21 in 21: Patrick Ball on Using Bitcoin and AI to Defend Human Rights

Patrick, welcome to Presidio Bitcoin and the 21 and 21 show. Cool. Let's do it. Yeah.

Well, I just have some questions for you today, and we're going to talk all about what you're doing and how you're using Bitcoin and AI in a cool, interesting way. Right on. So first off, for our listeners that don't know anything about you, can you just give us a little high-level overview about what you do and the Human Rights Data Analysis Group? Sure.

I'm a statistician, and I do math on mass violence. So, forced displacement, genocide, war crimes, crimes against humanity, mass killing. I try to put the numbers on it. So my colleagues and I at the Human Rights Data Analysis Group have been doing this for 35 years, and we have progressed from building creaky old databases on microcomputers back in the very early 90s through descriptive statistics to inferential statistics and population statistics to machine learning applications and most recently AI to try to hold the perpetrators of state crimes accountable.

So interesting. How did you get into this line of work and specifically like the interest on the human rights angle? So I made my living as a database programmer in the 1980s because it was easy work and good money back in those days for, you know, early 20s kid. I dropped out of graduate school in 91 and decided to go to El Salvador because I wanted to see history happening.

I wanted to see the war end. And through a series of weird connections, I ended up being asked to write a database for a human rights group. We did so, and with a really what now seems like a trivial SQL hack, we managed to convert 10,000 individual testimonies of the most horrific violence anyone's ever experienced into dossiers on 100 of the worst military officers in the Salvadoran army. And with that, we were able to force them to resign.

And that was an enormous win for human rights. even though they didn't go to jail, they just had to leave the army. Even that, that's called lustration, forcing people out of office. That was a big win and I've been hooked and I haven't done anything else since.

So yeah, tell me a little bit more about kind of the power of data and what your work can have and impact of rights. So violence is experienced by people and they'll tell their stories. They'll talk about what happened to them. And if you sit around and really listen carefully, you can listen to one or 10 or 100 stories.

But in mass violence committed by governments, it's not 110 or 100 people that suffer. It may be tens of thousands or hundreds of thousands or even millions of people. And in order to speak with all of those voices, we need statistics. We need a way to put all the stories together and look at, well, what's the distribution of violence across time and space?

Is it happening in March or is it happening in June? Is it happening in the North or the South? Is it the guerrillas or is it the government? And to answer those questions, we need not only all the stories we can get hold of from all the different sources we can get hold of, we need statistical models that tell us what we are not hearing, what's missing, what has been never reported.

Are people afraid? Have they run away? Is everybody dead? There's a thousand reasons we don't have all the stories.

But to get the story correct, we need to make estimates, and that takes a lot of math. What kind of data points do you gather to kind of paint the story, and I'm guessing it probably really depends on the situation, but. It depends more on what kind of violence we're talking about. So the easiest one to talk about is a homicide, because one person is one body, it's one death, it's one.

So you can count it. So you can imagine the data points are a list of deaths. So if you talk to everybody in a village and they tell you all the people who've died, that gives you a list of deaths you can work with. But in order to estimate how many you don't have, how many are still omitted, you need more lists.

So maybe you get a list from people who've gone around collecting the names of their relatives. You get another list from maybe a religious group. You get another list from perhaps an international human rights organization like Human Rights Watcher Amnesty or somebody who's come in and done this kind of work. You get another list maybe by a government office that's trying to do this.

You put all the lists together. You determine which people are on which lists. So in some sense, you're deduplicating. You're creating a very complex Venn diagram.

And with that, you can estimate how many are not in the list. Would you like an analogy for how that works? Okay, so let's imagine that you have two dark rooms. You can't see what's inside.

You want to know how big the rooms are. Specifically, you want to know which room is bigger. The only tool you have, for some odd reason, is a handful of little rubber balls. These balls have a curious property.

They don't make any noise when they hit the ceilings or the walls or the floor. But when they hit each other, right? So you take the balls, you throw them into the first room, and you listen carefully, and you hear, cool. You collect the balls, you go to the second room, throw them with equal force, which room is bigger first room second room which room is bigger second room right why exactly less clicks less clicks because the balls spread out right the balls spread out and they don't collide now imagine that you've done that with databases so you've taken a bunch of databases and thrown them into the room in some sense of let's say all the women killed in Medellin in 2003 and you've observed how many of these victims appear on one list, how many appear on two lists, how many appear on three lists, and so forth.

