https://www.troyhunt.com/setting-the-bar-for-government-access-to-have-i-been-pwned/ * Home * Workshops * Speaking * Media * About * Contact * Sponsor * * * * * Sponsored by: Setting the Bar for Government Access to Have I Been Pwned * * * * * 11 March 2022 Over the last 4 years, I've onboarded 28 national government CERTs onto Have I Been Pwned (HIBP) and given them free and open access to APIs that enable them to query and monitor their gov domains. This doesn't give them access to any information they can't already access via the free public domain search feature, but it makes their lives easier. Much easier. As interest from govs has grown, it's caused me to ponder: who am I willing to give access to? Who am I unwilling to give access to? Those questions prompted a tweet earlier today: If I was to define metrics for which governments I accepted onto @haveibeenpwned, what should they look like? Human rights? Other? And as defined by who? I need something empirical, consistent and repeatable for govs that "feel" uncomfortable. Context: https:// t.co/gxwBfdOdBl -- Troy Hunt (@troyhunt) March 10, 2022 There are 2 primary factors that caused me to pose this question and I want to explain my thinking on both clearly here: The first is the current situation with Russia and Ukraine and more specifically, the sanctions levelled at the former in recent weeks. It's not just sanctions, it's everything from McDonald's closing stores to my tweet this morning about Universal Audio blocking traffic from Russia and Belarus: Strong stance by @UAudio against the invasion of Ukraine. Which other services are blocking traffic form Russia and Belarus? How does everyone feel about this approach, and should we see more of it? pic.twitter.com/hAWPW1WbW3 -- Troy Hunt (@troyhunt) March 10, 2022 You may or may not agree with the stance these organisations have taken, but what this has highlighted is that there is a valid discussion to be had about which countries services are provided to and if there is a threshold beneath which you choose not to do business there. The second factor is that the requests I've had from some governments simply don't "feel" right. To be clear, these requests are no different to, say, New Zealand's (just to pick the most recent one), but my own subjective view on these countries is that they fall short on many of the values that I (and probably you), hold dear. Democracy. Freedom of press and speech. The ability to choose religion, sexuality and other basic rights I take for granted in a place like Australia. But just a "feel" is insufficient and per my earlier tweet, not at all empirical, consistent or repeatable. Of all the responses I received, this one really stood out: There are a number of country rankings that you could consider using. Here's one https://t.co/kA61z7NCn9 -- Jeff Barnes (@mani2jeff) March 10, 2022 Jeff pointed me to the World Population Review website and in particular, the democracy ranking by country. Let me repeat the list here with the 28 governments already onboard HIBP highlighted in green: Country Category Score Elec Function Polit Polit Civil Process of Gov Partici Culture Liberties Norway Full 9.81 10 9.64 10 10 9.41 Democracy Iceland Full 9.37 10 8.57 8 10 9.41 Democracy Sweden Full 9.26 9 9.29 8 10 9.12 Democracy New Zealand Full 9.25 10 8.93 8 8 9.71 Democracy Canada Full 9.24 9 8.93 8 9 9.41 Democracy Finland Full 9.2 10 8.93 8 8 9.41 Democracy Denmark Full 9.15 10 8.93 8 9 9.12 Democracy Ireland Full 9.05 10 7.86 8 9 9.71 Democracy Netherlands Full 8.96 9 9.29 8 8 8.82 Democracy Australia Full 8.96 10 8.57 7 8 9.71 Democracy