Source-linked AI summary
SoK: A Framework for Unifying At-Risk User Research
Noel Warford, Tara Matthews, Kaitlyn Yang, Omer Akgul, Sunny Consolvo, Patrick Gage Kelley, Nathan Malkin, Michelle L. Mazurek, Manya Sleeper, Kurt Thomas
TL;DR
Digital-safety threat models often center an “average user,” despite contextual factors that can increase some users’ chances of attack or disproportionate harm. The paper analyzes research on at-risk populations to build a framework of risk factors and protective practices. It identifies 10 contextual factors and uses the framework to discuss barriers to protection.
Problem
Existing threat models often focus on an “average user,” while guidance across varied at-risk populations can be difficult to apply.
Source: §I · p. 1Method
The authors systematically analyzed 95 papers on varied at-risk populations to develop a framework for reasoning about digital-safety risks and protections.
Source: §I · p. 1, §VIII · p. 13Results
The analysis identified 10 contextual risk factors and varied protective practices, and used the framework to discuss barriers to enacting digital protections.
Source: §I · p. 1, §VIII · p. 13Takeaways & Limitations
The framework offers researchers and technology creators a structure for identifying research opportunities and considering at-risk users’ needs in design.
Source: §I · p. 1The dataset is not exhaustive, skews toward Western—especially U.S.—populations, and may miss relevant social-science perspectives.
Source: D. Limitations · p. 3
Abstract
from arXiv · showhide
At-risk users are people who experience elevated digital security, privacy, and safety threats because of what they do, who they are, where they are, or who they are with. In this systematization work, we present a framework for reasoning about at-risk users based on a wide-ranging meta-analysis of 85 papers. Across the varied populations that we examined (e.g., children, activists, women in developing regions), we identified 10 unifying contextual risk factors--such as oppression or stigmatization and access to a sensitive resource--which augment or amplify digital-safety threats and their resulting harms. We also identified technical and non-technical practices that at-risk users adopt to attempt to protect themselves from digital-safety threats. We use this framework to discuss barriers that limit at-risk users' ability or willingness to take protective actions. We believe that the security, privacy, and human-computer interaction research and practitioner communities can use our framework to identify and shape research investments to benefit at-risk users, and to guide technology design to better support at-risk users.
I. INTRODUCTION
At-risk users face elevated chances of digital attacks or disproportionate harms because of contextual risk factors, while existing threat models often center an “average user.” The paper synthesizes research into a framework for reasoning about these varied risks and needs.
II. WHO ARE AT-RISK USERS?
- At-risk users are people whose circumstances increase their chances of digital attack or disproportionate harm, though anyone can face online security, privacy, or safety attacks.The paper uses “at-risk populations” for groups of at-risk users and focuses on external risks they face.Source: §I · p. 1, §II · p. 1
I. INTRODUCTION
- Threat models centered on a mythical “average user” may not meet at-risk users’ needs, while guidance across populations can be difficult to apply.The paper argues for synthesis to organize what is known and identify gaps for future work.Source: §I · p. 1
- The framework organizes 10 contextual risk factors and varied protective practices, then uses them to discuss barriers to digital protection.The practices range from social connections to a patchwork of technical strategies.Source: §I · p. 1
A. Previous taxonomies of attacks, threats, and harms
- Earlier frameworks categorized attacks, threats, harms, or attacker capabilities, whereas this framework isolates contextual vulnerabilities and documents protective practices and barriers.The distinction is how contextual factors relate to vulnerabilities across at-risk populations.Source: A. Previous taxonomies of attacks,… · p. 2
B. Value of focusing on at-risk users
The paper argues that structural inequalities and social norms make careful integration of at-risk users’ experiences important in technology creation. Its synthesis draws on a cross-section of security, privacy, and HCI research and develops an inductive codebook across varied populations and risk factors.
