The Right to Help: The Secret Ballot, the New Membership List, and the Architecture of Freedom

I. The $21 Receipt

The payments were small. The consequences were not.

On August 24, 2026, a Moscow court gave Leonid Stepanov a four-year suspended sentence for financing an organization that Russian authorities had designated extremist. According to Mediazona’s courtroom reporting, the prosecution concerned two transfers to Alexei Navalny’s Anti-Corruption Foundation in August 2021, totaling 1,532.43 rubles. Meduza put their value at approximately $21 at the time. Stepanov worked as a programmer at an organization under Russia’s communications regulator. ^[1]

The qualification matters: the charged transfers followed the ban. This was not a case in which an innocent-looking payment was retrospectively criminalized by a designation that came later. Nor was the sentence four years of immediate imprisonment. What the reporting establishes is narrower, and sufficient: two modest contributions became the subject of a criminal judgment five years after they were made. It does not establish the full investigative route by which the payments were first identified. ^[1]

A transaction has several lives. It moves purchasing power between two parties. It may also record a connection between them. And, when preserved, it leaves something that a future observer can interpret, investigate or use against either participant.

That second life is the subject of this essay. A payment system can function exactly as designed while creating dangers for the relationships it carries. Nothing need be frozen. No transfer need be reversed. The money can arrive, and the exposure can remain.

Our earlier Human Chokepoint analysis asked what happens when people are excluded from economic participation. Here the question begins one step earlier: what happens when the possibility of being identified makes people afraid to participate at all?

The distinction is between permission and practical freedom. Being able to help someone is not the same as being able to help without accepting unnecessary exposure for everyone involved. Long before digital money, a civil-rights organization made that distinction impossible to ignore.

II. The List Alabama Wanted

In the 1950s, Alabama sought records from the National Association for the Advancement of Colored People as part of proceedings challenging its operations in the state. Among the materials demanded were the names and addresses of its Alabama members. The NAACP supplied other information but resisted surrendering its membership lists. The dispute reached the United States Supreme Court. ^[2]

In June 1958, the Court ruled that compelling disclosure in those circumstances would impermissibly burden freedom of association. The record described economic reprisals, lost employment, intimidation and threats of violence against people whose connection to the organization became known. Exposure could cause members to withdraw and others to decide against joining. ^[2]

The list was dangerous because it connected individuals to a collective purpose. It could make each person answer, separately and vulnerably, for a commitment they had undertaken together. The danger did not depend exclusively on punishment by the state. An employer, a hostile neighbor or a private adversary could impose consequences of their own.

This is a different understanding of privacy from the familiar image of a person retreating from society. Here confidentiality protected the ability to enter society: to join, contribute and act alongside others. Privacy sustained a public movement by shielding some of the people who made its public action possible.

The case also reveals why disclosure is not a neutral preliminary step. Once names have been collected and exposed, a promise of subsequent fairness may arrive too late. The burden can begin when the person contemplating membership asks whether joining will endanger a job, a home or a family.

The analogy to digital finance must remain precise. A donation is not necessarily a membership fee, and a payment does not establish agreement with everything a recipient believes. The Russian prosecution and the American constitutional judgment belong to different legal and political settings. They should not be flattened into interchangeable stories.

Their shared question is nevertheless recognizable: what protection does association retain when its participants can be singled out through the records of their support?

A formal register is only one way to answer the question of who belongs. A collection of transactions may sometimes offer another. The membership list can be reconstructed rather than surrendered.

III. The Secret Ballot Paradox

Democracy makes an extraordinary choice at the voting booth. It asks society to accept a collective result while protecting each person’s contribution to that result from ordinary inspection.

The Universal Declaration of Human Rights places secret voting within its account of democratic government. Elsewhere it protects privacy, freedom of conscience and peaceful association. These are distinct provisions, but together they reject the idea that participation in public life must entail complete personal visibility. ^[3]

International IDEA’s guidance explains the practical purpose of ballot secrecy: voters should be able to choose without fearing that their preference will be revealed and bring retribution. A private choice is not an obstacle to a legitimate election. It is one of the conditions that helps make the election legitimate. ^[4]

The paradox appears when that voter leaves the booth. The preference protected inside may find expression outside through a subscription, a donation, a meeting or support for a person pursuing the same cause. Those activities can leave records through which an observer might infer the commitment the ballot concealed.

