itself. A guarantee that rests on the institution's good will disappears when the institution's management changes.

---

A Technical Anatomy: How Does a Digital Identity Wallet Work?

The architecture of Türkiye's wallet has not been announced. But there is a technical language that has settled in this field in the world. The Architecture and Reference Framework (ARF) that the EU prepared for the European Digital Identity Wallet (EUDI Wallet) is the most detailed example. Whichever road Türkiye chooses, it will have to answer the same questions. So let us tell the operation step by step, and at each step note which choice is in whose favour.

Three roles, and one trust anchor

In every wallet system there are three roles:

• The issuer: the institution that gives the document and signs it. For identity, the Population and Citizenship Affairs directorate. For a diploma, the university or the Council of Higher Education.
• The holder: the person who carries the document on their phone, and their wallet application.
• The verifier, or relying party: the party that asks for the document. A campus turnstile, a bank, an employer, a social-media platform, the police.

Above these there is also a trust anchor: trust lists and a certificate authority that decide which issuer's signature will be trusted, and which verifier may ask for which data. The real power of the system is here. Whoever holds the trust list decides who may enter the ecosystem and who may not.

Step 1: enrolment

The user downloads the official application. The phone is brought near the chipped identity card, and the chip is read by NFC. Several checks are made at this point:

• Access control. Access to the chip is opened by a code on the card, or by an encrypted session opened with the machine-readable zone. In passports and in the new identity cards the name of this is PACE. The aim is to make it harder for the card in your pocket to be read remotely, without your knowledge.
• Passive authentication. The data on the chip is signed with the state's digital signature. The application verifies this signature. It is understood that the data has not been altered.
• Active authentication, or chip authentication. Inside the chip there is a secret key that cannot be extracted. The application sends the chip a random challenge, and the chip signs it. It is thus understood that the card is a real chip, not a copied data file.
• Face matching and the liveness test. The camera takes the user's face and compares it with the photograph on the chip. The liveness test tries to understand that what is opposite is a living person, not a photograph or a video.

The first critical question is born here: where are the facial image and the biometric template processed? They can be processed on the phone and deleted. Or they can be sent to a central server, compared there and stored. The first protects the user. The second gives the state a biometric database. In the texts that have been announced there is not a single sentence on this.

Step 2: key generation and binding to the device

The wallet generates a key pair in the phone's secure hardware area (on Android a secure element or StrongBox, on the iPhone the Secure Enclave, and in some designs a SIM card or a remote hardware security module). The secret key never leaves that area. Every document that is issued is "bound" to this key. So even if the document is copied to another phone, it cannot be presented without the secret key.

The second critical question is born at this step: whose approval does device integrity depend on? To be sure that the application is running on "an unaltered phone", the state often uses Google's Play Integrity or Apple's App Attest service. This makes two American monopolies the silent partners of a national identity: if your phone does not pass their approval, your identity may not work either. Those who use a phone based on free software, those with an old device, and everyone in a moment of crisis when services abroad are cut off, carry the risk of this dependence.

Step 3: issuance

The identity and the diploma are sent to the wallet by the issuing institutions. In the EU the protocol for this is OpenID4VCI, an ordinary OAuth flow adapted to the issuance of documents. The identity document (in the EU's name, the PID, person identification data) is issued in two forms:

• SD-JWT VC: JSON-based, suited to remote presentation over the internet.
• mdoc (ISO/IEC 18013-5): binary and CBOR-based, developed in fact for the mobile driving licence, suited to face-to-face presentation, that is, to the turnstile, the police device and the reader at the till.

With Implementing Regulation 2026/1731, the EU wants person identification data to be issued in both forms (Didit's technical comparison). Because Türkiye's pilot scenarios (campus entry, an identity check at an exam) include face-to-face use, a form like mdoc will most likely come onto the agenda.

Step 4: selective disclosure

This is the feature of the wallet that is praised most. Each field in the document (name, surname, date of birth, identity number, address, photograph) is mixed separately with a random "salt" value and hashed. The issuing institution signs not the whole of the document but the list of these hashes. You send a verifier only the "date of birth" field and its salt. The verifier calculates the hash, finds it in the signed list, and understands that the field is genuine. It cannot see the other fields.

One can go further: an answer that says only "yes" to the question "are you over 18?", without ever showing the date of birth. The social-media age token that begins today is a rough version of this logic.

Step 5: presentation

In remote presentation the verifier sends a request (in the EU, the OpenID4VP protocol). The wallet asks the user: "This institution wants these fields. Do you approve?" If the user approves, the chosen fields are sent together with a proof signed by the device key. In face-to-face presentation the connection begins with a QR code or NFC, and the data flows over Bluetooth Low Energy (BLE). An internet connection may not be needed.

