Protecting People, Governing Data
Behind every score is a record of real people and real organizations. Here's how their data is protected, connected, and gated before anything goes public.
Many of the people named in this dataset are survivors, family members, or minors at the time events occurred. Publishing their real names alongside sensitive personal history would create a second harm on top of the first. This system is built so that a person's story can be documented — and their existence in the record verified — without ever displaying who they are.
Every named person gets a permanent internal record, but the public site only ever shows a short anonymous label — something like P-3f9a21bc — never a real name.
- Encrypted, not deleted: where a real name is known, it's stored encrypted (AWS KMS envelope encryption), never as plain text. The plaintext name column doesn't exist in the database at all — it was removed after migration, not just hidden.
- Duplicate detection without decryption: a one-way cryptographic fingerprint (a "blind index") lets the system recognize when two records refer to the same person, without ever reversing the encryption to check.
- Family ties hidden by default: relationships between people (parent, sibling, spouse) are not shown publicly, since inferring an anonymous person's identity through a named relative is a common re-identification path.
- Decryption is a gated, logged action: reversing the encryption to reveal a real name requires an authenticated, audited request — it is not something the public site, or a casual database query, can do.
Organizations rarely exist in isolation — one group splits from another, adopts another's tactics, or grows directly out of a predecessor's ideology. This system tracks those relationships explicitly, rather than leaving them as background knowledge in someone's head.
Every recorded relationship is tagged with a specific type — founded by, ideological heir, tactical evolution, institutional successor, media pipeline, or documented influence — so a reader can see not just that two organizations are connected, but how.
A chain of these links can trace a lineage across decades — for example, an ideological throughline running from one movement, through an intermediate successor organization, to a present-day group presenting a similar worldview under a different name.
Some data is loaded into the system ahead of publication and deliberately held back — for instance, large batches of physical location data for organizations with many sites. These records exist internally but stay switched off until they've been individually reviewed, so bulk data entry never becomes bulk publication.
None of the above is automatic in the sense of "unsupervised." New organizations, new locations, and new personnel records all pass through a human curation queue before they're published — the same governance principle described in the scoring system's human review gate applies here too: the system proposes, a person decides.