There is no simple legal equivalence between voting and giving money. A vote is formally equal to other votes. A large financial contribution can purchase access or amplify one person’s influence far beyond that of another. Public reporting and meaningful oversight therefore have an essential role in political finance. The secret ballot is a starting point for the question, not an answer to every disclosure dispute.

Its deeper lesson is architectural: accountability does not require every participant to be visible in the same way. We can scrutinize procedures, institutions and collective outcomes while protecting certain individual choices.

Why should that possibility disappear as soon as the choice takes financial form? Why should the ability to verify that an organization used its resources properly automatically require public access to the identities of everyone who helped it?

The challenge is not to reproduce the voting booth around every payment. It is to take seriously the principle the booth embodies: some forms of independence require a protected space between a person’s conviction and another person’s power to retaliate.

IV. The Power Between People

Hannah Arendt offers a more demanding account of what is at stake. Political power, in her work, arises when people act together. It cannot be reduced to an individual’s determination or a government’s capacity to compel obedience. It depends on plurality: people who appear before one another, deliberate, make commitments and sustain a shared course of action. The political world is not composed of isolated voices alone; it is made through relationships among them. ^[5]

Arendt was not advancing a theory of cryptocurrency or donor anonymity. The extension here is our own. Acting in concert has material conditions that philosophical descriptions can leave in the background: people need time away from work, meeting places, legal assistance, communications and the means to sustain an effort when public attention moves elsewhere. An idea may be expressed in a moment; an association must endure through many moments.

Consider an independent newspaper. The formal right to publish does not pay reporters or defend them in court. A legal-aid group needs more than permission to contest an arrest: it needs someone willing to cover the work. These acts of support are not substitutes for civic action. They are among the conditions that allow civic action to continue.

International human-rights language already recognizes part of this connection. Article 13 of the 1998 Declaration on Human Rights Defenders affirms the ability to solicit, receive and use resources for the peaceful promotion and protection of human rights. The declaration is not itself a binding treaty; OHCHR explains that its principles draw on rights contained in binding international instruments. It does not create a universal exemption for every donation or an unconditional right to anonymous finance. ^[6]

What it does establish is that resources are not an embarrassing commercial appendage to civic freedom. For peaceful human-rights work, obtaining support belongs within the discussion of rights themselves.

The right to help, as this essay uses the phrase, is therefore a principle for evaluating the conditions of lawful civic support, not a newly discovered, unlimited legal entitlement. It asks whether a person can meaningfully sustain another person or a peaceful association without disproportionate interference, unnecessary identification or avoidable retaliation. That question is relevant even when no one has blocked the payment.

As a practical test, the principle favors safeguards against indiscriminate collection, unnecessary publication and later misuse of information about ordinary supporters. It also asks who truly needs disclosure, for what purpose, and under what safeguards. It does not exempt political financing from proportionate oversight, excuse hidden purchases of influence or make all donor identities categorically secret. Those competing obligations become central later in this article.

Privacy can protect that relationship without requiring a movement to disappear. A campaign may need a visible spokesperson, a public argument and an accountable governing body. It does not follow that every sympathetic teacher, family member or small donor must accept the same degree of exposure as its leaders.

Indeed, public courage can depend on private solidarity. Someone willing to stand openly against an abuse may be sustained by people who cannot safely stand in the same spotlight. Protecting those supporters need not weaken public life. It may be what allows public life to become possible.

Public courage can depend on private solidarity.

V. The New Membership List

The modern membership list need not contain a field called political affiliation. Relationships can become visible through information collected for other purposes.

It is important to separate the sources. A bank’s internal records are not the same thing as a public blockchain. A recipient’s donor register is not the same thing as an exchange’s identity files. Combining them requires access, compatible information and an attribution that may or may not be correct. Calling all of this simply surveillance can conceal the very differences that determine the risk.

Bitcoin’s own privacy guidance makes one boundary explicit: transactions are public and durable, while the identities associated with addresses may become known through other information. Pseudonymity is not equivalent to publishing a name with every payment, but neither is it the same as keeping the transaction confidential. ^[7]

Analytical comparison, not a claim that one observer has access to every source or that every inferred connection is correct.