The third critical question is born here: who limits what the verifier may ask for? In the EU design, verifiers were supposed to register in advance and receive a "registration certificate" declaring which data they would ask for, and for what purpose. The Austrian digital-rights organisation epicenter.works criticised the Commission's 2025 draft, which made this certificate optional for the member states, as a gate to "over-identification": a social network being able to ask for the same data a bank asks for (netzpolitik.org). If the screen that comes up in front of the user saying "Do you approve?" is the condition of access to the service, that approval is not a free approval.

Step 6: verification and revocation

The verifier checks the signature against the trust list, and looks at whether the document has been revoked. The revocation check can be done in two forms: asking the issuer at every verification "is this document still valid?" (an online query), or downloading a status list that the issuer publishes periodically, carrying the status of thousands of documents in a single compressed list.

The fourth and most important critical question is born here: does the state learn of the verification? In the online-query model, every verification leaks to the issuer the information that "this document is being used there, now". In the literature this is called "phone home". In the status-list model, the issuer does not know who was verified where. This single design choice is enough to turn a wallet from a document carrier into a movement recorder.

Step 7: the log and the dashboard

In a good design, the log of every transaction is kept on the user's device. The user sees from a dashboard which data they gave to which institution and when, sends a request to delete data from there if they wish, and complains from there to the data-protection authority about a suspicious request. The EU's implementing rules make this compulsory. In a bad design the logs are gathered at the centre, and it is the institution, not the user, that sees them.

The problem of linkability

Selective disclosure does not solve everything. When the same document is presented in two different places, if the document's signature, the device's public key or the hash values are the same in both presentations, these two verifiers (or the verifier and the issuer) can recognise the same person when they come together. This is called linkability. The Danish cryptographer Søren Eller Thomsen showed this problem in detail in the feedback he wrote on the EU's first implementing draft (Partisia):

• The ECDSA signatures used in today's standards work like a fixed identifier between presentations.
• Issuing many single-use copies of each document (batch issuance) makes it harder for verifiers to match among themselves, but it does not prevent tracking if the issuer and the verifier cooperate.
• Signature schemes based on a zero-knowledge proof, such as BBS+, can provide real unlinkability, but the secure hardware of phones does not support this mathematics today.

Libraries such as Longfellow ZK, which Google has published as open source, try to close this gap by building a zero-knowledge proof on top of existing ECDSA signatures. The age-verification application that the EU declared "technically ready" in April 2026 also gives the verifier only a yes or no answer, with a zero-knowledge-style proof (Mobile ID World). So a wallet that cannot be tracked is technically possible today. Whether it is built is a choice.

---

Three Architectures, Three Different Worlds

The Türk İnternet piece speaks of three possible architectures: central, device-based and mixed. Let us make the differences concrete:

Question	Central model	Device-based model	Mixed model
Where does the document sit?	On the server. The phone is only a screen	On the phone, as a signed document	The document is on the phone. Verification and logs are split across layers
Does the state see every verification?	Yes. Every transaction passes through the server	It depends on the design. With a status list, it does not	It depends on the design. It generally sees part of it
What happens in a large leak?	All the records and the movement history are at risk together	Individual devices are at risk. There is no collective movement history	If the log layer leaks, the movement history is at risk
If the internet or the server is cut?	Identity does not work	Face-to-face verification continues to work	It works in part
If the phone is lost?	Logging in from a new device is enough	The documents have to be issued again	It depends on the backup policy
The user's control	Low	High	Medium
The state's control	High	Low, but the trust list is still with the state	High

Türkiye's e-Devlet tradition is a central tradition: the document is produced from the centre as a PDF with a barcode, and the verifier asks the centre about the barcode again. This means that every verification leaves a trace at the centre. The name "wallet" does not show that this tradition has changed. An application that puts the document on the phone and asks the centre at every verification can also be called a wallet.

---

The Diploma Example: Garbage In, Signed Garbage Out

One of the pilot's first documents is the diploma. The fight against forgery is shown as the reason. At this point it is necessary to remember what happened last year.

In August 2025 the Ministry of the Interior announced a network in which the e-signatures of officials of the ministry, of universities and of regulatory institutions had been seized by fraudulent means, by entering the e-Devlet system. About 200 people were taken into custody. At least 57 fake diplomas and 108 fake driving licences emerged. The BTK, the Information and Communication Technologies Authority, first cancelled 35 fake e-signatures, then 9 more (Global Voices). In an example that reached the indictment, at 17:20 on 16 August 2024 a university's system was entered, the e-signature of the head of the student-affairs office was copied, and the name and identity number in the record of someone who had graduated in 2004 were changed. At 17:49 the fake record was displayed on e-Devlet as a valid document. Total time: 29 minutes (Yeni Birlik).

