Real-World Security for At-Risk Users

Abstract

Whether due to context or circumstance, "at-risk" users experience risk factors that augment or amplify their chances of being digitally attacked and/or suffering disproportionate harms in comparison to the so-called ``average user.''Significant prior scholarship over the past decade has surfaced a variety of varying needs and concerns for different \groups, from activists to survivors of intimate partner violence. However, when technology creators and researchers seek to develop tools to support these users, it can be difficult to reckon with the vastly varied, often contradictory, needs of different populations. To address this challenge, this thesis develops a framework for understanding at-risk user research, designed to help researchers and technology creators better guide technology design to support at-risk users.The framework includes ten contextual risk factors---such as prominence and marginalization---that impact the digital safety of these users and three broad sets of both technical and non-technical protective practices these users currently employ to meet their needs. This thesis then analyzes the current barriers at-risk users face when seeking to address their particular digital-safety challenges. In order to test the utility of this framework, this thesis explores the needs and concerns of two distinct at-risk populations through interview studies---library IT staff and entertainment journalists.Library IT staff work under severe resource constraints to serve patrons who often do not have access to computing resources outside of the library, or may need the particular protection of intellectual freedom libraries seek to provide. I observe that privacy and utility currently work in opposition to one another, but library IT staff in fact prioritize privacy over utility in accordance with strong library values. As another case study, entertainment journalists---those who cover movies, TV shows, sports, and other pop culture topics---work at the intersection of prominence and marginalization.Due to their profession, they must maintain a public presence, but that presence often exposes them to severe harassment, particularly if they also experience marginalization. These journalists conceptualize harassment as an unavoidable cost of their profession, but they perceived taking any action other than attempting to ignore it as largely fruitless. In line with prior scholarship, this thesis shows that institutional support---both from their employer as an organization and other colleagues---was essential to managing harassment response. This thesis demonstrates that understanding and accounting for particular contextual needs is crucial for improving digital safety for at-risk users. By working towards generalizing their needs and concerns, it will become easier to design both technical and non-technical solutions for both immediate and long-term challenges for at-risk populations.