A 2015 study in Science illustrates how revealing limited financial metadata can be. Researchers examined three months of pseudonymized credit-card records covering 1.1 million people. With four pieces of outside information about where and when a person had made purchases, they could single out that person’s record within the study dataset in 90% of cases. That is a finding about reidentifiability through matching, not proof that four observations automatically reveal someone’s name or identify 90% of cryptocurrency users. It shows how apparently anonymous records can become linkable when paired with other knowledge. ^[8]

The more general lesson is that removing an obvious identifier does not necessarily remove identifying patterns. A small amount of outside knowledge can change what a record reveals.

For association, the important unit is often not the isolated person but the relationship. Who repeatedly supports a particular organization? Which recipients appear together? Which apparently separate activities depend on the same people? These are possible questions an investigator might ask, not conclusions that every dataset can answer reliably.

There is also a danger in treating an inferred relationship as a definitive belief. A transfer may be a refund, a professional service, humanitarian assistance or support for a specific activity rather than a recipient’s entire program. Data analysis does not abolish the need for context, evidence and due process.

Time adds another dimension. Records may outlast the purpose for which they were collected. A previously obscure connection can become interesting after a change in leadership, an investigation or a new association between datasets. The Stepanov case does not demonstrate retrospective criminalization, but it does show that the interval between a payment and its consequences can be measured in years. ^[1]

The problem is therefore not just who can observe today. It is what remains available to be interpreted tomorrow, by people the original participants never imagined would become their audience.

VI. When Repression Becomes Anticipation

Visible repression leaves a record: an arrest, a dismissal, a frozen account. Anticipated repression can leave an absence.

Consider a hypothetical supporter of an independent newspaper. She has never been threatened. Its reporting remains available, and her payment provider would process a subscription. But she has seen people questioned about their associations and cannot tell who might later obtain the transaction record. She decides not to subscribe.

Nothing fails in the payment system. There is no rejection to appeal and no censorship notice to photograph. The newspaper simply has one fewer supporter. Multiply the possibility across a community, and the effect need not resemble a ban to become consequential.

This is an illustrative mechanism, not a measurement of how many donations surveillance prevents. Amnesty International’s 2025 submission on digital and AI-assisted surveillance describes chilling effects on assembly and association, including concerns about fundraising, meetings and contact with others. It emphasizes the uncertainty created when people cannot know the extent of monitoring or rely on effective protection from abuse. ^[9]

Uncertainty can be enough to change a decision. The observer need not demonstrate that every relationship is known. The person considering participation may act on the possibility that an important relationship could become known.

The cost is also uneven. A wealthy supporter may absorb professional disapproval or obtain legal assistance. Someone dependent on a particular employer, institution or local community may have less room to take the same risk. An identical disclosure rule can therefore impose very different practical burdens.

That inequality matters to what eventually becomes public. The voices heard most clearly may be those whose supporters can afford visibility, not necessarily those with the strongest arguments. A society can permit an extensive range of opinions while making the organization behind some of them unusually difficult to sustain.

The deepest loss is not always a silenced statement. It can be the association that never forms, the witness who never receives assistance or the investigation abandoned before its first result. Such absences are difficult to count precisely because the activity did not occur.

Privacy, in this setting, protects a possibility: that people might find one another and build something before their collective commitment becomes powerful enough to defend itself. Freedom should not require a minority to win first and obtain the conditions for participation afterward.

VII. Oslo: Freedom Needs Infrastructure

By the time the 2026 Oslo Freedom Forum convened, the old question of who may safely support whom had become a practical technology problem. The Forum’s Freedom Tech program considered communication, financial access and the risks of organizing under repression. Its significance was not a promise that software could replace political institutions. It was the recognition that civic participation increasingly depends on the information systems through which people find, fund and assist one another. ^[10]

Carmen Lau’s Beyond the Bounty brought the human vulnerability into focus. The forum’s account describes a Hong Kong activist facing transnational repression in exile, with a HK$1 million bounty and pressure extending to her family. Leaving a territory does not necessarily remove the relationships through which a person can be threatened. ^[11]

Pavel Durov spoke about communications technology and freedom. That adds a second layer: private communications can help protect organizing, but they do not automatically protect the financial trails left by organizing. The Forum’s session descriptions are useful evidence of the themes discussed, not independent proof of every claim made from the stage. ^[12]

