ARI: Hello, I'm Ari. [CLAUDINE: And I'm Claudine] Welcome to Proving the Negative.
ARI: We're a podcast all about exploring the different sides of cybersecurity,
from political to computer science, international relations to mathematics.
Join us as we talk to our friends about the work they do.
JULIA: I wrote down in big notes here, "trigger warning" because I start any talks
because I start talks on this subject with a notice reminding people that this can be
disturbing whether or not you've experienced [intimate partner violence, IPV],
but especially if you have experienced it. Remember that you can stop listening
at any point and return to it and remember to take care of yourself.
Hi. So, first of all, thank you so much for having me on your podcast.
I'm a Ph.D. student at the Oxford Internet Institute and Cyber Security CDT.
I'm researching how people abuse technology
for coercion and control in intimate relationships.
So cybersecurity in the context of intimate partner violence,
looking at the ways in which people abuse technology to stalk their partners,
to coerce or control them through image based sexual abuse, or surveillance.
I'm looking at how technology producers and people who maintain technology
can anticipate and respond to these forms of abuse.
More broadly, how feminist theories and practices can inform technology design.
Some of the solutions that I'm exploring are drawing on participatory methods
and a concept called abusability, expanding security to think about abuse.
ARI: Perhaps we could start with abusability. Could you tell us more?
JULIA: Abusability is a concept that comes from Ashkan Soltani,
who used to be at the Federal Trade Commission in the US.
He coined it in contrast with conventional concepts like security or usability.
Usability is how easy it is for a user to navigate a technology to use it.
How intuitive the design is, to accomplish whatever their ends are.
Security is thinking about how to stop people from penetrating the system,
exfiltrating data or using it in a way that wasn't intended (causing risk or harm).
Abusability shifts that to think, not just about how someone might hack a system,
but how someone might use a system broadly in the way that it was intended.
How features were intended [for use], but in a way that causes harm to someone.
For example, if you think about the app, "Find my friends".
Conventional security may have thought about how someone completely external
to the system might hack in and get everyone's locations.
But abusability would think about how someone might use that app to
spy on friends or family by coercing them to share their location, and then using
that knowledge to monitor them constantly,
make them feel watched, control where they can and can't go.
It flips usability on its head because we tend to think that
technology should be as easy to use as possible.
But in this case, we want technology to be less easy to use
for certain people, for certain ends.
ARI: How have you approached the challenges within your research?
JULIA: I think that's such a great question and thinking through challenges
in your research and conversation with others, it's just really valuable to do.
One big challenge that I've been grappling with constantly and actually
keep returning to even when I've thought I've moved away from it,
is that the basic framing of a lot of technology research
(thinking of us being in the cybersecurity programme)
research questions tend to be "How can we make technology better?"
I've taken on that thinking through the concept of abusability
(which is very much "How can we design better technology?")
A lot of complex social problems can't necessarily be solved by technology.
And so, striking a balance...
There are fundamental problems in how technology is being designed
and it contributes to the problem.
It is hard to talk about new solutions without saying "We need more tech".
The biggest changes to the broader problems of domestic violence,
intimate partner violence, need to come in how we allocate resources,
allocating better resources towards care systems (domestic violence advocates, shelters...
... better housing in general) so that people aren't stuck
in abusive relationships because they depend on it for their housing.
ARI: Beautifully put - what is it that you are curious about?
JULIA: What I've been really curious about in the past few months
[are the] care practices of advocates who support survivors of domestic violence
on the front lines. Places like domestic violence shelters.
I've also been speaking to people from the traditional technology space
(e.g., software engineers) that have taken this on, supporting survivors...
people in the digital privacy rights space, who've taken this on...
even people in hacking collectives who've decided to make this their focus
(who aren't at all in the traditional domestic violence space).
Something really interesting is happening at the intersection of those
different forms of expertise. On the one hand, cyber security expertise of
people who think about systematically modelling and responding to
technology threats and building safer systems. And then, on the other hand,
the care expertise of people who think about trauma, healing from trauma,
protecting yourself from the vicarious trauma that comes from working with
people who are traumatised.
That group is suddenly having to learn about VPNs and password managers,
just because it's increasingly a part of what they're seeing in their jobs.
Tech people are having to learn about trauma and learn about care.
It's really hard to disentangle those two kinds of knowledges.
When you're helping survivors, you need to have both.
The security that comes out of that is really, really different to
the conventional way that we think about cybersecurity.