B. Value of focusing on at-risk users
- Structural inequalities and social norms vary globally, requiring care when integrating at-risk users’ experiences and identities into technology creation.The authors argue that tools and controls addressing at-risk users’ needs can also benefit general users.Source: B. Value of focusing on at-risk users · p. 2
A. Paper selection
- The researchers gathered papers from five years of security, privacy, and HCI conferences, then added papers from other sources or outside the target years to broaden population coverage.The final analyzed dataset contained 95 papers.Source: A. Paper selection · p. 2
B. Codebook development
- To build the initial codebook, the team selected 27 papers to represent its initial population and risk-factor lists, including papers combining multiple factors.The researchers inductively analyzed and summarized the papers, then iteratively refined categories for risk factors, protective practices, and barriers.Source: B. Codebook development · p. 2
C. Full analysis
The team coded its 95-paper dataset and finalized a framework of 10 contextual risk factors, organized as societal, relationship, and personal-circumstance factors. The synthesis reflects sampled literature rather than a complete account of every population’s challenges.
C. Full analysis
- Coding covered the final 95-paper dataset; after staged independent coding, Krippendorff’s α reached 0.88–1.00 for risk factors and practices and 0.83 for barriers.The team then reviewed results, identified themes, and finalized the framework; seven experts reviewed it and found it sound and useful.Source: C. Full analysis · pp. 2–3
D. Limitations
- The 95-paper dataset is not exhaustive, skews toward Western—especially U.S.—populations, and may omit relevant perspectives from fields such as the social sciences.The synthesis may not reflect all challenges because sampled papers often studied different issues and depths; it reflects current understanding in the sampled literature.Source: D. Limitations · p. 3
- The authors describe the work as a first step and call for future work that broadens the literature and cultural perspectives represented.Source: D. Limitations · p. 3
IV. CONTEXTUAL RISK FACTORS
- The analysis identified 10 contextual risk factors: three societal, three relationship, and four personal-circumstance factors that augment or amplify digital-safety risks.Being the target of a digital attack alone is not treated as a risk factor.Source: §IV · p. 3
- Table I marks a factor when at least one study reported it for a population; an empty cell means it was not reported in the dataset, not that it is irrelevant.The framework’s descriptions also consider associated attacks, attackers, harms, and intersections among factors.Source: §IV · p. 3
A. Societal factors
Societal factors can raise digital-safety risks through norms, political or legal power, and marginalization. They often expose populations to diffuse targeting and can constrain participation or produce harms beyond the online attack itself.
A. Societal factors
- Societal-factor attacks tended to target anyone in a population or the entire population at once rather than a specific person.Source: A. Societal factors · p. 3
- Government or quasi-government power can enable interception, surveillance, or internet shutdowns, and perceived monitoring can alter users’ behavior.Associated harms may extend offline to detention, incarceration, or deportation, and may contribute to self-censored speech or reduced trust in institutions.Source: A. Societal factors · p. 3
- Marginalization can expose people to hate and harassment from broad or anonymous attackers, with emotional distress and reluctance to participate online.Widespread microaggressions and threats to leak stigmatized information can also damage reputations or lead to sexual violence; automated gender recognition may misgender transgender people.Source: A. Societal factors · pp. 3–5
- Social norms can restrict options when technology creators’ assumptions mismatch lived experience, including assumptions that devices and accounts are personal and private.Device-sharing expectations have been reported for women in South Asia and rural women in Greenland.Source: A. Societal factors · p. 5
- Refugees adapting to a new country’s disclosure norms may face financial harm when they do not recognize information such as Social Security numbers as sensitive.Source: A. Societal factors · p. 5
B. Relationships
Relationship-based risks can involve focused targeting by attackers or risks arising from reliance on a helpful third party. Personal circumstances—including prominence, resource constraints, and underserved accessibility needs—can also heighten digital-safety risks.
