How Amnesty International Is Rethinking Sovereignty In A US-Dominated Tech Stack

The world’s largest human rights organization is sanction-proofing its stack

After the U.S. began sanctioning staff at the International Criminal Court, Amnesty International began treating dependence on American technology as an operational risk. Chief information officer Paul Smith explains why escaping it is harder than swapping out a few tools.

It is one thing to worry about vendor lock-in. It’s another to realize your vendor might be legally compelled to turn your lights off.

That is the uncomfortable lesson organizations had to take from the U.S.' sanctions against judges and other staff members at the International Criminal Court last summer. Several people were suddenly cut off from payments, deliveries and online services wherever an American firm sat in the chain.

For the world’s largest human rights organization, Amnesty International, that turned digital sovereignty from an abstract policy debate into an operational risk.

CIO Paul Smith explains, “[The ICC] operates in the same space as us, in terms of trying to do good.

“The recognition that U.S. tech can be weaponized in this way, as a lever to influence and control, really did catalyze the conversation.”

That conversation was about Amnesty’s exposure to U.S. technology, which it is now trying to limit - if not erase entirely.

Turning Political Risk Into An IT Plan

This issue keeps coming up under the current US administration. We’ve touched on the subject before: first as a theoretical thought experiment, and then as a real and present danger UK and European governments are now paying serious attention to.

But it goes beyond governments: every IT leader already knows the risks of having all their eggs in one basket.

Amnesty International appears to be one of the first major organizations outside the public sector to make a concerted effort to limit its U.S. risk exposure, which is exactly how Paul describes it:

“The risk landscape for us is quite unique because of what we do and where we operate. We do put ourselves in the firing line of some geopolitical decisions, which at its extreme could lead to sanctions from the USA... That's outside of our risk appetite, but it's a necessary risk area we have to step into to operate.

“Whilst it's unlikely, it is highly impactful, so we'd like to have a plan for it.”

‘It Goes Right The Way Through The Tech Stack’

This is not a challenge limited to Amnesty. “A lot of the larger non-profits around the world” are going through the same process of identifying and seeking alternatives to the U.S. influence in their tech stack – but it’s easier said than done.

“[It] goes right the way through the tech stack: your integration platforms, the hardware you buy...the operating systems, the carriers, the connectivity, everything. So how do you unpick that dependency? It's quite hard.”

(Paul Smith, CIO, Amnesty International, courtesy of Computing)

Part of the difficulty is that U.S. tech platforms are not just collections of tools, but heavily integrated ecosystems that are “greater than the sum of the parts.”

Replacing these ecosystems risks losing the connective tissue that makes them so attractive in the first place, and the alternative can become a management problem in its own right:

“You're into potentially deciding whether or not you're managing 50 independent products or one product ecosystem, developing 50 independent tech roadmaps, having to worry about 50 different integrations, 50 different sets of patching and security and all the rest of it.”

For Amnesty, that raises a key question: how much technical responsibility can the organization afford to take on? As Paul puts it, "We're not here to be a software house. We're not here to worry about development of open source products. We just want to be human rights activists.”

Replacing The Ecosystem Is The Easy Part

Replacing the connected ecosystem with a set of diverse products is actually the easiest part of disentangling yourself from U.S. tech – at least on paper.

Replacing apps, as we wrote last year, is hard enough. Replacing cloud infrastructure is even harder. Replacing hardware may be close to impossible today, as nearly every computing device in the world uses a US-designed chip. But this is what Amnesty is trying to achieve.

Paul says there are questions to ask about balancing risk, user experience and – naturally, for a non-profit – cost:

“How much do we care about this? Would the cost of change outweigh the cost of the risk?... And then as a result of that, is the capability comparable? Is it cost proportionate, or do we end up taking a step back in terms of what we're going to introduce to our people?...

“And then on top of that, we'd have to...sell and justify that level of investment to donors who ultimately are expecting every cent to go to the front lines.”

Writing The Escape Plan

The project has four phases: identify critical dependencies; test and train users on alternatives; model exit scenarios and write transition playbooks; then decide whether to execute the change or accept the risk.

Amnesty is already in “the early stages of delivery” for some projects, including adopting open source and non-US solutions for some areas of IT.

“We've mapped out where, if we needed to, we could just jump on their system...like with our backup selection. So, we're into the early implementation phase.”

Users Get The Final Say

One of the most important aspects of the transition blueprint, says Paul, is its human-centric approach, which means remembering tool changes don’t happen in a vacuum.

“The most important thing to remember when you're doing this non-US stuff is it's not just about the IT skills you've got. Say I'm recruiting you as a researcher or a policy analyst, [but] you've only ever worked with US tech. Now I'm going to give you a tool you've never heard of, and I'm expecting you to be as efficient and effective.

“They will torpedo some of these products, whether they fit technically or not, in terms of their usability, the UX aspect.”

Amnesty has also built flexibility into the plan. Some changes can happen opportunistically when a contract or tool comes up for review. Others are tactical responses to immediate needs, and the largest changes still have to go through annual planning and formal business cases.

“It's quite a nice, honest thing, we’re quite proud of it,” Paul says.

But for all the ambition and innovation Amnesty International is showing, it still faces an uphill battle – not least of which is the lack of non-US options for tech platforms, infrastructure and especially hardware. Paul describes it as “fishing in a small pond.”

“There's lots of conversations in the EU, in the UK, about sovereign tech and sovereign tech stacks...but it hasn't materialised yet.

“Lots of great talk, lots of great intent, but it's ultimately an arms race, isn't it? And right now, the others have had a head start.”

This article originally appeared on MES Computing’s sister site Computing.