One thing that's come up again and again in my interviews,
is that a lot of times local advocates will build relationships with local [experts].
For example, tech support at their Best Buy or local mechanics, reaching out to
them and explaining domestic violence, the kind of situation that survivors are in
with specific needs so that if they have a survivor that's experiencing stalking,
they're able to refer them to a mechanic who can search their car for trackers.
Mechanics know how a car works and where it's easy to hide something.
Just having that knowledge isn't enough to help a survivor,
because if you don't have that training and understanding, you might tell a
survivor that they're being crazy or treat them in ways that can retraumatise them.
Building those relationships and those networks of care in the local community
is a really interesting way of doing cybersecurity or digital security.
CLAUDINE: How have you seen dynamics change in the context of the pandemic?
JULIA: The pandemic affected people living in abusive relationships,
particularly cohabitating with their abusers by trapping them in homes,
while simultaneously a lot of the services that support them (e.g., counselling and...
... advocacy) were forced to close and then struggled to move online.
In situations where there is technology abuse, people's devices being monitored.
How do you provide services? That's a problem that domestic abuse advocates
have been on the forefront of, but it actually affects every single online service.
[When] you're setting up online counselling you need to be thinking
about the people that you're providing online counselling for.
Similarly, for court systems that have moved online. There was a case in the US
where it was recorded on camera that a survivor who
was trying to give testimony was being intimidated off camera by an abuser.
And so accounting for that domestic abuse situation has to be a part of
security practices. It will always be the case that some people will be trapped
in a domestic situation with an abuser.
That is really important thing for online services to consider.
People have found creative ways to approach [this],
incorporating some level of checking at the beginning of an online conversation.
Are you alone in the room? Do you trust this device?
Offering as many different service options as possible.
E.g., offering an email option, a text option, a phone option...
It's a mentally straining situation for both advocates and survivors to be in,
knowing that for some people,
they just won't have a safe space, but you still need to provide those services.
ARI: Is this a particular threat to be modelled, or does the way that we think
about risk and how we're designing these systems need a bit of an overhaul?
JULIA: I've used the language of threat modelling in my work a lot, and I found it
an intuitive way to explain what's happening in terms
technology designers and security experts will understand,
which is that whenever we design a technology, design a service...
and also generally in everyday situations, we'll have certain models of threats in
our mind, and intimate partner violence just doesn't get considered.
Thinking about the threat model, understanding it and incorporating it
is an important part of the solution, although threat modelling as a process
can have downsides as well. Becky Kazansky
has written a really interesting paper talking about threat modelling
with activists and different communities that are targeted by state surveillance.
I've done participatory threat modelling with different communities,
including activists - what she's described is that it can be this overwhelmingly
negative process, thinking through every single thing that can go wrong,
every single thing that's threatened, without pairing it to positive values or
the positive things that you're aiming for (psychologically really challenging).
There are modes of being that are quite anxious and part of the way security is,
as a field. Always thinking about risk isn't the best thing to do if
you're trying to create change in the world, or heal from trauma.
Finding ways that the IPV threat model is considered and is incorporated,
but doesn't necessarily require those who are most at risk to be constantly
dwelling on and explaining those risks, is really important.
CLAUDINE: In your intro, you said that you apply feminist theory to your work.
Can you give us an overview of what that means?
JULIA: What kicked off my thinking about threat modelling was a set
of feminist critiques of international relations theory and security studies,
a binary in the way we understand the world[s] of personal and political.
It's quite an old feminist slogan that the personal is political,
that binary will change how we think about the world.
Cynthia Enloe talks about how we think of international relations as something
that happens at the level of the UN or nation states.
Usually, men in suits debating the end of a war or invasions of one country
by another, or trade or economic relationships.
We wouldn't necessarily think of international relations as something
that happens at a plantation in the Bahamas,
owned by a multinational corporation and the workers who work there,
or a camp of sex workers in South Korea outside of a U.S. military base
and the ways that power is exercised there.
We wouldn't think of that as security or international relations [IR].
[Enloe] chose that as a way to study IR rather than diplomatic negotiations.
A similar thing happens in cyber security when we think of cyber security as
something that happens within businesses, militaries defending their
assets, states spying on each other or penetrating each other's networks.
But [we] don't think of cyber security as something that happens at the level of
teenagers sexting each other and sharing those images non-consensually.
Similar moves toward separation and moves towards binaries will happen.
