A Website Resettling Ukrainian Refugees Got Adoring Headlines. Experts Say It Was Too Good to Be True.

Three days after Russia invaded Ukraine in late February, 19-year-old Harvard University student Avi Schiffmann published a tweet in the middle of the night: “a cool idea would be to set up a website to match Ukrainian refugees to hosts in neighboring countries.”

Half an hour later: “this is being created rn, I hope to have it done within 24 hours.” The next night: “90% finished in 24 hours, goal is to release tomorrow as early as possible.” Schiffmann was at work making that website with the help of 18-year-old Marco Burstein, a fellow Harvard student. They launched UkraineTakeShelter on March 2.

“What we’ve done is put out a super fast, stripped-down version of Airbnb,” Schiffmann told the Washington Post on March 10, at which time he said there were more than 4,000 hosts on the site. As of Saturday, Schiffman told Gizmodo that UkraineTakeShelter had more than 60,000 listings and claims it has secured housing for more than 3,000 refugees, although those numbers are difficult to verify.

Schiffmann would go on to learn that his comments in UkraineTakeShelter’s early days were shockingly naive, but not before he ignored the advice of at least one expert on the ground helping the same people he claimed to be.

The teen told Gizmodo that the past few weeks, and especially the past few days, have been very stressful for him. Schiffmann is still in the process of fixing bugs on the site, adding missing information, and creating a more detailed resources page. He said he is obviously “not trying to develop a platform for human trafficking.” Burstein declined to comment for this story.

“I just want to convey that this project is truly an altruistic effort to help the people of Ukraine,” Schiffmann said on Saturday. “I understand there’s been a lot of critics along the way, but [at] the end of the day, this has already helped so many people and I hope that as it grows, it’s able to help so many more.”

While the American media gushed over UkraineTakeShelter, local activists on the ground in Poland and experts involved in privacy and humanitarian tech looked at the site with concern, outrage, and horror. Here was a site that had made headlines around the world — appearing in overwhelmingly positive stories on CNN, The TODAY Show, and ABC, among many others — but that didn’t verify hosts’ identities until March 21, nearly three weeks after it had gone live, a decision experts said put refugees that used the site at risk for human trafficking. In addition, the lax security measures have also exposed the private data of the hosts opening their homes to refugees, allowing anyone to see information including hosts’ phone numbers and email addresses with a few clicks.

Schiffmann and Burstein may have expressed noble intentions in jumping at the chance to help ease one of the worst refugee crises in the world, but the pair have been criticized for ignoring feedback from people on the front lines of the crisis in Ukraine, taking corrective actions only when they faced scrutiny from experts in the U.S. They have also taken heat for what some say is throwing tech at a problem they didn’t understand and not taking into account the complex needs of the very refugees they were trying to help.

Meta’s Mark Zuckerberg, another software engineer who made his name building a website in a Harvard dorm room, once said it was necessary to “move fast and break things.” That approach shouldn’t be used when the issue at hand is helping refugees, said Nathaniel Raymond, a lecturer at Yale University and co-lead of the Humanitarian Research Lab at the Yale School of Public Health.

Raymond stated that the website had already created a problem because it moved faster than the decades-proven processes that aim to keep people safe. Because of the website’s opaque flaws, experts have no way of knowing whether harm has been done to vulnerable refugees as a result of its haphazard rollout.

“This is amateur hour,” he said. “There is a sense from very passionate, well-meaning people who see the horror like Ukraine unfold in front of them that speed is of the essence, and sometimes that’s true in the humanitarian response. But there are certain functions in the humanitarian response where slow is safe, and this is one of them.”

In response to criticism from experts and activists, Schiffmann and Burstein implemented an identity verification process from Stripe that requires hosts to scan their passport, drivers license, or other form of government ID in order to post a listing. They said are also planning to roll out criminal and terrorist background checks for hosts in collaboration with the United Nations, major NGOs, and other housing platforms.

“We aren’t talking about couch surfing.”

Kasia Chojecka, a lawyer who works as a public affairs consultant in the tech sector in Warsaw, Poland, got involved in helping Ukrainians fleeing from war early on, serving as a host for refugees, helping volunteer groups with food deliveries, and supporting a grassroots movement helping refugees find accommodation in Warsaw.

Chojecka told Gizmodo in an email that she was extremely surprised when she saw the news about UkraineTakeShelter, noting that she hadn’t heard anything about the site from the local activists groups she was involved in. The platform “set off all the alarms right away,” she said.

