 Welcome everyone. I am Abigail Garner and joining me is a lawn bar. We are with least authority based in Berlin We have a team that is across 19 time zones Least authority is committed to building and supporting the development of I'm not miked. I mean the mic is for the the live, but I'll speak up Least authority is committed to building and supporting the development of usable technology solutions and ethical business practices One moment and ethical business practices that support the Privacy as a fundamental human right and secure solutions to for everyone So this project is supported by open technology fund and it is looking at file sharing and storage for human rights organizations We're looking to make this process more secure for human rights organizations. This is using the Tahoe laughs Secure file system that is open source. Also the tools being used for this integrated with Tahoe laughs are grid sync magic folders and Magic Bormhole will have links to those at the end the four partner organizations that are human rights organizations It's been really key to our research are based in Mexico, Nigeria, India and Argentina what we we work with them in Throughout this progress process. It's going to be about 18 months in total and it was important for us in our criteria Is to look at organizations that had a human rights track record They were also had they also had expressed a need for secure file storage and sharing and That they also had the capacity in terms of time and staff to participate in a long-term project And finally we wanted to make sure that it had the global diversity for to represent different parts of different regions So why human rights organizations when we focus on human rights organizations? We're looking at groups that have very sensitive data things that have identities even if it's not names it may be people in locations or experiences that really tie that data to a particular person and we're talking about things like witness testimonies films photos So a lot of things that would be high risk if they were found also if they were Found by People that should not be seeing them also in terms of the threat model their risks are very high. We're talking about things like Harm to your to your body or threats to yourself or your family members and situations like detention or or interrogation They also these organizations because they're doing such work that is pressing and often under Stressful situations, they have limited resource and time to learn new tools So if we can make these tools more usable for them They're more likely to adopt them and then we also as we make them more usable for human rights organizations We're making them more usable for everyone and finally this is aligned with least authorities mission to participate in In within the internet freedom space and human rights Thanks Abigail. I Hope I'll speak loud and clear enough. I want to hear me also in the back Okay, thanks. So what did you want to learn as part of the research that we did for this project? So we did the research as part of two phases and I'll tell you about both phases So in the first phase the goal for the research was to find out what the file sharing what a file storage needs are of human rights organizations So we did that research by first selecting human rights organizations and Abigail spoke to that just a second ago and Then we shared a survey with them that they filled out to explain what they're doing at the moment when they want to share files Or store files and we followed up with foundational interviews So basically where we had a chance to talk to the more in-depth about the things that they feel that in the survey That was the first phase in the first phase We discovered that the sharing use case was the one that we probably wanted to focus on for the remainder of the project And I'll tell you a little bit more about how we came to that But just to share what the second phase and looked like and the second phase are actually still in but the research that we've done So far basically focused on first describing Those file usage as file storage and file sharing needs of human rights organizations a bit more in-depth and also focusing more on collaboration And secondly to do a usability study of one of the open source tools that we work with that Abigail mentioned grid sync and grid sync is the graphical user interface of Tahoe laughs So we did more foundational interviews with these organizations and an additional organization and Then we did a moderated usability test Which means that we had the organizations and the people that we tested with Run through some tasks using grid sync so that we can see how usable the program is at the moment Is actually something that they can work with is it easy to use etc So what did we learn as part of this research? In the first phase as mentioned we did mostly needs finding and we won't have time to share everything that we learned so we'll just share some highlights We learned that organizations have different file storage and sharing needs Well, this may sound self-evident, but it's not as of evidence may seem and It's important for us to keep that in mind because human rights organizations comes in many shapes forms colors and everything They do many different things. They have different use cases And that means that there's also generally not like a one-size-fits-all for the work that they do One thing that was interesting in that sense is that we learned about the different ways that they choose the tools that they work with There are many different factors that fed into this choice And so for example when human rights organizations choose a tool to work with security practices Matter and security threats that they face Abigail talked about the threat modeling that they need to do to understand what kind of threats they're facing from whom etc And that also leads to different kind of security practices So some organizations may fear that their laptops will be stolen from their office and instead they put things in safe Or they might fear that the absolute will get stolen when they go into the street because they might get mugged And so they don't take the laptops into the street or they might fear surveillance of their digital equipment So they might fear that if they send an email that there will be something intercepted And it also changes the kind of tools that they choose Other factors that contribute to this choice of tools are the file size of take the thing that you want to share Does it fit into an email or not if they need to share through some different means like we transfer a dropbox? Whether they need to collaborate with other organizations as part of it How easy is ticket specific tools to use the privacy