Activists engage in highly public and collaborative work, and their social movement groups have long been targeted by the surveillance state. Many consider the adoption of secure and privacy-enhancing technologies to be the antidote. However, activists operate with limited resources and elevated risk, making the adoption of these technologies difficult and imperfect. We investigate how groups navigate organizing using digital communication, and specifically how groups make intentional (even if insecure) decisions around privacy protections in their organizing. We interviewed 40 activists belonging to 33 U.S.-based social movement groups ranging in size, structure, and tactics. Responses were analyzed qualitatively to uncover factors influencing digital security decisions for organizing work. We find that low-risk hierarchical groups with a lack of training and little concern for surveillance tended to not consider privacy as they navigate digital technologies and horizontally-organized groups engaging in risky activities took intentional strides to enhance their digital privacy within the context of their activism. The availability and influence of a technically-minded group member or advisor plays a strong role in the adoption of PETs. A groups\' lack of knowledge in PET use or concern with surveillance is a barrier to PET adoption and highlights the importance of education. Finally, we find that feature availability and learnability is still an important factor in PET adoption. This work illustrates the nuanced factors and responses that users aware of the threat of surveillance are taking into consideration, including but not restricted to, the adoption of E2EE communication technology and the digital security culture necessary to operationalize it.

Abstract Existing end-to-end-encrypted (E2EE) email systems, mainly PGP, have long been evaluated in controlled lab settings. While these studies have exposed usability obstacles for the average user and offer design improvements, there exist users with an immediate need for private communication, who must cope with existing software and its limitations. We seek to understand whether individuals motivated by concrete privacy threats, such as those vulnerable to state surveil-lance, can overcome usability issues to adopt complex E2EE tools for long-term use. We surveyed regional activists, as surveillance of social movements is well-documented. Our study group includes individuals from 9 social movement groups in the US who had elected to participate in a workshop on using Thunder-bird+Enigmail for email encryption. These workshops tool place prior to mid-2017, via a partnership with a non-profit which supports social movement groups. Six to 40 months after their PGP email encryption training, more than half of the study participants were continuing to use PGP email encryption despite intervening widespread deployment of simple E2EE messaging apps such as Signal. We study the interplay of usability with social factors such as motivation and the risks that individuals undertake through their activism. We find that while usability is an important factor, it is not enough to explain long term use. For example, we find that riskiness of one’s activism is negatively correlated with long-term PGP use. This study represents the first long-term study, and the first in-the-wild study, of PGP email encryption adoption.