Responsible data considerations In depth Example Upfront about vulnerabilities. Some developers publish “threat models” and Should Jon use WhatsApp for human rights work? known vulnerabilities on their website for the Jon is a human rights activist in Kampala, Uganda, sake of transparency. For good examples, see documentation for Scramble.io (secure email software) and Cryptocat (secure chat software). More companies now also release transparency reports that highlight things like official requests for user information and legal takedown notices. For example, see Twitter’s Transparency Report. These reports and is collecting reports of violence against LGBTI people. Homosexuality is illegal in Uganda, and Jon’s group is routinely monitored by police. Jon just bought his first smartphone, and is considering using the chat application WhatsApp. Many of his friends use it, and he has heard that it’s secure. are voluntary and difficult to verify, still they Here’s what Jon decided... may offer context around the safety of services. WhatsApp implemented widely-trusted encryption by Signal in 2016, which is open source and verifiable. But WhatsApp itself is not open source and there are no public audits of the code, so Jon can’t be entirely sure of their security. Also, WhatsApp messages are encrypted in transit, but not on the device, so a stolen phone could be vulnerable. Jon does not outrule using WhatsApp, but asks a colleague, and decides to research other messaging applications, including OpenEvsys and Martus which are developed for human rights purposes. 68