SoK: A Framework for Unifying At-Risk User Research

TL;DR

The paper addresses the fragmentation in digital-safety research for at-risk users by presenting a systematization of knowledge into a unifying framework. It builds a framework around $10$ contextual risk factors spanning societal, relational, and personal dimensions, and catalogs protective practices that at-risk users already employ, along with barriers to protection. Through a meta-analysis of $95$ papers across security, privacy, and HCI, the work demonstrates how risk factors intersect and how protections vary in effectiveness, offering actionable guidance for researchers and technology developers. This framework enables scalable, cross-population research and design, with the goal of making digital safety more inclusive while improving safety for all users.

Abstract

At-risk users are people who experience elevated digital security, privacy, and safety threats because of what they do, who they are, where they are, or who they are with. In this systematization work, we present a framework for reasoning about at-risk users based on a wide-ranging meta-analysis of 85 papers. Across the varied populations that we examined (e.g., children, activists, women in developing regions), we identified 10 unifying contextual risk factors--such as oppression or stigmatization and access to a sensitive resource--which augment or amplify digital-safety threats and their resulting harms. We also identified technical and non-technical practices that at-risk users adopt to attempt to protect themselves from digital-safety threats. We use this framework to discuss barriers that limit at-risk users' ability or willingness to take protective actions. We believe that the security, privacy, and human-computer interaction research and practitioner communities can use our framework to identify and shape research investments to benefit at-risk users, and to guide technology design to better support at-risk users.