What a bot can't fake

What a bot can't fake

Somewhere in the last two years, the internet stopped being mostly human. Imperva's Bad Bot Report put automated traffic at 51% of all web traffic in 2024, with the share still climbing since. That is one security vendor's telemetry, so hold the exact number loosely, but the direction is not in dispute. More than half of everything moving online is not a person.

You have felt it even if you have not measured it. The follower who is not real. The review written by nothing. The profile photo of someone who has never existed. The reply that reads almost right. Every year the fakes get cheaper and the tells get fewer, and every system built on "prove you are human" is quietly losing.

The people building the machines know it. In 2024, 32 researchers from OpenAI, Microsoft, Harvard, MIT and others published a paper on personhood credentials: privacy-preserving ways to prove there is a real human behind an account. When the builders of the flood start designing lifeboats, take the water level seriously.

The best-funded answer so far scans your iris in exchange for cryptocurrency. It has been banned or suspended in several countries, and the critics' core objection is hard to shake: an iris cannot be reissued once it leaks, and paying people, disproportionately poor people, to hand over biometrics is a grim foundation for identity. Your body should not be your password.

Now let me tell you about Tuesday nights.

Every Tuesday, at thousands of clubs across the country, a kid turns up to training. A coach who knows her sees her arrive. Teammates who know her warm up next to her. A parent stands on the touchline in the drizzle. Somebody marks the register. She trains, in a real body, in real weather, witnessed by real people who would notice instantly if someone else turned up claiming to be her.

That is identity verification. In person, continuous, repeated weekly, performed by a community rather than a corporation, and free. Sport does this at a scale and frequency no government scheme or biometric start-up can touch, and it has been doing it for a century without once calling it identity infrastructure.

A bot can fake a profile. It can fake a photo, a voice, an essay, increasingly a video call. It cannot fake standing on a pitch in the rain in front of twenty people who know it, week after week, season after season. Presence, witnessed and repeated, is the one credential the machines cannot mint.

Here is the idea I keep coming back to. Proof of personhood is the wrong target, because it is static: verify once, then trust a token forever, however it was obtained. What sport offers is proof of active personhood. Verified by showing up. Attested by the people around you, your coach, your club, your culture. And recharged by participation, because the credential is not a scan of your eyeball, it is the living record of you turning up. Stop participating and it fades, exactly as trust does in the real world.

Think about what that inverts. Every other identity system extracts something from you: your document, your face, your iris. This one is generated by the most human thing you do, playing sport with other people, and it strengthens the community that issues it instead of strip-mining it. The kid does not do anything extra. Her Tuesday nights were already the proof. Nobody was treating them as one.

I am not claiming this replaces passports, and I am deeply wary of anyone trafficking identity for profit; that is precisely the business we refuse to be in. But as the synthetic share of the internet keeps rising, the places that can still say "every account here is a real, present, witnessed human" will become the most valuable rooms online. Sport owns the mechanism to say it, at global scale, and barely knows it.

The internet forgot what a person is. Sport never did. It checks, in person, every week, and calls it training.

I am writing the full thesis up as a paper called Proof of Human. It will be at shotclubhouse.com.