By measuring the number of people documented as dead relative to the number of people documented in multiple lists, you can estimate how many are on zero lists, which is the interesting problem, that people have not been documented. And this is a very old method. In fact, one of its first applications was to estimate the population of France in 1783 by Laplace the French mathematician used this method then So it a very very old method but it gotten a lot more development in the last few years because math and computing has gotten much more powerful.

And so we've been able to do really nifty stuff with it. That's really interesting. And then what type of groups then, or where is your data then used to help helpful ways? Okay.

So one example, staying with the Colombia example is that in Colombia, they're grappling with the recruitment of child soldiers to the armed groups, particularly to the paramilitary groups. In the U.S., we sometimes call them cartels, but they're really focused on territorial control, not on drug trafficking.

Just we only see the drug trafficking part in the U.S. Anyway, the paramilitary groups versus the left-wing guerrillas, both recruited child soldiers. Which group recruited more?

This is a really important question politically in Colombia. So we get lists of children who were recruited, and we use this kind of method to analyze how many were recruited by each group and estimate the number who were not documented and be able to balance the two and have a correct accounting for history. The answer, by the way, in this particular case is that the left-wing guerrillas recruited a lot more child soldiers than the paramilitary groups did. But the paramilitary groups killed something like three times more people than the gorillas did.

So there's a trade off there. Interesting. Okay, so now I want to get to how you're both using Bitcoin and AI and super interesting ways with your data. Maybe let's start with Bitcoin.

Can you tell me a little bit more about how you're using timestamping and the blockchain? Sure. All this data and how it's been useful? I would love to.

It's one of my favorite things. This was really nifty when I figured it out, I was just delighted. And I was like, oh, thanks. Thanks, Bitcoin.

This is really great. So here's the problem. The problem is that we're going to have data that we need to bring to some sort of official process at some point in the future. We don't know when that is, but we're going to gather all this data and organize it for some kind of argument in the future.

And when we get to that argument in the future, what we're seeing now is that it's really likely that the defense, the people who are going to try to rebut our evidence are going to say, oh, that's all AI slop. Everything you have here is just made up AI slop that you just made up. Like, well, okay, how are we going to defend against that attack? One thing that we're going to do is to say, well, we say it's true.

Okay, well, you can believe us. So that means we have to put digital signatures on all the data as it goes forward, of course. Another thing that we have to do is say, well, we didn't mess it up. We didn't mangle it.

We didn't lose the data. It wasn't in some way corrupted between when we saved it and now. Okay, so we have hashes that we keep on all the data, of course. But the other thing is, well, when is it that we saved it?

We need a timestamp, and we need a timestamp that's out of our control. We need a timestamp that we could not have forged. So that's where the blockchain comes in, because we are now submitting our hashes of hashes, the roots of the Merkle trees for our whole data sets for each of the pieces that we're storing in our networks. We submit that to the open timestamp servers, which take that little hash and tuck it into a transaction that we can then get back a timestamp that is on the blockchain that we can verify as having occurred.

And that gives us the third guarantee that we need to say this data must have been created at this time or before. And that's just another way that we defend against the critique that we just made this stuff up, that it's AI slob. I see. That's super interesting.

I'm just curious, and that's amazing that Bitcoin is solving this use case for you. Did you explore other solutions when you were picking Bitcoin or was Bitcoin uniquely useful as a blockchain? I did not explore a lot of other blockchain-like technologies. This one just jumped out of the pack because, particularly because, you know, the open timestamp servers are open, they're free, they're available, they're super easy, they're responsive.

They don't complain when I send 10,000 through in 30 minutes. It's fine. It's just super easy. And so the fluidity of the technology makes it the obvious choice.

The other thing is the ubiquity of the Bitcoin blockchain makes it something that I can explain to people who are not really, really deep in the tech. Everybody's heard of the Bitcoin blockchain. So it's easy for me to say, look, this data is registered on the blockchain and therefore I can prove its age. I can't prove a lot of other pieces with it, but, you know, I've got lots of tools for each of the pieces of proof at this point.

And that's the point. But it's just so much bigger and so easy to use that it just is a no-brainer. And while we were talking earlier, I think there's another aspect of Bitcoin that maybe interests you is decentralization. Absolutely.

Absolutely. So I'm really, really, really worried now about nonprofits that depend on big tech solutions. Specifically, nonprofits that are critical of their governments are now vulnerable because big tech companies have proven really receptive to what I think are probably illegal demands by governments, including the government of the United States, to exclude people from their accounts. We've only seen the sort of barest hints of this in the United States so far, but we have seen it happen already in Europe, where the Trump administration placed senior members of the International Criminal Court, judges and prosecutors, on what's called the sanctioned persons list, which then meant that U.

