To view the trimmed, shortened recording, see the video below.

Table of contents

• 1. Between the Code: Why Technical Excellence Fails

• 1.1 Why this topic

• 1.2 Core themes

• 1.3 Several key insights

• 1.3.1 INSIGHT 1: Blockchain security is characterized by a permanent state of insecurity (for all involved)

• 1.3.2 INSIGHT 2: The security boundary has moved off-chain

• 1.3.3 INSIGHT 3: Security is maintained by informal coalitions of actors

• 1.3.4 INSIGHT 4: Legitimacy is undefined and contested

• 1.4 Take-aways

• 2. Q&A with matta

• 2.1.1 References & Links

Why this topic

The primary objective of our talk is practical: to provide conceptual tools that help practitioners better understand some of the key, ecosystem-wide dynamics that remain to be addressed to improve the security and thus legitimacy of the blockchain ecosystem.

It does this in two ways:

1. First, it provides four insights from Dr Nabben’s forthcoming book Decentralised Digital Security: Code, crisis, community (due out April 28th 2026, and Open Access in digital format). The book is based on embedded research within security communities for over years, and a PhD on resilience in decentralised digital infrastructures before that. It views security through a socio-technical lens (meaning the social and technical are inextricably linked and co-constitutive). This ‘outside-in’ perspective provides an ecosystem view of the blockchain security landscape, framing familiar problems with analytical clarity and surfacing the high-impact dynamics that are widely experienced but rarely formalised. This supports blockchain security practitioners by offering a shared language for discussing coordination, incentives, and legitimacy in decentralised security.

2. Second, the presentation is followed by a practitioner response and Q&A with Matta from The Red Guild/SEAL frameworks lead, who works daily on frontline interventions, including phishing education, operational security guidance, and adversarial response. Together, the session bridges analytical diagnosis with operational reality, offering security professionals a clearer map of the system they already inhabit—and a basis for thinking differently about where leverage actually lies and what needs to be done to improve the state of blockchain security.

Core themes

1. Security as a Socio-Technical System Security is not merely a property of code. It is produced through interactions between heterogeneous actants, including:

• Technical systems

• Organisational actors

• Informal and ephemeral communities

• Moral and professional norms

• External institutions (exchanges, regulators, law enforcement)

Failures often occur not within layers, but between them.

2. The Limits of Tool-Centric Solutions The ecosystem is making substantial investments in:

• Improved wallets

• Intrusion detection and monitoringDeveloper security tooling

While necessary, these do not address several structural blind spots, including:

• Incentive misalignment for white-hat responders

• Fragile or incompatible incident information formats

• Informal authority substituting for formal mandate

• Coordination with traditional authorities during physical or hybrid incidents

• The moral economies that shape disclosure, intervention, and restraint.

3. The Stakeholder Landscape and Incentive Geometry Decentralised security is maintained by a dense and uneven network of actors, including:

• Volunteer responders

• Protocol teams

• Security collectives

• Infrastructure providers

• Exchanges and custodians

• National and transnational authorities

Each operates under different incentive regimes, risk exposures, and legitimacy constraints. Understanding this landscape is essential for effective intervention.

Several key insights

INSIGHT 1: Blockchain security is characterized by a permanent state of insecurity (for all involved)

Unlike other cybersecurity domains, responsibility for security in blockchain ecosystems is shared between developers, operators, maintainers, and users.

While many security governance models assume a state of temporary crisis followed by restabilization, blockchain security assumes continuous threat, from which no-one is immune.

Relevant tools include: Vulnerability mapping, threat modelling, red-teaming (e.g. SEAL Wargames)

INSIGHT 2: The security boundary has moved off-chain

2025 has been aptly named ‘the year of the wrench attack’. Social engineering dominates loss events. Physical coercion and personal targeting are real (including abductions, ranSoms, fingers cut off, and hotel gangs, as detailed in the forthcoming book). Furthermore, cross-jurisdictional geopolitical dynamics shape response options (e.g., DPRK, Russia, and Iran money laundering stats highest ever in 2025.

If your threat model ends at the protocol, it is already incomplete.

Thus far, there are no real industry solutions (and very little talk) about deterring physical attacks (e.g. private physical security services…).

INSIGHT 3: Security is maintained by informal coalitions of actors

Blockchain security depends on non-mandated actors doing public-interest work (e.g. white-hat (‘for good’) hackers, security coalitions, trusted personalities, anonymous sleuths, and private security firms doing incident tracing).

Sustainable incentive structures are lacking. The blockchain industry is reliant on actors who carry risk without mandate, coordinate without a clearly designated authority, and burn out without replacement.

This is not sustainable infrastructure—it’s moral heroism (and industry failure if not addressed).

INSIGHT 4: Legitimacy is undefined and contested

• Who can request a protocol or exchange freeze?

• Who can reliably request an action (e.g. blacklist an address)?

• How are information and requests validated?

Communities are actively building legitimacy infrastructure, for example:

• Reputation systems

• Safe-harbour mechanisms (e.g. SEAL Safe Harbor)

• Coalition-based authority (e.g. coordinated response frameworks)

There is still a way to go to streamline public-private incident response coordination (including information formats, expectations, control, etc.)

See the latest paper on the work of zeroShadow + SEAL on freezes: Nabben, K. (2025). ‘Freeze: DPRK Hacks and the Governance of Blockchain Security’. Available at SSRN: http://dx.doi.org/10.2139/ssrn.6070088

Take-aways

• This is an institutional design and governance problem, not just technical deficiencies.

• Security is now a shared responsibility across actors who need to figure out how to work together (blockchains are meant to help with coordination, legitimacy, and incentives among distributed actors).

Q&A with matta

Kelsie: What is The Red Guild? What are some examples of what you do?

Matta: We are a very small team initially funded by EF’s Ecosystem Support Program, which has dedicated the past three years to working full-time, solely focused on security as a public good for the Ethereum ecosystem. It started as an exploration to determine whether we (Tincho and I) could achieve sustainability without relying on typical security industry models: bug hunting, contests, audit firms, etc. We’ve suffered them all.

M: We’ve experienced firsthand the inaccuracies, inefficiencies, lack of accountability, the critical/high-driven-reporting and triaging of issues, the profit-driven nature of these models, and we believe there’s still room (and need) for alternative approaches. We applied a new approach we called “spotchecks”, a mix between bug hunting and audits with a few differences: they were unsolicited, continuous, not limited by a fixed frozen codebase, and they lasted what we thought was acceptable, not conditioned by how much we “agreed” since there was no agreement. Our criteria were based on what we thought were Ethereum’s current needs, the EF’s view, and ecosystem feedback. A few weeks into using this model, we identified a critical vulnerability in an ENS library.

M: After public appearances and speaking with communities, we realized there were too many looking at smart contracts and few looking at the rest. That’s when we pivoted our energy to what some might call ‘traditional security’. Since then, we’ve delivered 28 unique presentations worldwide, hosted security activities and gamified experiences, and held our own conferences within renowned conferences and pop-up cities, raising awareness of the off-chain layer in different ways and open-sourcing everything we can.

M: I remember a very specific point in time where I knew we were going the right direction. As part of our first security awareness campaign, a group of 40 users spent 2 hours tampering with a Foundry challenge without realizing it was backdoored, and we had left a PDF on their desktop saying, “You could’ve been pwned by the red guild.”

M: As part of our current funding explorations, we have created our first platform, the Phishing Dojo (phishingdojo.com), which includes phishing awareness training delivered through realistic simulations in a safe environment.

K: And you’re also a SEAL.

M: Proud member! We have been working closely with SEAL since its genesis. I remember telling Tincho that seeing their announcement was like a refresher to my personal motivation. I’m now happy leading the Security Frameworks initiative, which outlines security best practices for organizations and individuals. Paradoxically, I decided to dedicate all my time to two nonprofits in one of the most profitable fields in tech haha :)

K: Thinking about the last major incident you were close to: where did the failure actually occur—at the technical layer, or in coordination, incentives, or authority?

M: My most recent direct and large-scale involvement was a nationwide incident in Argentina. It began when Pablo from Opsek and I investigated what we thought were some isolated Telegram hijacks in a local Web3 community. After conducting field research, gathering as much information as we could from the victims, and reverse-engineering Telegram’s protocol, we quickly concluded that they were being targeted by a threat group using a compromised SMS gateway provider.

M: This breach allowed them to capture all SMS messages for almost every short code sent to any mobile line in Argentina—even to foreign lines with active roaming. The result was the theft of OTP and 2FA access codes, granting unauthorized access to banks, government sites such as MiArgentina, and social apps like Telegram, which, by default, store and sync unencrypted messages in the cloud. Their objective was to look for conversation history in the form of pasted credentials, preferably private keys.

M: The incident was caused by a breach, primarily because the gateway provider didn’t realize it had been compromised for an extended period of time. But the bigger problem was how people reacted. After we confirmed that at least an Argentinian gateway provider was involved, Pablo and I reached out to organizations that might be affected. At first, they ignored us, dismissed our concerns, lied, and refused to investigate until additional evidence was provided. In one particular case, I was threatened.

M: We leveraged our local network through some local friends and colleagues to get all the national mobile carriers (Movistar, Claro, Personal) and our national CERT to jump in. Our experience was tough, as you can imagine. Fortunately, other SEAL members supported us all the way. We even had to issue an urgent advisory to warn users after the press learned about it and said they were about to run a cover story—and they did. We were worried the threat actor (TA) might make a sudden move.

M: On a personal level, though I wrote the advisory, I chose not to release the advisory under the ‘Red Guild’ simply to build a reputation; our main goal was to maximize public awareness. I also left out my name to be safe. Later, Pablo, who did not, received an anonymous message containing his personal information, telling him to be more careful next time.

M: Honestly, looking back, the actual breach was almost secondary. The real mess was how everything broke down between carriers, gateway providers, and even us. You had mobile carriers who smelled trouble but didn’t say anything. Gateway companies that just denied or stonewalled for weeks. And users were getting pwned left and right and often had no clue. Nobody felt like they had a reason to stick their neck out first, and nobody had the actual power to make anyone else act.

M: We weren’t in it for the cash or the fame; we just wanted the attacks to stop. Instead, we ate the cost: the stress, the threats, the work stopping, the personal risk. Because we weren’t “known enough,” our warnings felt light. We had to go find big names and pull external levers just to get a seat at the table. That’s the core problem. When your ability to respond depends on who you know and how much clout you have, instead of just having good data, security stops being a technical problem and becomes this political, slow, total mess.

K: And do you think this was resolved?

M: We have no way of knowing, to be honest. Those with the authority to initiate an investigation told us that the companies are responsible for reporting it themselves, so I don’t think so.

K: You mentioned above that provisioning security came with risk. White hats and some of the private security firms doing incident tracing are often described as critical infrastructure, yet are incentivised like volunteers. Where do you see this model breaking down first?

M: I consider a white hat someone who discovers real vulnerabilities in live systems and chooses restraint over exploitation, disclosure over silence, and proportionality over spectacle. They have a core principle: “Users first”, that’s something that both The Red Guild and SEAL have always in mind. The defining trait is not how the finding is reported, but why harm is deliberately avoided when it would be easy, profitable, or invisible to cause it.

M: The model breaks down when their work is no longer optional, yet is still treated as informal or secondary, or when its importance is neglected by some. The moment the ecosystem assumes someone will look, report, coordinate, and act responsibly under pressure, you have crossed into critical infrastructure. This is when volunteer incentives become a liability. Not because people are acting in bad faith, but because the system quietly relies on their sacrifice while providing no structural support in return.

M: Reputation is fine, but most of the folks I admire the most don’t care much about that; they often have 7 followers and use a customized anime profile picture. Reputation-based incentives fail early because it scales attention, not protection. The more trusted you are, the more responsibility you attract, the less cover you have when something goes wrong. Being “known” increases personal risk without necessarily increasing safety. This also applies to hunting threat actors, not only to finding vulnerabilities.

M: Incentives are distorted. Bug bounties in web3 are often reactive, underfunded, or capped well below the value at risk. The gap between the value of exploiting a vulnerability and disclosing it is clear to everyone. Choosing disclosure over exploitation is a measurable financial sacrifice, not a hypothetical one.

M: Imagine you see an exploit about to happen on-chain. You can act, or you can wait. If you front-run the attacker and drain the protocol to save user funds, you become the one who executed the exploit. Markets can panic, tokenomics can break, and even if funds are returned, the damage is done. If you hold back, alert maintainers, and try to coordinate a response, someone else may drain the protocol while you wait. Either choice has irreversible consequences, made under incomplete information.

M: If you think about it, that’s an insane position to put people in! Whitehats are expected to act responsibly, coordinate disclosures, and sometimes delay action for the “greater good,” yet they have no real authority, indemnification, or legal backing. The ecosystem quietly assumes someone will take the risk and eat the cost.

M: We often speak about decentralization, but liability is not decentralized in any coherent way. Whitehats interact with code, and by extension with DAOs, foundations, companies, and sometimes anonymous teams. Many major protocols have legal entities, but the entity on paper is not always the one that controls the code, the keys, or the response during an incident. Researchers are expected to coordinate responsibly across this gap while operating in jurisdictions that may still interpret their actions through traditional computer misuse laws.

M: In centralized financial systems, a critical bug typically results in downtime, data exposure, or erosion of trust. In our field, a critical bug often means assets are gone, forever, on a public ledger. There is no chargeback, no rollback, no quiet remediation window. That changes the psychology on both sides. For the whitehat, restraint carries real financial weight. For the vendor, disclosure is not just reputational risk but existential risk.

M: I still assume the vendor’s primary objective is always user safety. Most large vendors optimize first for narrative control, liability containment, and precedent. A vulnerability that affects millions of users is a technical problem. An uncontrolled disclosure is a governance and legal problem, a problem their executives are trained to “fear”.

M: This is why things like Safe Harbor, which pre-authorizes whitehats to rescue funds from protocols under active exploits, and legal defense funds, matter: they turn an implicit expectation into an explicit, supported role. It both protects and rewards. You stop looking at things you cannot safely touch because of risk avoidance.

K: We often treat incident information as neutral. In practice, how do formats, timing, and audiences of information sharing shape outcomes—for better or worse?

M: Incident communication is a tricky part of the whole security puzzle. It’s not just about what you say, but how, when, and to whom. Changing any one of them could mean changing attacker behavior, defender behavior, market reaction, and user harm.

• Format matters: A super-polished report signals everything is under control, even if it’s not. A casual chat might signal urgency. “FTX is fine. Assets are fine.”

• Timing is key: If you disclose too early, you give attackers a cheat sheet. Too late, and people lose trust.

• Audience is critical: You can’t use a one-size-fits-all message. What reassures a user might educate an attacker or panic a market.

M: I’m constantly learning about it. Wednesday (from SEAL) knows this well, haha. Until not so far ago, I treated it as an afterthought. Now I think we should all treat it as a defensive system. Teaching people to treat incident communication as part of the threat model changes outcomes. Who speaks, when, in what medium, and with what level of precision is as important as the technical fix. The incident does not end when the exploit stops! It ends when the information no longer causes additional harm. If you don’t consider these factors, your transparency can actually make attacks worse.

