Humans and Vulnerability During Times of Change: Computer Security Needs, Practices, Challenges, and Opportunities

Abstract

This dissertation explores the relationship between *change* and vulnerability to security and privacy harms. I suggest that change causes vulnerability in part due to the nature of change, and in part due to the design of technical and sociopolitical systems. I suggest that this connection between change and vulnerability exists for three reasons. First, when someone experiences change, new or different threats, risks, assets, technologies, and actors arise; if they do not update their personal threat model, it may be incomplete or inaccurate, making them unable to respond to emergent threats. Second, even if they are aware of all threats, they may be unable to prioritize security and privacy, as other needs may be more important. Third, the design of technology and user education is often misaligned with the needs and threat models of those going through change, causing vulnerable populations to become more vulnerable and exacerbating existing systemic inequities. I explore these three themes through four populations experiencing immense change differing in scope, cause, and time frame: (a) refugees who have moved to the United States; (b) activists in Sudan during the 2018-2019 revolution; (c) people considering using contact tracing apps during the first months of the Covid-19 pandemic; and (d) people who experience hurricanes. This dissertation makes contributions at two levels. First, each individual research chapter contributes an understanding of the security and privacy needs, experiences, and challenges of vulnerable populations. In each chapter, I make design, policy, and research recommendations to work towards more equitable technology. Second, taken together, the entirety of this dissertation contributes a deep understanding of the relationship between *change* and *vulnerability* to computer security and privacy harms. While the nature of change itself *does* engender vulnerability, in many ways the vulnerability is constructed---by sociopolitical and historical injustices or by technical design, or both.