The Role of Computer Security Customer Support in Helping Survivors of Intimate Partner Violence Yixin Zou1 Allison McDonald1 Julia Narakornpichit2 Nicola Dell2 Thomas Ristenpart2 Kevin Roundy3 Florian Schaub1 Acar Tamersoy3 1University of Michigan 2Cornell Tech 3Norton Research Group Abstract apps still have a high false-negative rate [10]. Resources for IPV professionals and survivors mostly include high-level Technology plays an increasingly salient role in facilitating advice without standardized procedures for flagging and ad- intimate partner violence (IPV). Customer support at com- dressing tech issues [27]. The Clinic to End Tech Abuse [77] puter security companies are receiving cases that involve in New York City and the Technology-Enabled Coercive Con- tech-enabled IPV but might not be well equipped to handle trol Clinic in Seattle are examples of personalized computer these cases. To assess customer support’s existing practices security assistance to IPV survivors, but these services are and identify areas for improvement, we conducted five fo- currently small and only available in specific locations [32]. cus groups with professionals who work with IPV survivors We take a different perspective by focusing on customer (n=17). IPV professionals made numerous suggestions, such support agents at computer security companies for several rea- as using trauma-informed language, avoiding promises to sons. These agents are trained to troubleshoot tech issues, and solve problems, and making referrals to resources and support prior work shows that customers turn to them for a wide range organizations. To evaluate the practicality of these sugges- of security issues beyond products [67], making them a likely tions, we conducted four focus groups with customer support point of contact for survivors experiencing tech-enabled IPV. practitioners (n=11). Support practitioners expressed interest Computer security companies offer products that can help sur- in training agents for IPV cases, but mentioned challenges vivors by catching spyware or other malicious apps, meaning in identifying potential survivors and frontline agents’ lim- that the tech help provided by support agents, when contacted ited capacity to help. We conclude with recommendations for by survivors, can be timely and impactful. Additionally, sev- computer security companies to better address tech-enabled eral large computer security companies have expressed inter- IPV through training support agents, tracking the prevalence est in supporting IPV survivors, forming the Coalition Against of these cases, and establishing partnerships with IPV advo- Stalkerware [71]. However, helping IPV survivors through cates. customer support requires extreme care and caution. Inap- propriate responses or recommendations might re-traumatize 1 Introduction survivors [50] or even escalate violence as abusers seek to regain control [25, 27, 86]. Intimate partner violence (IPV) — abuse or aggression that We investigate the opportunities and challenges for com- occurs in a romantic relationship — is a pervasive societal phe- puter security customer support to help IPV survivors via nomenon that causes physical and psychological harms to vic- three steps: tims [22]. In the United States, more than one in three women and one in four men have experienced rape, physical violence, 1. To discover if customer support agents already encounter and/or stalking by an intimate partner in their lifetime [35]. IPV cases, we searched customer support cases at a large Research shows that technology plays an increasingly salient computer security company. Our search surfaced at least role in IPV [28,53,70,85]. In particular, a growing number of 53 tech-enabled IPV cases, in which survivors described mobile apps enable abusers to surreptitiously spy on, harass the attacks’ severity and resulting distress. Support agents or impersonate their intimate partners [6, 10, 64, 79]. typically focused on technical solutions without expressing Providing technical support to survivors of technology- sufficient empathy or awareness of IPV. enabled IPV is challenging. IPV professionals such as social 2. Having established that support agents encounter tech- workers and lawyers report having insufficient technical ex- enabled IPV cases, we explore how customer support could pertise [27]. Tools for detecting spyware and other malicious better serve IPV survivors by engaging 17 IPV profession- als from five support organizations in focus groups. IPV Stalkerware [71]. Regulators are also strengthening their over- professionals provided numerous suggestions, such as us- sight on spyware, such as the US Federal Trade Commission’s ing trauma-informed language, avoiding promises to solve settlement with Retina-X in 