The Regulation You're Being Asked to Draft Will Protect Someone - and Expose Someone Else

Imagine you have been asked to draft the rules for a "right to know the contactor" - a regulation requiring that whenever someone initiates contact seeking your trust, your money or your cooperation, you get to know who they really are.

On paper, this looks like an easy call. Somewhere in India today, an elderly person is being talked out of their savings by a caller pretending to be from their bank or a first-time internet user is clicking a link from someone they have no way of verifying.

A right to know the contactor would close exactly that gap. But your draft regulation does not only apply to scammers. It applies to everyone who initiates contact anonymously - including the whistleblower calling a corruption helpline without giving their name, the domestic-abuse survivor reaching out to a support line from a number that cannot be traced back to them, the citizen tipping off a journalist about wrongdoing in their own department.

Write the rule broadly enough to actually stop sophisticated fraud and you also strip away the one protection that makes it safe for these people to come forward at all. Write it narrowly enough to protect them and you leave the door open for cybercriminals to simply describe themselves as one of the protected categories.

The article that raises this dilemma draws a genuinely useful distinction: privacy is the right not to be contacted or to refuse contact; anonymity, by contrast, is concealing your identity while actively seeking something from someone else - their trust, their money, their cooperation.

That distinction does real work here. It suggests the ethical question is not "should anonymity ever be protected" but "at what point does someone seeking something from you earn you the right to know who they are." A purely deontological reading would say the moment anyone solicits trust or money, they owe the recipient truthful identification - a duty that holds regardless of the solicitor's reasons.

A consequentialist reading asks a harder question: which rule, applied at scale, reduces more total harm - the harm of continued fraud against millions who cannot verify who is contacting them or the harm of exposing the smaller number of people whose safety depends on staying anonymous while they seek help?

The honest resolution is that these two readings point toward different rules depending on what is actually being sought. A right to know the contactor should apply wherever the ask is money, credentials or an ongoing commercial relationship - precisely the situations cybercriminals exploit and precisely where anonymity offers no legitimate protective function.

It should not apply to designated protected channels - whistleblower lines, mental-health and abuse helplines, journalists' tip lines - which need statutory anonymity guarantees, not disclosure requirements, however broad the general rule becomes.

That line is imperfect: some scammers will learn to disguise themselves as protected callers and no regulation removes that risk entirely. But better a rule that names its exception precisely than one that either exposes the people who most need protection or leaves millions of ordinary users permanently unprotected against deception.