This blog is authored by William Kilbride, Executive Director of the Digital Preservation Coalition (DPC)
Introduction
Welcome to World Digital Preservation Day, an annual opportunity for the global digital preservation community to raise awareness about our work and to connect to each other. Both of those goals are important: the work of advocacy for digital preservation seems never to be done; and although our community is growing rapidly it is very dispersed and fragmented. World Digital Preservation Day gives us a chance to connect and showcase our wok.
The theme for World Digital Preservation Day this year is ‘Save our Stories: Our Digital Heritage in Danger’. It’s a snappy title but the question quickly arises, save them from what?
Our answer used to be quite succinct: that we provided a managed process to ensure continued access to digital materials for as long as necessary beyond the limits of media degradation, technical obsolescence and organizational change. Most digital preservation solutions implicitly work around these three tropes: whether it’s managing file formats or avoiding dependence on single storage solutions or documenting digital materials so that their meaning is not lost. But a curious feature of our work is that having worked so hard on the fundamentals for so many years, the threats to digital heritage seem to be increasing not reducing. As Emanuele Bellini (2026) has recently reminded us, ‘the mission of digital preservation is no longer only to protect data from technological obsolescence, but to become an active part of a nation’s resilience and defence strategy’. What’s going on?
We have long known that there’s more to digital preservation than technology. Economic fundamentals saturate the digital preservation challenge. Schumpeter’s ‘creative destruction’ is one of the foundations of change in the IT market and thus obsolescence: and that if venture capitalists in Silicon Valley paid just a little more attention to longevity, then we could make obsolescence obsolete. Moments of data loss in the last couple of decades have followed a strict business logic where tools and services are withdrawn or deleted because they were no longer profitable. It’s why there’s often a great cosmic groan when platforms, like GitHub or Sketchfab are acquired by larger corporations. It means the business model behind them is changing and the risk to content becoming acute.
We have also long recognized the threats to digital heritage are as much about manipulation, erasure or falsification. There’s nothing new about misinformation and disinformation, but the means to produce them and the verisimilitude they offer have become extraordinary in the age of AI. The power to bend reality (past, present and future) to suit your own narrative is super-charged when you have 100,000 GPUs available. Efforts to separate truth and ‘truthiness’ from downright lies has never been more important. Efforts like C2PA which track and authenticate content from need our attention and active support.
Conflict
We have almost certainly under-estimated the extent to which global conflict – whether with conventional munitions or cyber-weapons – are a threat to the digital heritage. While others (like Ronald Alcala) have been thinking about this topic for a while, the physical threat to digital collections came into view for me at the start of the war in Ukraine. It was immediately obvious that the digital heritage of Ukraine, not to mention the entire infrastructure of government was suddenly in peril, and that a couple of stray missiles could do irreparable damage. It was pleasing therefore to see the rapid and large response from allies and friends around the world: some collaborating to Save Ukraine’s Cultural Heritage Online, others to evacuate critical digital infrastructure to safe keeping.
Digital responses to safeguard cultural heritage in times of conflict are not new. When ISIS attempted to destroy the ancient archaeological site of Palmyra in Syria they had not reckoned on Bassel Khartabil, a Syrian archaeologist who had been accumulating an extensive archive of scans and photographs of the town. So, although ISIS has done lasting damage to the archaeology of Palmyra, the record survives which has been since used to create 3d models and replicas of elements of the town. By any stretch the destruction of Palmyra was a crime under the terms of the 1954 Hague Convention. Considering the damage done to parts of the site, the digital twin becomes the best available proxy for parts of a world heritage site. The question therefore arises: what protections in law should that data now enjoy?
That seems a pertinent question especially in 2026 as data centres have been specifically targeted. On three occasions this year, in March, April and July, Amazon Data Centers in Bahrain and UAE were hit by Iranian drones during the escalating conflict in the Gulf. It’s not hard to imagine why. Data centers are critical infrastructure for every aspect of life, including military operations and secure government communications. Amazon announced that, after six months effort, ‘we are unable to restore access to the resources and data hosted exclusively in the mec1-az2 Availability Zone’. That’s not a complete loss – users had been previously encouraged to replicate data to alternative regions, but nor is it a footnote from the perspective of cultural heritage. The point of data centers is their massive economy of scale where many different types of institution store and process data in a single shared facility. It’s not just that digital cultural heritage is not well protected, in the advent of cloud computing there is a reasonable chance that it is being stored and processed in facilities that are being actively targeted.
