Setting the Bar for Government Access to Have I Been Pwned

Over the last 4 years, I've onboarded 28 national government CERTs onto Have I Been Pwned (HIBP) and given them free and open access to APIs that enable them to query and monitor their gov domains. This doesn't give them access to any information they can't already access via the free public domain search feature, but it makes their lives easier. Much easier.

As interest from govs has grown, it's caused me to ponder: who am I willing to give access to? Who am I unwilling to give access to? Those questions prompted a tweet earlier today:

If I was to define metrics for which governments I accepted onto @haveibeenpwned, what should they look like? Human rights? Other? And as defined by who? I need something empirical, consistent and repeatable for govs that "feel" uncomfortable. Context: https://t.co/gxwBfdOdBl

— Troy Hunt (@troyhunt) March 10, 2022

There are 2 primary factors that caused me to pose this question and I want to explain my thinking on both clearly here:

The first is the current situation with Russia and Ukraine and more specifically, the sanctions levelled at the former in recent weeks. It's not just sanctions, it's everything from McDonald's closing stores to my tweet this morning about Universal Audio blocking traffic from Russia and Belarus:

Strong stance by @UAudio against the invasion of Ukraine. Which other services are blocking traffic form Russia and Belarus? How does everyone feel about this approach, and should we see more of it? pic.twitter.com/hAWPW1WbW3

— Troy Hunt (@troyhunt) March 10, 2022

You may or may not agree with the stance these organisations have taken, but what this has highlighted is that there is a valid discussion to be had about which countries services are provided to and if there is a threshold beneath which you choose not to do business there.

The second factor is that the requests I've had from some governments simply don't "feel" right. To be clear, these requests are no different to, say, New Zealand's (just to pick the most recent one), but my own subjective view on these countries is that they fall short on many of the values that I (and probably you), hold dear. Democracy. Freedom of press and speech. The ability to choose religion, sexuality and other basic rights I take for granted in a place like Australia. But just a "feel" is insufficient and per my earlier tweet, not at all empirical, consistent or repeatable.

Of all the responses I received, this one really stood out:

There are a number of country rankings that you could consider using. Here's one
https://t.co/kA61z7NCn9

— Jeff Barnes (@mani2jeff) March 10, 2022

Jeff pointed me to the World Population Review website and in particular, the democracy ranking by country. Let me repeat the list here with the 28 governments already onboard HIBP highlighted in green:

Edit: I'll keep updating this table as more governments come on board, so the number will exceed the original 28:

Of those 28 govs, all are classified as "Full Democracy" (Norway and Australia), "Flawed Democracy" (the US and Belgium) or "Hybrid Regime" (Ukraine and Turkey). The govs I mentioned as not feeling right are all well below the highlighted ones, with each classified as an "Authoritarian Regime" and as such, I've decided to reject those governments. I won't say where the cut-off is nor will I commit to a single, easily definable threshold, but I will say that they each rated well below every highlighted gov on every measurable metric. My "feel" is amply reflected by the data.

I'm sure there will be those who feel this approach is insufficient, too much, missing appropriate data, using the wrong metrics and all sorts of other reasons. I don't expect it to be perfect nor does it need to be, what's important to me here is to describe the problem, explain my logic and have a resource I can direct both current and future requests to when I feel the gov is not a suitable fit for the offering I've made available.

Time and time again over the last 8 years, I've needed to make ethical decisions on how I alone run this service. This is just one more of those decisions and I hope I've done a good job of explaining my logic here.