K: Yes. The Coalition to Change Crypto Freezes & Recovery (led by zeroShadow and SEAL) is seeking to address this area, too. Your work highlights the ‘off-chain layer’—users, behaviours, education, trust. Do you see this as a solvable security problem or an inherently shifting one?

M: The latter.

M: It isn’t “solvable” because it has no boundaries—it’s constantly changed by human behavior and how fast tech evolves. When we make things easier and more convenient, we’re actually making the gap between how simple a technology feels and how complicated it really is larger. That gap is the security risk we accept in exchange for convenience.

“Freedom, convenience, security. Choose two” — Dan Geer

M: Unlike on-chain security—which operates inside “fixed boxes” like the EVM—the off-chain layer is something you constantly manage and reshape. It’s a systemic attack vector that we need to handle. Our goal shifts from eliminating risk to limiting damage and designing systems that don’t completely fail when people make mistakes. And they will, because that’s human nature.

M: We know this, which is why we aim to improve users’ awareness when interacting with technologies that could be used against them. That’s basically what the Phishing Dojo is for.

K: Why did The Red Guild print an ‘op-sec companion pocket-book’, and what was the on-ground reaction when you handed it out at a Web3 conference? Did anything surprise you?

M: Well… It’s merely a different way to help users digest information in these chaotic times. We’re always wondering how we can improve the user learning experience.

M: The most surprising thing was that even experienced security professionals found this basic primer useful. This highlights a critical point: the tech gap is now so vast that it’s affecting even experts. With AI accelerating this trend, we urgently need better, more creative ways to communicate about security, especially since most people seek information only after a security incident.

A hard truth: Humans default to outcome-based learning over risk-based reasoning.

That’s why, at the guild, we don’t just wait for them to come to us to learn; we try to “coerce” them to engage with our security awareness campaigns through gamification/engagement tactics.

K: If we assume incidents will become more cross-chain, more AI-augmented, and more geopolitical—what coordination capability is most urgently lacking?

M: Well, tech isn’t the problem; the real weakness lies in the human and operational layers above the technology. Incidents are becoming chaotic—cross-chain, AI-involved, and even geopolitical. Relying on informal chats and personal favors is unsustainable. Our on-chain complexity means a single failure puts everything at risk. Yet, when things go wrong, we regress to private DMs and improvisation. This gap will only widen as attacks target interfaces, automation, and AI narratives.

M: It’s not about awareness. We need a basic off-chain operational structure: a shared language for incidents, clear roles, predictable disclosure, and channels that assume attackers are listening. Education alone (as we saw at The Red Guild) isn’t enough; systems evolve too fast. We can’t rely on vigilance or heroic efforts to save us.

M: If we’re serious, we must design for social failure. Confusion, bad information, legal headaches, and time pressure are the new normal, not exceptions.

M: Off-chain coordination is mission-critical infrastructure, and we must treat it accordingly. This is why organizations like SEAL are essential: they create a social coordination layer where none existed.

M: This isn’t only an education or a tooling problem. It’s a structural one. We need to move past fragmented efforts and implement industry-scale resource coordination. That could mean getting company-sponsored staff working together on essential open-source work and public goods organizations that require human power and funding to thrive. Honestly, TheDAO’s Security Fund also gives me a ton of hope for future non-existent solutions.

M: I joked at my last presentation at Devconnect’s One Trillion Dollar’s Security Conference, saying we need to “destroy the industry,” but it points to a truth: if we don’t formalize it at industry scale, with real resources and support, the system will burn out the most dedicated people, and their exhaustion will be seen as a badge of honor instead of a warning sign.

K: If there’s one thing this discussion makes clear, it’s that blockchain security is no longer a tooling problem. It’s an institutional design problem. In other words, security without a sovereign works...until coordination fails.
Everything we’ve discussed today lives in that gap.

i. Dr. Nabben’s book titled “Blockchain Security: Code, Crisis, Community” will be launched on Wednesday, April 29, 10 PM UTC via Zoom on a Metagov Seminar.
More details available here: https://manchesteruniversitypress.co.uk/9781526187093/

References & Links

• https://www.darkreading.com/cyber-risk/illicit-crypto-economy-surges-nation-states

• https://www.taylorfrancis.com/chapters/edit/10.4324/9781003449607-12/dao-vulnerability-mapping-kelsie-nabben

• https://kelsienabben.substack.com/p/diy-seal-wargames

• https://www.darkreading.com/cyber-risk/illicit-crypto-economy-surges-nation-states

• Nabben, K. (2025) ‘Freeze: DPRK Hacks and the Governance of Blockchain Security’. Available at SSRN:http://dx.doi.org/10.2139/ssrn.6070088

• https://blog.theredguild.org/what-is-a-security-spotcheck/

• https://blog.theredguild.org/how-to-almost-take-over-any-dns-domain-on-ens/

• https://frameworks.securityalliance.org/intro/introduction

• https://radar.securityalliance.org/2025-03-slovenly-comet/

• https://blog.theredguild.org/you-were-not-pwned-the-red-guild-ethereum-argentina-2023/

• https://blog.theredguild.org/against-all-odds-security-awareness-campaign-at-devconnect/

• https://blog.theredguild.org/off-chain-layer-champions-at-on-initiative-conference-devconnect-argentina/

Originally posted: blog.theredguild.org/between-the-code-why-technical-excellence-fails/

The Most Attractive Target

Crypto has proven to be an attractive target for sophisticated cyber criminals around the world. Threat intelligence suggests that nation-states rely on hacking into crypto accounts as a source of revenue for the government. Law enforcement lists crypto as one of the largest sources of financial loss in the past three years. Indeed, individual hacks can lead to over $100 million in lost funds.

While a hack is not necessarily an indication of poor security, the state of security in the crypto industry is lacking, according to SEAL-ISAC lead developer and Head of Security at Scroll protocol, Ryan Wegner:

“It varies a lot from project to project. It seems poor because it’s easy to find the projects that aren’t doing well because they lack basic security processes and practices and these mistakes are public on the blockchain for everyone to see.”

In an earlier effort to help identify security controls, Ryan contributed alongside a group of security researchers to develop the “Rekt Test”, as a simple and widely applicable evaluation of security controls to help teams assess security posture and measure progress. While these measures may seem simple, they are not always practiced.

The nature of public cryptocurrency projects is that they are permissionless, meaning that anyone can build an application or even launch a cryptocurrency exchange. Yet, most are unprepared.

"Because the bar is so low to actually deploy a project, they don’t think about security until much further down the track. Unlike Web2, Web3 startups are often responsible for protecting millions in TVL [total value locked] of retail funds, and security professionals are forced to reverse engineer products in production to retroactively apply security best practices...like adding seat belts to a plane that's already in flight”, states Ryan.

Enter, The Security Alliance (SEAL)

The recently launched Web3 Security Alliance (SEAL) initiative is making haste to develop the infrastructure required to mature cybersecurity in the crypto industry and to share threat intelligence about threat actors.

Spanning both regulatory coordination and practical tooling, SEAL’s cornerstone initiatives include:

• SEAL 911, a 24/7 emergency Telegram chat channel where anyone can report an incident, disclose a vulnerability, or report a security problem,

• The Whitehat Safe Harbor Agreement, a framework to establish legal protections and incentives between white hat hackers and protocols or DAOs ahead of time, so rights are clear when engaging in a rescue against an active exploit, and

• SEAL Wargames, attack simulation exercises (known as “red teaming”), to help protocol security teams practice and improve their processes, tooling, and responses in the case of a real exploit.

As a largely volunteer-led effort that is funded by grants and donations, SEAL has already been involved in the rescue of around 50 million dollars, according to their own statistics.

“Our actions involve identifying root causes, tracing stolen funds, pointing to resources on best practice responses, and recovering stolen social media accounts” states one of the SEAL 911 responders.

For example, SEAL 911 helped lead the negotiations with a hacker, using on-chain messages to their cryptocurrency wallet address to strike a deal, resulting in over 90% of the stolen funds being returned to Dolomite, a margin trading protocol on Arbitrum. In another event, SEAL 911 responders helped save $200,000 being drained mid-hack from a smart contract in one exploit, and $2.3 million in another negotiation. SEAL whitehat hackers have also helped identify vulnerabilities using community reporting to responsibly disclose and preemptively prevent attacks. As the participants in the network of SEAL contributors grows, additional real time assistance will help others avoid attacks, or quickly mitigate those under way.

One auditing team lead reported on “X”:

“Today I messaged the SEAL911 hotline with a bug I found in production. 15 minutes later, the CEO of the project was informed. 50 minutes later, the code was patched and no longer exploitable. I cannot recommend SEAL911 enough”.

The question is, what can be done with all of this insider information and experience to improve security throughout the crypto ecosystem?

Having proved their chops in incident response, the next SEAL initiative to launch is ‘SEAL-ISAC’, an Information Sharing and Analysis Centre to coordinate and respond to cyber security information at scale across the cryptocurrency ecosystem.

Why an Information Sharing and Analysis Centre (ISAC)?

An ISAC is not a novel idea. It is a framework for real-time inter-organizational information sharing and collaboration, commonly utilized across various industries to enhance cyber security resilience.

The idea is based on the original Financial Services ISAC (FS-ISAC); an international, 7,000 member not-for-profit industry consortium, dedicated to reducing cyber-risk in the financial system.

Upon joining a call with the initiating team where the initial product demo was presented, one asked, “are we sure we want to call it an ISAC? Some people think ISAC’s are not very useful”.

“Yeah, we do”, replied whitehat hacker and Founder of SEAL, Samczsun, "it helps to explain what it is in a straightforward way”.

The comment points to the paradox of any coordination mechanism that could be perceived as centralizing in an industry predicated on decentralization. The initial FS-ISAC was founded in 1999 as a response to a Presidential Directive from the US government. ISACs are trusted entities that collect, analyze, and disseminate actionable threat information to their members, as well as providing members with tools to mitigate risks. These include threat intelligence reports, crisis and incident support, security alerting and automated information feeds, and running security exercises.

What is different about SEAL is their ability to get the right people, in the right place, at the right time. Leading by “shipping” a threat intelligence platform, SEAL is focusing on engineering and infrastructure support, combined with gathered a number of high-profile and data rich stakeholders as the ground zero members for SEAL-ISAC.

An ISAC Tailored to the Cryptocurrency Ecosystem

Given the unique challenges and the rapidly evolving nature of blockchain technology and digital assets, such an ISAC would focus on the specific needs and vulnerabilities of the cryptocurrency sector. With more money flowing into the market, the types of threats which the SEAL911 team observes do change and evolve. According to one of the SEAL 911 expert white hat hackers, the majority of tickets are phishing scams (people losing their cryptocurrency tokens via malicious approvals and compromised private keys), and romance scams that involve investing in cryptocurrency (known as “pig butchering” scams). The remainder are responsible disclosures by other whitehats regarding potential vulnerabilities (such as re-entrancy attacks where there is a bug in smart contract code and access control issues), or projects reaching out for help once being hacked.

While FS-ISAC charges membership fees, and a number of crypto security firms try to monetize intelligence sharing products and services, the key to SEAL is that it’s a Not-For-Profit and SEAL-ISAC membership is planned to be completely free. Although there are more players to coordinate in a decentralized ecosystem like cryptocurrency, there are even higher incentives to collaborate on industry-wide security to protect users from having their funds drained, to mitigate cascade effects from hacks, and to improve the reputation of the industry.

The types of stakeholders that are relevant members of SEAL-ISAC include cryptocurrency exchanges and trading platforms, blockchain development projects and platforms, wallet providers and crypto storage solutions, mining pools and infrastructure providers, cybersecurity firms and researchers specializing in blockchain and cryptocurrency, and regulatory experts and bodies interested in or working with cryptocurrency projects.

An Information Sharing and Analysis Center (ISAC) tailored for the cryptocurrency industry could play a crucial role in enhancing the security and resilience of the cryptocurrency ecosystem against cyber threats, fraud, and financial crimes. For SEAL, it’s about formalizing the community-run intelligence sharing that is already occurring between whitehats and security firms across numerous online chats to share more effectively in one place and maintain better record keeping.

In response to the security characteristics of the crypto industry, key features and functions of SEAL-ISAC include:

1. Information Sharing: ISACs facilitate the exchange of information regarding vulnerabilities, threats, attacks, and best practices for cryptocurrency industry cybersecurity among their members. This sharing occurs in a secure and confidential manner to protect sensitive information, in accordance with SEAL’s Code of Conduct (noting no personally identifiable information is shared between SEAL 911 initiative and SEAL-ISAC).

2. Threat Analysis and Alerts: Analysis of cybersecurity threats to provide timely threat intelligence and alerts to members. This analysis helps organizations to anticipate, identify, and mitigate potential attacks.

3. Best Practices and Guidelines: ISACs disseminate best practices and guidelines for cybersecurity (known as “playbooks”), to help members implement effective security measures and policies.

4. Incident Coordination and Response: Providing a coordinated response mechanism for major security incidents, such as exchange hacks or network attacks, including facilitating communication between affected parties, law enforcement, and cybersecurity experts.

5. Education and Awareness: Offering educational resources and training programs tailored to various stakeholders in the cryptocurrency ecosystem, including developers, exchanges, wallet providers, and users, to raise awareness about security best practices and the latest threats.

6. Regulatory and Legal Guidance: Connecting the cryptocurrency industry with regulatory experts to ensure that security measures are in line with legal requirements and to advocate for reasonable regulatory approaches to cryptocurrency security.

What this looks like is a way to report information, and a back-end dashboard for analytics and response.

Using the SEAL-ISAC Dashboard

Practically, SEAL-ISAC is a repository of data, based on an Open Source Cyber Threat Intelligence database platform (called OpenCTI). Members can access the platform to input information there according to the data formats presented, including new report, context, external reference (such as a post on “X”), observables (such as cryptocurrency wallet addresses), entities, and relationships. SEAL analysts then organize that data into something useful by building it up into a database to understand how things are related, and other member organizations can consume that data. Some will consume information manually and conduct their own analysis, and others will subscribe for automated information feeds, curated by SEAL analysts. The result is that incidents are not just responded to by SEAL 911, but incidents are recorded, information is added by member organizations, and this leads to an cyber threat intelligence database that can be used by people and projects before an incident occurs, as well as the development of best practice resources, such as incident playbooks to respond.

Success Hinges on High-Quality Data Contributor Members

In an ideal world, the SEAL-ISAC database will be shared with community members that can make use of the actionable intelligence insights being provided. Most of the cybersecurity data collected in crypto events is open source (such as on chain or posted on social media). SEAL-ISAC puts it all together, and adds a layer of analysis and coordination.

SEAL already has commitments for data contributions from major service providers in the cryptocurrency ecosystem, including cryptocurrency exchange Coinbase, Web-browser wallet Metamask, decentralized exchange UniSwap, and Layer 2 protocols Scroll and Polygon.

SEAL-ISAC signifies an important maturing in infrastructure, practices, and coordination of security in the crypto industry. The role of ISACs is increasingly important in the context of the evolving sophistication and frequency of cyber attacks that comes with an up-tick in market value. By fostering a culture of information sharing and collaboration, SEAL-ISAC will help to improve the overall cybersecurity posture of their member organizations and, by extension, the cryptocurrency ecosystem. If SEAL’s ISAC initiative succeeds in aggregating actionable insights that help to protect crypto users and improve the state of security across the industry, it has the potential to represent the security of billions of dollars in assets via its members.