I remember at the beginning of my time at the CDT, I would ask people whether
they thought non-consensually shared images were a cyber security issue, and
they would say it's a privacy issue or not really answer the question. I've learned
since then that there is a whole community of privacy engineering
that does care about privacy a lot, and this isn't to discount them.
'Privacy' will be used as a code to say "this isn't serious security research...
... this is an 'other' thing", which is a problem. In practice, this will mean that
in cases of image-based sexual abuse (non-consensual pornography), the
response will be "You shouldn't have shared that image in the first place",
rather than "How do we build better, more secure technology that gives
more control over your images?" which is what we do for companies.
We would never tell a company "Don't share so much sensitive data".
We think about how we can build better technology for them.
Feminism is a theoretical approach, an activist movement...
it means a lot of things to different people.
One thing that started happening in recent years, which I think is helpful,
is to think of feminisms rather than a singular, unified feminism.
It draws on ideas of plurality or intersectionality - that depending on
other identity factors that you have, depending on where you come from
depending on where you come from and stand in the world,
what feminism means to you and the feminism you practice will be different.
That's also true for other academic theories or political movements.
Words like liberalism or socialism mean different things to different people.
ARI: It's wonderful to get input from people who are not 'us'. As researchers
there's a contract with society, we have privileges not afforded to everyone.
By privilege - if I ask someone about personal life or cyber security habits,
they're more likely to tell me because I'm a researcher and I've got approval.
What are participatory methods, and why do we use them?
JULIA: Participatory approaches to research come from different areas,
it's something that's quite common in feminist research traditionally,
it also came out of activism in South America...
... Scandinavian worker-based approaches to participatory methods.
Traditional research will have binaries of expert researcher and non-expert other.
The expert collects data about their subjects and writes it up.
If it's a subject that doesn't involve humans like computer science,
then it's just expert study that goes on to inform public policy decisions.
Participatory methods erase that hierarchy, or at least mitigate it a little,
balancing the relationship between researchers and participants
by involving participants in as many different stages of research as possible.
That can involve reaching out to people who are outside of research
to frame your research questions after data is collected,
and it can include reaching out to your participants and involving them in the
data analysis process, (asking "What kind of patterns do you see here?")
It can involve joining your participants' initiatives to help them improve
their lives through education. If they're campaigning on a certain cause,
you can think about how your research can better support that cause.
There's a risk in being too idealistic because thinking of researchers' role,
you can't fully erase those differences and hierarchies. In my own research,
we were running digital privacy and security workshops with different
groups: the general public, different activist groups, a group representing
survivors of image-based sexual abuse, environmental groups...
And in those workshops, we tried to make them two-way, creating a safe,
community fun space rather than just teach digital privacy and security.
We first asked people about their threat models,
what they were worried about, what they wanted to defend against.
In asking that, we were learning about their threat models,
I mentioned the psychological burden that threat modelling can impose...
So we would have a tech support session with [experts] on hand to help
people take action to address threats or concerns that they saw in their lives.
We very much wanted those support people to support people.
So rather than someone there as an expert to tell you what you need to do,
they help access resources, sit with you to download Tor, and look up issues.
At later stages we've been able to be even more participatory.
We're collaborating with 'The Voice of Domestic Workers'.
We're planning a kind of data walk-through where some of the
people who were in workshops will help us analyse the data.
We'll walk through some of the data and hear their responses and thoughts.
ARI: Do you have any tips for keeping up to speed with cybersecurity?
JULIA: I've had good experiences with online conferences and webinars.
I joke about whether future generations will look back at this moment now and
see it as the 'golden age' of the webinar (they probably will not). But there is a
lot of amazing and interesting work that's being put online now,
where you can hear conversations by people who have very different life
experiences or approaches, and their thoughts on online security and privacy,
for example, RightsCon or USENIX
(Privacy Engineering Practice and Respect, PEPR)
ARI: Where can our listeners find out more?
JULIA: I've published a paper on participatory threat modelling,
which goes deeper into participatory approaches to threat modelling.
And also to Claudine's earlier question,
I've looked at IPV - specifically survivors who are in lockdown with their abusers,
lessons from that threat model to build better digital security practices.
CLAUDINE: Join us next week for another fascinating conversation.
In the meantime, you can tweet at us @HelloPTNPod
You can subscribe on Apple Podcasts or wherever you listen to podcasts.
The title there is PTNPod. See you next week. ARI: Bye!
CLAUDINE: This has been a podcast from the Centre for Doctoral Training in Cybersecurity, University of Oxford.
Funded by the Engineering and Physical Sciences Research Council.