Tuesday 15 March 2016

SumVoices: Digital Security Starts With Contextual Risk Assessment

Our last installment of SumVoices featured an anonymous contributor from Algeria, in English and Arabic. This month we bring you Venezuelan digital rights activist and digital security trainer, Marianne Díaz Hernández, in English and Spanish.

SumVoices, Venezuela, Marianne Díaz Hernández, digital security trainingFor the last six years, I have been a digital rights activist in Venezuela and a great amount of my work has been focused on digital security training aimed at audiences at risk: activists, journalists and young students who are beginning to defend their civil rights. In my experience, a concept that is often disregarded in the digital security training arena is that of risk assessment. While in certain contexts, risk assessment is something of a cliché term to throw around—a buzzword, like "entrepreneurship" or "synergy", in those contexts where it's frequently overlooked, we are often missing something very important: the fact that tools and tactics are not universally applicable, and thus the fact that we might be aiming at the wrong target when choosing certain tools without having a complete understanding of the nature of risks present.

This is something that becomes particularly important not only for those of us who conduct trainings aimed at different audiences, but also for those who design training materials, handbooks, and software that is going to be used by people at risk. Understanding the nuances of risk when looking at different scenarios can often mean the difference between designing a handbook or app that is going to be used by many people in many contexts versus creating something that only those with the same background as us are going to be able to use.

Points to consider when creating strategies that are applicable to many different scenarios include:

  • What is the scope of internet availability? What speed and quality of connection is available?: When recommending streaming apps like Periscope in the South American context--particularly in Venezuela, where we currently deal with one of the worst, slowest and most expensive internet connections in the world, we are often faced with the fact that internet connections are not reliable and upload speeds are sorely lacking, not to mention the fact that connection is often paid for by the megabyte and extremely expensive. Some people cannot count on internet access at home, and some can only connect once a week or once a month.

  • What technology is available? Is what I’ve created compatible?: This is often overlooked when creating apps that work exclusively in iOS environments and thus cannot be used by the many people who lack economic resources and are most at risk. Compatibility is also overlooked when creating apps that only work with newer versions of some operating systems, disregarding the fact that most people in developing countries only have access to the previous, often out-of-date versions of operating systems that come with cheaper devices.

  • Is it legal to use? Should I warn users of possible legal consequences?: Technologies like encryption and practices like anonymity are illegal or outlawed in many countries. For example, anonymity is forbidden in Venezuela and encryption is illegal in Russia and Tunisia. If someone is going to make the decision to use technology that could put them at further risk, this decision should be made from a place of informed awareness.

  • Is it understandable? Is it accessible? Does it make sense in a given cultural context?: In many places, particularly in those where indigenous languages still survive and coexist, language is a barrier that can keep people from accessing certain tools and materials. In my experience with training Venezuelan indigenous populations at risk, the trainings have to be conducted in Spanish, which is the legal language of the country, but not the mother tongue of the audience. Even when trying, sloppy translations have the potential to become a hazard instead of an aid. Considering cultural aspects also means considering the risks of taking out a cellphone in the street in certain places, or simply carrying it while out and about.

Even though it's impossible to list every aspect that we should consider, more often than not, just being aware of differences and being open to asking questions and listening to answers is a good place to start. As in many other circumstances, the ability to fight preconceived notions and assumptions is the key to opening a door that will lead us to more diverse solutions for digital security.

Venezuelan lawyer and digital rights activist Marianne Díaz Hernández is involved in initiatives including Creative Commons Venezuela and Acesso Libre. She also contributes to Global Voices and guest blogs for Amnesty International. Follow her @mariannedh.

Want more SumVoices? Read on!

SumRando Cybersecurity is a Mauritius-based VPN, Web Proxy and Secure Messenger provider. Surf secure and stay Rando!

No comments:

Post a Comment