Taiwan Full 8.94 10 9.64 7 8 9.71 Democracy Switzerland Full 8.83 9 8.57 7 9 8.82 Democracy Luxembourg Full 8.68 10 8.57 6 8 9.41 Democracy Germany Full 8.67 9 8.21 8 8 9.12 Democracy Uruguay Full 8.61 10 8.57 6 8 9.71 Democracy United Full 8.54 10 7.5 8 7 8.82 Kingdom Democracy Chile Full 8.28 9 8.21 6 8 8.82 Democracy Costa Rica Full 8.16 9 6.79 7 7 9.71 Democracy Austria Full 8.16 9 7.5 8 6 8.53 Democracy Mauritius Full 8.14 9 7.86 6 8 8.82 Democracy Japan Full 8.13 8 8.57 6 8 8.53 Democracy Spain Full 8.12 9 7.14 7 8 8.53 Democracy South Korea Full 8.01 9 8.21 7 7 7.94 Democracy France Flawed 7.99 9 7.5 7 6 8.24 Democracy United States Flawed 7.92 9 6.79 8 6 8.53 Democracy Portugal Flawed 7.9 9 7.5 6 7 8.82 Democracy Estonia Flawed 7.84 9 7.86 6 6 8.24 Democracy Israel Flawed 7.84 9 7.5 9 7 5.59 Democracy Italy Flawed 7.74 9 6.43 7 7 7.94 Democracy Malta Flawed 7.68 9 6.79 6 8 8.24 Democracy Czech Flawed 7.67 9 6.07 6 7 8.53 Republic Democracy Botswana Flawed 7.62 9 6.79 6 7 8.53 Democracy Cyprus Flawed 7.56 9 5.36 7 7 8.53 Democracy Slovenia Flawed 7.54 9 6.43 7 6 8.24 Democracy Belgium Flawed 7.51 9 7.86 5 6 8.24 Democracy Greece Flawed 7.39 9 5.21 6 7 8.53 Democracy Latvia Flawed 7.24 9 6.07 6 5 8.24 Democracy Malaysia Flawed 7.19 9 7.86 6 6 5.59 Democracy Panama Flawed 7.18 9 6.43 7 5 7.65 Democracy Trinidad and Flawed 7.16 9 7.14 6 5 7.35 Tobago Democracy Lithuania Flawed 7.13 9 6.07 5 5 8.82 Democracy Jamaica Flawed 7.13 8 7.14 5 6 8.53 Democracy Timor-Leste Flawed 7.06 9 5.93 5 6 7.35 Democracy South Africa Flawed 7.05 7 7.14 8 5 7.35 Democracy Colombia Flawed 7.04 9 6.43 6 5 7.94 Democracy Slovakia Flawed 6.97 9 6.43 5 5 7.65 Democracy Argentina Flawed 6.95 9 5.36 6 5 7.94 Democracy Brazil Flawed 6.92 9 5.36 6 5 7.94 Democracy Poland Flawed 6.85 9 5.71 6 5 7.06 Democracy Suriname Flawed 6.82 9 6.07 6 5 7.35 Democracy Bulgaria Flawed 6.71 9 5.71 7 4 7.06 Democracy India Flawed 6.61 8 7.14 6 5 5.59 Democracy Tunisia Flawed 6.59 9 5.36 7 5 5.59 Democracy Hungary Flawed 6.56 8 6.43 5 6 6.76 Democracy Philippines Flawed 6.56 9 5 7 4 6.47 Democracy Peru Flawed 6.53 8 5.36 5 5 7.35 Democracy Namibia Flawed 6.52 7 5.36 6 5 7.94 Democracy Croatia Flawed 6.5 9 6.07 6 4 6.76 Democracy Ghana Flawed 6.5 8 5.36 6 6 5.88 Democracy Mongolia Flawed 6.48 8 5.71 5 5 6.76 Democracy Romania Flawed 6.4 9 5.36 6 3 7.06 Democracy Dominican Flawed 6.32 9 4.29 6 5 7.06 Republic Democracy Lesotho Flawed 6.3 9 4.14 6 5 6.47 Democracy Indonesia Flawed 6.3 7 7.5 6 4 5.59 Democracy Serbia Flawed 6.22 8 5.36 6 3 7.06 Democracy Paraguay Flawed 6.18 8 5.71 5 4 7.06 Democracy Sri Lanka Flawed 6.14 7 5.71 5 6 6.18 Democracy Ecuador Flawed 6.13 8 5 6 3 6.47 Democracy Papua New Flawed 6.1 6 6.07 3 6 7.94 Guinea Democracy Albania Flawed 6.08 7 5.36 4 6 7.35 Democracy Mexico Flawed 6.07 7 5.71 7 3 5.88 Democracy Thailand Flawed 6.04 7 5 6 6 5.29 Democracy Singapore Flawed 6.03 4 7.86 4 6 6.76 Democracy Guyana Flawed 6.01 6 5.36 6 5 7.06 Democracy Bangladesh Hybrid Regime 5.99 7 6.07 6 5 4.71 El Salvador Hybrid Regime 5.9 9 4.29 6 3 6.18 North Hybrid Regime 5.89 7 5.71 6 3 7.06 Macedonia Ukraine Hybrid Regime 5.81 8 2.71 7 5 5.88 Moldova Hybrid Regime 5.78 7 4.64 6 4 6.76 Montenegro Hybrid Regime 5.77 7 5.71 6 3 6.47 Malawi Hybrid Regime 5.74 7 4.29 5 6 6.18 Fiji Hybrid Regime 5.72 6 5 6 5 5.29 Bhutan Hybrid Regime 5.71 8 6.79 3 5 4.71 Madagascar Hybrid Regime 5.7 7 3.57 6 5 4.71 Senegal Hybrid Regime 5.67 6 5.71 4 6 5.88 Hong Kong Hybrid Regime 5.57 3 3.64 5 7 8.53 Honduras Hybrid Regime 5.36 7 4.29 4 4 5.88 Armenia Hybrid Regime 5.35 7 5 6 3 5 Liberia Hybrid Regime 5.32 7 2.71 5 5 5.29 