“The ISAC is only as good as the intelligence it receives”, states Ryan. “We just really want folks to participate and share. If people are seeing something that looks malicious, such as an imposter domain, a phishing attack, and so on, submit it”. Unfortunately, the chances are if someone has been victimized by a scammer or hacker, someone else will be victimized too.

END.

Acknowledgments: With thanks to the SEAL-ISAC team for research approval, interviews, and feedback.

Suggested citation: Nabben, K. (2024). “SEALing Crypto Security: A Web3 Information Sharing and Analysis Center (ISAC).” Available online: [link].

Note: Minor edits were made post publishing this article, including editing to read ‘SEAL-ISAC’

Yesterday marked the launch of the Decentralised Data Governance Pattern Library. The library attends to the social arrangements surrounding data management to improve resilience.

Resilience, here, refers to adaptability and transformability in response to external threats, internal vulnerabilities, and opportunities. The social science approach I take focuses on the affordances of decentralised technologies in terms of resilience for individuals and groups of people (or in other words, the social outcomes).

This tool emerges from over 2 years of research on resilience in decentralised technologies. Specifically, ‘how can decentralised data management be more resilient?’.

The aim of the library is to present research and user experiences to share ‘patterns’ for decentralised data management (including content addressing, encryption, storage, and governance, across a range of contexts).

The idea for a pattern library arose from previous work on decentralised data patterns that I contributed to. Software design patterns are general, reproducible solutions to a commonly occurring problem within a given context in software design.

My digital ethnographic research on resilience in decentralised data management found that resilience can be improved by addressing ‘gateway moments’ when infrastructure is bridged or scaled (for example, when addressed content is linked to a storage solution), via institutional infrastructure.

Institutional infrastructure just means addressing the social arrangements that surround how people engage with technology. This includes the set of legal, cultural, economic, and social institutions that enable and constrain actions (Hinings, et. al., 2017).

Similar to software patterns, institutional infrastructure patterns are organisational arrangements that are reproducible.

The Decentralised Data Governance Pattern Library demonstrates how people can compose technical protocols and social patterns into complex, socio-technical systems that are resilient for those that use them.

You can read the patterns here, and add a Pull Request for any additional patterns or contexts you think should be included!

Next Steps…

The library is now available as a resource for people to consider and contribute to. The research is ongoing!

Building on previous work on ‘DAOs as Data Trusts’, the next step in my project plan is to further investigate one of the most opaque patterns of all, that of the “Data DAO”.

This includes exploring existing instantiations of data DAOs (for example, ‘SupersetDAO’, Filecoin Virtual Machine DAOs, and data governance arrangements for cultural artefacts). This will be augmented by deeper consideration of the technical requirements for actually building a data DAO, thanks to the good folk at BlockScience (who I also work with).

Some key research threads I’m pursuing have been informed by my research focus on accountability in contexts of private or ‘self’ governance. These include:

· How social-institutional arrangements of data management relate to existing institutional frameworks (including legal, multi-stakeholder institutional (e.g. W3C, IETF, etc), and others),

· What this means for accountability, in terms of who is accountable to who, across multiple institutions, at multiple scales, and,

· How accountability operates at the hardware infrastructural layer of compute. This line of research is particularly pertinent as it relates to my ongoing interest in AI governance, and Filecoin ecosystem efforts such as project ‘Lilypad’, a decentralised marketplace for compute.

Further resources:

Data Governance Pattern Library — Patterns:

https://github.com/kelsien/datagovernancepatterns/tree/main/patterns

Data Governance Pattern Library — Ways to Contribute:

https://github.com/kelsien/datagovernancepatterns/tree/main

Decentralised Data Governance Pattern Library (front-end web page): https://beta.portrait.gg/0x1018c3A71997D2171E915ea89f704d9a192823EF (portrait is a cool, IPFS backed application)

IPFS Implementation Principles: https://blog.ipfs.tech/2023-03-implementation-principles/

Research Paper:Nabben, K. “Decentralized Technology in Practice: Social and technical resilience in IPFS,” 2022 IEEE 42nd International Conference on Distributed Computing Systems Workshops (ICDCSW), Bologna, Italy, 2022, pp. 66–72, https://ieeexplore.ieee.org/document/9951370

Funding the Commons talk on research findings (October, 2023): https://www.youtube.com/watch?v=5yT-jd3BfA4

Note: This work has been supported by the Filecoin Foundation Dev Grants program (I believe the first social science oriented one, which I’m very grateful for).

It’s May 2023, which marks 3 years since I formally embarked on a PhD research journey to investigate ‘resilience in decentralised technologies’. As one journey (hopefully) comes to an end (see findings here, here, here, and forthcoming), I am hereby holding myself accountable to set out another research project by sharing it with you here.*

Accountability is a core governance concern in legal, social, and technical systems. Accountability refers to the mechanisms and processes through which individuals, organisations, or institutions are responsible for their decisions and actions in relation to others, which concur via social norms or monitoring, enforcement, and consequences (Bovens, 2007). Accountability can be pursued through any combination of social, regulatory, economic, and technical measures (Lessig, 1998). Creating and maintaining accountability is crucial for establishing trust, legitimacy, and fostering effective and responsible governance, whether in public institutions, private organisations, or self-governed communities (Nabben, 2023a).

Blockchain governance occurs in a unique context of collective, digital, self-governance, where participants in a system 'self-infrastructure’ the rules of that system to create the boundaries that they wish to operate by (Nabben, 2023b). At the heart of decentralised governance sits accountability. We have little understanding of what accountability is, how it is created, how it is maintained, what scale and scope of accountability is needed to be considered sufficient by stakeholders participating in the ecosystem, and how accountability in decentralised systems fares in comparison to other models of accountability (e.g. the law).

Who is accountable in a decentralised system, and to who or what, is not clear. Neither is how this can be created and maintained through decentralised governance tools and processes. According to the logics of peer-to-peer systems (as an architectural sub-set of decentralised technologies), accountability is occurring at multiple scales and between multiple actors and forums. It could refer either to each-other, to the rules of the system, or to oneself. For example, accountability is very different in a decentralised, public blockchain protocol, compared to a Decentralised Autonomous Organisation (DAO), a liquid staking protocol that operates on a Layer 1 blockchain protocol (e.g. Lido), and a project that has a centralised, private Foundation and a community (a ‘Foundation model’).

This project aims to understand how accountability can be created and maintained in contexts of collective, digital, self-governance by addressing the research question of ‘are decentralised technology communities able to create and maintain accountability, and if so, how?’.

This research project investigates this question by answering the following questions: ● What does accountability mean to decentralised technology communities? ● How is accountability created (or ‘infrastructured’) and maintained across regulatory modalities? (a.k.a., through any combination of social norms, and/or technical, legal, and/or market mechanisms), ● Is accountability sufficient in decentralised technology community governance? (to stakeholders participating within a system or to external stakeholders).

Decentralised Technologies and the Need for Accountability

Decentralisation in decentralised technology communities refers to the technical typology of a distributed computational system where multiple authorities control different components and no authority is fully trusted by all (Troncoso, et. al., 2017; Balázs, et. al., 2021), as well as a socio-political goal towards “freedom” and “autonomy” from external political influence or capture (Buterin, 2017; Balázs & Giannopoulou, 2017, Balázs, et. al., 2021). As such, decentralisation is both a technical, architectural dynamics as well as a normative, political aspiration that is aligned to an ideal of independence through distributed computing architecture.

Public blockchains, as an example sub-set of decentralised technology, have been described as digital infrastructure that creates “new institutional possibilities” and unique infrastructural practices (Berg, et. al., 2019). Decentralised technologies create these new institutional frontiers in digital domains by offering a governance infrastructure that purportedly minimises trust in existing institutions through computational processes, including transparent and verifiable software code and cryptography. This, in turn, aspirationally reduces the role of intermediaries and third parties, such as regulators (although this is not necessarily the case in practice) (Becker & Balázs, 2021; Wright & De Filippi, 2015). Scholars Wright, De Filippi, Werbach, and others, characterise decentralised systems as reliant on distributed operation and control, with consensus and trust among participants being established through cryptographic mechanisms and algorithms (De Filippi & Wright, 2018; Werbach, 2022; De Filippi, et. al., 2020). Decentralised technologies defer some administrative and regulatory processes of coordination to software encoded rules, establishing a system of “trustless trust” (Bruun, et. al., 2020; Werbach, 2018; Alston, 2023). Thus, they are often thought of as a macro-social coordination infrastructure for greater public choice and freedom.

Although there is a small body of critical literature on blockchain technology, there is starkly little consideration of “ethics” in the field of decentralised technologies, as the moral values, principles, and guidelines that orient and govern human behaviour (Tang, et. al., 2020; Hyrynsalmi, et. al., 2020). The critical literature that does exist focuses on the underpinning logics of ‘decentralisation’ and that prevailing technocratic tendencies in blockchain communities towards ‘algorithmic governance’ (O’Dwyer, 2016; Walch, 2017; Walch, 2019; Walch, 2017, Schneider, 2019). Consideration of ethical governance principles is particularly devoid from within the field itself, with minimal discussion of this topic (Zargham, 2021; Bagus, 2021, Allen, et. al., 2023). Rather than focusing on the ethics of governance in blockchain (an ‘economy’ fraught with virtue signalling and private interests (see Phan, et. al., 2023)), this research project focuses on the more pragmatic topic of accountability. Accountability pertains to social questions of human interaction and governance, operational practices, legal considerations, and technical mechanisms in decentralised technology communities because it can be pursued through a blend of such measures and mechanisms.

Trust, legitimacy, confidence, and accountability are essential components to effective governance. Compared to proprietary, centralised algorithmic systems where users do not know how the system works and systems are often closed to cross platform collaboration to retain users (Bucher, 2012), decentralised technologies are also considered transparent and thus accountable. In decentralised technologies, software code is open-source and transactions are recorded openly on a public ledger, and systems talk to one-another (known as ‘interoperability’). This transparency of software code rules and interactions does not necessarily equate to legibility. Yet, legibility is critical for legitimacy in blockchain governance. De Filippi, et. al., contend that legitimacy in blockchain governance relates not just to exogenous legitimacy (as how a system is viewed from the outside, such as by legislators), but also endogenous legitimacy, which refers to how structures and processes through which these blockchain systems are being governed are perceived from within by their own community of users (2022). Legitimacy helps to facilitate participation, which is fundamental to both the governance and operation of distributed systems with multiple peers. The need for legitimacy directly corresponds to the recent trend in blockchain communities towards ‘constitutionalising’ to codify community purposes and rules in written documentation and technical infrastructure (an active area of research and practice at BlockchainGov and BlockScience) (Zargham, et. al., 2023; BlockchainGov, 2023). A legitimate governance structure and processes create confidence in a blockchain system. This provides a basis of trust in a distributed web of stakeholders on which participants can act (De Filippi, et. al., 2022).

Accountability can occur through a blend of social trust-based and regulatory measures. According to O’Neill, the ideal of a “trust-free world is based on fantasising”, as accountability requires some forms of trust (2003). O’Neill contends that what needs to be considered is forms of accountability that support trust relations (2003). This perspective emphasises the importance of cultivating trustworthiness through well-designed accountability measures that are relevant, proportionate, and constructive to a specific context, rather than overemphasis on transparency and compliance that can inadvertently undermine trust. An example of proportionate accountability standards is demonstrated in Ostrom’s “graduated sanctions”, whereby penalties that enforce community rules and norms escalate in severity based on the nature, frequency, or seriousness of rule violations to promote cooperation among resource users (2015). The alternative to cultivating trustworthiness for accountability through standards is enforcing accountability through regulation, measurement, and consequences. These types of approaches are evident in some of the economic incentive and penalty mechanisms that govern blockchains as ‘cryptoeconomic systems’, such as “block rewards” and “slashing” (Nabben, 2023a). Blockchain is an administrative technology that is intended to reduce transaction costs and afford maximal autonomy to participants in that system. Therefore, what blockchain communities may wish to avoid is the design of system in which the political demands for accountability and control catalyses a proliferation of accountability mechanisms. This ever-expanding administration formalisation and auditing to govern the behaviour occurring within a system creates what Power calls an “audit society” (1999). Such control systems erode trust and autonomy, and do not coexist easily with the operational capabilities of organisations (Power, 1999).

What is Accountability?

The working definition adopted to analyse and assess accountability in this research project is ‘the mechanisms and processes through which individuals, organisations, or institutions are responsible for their decisions and actions, in relation to others, which concur via social norms or monitoring, enforcement, and consequences’. This definition is based-off the conceptual framework provided by Bovens, of “a relationship between an actor and a forum, in which the actor has an obligation to explain and to justify his or her conduct, the forum can pose questions and pass judgement, and the actor may face consequences.” (Bovens, 2009) This framework has been adopted in other studies of algorithmic accountability (Wieringa, 2020). It is also well suited to the analysis of decentralised technologies. Decentralised technologies are socio-technical systems that frequently involve emergent outcomes of a collection of actors, there is a cultural bias for actions to occur “on-chain”, at either the protocol level or via ‘decentralised applications’, where they are transparent and traceable. Governance in this context refers to “governance interactions” in a system, defined as actions towards “solving societal problems or creating societal opportunities; attending to the institutions as contexts for these governing interactions; and establishing a normative foundation for all those activities” (Kooiman, 2003). In order to analyse if governance in decentralised technology communities produces accountability according to the dynamics set out by Bovens, what I am looking for is governance interactions between actors and forums, along social, technical, economic, and legal dimensions.

These dimensions (of social norms, technical architecture, market mechanisms, and the law) are articulated by Lessig as the four forces of regulatory modalities that shape and govern human behaviour in a given environment (and particularly in the context of the internet and digital technologies). These intersect and interact to apply to human (or machine) interactions in any combination in society, at multiple scales (i.e. individual, collective or organisational, and societal), and evolve over time (Lessig, 1998). Blockchain-based organisations rely on distinct mixes of algorithmic and normative governance techniques and behaviours to self-regulate and govern. In both blockchain protocols and ‘Decentralised Autonomous Organisations’ (DAOs), governance depends on both social and technical monitoring, verifiability, and enforcement that occurs both “on” and “off” the blockchain (Nabben & Zargham, 2022). This means that some regulatory rules of governance are embedded in the software code of the protocol itself and executed automatically (on-chain governance), whilst others occur through social processes of person-to-person interactions, deliberation, and norms (off-chain governance), with governance occurring of and by the infrastructure (De Filippi & Loveluck, 2016; Yeung, 2019). These institutions of regulatory behaviour are both formal and informal, as well as blending algorithmic and human components to limit and enable interactions.