2019 [72]. problems, and making referrals to external resources for Interventions against tech-enabled IPV. In addition to spy- support beyond the immediate technical issue. ware detection tools, prior work has proposed apps and oper- 3. To gauge the practicality of IPV professionals’ recom- ating systems that can help IPV survivors by erasing browser mendations, we conducted focus groups with 11 customer history [20, 73], recording evidence of abuse [3], or engaging support practitioners from four large computer security in safety planning [38]. However, few of them have received companies. Practitioners agreed on the importance of train- wide adoptions among IPV survivors. Support organizations ing agents for IPV cases but mentioned implementation such as NNEDV [76] and Safe Horizon [34] have provided challenges, such as frontline agents’ limited capacity and tech-focused resources for survivors, but these resources are uncertainty in identifying whether a customer may need often out of date or lack detailed guidance [27]. Computer se- IPV-related help. curity clinics are a recent approach for helping IPV survivors through one-on-one consultations with trained technologists, Through this process, we thoroughly engaged with mul- who analyze survivors’ digital assets and provide personalized tiple stakeholders and synthesized their insights into novel advice on resisting tech-enabled attacks [26, 32, 80]. Despite recommendations that both cater to the needs of IPV survivors early evidence of success, these clinics are currently limited and consider the real-world constraints of customer support. to the serving geographic locations [32] and face numerous To better address tech-enabled IPV, we recommend that com- challenges in remote operations [80]. Our focus — computer puter security companies should train support agents to be security companies’ customer support — has the potential to aware of IPV’s prevalence, the limitations of security software reach a broad audience, but this approach requires careful in curbing IPV, and when and how to provide additional help. attention to the nuances and unique risks in IPV to avoid Tracking the frequency and nature of relevant cases would unintentional harm. help companies assess their current practices and determine Customer Support. Customer support plays a crucial role areas to invest in. We further note the opportunity for com- in helping customers make purchase decisions, providing puter security companies and IPV advocates to learn from guidance on product use, and resolving problems or com- each other’s expertise and join forces to help IPV survivors plaints [7]. Reliability, assurance, tangibles, empathy, and re- combat tech-enabled abuse. sponsiveness (RATER) are key metrics in evaluating customer support’s quality [61]. Support agents need to make customers 2 Background and Related Work feel heard and respected to create a positive customer experi- ence [5]. In particular, past research highlights the importance A growing body of literature on tech-enabled IPV has doc- of training support agents in information technology to use umented the many ways abusers maliciously use technol- phrases that build rapport and show empathy [84] since they ogy [25,28,33,45,46,48,49,70,85] and how IPV survivors tend to be technical thinkers with limited soft skills. While struggle to protect their privacy and security [17,18,27,53]. these principles may apply to most, if not all customers, inter- The complex socio-technical and legal factors embedded acting with IPV survivors requires extra sensitivity and care, in the intimate relationship differentiate tech-enabled IPV as we discuss below. from abuse in other contexts such as online harassment [74], Interacting with IPV survivors. Training materials for doxxing [69], cyberstalking [25], and cyberbullying [83]. IPV professionals note the impacts of violence on IPV Malicious apps in IPV. Tech-enabled IPV often occurs survivors, such as post-traumatic stress disorder and sub- through surveillance apps installed on survivors’ devices [10, stance abuse, as well as the lengthy and challenging re- 27, 31, 47, 53]. mSpy, one of the largest spyware vendors, covery process [4, 59]. Some materials further empha- allegedly had around two million users as of 2014 [13]. In size empowerment — supporting survivors in finding their NortonLifeLock’s 2020 survey, 10% of respondents admitted inner strength [15, 41], and trauma-informed responses — using an app to monitor a former or current partner’s mes- understanding the persistent effects of trauma and providing a sages, calls, emails, or photos [78]. safe space [58,59]. Others discuss secondary trauma on IPV Most spyware apps are in fact dual-use, i.e., they have a professionals and respective