S. companies can't do business with them. Well, US companies include Google and Amazon and Microsoft and Dropbox. Well people whose data is all in those places their email accounts their financial records their work product well they now cut off They just completely cut off That is an enormous vulnerability And I think that it likely that we will see unethical government officials try to use leverage over the tech companies to do this The obvious response to me is that we need to get out of the big tech ecosystems and use decentralized tools and platforms so that we can be resilient to those attacks.

I agree. And well, now we'll kind of lead into the AI aspect. Sure. Well, first off, I know you're also using AI in an interesting way with your data analysis.

Maybe let's talk about that first. Then let's talk about kind of like decentralized AI ideas, too. Okay, well, we're going up the difficulty chain, for sure. It gets harder as you sit here.

Absolutely. No, I mean, and also it gets harder technically. Using AI is not all that hard at this point. We run our own hardware stack.

We have a big GPU server that we keep in an undisclosed location, but outside the United States. And it runs open models. Now, as we talked about a little bit ahead of time, open is a complicated word in this context. I'm used to the word open source.

Open models are not quite that. But let's leave that aside and move on. We run open models. We run them to do a series of things.

We do simple things like transcription of videos or transcriptions of audio. We then do entity resolution, entity detection and resolution, which is to identify a specific person across a whole series of videos or audio or documents. We do all kinds of document extraction. We do all kinds of conversion of heterogeneous unstructured inputs into structured outputs.

We're statisticians at heart. And so what we're trying to do is get to structured outputs that we can use for analysis in these adversarial contexts, in court cases, in other human rights projects like truth commissions or lustration, like the El Salvador example I started with, excluding human rights violators from public office, as well as public memorialization and, in some cases, civil processes. So our problem is to how can we at scale look at a huge amount of stories, essentially, as you know, in all sorts of different formats and make them into graphs that we can use to speak with all the voices at once.

This is the idea is to bring together collective voices so that we have the synthesis of all these voices into a very specific point to be made in a legal argument or in an advocacy argument of some kind. So that's what we do with AI. Interesting. And then, yes, having local models is super important in the work you do because there's obviously a lot of private information that you don't want to get.

I mean, some of it's about the privacy, but I think that increasingly our problem is less about the confidentiality. I mean, privacy, let's unpack in a second, but it's less about the confidentiality of information and more about the probability of being denied access to this tool. So we have for decades worried about data leakage, you know, that something really important and secret will get to someone who will do bad things with that secret information. That's still a problem.

That hasn't gone away. In some sense, it's getting worse. But a bigger problem that I think is more concerning is that our whole advocacy model, our whole intellectual model now rests on tools we no longer control. It rests on tools that can be turned off and denied to us at the behest of very powerful people.

So that's the threat. If we are criticizing powerful people, we have to expect them to retaliate. And their retaliation could be fatal for our enterprise unless we control all of those tools ourselves. And this fits my sort of general philosophical worldview.

I come from the free software world, and I think about these things. I've been thinking about these things since we started worrying about whose compiler was it. But now it's gotten bigger and bigger and bigger because platforms, online platforms, cloud platforms are so easy to use and so ubiquitous that it's really difficult to disentangle ourselves from them. But it's terrifying to go through the threat model of what happens if they all get turned off.

If you get excluded from those models, what happens to you? You just aren't a member of modern society. I mean, you're just gone. What happens?

You turn on your cell phone. It doesn't work. You no longer have any email access. You never, what happens?

This is bad. Yeah, it's very bad. Yeah. So are you guys using any other open source SDKs to build or build tools in-house that you use?

Everything that we do on the analytics side has been free software for almost 30 years now. Is that right? 30, 26, 27, 28 years now. Yeah.

So everything we build is on Linux platforms. Everything we build is in free software. It's all us scaling up tools that we've largely built in languages like R and Julia and Python and Bash. And now a little bit of TypeScript around the edges.

But all free software languages, we write it all ourselves. Or we publish some little bit of packages in the R community. And we tie together all these things with open source models now. Well, open-ish AI models.

We aren't strict live coders, but we do use, of course, a lot of AI to get stuff done. Because that's the way it gets done fast. Definitely. Yeah.

Well, if you can wave a magic wand and have some sort of tool that would be helpful to you or an SDK of some sort for AI or Bitcoin. and they'd analysis, like, what would it be? Wow, waving a magic wand. Waving the magic wand would be, I think, I don't think that we have solved a whole bunch of network routing problems.

