"Is my phone hacked?" Analyzing Clinical Computer Security Interventions with Survivors of Intimate Partner Violence

Abstract

Intimate partner abusers use technology to track, monitor, harass, and otherwise harm their victims, and prior work reports that victims have few resources for obtaining help with such attacks. This paper presents a qualitative analysis of data from a field study of an approach to helping survivors of intimate partner violence (IPV) with technology abuse. In this approach, called clinical computer security, a trained technologist performs a face-to-face consultation with an IPV survivor to help them understand and navigate technology issues. Findings from consultations with 31 survivors, as well as IPV professionals working on their behalf, uncovered a range of digital security and privacy vulnerabilities exacerbated by the nuanced social context of such abuse. In this paper we explore survivor experiences with, and reactions to, the consultations, discussing (1) the ways in which survivors present their tech concerns, (2) the cooperative work required to guide survivors towards understanding probable causes of tech insecurity, (3) survivors' reactions to the consultations, particularly when security vulnerabilities or spyware are discovered, and (4) the role we play as consultants and interventionists in the complex socio-technical systems involved in mitigating IPV. We conclude by discussing some of the broad ethical and sustainability challenges raised by our work, and provide design opportunities for tech platforms to better support survivors of IPV.

The Many Kinds of Creepware Used for Interpersonal Attacks

“…Thus far, Norton has begun to scan and warn customers about CreepRank-identified apps that were verified as creepware by our manual coding. These apps are also now flagged as potentially dangerous by the IPV Spyware Discovery tool, which is used in Cornell Tech's computer security clinic for IPV survivors [9], [10].…”

“…It is also practically useful. CreepRankidentified apps now trigger warnings in Norton's products and are flagged as potentially dangerous apps when scanning phones of IPV survivors in the context of Cornell Tech's computer security clinic [9], [10]. We also reported 1,095 apps to Google via a responsible disclosure process, and they removed 813 apps for violating the Google Play store's terms and conditions.…”

The Internet of Things: Social dimensions

“…Further, while promotional discourses on smart homes often champion their alleged benefits for better safety for families, social researchers have identified another serious unintended consequence of the security systems that are part of some homes: that of “smart abuse.” Some of these technologies can be used by abusers to exert control by conducting digital surveillance on people, including intimidation and harassment of estranged partners or children, stalking them and potentially locating them for targeted violent attacks (Freed et al, ; Tanczer, Neira, Parkin, Patel, & Danezis, ; Vella, ). Smart toys contained within the home environment, which are typically marketed as promoting young children's safety, health, development, and well‐being, can also open these vulnerable users to privacy and security risks.…”

Tactics of Soft Resistance in User Experience Professionals' Values Work

“…Further research has sought to develop new theories, frameworks, methods, and tools to help technology practitioners grapple with a range of social values and ethical issues in their everyday work. This includes incorporating fairness into AI and algorithmic systems [16,37,48,66], addressing issues of privacy and security [5,18,74], considering the needs and well-being of platform workers [17,35], and avoiding causing and perpetuating harms.…”