“First of all — the matter is much more delicate than simply putting up a website with a super shady security policy (because we are not talking about couch surfing, but about a humanitarian crisis),” Chojecka explained, pointing out that some refugees suffer from trauma and need a lot of time as well as financial and medical support. “And secondly, I know how intensely Russian trolls are attacking right now and one small security gap can be enough to expose refugees to some tragedy.”

Chojecka said that she and another colleague reached out to Schiffmann on Twitter to ask if he was checking out the other initiatives set up by NGOs and other organizations for refugee housing.

In a thread on March 9, she pointed out some of UkraineTakeShelter’s basic shortcomings, including a flawed location system and a lack of identity verification. The lack of identity verification also concerned her because many of the refugees are Ukrainian women and children.

https://twitter.com/embed/status/1501475743687233536

Joung-ah Ghedini-Williams, head of the global communications service at the United Nations High Commissioner for Refugees, told Gizmodo in an email that although it was “incredibly heartwarming” to see the outpouring of support and solidarity for Ukrainian refugees from so many, UNHCR had flagged protection concerns inherent with these kinds of massive movements of people, especially in this case, where 90% are women and children.

“We know from other emergencies that predators and criminals may be hiding among helpers and responders, so identifying, mitigating and responding to these risks of sexual exploitation, abuse, gender-based violence and trafficking must be coordinated and addressed robustly from the start by authorities across the region and beyond,” Ghedini-Williams said.

She stated that UNHCR did not have a specific comment on UkraineTakeShelter, as there are many private initiatives that had been set up and launched in recent weeks.

In an interview with Gizmodo, Chojecka also said she had a problem with the site’s lack of education about the refugee experience for hosts, the fact that it did not translate listings into multiple languages, and that it had listings from places as far away as the U.S.

“[N]o one answered the questions: What if the host turns out to be a scam? What if violence is involved? Who pays for the ticket? What if a person from Ukraine finds themselves in a completely foreign country and does not receive appropriate support from the host, because they say that they did not sign up for it? These are real stories that happen and have happened already in this crisis, and many organizations introduce additional rules or methods of verification on the basis of such situations,” Chojecka said. “Creating such tools requires not only technical experience, but also general life experience and knowledge about humanitarian aid.”

On Twitter, Chojecka said that she considered the website unethical and harmful to refugees; she urged others not to recommend it. She told Gizmodo that her concerns about UkraineTakeShelter were ignored and that she felt attacked by Schiffmann and other commenters for voicing them.

A little more than a week later, her criticisms went viral on Twitter, though someone else — an American man — was making them. This time, the person speaking up was Bill Fitzgerald, an American privacy researcher, who pointed out the same things Chojecka had earlier from the other side of the Atlantic. Fitzgerald’s critiques made waves, unlike Chojecka’s, and elicited a response from Schiffmann and Burstein.

Fitzgerald’s Twitter thread was retweeted more than 3,000 times, attention that he said Chojecka should have received. In an interview with Gizmodo, the privacy researcher said the response seemed “more than a bit sexist.”

“The fact that I am a middle aged straight white American man who works in tech getting attention for essentially repeating what a more qualified, more informed woman said two weeks before I said it, like that’s part of the problem too,” Fitzgerald stated.

“I was doing 10,000 things at the same time.”

This isn’t the first time Schiffmann has used technology to solve a problem. He made headlines in 2020 when he launched ncov2019.live, a covid-19 tracker that grew to be one of the most popular in the world and earned him the Webby Person of the Year Award that year. Subsequently, he worked with other high school students around the world to create 2020protests.com, a site that tracked where Black Lives Matter protests were happening across the U.S.

Schiffmann told Gizmodo via email that he was motivated to create UkraineTakeShelter after he attended a protest against the war in Ukraine in San Diego on Feb. 27.

“While I was there, I noticed that many of the Ukrainian speakers were around my age. This really humanized the whole conflict for me, as it helped me imagine what it might be like to be in their shoes,” Schiffmann said. “After all, these were my friends and peers. It was really terrifying. I realized that I had to do something. I couldn’t just attend a local protest and hold up a sign.”

Taking into account the large platform he had as an internet activist and his coding skills, the teen started to investigate how he could help Ukrainians. He quickly found that there were millions of refugees fleeing to countries all over Europe — since Russia’s invasion on Feb. 24, more than 3.7 million people have left Ukraine — but felt that the systems in place to help them find housing were insufficient in the face of such a large humanitarian crisis.

Schiffmann explained that he found a decentralized network of thousands of Facebook groups and saw that refugees were posting information about themselves hoping to find someone to take them in. There were also Google forms set up by some websites to help match refugees to families, he said, but he considered that they wouldn’t sufficiently scale and were already overwhelmed. The WhatsApp and Telegram groups were also confusing for refugees, in his opinion. Based on this assessment, Schiffmann got to work on UkraineTakeShelter.

