Technology-Facilitated Intimate Partner Abuse

In my experience, most classes on computer security discuss things like hackers using buffer overflow exploits to steal credit card information. They rarely mention that if you go to a family shelter in the middle of the night to escape a physically abusive partner, one of the first things they get you to do is turn off your phone, because whoever is abusing you has probably installed spyware to track your location and read your texts and email.

Leitao2019 is a good introduction to so-called "intimate threats". In it, the author describes how the tools and skills used to "keep tabs on her" are shared in online forums, how the software sold by the surveillance industry to keep children safe is routinely repurposed to control the victims of domestic abuse, and the advice that victims and survivors share amongst themselves (which is sometimes inaccurate or incomplete). The paper does not offer any simple conclusions or remedies; instead, I think it can and should spark discussion about everything from what data apps should collect and share to what legal sanctions programmers and their employers should face for creating things that they know are use to do harm.

Leitao2019 is uncomfortable reading, which is why I think our profession prefers to focus on scenarios where business profits are threatened rather than ones where the targets are merely vulnerable people. Precisely because of that, I think the security and ethics lectures in most software engineering courses would be more likely to actually change students' beliefs and behaviors if their starting point was research like this.

Footnote: if you have been enjoying these posts, please take a minute and make a small donation to a family shelter near you.