The Future of Scientific Data Sovereignty: Why Decentralization Matters

The postdoc leaves and the data goes with her

The failure mode is so ordinary that nobody writes it up. A postdoc runs three years of experiments. The raw output lives on a lab workstation, a departmental share, and an external drive in a desk. She takes a position elsewhere. Two years later someone wants to re-run an analysis, and what remains is a methods section, a figure, and an email address that bounces.

Nothing was stolen and no policy was violated. The data was simply held in places that were only ever going to persist as long as her affiliation did.

Custody is the thing nobody specified. Everyone agrees data should be preserved and shared; almost no one writes down who holds it and what happens when they stop. That is the gap this post is about.

FAIR describes the data, not the custody

The FAIR principles - Findable, Accessible, Interoperable, Reusable - were published by Wilkinson and colleagues in 2016 and have since been written into funder mandates across the EU, the US and Australia. They are good principles. They are also, deliberately, a description of properties data should have rather than an architecture for providing them.

Read the accessibility principle closely and this becomes obvious. A1 asks that data be retrievable by its identifier using a standardised protocol. It does not ask who operates the endpoint that identifier resolves to. In practice that endpoint is a repository, the repository is run by an institution or a vendor, and the identifier points at the repository rather than at the data.

Which means FAIR compliance survives exactly as long as the repository does. A dataset can satisfy all four principles on Monday and satisfy none of them on Friday because a grant ended, a vendor was acquired, or a university consolidated its storage estate. Nothing about the data changed. The custodian changed.

It is worth being fair to FAIR here: the authors never claimed otherwise, and F1's insistence on globally unique persistent identifiers is a direct attempt to limit the damage. But a persistent identifier issued by an institution is persistent in the same sense the institution is.

What sovereignty actually means here

"Self-sovereign" is an overloaded word, so let me be narrow about the claim. It means one thing: the ability to prove custody and authorise access does not route through anyone's server.

Three pieces are enough to get there, and they are all deployed standards rather than research proposals.

An identifier derived from a keypair rather than issued by a registrar. If the identifier is the public key, minting one requires no membership, no fee and no network connection, and verifying a signature from its holder requires no lookup. That property is what decouples the identifier's lifetime from any organisation's.

A name for the data derived from the data. A content identifier is a hash, so a reference means one specific sequence of bytes and substitution becomes detectable rather than invisible. This is the part people find least interesting and it is the part everything else rests on.

Authorisation the holder can delegate directly. Capability tokens let the person who controls the data grant a scoped, expiring, offline-verifiable subset of their authority to a collaborator, without an account being provisioned on a system that both of them have to trust.

None of this is exotic. The pieces exist because other people built them for other reasons, and research data is a good fit for them.

The honest economics

I originally wanted to put a cost comparison table here. I took it out, because the numbers I would need - what a given university actually spends on research data infrastructure versus what the decentralised equivalent would cost - are not numbers I have, and inventing them to make a table look authoritative is exactly the kind of thing that makes this genre of writing untrustworthy.

What can be said without fabricating anything:

The cost structures are different in kind, not just in size. Institutional repositories are an operating expense that recurs for as long as the data is held and stops the moment funding does - which is precisely when preservation matters most. Registry-based identifiers invert this: registering a did:bio costs a one-time, refundable rent deposit of roughly 0.00175 SOL, and an identifier that has never been registered still resolves. The recurring cost moves to storage, which is a genuine ongoing expense that someone still has to pay.

So the pitch is not "this is cheaper." Sometimes it will be; sometimes replication across pinning services will cost more than a departmental NAS. The pitch is that the failure modes are better. A funding lapse degrades availability instead of destroying provenance, and the identifier survives the institution rather than depending on it.

Anyone quoting you a percentage saving on this transition is guessing.

What the transition actually looks like

Not a migration. Almost every group that adopts this runs it alongside what they already have, because the existing systems satisfy obligations that have not gone away - a DOI in a publication, a deposit requirement from a funder, an institutional archive with a retention policy.

The practical pattern is to make the sovereign layer authoritative for integrity and custody, and keep the institutional layer authoritative for discovery and compliance. A dataset gets a did:bio and a content identifier when it is captured, at the bench, before anyone has decided whether it will be published. If it later becomes a paper, it also gets a DOI, and the DID document records that DOI as a service entry. The two identifiers coexist and point at each other.

That ordering matters more than it sounds. The reason so much data is lost is that identifiers are currently assigned at publication, which is the end of the process, and everything upstream of that moment - the failed runs, the intermediate datasets, the calibration files - never gets one at all.

The part that is not a technology problem

The infrastructure question is, honestly, close to solved. The pieces work, they interoperate, and the remaining engineering is unglamorous.

What is not solved is that nothing in a researcher's professional life rewards doing any of this. Careful custody of raw data does not appear on a CV. It is not assessed, not funded as a line item, and not noticed unless it fails publicly years later. Until that changes, sovereignty will be adopted by the people who were already meticulous - which is not the population where the losses are concentrated.

Technology can make the right thing easy. It cannot make it rewarded. That part is a policy problem, and it is the one worth arguing about.

References: Wilkinson et al., "The FAIR Guiding Principles for scientific data management and stewardship", Scientific Data 3:160018 (2016) · W3C DID Core specification · GO FAIR