Human Rights and the Decentralized Web
In the first months of 2023, HRDAG convened meetings with twelve partner groups representing human rights communities in countries in Latin America, Europe, the Middle East, South Asia, and the US in order to discuss the potential benefits and challenges of the decentralized web in general and distributed storage in particular. This blogpost summarizes our findings from those conversations.
Four points stood out in our conversations.
1.
Nobody likes Big Tech! They love the idea of building shared storage solutions with partners and friends. Nonetheless, they need something other than a discomfort with Big Tech providers before they adopt new tools. Groups often mentioned that standard IT practices from Big Tech providers seem safer: these tools are familiar, it’s easy to find others who can help, and it has worked well (or at least adequately) for them. Traditional IT is also more feasible for smaller organizations who may have an extremely limited number of team members with suitable technical skills for experimenting comfortably with lesser-known tools. Changing core technology is costly and risky, and to motivate change, either the problems with existing tools must be severe or the benefits of new tools must be great. Neither seemed to be true in this case.
2.
With respect to the dweb, they don’t get it. We mean two ideas by this phrase. First, they find the technology to be opaque. Perhaps we did not explain it well, but we suspect that the ideas at the base of distributed storage are sufficiently different from our partners’ previous experiences with technology that even a far better explanation than we provided would have been insufficient for a first presentation. Even groups with a little bit of experience with cryptocurrency or web3 presentations find these ideas difficult and challenging to imagine in practice. Second, and more importantly, the benefits we proposed were not convincing. We discussed two areas of benefits of distributed storage. Neither was persuasive.
(a) We described how Big Tech storage solutions create a single point of failure. Groups replied that while that may be true, they have not experienced substantial failures with their Big Tech providers, so they were not persuaded that the single point of failure might be a problem for them. Further, several groups questioned how decentralized storage solutions would fare if the organizations supporting them failed. It seemed to them very likely that Microsoft will be around in ten years; in our conversations, our partners thought it likely that in the next ten years, some or all of the current decentralized storage solutions will disappear.
(b) We described how the distributed web creates a mathematically provable chain of custody and timestamps for the information stored there. Groups agreed that proving that data has not been modified could be useful. We explored scenarios in which they would need to convince a skeptical audience that their data had been preserved without modification. They questioned whether it would be more convincing to have files that could be shown by Big Tech providers to have been in their systems for some time (e.g., by looking at logs) or to use the arcane math of hash functions to make the same claim. Most felt that Big Tech logs would be sufficient, and more importantly, more easily understandable than explaining hashing.
3.
Many human rights groups emphasized that to be comfortable with a distributed storage solution, their internal data would need to be encrypted before being stored. Few groups said that they have data that they want to share, nearly all their data is for internal use, and is therefore confidential. From our long experience with Martus, we know that the encryption must be transparent, that is, after turning it on, the user must need to do nothing else in order for the encryption to work properly (e.g., “https” and full disk encryption). Automatic encryption would be a significant benefit for users, relative to storing data in Big Tech clouds.
4.
Many human rights groups are wary of permanently published data. Several of our partners described their process for sharing data. They gave examples in which they published and then took down a dataset after realizing it contained sensitive information they didn’t want to make public. They replaced the data with a modified version of the original. They believe that even if people have downloaded the sensitive data, taking it down will reduce the exposure (whether or not we agree with this is irrelevant). In this case, the ability to take down their previous content contributes to their sense of safety for victims and witnesses of human rights abuses who trust these organizations with their stories. The distributed web’s immutability is therefore a disadvantage relative to traditional server-based solutions.
Our partners were eager to learn and talk about emerging decentralized technology. We did not find a sufficient balance of benefits relative to current solutions that would motivate our partners to transition to decentralized storage. However, we have a few use cases which may provide insights into specific circumstances in which decentralized storage may be useful for human rights organizations.
An illustrative use case
Our conversations with partners focused on storing what they consider their data, which generally includes documents, photos, and spreadsheets containing the substance of their work. These files tend to be largely internal and often (perhaps even usually) contain confidential information. In a few cases, the documents describe interviews with witnesses or descriptions of events that, if accessed by the perpetrators, could lead to retaliation against the victims. The concerns we’ve documented here largely reflect issues with this notion of data.
A few groups think of data in a more traditional way, in the sense of databases or datasets. It is rare in human rights to publish traditional data, for the security and confidentiality reasons described above. However, sometimes groups have photos, videos, audio files, or datasets to distribute for public use. Big Tech platforms are the usual mechanism for making these public, but there may be a role for decentralized storage. In particular, decentralized storage may be well suited to the specific task of publicly sharing large files in forms that enable verification of their authenticity.
HRDAG is currently releasing data with these characteristics: large-scale datasets intended for public use. We published data from the Colombian Truth and Reconciliation Commission on 23 June 2023. There are 4 groups of 100 files each, with sizes between 1 and 25MB, totaling approximately 3.5GB. These files are anonymized, and to reiterate, they are intended for use by the public. Our key security concern is that the data be distributed in exactly the form that we publish them. Our concern about file authenticity and integrity fits well with distributed storage’s core strength.
Like the truth commission’s report and their other published materials, our data carries a Creative Commons license (CC 4.0 BY-SA-NC) so it is likely that the data will be subsequently redistributed by others. We intend for recipients to use the data to replicate and extend the data analysis we did for the Colombian truth commission (in Spanish here). Therefore it is important that users be able to authenticate the data to assure that what they have is the same as what we released. The analytic software we are publishing with the data enables the user to check the authenticity (the file hashes are stored in the software). Nonetheless, the authentication built-in to decentralized storage by way of the content ids provides another layer of confirmation.
There will be several websites offering copies of the data via the traditional web. With a copy available via IPFS, recipients will have multiple mechanisms to authenticate the information they receive. We are eager to learn whether this example will be replicable and useful to other human rights organizations.