My name is Julia Slupska, I'm at the Oxford Internet Institute and I'm here with Gina Neff,
also at the Oxford Internet Institute and we are presenting a paper titled "Participatory
Threat Modelling: Exploring Paths to Reconfigure Cybersecurity." Before we begin we'd like to thank
two of our co-authors, Scarlet Dawson Duckworth and Linda Ma, as well as our funders at UKRI.
So the context for this study is that we're doing citizen science
of cybersecurity and that means bringing in computer-human interaction techniques
into the the work of cybersecurity. So conventional cyber security leaves out huge swaths
of people and it relies on information security experts who are overwhelmingly over represented
by certain parts of the population. Who's missing are women and underrepresented groups
in the discipline and the industry. Now cybersecurity really sees humans
as the problem to be fixed not as part of the solution and so it means that those wonderful
kind of concepts that we have in HCI are missing in a lot of the ways we talk about cybersecurity.
As we were drawing on methods like participatory security design, participatory
access action research and feminist critiques of technology and human computer interaction,
the method that emerged as a part of this pilot project is called participatory threat modeling
which means that we're using action research to center people's experiences of threats rather than
information security ideas of data or systems. This expresses an explicitly feminist standpoint
in which we want to include people in every part of the research practice as much as possible
and in practice this meant seven online and offline workshops in which participants would come
get help in improving their security practices and then
share their experiences of cyber security as well as visions for how it can improve.
Over here you can see a black and white picture of a Reconfigure workshop in
a in a coffee shop at Oxford where tech support people are helping other people with laptops and
phones to do things like download VPNs or share their concerns about cybersecurity.
And so what this method of first giving some tools and information to people our participants
and then asking them about what makes them feel safe or threatened online really opened up how
people experience online threats quite differently according to their socially situated experience.
So that could be about age, gender, sexual identity, all of these things really changed and
shaped what they thought of as threats and what they wanted to protect online. Now many of these
threats are completely dismissed by traditional cybersecurity practice for example being a queer
or a trans person means that having one's legal or banking name displayed could could be a an
incredible threat, experienced as an incredible threat but it's not one that necessarily cyber
security has sought to protect and so we see that these kinds of threats around image-based sexual
abuse or misogynistic trolling were really important in our participants everyday lives
and yet they these are ones that are not important within the cyber security discipline. And finally,
participants really questioned the need for new tools. What they wanted instead was better
norms and sometimes those were things like better education around consent of using information.
They also wanted to change the incentives around technology platforms and and and create
better laws and protections including things like better customer support when something goes awry.
Having reflected on these findings, we'd like to leave you with three key takeaways. Firstly,
involving a wider variety of people in threat modeling will help us build systems that are more
resilient to the range of threats that humans actually experience as opposed to those which
might be imagined by information security experts. Secondly, we were left with a set of interesting
hypothetical questions. So for example, participants brought up targeted advertising
as something that made them feel threatened online. What would cyber security look like if
it defended users against threats like targeted advertising? And lastly, by respecting these
socially situated, lived experiences as a valid source of knowledge about cyber security
we're challenging a monolithic orthodox view of what counts as a cyber security issue.
Finally, more information is online on our project website. Thanks for listening!