Open-sourcing a design process: Floodlight, a sexual harassment report tool

Recently I’ve been working on a project that is particularly delicate. I’ve decided to write about my research and thought process so far because I really want some help, and because this project will benefit from more voices being involved. I also started a Github to keep track of things I’m learning.

A few weeks ago, a friend and I started working on an idea: a tool for women to confidentially submit reports of sexual harassment in the workplace, and be connected to each other if they’ve filed reports about the same person.

The idea was inspired by the shitty men in media list as well as a 2012 paper on Information Escrow (my notes here). The paper makes a game-theoretic case for such a system based on two factors: a) most harassers have multiple targets, and b) for any one of them, being the first to come forward carries the highest risk and retaliation. If a third-party could hold reports in escrow until a small group forms, the risk for each of them is decreased.

It’s an intriguingly simple idea, but as anyone who’s built Internet products knows, the simplicity masks thousands of small decisions that dictate whether it would actually work. It also has the danger of falling into the unfortunately common category of technical tools attempting to solve social problems. This won’t fix a culture that enables sexual harassment — but if it ends up being used, it could put pressure on people and institutions to improve.

I decided I wanted to work on it, but before getting into the mechanics, I started with principles. I wanted the goal to be empowering women, not fixing their problems. They should have as much agency over their data and decisions as possible. That meant taking an essentially anti-authority position — not building this for HR departments or anyone else with power to smother an uncomfortable discovery. The second principle was that it should be inclusive. The design process would need to involve trans people, black women, and other groups for whom sexism interacts with other isms.

The first product discussion we held went well. People expressed excitement about the project, but also plenty of hesitation about trusting an online tool with such sensitive information. The primary fears expressed in the session were about actions being taken without their consent, and their information somehow leaking. A slightly lesser but still substantial fear was the possibility of being put into contact with someone misrepresenting themself as a fellow target of harassment.

We also talked a lot about trust and the graded spectrum from anonymity to verification to identification. Is it possible to verify that a person is not a bad actor without forcing them to reveal their identity?

The initial model for Floodlight came out of that conversation: It would be an anonymous webform for submitting a description of harassment, optional evidence, and the LinkedIn username of the harasser (to help with disambiguation). Verification of the users’ identities would only happen later if there was a match (we weren’t sure what that would look like, but maybe Facebook, Twitter, or LinkedIn OAuth). Only after verification and explicit consent from all users would they be connected to each other, either in a masked-address email thread or a logless IRC-style chat. One thing I liked about this model is that trolls could submit fake reports without causing much harm, but could be caught later down the line. I find it useful to think of trolls as cats — keeping them out just makes them fixated on getting in, so it’s often better to assume they’ll get in, but make the intrusion unsatisfying.

There were still pieces not figured out though, especially around users’ trust of the system and who would have access to their data. And even restrained trolls could still flood the system, making a ton of extra work. I also spoke to lawyers and began learning about which legal considerations I should take into account. I learned about spoliation — if women are planning to bring a lawsuit and then communicate over logless chat, that could be considered destruction of evidence. Impeachment — making records of an event could get in her way, if she later contradicts anything in them and her credibility is called into question. And I began to be concerned that through discovery or subpoenas, any relevant information in our system could be demanded in court, along with people who saw the data.

As a product-builder, the more I imagined not being able to look at the information in our system, the more uncomfortable I felt. Almost any automated system for verification could be gamed (it’s not hard to set up a fake LinkedIn profile), and standard methods of scanning content for trolls become difficult.

The evolved (and most current) model is more like this: Invite people to join, who can invite others they trust. Therefore, the user-list isn’t a list of women who are victims, just allies, making it much less sensitive data. Because the users can be trusted a little more, we can afford to make the allegation completely private. The description she writes is encrypted with a random key that is emailed to her but not saved anywhere. This makes it less hackable, gives her a sense of security, and means I (or someone else working on the site) could never release it without her consent. She’ll still get connected to others in an email thread if there’s a match, and she may decide to share the key with them but only on the basis of the trust established through their communication.

It’s not perfect, and I have more work to do. Here are some of the questions I am still asking:

What would be your motivations for reporting?

What would make you hesitate?

If you were talking shit about this thing on Twitter, what would you say?

How would you game this system, particularly the second version?

If you’re comfortable speaking to me about your own reporting or non-reporting of harassment, I would love to chat.

I’m also looking for ideas, organizations to reach out to, and collaborators. You can email me at

P.S. By far the best aspect of this project for me has been the conversations I’ve had with other women. You are incredible.