Reconfiguring Citizen Participation in Cybersecurity

网络安全中的哪些威胁？作为一个领域，网络安全在外人看来可能是晦涩难懂和令人生畏的，这是黑客、网络战士和技术专家的领域，他们往往是男性。然而，每个人都暴露在潜在的脆弱技术面前。该研究项目开创了一种公民参与网络安全的模式，既赋予公民与自己的网络安全实践相关的权力，又通过融入他们的观点和个人经验来推进网络安全领域。女权主义理论家对传统安全研究中的个人/政治暴力二元对立提出了挑战，认为这些研究忽视或减少了基于性别的暴力和对妇女安全的威胁。不幸的是，网络安全领域并没有将这些关于个人和政治之间关系的见解纳入其中，因此有可能从“威胁模型”中遗漏许多形式的技术滥用，这些模型塑造了研究人员调查安全挑战的地方。网络安全中的威胁建模程序通常依赖于专家来识别漏洞和潜在的攻击者。尽管这一过程被认为是抽象和公正的，但它往往反映了对精英技术用户不安全原因的假设。例如，我们在牛津互联网研究所（OII）和伦敦大学学院科学、技术、工程和公共政策系（STEaPP）之间进行的试点研究发现，在安全分析和智能家居设计中，亲密威胁被忽略了，而这些智能家居设计的重点是黑客或窃贼等威胁（Slupska 2019）。新兴的物联网和智能家居设备可能使人们容易受到来自国内合作伙伴的新类别威胁（Leitão 2019;通过邀请公民参与定义是什么让他们在网上感到受到威胁，以及他们如何感到有能力对抗这些威胁，该项目将使网络安全方法人性化，并为公民创造新的机会，参与塑造他们认为在网络安全中应该重要的研究问题。该项目将通过举办八个关于公民网络安全的共同设计研讨会来实现这一目标。每个研讨会都将通过提供免费的数字安全培训来重新配置有关技术专业知识的假设，使公民能够反思自己的做法，并提出新类型的威胁，以促进网络安全知识。主持人还将领导选择性小组讨论和焦点小组，讨论个人经验与网络安全知识之间的关系。我们的目标是通过反思性讨论改善现有做法，促进公民积极参与自己的网络安全，并征求意见，以塑造和完善学术领域的方向。这些研讨会将免费向所有人开放，并将与牛津、伦敦和巴黎大都市地区的社区组织联合举办。每个参与者都将在研讨会结束时就如何改进其网络安全实践提出实用建议。参与者还将有机会在开放和安全的环境中自愿贡献他们的观察，经验和研究人员的故事，以促进研究。我们还将招募志愿者编码和分析数据，并努力开发如何利用研讨会参与者培训他人。该项目将汇集牛津互联网研究所的合作伙伴;牛津大学网络安全博士培训中心;伦敦大学学院科学，技术和公共政策系的性别和物联网项目; Power Play，一家女权主义戏剧公司，以及Darktrace，一家网络防御公司。我们还将与牛津、伦敦和巴黎的社区团体合作，主办和宣传每个研讨会，并招募潜在的参与者。

What threats count in cybersecurity? As a field, cybersecurity can seem obscure and daunting to outsiders, a domain for hackers, cyber-warriors and technical experts, who are more often than not male. Yet, everyone is exposed to potentially vulnerable technology. This research project pioneers a model of citizen participation in cybersecurity both to empower citizens in relation to their own cybersecurity practices and advance the field of cybersecurity by incorporating their perspectives and personal experiences.Feminist theorists have challenged binaries of personal/political violence in conventional security studies, arguing these ignore or diminish the threat of gender-based violence and threats to women's security. Unfortunately, the field of cybersecurity has not incorporated these insights on the relationship between the personal and the political and therefore risks omitting many forms of technological abuse from the "threat models" that shape where researchers investigate challenges to security. Threat modelling procedures in cybersecurity often rely on experts to identify vulnerabilities and potential attackers. Despite being presented as abstract and impartial, this process often reflects assumptions about the causes of insecurity among elite technology users. For example, our pilot research conducted between the Oxford Internet Institute (OII) and UCL Department of Science, Technology, Engineering and Public Policy (STEaPP) found that intimate threats are ignored in the security analyses and the design of smart home devises, which focus instead on threats like hackers or burglars (Slupska 2019). Emerging Internet of Things and smart home devices can leave people vulnerable to new classes threats from their domestic partners (Leitão 2019; Tanczer et al. 2018).By inviting citizens to participate in defining both what makes them feel threatened online, and how they could feel empowered to counter those threats, this project will humanise cybersecurity methods and create new opportunities for citizens to engage with shaping the research questions that they think should matter within cybersecurity. This project will do this by running eight co-design workshops on citizen cybersecurity. Each workshop will reconfigure assumptions about technical expertise by providing free digital security training to empower citizens to reflect on their own practices and to surface new types of threats to contribute to cybersecurity knowledge. Facilitators will also lead opt-in group discussions and focus groups on the relationships between personal experience and cybersecurity knowledge. Our objectives are to improve existing practices through reflective discussion, promote citizens' active involvement in their own cybersecurity, and solicit input for shaping and refining the directions of the academic field. The workshops will be free and open to all and will be hosted in conjunction with community organisations in the Oxford, London and Paris metro areas. Each participant will leave the workshop with practical advice on how to improve their cybersecurity practices. Participants will also have the opportunity to voluntarily contribute their observations, experiences, and stories with researchers in an open and safe environment to contribute to research. We will also elicit volunteers for coding and analysing data, and work to develop how we might use workshop participants to train others.This project will bring together partners in the Oxford Internet Institute; the Centre for Doctoral Training in Cybersecurity at the University of Oxford; the Gender and IoT project at the UCL Science, Technology and Public Policy Department; Power Play, a feminist activist theatre company, and Darktrace, a cyber-defence company. We will also work with community groups in Oxford, London and Paris in hosting and publicising each workshop and recruiting potential participants.