Upon preliminary investigation, blockchain communities possess all four of these forces of regulation in their governance in various mixes, depending on the context and operating environment of a particular community. In the context of blockchain technologies, these include algorithmic monitoring (e.g. contribution and reward systems like Tally and Coordinape, and ChatGPT plug-ins), legal mechanisms which may be legally enforceable (e.g. technical mechanisms based on legal logics, such as Kleros and Celeste decentralised courts and arbitration mechanisms), market incentives and penalties (e.g. block rewards and slashing), and social norms (e.g. “no shit posting” in community Discord channels or people will yell at you). These forces occur via different mechanisms and with varying dominance according to the community and context. What remains to be understood is what forces are dominant in what contexts, and if, how, and in what contexts blockchain governance produces accountability. By considering the effects of law, social norms, market forces, and architecture, policymakers (who are system designers in this context) and stakeholders can design more effective and context-sensitive approaches to accountability.

Methodological Approach

To conduct this research, I employ participatory, digital ethnographic methods as the study of the consequences of digital media in the everyday (including algorithms and blockchains) on people, culture, and society (Pink, et. al., 2016), to investigate the regulatory forces, mechanisms, behaviours, and tensions of blockchain community accountability in practice. I couple this with a case studies approach, as the field site of decentralised technology communities requires observation of multiple contexts as a non-homogenous class in terms of technology, culture, and aims (Schwandt & Gates, 2018). Decentralised technology communities are digitally native, geographically distributed, and disparate across numerous traditional and ‘Web3’ infrastructures and applications, including governance proposal and discussion forums, the Discord chat application, the voting application Snapshot, and Twitter, as well as in-person conferences and meet-ups (Rella, 2021; Nabben & Zargham, 2022). My observation and participation in online community channels will be paired with ethnographic interviews to collect data for this research. Digital ethnography is particularly well suited to the study of decentralised technologies in that it provides insights into the social dynamics that shape the rules of a field with a decidedly technical bias, that often only looks at how technical forces and rules shape behaviour, rather than also acknowledging social dynamics. The suitability of digital ethnographic methods has been demonstrated by other scholars to conduct research into the social dynamics and outcomes of decentralised technical systems and governance arrangements (Faustino, 2019; Kosmarski & Gordiychuk, 2019; Rennie, et. al., 2022).

This research project provides both a theoretical and empirical contribution to the field of decentralised governance by connecting blockchain governance with existing theory on algorithmic regulation and accountability, contributing to the design of new governance models that synthesise theoretical findings through design ethnography, and evaluating governance models in practice through participatory digital ethnography. This research aims to surface findings relevant to accountability in digital infrastructures, algorithmic regulation, accountability, and policy making in blockchain and AI.

Next Steps

This research is underway. I’m already speaking with a number of fascinating people and projects about how ChatGPT is being used in attempts to augment DAO governance, ‘best practices’ for decentralised court systems, and labour management in Decentralised Autonomous Organisations. (With many thanks to both BlockchainGov and BlockScience and the teams we research and work with for ongoing engagement and/or application of these ideas). I’d love to hear if this research is relevant to you and your community, and how you think instantiations of accountability are being applied (or should be!). Thanks for reading.

Notes:

• I will save the many thank you’s for when I actually submit and pass.

With thanks for feedback to Primavera De Filippi at BlockchainGov, Michael Zargham and Eric Alston at BlockScience, Darcy Allen, and Aaron Lane from RMIT University Blockchain Innovation Hub.

References:

Allen, Danielle, Eli Frankel, Woojin Lim, Divya Siddarth, Joshua Simons, and E. Glen Weyl. (2023). “Ethics of Decentralized Social Technologies: Lessons from the Web3 Wave.” Edmond & Lily Safra Center for Ethics, Harvard University.

Alston, Eric. (2023). “Norms, Institutions and Digital Veils of Uncertainty – Do Network Protocols Need Trust Anyway?”. Available at SSRN: http://dx.doi.org/10.2139/ssrn.3956873.

Bagus, P. and de la Horra, L.P. (2021). “An ethical defense of cryptocurrencies.” Business Ethics, the Environment & Responsibility, 30(3), pp.423-431.

Becker, Moritz, and Balázs Bodó. (2021). "Trust in blockchain-based systems". Internet Policy Review 10 (2). DOI: 10.14763/2021.2.1555. https://policyreview.info/glossary/trust-blockchain.

Berg, C., Davidson, S., Potts, J. (2019). “Blockchain Technology as Economic Infrastructure: Revisiting the Electronic Markets Hypothesis”. Frontiers in Blockchain 2 no. 22.

BlockchainGov. 2023. ‘@BlockchainGov’. “Mark your calendars!”. Twitter. Available online: https://twitter.com/BlockchainGov/status/1646081164896083968. Accessed May, 2023.

Bodó, B., and A. Giannopoulou. "The logics of technology decentralization–the case of distributed ledger technologies." In Blockchain and Web 3.0, pp. 114-129. Routledge, 2019.

Bodó, Balázs, and Jaya Klara Brekke, and Jaap-Henk Hoepman. (2021). "Decentralisation in the blockchain space". Internet Policy Review 10 (2). DOI: 10.14763/2021.2.1560. https://policyreview.info/glossary/decentralisation-blockchain-space.

Bovens, M. (2007). Analysing and Assessing Accountability: A Conceptual Framework. European Law Journal, 13(4), 447-468.

Bruun, Maja Hojer, Astrid Oberborbeck Andersen, and Adrienne Mannov. (2020). “Infrastructures of Trust and Distrust: The Politics and Ethics of Emerging Cryptographic Technologies.” Anthropology Today 36, no. 2: 13–17. https://doi.org/10.1111/1467-8322.12562.

Bucher, Taina. (2012). "Want to be on the top? Algorithmic power and the threat of invisibility on Facebook." New media and society 14, no. 7: 1164-1180.

Buterin, Vitalik. (2017), “The Meaning of Decentralization”. Medium. Available online: https://medium.com/@VitalikButerin/the-meaning-of-decentralizationa0c92b76a274. Accessed 7 November, 2021.

De Filippi, P. and Loveluck, B. (2016). “The Invisible Politics of Bitcoin: Governance Crisis of a Decentralized Infrastructure”. Internet Policy Review, 5: 3. https://doi.org/10.14763/2016.3.427.

De Filippi, Primavera, and Aaron Wright. Blockchain and the law: The rule of code. Harvard University Press, 2018.

De Filippi, Primavera, Morshed Mannan, and Wessel Reijers. (2020). "Blockchain as a confidence machine: The problem of trust and challenges of governance." Technology in Society 62: 101284.

De Filippi, Primavera., Morshed Mannan, Jack Henderson, Tara Merk, Sofia Cossar, Kelsie Nabben. (2022). BlockchainGov, Report on Blockchain Technology and Legitimacy. Available online: https://blockchaingov.eu/report-on-blockchain-technology-legitimacy/. Accessed May, 2022.

De Filippi, Primavera., Morshed Mannan, Wessel Reijers. (2020). “Blockchain as a confidence machine: The problem of trust & challenges of governance, Technology in Society, Volume 62. https://doi.org/10.1016/j.techsoc.2020.101284.

Faustino, Sandra. (2019). “How Metaphors Matter: An Ethnography of Blockchain-Based Re-Descriptions of the World.” Journal of Cultural Economy 12, no. 6: 478–90. https://doi.org/10.1080/17530350.2019.1629330.

Frederickson, Melvin J. Dubnick, H. George, ed. Accountable Governance: Problems and Promises. New York: Routledge, 2015.

Hyrynsalmi, Sami, Sonja M. Hyrynsalmi, and Kai K. Kimppa. (2020). "Blockchain ethics: A systematic literature review of blockchain research." In Well-Being in the Information Society. Fruits of Respect: 8th International Conference, WIS 2020, Turku, Finland, August 26–27, 2020, Proceedings 8, pp. 145-155. Springer International Publishing.

Kooiman, J. Governing as Governance. (SAGE, London). 2003.

Kosmarski, Artyom, and Nikolay Gordiychuk. (2021). “Anthropology and Blockchain.” Anthropology Today 37, no. 6 (2021): 1–3. https://doi.org/10.1111/1467-8322.12683.

Lessig, Lawrence. (1998). "The new Chicago school." The Journal of Legal Studies 27, no. S2: 661-691.

Nabben, K. (2023a). “Cryptoeconomics as Governance: An Intellectual History from ‘Crypto Anarchy’ to ‘Cryptoeconomics.’” Internet Histories 0, no. 0 (March 3): 1–23. https://doi.org/10.1080/24701475.2023.2183643.

Nabben, K. (2023b). Web3 as ‘self-infrastructuring’: The challenge is how. Big Data & Society, 10(1). https://doi.org/10.1177/20539517231159002.

Nabben, K., and Zargham, M. (2022). “The Ethnography of a ‘Decentralized Autonomous Organization’ (DAO): De-mystifying algorithmic systems”. EPIC Conference Proceedings, ‘Resilience’, 2022. https://anthrosource.onlinelibrary.wiley.com/doi/abs/10.1111/epic.12104.

O’Dwyer, R. (2016). “Blockchain and their Pitfalls”. In Trebor Scholz and Nathan Schneider (eds.), Ours to Hack and to Own: The Rise of Platform Cooperativism, A New Vision for the Future of Work and a Fairer Internet, (OR Books), 228-232.

O’Neill O. (2003). Trust with Accountability? Journal of Health Services Research & Policy. 8(1):3-4. doi:10.1177/135581960300800102.

Ostrom, Elinor. “Governing the Commons:The Evolution of Institutions for Collective Action”. Cambridge University Press, 2015. https://doi.org/10.1017/CBO9781316423936.

Pink, S., Horst, H., Postill, J., Hjorth, L., Lewis, T., Tacchi, J., Digital Ethnography, SAGE Publications Ltd, 2016.

Power, Michael. The Audit Society: Rituals of Verification. Oxford, New York: Oxford University Press, 1999.

Rella, Ludovico. (2021). “Assembling the FieldlessFieldless Field SiteField Site.” In Navigating the Field: Postgraduate Experiences in Social Research, edited by Mildred Oiza Ajebon, Yim Ming Connie Kwong, and Diego Astorga de Ita, 37–48. Cham: Springer International Publishing. https://doi.org/10.1007/978-3-030-68113-5_4.

Rennie, E., Zargham, M., Tan, J., Miller, L., Abbott, J., Nabben, K. and De Filippi, P. (2022). “Toward a Participatory Digital Ethnography of Blockchain Governance”. Qualitative Inquiry, DOI: 10.1177/10778004221097056.

Schneider, Nathan. (2019). “Decentralization: An Incomplete Ambition.” Journal of Cultural Economy 12, no. 4: 265–85.

Schwandt, T. A., and Gates, E. F. Case study methodology. In Denzin, N. K. and Lincoln, Y. S. (Eds.), Handbook of Qualitative Research. 5th ed. (SAGE Publications). 2018. 341-358.

Tang, Yong, Jason Xiong, Rafael Becerril-Arreola, and Lakshmi Iyer. (2020). "Ethics of blockchain: A framework of technology, applications, impacts, and research directions." Information Technology & People 33, no. 2. 602-632.

Thao Phan, Jake Goldenfein, Declan Kuch, and Monique Mann (eds). “Economies of Virtue – The Circulation of ‘Ethics’ in AI”. (Institute of Network Cultures). 2023.

Troncoso, C, Isaakidis, M, Danezis, G and Halpin, H. “Systematizing Decentralization”, 2017, 329–44.

Walch, Angela. (2017). Blockchain's Treacherous Vocabulary: One More Challenge for Regulators. Journal of Internet Law, Vol. 21, No. 2.

Walch, Angela (2019). Deconstructing 'Decentralization': Exploring the Core Claim of Crypto Systems. Chapter in Crypto Assets: Legal and Monetary Perspectives (Chris Brummer, ed), Oxford University Press, 2019.

Werbach, K. “The Siren Song: Algorithmic Governance by Blockchain” in the Digital Tornado. Cambridge University Press: United Kingdom. 2022.

Werbach, K. The Blockchain and the New Architecture of Trust. (Cambridge, MA: The MIT Press, 2018).

Wieringa, Maranke. (2020). What to account for when accounting for algorithms: a systematic literature review on algorithmic accountability. In Proceedings of the 2020 Conference on Fairness, Accountability, and Transparency (FAT* '20). Association for Computing Machinery, New York, NY, USA, 1–18. https://doi-org/10.1145/3351095.3372833.

Wright, A, and De Filippi, P. (2015). “Decentralised Blockchain Technology and the Rise of Lex Cryptographia.” SSRN Scholarly Paper. (Rochester, NY: Social Science Research Network). doi: 10.2139/ssrn.2580664.

Yeung, K. (2019). Regulation by blockchain: the emerging battle for supremacy between the code of law and code as law. The Modern Law Review, 82(2), 207-239.

Zargham M., Alston E., Nabben K., Ben-Meir I. (2023). “What Constitutes a Constitution?”. BlockScience Medium (blog). Available online: https://medium.com/block-science/what-constitutes-a-constitution-2034d3550df4. Accessed May, 2023.

Zargham, Michael. (2021). “Engineering Ethics in Web3.” Token Engineering Commons (blog). Available online: https://medium.com/token-engineering-commons/engineering-ethics-in-web3-18d981278018. Accessed May, 2023.

Suggested Citation:

Nabben, K. ‘Accountability in Decentralised Technology Communities and Blockchain Governance’. May, 2023. Substack / Medium. Available online: [LINK]

February, 2023

This post discusses a concept which builds on existing ethnographic approaches, that we call ‘Computer Aided Ethnography’ (CAE). Our ethnographic research on Web3 uses some of the same software tools that define ‘Web3’ (referring to communities that participate in the practice of decentralized technologies, such as public blockchains), as digitally native communities. In this post, we discuss why we do this, as well as how it builds on existing practices of ethnography to enable participation by a community being researched on their own terms. We find that CAE offers a unique methodological approach that enables research participants to contribute to both the social and technical dimensions of the research according to their preferences, creating fertile ground for ethnographic interactions and co-constitution in the field of Web3. It remains to be researched how CAE methods may be adapted and applied in other digitally native field sites.

Introduction

A community that assembles and uses digital tools becomes more-than-human when these tools are essential to that community’s operation. For instance, a decentralised autonomous organisation (DAO) may use smart contracts for actioning the decisions of members who wish to remain pseudonymous (for more on what is a DAO, see Nabben and Zargham, 2022). These actions would otherwise be difficult (if not impossible) as other options for minimising risk would require information about members that they are not willing to share. For such communities, peer-to-peer Web3 technologies are not just tools, they are machine agents that the community intentionally deploys to manage what members can and can not do. Not only do they define some important boundaries and intentions of that community, in most cases the community would not exist if not for these tools. As researchers using ethnographic methods, we have been utilising some of the same tools and infrastructures in our research, in conjunction with these communities. We do this to define the “field” within which our work takes place and to enable participation by the community on its own terms. We call this approach Computer Aided Ethnography (CAE), which is a subset of the broader practice of digital ethnography.

Where CAE comes from

Ethnography is traditionally a qualitative, inductive methodology with origins in cultural anthropology that relies on first-hand experience to gather observational and interview data and produce detailed and comprehensive accounts of different social phenomena (Hammersley, 2006). Ethnography is widely used to investigate people’s lived experiences in and across cultures and communities.

The concept of ‘Computer Aided Governance’ (CAG) refers to how we can use computers and computational innovations to better understand and steer complex systems, and emerges from complex system research and development firm ‘BlockScience’ (Zargham & Emmett, 2019). For example, CAG can provide tools and techniques for people to design and analyse governance proposals for complex, sociotechnical systems (Burrrata, 2021).

