# Credibility and Field-Testing Plan **Audience:** Internal planning (solo developer) **Status:** Active planning document **Last updated:** 2026-04-01 ## Overview Phased plan for getting FieldWitness trusted and known in the press freedom and digital security space. Constraints: solo developer, ~10-15 hrs/week, portfolio/learning project that should also produce real-world value. --- ## Current Strengths - Federation layer does something existing tools don't: gossip-based attestation sync across orgs with offline-first design and append-only hash chains - Three-tier deployment model maps to how press freedom orgs actually work - C2PA export is well-timed as interest in content authenticity is growing - Working codebase with tests, deployment configs, documentation ## Core Challenges - **Trust deficit:** "Some guy built a tool" is a warning sign in this space, not something that makes people trust it - **Chicken-and-egg:** Need an audit to be trusted, need to be trusted/money for an audit, need adoption for money - **Limited bandwidth:** 10-15 hrs/week makes sequencing critical - **Stego perception risk:** Steganography angle can hurt trust if presented as the main feature (perceived as "hacker toy") --- ## Phase 1: Foundation (Months 1-6) **Goal:** Make the project easy for people in this field to understand. ### Technical credibility (60% of time) - Ship C2PA export as the v0.3.0 main feature (target: 8 weeks) - Write formal threat model document at `docs/security/threat-model.md` - Model after Signal protocol docs or Tor design doc - De-emphasize steganography in public surfaces -- lead with "offline-first provenance attestation with gossip federation" - Set up reproducible builds with pinned dependencies - Get CI/CD visibly working with test/lint/type-check/coverage badges ### Documentation and clear explanation (20% of time) - Write "Why FieldWitness Exists" document (~1500 words): the problem, why existing tools don't solve it, what FieldWitness does differently, who it's for, what it needs - Create 2-minute demo video: field attestation -> sneakernet sync -> federation -> verification ### Talking to people in the field (20% of time) - Lurk on `liberationtech@lists.stanford.edu` -- do NOT announce tool cold; wait for relevant threads - GitHub engagement with adjacent projects (real contributions, not performative): - `guardian/proofmode-android` - `contentauth/c2pa-python` - `freedomofpress/securedrop` - Post Show HN when C2PA export ships --- ## Phase 2: Getting Outside Validation (Months 7-12) **Goal:** Get the work reviewed by at least one recognized entity. ### OTF (Open Technology Fund) -- https://www.opentech.fund/ **Internet Freedom Fund:** $50K-$900K over 12-36 months. Solo developers eligible. Rolling applications. **Red Team Lab:** FREE security audits commissioned through partner firms (Cure53, Trail of Bits, Radically Open Security). This is the single most important action. **Usability Lab:** Free UX review. **Application timeline:** 2-4 months from submission to decision. **Strategy:** Apply to Red Team Lab for audit FIRST (lower commitment for OTF, validates you as "OTF-vetted"). ### Compelling application elements 1. Lead with the problem: "Provenance attestation tools assume persistent internet. For journalists in [specific scenario], this fails." 2. Lead with what's different: "Gossip federation for cross-org attestation sync, offline-first, can export to the C2PA format used by Adobe, Microsoft, and the BBC." 3. Be honest about status: "Working prototype at v0.3.0, needs audit and field testing." 