Security
At least in the physical world it’s possible to know the extent of the battlefield and the adversaries in the fight. Cyberwarfare and cybercrime change the nature of digital protection. Saving our stories becomes not simply a question of avoiding obsolescence and bit rot, but proactive defence of systems from intrusion and theft. Cyber-security is probably the biggest threat to every single organization and individual reading this blog; and cyber-warfare can make battlefields of almost anything. And yet there is no blue shield on the electronic battlefield.
This is an extraordinary omission. Our generation takes cyber-warfare for granted. Digital cultural heritage is not just close to a war zone; it exists in a war zone. That has to be unacceptable. Three short case studies demonstrate that the impact and the costs are real.
The British Library cyberattack in October 2023 has become a case study on cybersecurity for all cultural heritage institutions, partly because the British Library has purposefully shared the lessons so that all take steps to protect themselves. To recap, around 600GB of data was stolen and a series of online systems encrypted in a ransomware attack. The British Library refused to pay the ransom and therefore faced the enormous task of restoring multiple internal and public facing systems including it online catalogue, its electronic thesis service EThOS, and the UK Web Archive. It has taken around 2-3 years to restore many of these services. The resulting effort is reported to have cost between 6 and 7 million pounds, met from the BL’s own reserves. It’s not clear what the economic impact has been or the opportunity costs for the library which has had to direct funds and activity away from planned development.
The British Library has become a case study but is far from alone. The UK Royal Navy Museum described an incident in December 2024 when another ransomware attack took out 15 out of 20 systems – including its collections management system. It took 18months to recover. However, a key finding from this was the wellbeing of staff who were shaken by the incident. The attack coming just before the holiday season meant key staff working over Christmas and New Year to secure and restore computers one-by-one. The distributed nature of the museum meant the relatively small IT leadership had to drive around 6000 miles in the month after the attack. This was a heroic effort by any standard, but critically staff struggled emotionally with the impact. One reported that it felt personal ‘like you’ve done something wrong’. Another described it like having a fire. The cost is personal as well as financial. Management and funders need to understand that, as far as cybersecurity is concerned, relatively junior and often poorly paid staff in cultural heritage institutions are pitted against incredibly sophisticated and ruthless adversaries who will exploit any weakness.
The Internet Archive has also been subject to a cyberattack, which might more accurately be described as a cyber-campaign. Running over an extended period in 2024 this included a distributed denial of service attack, a data hack that compromised user email addresses and an attack on its helpdesk. Brewster Kahle described the attack as ‘sustained, impactful, targeted, adaptive, and importantly, mean’. It has been claimed that these attacks were not about financial gain but designed to enhance the reputation of the hackers. So, whereas other attacks may seem opportunistic and financially motivated, the experience of the Internet Archive is that digital cultural heritage is a specific target in its own right: a kind of vandalism for its own sake.
To repeat: there is no blue shield on the electronic battlefield that could have provided special protection to the British Library or the Museum of the Royal Navy or the Internet Archive or numerous others who have reported cybersecurity incidents. There is no specialist or expert branch on whom memory institutions can call. There is no special designation that marks out culturally important sites. There’s no special sanction against the perpetrators and there’s precious little support from government or policy makers to help restore them once compromised. There really ought to be. Digital cultural heritage is the memory of the world. An attack on that is an attack on all of us and on the future.
Steps
It’s hard to know where to start: the threat seems so large and our domain so extensive and undefended. How even could we design better protection for digital cultural heritage? How can we prioritize the digital resources that really matter? Part of the answer lies in the digital repositories themselves.