As an extension of this approach, CAE is about how we can use computers to better understand and research the dynamics of complex systems that incorporate digital components. In the same way that CAG is not governance by computers, CAE is not research by technology but rather research that leverages the technologies of the field being studied, to integrate the researcher into the practices of the communities they research.

For example, Computer Aided Ethnography is a valuable tool in the ethnography of decentralised technology communities (or “Web3”) because this is a sociotechnical field-site, composed of both social and technical dynamics (Nabben & Zargham, 2022). In this context, qualitative methods offer insights into the novel modes of self-governance occurring but technical tools are required to navigate the field-site and complement the researcher and/or participants.

How CAE fits within existing ethnographic methods

Computer Aided Ethnography is a subset of existing digital ethnographic methods. Ethnographic methods that acknowledge the relevance of digital environments are not new. Hine pioneered the methodology of “virtual ethnography” that considers “the field” in various forms, encompassing online and offline environments that have become embedded within our everyday lives and change culture, including the internet, new platforms, and devices (2000). Sherry Turkle and others have then broadened the focus of sociology to inspect the implications of ‘the digital’ through a focus on technological transformations that accompany ‘the digital age’ (Robinson & Halle, 2002; Turkle, 2005; Turkle, 2011). 

Furthermore, digital ethnography is less a specific method, and rather an approach to doing ethnography in the digital world that acknowledges both the study of the consequences of digital media in the everyday on people, culture, and society, as well as ways in which the practice of ethnography can occur through various forms of digital media (Pink, et. al., 2015). Digital ethnography encompasses “studies of people, societies, and sociotechnical relations that are digitally-saturated, or somehow impacted by transformations wrought by digitalization, widespread internet connectivity, and the large scale datafication of society” (Markham, 2016). Pink, et. al. describe the principles for digital ethnography as multiplicity, non digital-centricness, openness, reflexivity, and unorthodox (2015). Thus, digital ethnography embraces digitally mediated contact with research participants, as well as other digital information which offers an insight into human behaviours and expression, including data produced by humans, such as public-blockchain transaction records, social media ‘bios’ or interactions, and other movements or flows of information and value. Within such studies,  knowledge is derived from investigation, observation, experiment, or experience. Another approach in this vein is netnography, a qualitative research method concerned with the study of online cultures and communities, especially through and about social media networks (Kozinets, 2006). 

Researchers have also explored the application of computational methods in the context of ethnography. Computational ethnography (or ‘computational anthropology’) extends ethnography’s qualitative methodological toolkit with computational methods by conducting mixed-method scholarship in line with the broader principles of ethnography (Brooker, 2022). The logic here is that “our methods of knowing the social world should come from those whose day-to-day life produces it, rather than imposing a framework” (Brooker, 2022). Some examples of this practice exist, focusing on the practice of data science to support ethnographic methods (referred to by some as ‘trace ethnography’) (Geiger & Ribes, 2011; Geiger, et. al., 2018). Computational ethnography is also referred to as unobtrusive automation of data collection in situ (Zheng, et. al., 2015), and a way or addressing ethnography’s weaknesses (e.g. limitations in sample size and analytical transparency) by helping to scale ethnography, improve transparency, and address validity concerns, through techniques such as data visualisation, Social Network Analysis, and textual analysis (Ambramson, 2018). Yet, computational ethnography remains under-defined and underdeveloped as a comprehensive methodological approach. Thus, in our ethnographic practices we have been developing and applying ‘computational ethnography’ methods in the field of Web3 in novel ways, which will be explained in more detail below.

Furthermore, computational social science has also explored using data and computational tools to explore social science topics, closing the divide between the two disciplines (Ledford, 2020). Here, scholars have previously suggested ways to utilise digital tools to study digital domains, such as the Web. For example, based on the claim that the Web is a knowledge culture distinct from other media, Richard Rogers concentrates on the research methods and tools that would have not been possible without the Internet, that also align with the cultures of the Web (Rogers, 2013). Web native tools in research include building and tracking URL lists to identify censorship, making Twitter APIs comprehensible, researching Instagram hashtags, and documenting and analysing Facebook media (Rogers, 2019). Other scholars have explored how computational methods apply to social science practices, such as historical analysis but with an emphasis on developing technical skills, such as learning how to code (Brügger, et. al., 2019; Ledford, 2020). This approach does not necessarily encourage multi-disciplinary collaborations between computational and social scientists, as well as not necessarily imbibing the technical culture of a community being studied.

Rather than a re-appropriation of ethnography in new (digital) settings, CAE is a necessary extension of traditional ethnographic methods. In contrast to the prior approaches outlined that Computer Aided Ethnography seeks to build upon, Computer Aided Ethnography is not about using computational tools to extend traditional ethnographic methods or teach social scientists to use technical skills and tools. Rather, it uses and extends the computational tools of communities that have a presence in digital spaces. In this respect it follows participatory approaches pioneered in the fields of participatory communication and citizens’ media studies that bring community members and their chosen medium into the processes of data collection and sense-making (Cornish & Dunn, 2009; Tacchi, 2015). The remainder of this post explains CAE in more detail, including core principles and examples.

Both the introduction of novel or adapted technical components (e.g. software) and the ethnographer's presence as a participant observer modifies the sociotechnical field-site. The phrase ‘sociotechnical’ here refers to the interrelatedness of social and technical aspects of a system, describing the complex interplay between people and technology in which neither the social (such as people, relationships, and structures), nor the technology (such as hardware, software, and processes), can be considered in isolation from one another (Golden, 2013; Nabben & Zargham, 2022). This increases the fidelity of the observations through a combination of qualitative and quantitative data collection and triangulation of findings, while also increasing the direct impacts the ethnographic practice has on the field-site. Introducing technical tools to the field-site can also make it harder to distinguish phenomena created by the introduced tools from those already present, especially as the tools being introduced in CAE are digitally native to the community but adopted, and possibly adapted, by the researcher/s. 

The Principles of Computer Aided Ethnography

Through our practice, we have found that the dominant conceptions of digital ethnography as a method of digitally mediated contact and digital information as data only get us so far in understanding the principles and practices of communities that reside in digital spaces, and engaging with them. Computer Aided Ethnography utilises the digital tools of the community being studied, both to enhance research methods and deepen ethnographic experiences and insights, whereby computational tools augment research practices of observation, participation, data collection, data analysis, and findings communication and dissemination. CAE does not only acknowledge people’s occupation of digital spheres but utilises computational tools to enhance qualitative research practices. 

Thus, CAE uses digital-ethnographic methods not only to observe online communities but to access, understand, engage with, and process the subtleties and dynamics of communities that interact in digital spaces. This methodological approach is especially relevant for field sites such as Web3 communities where the practice of self-governance includes (but is not limited to) digital self-infrastructuring (Nabben, 2022). Thus, it is possible in other digital domains but this is context and culture dependent. 

CAE is not digital centric but digitally curious. As such, the method utilises existing tools of the community being studied and innovates new tools and techniques that integrate human-machine collaboration throughout the research lifecycle, according to the guiding principle that technical mechanisms augment the researcher and research participants. 

1.     Leverage the digital tools and infrastructures that research participants use

This component of CAE pertains to access, which refers to the process of entering a field site, or in this case, entering a digital community and culture. By using the tools of the community being researched in novel and relevant ways that enhance the research practices,  processes, and/or findings, the researcher enters the field site to become a participant-observer. This makes the ethnographer a social element of the sociotechnical system being studied and potentially a technical element of the system, depending on if they participate in operating infrastructure, such as running a node in a peer-to-peer network. For example, in decentralised technology communities, this may include Discord (Web2 chat application), public blockchains, Twitter, data content and storage networks (e.g. IPFS and Filecoin), multi-signature wallets, etc. 

2.   Identify (or develop) tools relevant to the digital field site to augment research practices through community participation

This component of CAE pertains to conducting research (observation and data collection) in a digital-first setting. CAE integrates computational methods into research practices, including data collection, data management, and data analysis. This is predicated on consent of, and benefit to, the humans in the system being studied. As such, CAE rests on the assumption that computers can augment human behaviours, including research practices. For example, a community using the chat applications ‘Telegram’ or ‘Discord’ may choose to introduce software “bots” to tag and log data, provide access to channels, or answer questions (Rennie, et. al., 2022).

The ethical considerations of introducing tools to a field-site must be considered by the researcher/s before commencing CAE. In this regard, Web3 communities are viable candidates for Computer Aided Ethnography because they are already engaged in experimental self-infrastructuring and have a bias in favour of the introduction of technical mechanisms to their communities (Nabben, 2022). CAE is not exclusive in its applicability to Web3, but Web3 is culturally relevant and appropriate to methods that surface the need for a methodological approach that leverages the digitally-native and participatory nature of this field. 

3. Reflexivity on social and technological experiences and adaptations (“Techno-reflexivity”)

This element of CAE emphasises the importance of reflexivity, and how it changes in CAE settings. Ethnography introduces the role of the researcher as a "participant observer" in the field, with the positionality of the researcher adding a social element to the dynamics we study. When we study sociotechnical systems with CAE, we can go one step beyond being participant observers by also leveraging pre-existing computational elements from the community being researched in the field, or introduce culturally appropriate computational elements as new actors in the field in which research participants participate, adding a technical element to the sociotechnical dynamics we study. As such, we must practise techno-reflexivity (as the positionality of the technology we introduce, not just our own positionality as researchers (Nabben & Zargham, 2020)), because we are acting as both participant observer and as "infrastructurers" (designers, builders, and operators of infrastructure (Nabben, 2022)) when we introduce new technological elements into the fieldsite.

Reflexivity is a process of reflection involving both emotion and cognition that results in new understandings of a phenomenon (Boud, 2010). Through this tool in ethnography, researchers engage in explicit, self-aware analysis of their own role and how intersubjective elements influence data collection and analysis (Finlay, 2002). In CAE, reflexivity must be practised with regards to both the social elements introduced (i.e. the participant observer/s) and the technical elements introduced (any technical tools the researcher/s adopted, adapted, or introduced). This practice of reflexivity in contexts where technology is subjectively designed or utilised by software developers or researchers can be referred to as “techno-reflexivity” (Nabben & Zargham, 2020). Relevant questions for the researcher/s to reflect on include; what is the cultural exchange when conducting CAE / between ethnographers and the community? What changes did the presence of the researcher/s, and/or their technical introductions create to the field site? Was any effect of the field social, cultural, or  technical? And so on.

4. Utilise the digital tools and infrastructures that the research participants use to communicate and disseminate research findings

This aspect of CAE is about the communication of research insights and findings. It requires the researcher/s to identify, observe, acknowledge, and leverage the cultural and communication practices of the community being studied. Digital communities often have unique communication methods and styles (Coleman, 2009). In order for researchers to effectively communicate and disseminate research findings in the ‘attention economy’ of digital spheres, researchers must leverage digitally native and culturally relevant approaches, tools, and platforms (Nabben & Zargham, forthcoming). An example of this in decentralised technology communities is the concept of ‘open-sourcing’ initial research insights as they arise, to align with the cultural norm of developers making software code publicly available for engagement (or ‘open source’).

CAE leans into and proactively seeks benefits to the researcher and research participants from introducing software (or other infrastructure, including hardware) into the field site, while being aware enough to safeguard against its harms, and also accounting for its own impacts on the system being studied. 

An example of this is seen in the research project and paper that introduced an application extension bot called ‘Telescope’ to a community's Discord chat application to help the community work with the researchers to identify and tag relevant research data in the chat (Rennie, et. al, 2022). The Telescope is a means to ensure that participants have visibility over the data that is being used and a means to consent (or not) to their dialogue being quoted in the research. It also involves community members in the process of data collection and reveals to the researcher the things they consider to be significant. Developing, deploying, and iterating on the Telescope Discord bot requires awareness and reflexivity on how introducing a novel computational research element affects and changes the dynamics of the community being observed. When the Telescope is active in a Discord server the approved comments appear in a bridge channel. We found that visibility over approved comments can prompt further discussion among community members, including dialogue on why themes and posts are significant (Rennie, et. al, 2022). In our next use of this tool we are experimenting with how the same dynamics might occur across DAOs using the same bridge channel (via the ‘DAODAO’ DAO). While ethnographers have long debated their role and impact in the field (for instance Altman & Hinkson 2010; Adler & Adler 1987), in this case the research tools are also extending the technical domain of the DAOs we study. 

Conclusion

This piece has explored the methodological concept of “Computer Aided Ethnography”, as a type of digital ethnography that enables participation by a community being researched on their own terms, which includes being able to participate in both the social and technical dimensions of the research. CAE is about what computational methods in qualitative research in Web3 domains (and potentially other digital domains) allow, as well as conducting research in a way that aligns with the culture of the community being studied in digitally-native domains. As such, CAE integrates qualitative and quantitative approaches to offer a unique approach to the investigation of digitally native communities, such as Web3. In setting out the core principles of CAE and providing examples of how this method is being practised in various contexts (see list that follows), our aim is to push the frontiers of doing digital ethnography in relevant and interesting ways to the communities we research, and enabling avenues of participation in ways that suit the preferences for engagement of these communities. 

Examples of Computer Aided Ethnography in Practice:

The following is a list of research projects at the forefront on decentralised governance, that are pioneering and utilising CAE methods to surface research insights and findings. This work is just some that we are aware of, coming out of BlockScience, RMIT University, Metagov, and others. 

Nabben, K., and Zargham, M. (2022). “The Ethnography of a ‘Decentralized Autonomous Organization’ (DAO): De-mystifying algorithmic systems”. EPIC Conference Proceedings, ‘Resilience’, 2022. https://anthrosource.onlinelibrary.wiley.com/doi/abs/10.1111/epic.12104.

Rennie, E., Zargham, M., Tan, J., Miller, L., Abbott, J., Nabben, K., & De Filippi, P. (2022). Toward a Participatory Digital Ethnography of Blockchain Governance. Qualitative Inquiry, 10778004221097056. 

Rennie, E. 2020. “The Governance of Degenerates Par II: Into the Liquidityborg”. Medium (blog). Available online: https://ellierennie.medium.com/the-governance-of-degenerates-part-ii-into-the-liquidityborg-463889fc4d82. Accessed Dec. 2022.

Tan, J. Z., & Miller, L. V. (2022). Building Net-Native Agreement Systems. MIT Computational Law Report. Available online: https://law.mit.edu/pub/buildingnetnativeagreementsystems. Accessed December, 2022.

Burrrata. “Mapping the Computer-Aided Governance Process.” BlockScience (blog), August 6, 2021. https://medium.com/block-science/mapping-the-computer-aided-governance-process-2e47eaf70889.

References:

Abramson, C. M., Joslyn, J., Rendle, K. A., Garrett, S. B., & Dohan, D. (2018). The promises of computational ethnography: Improving transparency, replicability, and validity for realist approaches to ethnographic analysis. Ethnography, 19(2), 254–284. https://doi.org/10.1177/1466138117725340

Adler, P., & Adler, P. (1987). Membership Roles in Field Research. SAGE Publications, Inc. https://doi.org/10.4135/9781412984973

Altman, J. C., & Hinkson, M. (2010). Culture crisis: Anthropology and politics in Aboriginal Australia. University of New South Wales Press.

