# Decentralized Documentation of Maritime Traffic Incidents to Support Conflict Resolution
## 2 Background
### Data Protection and Sovereighty  
In the case of an accident investigation, authorities have the executive power to confiscate VDRs or request data from external surveillance systems. However, this often happens a certain amount of time after the event. For more minor incidents without an official investigation, the procedure of data recording and preservation must be organized differently. Also, at the time of the incident itself, it may not be apparent to all parties that an incident is currently happening. Therefore, it is essential that data in potentially critical situations is continuously recorded and available for later analysis. In the case of the quark wall, it can also occur that the damage is only noticed in a general inspection or by other incoming vessels, and it is not even clear which parties were involved in the incident. In these cases, it is not an option of the port owner to force all ship owners to share their VDR data; thus, other means are needed for more efficient data sharing. On the other hand, it might also not be a possibility for all the involved parties to continuously exchange data with each other just in case something happens. Depending on the shared data, this may also violate data protection regulations (such as the GDPR in the EU, cf. [8]), for example, if they include personal data. Another aspect to consider is the value of the data to a company since, for example, business secrets could be revealed if data about a ship is constantly shared (preferred routes, etc.). In general, the idea of being able to meaningfully control and govern one's own data is a recent trend and is generally referred to as data sovereignty [9]. These factors lead to the conclusion that the recorded incident data cannot be stored centrally in a cloud environment (or similar) but must remain with the involved parties until a conflict arises and needs to be resolved. Even then, the participants should have full decision-making power over their data.  
Finally, keeping local records of data with proof that it has not been modified and was recorded at the time of an incident only makes sense if it can be ensured that the recorded data evidence will stand up in court. Only in this way can a serious conflict resolution be performed between the involved parties and other relevant stakeholders (such as insurance companies). Similar to an analog paper document, a digital datum acquires its validity through a digital signature. In the setup of a Public-Key Infrastructure, users possess a public- and a private-key, which can be used to encrypt or sign data. The public key is also typically signed by a certification authority (CA) in the form of a certificate, thus binding it to the physical identity of a user. In order for the user to be able to use the key pair to sign its data in a trustworthy way, a certification authority must be used to certify the public key and apply special verification procedures (in accordance with applicable law) to ensure that the user's identity is correct. Furthermore, key-holders must take measures to prevent their private key from being exposed to other unauthorized parties in such a way that it can be assumed that data was actually signed by the key-holder and the key was not compromised [10].