I2P Usability Lab

Forum on internet Freedom in Africa 2021 (#FIFAfrica21)

On September 28–30, 2021, the Collaboration on International ICT Policy for East and Southern Africa (CIPESA) hosted the eighth edition of the annual Forum on Internet Freedom in Africa (FIFAfrica). The Forum is a landmark event that convenes a wide spectrum of stakeholders from across the internet governance and digital rights arenas to deliberate on gaps, concerns and opportunities for advancing privacy, free expression, non-discrimination and the free flow of information online.

Working with our partners in Africa, the Invisible Internet Project was invited to participate in both a panel discussion, as well as work with a group of journalists to explore what privacy and security mean to them.

The goal for the outcome from this opportunity was to:

• Understand what establishes trust, the concept of privacy and what it means.
• Begin to evaluate I2P and its tooling through this lens.

The word privacy is comprised of different elements that are personal, technical, localized and dependent on other social aspects. We wanted to try to gain some insight about these elements and any risk assessments we could learn about to help us with our work of I2P adoption.

In preparation, we created the following list of questions:

What does privacy mean to you?

What does security mean to you?

What tools are you using for communication?

What makes you decide to trust and use a tool for communication?

Do you use mobile or desktop more?

How much phishing or bad actors do you deal with?

Which are more important to you? Circle and rate each one ( 1 being not important , 5 being very important).

• IP address
• Tracking
• Encryption
• Anonymity
• Other

Findings

What makes you decide to trust and use a tool?

• Knowing how the tool is used, its usability, is it easy for people to use.
• Everyone or many people can use the tool, not limited to a small group. Can share info with others.
• Consider feedback mechanism. Is it safe?
• Finding out the source, who built this tool? Is that person credible.
• Its efficiency, how does it work? Is it fast, does it back up your info?
• “We have to be careful in the selection of tools that we use. Some tools we use alone. We need apps that everyone uses. What tools are used in Uganda? When developing a tool you need to consider all that.”

What do you do to ensure privacy and security?

• Encrypt your messages.
• Have different passwords on different accounts.
• Do not use free wifi, Internet cafe. There are hackers.
• Avoid clicking on links and prompts that are phishing scams.
• When filling out account, do not put every bit of info about yourself on there.

Insights

In terms of adoption, I2P needs to ask about relationships to privacy tools and practices and meet people where they are. While the project works diligently to create and constantly improve its protective communication and traffic obfuscating abilities, it must consider the accessibility of this work. In regards to security, we find that the group has adopted their own operational security methods for protection when using the tools that they make use of.

“Finding out the source, who built this tool? Is that person credible.”
This is one to think about. How do we provide credibility when as tool developers we may want to keep our names and faces off of the internet? How do people decide who is credible and who is not? Is being a free open source project enough? Further research on the topic of establishing trust will take place in the upcoming months.

Do not focus right away on the “at risk user” persona. Instead we should start with this: all people want something that is simple to use and that has a reputation. It is also important that people can use it with their community, friends, and work colleagues to collaborate. We found that many people rely on things like Gmail and its services. Why? It is easy to use, “free”, and its reputation is in part built by many people using it. It also makes collaboration easy. Is it a first choice for privacy? Probably not. Is it a choice that people make for trade offs like usability and ability to get things done simply? Many of us do. Here we need to ask the question about the potential disconnect between the tools that the privacy community uses and creates and what people actually end up using and why.

Adoption results from efficiency, ease of use, and empowerment. All of these things result in a person not just wanting to use a privacy option, but to feel like they are actually taking control of their privacy. This is one of the most important aspects we have encountered during the past year when talking with new users: the emotional aspect of interacting with technology. Telling a person that something can technically provide a solution is one part of adoption. Providing a person with something that they can use with confidence is the other. Meeting people where they are and asking about who they are ensures that we are creating for real needs and for the most people possible.

Looking at what people use, we see applications like chat and email. Focus for development should take into consideration the opportunities available with the I2P application layer. Applications should work cross platform, and participate in rigorous testing for usability. The other is mobile development. I2P Android requires more attention in order to offer more robust options for people who want or need a mobile solution for I2P services.

“Avoid clicking on links and prompts that are phishing scams.”
I2P Bote offers protection from many threats and could reduce some of the threat surface created by using regular email. It is in need of a maintainer at the moment. If you are interested in participating in reviving I2P Bote, please contact us at the I2P Usability Lab.

If you are interested in participating in I2P research and adoption work, the I2P Usability Lab is working on creating specific onboarding and updating documentation to ensure that our next generation of developers have everything that they need to expand the I2P ecosystem for more people. We also conduct user research, and are focusing on supporting key I2P applications and extensions find adoption.

Thank you so much to everyone who supported this work by organizing the workshop, participating, and allowing us to participate in this event.

HN, Lucie, and Sadie