Although Schiffmann said he worked with cybersecurity experts and aid groups to develop the site, many people, including Chojecka and Fitzgerald, were able to find a number of alarming issues. There were many suspicious listings on the platform, with some people posting job ads looking for seamstresses or nurses. Others were specifically seeking out women and children. As for privacy—all Gizmodo had to do was pass a reCAPTCHA test in order to gain access to hosts’ phone numbers and email addresses. (Schiffmann told Gizmodo that, in a future update, refugees will have to register on the site and pass an identity check in order to see host contact information).

“There is a longing to take complex political problems and make them simple and technological when they are neither simple nor technological in nature,” Raymond, the humanitarian tech expert at Yale, said.

When asked by Gizmodo why he didn’t take action on the issues pointed out by Chojecka, the Polish volunteer, or check out what other initiatives were doing, Schiffmann said he had looked into other actions, but felt some of those initiatives “were not ready to scale” and that they “didn’t even work properly yet.” He felt that joining other projects was not a good use of his time.

Schiffmann feels that he never attacked Chojecka on Twitter — which she disputes — and that he can’t control what others said to her. He said he wasn’t in contact with anyone who replied to her.

The teen pointed out that he received “tens of thousands of messages across so many social platforms” and that Chojecka’s comments were just some of many. As for why he didn’t take action on her concerns on March 9, he said that he has simply been working on so many things at the same time and that none of the groups he was working with on social media brought up these issues with him.

“None of the groups I had worked with had raised concerns about the verification process for hosts, and while adding more verification processes was a priority on my list, I was doing 10,000 things at the same time, and as an individual, I can only do so much,” Schiffmann said.

Once he saw the thread from Fitzgerald, the American privacy researcher, Schiffmann said he “instantly took action and released a massive overhaul on the host sign up process,” not sleeping or even moving until it was done.

Schiffmann told Gizmodo that recently, he has talked to Chojecka, Fitzgerald, and some more of his critics. He said that some of them wanted to collaborate with him. Chojecka said she didn’t have an extensive conversation with Schiffmann, but Fitzgerald confirmed the teen’s account, adding that he believed that Schiffmann was now listening and that many of UkraineTakeShelter’s core problems were being mitigated and improved.

“Overall, I want everyone to understand that I am listening to criticism, and that I am continuing to take action to improve this platform. I have done nothing but work on this project since I launched on March 2nd. I eat my dinner while on the phone with NGOs,” Schiffmann said.

A good intention that was “too big from the beginning”

Raymond, the humanitarian tech expert from Yale, said it was good that Schiffmann had implemented identity verification on UkraineTakeShelter. However, he felt that the fix was inadequate; too little, too late.

“That’s like trying to put on a parachute after you jumped out of a plane already. Where have people already gone, and who have they gone with? And it’s about double verification, not only on the host, but on the populations,” Raymond said. “We need to be able to track those who came in and where they went, and right now, retrospectively, that’s impossible.”

In Raymond’s view, UkraineTakeShelter should be paused immediately to avoid causing harm to refugees. He also said that Schiffmann and Burstein should contact UNHCR, ask for help, and work with the agency to fix the issues with the site. On the local level, he said, the site’s founders should bring in Polish and other local actors in the host communities to see if UkraineTakeShelter can be integrated into the systems that are already in place. The site needs to be a layer of middleware to help connect solutions that are already in place, he said, but if it can’t, it should be shut down.

Fitzgerald, the U.S. privacy researcher, said that in general, tech solutions launched by people with minimal experience working on specific problems often fail to address these problems. The initial launch of UkraineTakeShelter had serious shortcomings, he added, but now it was time to decide whether to judge a site by its past failures or move forward based on where it was now. He believes the site is safer than it was a week ago.

Multiple experts who spoke to Gizmodo said that UkraineTakeShelter was a cautionary tale on what not to do with technology and an example of what happens when the media doesn’t thoroughly vet a platform and focuses on telling a positive story. Until this week, no mainstream media outlet had taken into account the security flaws and risks of UkraineTakeShelter.

As far as Chojecka’s concerned, the situation started out with a good intention, but it was “too big from the beginning” and didn’t coordinate with anyone on the ground, which led to numerous mistakes.

“Sorry, but I think we should now concentrate on how to help Ukrainians, states, NGOs and other volunteers and how to coordinate already existing work and not on how to clean the mess that one site is causing,” Chojecka said. “I hope it will work properly one day and it will not cause additional drama in a situation that is already dramatic.”