B. Relationships
- Intimate attackers can make harm difficult to prevent or detect through physical access, authority, or detailed knowledge of their targets.Reported attacks include surveillance, account or device compromise, and destruction of data or devices.Source: B. Relationships · p. 5
- Reliance on helpful third parties can reduce privacy and autonomy, increase the attack surface, or expose users to impersonation.Examples include caregivers, crowdsourced services, and refugee case workers handling personal data or essential tasks.Source: B. Relationships · p. 5
- Access to another at-risk person can invite focused, stepping-stone attacks intended to reach that primary target.Examples include targeting children to regain access to a survivor, journalists to reach sources, and teachers to reach students.Source: B. Relationships · p. 5
C. Personal circumstances
- Prominence can bring focused targeting and intensify risks tied to legal or political factors or marginalization.The passage reports greater focused-attack risk for people involved in a national U.S. political campaign than campaigns receiving only state or local attention.Source: C. Personal circumstances · pp. 5–6
- Limited resources or time can elevate risk and reduce users’ ability to respond, including when outdated devices cannot receive security updates.Election timelines and hospital availability demands can also constrain security preparations or encourage password reuse and unsecured-device use.Source: C. Personal circumstances · p. 6
- Underserved accessibility needs can increase digital-safety risks through anxiety, susceptibility, and difficulty interpreting or using technology.Examples include difficulty distinguishing legitimate English-language callers from scammers and understanding privacy risks; screen-reader use in public can also raise eavesdropping concerns.Source: C. Personal circumstances · p. 6
- Access to sensitive data, credentials, or money can make users targets for attacks intended to co-opt that access.Examples include emergency department staff with patient data, journalists with source materials, and executives able to approve wire transfers.Source: C. Personal circumstances · p. 6
D. How do contextual risk factors interact?
Contextual risk factors often overlap, combining to create or amplify digital-safety risks. Their interactions can add focused targeting, constrain coping, or connect accessibility needs with third-party reliance.
D. How do contextual risk factors interact?
- Most at-risk populations experienced multiple contextual risk factors, which can combine to create new risks or amplify existing ones.The authors argue that technology creators and researchers should consider a population’s risk factors together when possible.Source: D. How do contextual risk factors… · p. 6
- Prominence can add focused targeting to other risk factors, intensifying risks such as attacks aimed at sensitive resources or targeted harassment.Examples include prominent politicians and transgender activists.Source: D. How do contextual risk factors… · p. 6
- Resource or time constraints can make it harder to cope with other risk factors, including protecting digital lives after intimate partner abuse.The passage notes particular difficulty among survivors with low socioeconomic status in protecting their own and their children’s digital lives.Source: D. How do contextual risk factors… · pp. 6–7
- Underserved accessibility needs can combine with reliance on a third party, as when memory difficulties lead older adults to share passwords with caregivers.The pattern also appeared among children, teens, people with visual impairments, and refugees.Source: D. How do contextual risk factors… · p. 7
V. PROTECTIVE PRACTICES
At-risk users employ varied practices they perceive may prevent, mitigate, or respond to digital-safety risks, but those practices can be imperfect and involve tradeoffs. Social strategies include seeking help, vetting identities, controlled disclosure, and appealing to attackers.
V. PROTECTIVE PRACTICES
- Protective practices form part of the framework, but users’ chosen strategies are not always ideal or effective and can involve tradeoffs.The authors catalog these practices to describe what users do under risk and to inform discussion of barriers to protection.Source: §V · p. 7
- The framework groups protective practices into social strategies, distancing behaviors, and technical solutions, which users may combine.Social strategies rely on connections; distancing limits or abandons accounts or technologies; technical solutions use tools or mechanisms.Source: §V · p. 7
A. Social strategies
- Users seek informal help from trusted family, peers, or online communities for practical assistance and emotional support.Examples span children seeking help with warnings, older adults asking family for assistance, and transgender people seeking peer support.Source: A. Social strategies · p. 7
- Trusted organizations and professionals provide digital-safety help alongside support for other needs, though reliance on them can add risk.Organizations assist survivors and refugees, while libraries provide technology access; journalists, teachers, and campaign workers also receive professional support or training.Source: A. Social strategies · p. 7
- When dependable digital signals of identity are lacking, users rely on ad-hoc methods to vet people before admitting them into private spaces.Examples include screening questions, shared lists of abusive clients, and trusted peers who vet people before sensitive group chats.Source: A. Social strategies · pp. 7–8
- Some users disclose sensitive information proactively to control how it is revealed, while others appeal directly to attackers to stop harm.Controlled disclosure requires willingness to be hyper-public, which carries potential risks; social pleas rely on the attacker’s empathy.Source: A. Social strategies · p. 8
B. Distancing behaviors
Users often limit technology use or sharing when it feels safer, and they also adopt technical protections such as account separation, encryption, and privacy controls. These strategies do not always provide the desired protection and can involve tradeoffs.
