Public content provenance for organisations

This publication is intended for security and public communications practitioners. It lays the foundation in explaining what public content provenance is and why it's an important tool for organisations to establish a verifiable historical record of the content they make available online. It provides information about the range of technologies which help to establish trust in digital records along with examples of how they might be used to meet different requirements.

This publication has been jointly researched and co-authored by the Canadian Centre for Cyber Security (Cyber Centre) and the NCSC. The Cyber Centre and the NCSC do not directly endorse the products, services or methodologies in this publication. The tools and standards described are a means to demonstrate how to improve cyber resilience in different contexts using combinations of technologies.

1. Securing trust in digital content: why public content provenance matters

2. The challenge of securing digital trust in today’s complex information environment

2.1  Digital content provenance explained

2.2 Digital content provenance analogy

2.3 How to earn trust in digital content 

2.4 How digital content provenance helps enhance public trust in an organisation

3 Provenance: selecting suitable systems and technologies

3.1 What to consider when selecting provenance systems

3.1.1 Source of trust

3.1.2 Extent of provenance record

3.1.3 Ease of verification

3.1.4 Cost of providing provenance

3.1.5 Strength of provenance claim

3.1.6 Duration of the provenance claim

3.1.7 Utility of the provenance

3.1.8 Redress requirements

3.1.9 Privacy considerations

3.2 What to consider when selecting content provenance technologies

3.2.1 Trusted timestamps

3.2.2 Cryptographic identity

3.2.3 Digital ledgers (Blockchain)

3.2.4 Web archiving

3.2.5 Digital watermarking

3.2.6 The Coalition for Content Provenance and Authenticity

3.3 Why private provenance systems aren’t suitable for public content    

4. Deploying public content provenance systems: considerations and example use cases

4.1 Points for organisations to consider

4.1.1 Strategy to establish public information trust

4.1.2 Introduction of provenance in content lifecycle

4.1.3 Timeframe for content verification

4.1.4 Cost

4.1.5 Audience and format

4.1.6  Maturity of public provenance technologies

4.2 Example use cases

4.2.1 Use case 1: Organisation wants provenance of all its public content

4.2.2 Use case 2: Organisation’s content provenance is only needed for a short time

4.2.3 Use case 3 : Organisation’s content provenance is needed for a long time

4.2.4 Use case 4: Organisation needs content to retain its anonymity and privacy

4.2.5 Use case 5: Copyright and other legal redress

5. Next Steps