How a well-meaning tech solution for Ukraine almost became a 'Craigslist for pedophiles'

• UkraineTakeShelter aimed to connect refugees from Ukraine with individuals who could house them.
• It attracted criticism for lax security procedures. One data security expert called it 'Craigslist for pedophiles.'

Avi Schiffman first decided he needed to do something about the crisis in Ukraine on February 28 while attending a protest in San Diego's Balboa Park. The 19-year-old student had studied at Harvard but dropped out.

Schiffman, who was in town to visit a friend, was among hundreds of people protesting Russian president Vladimir Putin's invasion of Ukraine four days earlier, but felt powerless by simply protesting.

Instead, he felt the need to act. He had developed a following on social media after building one of the first and largest coronavirus tracking websites in January 2020 while a high school senior. The site, claims Schiffman, has hundreds of millions of users. And he had similarly lofty goals for the Ukraine situation.

"I thought I could do something more global to help hundreds of millions of people around eastern and western Europe, rather than just a few hundred people in San Diego," he says.

He returned to the home he was staying in that night and researched the situation more. He saw millions of refugees were fleeing Ukraine "and ending up in neighboring countries like Poland, Moldova, Germany et cetera." (Germany does not border Ukraine.) He also investigated how Ukrainian refugees were seeking shelter when they arrived in those countries, including a network of ad hoc Facebook groups, and found it lacking. "I felt what was in place for those refugees to find available hosts was just not going to scale to millions and millions of refugees," he says.

He came up with the concept that would eventually become UkraineTakeShelter, but initially decided he was too busy to do it.

Yet the worry niggled at him. Later that night, he couldn't sleep, so tweeted a message saying it would be a "cool idea" to launch a site matching Ukrainian refugees to hosts. Within an hour, he tweeted again to say he was developing it.

Within a few hours he had sketched out the basic structure of the website, then called his friend from Harvard, Marco Burstein, a web developer. "We didn't sleep for like three days," Schiffman says. "We did nothing except work on this website."

UkraineTakeShelter launched on March 2. Schiffman tweeted about the site, He emailed more than 150 Ukrainian and Polish news outlets, and messaged the admins of various Facebook pages set up to support refugees. Only one replied.

So Schiffman turned to the US media that had covered his Covid tracking website. Finally, things took off.

The initial coverage was largely positive: 'Harvard student launches a website to help connect refugees seeking a home with those who can provide it'. But the reality was more complicated.

Among data security researchers and academics who work on refugee issues, there was more skepticism and people wondered if Schiffman, while well-intentioned, was in over his head. On social media, threads appeared that pointed out the site for its lax attitude to vetting potential hosts, and alleged breaches of European data protection law.

Schiffman claims he's resolved some of those issues by talking to those who posted the critiques. "I've been in contact with a lot of the critics, such as Kasia — I don't know how to pronounce her name — Chojecka and Bill Fitzgerald and a few others, like Maciej Kawecki," whose name Schiffman also struggled to pronounce. "I've had amazing conversations with all of them," he says. "I'm listening to the responses, and I took action."

Yet the development of the site belies a naivety that can be dangerous. "We like the idea of a simple fix for things that we don't fully understand," Angelika Strohmayer, senior lecturer at Northumbria University, UK, whose research focuses on supporting marginalized individuals, tells Insider. "And if we don't fully understand them, we think they're easy to fix. If it were so easy to solve refugee crises as an app connecting individual people, we wouldn't have multiple refugee crises across the world right now."

Daragh O Brien, the managing director of Irish data protection consultancy Castlebridge, and data management lecturer at University College Dublin's Sutherland School of Law, says his reaction was "horrified."

"I described it to my university class as Craigslist for pedophiles," O Brien says. "That's what they've created — without any vetting. All they have in terms of verification is that they know it's a real person, not a spoof profile. You do not know that the person is safe."

O Brien, who has decades of experience working with NGOs, child protection agencies, and dealing with survivors of sexual abuse, admires their eagerness, but worries it could cause more harm than good. "I'm not dissing or dismissing the human motive of wanting to help, and to bring skills to the table to help," he says. "But you need to understand the problem you are solving first otherwise you will just make things worse."

Schiffman thinks that people have got his intentions behind UkraineTakeShelter wrong. "I'm not making any money off this website at all," he says. "In fact, I'm massively losing money working on the website." He also, unprompted, says the site wasn't designed to gain media attention for himself.

As for what he got wrong? "Look, I definitely agree I should have had a better verification system in place at the start," he says. "But the way I see it is, it's better late than never to add these features."

