Let's Stop Phoning Home

When you're the parent of a teenager out late at night, the prospect of them phoning home might seem reassuring. But that same action—to check in, to report back—is also the dream of every government that wants to monitor its citizens and every company seeking to surveil its customers.

This concern sits at the heart of the No Phone Home movement, which advocates for digital identity systems that don't phone home—that is, digital credentials that do not silently report back to their issuers or some central authority every time they're used. While this kind of telemetry can be marketed as a security or interoperability feature, in reality, it opens the door to a kind of invisible surveillance infrastructure that undermines privacy and individual freedom.

I've added my name as a signatory to the No Phone Home campaign, joining a broad coalition of organizations and individuals who believe that digital identity should serve people, not institutions. The signatories include respected organizations like the ACLU, the EFF, and Brave Software, as well as numerous experts with deep experience in digital identity, cryptography, and privacy advocacy.

Enabling Surveillance...and Control

The phrase "phone home" might conjure nostalgic images of a homesick alien, but in the context of digital credentials, it's far more sinister. When a credential—like a mobile driver's license or digital vaccine certificate—relies on contacting a central authority each time it's presented, it creates a record of where and how it was used. Even if that data isn't stored today, the potential exists. That built-in capacity for surveillance is what the No Phone Home campaign seeks to dismantle.

What's more, the very architecture of phone-home systems inherently concentrates power. It privileges the issuer over the holder, undermining the principles of user control and consent. It's not hard to imagine a world where access to services—buying a train ticket, checking into a hotel, entering a public building—depends on real-time authorization or permission from a government server or corporate backend.

Shoshana Zuboff, in The Age of Surveillance Capitalism, lays bare the business model that feeds off this architecture. Her thesis is chilling: surveillance is no longer a byproduct of digital services—it is the product. As she puts it, "Surveillance capitalism unilaterally claims human experience as free raw material for translation into behavioral data." In this world, "phoning home" isn't a safety feature—it's the toll you pay for participation.

Against that backdrop, the No Phone Home movement demands digital identity architectures where credentials are presented to verifiers without any need to check back with the issuer. This model aligns with the principles of self-sovereign identity and decentralization. It shifts the balance of power, placing control squarely in the hands of the individual.

Systems that Phone Home

Many digital identity systems are designed to contact a central server—typically the issuer or identity provider—whenever an identity credential is presented. This is especially true in federated identity systems, where verifying a token often means checking with the original source. OAuth and OpenID Connect, for example, explicitly redirect the user to the identity provider (IdP) as part of the authentication process. SAML can be more opaque, performing these validations through backend calls that may not be obvious to the user. In all these cases, the result is the same: the issuer is aware of the credential's use, creating a trail of user activity that can be observed, logged, and potentially acted upon.

Some verifiable credential systems can operate similarly, enabling the issuer to learn where and when credentials are used. OpenID for Verifiable Credential Issuance (OpenID4VC), for example, inherits these patterns from OpenID and can allow for issuer visibility into credential presentations. But this is a design choice, not a necessity. For example, the verifiable credential presentation protocol in Anoncreds is designed to avoid these pitfalls, enabling credential verification and even revocation checks without contacting the issuer—preserving privacy without sacrificing trust.

Mobile driver's licenses (mDLs) exemplify how this can go wrong. They feel like physical IDs—familiar, simple, and discreet—but unlike handing over a plastic card, an mDL may rely on server retrieval to validate the credential in real time. This means that governments could know when and where you use your license, and in some implementations, could even grant or deny permission for its use. The result is a powerful mechanism for surveillance, packaged in the form of a seemingly benign, everyday artifact.

The American Association of Motor Vehicle Administrators (AAMVA) has acknowledged the privacy concerns associated with server retrieval mode in mDLs. In their December 2024 Implementation Guidelines (version 1.4), they warned about the tracking potential of this mode. Subsequently, in version 1.5, they prohibited the practice. But, as Timothy Ruff argues in Phone Home is Bad. Really Bad, many systems still support it, and the prohibition is simply a policy choice that could be reversed.

The usual justification for "phoning home" is the need to verify that a credential is still valid or hasn't been revoked. But this function doesn't require building surveillance into the architecture. Cryptographic techniques like revocation registries, signed timestamps, and status lists enable real-time verification without ever contacting the issuer. These methods let verifiers check credential status in a privacy-preserving way, ensuring both trust and autonomy. In fact, this is not just possible, it's already being done. Many projects in the self-sovereign identity space routinely demonstrate how to maintain trust without compromising privacy.

These "phone home" systems risk turning identity into an instrument of control. By embedding surveillance into the plumbing of digital trust, they invert the foundational goal of identity systems: to empower the individual.

Build the Future You Want to Live In

The choice to build digital identity systems that don't phone home is ultimately a choice about the kind of society we want to live in. Do we want a world where every credential presentation creates a record, where silent connections to central servers allow for invisible oversight, and where the potential for control is built into the foundation of everyday interactions?

The No Phone Home campaign isn't just about technical standards—it's about civic architecture. It asks us to reject the logic of surveillance and embrace designs that respect human dignity. As our daily lives increasingly rely on digital intermediaries, we have a narrow window to get this right.

By insisting on architectures that protect privacy by design—not just by policy—we build a future where technology empowers rather than controls. That's a future worth fighting for.