Georgia Hybrid Regime 5.31 7 3.57 6 3 5.29 Nepal Hybrid Regime 5.22 4 5.36 5 5 5.29 Tanzania Hybrid Regime 5.1 4 5 5 6 4.41 Bolivia Hybrid Regime 5.08 6 3.57 6 3 5.88 Kenya Hybrid Regime 5.05 3 5.36 6 5 4.12 Morocco Hybrid Regime 5.04 5 4.64 5 5 4.12 Guatemala Hybrid Regime 4.97 6 3.93 5 3 5.88 Uganda Hybrid Regime 4.94 4 3.21 5 6 5.29 Sierra Leone Hybrid Regime 4.86 6 2.86 3 6 5.29 Zambia Hybrid Regime 4.86 4 2.93 3 6 5.88 Benin Hybrid Regime 4.58 3 5.36 3 5 4.71 Gambia Hybrid Regime 4.49 4 4.29 4 5 4.12 Turkey Hybrid Regime 4.48 3 5.36 5 5 2.35 Pakistan Hybrid Regime 4.31 5 5.36 3 2 4.71 Haiti Hybrid Regime 4.22 4 1.71 2 6 5.59 Kyrgyzstan Hybrid Regime 4.21 4 2.93 5 3 4.71 Lebanon Hybrid Regime 4.16 3 1.5 6 5 4.12 Ivory Coast Hybrid Regime 4.11 4 2.86 3 5 3.82 Nigeria Hybrid Regime 4.1 5 3.57 3 3 4.12 Mali Authoritarian 3.93 5 0 4 5 4.41 Regime Mauritania Authoritarian 3.92 3 3.57 5 3 4.41 Regime Palestine Authoritarian 3.83 3 0.14 7 4 3.53 Regime Kuwait Authoritarian 3.8 3 3.93 3 4 3.24 Regime Algeria Authoritarian 3.77 3 2.5 4 5 3.82 Regime Burkina Faso Authoritarian 3.73 3 2.36 4 5 3.82 Regime Angola Authoritarian 3.66 2 2.86 5 5 2.65 Regime Jordan Authoritarian 3.62 2 3.93 3 4 3.24 Regime Iraq Authoritarian 3.62 5 0 6 5 1.18 Regime Nicaragua Authoritarian 3.6 0 2.86 5 5 4.12 Regime Gabon Authoritarian 3.54 2 1.86 4 5 3.82 Regime Mozambique Authoritarian 3.51 2 1.43 5 5 3.53 Regime Ethiopia Authoritarian 3.38 0 3.57 5 5 2.35 Regime Russia Authoritarian 3.31 2 2.14 5 3 4.12 Regime Niger Authoritarian 3.29 2 1.14 3 4 4.71 Regime Qatar Authoritarian 3.24 0 4.29 2 5 3.53 Regime Zimbabwe Authoritarian 3.16 0 2.5 4 5 3.24 Regime Kazakhstan Authoritarian 3.14 0 3.21 5 3 3.24 Regime Republic of Authoritarian 3.11 2 2.5 3 3 3.24 the Congo Regime Rwanda Authoritarian 3.1 1 4.29 2 4 2.65 Regime Cambodia Authoritarian 3.1 0 3.93 3 5 2.06 Regime Comoros Authoritarian 3.09 2 2.21 3 3 3.53 Regime eSwatini Authoritarian 3.08 0 2.86 2 5 3.24 Regime Guinea Authoritarian 3.08 3 0.43 4 4 2.65 Regime Myanmar Authoritarian 3.04 1 3.93 2 4 2.35 Regime Oman Authoritarian 3 0 3.93 2 4 3.82 Regime Vietnam Authoritarian 2.94 0 2.86 3 5 2.35 Regime Egypt Authoritarian 2.93 1 3.21 3 5 1.76 Regime Afghanistan Authoritarian 2.85 3 0.64 3 2 3.82 Regime Cuba Authoritarian 2.84 0 3.57 3 4 2.94 Regime Togo Authoritarian 2.8 0 1.79 3 5 2.94 Regime Cameroon Authoritarian 2.77 1 2.14 3 4 2.35 Regime Venezuela Authoritarian 2.76 0 1.79 5 4 2.65 Regime Djibouti Authoritarian 2.71 0 1.29 3 5 2.35 Regime United Arab Authoritarian 2.7 0 3.93 2 5 2.35 Emirates Regime Azerbaijan Authoritarian 2.68 0 2.86 3 3 2.94 Regime Guinea-Bissau Authoritarian 2.63 4 0 2 3 2.35 Regime Belarus Authoritarian 2.59 0 2 3 5 2.06 Regime Sudan Authoritarian 2.54 0 1.79 4 5 1.47 Regime Bahrain Authoritarian 2.49 0 2.71 2 4 1.76 Regime China Authoritarian 2.27 0 4.29 2 3 1.18 Regime Iran Authoritarian 2.2 0 2.5 3 3 1.47 Regime Eritrea Authoritarian 2.15 0 2.14 0 6 1.18 Regime Burundi Authoritarian 2.14 0 0 3 5 2.35 Regime Uzbekistan Authoritarian 2.12 0 1.86 2 5 0.88 Regime Saudi Arabia Authoritarian 2.08 0 3.57 2 3 1.47 Regime Libya Authoritarian 1.95 0 0 3 3 2.65 Regime Yemen Authoritarian 1.95 0 0 3 5 0.88 Regime Tajikistan Authoritarian 1.94 0 2.21 2 4 0.88 Regime Equatorial Authoritarian 1.92 0 0.43 3 4 1.47 Guinea Regime Laos Authoritarian 1.77 0 2.86 1 3 0.59 Regime Turkmenistan Authoritarian 1.72 0 0.79 2 5 0.59 Regime Chad Authoritarian 1.55 0 0 1 3 2.35 Regime Syria Authoritarian 1.43 0 0 2 4 0 Regime Central Authoritarian African Regime 1.32 1 0 1 1 2.35 Republic DR Congo Authoritarian 1.13 0 0 1 3 0.88 Regime