The Forum’s Bitcoin for Nonprofits 101 workshop made the connection explicit. It addressed frozen bank accounts, blocked donations and financial surveillance, including the need to understand private transactions. A payment network may offer access where banks do not; the next question is what information it exposes. Access and confidentiality must be assessed separately. ^[13]

A concrete response emerged in Ágora, the fundraising platform developed by Soapbox with the World Liberty Congress and launched at the forum. The developers describe a Bitcoin-and-Nostr design and a choice between public and privacy-enhanced payment arrangements. Their account treats fundraising as a problem of access, resilience and user choice, rather than simply adding a cryptocurrency button to an existing intermediary. ^[14]

The technical distinction matters. Ágora uses Silent Payments, specified in BIP 352, for its private wallet option. The protocol enables payments to a reusable identifier while generating distinct on-chain outputs, reducing the obvious linkage associated with repeatedly publishing the same receiving address. It does not hide all amounts, erase every transaction relationship or make every sender anonymous. ^{[14, 15]}

The developers’ launch account, however, is neither an independent security audit nor a comprehensive assessment of the system’s real-world threat model. This article has not established whether such an assessment has been completed. Architecture and developer intent are useful to examine; they are not evidence that an activist’s operational security is guaranteed.

The developer account contains a more challenging observation. Some activists, it reports, were willing to accept greater exposure in exchange for urgently needed funds. That feedback is not a representative survey, but it warns against designing freedom technology around risks chosen entirely by outsiders. ^[14]

The lesson is not to dismiss privacy or make urgently needed assistance contingent on perfect protection. It is to make risks understandable, improve the available choices and respect the circumstances of those who must decide under pressure.

Agency is not exhausted by individual consent, however. A recipient’s willingness to be public does not automatically mean that every donor consents to being identified, just as a donor cannot assess every danger faced by the recipient. A funding relationship has more than one participant. Its protections should account for both.

Oslo thus illustrates the tension at the heart of the article: the strongest freedom technology is neither the most radical privacy promise nor the easiest payment button in isolation. It is the infrastructure that lets people sustain one another while making the costs of visibility as limited and intelligible as circumstances allow.

VIII. Who Must Be Transparent?

The strongest objection to financial privacy is not that privacy is suspicious. It is that secrecy can conceal the exercise of power.

A donor seeking to protect an ordinary association and a financier seeking to purchase political influence may both prefer confidentiality. An organization can be persecuted by a state; it can also deceive its supporters. A serious defense of private solidarity must recognize both possibilities.

In Americans for Prosperity Foundation v. Bonta, the U.S. Supreme Court considered California’s blanket collection of major-donor information from charities. The information was intended to be confidential, making the case about government collection rather than simply public publication. In 2021, the Court held the requirement insufficiently tailored to the state’s asserted needs. Justice Sonia Sotomayor’s dissent argued that the challengers should have to demonstrate an actual burden and warned against undermining routine disclosure regimes. The disagreement concerned how to balance associational protection and legitimate supervision, not whether charitable organizations were beyond scrutiny. ^[16]

International IDEA’s work on political finance describes the other side of the problem: transparent funding and effective enforcement help expose corruption and improper influence. It also examines disclosure thresholds and the protection of smaller contributions. Such distinctions require safeguards against evasion; a large contribution does not become harmless because someone divides it into smaller pieces. ^[17]

Three questions follow. What needs to be known? Who needs to know it? What prevents the information from being used for a different purpose?

A public report about an organization’s spending need not contain every beneficiary’s personal circumstances. An independent auditor may require evidence that the general public does not. A targeted investigation needs a justified scope, reliable evidence and safeguards appropriate to the authority being exercised. These are design principles, not a claim that every jurisdiction already applies them.

Call the resulting principle a democratic visibility asymmetry: the case for scrutiny becomes stronger as someone exercises public power, manages entrusted resources or buys substantial political influence. That does not automatically justify making every ordinary participant equally transparent.

A free society should make power accountable without making every ordinary act of solidarity needlessly visible.

This is not a mechanical division between good citizens and bad institutions. Individuals can wield immense power, and institutions can protect vulnerable people. The relevant distinction is the function being performed, the influence at stake and the information genuinely required to hold it accountable.

Nor is confidential collection a complete answer when the collector itself is the source of persecution. Purpose restrictions, independent review and remedies matter only to the extent that institutions can enforce them. Where those safeguards fail, minimizing the information created or retained can become particularly important.