Boud, D. 2010. “Relocating Reflection in the Context of Practice” in H. Bradbury, N. Frost, & S. Kilminster (Eds.), Beyond Reflective Practice. (New York: Routledge). pp. 25-36. 

Brooker, P. (2022). Computational ethnography:  A view from sociology. Big Data & Society, 9(1). https://doi-org.ezproxy.lib.rmit.edu.au/10.1177/20539517211069892.

Burrrata. “Mapping the Computer-Aided Governance Process.” BlockScience (blog), August 6, 2021. https://medium.com/block-science/mapping-the-computer-aided-governance-process-2e47eaf70889.

Coleman, G. 2009. “CODE IS SPEECH: Legal Tinkering, Expertise, and Protest among Free and Open Source Software Developers.” Cultural Anthropology 24 (3): 420–54. DOI: 10.1111/j.1548-1360.2009.01036.x.

Cornish, L., & Dunn, A. (2009). Creating knowledge for action: The case for participatory communication in research. Development in Practice, 19(4–5), 665–677. https://doi.org/10.1080/09614520902866330

Geiger, R. Stuart and David Ribes (2011). “Trace Ethnography: Following Coordination through Documentary Practices.” In Proceedings of the 44th Annual Hawaii International Conference on System Sciences (HICSS). http://www.stuartgeiger.com/trace-ethnography-hicss-geiger-ribes.pdf

Geiger, R.S., Varoquaux, N., Mazel-Cabasse, C., and Holdgraf, C. (2018). ”The Types, Roles, and Practices of Documentation in Data Analytics Open Source Software Libraries: A Collaborative Ethnography of Documentation Work.” Computer-Supported Cooperative Work (JCSCW), 27(3). DOI:10.1007/s10606-018-9333-1 https://link.springer.com/article/10.1007/s10606-018-9333-1

Finlay L. “Outing” the Researcher: The Provenance, Process, and Practice of Reflexivity. Qualitative Health Research. 2002;12(4):531-545. doi:10.1177/104973202129120052.

Golden, TD. 2013. “Sociotechnical Theory, in: Encyclopedia of Management Theory”. SAGE Publications, Ltd., Thousand Oaks. 752–755. https://doi.org/10.4135/9781452276090.

Hammersley, M. “Ethnography: Problems and Prospects.” Ethnography and Education 1, no. 1 (2006): 3–14. doi: 10.1080/17457820500512697. 

Hine, C. Virtual Ethnography (SAGE Publications Ltd: 2000).

Kozinets, R.V., 2006. Netnography. Handbook of qualitative research methods in marketing, pp.129-142.

Ledford, H. “How Facebook, Twitter and Other Data Troves Are Revolutionizing Social Science.” Nature 582, no. 7812 (June 17, 2020): 328–30. https://doi.org/10.1038/d41586-020-01747-1.

Markham, A.N. "Ethnography in the digital internet era." Denzin NK & Lincoln YS, Sage handbook of qualitative research, Thousands Oaks, CA: Sage Publications (2016): 650-668.

Nabben, K. 2022. ‘Decentralised Technologies as Self-Infrastructuring’. Mirror.xyz (blog). Available online: https://kelsiemvn.mirror.xyz/Obs11rquCCp20XB1nUiMTBU7bKWslThbfpF4Hf7n7Rg 

Nabben, K., and Zargham, M. 2020. “Techno-reflexivity”. Substack (blog). Available online: https://kelsienabben.substack.com/p/techno-reflexivity-cf1331278bdc 

Nabben, K., and Zargham, M. 2022. “The Ethnography of a ‘Decentralized Autonomous Organization’ (DAO): De-mystifying algorithmic systems”. EPIC Conference Proceedings, ‘Resilience’, 2022. https://anthrosource.onlinelibrary.wiley.com/doi/abs/10.1111/epic.12104.

Brügger, N., I. Milligan, A. Ben-David, S. Gebeil, F. Nanni, R. Rogers, W. J. Turkel, M. S. Weber, and P. Webster. “Internet Histories and Computational Methods: A ‘Round-Doc’ Discussion.” Internet Histories 3, no. 3–4 (October 2, 2019): 202–22. https://doi.org/10.1080/24701475.2019.1639352.

Pink, S., Horst, H., Postill, J., Hjorth, L., Lewis, T., Tacchi, J., Digital Ethnography, London, SAGE Publications Ltd, 2015.

Rennie, E., Zargham, M., Tan, J., Miller, L., Abbott, J., Nabben, K., & De Filippi, P. (2022). Toward a Participatory Digital Ethnography of Blockchain Governance. Qualitative Inquiry, 10778004221097056.

Robinson, L., and Halle, D. “Digitization, the Internet, and the Arts: eBay, Napster, SAG, and e-Books.” Qualitative Sociology, 25(3), 2002, 359–383. doi: 10.1023/A:1016034013716; Robinson, L. “The cyberself: the self-ing project goes online, symbolic interaction in the digital age.” New Media & Society, 9(1), 2007, 93–110. doi: 10.1177/1461444807072216.

Rogers, R. Digital Methods. Cambridge, MA: MIT Press, 2013. https://dare.uva.nl/search?identifier=82535a0e-75aa-48f8-8583-5aac0c9b900f.

Rogers, R. Doing Digital Methods. Los Angeles: Sage, 2019. https://dare.uva.nl/search?identifier=b6d2bfa8-e75e-45d8-b34c-617db7a5914b.

Tacchi, J. (2015). Ethnographic action research: Media, information and communicative ecologies for development initiatives. In The Sage Handbook of Action Research (pp. 220–229). Sage.

Turkle, S., “Computer Games as Evocative Objects:  From Projective Screens to Relational Artifacts*."* In Handbook of Computer Game Studies, Joost Raessens and Jeffrey Goldstein (eds.), MIT Press, 2005.

Turkle, S., Alone Together: Why We Expect More from Technology and Less from Each Other. New York: Basic Books, January 2011.

Zargham, M. & Emmett, Jeff. “Computer Aided Governance (CAG) — A Revolution in Automated Decision-Support Systems.” BlockScience (blog), May 19, 2021. https://medium.com/block-science/computer-aided-governance-cag-a-revolution-in-automated-decision-support-systems-9faa009e57a2.

Zheng, K., Hanauer, D. A., Weibel, N., & Agha, Z. 2015. “Computational ethnography: automated and unobtrusive means for collecting data in situ for human–computer interaction evaluation studies”. In Cognitive informatics for biomedicine. Springer, Cham. Pp. 111-140.

This blog post is a special one. It syntheses some of my initial PhD findings on ‘resilience in decentralised technologies’, ahead of a talk at the conference ‘What’s Governing Web3?’ at the Centre of Excellence for Automated Decision-Making & Society in December, 2022.

TLDR:

Decentralised technologies are resilient when a phenomenon that I term ‘self-infrastructuring’ occurs. ‘Self-infrastructuring’ is when people are able to participate in designing, owning, operating, governing, and/or maintaining their own infrastructure for resilience. It is the boundaries people place around their own actions in relation to shared purposes or goals, that are then expressed in technical and institutional infrastructure. Self-infrastructuring emerges from the collective will to adapt and continue to self-govern according to one’s political preferences. Resilience in this practice is contextual, relating to a person’s purpose or goals, threat model, vulnerabilities, and opportunities. As such, self-infrastructuring is motivated by the political will to self-govern towards specific purposes and against specific threats through technological and social means. Decentralised technology communities’ self-infrastructure in a variety of contexts and through a variety of methods, including algorithmic and organisational structures (such as DAOs), full-stack self-infrastructuring (such as hardware), and institutional infrastructure. How well people can collectively articulate their political objectives, identify their threat model, and clearly express this in software code and coordination rules (on or off-chain), to organise and adapt in line with that objective, determines resilience. When self-infrastructuring does not occur and people cannot set boundaries around their own actions in relation to their goals, resilience breaks down.

Introduction

Decentralised technologies are often thought of as secure, empowering, and ‘resilient’. This multi-year research project set out to develop an in-depth understanding of the affordances of decentralised technologies in terms of resilience through an infrastructure studies lens and qualitative mixed methods of historical analysis and ethnographic observation and interviews with a variety of community-level developers, implementers, and users of decentralised technologies, and through identifying and tracing vulnerabilities. Here, I take resilience to mean “adaptability and transformability of a socio-technical system in response to threat or crisis” to foreground the dynamic, continuous adjustment, between humans and technology, as people pursue their goals, or flexibility under uncertainty, in people’s given context. This research has taken place at the disparate and ephemeral digital-first field site of ‘decentralised technologies’ to investigate and observe the concept of resilience and the infrastructural practices of decentralised technology communities across conception, design, development, implementation, and use. I show what resilience is in decentralised technologies, when and how it occurs, and under what conditions it is limited or challenged.

I show how resilience is conceived of, enacted using decentralised technologies, and experienced (or not experienced) by participants in its use to respond the overarching research question of ‘are decentralised technologies resilient?’. I find that resilience in decentralised technologies is understood and occurs through the practice of ‘self-infrastructuring’.

By self-infrastructuring, resilience in decentralised technologies is determined by the boundaries people place around their own actions in relation to a specific, shared purpose. It is in the study of infrastructuring in decentralised technology communities that leads to the discovery of resilience in decentralised technologies as ‘self-infrastructuring’. Good information infrastructures are those that are adaptive to changing circumstances and environments (Star & Bowker, 2010). Infrastructure is a ‘doing’ word and resilience is a dynamically emergent phenomenon, not a static end state or outcome. The verb “to infrastructure” denotes the activities, processes of integrated materials, tools, methods, and practices that make up and change an infrastructure (Star & Bowker, 2010). Thus, ‘infrastructuring’ is an ongoing process of doing, and these processes are incremental, iterative, and long-term (Karasti et al., 2010). Infrastructure emerges as a “relational property”, inseparable from its use, which exists or “is” when its purpose connects to its functional use by a person or community (Star & Ruhleder, 1996). The boundaries of action and interaction in decentralised technologies are infrastructured through both technical processes and social processes, resulting in both technical and institutional infrastructure. Self-infrastructuring enables voluntary participation in the rules of infrastructure, which allows for adaptivity and accountability in relation to shared goals. The agency that self-infrastructuring affords helps to facilitate adaptivity amidst internal or external crisis, without so much deviation from shared goals that infrastructure collapses.

Self-infrastructuring is why decentralised technology communities are adaptive and resilient in some cases — when people can collectively articulate their political objectives, identify their threat model, and clearly express this in software code and coordination rules (on or off-chain), to organise and adapt in line with that objective. This depends on how well people articulate their purposes and goals, identify their threat model and own vulnerabilities, and express this in the rules of infrastructure. Where there is a disconnect between the purpose of a group and these rules of their infrastructure, the ability to self-infrastructure is limited (in terms of the capacity to structure, own, operate, or maintain infrastructure) and resilience breaks down.

Self-infrastructuring is also why centralised digital platforms and infrastructures cannot be considered resilient by decentralised technology practitioners. As one research participant put it, “whoever controls infrastructure controls society”. What is implied is that this must be ‘us’.

This insight informs the three key findings, that: resilience in decentralised technologies is about ‘self-infrastructuring’, self- infrastructuring is political, and that when self-infrastructuring does not occur, resilience breaks down.

1. Resilience in decentralised technologies is about ‘self-infrastructuring’

Resilience in decentralised technologies is about ‘self-infrastructuring’, meaning awareness of and participation in designing, owning, operating, governing, and/or maintaining one’s own infrastructure. It is the boundaries people place around their own actions in relation to shared purposes or goals, that are then expressed in technical and institutional infrastructure

In this context, resilience is enhanced by writing your own infrastructural rules and having agency to act according to these rules. This allows for people to take responsibility for their own infrastructure and self-governance. In this context, self-governance is being able to abide by infrastructural rules, be it technical or institutional — as the set of political, legal, and cultural institutions that form the backdrop for economic activity and governance and enable or constrain its operation or adapt them when needed.

Resilience in this practice is contextual, relating to a person’s purpose or goals, threat model, and vulnerabilities. This gives rise to a plethora of possible threats and vulnerabilities in and against decentralised technologies. In this respect, self-infrastructuring is motivated by ‘the will to infrastructure’. The will to infrastructure is the political, collective, strong driving purpose or desire to self-govern through infrastructural means, and against a specific threat, that is informed by a particular world view. The will to self-infrastructure is essential in motivating the practices of self-infrastructuring, despite the potential inconveniences, efficiency costs, and resources required in terms of time, effort, cost, knowledge acquisition, and/or risk. Even if the will to infrastructure is for a functional purpose, there is usually a political motive behind that.

Decentralised technology communities enact resilience by self-infrastructuring in a variety of contexts, against a variety of threats, and through a variety of methods. The self-infrastructuring practices of decentralised technology communities include algorithmic and organisational structures (such as DAOs), what I call “full-stack self-infrastructuring” (such as hardware), and institutional infrastructure (such as governance tools and processes to guide infrastructural practices (Nabben, 2022)).

Self-infrastructuring can both enhance resilience and create new vulnerabilities. These threats and vulnerabilities to resilience in decentralised technologies can be exogenous, attacking from outside of the community, or endogenous, emanating from internal community dynamics or forces. When self-infrastructuring does not occur and people cannot set their own boundaries around their actions in relation to their goals, resilience breaks down. This will be further explored in finding three. The second findings is that self-infrastructuring is political.

2. Self-infrastructuring is political

Self-infrastructuring is motivated by the political will to self-govern towards specific purposes and against specific threats through digital means. Political purposes are inscribed in the infrastructure of self-infrastructuring. Yet, in decentralised technologies, the politics of infrastructure dictate the requirements for resilience to produce new things. The political forms of rationality revealed by decentralised infrastructure is that people can self-govern. Decentralised technologies expressly aim to explicitly embed political rationalities by encoding the rules of governance actions and interactions. Political narratives shape the purpose of decentralised technologies and translate into the technical requirements of how an infrastructure functions.

From the outset, decentralised technologies are reflective of political aspirations, rather than the mathematical invention of public-key cryptography, or a cult of personality (for example, the identity of the Founder of Bitcoin, the pseudonymous Satoshi Nakamoto, remains a mystery to this day) (Nabben, 2021). Each case study reveals how the political motivates, influences, and is affected in each of these instantiations of self-infrastructuring from threat perception, to technological solutions, and institutional dynamics.

Through the political modes of self-infrastructuring new infrastructural dynamics emerge and new voices are inserted into political spaces (more on this coming soon in an accepted paper). In cases where self-infrastructuring occurs, novel dynamics are emerging where new stakeholders hold political influence. What occurs is that infrastructuring takes place through new organisational structures that include the materiality of algorithms, software, hardware, and people. It is not through the efforts of one project or group that political change occurs but through a decentralised movement where each module produces something that others can build on as composable infrastructure. Through these materialities, new things are enabled, from public blockchains, to distributed funding mechanisms, to censorship-resistant blogs, to opensource microchip distribution and integration.