This event teaches us the following: the fake diploma was not a fake document. It was a fake record, produced in the real system, with a real signature. A digital wallet takes this record and places it on the phone in a cryptographically flawless form. The verifier checks the signature and finds it valid. The wallet does not prove that the source is true. It proves that the record was not changed after it left the source.

So the solution to diploma forgery is not the wallet. It is the following:

• holding the signature keys in the issuing institutions in hardware security modules, and not leaving them to a single person's authority,
• a record of changes that cannot be altered and can be audited independently,
• access to authorised accounts that is multi-factor and logged,
• rewarding, not punishing, those who report vulnerabilities.

Putting the diploma into the wallet without these being done does not solve the problem. It makes the problem look more trustworthy.

---

Lessons from the World

The European Union: the principle is strong, the implementation is contested

With Regulation 2024/1183, which entered into force in May 2024, the EU obliged every member state to offer at least one wallet by the end of 2026. Institutions in the private sector that require strong authentication, and very large online platforms, have to accept the wallet by the end of 2027 (Wikipedia). The regulation keeps use voluntary, forbids discrimination against those who do not use the wallet, and writes the prevention of tracking and profiling as a principle. But the timetable has slipped. As of October 2026 it is being said that many member states will miss the deadline. Germany's wallet aims at January 2027, and Romania's again at January 2027 (eID Easy). On the privacy side, the debates on linkability and over-identification that we told above continue.

China: let the platform not see, let the state see

China's "National Network Identity Authentication" system entered into force on 15 July 2025. The user has the identity card read by NFC, passes facial recognition, and receives a "network identity" made of random letters and numbers. The platforms do not see the real name and the identity number. The state does. The system is voluntary on paper, but some local applications narrow the alternatives in practice by removing other ways of logging in (Wikipedia, ARTICLE 19).

This example shows that the sentence "the data does not go to the platform" is not, by itself, a privacy guarantee. If the data flows not to the company but to the state, the problem does not disappear. It changes hands. The question that has to be asked while assessing the age token that begins in Türkiye today is exactly this.

India: scale, exclusion and the leak

India's Aadhaar system holds the biometric records of more than a billion people. Two items stand out in the system's balance sheet. The first is exclusion: cases in which poor families fell out of food aid because a fingerprint could not be read, a connection could not be made, or a record did not match, turned into a debate associated with deaths from hunger (Noema). The second is the leak: in 2023 it was claimed that the records of 815 million people had been put up for sale. When an identity system is the only door to a service, every fault of the system closes the door in front of the poorest.

Kenya: it cannot be done without an impact assessment

In October 2021 the High Court of Kenya held that the Huduma Namba digital-identity project was unlawful because it had been put into practice without a personal-data-protection impact assessment. A similar objection later came onto the agenda for the Maisha Namba project as well (Amnesty Canada, Bowmans). The lesson is plain: an impact assessment is not a formality. It is a legal precondition, and it must be public.

Estonia: even in the best, a chip vulnerability

In Estonia, the showcase country of digital identity, a serious vulnerability was found in 2017 in the key-generation library of a chip manufacturer in the identity cards. The certificates of about 750,000 cards had to be suspended and renewed. Even the best design can be shaken by the fault of a single supplier. That is why the source code being open, and independent security researchers being able to inspect the system, is not a luxury. It is a necessity.

The United Kingdom: a step back

In September 2025 the British government had announced a digital-identity plan that would be compulsory on starting a job, and it met intense objection. First the compulsion was softened. Then, in July 2026, it was confirmed that the national identity scheme would not be put into practice (Full Fact). A public reaction can genuinely change architectural decisions.

Country	What did it build?	The basic lesson
The EU	A voluntary wallet, with selective disclosure and many providers	The principle is strong in the text. In implementation, the gaps are closed by struggle
China	A network identity that the state sees and the platform does not	"It does not go to the platform" is not a guarantee
India	A central biometric identity	A compulsory single door excludes the poorest. A leak strikes the whole population
Kenya	A central digital identity	An impact assessment is a legal precondition
Estonia	A chipped card and a digital identity	Open code and independent audit are necessary
The United Kingdom	It withdrew the compulsory plan	A public reaction can change the architecture

---

A Class Reading: What Is Identity a Record Of?