Privacy and accountability must therefore be designed together. Absolute opacity is not the answer. Neither is building a permanent public map of civil society and trusting every future holder of power to use it well.

IX. The Architecture of Private Solidarity

A useful freedom technology should begin with a question about the human task. What must these people reveal to accomplish it, and what are they being asked to reveal merely because the system makes collection easy?

The answer will differ across communication, association and payment. A group may need to verify that a person can access a service without publishing their identity to everyone else. A payment must satisfy the rules of its monetary system without necessarily exposing the parties’ wider relationships. An organization must account for entrusted funds without turning each recipient into a public case file.

Standards for verifiable credentials already express a related principle. The W3C recommends minimizing disclosed information and, where appropriate, using abstract claims or selective disclosure. Establishing that a person meets an age threshold, for example, need not require sharing a complete identity document. The principle does not remove trust in issuers, establish facts by itself or solve financial regulation. It shows that verification and indiscriminate disclosure are different design choices. ^[18]

For digital money, privacy can similarly be approached at different levels. Bitcoin’s Silent Payments addresses a specific recipient-linkage problem. Other designs aim to protect transaction details as a normal property of the monetary protocol. These approaches should be judged against explicit threats rather than collapsed into a single promise of anonymity. ^{[7, 15]}

This brings the right to help from philosophy into design. If an ordinary donation automatically creates a publicly traceable financial relationship, the participant must take additional steps to reduce exposure. Default protections can shift some of that burden from a stressed or inexperienced user onto the system’s architecture. That does not make a private-by-default protocol automatically secure; it focuses scrutiny on the defaults that determine how much information is created before the user can act.

Ryo is relevant to this narrower question of monetary defaults. Its project documentation describes Ring Confidential Transactions (RingCT) with a default ring size of 25, making on-chain transaction privacy part of ordinary use rather than an optional public-versus-private setting. This is an attempt to reduce ledger-level exposure. It does not, by itself, protect a donor from compromised devices, records kept by other parties or observation at access points. ^[19]

Its official website describes a future transition to Halo 2 zero-knowledge proofs. That proposed upgrade must remain distinct from the currently documented RingCT system. A development roadmap is neither an activated capability nor independent evidence that a threat has been eliminated. The relevance here is the direction of design: maintaining privacy by default while pursuing stronger transaction confidentiality. ^{[19, 20]}

For Ryo, as for any other candidate, practical value still depends on security, usable software, access to counterparties and the ability to turn a receipt into something the recipient actually needs. No adoption or endorsement by the Oslo participants is asserted. This is an architectural example, not a recommendation that a person in danger entrust their safety to a particular coin.

A confidential ledger cannot make a compromised phone trustworthy, erase a counterparty’s records or prevent physical coercion. A system that protects a payment but exposes its surrounding communications may leave the relationship vulnerable through another route. Appropriate legal protections, organizational practice and technical safeguards remain complementary.

The goal is not an invisible society. It is a society in which cooperation does not automatically generate an unnecessarily comprehensive dossier about the people cooperating.

X. The Right to Help

A small payment and a membership list appear to be different objects. One records a transfer; the other records belonging. Under pressure, both can become ways of identifying the people who sustain a collective undertaking.

The answer cannot be that every relationship should remain hidden. Public institutions need scrutiny. People entrusted with resources owe an account of their use. Political influence should not be able to disappear behind a convenient language of privacy.

But neither can the answer be that participation requires universal exposure. The secret ballot embodies the opposite intuition: freedom can depend on separating a person’s political choice from the ability of others to punish it. Associational privacy extends that concern into the relationships through which civic life is maintained.

The digital question is whether our systems will preserve room for those relationships to develop. Will a person be able to support a newspaper without unnecessarily advertising the connection? Will a community be able to sustain a threatened member without making every supporter equally vulnerable? Will the next unpopular cause be allowed to acquire resources before it has acquired the power to protect its own participants?

No protocol can settle those questions alone. Yet protocols help determine what information exists, how widely it circulates and how long it remains available. Institutional choices determine who may demand it and what happens when authority is abused. Together they shape the practical cost of standing beside another person.

A free society should not be measured only by what its citizens may say. It should also be measured by whether they can sustain one another when saying it becomes difficult.

Freedom does not end with the right to speak. It also depends on the freedom to help.