Enshittification is here – can not-for-profits escape its trap?

Right now, the worser mice are definitely gaining. We operate in an increasingly online environment, where almost every human transaction requires some electronic signature. Every operation, however, is liable to attract the attention of one or another online predator, seeking your personal details to raid your assets or onsell your advertising potential. The pressure requires us to double and redouble our security measures, with passwords, two-factor authentication, and biodata, among others. All these take time, if nothing more. They break up the smooth passage of business, and from time to time snarl it up completely. 

We are told that any password we can remember, and certainly any password we use twice, is easily crackable, and we are herded over to buy password programs that can remember the incomprehensible strings of numbers and letters we are told we need. More and more, too, we’re enticed to do everything on our phones, which shrink our horizons, personalise our politics, and overturn our amusements. 

Which of us has been so efficient, so cautious, so prudent, never to have found ourselves trying to access an account having forgotten the password, asking for a replacement, having the replacement sent to a defunct email (or, as an alternative, your last phone number but two)? Every level of protection has costs. Frustration levels have been rising inexorably for years. 

To add insult to injury, every complication offers opportunities not only to the circling wolves but also to the well-paid shepherds. The more information that has to be handed over to prove I am who I say I am, the more valuable data is entrusted to companies that have no compunction in using it to manipulate me and market to me – companies, too, that don’t particularly like spending good money on data security, and in consequence are quite frequently raided en masse, millions of files scattered broadcast on to the dark web to produce exactly the result that would have come about if there was no security at all. 

The early promise of the internet was that it would provide a frictionless marketplace and a levelled playing field. This was particularly attractive to smaller not-for-profits, newly enabled by computer publishing software to turn out professional publications rather than Roneo-machine typescript (google “Roneo”, young folk – you won’t believe it). You didn’t need typists, you didn’t need printers, you might be able to get away without a bookkeeper. We soon found out, though, that what we’d signed up for was the Red Queen’s race from Alice in Wonderland – “Now, here, you see, it takes all the running you can do, to keep in the same place. If you want to get somewhere else, you must run at least twice as fast as that!” 

We had to design our own webpages, we had to organise our own online businesses, we had to handle our own security, or give ourselves over to the new monopolists. We faced the process that Canadian writer Cory Doctorow has branded “enshittification”. First the application would provide wonderful and rewarding services to the user, until they built it into their lives and couldn’t easily do without it. Next, the application would sell these captive audiences to the businesses who wanted to advertise to them, taking away much of the enjoyment. Finally, the hyperscalers bought out the competition, wrote the legislation, created online monopolies, and settled down to take as much as possible away from the advertisers to keep for themselves. 

Trust oils the wheels of commerce, industry, and politics, and the erosion of that trust is one of the most striking changes in society in this century. Nor have we come to the end of that process. Whatever else you can say about AI, it is very good at pretending to be human, and there’s nothing more likely to feed trust into the grinder than that. The struggle between attack and defence – the gradual ascension of grubby hackers into possible godhood – is entering a new phase. 

In the short term, not-for-profits need to review their cybersecurity policies. In the longer term, they’ll need to free themselves from the avarice and imposition of the giants and recreate a defensible public sphere. Things used to be better, and they can be again, but it’s going to be the struggle of our lifetimes. 

← Back to the newsletter

Improve digital access and security with our guidance

Community Directors hosts thousands of pages of free guidance, such as this help with your tech: Damned Good Advice on Cybersafety and Fraud Prevention | 10 questions every board member needs to ask about cybersecurity | Preparing a technology plan for your organisation | Cybersecurity policy | Data retention and destruction policy | More help with tech | More help with artificial intelligence

Find more resources under tools and resources on the Community Directors website.