The Motivated Can Encrypt (Even with PGP)

TL;DR

This study investigates whether motivated individuals, such as activists, can overcome usability challenges of PGP email encryption for long-term use, revealing that motivation and social factors influence sustained adoption.

Contribution

It provides the first long-term, in-the-wild analysis of PGP email encryption adoption among activists, highlighting social and motivational factors beyond usability.

Findings

Over half of participants continued using PGP after 6-40 months.

Long-term use is influenced by motivation and activism risk levels.

Usability alone does not predict sustained encryption use.

Abstract

Existing end-to-end-encrypted (E2EE) email systems, mainly PGP, have long been evaluated in controlled lab settings. While these studies have exposed usability obstacles for the average user and offer design improvements, there exist users with an immediate need for private communication, who must cope with existing software and its limitations. We seek to understand whether individuals motivated by concrete privacy threats, such as those vulnerable to state surveillance, can overcome usability issues to adopt complex E2EE tools for long-term use. We surveyed regional activists, as surveillance of social movements is well-documented. Our study group includes individuals from 9 social movement groups in the US who had elected to participate in a workshop on using Thunderbird+Enigmail for email encryption. These workshops tool place prior to mid-2017, via a partnership with a non-profit which supports social movement groups. Six to 40 months after their PGP email encryption training, more than half of the study participants were continuing to use PGP email encryption despite intervening widespread deployment of simple E2EE messaging apps such as Signal. We study the interplay of usability with social factors such as motivation and the risks that individuals undertake through their activism. We find that while usability is an important factor, it is not enough to explain long term use. For example, we find that riskiness of one's activism is negatively correlated with long-term PGP use. This study represents the first long-term study, and the first in-the-wild study, of PGP email encryption adoption.