Public content provenance for organisations
Page 3 of 6
2. The challenge of securing digital trust in today’s complex information environment
Today’s information environment¹ comprises a wide variety of forms of communication, ranging from traditional media and social media, to telephone conversations and even signs on lampposts. This makes it easy to access large amounts of information quickly. Different processes within this environment collect and reorganise data and metadata to meet the needs of various groups such as information seekers, publishers and advertisers. Additionally, social media platforms enable widespread republishing and the option to add commentary.
Although the information environment benefits both content creators and consumers, it also presents challenges. An original piece of content may be collected, reorganised, summarised, aggregated, reformatted, republished and modified throughout its lifecycle. Modifications may be made deliberately or otherwise, and with or without intent to deceive. These modifications can be difficult to detect as the information rarely persists in its original form. This means we cannot be certain that the intended meaning of the content is retained, or worse, that it has not been distorted.
For security practitioners, protecting information in this environment poses significant challenges. They have traditionally focused on protecting the confidentiality, integrity and availability of digital data directly controlled by the organisation, but now must also focus on protecting publicly available information about their content, which is outside of their control. To address this, organisations can use public trust mechanisms to verify the source and history of content.
¹The aggregate of individuals, organisations, and systems that collect, process, disseminate, or act on information.
Figure 1 - Communicating an organisation's information in the information environment
2.1 Digital content provenance explained
The term provenance is defined as the 'place of origin’ and is used as a guide to the authenticity and quality of a given artefact. It is traditionally used in the context of art and history. In digital environments the concept can be applied in many ways to deal with specific challenges in domains such as internet content history, supply chain integrity, data management, software certification, scientific process management, financial transactions tracking as well as legal chain of custody management. Each has its own unique requirements.
The focus of this document is public content provenance. Content provenance provides factual information about the history of digital content without making assertions about the value or truth of the content itself. Decisions on the veracity of the content are left to the consumer, but additional verifiable information is provided to aid them in making a final determination. Content provenance can provide different types of verifiable information including, but not limited to the following:
- individual or entity making a claim about the content
- date and time of a claim
- image against its verified thumbnail
- claims such as location, device or edits made with software
- statements about whether the work is creative or AI-generated
- assignment of rights to others (for example, via Creative Commons or other public copyright licences)
By clearly establishing the facts about the history of its public digital content, such as its origin, authenticity and quality, organisations can build better trust with their audiences, customers and stakeholders.
2.2 Digital Content Provenance Analogy
A good analogy for provenance is that of a notary.
Many legal systems employ the concept of a notary to witness signatures as part of legal proceedings. The notary is a trusted third-party who performs the witness activity in a way acceptable for legal requirements.
Members of the public who need documentation for legal requirements visit the notary, who confirms their identity and ensures they are signing willingly. The notary then attests to the content of their documentation, as well as the date and time the attestation was done. This attestation involves a formal declaration that the document is genuine and the signatures are valid. Notarised documents are legally recognised and can be used as evidence in court.
In a similar way, digital content owners use an attestation service to verify the details of the content, such as hash or thumbnail image, and establish verifiable evidence such as the location, time and the notary details. This is done using cryptographic methods rather than paper documents.
Additionally, just as notaries maintain a ledger of all notarised documents, attestation services can record their attestation transactions as part of their service. The basic public notary function is illustrated in figure 2 below.
Figure 2 - Notary function as analogy for public provenance
2.3 How to earn trust in digital content
A major objective for organisations is to establish trust with their audience, customers or stakeholders.
To establish why organisations need to consider public provenance, it is useful to understand the broader digital trust context. The issue of trust on the internet is not new and it was an integral part of the development of e-commerce.
The World Economic Forum’s 2022 report describes the following 8 dimensions of trust for digital technology. These factors are important for information assurance more broadly.
The 8 dimensions of digital trust are:
-
Cyber security
mitigating the risks of both malicious and accidental uses of technology.
-
Safety
preventing harm (for example, emotional, physical or psychological) to people or society from technology uses and data processing.
-
Transparency
establishing visibility and clarity around digital operations and uses.
-
Interoperability
ensuring information systems can connect and exchange information for mutual use without undue burden or restriction.
-
Auditability
ensuring that organisations and third parties are able to review and confirm the activities and results of technology, data processing and governance processes.
-
Redressability
providing the possibility of obtaining recourse where individuals, groups or entities have been negatively affected by technological processes, systems or data uses.
-
Fairness
ensuring that an organisation’s technology and data processing considers the potential for disparate impact and aims to achieve just and equitable outcomes for all stakeholders, given the relevant circumstances and expectations.
-
Privacy
ensuring that individuals have control over the confidentiality of their personal or personally identifiable information.
Most organisations today address these 8 dimensions to some degree, but digital trust requirements are evolving as the internet matures. These requirements are also driven by changes in how people behave on the internet and advances in AI.
2.4 How digital content provenance helps enhance public trust in an organisation
Content provenance can help to address and enhance the digital trust in an organisation in a number of the above 8 dimensions, including the following:
Cyber security: helps verify that content is sourced from legitimate and secure origins, which reduces the risk of malicious content. It also helps with maintaining immutable records of content creation and modification to prevent unauthorised alterations.
Safety: can reduce the impact of inaccurate information about individuals and organisations. The verifiable provenance record can aid in refuting inaccurate online information.
Transparency: establishes verifiable metadata about the content itself. This metadata helps establish a content item's history, including creation and handling. The public availability of this information makes the content and related processes more transparent.
Auditability: establishes a digital content record as well as the means to verify it. This can be used in auditing programmes.
- Fairness: establishes a formal verifiable record of information about content. This can include information about the creator, ownership, and rights for digital content. This verifiable information can be used to adjudicate any issues around content rights and validity.
Content provenance provides the public with a means of assessing the accuracy of content created by or related to an organisation. This can enhance the trust the public has in an organisation.