When asked about the security concerns by Insider, Schiffman explained the methods he deployed to prevent hackers taking down the website, including working with cybersecurity experts. He explained, to a technology journalist of a decade's standing, about DDoS protection, "which is a very common hack you may have heard of." He also introduced anti-bot and anti-spam mechanisms to the site.

But while Schiffman was preoccupied with trolls and spam listings, those with expertise in the field were worried more about whether vulnerable individuals fleeing their country were safe to use the site, and whether the people offering shelter were people who wouldn't exploit their vulnerability.

When asked about whether he had contacted NGOs that specialize in refugee resettlement, Schiffman says "It's very hard to get the attention of those major groups." Instead, he talked to admins of Facebook pages running informal resettlement schemes.

Schiffman admits that some of the criticism about safeguarding issues is well-placed. "For sure, when I launched this website, there should have been more systems in place for verifying hosts," he says. "The goal of the website was really to make it scalable to millions and millions of refugees. And it's a hard balance between safety and security, while also efficiency and scale, of course."

He's since implemented more identity verification systems, which run criminal background checks, and verifying users with photographs that are cross-checked against official databases. "All that kind of stuff is really expensive on the server side, and it's not something I could afford at the start." Schiffman estimates he's spent $10,000 of his own money setting up the site and integrating security checks. "I just realized it's such a drastic need, but it has been something I've been working on. I just wanted to get it out as soon as possible," he says. "So I'm figuring out a lot of these concerns."

'Move fast and break things'

The missteps that some have pointed out in Schiffman's creation of UkraineTakeShelter have played out before when tech and the humanitarian sectors combine, says Reem Talhouk, who studies how technology and international development interconnect.

"It really stems from the notion of Silicon Valley, and that we can design technologies out of things and out of crises," says Talhouk, vice chancellor's research fellow at Northumbria University, UK. "That narrative has been propagated by extensive funding and investment and hackathons in Ivy League universities for students to address migration or refugee issues." Harvard held their first-of-its-kind refugee hackathon in response to the Syrian Civil War in 2016.

Schiffman says that the Harvard connection has been used to unfairly malign him and his efforts. "People are so obsessed with shitting on Harvard," he says. "But I'm not even a student there." (The UkraineTakeShelter website says it "was developed by two Harvard students.")

Schiffman, who had been studying neuroscience and philosophy, says he dropped out because of the cost — $54,768 for the tuition alone — and because of its "structured environment." He's currently taking time off in Barcelona, Spain, while he decides whether to return. Burstein is still at Harvard, and deep into midterms, Schiffman says.

Yet Talhouk has real-world experience of students emailing her after receiving funding for a project at a hackathon that they subsequently realize replicates pre-existing technology — or that ends up being harder than they expect — asking her to help.

"There's an element of propagating the narrative that anyone who has a technology background can design a technology that works to address the crisis, or the issue," she says. "And this does combine with the white savior complex and all that comes mixed into that to result in these things happening and propagating themselves."

O Brien points out that the startup mentality of "move fast and break things" doesn't work when talking about human beings. "There's middle class exceptionalism, tech bro exceptionalism, and American exceptionalism," he says.

He says a similar dynamic was at work when Elon Musk decided independently to build a submarine to try and rescue a Thai soccer team trapped in a cave in 2018, rather than supporting the ongoing rescue efforts on the ground. (The submarine was delivered, but was deemed wholly unsuitable by rescuers and called a PR stunt; Musk subsequently called one of the rescuers "pedo guy" for daring to criticize his efforts.)

"This is not a situation where you build the aircraft while you're flying," O Brien says. "This is not a situation where you launch something that is half-baked. This is a situation where you pick up the phone and ask your local branch of the Red Cross: 'Can you put us in contact with someone who is dealing with this?' So you understand what the requirements are."

Those who have experience supporting displaced and marginalized individuals still think there was a better solution from the start.

"As a tech worker, if you want to help, give money to organizations that know what they're doing," says Strohmayer. "Give your skills to organizations who need them. You don't need to work on your own passion project. In crisis situations, we need things that work quickly."

Schiffman says he can "definitely" see why the critics threw brickbats at the site. "I honestly was just trying to move fast and get this website out there as soon as possible," he says. "And overall, like 99% of people are good."

By the end of March, he aims to completely overhaul the platform so that none of the current listings on the platform will be there. "Hopefully by the end of the month, I'll just be lifting from housing platforms and verified NGOs," he says. "Instead of trying to be like Airbnb, the way the platform currently is, it is moving to be more like Kayak. And that's going great."