B. Distancing behaviors
- Distancing behaviors are prevalent, and limited or non-participation often felt like the safer choice.Some users self-censor personal content to avoid disclosure or stigma, while others sharply reduce their digital footprint.Source: B. Distancing behaviors · p. 8
C. Technical solutions
- Journalists, activists, politicians, and organizations used encrypted communications, while some also encrypted files or devices against attackers gaining physical access.Reported uses include PGP for Panama Papers reporting and encrypted chat across networks controlled by nation-state adversaries.Source: C. Technical solutions · p. 8
- Strong authentication was rare in the dataset, with reported adoption limited even among groups facing motivated attackers or phishing.The ICIJ required 2FA for Panama Papers journalists, while only a minority of political campaign participants adopted the strongest form of 2FA.Source: C. Technical solutions · pp. 8–9
- Users applied privacy settings to limit location sharing, social-media visibility, unwanted contact, and access to sensitive resources.Caregivers also used tracking and monitoring applications, which can create autonomy–privacy conflicts but may help when used in ongoing dialogue with parents.Source: C. Technical solutions · p. 9
- Users manage online identities through multiple, pseudonymous, or replacement accounts and devices to separate identities or respond to surveillance.Some also use ad-hoc pseudonyms, such as neutral profile images or emojis instead of contact names.Source: C. Technical solutions · p. 9
- Only two populations in the review were reported using network-security tools such as Tor or VPNs, and not all users found them useful or usable.The reported populations were certain activists and journalists; the authors note that the review cannot distinguish limited awareness, perceived usefulness, and research coverage as explanations for the pattern.Source: C. Technical solutions · p. 9
VI. BARRIERS TO PROTECTIVE PRACTICES
The thematic analysis identifies competing priorities as barriers that can limit or prevent effective adoption of protective practices. At-risk users may put basic needs, social participation, community expectations, or others’ autonomy ahead of digital safety.
A. Competing priorities
- Competing priorities can layer conflicts between digital safety and other needs, making safer behaviors especially difficult for at-risk users.These priorities include basic needs, social participation, social norms, and caring for others.Source: A. Competing priorities · p. 10
- People facing resource or time constraints used potentially insecure apps and public Wi-Fi to meet critical needs such as food, housing, and jobs.Some also shared account credentials or accepted surveillance to obtain services, identify medicines, or maintain autonomy.Source: A. Competing priorities · p. 10
- Some users accepted risks to participate or meet social expectations, including LGBT+ parents’ family posts and account or device sharing in response to community norms.Activists also used potentially risky communications to organize and maintain community.Source: A. Competing priorities · p. 10
- Users sometimes prioritized efficiency or others’ well-being and autonomy over their own digital safety, including mixing work and personal data or accepting risk to support visibility.Journalists and NGO staff also described balancing their safety against burdens or restrictions placed on sources and survivors.Source: A. Competing priorities · p. 10
B. Lack of knowledge or experience
At-risk users’ knowledge and experience may not match the protections their risks require, while technology designs can rely on assumptions that do not fit their circumstances. These gaps can make protections inaccessible, ineffective, or insufficiently nuanced.
B. Lack of knowledge or experience
- Nearly all at-risk populations in the dataset had less digital-safety knowledge than needed to mitigate serious risks and deploy robust protections.Sophisticated attackers targeting activists, journalists, undocumented immigrants, or campaign workers can create stark knowledge asymmetries.Source: B. Lack of knowledge or experience · pp. 10–11
- Survivors of intimate-partner abuse may face motivated attackers launching repeated attacks that leverage intimate knowledge, physical access to devices and accounts, and relational power, requiring substantial, robust protective measures [57].Some resource- or time-constrained users had limited technology experience; survivors and others lacked regular access to new or trusted devices or the internet, limiting their ability to gain technology experience and skills.Source: B. Lack of knowledge or experience · p. 11
C. Broken technology assumptions
- The assumption that one person controls each device or account fails when users share access for services, monitoring, social norms, legal requirements, or under duress [4, 8, 18, 19, 33, 35, 42, 53, 63, 76, 89, 96].The authors note that child and family account support has progressed since many reviewed papers were published, though more can be done.Source: C. Broken technology assumptions · p. 11
- Phone-dependent 2FA can be out of reach for people without reliable service or app space, those unable to afford separate plans, and Sudanese activists blocked by sanctions.Password memorization can also be difficult for older adults with cognitive impairments and people with dyslexia or aphasia.Source: C. Broken technology assumptions · p. 11
- Safety concepts and authentication assumptions may not fit users’ cultures or values, as in Khmer privacy translations, birthday-based systems, and payment access for sex workers.For users facing focused intimate attackers, contextual controls may need to account for relationship dynamics, mood, or physical copresence; unavailable or unclear options may accompany distancing from technology [57].Source: C. Broken technology assumptions · pp. 11–12
VII. IMPLICATIONS AND FUTURE DIRECTIONS
The framework is intended to help researchers identify gaps in knowledge and shape research questions and study designs. The authors also highlight understudied populations, risk-factor interactions, and crisis situations as areas for further work.
