Re: [hrpc] Intimate Partner Violence Digital Considerations

[Sofía Celi <[e-mail]>]

Dear, Leonie,

Thank you so much for all these points and nice e-meeting you!

I opened issues for the points made over here: 
https://github.com/claucece/draft-celi-ipvc/issues

>  1. I wondered if it may also be helpful to emphasise “gaslighting” in
>     the text explicitly (fits under “perception of threat”). I am saying
>     this because both the over- and underestimation of a device’s
>     capabilities can be misused (we highlighted this in a recent report
>     for the UK Government
>     <https://assets.publishing.service.gov.uk/government/uploads/system/uploads/attachment_data/file/978692/The_UK_code_of_practice_for_consumer_IoT_security_-_PETRAS_UCL_research_report.pdf>).

That is a very interesting point. I think perhaps is needed a section 
more related to IoT devices and how they can be used for this. We didn't 
focus on those kind of devices in the first pass, but it is def a needed 
addition.

>  2. Perhaps you also would like to flag smart, Internet-connected
>     devices as they open up avenues for remote, physical control (we
>     have worked on this extensively here
>     <https://www.emerald.com/insight/content/doi/10.1108/978-1-83982-848-520211049/full/html>, here <https://dl.acm.org/doi/10.1145/3368860.3368861>, and here <https://papers.ssrn.com/sol3/papers.cfm?abstract_id=3350615>, for example).

Yes! Agreed in the previous point ;)

>  3. The low/high-tech dimensions of this abuse pattern could be made
>     explicit. This fits with the sentence that an “attacker can be
>     technologically savvy or not” (we stress this in our work with UK
>     support sector organisations here
>     <https://papers.ssrn.com/sol3/papers.cfm?abstract_id=3931045>);

Yes! There is some literature that explores that a high-tech 
knowledgeable attacker can mount more complex attacks (sniffing the 
network, for example). Adding a section on this seems like a good idea.

>  4. Under “3.2. Tech-based IPV tactics”, you could feature “hacker for
>     hire” services (which we mention in Chapter 6 here
>     <https://www.taylorfrancis.com/books/edit/10.4324/9780429316098/technology-domestic-family-violence-bridget-harris-delanie-woodlock>). Although, I must flag that the prevalence of this is not clear. I have only heard anecdotal evidence from frontline workers that said victims/survivors had stated that their partner had threatened them with this (which, if not correct, relates to [1] above).

This is interesting. I heard from first-hand accounts as well, but I 
haven't been able to confirm. It could be part as you say of a 
"perceived threat".

>  5. Under “Compromise of accounts”, you may also want to underline the
>     impersonation to sign victims/survivors up for services (without
>     their consent/awareness), including for porn sites or online banking
>     (which then facilitates economic abuse).

>  6. Lastly, Deepfakes may be something worth accenting in the text.

Yes! Agreed on both points as well!

> 
> Hope this is useful and happy to provide further input if wanted.

For sure! Thank you very much for this! We will be working on 
integrating these points and send a revised document ;)

Thank you,

-- 
Sofía Celi
@claucece
Cryptographic research and implementation at many places, specially Brave.
Chair of hprc at IRTF and anti-fraud at W3C.
Reach me out at: [e-mail]
Website: https://sofiaceli.com/
3D0B D6E9 4D51 FBC2 CEF7  F004 C835 5EB9 42BF A1D6