And these are just the grittiest, most plumbing pieces of this toolkit. I feel like I have been struggling with this for about a year I have read all the BitTorrent papers from days gone past The decentralized days of yore BitTorrent really was the ur for so much of this stuff But we don have a lot of really good solutions for decentralized problems. And we have a lot of solutions for the guarantees. We have a lot of cryptographic level solutions.

What we don't have is the network level solutions, the distributional solutions that would allow me to know where are resources available right now from the perspective of my node, what other nodes have those resources available that I can use, and how can I offer the available resources I have to the other nodes. These exist, but in highly specific ways. And I'm not sure if the right solution is at a protocol level, at a technical level. I'm not even really sure where the solution lies, but boy howdy, would it make things easier if we had a kind of underlying decentralized network layer to write these things onto.

That would be nifty. And I think it would benefit a lot of people, but it's a deep problem. I am not pretending it's simple. And I'm an old man.

I just want to write apps on top of it. I don't want to write that stuff. Well, maybe somebody else is able to do so. I sure hope so.

Okay. One more question for you. So are you seeing any other human rights data type groups like adopt the methods that you're using? Are you influencing other groups to do similar ways with Bitcoin or AI?

I mean, yes and no. This decentralized data storage network that I mentioned to you earlier that uses stamps and stuff is a network in which we have five cooperating organizations, nonprofits around North America, sharing storage architectures and sharing compute. The compute is not decentralized. Compute's a single big server, but the storage is completely decentralized.

So we shift our storage across each other. The storage is all bundled up into these chunks, about one gigabyte each, that have all the guarantees on them, including the open timestamp stuff on it. So all those groups have adopted it. They're all psyched and it works really pretty smoothly.

That's not super hard. I have to say that it's worth a shout out to the Filecoin Foundation and some of the engineers at the Filecoin Foundation have done a lot of, they've helped fund us and they've been really, really just invaluable helping me think through a lot of this distributional stuff. The engineers have been amazing. The larger question, though, is how can I get the warning out to the nonprofit space of groups that are critical of their governments in the United States and elsewhere and build resilience?

That's a bigger problem. And that's a funding problem. That's a technology problem. But that's also just a groups being willing to make a shift.

I started teaching human rights groups to use encryption in the 1990s. This was where I got started in this stuff. is I was literally taking diskettes with PGP on it around the world and helping groups encrypt their data with PGP and sign it and encrypt their email with PGP. Great.

And a few groups that had the sharpest threats did in fact adopt this. And particularly in Guatemala, we were really successful getting a bunch of Guatemalan groups to adopt really tight data protection practices in DOS. Like literally, this is so long ago. Like this is 30 years ago.

Then I built an application to make it easier for groups to do. And with a bunch of colleagues, a group in Palo Alto called Benetech, the Benetech Initiative, we built a project called Martis and we rolled it out and it was a self-encrypting database. And we got remarkably little uptake. And this is the threat that's facing us today.

And I want to just kind of walk through it because we know the shape of this problem. And the problem has this shape, which is that people will, in the same breath, tell you, you know what? The security of my data is life or death. If the bad people got this data, people could die.

But I can't do anything except use Microsoft Word in Windows. That's the only thing I can possibly do because I can't do anything else. I have to just use Windows and I have to use Microsoft Word. And you're like, well, what?

Anything we build has to be at least as good for the users as whatever they have now, or they're not going to move. And even then there's network effects which slow down their move. So we have this real challenge. That said, we've also seen some movement.

So why do people use Google Docs instead of Microsoft Word? I think that's probably the user experience case that we need to really think through as we think about what can we build in a centralized world that can invite people to leave the vulnerability that they have to big tech solutions. We have to be at least as good. We have to offer them something that is at least as good, plus something that they want, and not just the security.

The security, the resilience, sometimes say, that's like telling people to eat their spinach. They'll smile, nod at you, and tell you they agree with you, and sure, we all have to eat our spinach, and then they're just going to eat fries. Okay, that's how it is. So you have to build for that.

You have to plan for that. You have to think ahead. We should not repeat the mistakes we made in the first two rounds, the encryption rounds, and then the first round of decentralization attempts, I think, in the 2010s. You know, we got tiny successes.

We need to have bigger successes this time, much bigger. I agree. User experience is super important to actually get people to use products. Well, before I let you go, can you just let our listeners know where they can learn more about you, follow your work?

Absolutely. So three things. We're on Blue Sky at hrdag.org.

If you go to hrdag.org, on the web, then you'll find our website and we keep it pretty current. And we also have a Substack. So we're at hrdag.

org on Substack. So you can find us in any of those three places. Perfect. Well, PB, thank you for coming to PB today.

What a pleasure. And I hope you enjoy the rest of your day. Thank you very much.