Not only are these infrastructures inextricably linked to politics, from their design, to maintenance, to use but politics is a feature, not a bug, in shaping the threat models, design, and the resilience that infrastructure can afford. How well people can collectively articulate their political objectives, identify their threat model, and clearly express this in software code and coordination rules (on or off-chain), to organise and adapt in line with that objective, determines resilience. This means that resilience is largely determined by factors internal to the system (endogenously), for example, goals, rules, processes, software code, and community norms. Thus, resilience can be controlled for but only by acknowledging forces beyond the technical.

While these bespoke, decentralised infrastructures can be highly dynamic and adaptive through the practices of self-infrastructuring described, they don’t always work in practice, or as intended. This is explored in finding number three that follows.

3. Resilience breaks down when self-infrastructuring does not occur

Resilience is compromised when the political and technical purpose of an infrastructure becomes misaligned. Investigating why resilience was experienced or not in the use of decentralised technologies highlights the inextricable and co-constructive interplay between social and technical components of infrastructure.

By definition, the interplay between social and technical dynamics of infrastructure in a sociotechnical system is inextricably interlinked, so that neither the social (such as people, relationships, and structures), nor the technology (such as hardware, software, and processes), can be considered in isolation from one another (Golden, 2013). In every case study, the importance and role of institutional infrastructure were foregrounded in generating and governing that adaptivity to enhance resilience, as the set of political, legal, and cultural institutions, that form the backdrop for economic activity and governance, which enable or constrain its operation (Hinings, et. al., 2017). Social coordination layers that surround the use of technology required to guide processes and practices of implementation around data ownership, governance, storage, and maintenance of data to bridge the “gateway moments” (Edwards, et. al., 2009) of linking infrastructure for scale, ongoing adaptivity to changes in environments, and to serve people’s needs in their local context (see Nabben, 2022 for the draft working paper. The full one has been accepted by IEEE and is coming soon TM.). Based on this insight, I argue that separating the technical operation of infrastructure and the social processes of structuring and governing (institutional) infrastructure undermines resilience.

Self-infrastructuring as a doing word, means that decentralised technologies are not resilient independent of the humans that use them. Resilience is not about perfecting the technical but that the infrastructure is only relevant when used, and when used, will break down. This means that there is a difference between the narrative of decentralised technologies as resilient, and how resilience is afforded in practice through both technical and social means. In technologically dominant or technologically deterministic engineering cultures such as public blockchain protocols, it is often thought that the technical layer of infrastructure is superior to the weak, corruptible, social dynamics and human layer (Filippi, & Loveluck, 2016).

In the techno-deterministic view of some decentralised technology community members, the social dynamics of a system are only vulnerabilities that are bound to break down, amidst a narrative of “governance minimization” through “governance automation” to remove social dynamics through algorithmic governance (Ehrsam, 2020). Yet, vulnerabilities can occur across the social, technical, economic, and even legal and or environmental dimensions of infrastructure, and only a multi-dimensional approach to resilience can account for the adaptivity required to identify and address these concerns. Indeed, social dynamics can and do break down resilience, but they are also required to make it. This depends on the severity of the consequences of the threat model at hand. For example, one engineer asked me about my findings on decentralised storage about the role of institutional infrastructure in facilitating resilience: “so, it’s the social layer that breaks down, not the technical?”. This misses the point, that resilience does not emerge from infrastructure, it emerges from infrastructures that support human capacities. How people engage to shape, use, or re-purpose an infrastructure is an active process of adaptation, which influences and determines resilience.

In practice, it is not possible for the technical layer to be resilient while the social layer is not, as the social and technical dynamics of infrastructure are co-constitutive. It is through use that resilience is situated in context, dependent on social dynamics, and adapting (or not) to meet the challenges of both external threats and internal vulnerabilities in relation to the purpose of the technology and community in question. When people imagine decentralised technologies as resilient, they often do not take into account the complexity of the lived experience of self-infrastructuring towards one’s goals. This is also true of centralised technologies. We think they are resilient because of the narratives that companies propagate. In this case, people do self-infrastructuring with them too (in that they use them for purposes other than what they were originally intended and may even adapt them in the process). How resilience plays out differently in decentralised technologies relates to agency in relation to rules.

Both the social and technical can be co-constructive or undermining of resilience, as demonstrated in the interplay between sybil attack bots and machine learning defence in GitcoinDAO. Decentralised technologies, being peer-to-peer or permissionlessly participatory infrastructures, by nature do not exist without “embeddedness” in the “organizational arrangements” (Star, 1999) of a community. Infrastructure is “part of human organisation” (Star, 1999). Through the social layer, decentralised infrastructure can also be organised and re-organised (adapted) to improve resilience. The social layer of institutional infrastructure affords adaptivity to deliberate and change the rules of the system in the face of changing circumstances.

Another aspect that delineates self-infrastructuring in decentralised technologies from centralised infrastructure is that institutional dimensions are not imposed on the system from the outside but arise endogenously through the phenomenon of ‘self-governance’. Infrastructure is fundamentally relational; it emerges for people in practice, connected to activities and structures. It consists of both static and dynamic elements, each equally important to ensure a functional system. Infrastructuring accounts for the social and organizational dimensions of infrastructure. This understanding requires adopting a long-term rather than immediate time frame and thinking about infrastructure not only in terms of human versus technological components but in terms of a set of interrelated social, organizational, and technical components or systems (Bowker, et. al., 2010). Resilience, in this context, is process-oriented, as a continual, dynamic, adaptive phenomenon, rather than outcome-oriented.

Self-Infrastructuring Futures

Having previously explored the origins of the concept of resilience in decentralised technologies in my historical research, I turn my attention to the ethnographic futures of decentralised technologies to ‘unfix’ and ‘unsettle’ the concept of self-infrastructuring for resilience in the remainder of this piece.

I hope to share more with you on soon.

Acknowledgements:

Thank you to my supervisors, Professor Ellie Rennie and Associate Professor Chris Berg, as well as colleagues at the RMIT Blockchain Innovation Hub, and collaborators (especially Michael Zargham and the team at BlockScience), without which, this would have been much less fun or interesting). There are also numerous contacts, communities, and research participants who have so kindly engaged in interviews and/or observations, that contribute to these findings.

Thank you also to those that support and encourage my work by subscribing to my blog on Substack or NFTing my work on Mirror.xyz.

References:

De Filippi, P, and Loveluck, B. 2016. “The Invisible Politics of Bitcoin: Governance Crisis of a Decentralised Infrastructure” Internet Policy Review, 5, 3. doi: 10.14763/2016.

Edwards, P, Bowker, G, Jackson, S, and Williams, R. “Introduction: An Agenda for Infrastructure Studies.” Journal of the Association for Information Systems, 10 (5, 2009). doi: 10.17705/1jais.00200.

Ehrsam, F. 2020. “Governance Minimization”. Paradigm. Available online: https://www.paradigm.xyz/2020/10/870#what-governance-minimization-is-not . Accessed December, 2022.

Folke, C., S. Carpenter, B. Walker, M. Scheffer, T. Chapin, and J. Rockström. 2010. “Resilience Thinking: Integrating Resilience, Adaptability and Transformability.” Ecology and Society 15 (4). https://doi.org/10.5751/ES-03610-150420.

Golden, TD. 2013. “Sociotechnical Theory, in: Encyclopedia of Management Theory”. SAGE Publications, Ltd., Thousand Oaks. 752–755. https://doi.org/10.4135/9781452276090

Hinings, C.R., D. M. Logue, and C. Zietsma. “Fields, institutional infrastructure and governance.” The Sage handbook of organisational institutionalism. 2017.

Karasti, H., Baker, K. S., & Millerand, F. (2010). Infrastructure time: long-term matters in collaborative development. Computer Supported Cooperative Work (JCSCW). doi:10.1007/s10606–010–9113-z.

Nabben, K. (2021). “Resilience as ‘Political Decentralization’: An Alternate History of the Cypherpunks Origins of Decentralised Technology”. Available at SSRN: http://dx.doi.org/10.2139/ssrn.3938626

Nabben, K. (2022). “Decentralized Technology in Practice: An analysis of socio-technical resilience in IPFS”. Available at SSRN: http://dx.doi.org/10.2139/ssrn.4082016

Ranciere J. 2006. The Politics of Aesthetics: The Distribution of the Sensible. Transl. G Rockhill. London: Continuum

Star, S. L. The Ethnography of Infrastructure. American Behavioral Scientist 43, no. 3 (1999): 377–391. doi:10.1177/00027649921955326.

Star, S. L., and G. C. Bowker. (2010). “How to Infrastructure.” In Handbook of New Media: Social Shaping and Social Consequences of ICTs, Updated Student Edition, 230–45. London: SAGE Publications Ltd, 2010. https://dx.doi.org/10.4135/9781446211304.n13.

Star, S. L., and Ruhleder, K. “Steps Toward an Ecology of Infrastructure: Design and Access for Large Information Spaces.” Information Systems Research 7 (1996): 111

Hyperlinks:

Kelsie Nabben on Substack: https://substack.com/profile/1619235-kelsie-nabben

Nabben, K. 2021. “DAO Vulnerabilities”. BlockScience Medium. Available online: https://medium.com/block-science/dao-vulnerabilities-509ff074a296.

Nabben, K. (2022). “Decentralized Technology in Practice: An analysis of socio-technical resilience in IPFS”. Available at SSRN: http://dx.doi.org/10.2139/ssrn.4082016.

Nabben, K. (2021). Is a “Decentralized Autonomous Organization” a Panopticon? Algorithmic governance as creating and mitigating vulnerabilities in DAOs. In Proceedings of the Interdisciplinary Workshop on (de) Centralization in the Internet (IWCI’21). Association for Computing Machinery, New York, NY, USA, 18–25. https://doi/10.1145/3488663.3493791

Zargham, M. and Nabben, K. (2022). “Aligning ‘Decentralized Autonomous Organization’ to Precedents in Cybernetics” Available at SSRN: http://dx.doi.org/10.2139/ssrn.4077358

If I was part of any DAO, I would want it to be “Friends With Benefits.” It is just so darn cool. As a vortex of creative energy and cultural innovation, the purpose of its existence seems to be to have fun. FWB is a curated decentralized autonomous organization (DAO) filled with DJs, artists and musicians with banging distribution channels for writing, non-fungible token (NFT) art and more.

FWB’s vision is to equip cultural creators with “the community and Web3 tools they need gain agency over their production” by:

• Making the concepts and tools of Web3 more accessible

• Building diverse spaces and experiences that creatively empower participants

• Developing tools, artwork and products that showcase Web3’s potential

The DAO has already made significant progress towards this mission, with some of its members finding major success in the art world. One example is Eric Hu, whose generative AI butterfly art “Monarch” raised $2.5 million in presale funds alone.

The DAO crosses from the digital realm to the physical via its members-only ticketed events around the world, including exclusive parties in Miami, Paris and New York. The latest of these events was “FWB Fest,” a three-day festival in a forest two hours east of Los Angeles.

FWB wants to grow in a decentralized way by having its members run local events around the world based on the FWB Fest model. But the problem is that FWB’s governance and funding isn’t exactly decentralized, which is paradoxical to its mission.

Read the full story at CoinDesk…

The secret of change is to focus all of your energy not on fighting the old, but on building the new. – Dan Millman in “Way of the Peaceful Warrior” (1984).

Abstract

This piece offers an introductory playbook to researchers looking to enter the field of ‘Web3.0’. Web3.0 is a practice in participatory infrastructures of co-creation, through the ability to read, write, and own digital assets. First, I describe the field itself, where it is, and how to access. I explore Web3.0 origins, the serious and playful cultural aesthetics and hacker ethics of Web3.0, and outline some fundamental analytical lenses to aid researchers in identifying some of its core themes and unique features. Drawing on qualitative examples from my own research as an ethnographer in the field, I argue that the play, politics, and prefiguration that undergirds Web3.0 is one of “exiting” existing institutional structures. In light of this, I emphasize that one of the underlying challenges to Web3.0 is learning “how to infrastructure?”.

Introduction: Gaining Access

It was worth leaving the house for the local “WEB3 HACK” meetup that Thursday evening, despite my post-COVID social anxiety about being in crowds and having to make small talk. In reward for our interest and attention, each attendee got “airdropped” Zcash privacy coin to our digital wallet address. I chose the mobile wallet brand called “Nighthawk” to receive the equivalent of 18 cents in privacy coin. The transaction included a secret memo containing a “shielded love note”, that was cryptographically hidden from external surveillance or snooping.

I was late to register for the airdrop by providing my wallet address, somewhat desperately “DMing” (direct messaging) the well-known founder on Twitter in the middle of their talk to include me in their software script” that would drop to all the addresses at once.

“Hi! wave emoji. Please add me to your bash script. Wallet address: zs1tegqkd6ll92ktc2gxr874ljy7qjau5aa7pspp6rrktnaeyl82fgrdh6zxlr5pjznsdgpjmyqaef. Ty! thank you hands emoji. Also, I would love to interview you for a research article on the cypherpunks and origins of decentralised technologies to test some assumptions.”

To my surprise, they responded.

“Hi. Check your Shielded Love Notes!”

Opening up my NightHawk wallet, the transaction memo read: “Hi, Kelsie, nice to meet you! How did you think the meetup went yesterday? What assumption are you trying to test?”.

With the tiny amount of coin I had received, I could still afford to send micro transactions of cryptocurrency with a memo attached each time. The messages exchanged were shielded by “zero knowledge” cryptography on the Zcash privacy coin blockchain.

“I’m interviewing a well-known cryptographer and privacy coin founder, mediated by cryptographically shielded love note transactions on the blockchain they invented!” I thought to myself, writing:

“There are not enough characters in the memo or Zcash in my wallet…Also, I need your approval to interview”, referring to the ethics form I needed them to sign to consent to an interview to comply with University processes.

The decentralized, digital technologies that comprise “Web3.0” are born out of the idea that access to encryption technology is a right, and an essential one in the information age of computers. Sliding into the DM’s of Web3 personalities, pseudonyms, and managing numerous coins, wallets, and “seed phrase” passwords all part of navigating the boundaries of deep community participation between the online and offline domains in accessing and entering Web3.0.

This piece aims to demystify Web3.0 for researchers, by providing a working definition, outlining its origins, identifying a number of key themes and analytical lenses, and cutting to the crux of its political purposes and underlying challenges. I depict one lens of what Web3.0 is as “infrastructure”, where it occurs, and how to enter it.

I present Web3.0 as composed of the following attributes of:

(1) Permissionless (to access) (2) Pervasive (participatory infrastructures and personal entanglement) (3) Prickly (characters) (4) Playful (aesthetics, such as memes) (5) Political (origins and ambitions) (6) Prefigurative (A bias towards action or “BUIDL”ing, a new world from within)

These themes of ‘permissionless’, ‘pervasive’, ‘prickly’, ‘playful’, ‘political’, and ‘prefigurative’ are subtly and deliberately threaded throughout this piece as “easter eggs” in theoretical explorations and qualitative examples for the reader to uncover, apply, and make meaning of. By analysing some of Web3.0’s key themes and politics, I argue that Web3.0 is about “exiting” existing institutions to build its own structures of self-governance from within the prevailing societal hierarchies and power structures. In conceptualising Web3.0 as infrastructure, it becomes clear that the fundamental contradiction of Web3.0’s ambition to build and create is figuring out what to build, or “how to infrastructure”.