A. Research
- The framework can reveal sparse or missing knowledge across populations and risk factors, helping researchers prioritize efforts and shape study designs and questions.The authors call for broader research across populations and factors, including geographically and culturally diverse participants and groups not studied in the analyzed venues.Source: A. Research · p. 12
- The analyzed literature had not deeply explored how risk factors combine and interact, precluding a thorough synthesis and making interactions a future research priority.The framework can help enumerate factors to consider in such work.Source: A. Research · p. 12
- Crisis situations may change access to resources, circumstances, or behavior in ways that amplify attack risk or harm, making them a possible new or expanded risk factor.The authors point to COVID-19 research as evidence of such changes.Source: A. Research · p. 12
- Researchers can use the 10 factors and protective-practice categories to structure interviews or surveys, deepen inquiry into known populations, and support comparisons across studies.The authors also call for careful ethical planning when researching at-risk users.Source: A. Research · p. 12
B. Technology development
The authors propose using the framework to help technology creators consider multiple at-risk populations, their needs, and current coping practices. They emphasize that design must balance protection, usability, and the trade-offs users already face.
B. Technology development
- The framework organizes 10 contextual risk factors and protective practices to help researchers and technology creators consider multiple populations, including when broad user research is not an ethical option.It does not replace direct engagement with at-risk users, which the authors advocate when appropriate.Source: B. Technology development · pp. 12–13
- Different risks suggest different technology needs, from secrecy on shared devices to robust resource protections, easier strong protections, and support for pervasive attacks.Examples include plausible-deniability features, encryption, authentication, guided setup, and bulk-attack management [11].Source: B. Technology development · p. 13
- At-risk users rely on technical and non-technical practices that may be ineffective or introduce vulnerabilities, so designers should understand and avoid disrupting social strategies and distancing behaviors.The reviewed dataset also suggests some existing safety solutions are not commonly used, pointing to possible accessibility or usability improvements.Source: B. Technology development · p. 13
- Protective practices can carry downsides: distancing may reduce social participation and access to social support, so interventions require evaluation of benefits and drawbacks.The authors recommend using the framework to reason about whether design tensions are manageable and net beneficial.Source: B. Technology development · p. 13
- More nuanced options and transparency should remain manageable and usable, with actionable guidance, layered controls, and defaults suited to competing priorities.At-risk users may experience heightened stress, while unclear or inaccessible controls can make tailored protections harder to deploy.Source: B. Technology development · p. 13
VIII. CONCLUSION
- The framework combines contextual risk factors, protective practices, and barriers to structure future research and technology development for safer online engagement.The conclusion describes it as a way to make guidance from varied populations more applicable in practice.Source: §VIII · p. 13
APPENDIX
The population categories are provisional and non-exhaustive, and the authors flag geographic skew and Western institutional perspectives as limits on the reviewed work and its analysis.
APPENDIX
- The review’s provisional categories represent its dataset, flatten some demographic detail, and are non-exhaustive, while thematic analysis unpacks intersections where possible.The examples use more specific participant descriptions and geography when relevant.Source: APPENDIX · p. 17
- 48 of 95 papers included only U.S. participants, and 68% included participants only from Western countries.Some populations had perspectives reported from around the world, while the remaining Table I populations represented Western perspectives.Source: APPENDIX · p. 17
- The authors’ U.S.-based institutional and disciplinary contexts, alongside those of many dataset-paper teams, influenced the sampled papers and analysis lenses.They advocate for additional perspectives to enrich the framework’s findings.Source: APPENDIX · p. 17