features of particular tools or the reputation that they have Whether to costs or whether it's free or how much it will cost and lastly the choice of the partners that they work with I'll tell you a little bit about that one Now so the partners of human rights organizations so the other organizations human rights organizations work with They have a large role to play when organizations choose what tools they can use Human rights organizations tend to not work in isolation. They're usually part of networks They collaborate to do campaigns together. They do research together and that leads to the fact that when they use a tool They often look to their partners to understand what tools the partners are using and When they have a sense for what tools of partners are using they might affect the tool the tools that they can choose or vice versa When they think oh, we want to use this tool then they consider well Actually, I'm not sure if this part organization could work with that or would work with that So we might need to reconsider and also some organizations actively give advice to other organizations for what tools to use So there was interesting thing for us to find out about so that how this partner or the part organizations of these Human rights organizations play such a key role Another thing we learn is that collaboration is really important use case So oftentimes it's not about extending a file to another party It is often about working together in specific documents. So that was really a thing that struck us as part of this research So some of the recommendations that we came out of this research with were that we wanted to focus on the collaboration sharing use cases and We figured well within the scope of what we can do within this project We can't go to let's say real-time collaborate new real-time editing together, but we can do asynchronous editing and We can look at things like version control which really matter when you collaborate together on something We thought we can figure that we can also improve the sharing workflow of The tools that we work with and overall just improve the ease of use of the tools Yeah Yeah, absolutely. Yeah So the second phase of research we decide to focus on sharing collaboration and also to do this usability study that we mentioned before So just one thing that we wanted to highlight from this version control Finding that we learned as part of the second phase is that version control is especially important when collaborating So when people are working by themselves in a particular file being able to go into earlier versions Etc seems to be less critical as when people are working together on the file We identified four needs in that context One is the need to be able to restore earlier versions of a document or a file or to view earlier versions Two would be to view track changes Three would be to see when changes were made and four to see who has made changes. I Also want to share just a few highlights from the usability study that we did with grid sync This is the user interface of grid sync. So this is the file storage and file sharing tool that we use with Tahoe labs So we asked the organization that we worked with as part of the test to see if they can share this real cat folder With a recipient just want to ask people in the audience. How would you do that? If you see this interface and you want to share the real cat folder? What would you do any idea? Sorry, you would drag and drop. Okay? Right click on folder Sorry Okay, so right click on folder or on the three dot menu so Sorry Click on the white. Okay On the invites you said yes, gotcha So we learned that when we asked this question that this was actually not something that was very intuitive to people and So this important task that we had for people to share something with Others seem not to be as easy as It should be So basically the way it works now is that people can need to click on invites and then click on enter invite code That's our create invite code or they can indeed Right-click or click on the three dots and then choose simply device and create invite code But even if people reach that stage it wasn't necessarily clear to them that yes This is the path for them to follow. This is the most effective way and yes Now they're certain that they're doing the thing that they're seeking to do Something that did work well as part of the research that people seem to understand that this sharing use case was something where People sync a folder together. So it's not something that you share in one direction But once you share something with another person then the other person can also make changes to that folder and also then what happens With that folder on your own device So some of the recommendations that we came out of this research with is to focus on version control on Previous versions when chains were made who made changes to improve things in the sharing Workflow to make sure that the user intent is reflected in the way people can access The interface and also provide more guidance in some areas and also we actually need to do more user testing as part of The outcomes on particular aspects of this I will hand it over to Abigail Since the key part of this research has been working with our partner organizations We wanted to share some Information we'd like to pass on if you're thinking about working with human rights organizations in the situation And we had about four months scheduled to find these four partners that would commit with with us for this for for this project and We actually they took we underestimated how much time we would need for that it took us about seven months and that has to do with some suspicion around what we're doing building that trust and And some some of the knows that we heard were because they actually had bad experiences with other development Projects, so there's also some learning to happen there and we We ended up we've now extended our project a bit in order to do that But the way that we did our outreach was we went to the internet freedom space and the human rights space and Introduced people it got introduced to people and then they introduced us to people but that took quite a while longer than we anticipated It's really important that we compensate these individuals as the professionals and the The experts that they are so keep that in mind. They're not going to do this work for free They already have enough on their plate So make sure that you work that into your budget and be upfront with them about what incentives you can offer So that you're really not wasting their time if it's not going to work in in their plan What we were able to do with this project is invite them to meet us in person at a conference that they would be attending