What is Web3.0? A Brief Background

“Web 3.0” has been described as the next generation of the internet that will shift power away from corporates to individuals (Stevens, 2022). If Web2.0 gave people the ability to read, as well as “write”, digital media on the World Wide Web (for example, blogs), then Web3.0 is a platform infrastructure to “read, write, and own”. For ownership, the cryptographic properties of private key management in cryptocurrency, combined with the shared, distributed consensus of blockchain-based ledgers (basically, databases) provide the foundations for cryptocurrency tokens to represent property rights and ownership of decentralized digital assets and networks. As such, this piece largely focuses on blockchain as a foundational, enabling infrastructure for Web3.0, and blockchain communities as a field site.

The promise of Web3.0 is a decentralized infrastructural base, that anyone can build on, and everyone can own. Web3.0 provides a next generational, peer-to-peer network for participatory self-organizing, and a new infrastructural “archetype” (Stefik, 1996). The unique components of public blockchains are the combination of distributed computing, cryptography, and self-provisioning public infrastructure (such as money) to coordinate without central intermediaries. This has given rise to what has been labelled as a new field of “cryptoeconomics” (the application of cryptography and economics for new forms of institutional infrastructure) (Berg, et. al., 2019). Grounded in the purity and infallibility of mathematics, cryptoeconomic systems combine cryptography and economics to “produce new methods of communication, cooperation, and organization” (Cowen & Tabarrok, 2022). Blockchains are a technical expression of the politics of “exit, choice, and loyalty” (Hirschman, 1972). They provide an alternative, free market response to the decline in organizations and nation-states. Adoption of this philosophy in the space has perpetuated the idea that blockchains enable freedom, through choice.

In response to these features, public blockchains have been described as creating “new institutional possibilities” and providing a “blueprint for a new economy” (Swan, 2015; Berg, et. al., 2019). In blockchain systems, the rules of collective governance are designed and encoded for software to enact these rules through ordered, distributed consensus. When applied to governance procedures, this purportedly offers institutional infrastructure that minimizes trust in existing institutions through computational processes, including transparent and verifiable software code and cryptography (Szabo, 2017). In theory, code reduces the need for third party regulators, as the system can regulate itself (Wright & De Filippi, 2015). This “input-processing-output” perspective on the world has been described as “blockchain thinking” (Swan, 2017). Manifestations of these decentralised systems include “Decentralized Autonomous Organizations” (DAOs), Decentralized Finance (DeFi), Non-Fungible Tokens (NFTs), “open” Metaverses and more (Nabben, 2021).

Where did Web3.0 come from?

Decentralised technologies offer an information infrastructure with unique attributes, in that it is participatory, open-source, and encrypted, suggesting the possibility of social coordination that is free from unwanted third-party interference. The combination of distributed computing, cryptography, and the idea of self-provisioned digital monies led to the invention of Bitcoin, the first functioning, “peer-to-peer digital cash” (Nakamoto, 2008). The concoction of this invention is largely credited to the “cypherpunks”, a 1990s sub-cultural group of cryptographers, computer engineers, and philosophers (Swartz, 2018; Maurer, et. al., 2013; Brunton, 2019). The cypherpunks have been described as key political protagonists in the engineering of Web3.0 political economies (Brekke, 2020).

Cryptocurrencies and Web3.0 emerge as an early but accurate reaction to the potential of computing to greatly enhance the surveillance state and surveillance capitalism (Nabben, 2021). The advent of public key cryptography enabled access to the ability for identities to communicate securely over insecure networks (Diffie & Hellman, 1976). The cypherpunks converged over the shared belief that public key cryptography was a powerful tool in re-structuring society. According to Timothy C. May, author of the Crypto-anarchist Manifesto and co-founder of the Cyphepunks Mailing List, cryptography has the ability to “fundamentally alter the nature of corporations and of government interference in economic transactions”, (although we know that public blockchains, as an instantiation of this vision, are indeed very traceable, with professionalised organisations offering this service) (May, 1992).

Web3.0 perpetuates computer subcultures of old by embracing the hacker ethic of participatory organizing. Hacking is about political re-ordering (Coleman, 2011). The cultural politics of Web3.0 are in many ways a continuation of hacker traditions, embracing political ambition through ‘playful tinkering’. Although serious in its underlying ambition, development is conducted playfully and for the “lulz” (laughs) (Coleman, 2014), as both a challenge and a game. Yet, in Web3.0, hackers are not breaking, but “BUIDLing”.

Web3.0 is evolving from holding its ground, to taking new ground. Web3.0 has emerged from encryption and anarchy, not for tearing down but for creating value networks that re-structure society in ways where people have more control. For hackers, “code is speech”, meaning a sphere for free speech and protest (Coleman, 2009). In Bitcoin, “code is law”, referring to the immutable, software code that acts as legal enforcement of the rules of the system (Lessig, 2000). In Web3.0, code is creation. Its playful origins that were once surmised in the meme phrase “HODL” (meaning, hold your tokens despite market bear and bull runs), are now described as large-scale infrastructure engineering projects, encapsulated in the surprisingly popular meme “BUIDL” (meaning, build). Creation speaks of ‘experiments’ in new institutional infrastructures and societal possibilities for self-organization.

In the study of infrastructures, one way to identify emerging ecosystems is by their master narratives (Star & Ruhleder, 1996). Blockchain, and by extension Web3.0, can be known by its political imaginaries and expressions (Husain, et. al., 2020). Blockchains configure our social reality by configuring social relations and constituting new social realities (Reijers & Coeckelbergh, 2016). The subliminal question behind Web3.0 is, what is being built, or 'how to infrastructure?'.

To be continued in "Defining Web3: An Off-Chain Collective Research Project"...

“Decentralized Autonomous Organizations” (DAOs) are everywhere, yet it is unclear what a DAO is (or isn’t), and what design elements constitute a DAO.

Already, DAOs are diverse. DAOs have helped to shift early blockchain community debates from “one blockchain to rule them all” to a “pluriverse” of multiple chains and ecosystems that serve a variety of purposes and interoperate for user choice. As such, DAOs can be designed for any number of organizational functions to serve different objectives.

First, this piece frames “what is a DAO?” by drawing on conceptions of DAOs from different disciplines in an effort to disambiguate DAOs as an amorphous entity. It then explores DAO design patterns according to different ontologies (including law, economics, and cybernetics).

I present the fundamental components that constitute a DAO and determine its design pattern and argue that DAO ontology affects DAO design, including the realities and possibilities of what these organizational forms could be.

What is a DAO? Exploring DAO definitions

The term “DAO” stands for “Decentralized Autonomous Organization”. Although nascent, DAOs have a rich history and are continuing to evolve. How DAOs are defined and then designed, is contextual depending on the subjective conception of how a DAO is defined and is the purpose a DAO hopes to achieve.

Broadly, DAOs can be defined as a multi-agent system, working towards a shared objective. In these human-machine systems, computational components aid coordination (operational efficiency and/or decision-making, although that latter is less prevalent at this stage). In a blockchain context, public, decentralized blockchains provide an infrastructural foundation to facilitate coordination by reducing transaction costs (the costs of participating in a market). As such, DAOs provide an institutional infrastructure, to enact “a governance model sanctioned by software”.

Where did DAOs come from?

The pre-DAO history of decentralized technologies, encryption technology, and public blockchains is imperative in contextualizing DAOs today. In many ways, DAOs perpetuate early cypherpunk ideologies of political decentralization. Here, autonomy refers to self-governance or independence from external political direction or coercion, and this goal is pursued via technological means.

The precursor concept of “Decentralized Autonomous Corporation” (DAC) emerged in blockchain communities in a post by Ethereum co-founder Vitalik Buterin in 2013 in Bitcoin Magazine exploring how to bootstrap a DAC. It then appeared in the Ethereum whitepaper and a related terminology guide on “DAOs, DACs, DAs, and more”.

Rule of First Mention: Cybernetics

The concept of DAOs can be aligned to precedents in the area of cybernetics.

As I’ve previously explored, the phrase “Decentralized Autonomous Organization” was first mentioned in the field of cybernetics by German Computer Scientist Werner Dilger.

Dilger referred to an “intelligent” home system that operated like an immune system in “identifying, defining, and maintaining the self” to “cooperate with other agents by sending messages and interpreting incoming messages such that the whole system fulfills the task it is designed for” as a “Decentralized Autonomous Organization”. Dilger understood the concept as a complex, multi-agent information processing system that is autonomous, meaning self-sustaining and self-referential.

As computational organizations, DAOs are comprised of humans and technology.

The cybernetics approach evokes the possibility for DAOs to embody biomimetic organizations of human-machine ensembles that emulate models of symbiosis seen in nature (such as evolution, co-dependence, and augmentation). This ontology is perhaps closer to the idea of DAOs as “regenerative economies”.

Law

Legal definitions have been some of the first to be formally defined in the literature on blockchain-based DAOs. Here, legal scholars have defined DAOs as “a blockchain-based system that enables people to coordinate and govern themselves mediated by a set of self-executing rules deployed on a public blockchain, and whose governance is decentralized (i.e., independent from central control)”.

Other legal scholars have pointed out that DAOs operate according to different legal and business assumptions from other organizations. Aaron Wright states that DAOs “aim to be governed by democratic or highly participatory processes or algorithms”. This view hints at the computational, automated, and algorithmic nature of these organizations, whereby software manages procedural elements of organizing, to allow humans to focus on the more substantive elements.

The “DAO Model Law” guide by COALA researchers outlines 11 technical and governance requirements for DAOs to meet the requirements for legal recognition as an entity, including:

1. Deployed on a blockchain,

2. Provide a unique public address for others to review its operations,

3. Open source software code,

4. Get code audited,

5. Have at least one interface for laypeople to read critical information on DAO smart contracts and tokens,

6. Have by-laws that are comprehensible to laypeople,

7. Have governance that is technically decentralized (i.e. not controlled by a single party),

8. Have at least one member at any given time,

9. Have a specific way for people to contact the DAO,

10. Have a binding internal dispute resolution mechanism for participants,

11. Have an external dispute resolution mechanism to resolve disputes with third parties(e.g. service providers).

These factors and considerations constitute a legal basis for conceptualizing DAOs.

Institutional Economics

Meanwhile, according to institutional economists, DAOs are digital organizations.

In this paradigm, people have coordinated via organizations for hundreds of years, and DAOs are just the next instantiation of that. Given the emergence of computers and the internet age, we find ourselves in the “digital economy” and thus, a new type of economy demands new types of organizations, where principles of corporate governance apply.

The “intangibles”: cultures, norms, historical influences, and more

Ethnographic practices (a qualitative research method of observation, interviews, and tracing people and component things, events, crises, discourse, etc.) help us to recognize DAOs as a cultural phenomenon.

DAOs are infrastructure, composed of human and machine elements, technical and governance processes, rituals, standards, and more. At this relational nexus between human-technology encounters, cultural dynamics begin to emerge. This includes the social influences, practices, ideologies, and politics that influence DAO formation, maintenance, collapse, and regeneration, playing into the lifecycle and identity of DAO.

This practice of observation as the emergence and development of DAOs is unfolding has helped me and others to draw analogies and continue to explore DAOs as clubs, cooperative organizations, legal trusts, or commons.

Emerging research and implementation on “DAO to DAO” relations and mechanisms analogizes DAOs to political-economic entities like cities and countries. Numerous DAOs now describe themselves as “crypto cities”, decentralized polities of “network states”, and “crypto states”.

Increasingly, and certainly, with regards to blockchain systems, technology acts as a legislative force in society. Thus, DAOs aren’t just an organization but embody the institutional possibilities for new political expressions, such as “crypto democracy”.

From this exploration, we see that a DAO is not a DAO. There are a variety of DAOs, DAO interpretations, and DAO objectives. The disciplinary distinctions and design attributes of DAOs explored in this article form a basis to begin to recognize DAOs as relational, co-constructive entities, composed of human and machine components, functioning towards a shared objective.

DAO Design Patterns

Clarifying purpose:

How a DAO is designed in terms of organizational function, technical mechanisms, and whether its design is pre-determined at all, depends on its purpose. In other words, form follows function.

DAOs fulfill a diverse array of organizational functions, such as a vehicle for capital investment (e.g. The LAO), building decentralized software (e.g. 1Hive), or creating social clubs (e.g. Friends With Benefits).

Some obvious but useful DAO design or analysis questions are:

1. What is being decentralized? (technically, economically, or politically),

2. Who or what is being made autonomous, and from who or what?

3. What is being automated?

4. What is being organized?

From here, subjective goals, beliefs, and values can be articulated to determine design choices.

The emergent dynamics of DAO design choices:

So, what essential elements constitute a DAO in practice? In my research as an ethnographer, some of the common components or design patterns across DAOs include the following:

1. A clear objective or common reason they exist is often enshrined in a manifesto, “constitution”, or product/service Terms & Conditions. This can be both implicit and explicit, although it is often articulated by communities. For example, see KONG Land manifesto, 1Hive constitution, and Gitcoin T&C’s, all of which act as purposeful, guiding documents. In some DAOs, this pattern of an enforceable group statement has been referred to as the “constitutional archetype”.

2. Formation: Determining token allocation and capital expenditure towards a “DAO first” approach or a community “exit to DAO”. This can be automated or dynamic e.g. 1Hive.

3. Participation: Labor, accountability of labor, and compensation (paid, social, or other). This can be by humans and/or algorithms in the context of a multi-agent system. Labor can be volunteer-based, paid compensation e.g. DxDAO, or a combination of both e.g. GitcoinDAO.

4. Dispute resolution/arbitration mechanisms. E.g. 1Hive Celeste, Kleros, or nation-state law, such as the Wyoming Limited Liability Company (LLC) DAO legal framework.

5. Communication/coordination processes e.g. a chat application and governance proposal making processes, such as Discord, a Discourse forum, and Snapshot voting in numerous DAOs.

These components are fundamental building blocks in DAO design patterns that provide a framework for the questions that communities need to consider.

Conclusion and Next Steps

This piece is focused on definitional subjectivity and design patterns in the conceptualization and practices of “Decentralized Autonomous Organizations” across different scholarly disciplines and communities. It has not focused on the question of “do you need a DAO?” and it is not aimed at exploring the limitations and risks of DAOs (although, this is important and I do this in other works).

The articulation of these DAO ontologies is a means to establish a clearer vernacular towards being able to explore the relationship between DAO designs, DAO governance, decision-making settings, and DAO political economies. As a site of algorithmic policy-making, DAOs are an important means to better understand the implications and outcomes of human-machine assemblages at the individual, organizational, and societal levels.

Further analysis is warranted to explore how these DAO design pattern building blocks are constituted in different DAOs, how design choices in organizational structure relates to organizational purpose or function, how DAOs evolve, and institutional comparative analysis across different DAOs.

Acknowledgments:

Thank you to the team at BlockScience for ongoing research conversations, especially Dr. Michael Zargham and Burrrata for review, as well as the team at RMIT Blockchain Innovation Hub for feedback. Thank you to Rafa for the encouragement to get set up on Mirror.

Please note the canonical link for this piece is here.