Cybersecurity is structured by binaries that fail to account for domestic violence and gendered insecurities

Feminist theorists of international relations (IR) have long argued that binaries of public/private reinforce the subsidiary status given to gendered insecurities, so that these security problems are ‘indi- vidualised’ and taken out of the public and political domain. This article argues that the emerging field of cybersecurity risks recreating these dynamics by omitting or dismissing gendered technologically-facilitat- ed abuse such as ‘revenge porn’ and intimate partner violence (IPV). I present a review of forty smart home security analysis papers to show the threat model of IPV is almost entirely absent in this literature. I conclude by outlining some suggestions for cybersecurity research and design, and reaffirming the importance of critical studies of informa- tion architecture to the modern study of IR. The ease of changing locks after a break-up—and the design of homes and domestic architecture more broadly—could have once been seen as a private matter, far from the concern of inter- national relations (IR) and security scholars. However, the global spread of information technologies means that information ar- chitectures designed in one part of the world mediate the lives of people worldwide both in the workplace and in ‘private’ spaces like the home. For example, ‘smart home’ technology allows users to control their home from an interface, adjusting temperature, un- locking doors, controlling lights, or viewing security cameras. The smart home market is growing rapidly and is forecast to comprise nearly 1.3 billion devices by 2022.1 Therefore, lack of diversity and failures of imagination among designers, theorists and practition- ers of cybersecurity have global implications. The definition of cybersecurity is contested and in flux. Cy- bersecurity is best understood as the set of protocols, technolo- gies, and practices designed to protect against threats mediated by digital technology. The question of who or what is protected is often at the heart of definitional controversies. Early understand- ings of ‘information security’ (which is often used interchange- ably with cybersecurity), such as the classic ‘CIA model,’ focused on the confidentiality, integrity and availability of information.2 Similarly, Kello’s The Virtual Weapon and International Order – an influential book on cybersecurity and IR – defines cybersecurity as “measures to protect cyberspace from hostile action,” where “cyberspace” is defined as “all computer systems and networks in existence.” However, as von Solms and van Kiekerk point out, cybersecurity goes beyond information security, as the term en- compasses not just the protection of information, machines, or networks, but also of the humans that use them. A feminist ap- proach to cybersecurity must be grounded by a focus on harms to humans. Security analysis papers – in which new technologies are as- sessed in light of how their security architectures might be com- promised by an adversary – are a common cybersecurity practice.4 Security analyses commonly begin by ‘threat modelling’: a system- atic analysis of the probable attacker’s profile, the most likely at- tack vectors, and the assets most desired by an attacker.5 Threat modelling therefore reflects assumptions about the causes of inse- curity among technology users. Feminist IR theorists have challenged binaries of internal/ external and personal/political violence in conventional security studies, arguing these ignore or diminish the threat of gender- based violence and threats to women’s security. Unfortunately, the emerging field of cybersecurity has not incorporated these insights and therefore risks omitting many forms of technological abuse. In this paper, I present a review of smart home security analysis to show how cybersecurity research fails to account for domestic and intimate partner violence (IPV) in its threat models. This is deeply concerning because technology is an increasingly common medi- um for abuse; if researchers ignore the domestic threat model, it is unlikely designers and practitioners will account for how informa- tion architectures can both facilitate and constrain abuse.