The history of the identity document is not, as it is supposed to be, the history of a service to the citizen. In The Origin of the Family, Private Property and the State, Engels defines the first feature that separates the state from the old social organisation as the division of the people not by kinship but by territory, that is, their being entered in a record. The census, the tax register and the military roll are the first forms of identity. In the Ottoman Empire, the tahrir registers, then the population certificate. In Tsarist Russia, the internal passport that inspected the peasant's leaving the village. In South Africa, the pass books that apartheid made the Black worker carry, and that the police could ask for at any moment. In China, the household registration that still regulates internal migration today. The common point of these examples is this: the identity document has been the instrument of inspecting where labour power can work, for whom, and under what conditions.

This does not mean that the identity document is only an instrument of repression. The record is at the same time the condition of being a holder of a right: a pension, health security and the right to vote work for the person who has a record. The hundred-and-fifty-year struggle of the working class is the struggle to make the record an instrument of the right, not of repression. The question is not whether there is a record. It is in whose hands the record is, under whose control, and for whose benefit it works.

The digital wallet carries the capacity to create a qualitative change in this historical relation. A paper identity is shown from time to time, and it leaves no trace. A digital identity can be used at every transaction, every entry and every verification, and it can leave a log. The act of carrying a document turns into a continuous state of being verified. In this case three class questions become sharp.

In whose hands? The first test subjects are workers and students

The pilot's priority users are public employees, the place of the test is a university, and the scenarios are campus entry and exit, exam checks and personnel authorisation. The wallet's first function will be the record of who entered where, and when, at the workplace and at the school. When we told The Card Around Our Necks, the chipped tracking system at Astor, we examined in detail how the card around the neck turns into a movement recorder. Setting this up by the hand of the state, at the level of an identity document, in the public institution and on the campus, makes surveillance ordinary under the name of "security".

There is also a recent experience in Türkiye of how the identity and personnel records of public employees can be used. Tens of thousands of public workers dismissed by state-of-emergency decrees after 2016 did not only lose their jobs. Their passports were cancelled, and the dismissal codes in their social-security records turned into a practical obstacle to their finding work in the private sector. When identity data, employment data and diploma data are joined in a single verification infrastructure, the application of such a blacklist ceases to be a matter of correspondence. It becomes automatic. That is why holding the diploma, the professional qualification and the identity in the same wallet, bound to the same institution's trust list, also places inside this infrastructure the decision of who can do which job in the labour market.

Under whose control? A security institution and two monopolies

We saw above: the institution that runs the infrastructure is a security institution, and the companies that approve device integrity are Google and Apple. The user's control is limited to the "do you approve?" button that the application offers them. Real control gathers in three places: in whoever holds the trust list, in whoever stores the logs, and in whoever controls the phone's operating system. None of the three is the user. The conclusion we reached when we wrote Whose Eye Are the Glasses? and When AI Becomes the Boss's Eye holds here too: control is in the hands of whoever determines the direction in which the data flows.

For whose benefit? The socialisation of the cost of verification

One of the wallet's largest economic beneficiaries is the banks, the payment institutions, the platforms and the large employers. Every company that today spends money to verify its customer's identity (remote identification, document checks, anti-money-laundering screening) will be able to pass this cost to the state's infrastructure. In the EU, accepting the wallet was defined as an obligation for the private sector. In Türkiye the conditions of this relation have not been announced. While the verification of identity turns into a public service, the question of the conditions, the fee and the data limits under which the companies that produce commercial value from that service will reach this infrastructure is a question of property. If, while society's common infrastructure is being built, the rights of use are opened to capital free of charge or without limit, public investment turns into an input of private accumulation. What we said when we wrote A Common Product Is Not Common Without Common Ownership holds for the digital-identity infrastructure too.

There is this as well: the integration of the e-Devlet gateway with "common payment" and "identity verification" brings identity close to the payment infrastructure. The EU wallet also aims at strong customer authentication and payments. When identity, payment and the public service are joined in a single application, a person's exclusion from this application comes close to their exclusion from economic life.

---

What Should We Demand?

