Safeguards
Public safety requires public trust
A civic reporting system is only legitimate if it cannot be turned against the people it serves. These safeguards are designed in from the start, not bolted on after.
Binding on any pilot
Non-negotiable
What RR must never become
Written down first, so that it can be held against us later.
- A political-monitoring system
- A tool for targeting journalists or activists
- A public accusation platform
- A facial-recognition dragnet
- A location-tracking system
- A citizen vigilantism network
- A marketplace for private personal information
- A system that rewards unverified allegations
- A substitute for lawful investigation and due process
Safeguard principles
Eleven commitments, in detail
Each one has to survive contact with a real pilot, independent review and public scrutiny.
01
Purpose limitation
Data may only be used for defined civic-response purposes. Repurposing information for monitoring, profiling or unrelated enforcement is prohibited by design and by policy.
02
Data minimization
The system collects only the information necessary for the specific incident. If a report about a flooded road doesn’t need a name, a name isn’t collected.
03
Protected reporting
Reporter details are not publicly displayed. Participation happens under masked identifiers so that reporting a hazard never exposes the reporter.
04
Verification before reward
No one is rewarded simply for accusing someone. Any incentives are linked to verified, useful and responsible participation — confirmed hazards, emergency assistance and reliable public-interest information.
05
Human review
High-risk reports require trained human review. Automated signals can help prioritize, but they do not make consequential decisions on their own.
06
Anti-retaliation measures
The system is designed to protect reporters and prevent targeted harassment, including protections against attempts to unmask or intimidate participants.
07
Corrections and appeals
People and institutions must have a clear process to challenge inaccurate information, request corrections and appeal decisions that affect them.
08
Data retention limits
Sensitive data is not retained indefinitely. Retention schedules are defined per data category and enforced technically, not just contractually.
09
Independent oversight
Governance includes civil-society, legal, technical and community representation with real authority to review, pause and change how the system operates.
10
Auditability
Sensitive access, report changes and institutional actions are logged in tamper-evident records available to oversight bodies.
11
Security
Encryption in transit and at rest, role-based access, secure authentication and regular independent security assessment are baseline requirements.
Independent oversight is a design requirement.
Civil-society, legal and research organizations: governance is being designed now, and it needs your seat at the table.