For more than twenty years, the digital preservation community has championed the concept of the ‘Trusted Digital Repository’ – the idea that certain kinds of digital repository have clearly defined preservation functions that are publicly declared and which can be validated through some kind of independent review. Communities like the Core Trust Seal have emerged with a large and growing catalogue of digital archives and libraries that have publicly declared long-term preservation to be one of their stated goals and gone to the trouble of proving that through peer review (other certifications are also available). This may not be the most eye-catching content: it may not be Palmyra, but it gives us a clue as to how we can proceed. If we’re not able to negotiate special protection for the tiny minority of content which has already been selected for active and proven preservation, there’s little hope we’d be able to preserve the much larger unprotected majority. Granted there may be need for alternative metrics and a wider discussion about selection and certification: but that’s also probably a good thing. It would also by default mean we deny blue shield protection to the far-too-many institutions who are still failing to provide an appropriate preservation infrastructure for the world class digital cultural heritage in their care. That might concentrate the minds of policy makers.
We know what we need to do: instruments like the Hague Convention and Blue Shield already provide a model. For example, we should establish specialist units with responsibility for the protection of digital cultural property – just as some governments maintain dedicated cultural protection specialists within their armed forces. We should lobby for extended criminal sanctions for breaches, recognising that holding digital culture to ransom does harm through the decades. We need enhanced protection with ‘no fire’ zones and with digital refuge, recognizing that reserved preservation rights offer more public and private value than copyright. We need a committee for the protection of digital cultural property. More than anything it’s time to fund the protection of digital cultural property.
We need to make the case that such a step is necessary and viable. We need to build a consensus on the practical mechanisms that might implement a digital blue shield. We need to develop recommendations on the instruments, legal and practical, that would need to be established or updated; and we need to do this with new resources, not inadvertently deflect hard pressed resources which are already struggling to protect physical cultural heritage. Let’s be brave enough to recognize the skills that the cultural heritage sector bring to the discussion, and ambitious enough to recognize that resilience is more than storage: it’s the absolute requirement for meaningful access and impact.
I have been reflecting on this topic since invited to speak to the Memory of the World committee in 2023. It’s been too long, with too little action. Digital preservation has not been developed or resourced at anything like the scale of the threat, and the effect is inevitable and sobering. Time and again cultural institutions have been targeted in cyberattacks that wreak the kind of damage that, if perpetrated on physical collections, would make global front page news. Let’s not wait another three years. Let’s build the coalition so that by the end of the decade we can begin to provide practical solutions and senior leadership beyond an occasional blog post and webinar.
World Digital Preservation Day begins with the cry ‘Save Our Stories’ our heritage in danger. The message quickly develops when we consider the many threats and challenges we face, which only seem to expand. But my prediction: we’re not waiting for someone to come along and save them for us. We’re very capable of saving these stories ourselves, if only we had the resources the capacity and the time. Who will Save our Stories? If not us, who? If not now, when?
Further Reading
Alcala, R (2022) Cultural evolution: Protecting “digital cultural property” in armed conflict, International Review of the Red Cross 104, 1083-1119 online at https://doi.org/10.1017/S181638312200008X last accessed 3/11/26
Bellini, E (2026) The Memory Hack: Cyber Cognitive Operations and the Weaponization of Digital Heritage, Keynote Presentation, iPRES 2026
Mills A and Brown H (2026) Digital Disaster Risk Management for Repositories and Archives DPC Technology Watch Guidance Note 26-04 online at http://doi.org/10.7207/twgn26-04 last accessed 3/11/26
Lowrie H and Stewart G (2026a) Cyber Security and Resilience for Digital Preservation - Part 1: Understand Cyber Threats DPC Technology Watch Guidance Note 26-01 online at http://doi.org/10.7207/twgn26-01 last accessed 3/11/26
Lowrie H and Stewart G (2026b) Cyber Security and Resilience for Digital Preservation - Part 2: Engage Stakeholders DPC Technology Watch Guidance Note 26-02 online at http://doi.org/10.7207/twgn26-02 last accessed 3/11/26
Lowrie H and Stewart G (2026c) Cyber Security and Resilience for Digital Preservation - Part 3: Respond DPC Technology Watch Guidance Note 26-03 online at http://doi.org/10.7207/twgn26-03 last accessed 3/11/26
Acknowledgements
I am grateful to Cecile Chemin at Blue Shield Ireland for an invitation to speak which provoked this text, and Emanuele Bellini’s timely keynote at iPRES 2026 which helped clarify the issues in scope for the blog.