4. Budget: stipend, audit (if Red Team Lab unavailable), 1-2 conferences, federation relay hosting. ### Backup audit and funding paths | Organization | URL | Notes | |---|---|---| | OSTIF | https://ostif.org/ | Funds audits for open-source projects; may be too early-stage | | Radically Open Security | https://www.radicallyopensecurity.com/ | Nonprofit, reduced rates for internet freedom projects; focused audit ~$15-30K | | NLnet Foundation | https://nlnet.nl/ | EUR 5-50K grants, lightweight process, solo devs welcome, includes audit funding | | Filecoin Foundation for Decentralized Web | https://fil.org/grants | Relevant to federation/provenance angle | ### Building relationships - Submit talk to **IFF 2027** (Internet Freedom Festival, Valencia, ~March) - Open sessions and tool showcases have low barriers - Talk title: "Federated Evidence Chains: Offline Provenance for Journalists in Hostile Environments" - Cold outreach to 3-5 specific people: - Access Now Digital Security Helpline trainers - Harlo Holmes (FPF Director of Digital Security) - Guardian Project developers (ProofMode team) - Present it as a complement, not a competitor - Lead with "I want honest feedback" - Conferences: - **RightsCon** -- https://www.rightscon.org/ - **IFF** -- https://internetfreedomfestival.org/ - **USENIX Security / PETS** -- academic venues, for federation protocol paper --- ## Phase 3: What Would Keep This Going, and When to Stop (Months 13-24) ### Green lights (keep going) - OTF Red Team Lab acceptance or any grants - A digital security trainer says "I could see using this" - A journalist or NGO runs it in any scenario - Another developer contributes a meaningful PR - Conference talk accepted ### Signs to stop / change course - Zero response from outreach after 6+ months - Funders say problem is already solved - Security reviewers find fundamental design flaws ### If green (months 13-24) - Execute audit, publish results publicly (radical transparency) - Build pilot deployment guide - Apply for Internet Freedom Fund - Present at RightsCon 2027/2028 ### If red (months 13-24) - Present it as a reference implementation / research project - Write federation protocol as academic paper - Lean into portfolio angle --- ## Portfolio Context ### Framing "I designed and implemented a gossip-based federation protocol for offline-first provenance attestation, targeting field deployment in resource-constrained environments. The system uses Ed25519 signing, Merkle trees with consistency proofs, append-only hash chains with CBOR serialization, and can export to the C2PA format used by Adobe, Microsoft, and the BBC." ### Skills demonstrated - Cryptographic protocol design - Distributed systems (gossip, consistency proofs) - Security engineering (threat modeling, audit prep, key management) - Systems architecture (three-tier, offline-first) - Domain expertise (press freedom, evidence integrity) - Grant writing (if pursued) ### Possible roles this work could lead to - Security engineer (FPF, EFF, Access Now, Signal, Cloudflare) - Protocol engineer (decentralized systems) - Developer advocate (security companies) - Infrastructure engineer ### Key portfolio artifacts - Threat model document (shows security thinking) - Audit report, even with findings (shows maturity) - C2PA bridge (shows standards interop, not just NIH) --- ## Timeline (10-15 hrs/week) | Month | Focus | Deliverable | Time split | |-------|-------|-------------|------------| | 1-2 | C2PA export + threat model | v0.3.0, `threat-model.md` | 12 code, 3 docs | | 3-4 | Demo video + "Why FieldWitness" + CI | Video, doc, badges | 8 code, 4 docs, 3 outreach | | 5-6 | OTF Red Team Lab app + community | Application submitted, Show HN | 5 code, 5 grants, 5 outreach | | 7-9 | Community + backup grants | Outreach emails, NLnet/FFDW apps | 8 code, 3 grants, 4 outreach | | 10-12 | IFF submission + check whether anything is working | Talk submitted, go/no-go decision | 8 code, 2 grants, 5 outreach | | 13-18 | (If green) Audit + pilot guide | Published audit, pilot doc | 10 code, 5 docs | | 19-24 | (If green) Conference + IFF app | Talk, major grant application | 5 code, 5 grant, 5 outreach | --- ## What NOT to Bother With - Paid marketing, ads, press outreach - Product Hunt, startup directories, product-launch campaigns - Project website beyond clean README - Corporate partnerships - Whitepapers before audit - Mobile apps - Discord/Slack community (dead community is worse than none) - Press coverage (too early) - Competing with SecureDrop on source protection - General tech conference talks (domain-specific venues only)