anyway so internet freedom festival or rights con they would be there and we would Cover their travel expenses and their hotel and other related expenses in exchange for two to four hours of meeting with us during that time Defining the expected making the clear expectations and commitment really helps The organizations get a sense of what you're asking for that. They're no surprises So we developed a memorandum of understanding an MOU that really told them which activities We were doing how many hours each of them would take the maximum time over this over this project is 32 hours and We also made it clear that this was a non binding Non-binding agreement not even a contract that was important because of the suspicion that there may they may somehow be legally Liable for something along the way or kind of if they need to drop out at some point. They can do that without consequences We had we faced challenges with low bandwidth and other connectivity limitations We did some of our user testing Remotely and there were specific challenges to that one of them Of course is when they're showing their sharing their screen with us. We can't see their faces So they would talk through what they're doing and we could glean from that and from what was on the screen, but but there the Those problems that come up that you kind of work through you see how they work around them And how and it informs our work more on a positive note It informs our work in being aware of the real challenges and circumstances that that human rights organizations are dealing with in the field and Finally it to be aware that their threat modeling may not fit your framework of what is safe and what is private? So keep that in mind every time you include them in discussing your project whatever it is check back with them it also that builds trust and it also Keeps them engaged with the project because for example They know where it fosters them and they know they each one of these organizations Consented to have their names in the slides with understanding that that would also be online So we continue to do that in every time that we mention them so And don't presume that it's that it's okay with them until you've checked Right now we have discussed our findings with our team including the developers and that is currently underway for for making those Changes and then we will go back to the organizations again and do a more user testing at that point We will work with them in deployment and that will inform how we how we do documentation for For broader deployment in the future and those are our the tools of the open source tools that we're using as well as our Website and a blog post specifically about this project What questions are there? What file storage and sharing tools that they use a wide variety for different purposes and so In some cases, they're just sending an email in some cases They want did they make sure that they're sending encrypted email there are other situations where the They don't even want it to be Anywhere except on their computer and the other person's computer and so they are walking a USB To that that other organization. I mean because so many of these organizations work with with others and then depending on Google Drive is a big one and also very Popular because their partners are also working and so if they need it they see it as someone said We just need to get the work done and so sometimes Assessing safety over convenience. That's constantly the dance for them What else Cryptpads, yeah, crypt pad was a big one for But one of the the feedback about that is the formatting is not They're the way they'd like it in collaboration Next cloud. Yeah, I'm sorry second. How many people are using our tool right now With the human rights organizations, they have not they have not deployed it yet So they are they've just participated in the user testing so far. What was their feedback? The feedback on a grid sync and what we showed them there. Yeah, so Many of them said that well, this is actually something that worked quite easily and yes We can work with this and at the same time as we did the test that was not always as evident, right? So this is part of the lesson that Organizations are people when they use something and they go through the motions and they've learned how it works And okay, yes, I can use this this is fine This is workable, but at the same time to get to that process actually there are a lot of stumbling blocks And so there are all sorts of things that we learned from there that oh, actually, this is not so Self-evident or this is not as clear as it should be for people to use it without any any barrier Any other questions? So as part of the agreement that we have with with these organizations, they've agreed that If they want to that they can deploy the tool that we will offer them As that is something that we're looking forward to do in the next few months And so we have to see exactly how that will be if there's something that they can work with if they also have the Facilities to work with that as server space and all these kind of things But to generally there is a willingness and interest to to use that. Yes Any other questions? please How it works technically on the hosting side So as part of the this particular project, it seems like we will not provide the hosting ourselves But that we will help them with organizing hosting for themselves so that you can actually use your own servers for that So some of these organizations use their own servers and they're used to using your own server So we can help them deploy towel laughs in such a context We had a statement of what we were doing that improved the more we learned when we heard people's resistance or Misunderstanding of what we were trying to do so we had a statement of that plan and then we distributed that to various mailing lists and And and through other people's personal networks, that's how that worked Yeah, I can speak to that the question is what when Organizations would talk about their resistance and their the negative experiences they had with other development projects I I can speak to it very generally to say that they would put a lot of work and effort into their feedback and And and then the response of the people that were developing the tool was not necessarily That that they didn't give reason for why it was wrong only Flip it responses like yeah, we're not we're not going to do that or that's not the one of the quotes was that's not sexy So they're kind of like putting this heartfelt effort into sharing what their risks are and sharing what their experiences are and say Here's what we need and then developers saying yeah, you maybe you need that but we're not going to do that Thanks very much. Thank you