Systemic Altruism
← Back to the cohort
Justice & public goodsPreliminary editorial review

Internet Security Research Group

ISRG is the US nonprofit behind Let’s Encrypt and other Internet infrastructure projects. Its systemic hypothesis is to make baseline technical protections practical for many implementers, including charities.

Visit the organization ↗

Systemic Altruism practice potential: 74–84/100
90% of weighted axes reviewed. A mechanism hypothesis, not proven effectiveness or a donation recommendation.

Who this work enables

Tools & support for charities: Automated certificate services and reusable authority software can reduce a recurring technical burden for nonprofit website operators.

Open-source evidence · license checked

  • Boulder — MPL-2.0 license file. Organization’s role: maintainer.
    Checked the named certificate-authority software license and non-archived repository status. This does not cover every dependency, the terms of hosted certificates, trust policy, operational safety or ISRG’s other projects. License-file snapshot: fa274d92d74d73bfdec7d27ccc8bac36c1219701.

License checked 2026-10-27. This is not a security audit, proof of current support or effectiveness, or a promise of free hosting. A sponsor or steward is not necessarily the sole developer. Unchecked profiles are not evidence of closed code. No extra score points are added.

Humanity’s Checklist source match

Gatekeepers · Coordination — editorial, partial alignment.

Shared protocols and low-barrier infrastructure can reduce exclusion by technical gatekeepers and coordinate baseline protections. This does not establish broader institutional reform or secure outcomes.

Explicit checklist adoption: not verified. A mechanism match is not an affiliation, endorsement, evidence of effectiveness or a scoring bonus. Read the practice.

Focus classification: 2026-10-27. Based on the organization’s dated official sources below; earlier axis-review dates are unchanged.

Compare alternatives for a funder →

The proposed pathway

Make shared security infrastructure easier and cheaper to operate

Six dimensions, with rationale

Structural depth

3 / 4

Automated shared certificate infrastructure reduces cost and operational barriers to encrypted websites; it changes a technical default rather than all causes of online harm.

Institutional reach

4 / 4

Shared Internet infrastructure can serve many sectors and organizations instead of a single charity’s website.

Durability

2 / 4

Reusable code and standards persist, but certificate issuance, renewal, trust and incident response depend on continuing operations.

Scalability

4 / 4

Automation and common infrastructure can serve many websites with less repeated manual work, while reliability and governance remain substantial costs.

Funding additionality

Unreviewed

A current marginal funding bottleneck, donor substitution and the counterfactual contribution of other certificate providers were not assessed.

Community agency

Unreviewed

Open protocols and public code do not establish affected users’ binding rights over infrastructure governance or service policies.

Evidence and selection

Organization reported; current primary mechanism sources inspected; named repository and license file checked

Illustrative inclusion to examine this mechanism. Inclusion is not an external recommendation or a verified comparative ranking.

A testable next question

Does expanding supported automated certificate infrastructure measurably reduce insecure nonprofit service deployments and operating burden compared with existing certificate options, without concentrating unacceptable operational risk?

Review confidence: Moderate for documented design; low for systemic attribution. ISRG’s nonprofit Internet infrastructure model, with Let’s Encrypt and Boulder as the scoped mechanism; not a separate charity count for each ISRG project.

What remains uncertain

ISRG identifies itself as a California public-benefit 501(c)(3), EIN 46-3344200. Boulder’s MPL-2.0 software terms are distinct from certificate-service policies, dependencies and trust decisions. HTTPS is not a guarantee of a trustworthy website, endpoint safety or anonymity. This is not a cryptographic, operational security or financial audit, and software reach is not measured social impact.

Sources to inspect

Propose a sourced correction →

Axis review: 2026-10-27 · weighting method v0.2 (2026-10-26) · Method, conflicts and coverage