Our stance is not to oppose digitalisation. A class organisation wants the worker to be able to carry their diploma in their pocket, to be able to show their document without waiting in a queue every time, and to be able to see whom their data goes to. But this has conditions. The demands that should be put into public debate before the pilot can be listed as follows:

Architectural guarantees

1. No phone-home. The issuing institution should not learn where and when the document was verified. The revocation check should be done with a status list.
2. Unlinkability. The presentation of the same document in different places should not be bindable to one another. Batch issuance should be the minimum condition. A zero-knowledge proof should be the aim.
3. Minimum data. What should go to the question "is their age over 18?" is not the date of birth, but yes or no. The identity number should go to no verifier unless the law makes it compulsory.
4. Verifier registration should be compulsory. Every verifier should register in advance which data it may ask for, and for what purpose. This register should be public. The wallet should refuse unregistered requests.
5. Biometrics should stay on the device. Face matching should be done on the phone. The biometric template should not be sent to the centre, and should not be stored.
6. The logs should stay with the user. The transaction history should be kept on the device. The user should be able to see it from the dashboard, and use the right to deletion and to complaint from there.
7. No dependence on the monopolies. Device integrity should not be bound only to the approval of Google and Apple. Devices based on free software, and the physical card, should always remain an alternative.

Institutional guarantees

8. Open source and an open standard. The source code of the wallet application, and of the issuer and verifier components, should be published. International open standards should be used.
9. A public impact assessment. Before the pilot begins, a personal-data impact assessment and a threat model should be published.
10. Independent audit. The audit should be done together with academics, professional chambers and civil society, independent of the institution running the work. At the end of the pilot a detailed technical report should be shared with the public.
11. A reward for the one who discloses, not a penalty. Researchers who report a security vulnerability, and journalists who report a leak, should not be under criminal risk. For this, the relevant provision of Law No. 7545 should be changed.

Legal and social guarantees

12. No compulsion. The wallet should not be compulsory for any public service, for starting a job, or for the right to education. The physical identity and paper processes should always remain valid.
13. Not consent at the workplace, but collective bargaining. For public employees, the use of the wallet at the workplace should be set not by a one-sided administrative decision, but by a regulation to which the unions are a party. The use of entry, exit and authorisation logs in discipline and performance assessment should be forbidden.
14. A guarantee against exclusion. An equivalent route of access should be secured by law for everyone who has no smartphone, whose digital literacy is limited, who is elderly, disabled or a migrant.
15. Purpose limitation by statute. The conditions under which wallet data may be used for the police, for intelligence, and for a common data space or for training artificial intelligence, should be limited by law, openly and narrowly.

---

Concrete Tasks

For computing workers:

• When the pilot process begins, inspect every technical document, application package and network traffic that is published, and share the findings in a language the public can understand, with the principles of responsible disclosure.
• When the age-token guide is published, analyse whether the token is linkable across platforms, and whether e-Devlet records which platform a token was produced for.
• Set up a "digital identity technical monitoring group" under the roof of the professional chambers and the computing union.

For public workers and their unions:

• Ask in writing, at the pilot institution, whether use of the wallet is voluntary, and whether the data will be used in discipline and performance processes.
• Carry the limits on the use of digital identity and of entry and exit data at the workplace onto the agendas of the collective agreement and of the institution's administrative board.

For students and academics:

• When the pilot university is announced, ask, through student representative bodies and academic boards, by whom the data of campus entry and exit and of exam checks will be kept, and for how long.
• Form working groups in the computer-engineering, law and sociology departments of the universities that will make an independent assessment of the pilot.

For lawyers and those who work in data protection:

• Prepare applications to the Personal Data Protection Authority asking whether an impact assessment has been made for the pilot.
• Under the right to information, request the legal basis of the pilot, its technical specification, and the information on the institution or company developing the software.

For all of us:

• In the age verification that begins today, use only the official e-Devlet site and application, and do not trust links saying "your account will be closed". Fraud is the first by-product of every new verification obligation.
• Spread this piece, and pieces like it, not as a technical subject, but as a debate about a right: who will know who is where, and when, at the workplace, at the school and in the street.

---

Dear Young Comrades,

Until today you carried your identity card in your wallet, and you showed it only when someone asked. When you showed it, no record was left behind. An identity that moves onto the phone can change this balance. Whether it changes it depends on a few technical choices: will verification report to the centre, with whom will the logs sit, will the data that is asked for be limited, will use be compulsory?

All of these choices are being made today, at the prototype stage. A year from now, when the system is running on the phones of thirty million people, changing these decisions will be much harder. That is why we ask now: in whose hands will this wallet be, under whose control, and for whose benefit?

Technology neither liberates by itself nor enslaves by itself. The same cryptography can produce an age proof that cannot be tracked, and it can keep a ledger that records your every entry. Which of the two is built is decided by who sets the priorities of those who design it. To have those priorities set not by a security institution and two technology monopolies, but by workers, students and society, we have to be organised, to ask questions, and to demand that the answers be public.

The machine is new, the chain is old. But knowing which link of the chain will break, and where, is now in the hands of those who can join technical knowledge with class consciousness. If the wallet is to be ours, the key must be in our hands too.

---