North Korea Authoritarian 1.08 0 2.5 1 1 0 Regime Of those 28 govs, all are classified as "Full Democracy" (Norway and Australia), "Flawed Democracy" (the US and Belgium) or "Hybrid Regime" (Ukraine and Turkey). The govs I mentioned as not feeling right are all well below the highlighted ones, with each classified as an "Authoritarian Regime" and as such, I've decided to reject those governments. I won't say where the cut-off is nor will I commit to a single, easily definable threshold, but I will say that they each rated well below every highlighted gov on every measurable metric. My "feel" is amply reflected by the data. I'm sure there will be those who feel this approach is insufficient, too much, missing appropriate data, using the wrong metrics and all sorts of other reasons. I don't expect it to be perfect nor does it need to be, what's important to me here is to describe the problem, explain my logic and have a resource I can direct both current and future requests to when I feel the gov is not a suitable fit for the offering I've made available. Time and time again over the last 8 years, I've needed to make ethical decisions on how I alone run this service. This is just one more of those decisions and I hope I've done a good job of explaining my logic here. Have I Been Pwned Government Tweet Post Update Email RSS Troy Hunt's Picture Troy Hunt Hi, I'm Troy Hunt, I write this blog, create courses for Pluralsight and am a Microsoft Regional Director and MVP who travels the world speaking at events and training technology professionals Please enable JavaScript to view the comments powered by Disqus. Troy Hunt Hi, I'm Troy Hunt, I write this blog, run "Have I Been Pwned" and am a Microsoft Regional Director and MVP who travels the world speaking at events and training technology professionals Upcoming Events I often run private workshops around these, here's upcoming events I'll be at: Must Read * Data breach disclosure 101: How to succeed after you've failed * Data from connected CloudPets teddy bears leaked and ransomed, exposing kids' voice messages * Here's how I verify data breaches * When a nation is hacked: Understanding the ginormous Philippines data breach * How I optimised my life to make my job redundant Don't have Pluralsight already? How about a 10 day free trial? That'll get you access to thousands of courses amongst which are dozens of my own including: 1. OWASP Top 10 Web Application Security Risks for ASP.NET 2. What Every Developer Must Know About HTTPS 3. Hack Yourself First: How to go on the Cyber-Offense 4. The Information Security Big Picture 5. Ethical Hacking: Social Engineering 6. Modernizing Your Websites with Azure Platform as a Service 7. Introduction to Browser Security Headers 8. Ethical Hacking: SQL Injection 9. Web Security and the OWASP Top 10: The Big Picture 10. Ethical Hacking: Hacking Web Applications This is already the newest post! Weekly Update 286 Subscribe Subscribe Now! Send new blog posts: (*) daily ( ) weekly [ ] [go!] Hey, just quickly confirm you're not a robot: Submitting... Got it! Check your email, click the confirmation link I just sent you and we're done. Copyright 2022, Troy Hunt This work is licensed under a Creative Commons Attribution 4.0 International License. In other words, share generously but provide attribution. Disclaimer Opinions expressed here are my own and may not reflect those of others. Unless I'm quoting someone, they're just my own views. Published with Ghost This site runs entirely on Ghost and is made possible thanks to their kind support. Read more about why I chose to use Ghost. * * * * *