Learning about Tor users with an immersive user research in the global south

User research is critical for a tool like Tor. Tor should improve their ecosystem of tools to increase and diversify its user base. Anonymity networks function by hiding users among other users. The larger the set, the more anonymous the participant. So, when more users join the network, existing users become more secure.

Organization: The Tor Project
Date: 2018-2021
Role: User Experience Team Lead
What I did: Research, Management, Reporter

We designed a User Research Program focused on the Global South, incorporating user research as part of security training performed by the community team. The program reached people in countries like Brazil, Colombia, Mexico, India, Indonesia, Kenya, and Uganda.

The user research program allowed us to raise the voice of users with diverse needs for secure and private software. We were interested in learning about the so-called next billion. But, we discovered that our users are not the next billion; they are already online.

During every trip, we ran security training with local groups. We carried out a threat model exercise that influences the content of the activity. We tailored courses with different modules which we put together according to the needs of the participants. Along with Tor Browser, we also teach about other tools that improve security: for instance, in training customized for journalists, we talk about sharing sensitive information using OnionShare.

These immersion trips have allowed us to learn about the end-users’ everyday experience with secure and private tools. We bought their SIM cards, and we set the local ISPs that we then connected to their wifi. We also ran in-person usability tests for Desktop and Android versions of the Tor Browser.

Additionally, we provided them with the tools to threat model their specific use cases in order to understand the value of using a secure tool.

It allowed us to have a first-hand account of how what we were building is serving people in different contexts with multiple levels of technical understanding. It also shed light on different mental models on how privacy and security work online.

Knowing the reality that Tor users face helps us understand their context, empathize with them, and contemplate solutions to meet their needs. Essentially, it allows us to bridge the gap between developers, tools and users.

The UX team generated different types of artifacts that enabled us to share this experience with developers.

We published community.torproject.org/user-research to enable user researchers around the globe to run open research with their local communities.

The industry relies heavily on data gathered from invasive tracking scripts to better understand their users’ behavior, further fueling what Zubboffs called surveillance economy. The data extraction imperative is one of the foundational mechanisms of the surveillance economy. Collecting user feedback without practicing extracting methodologies enables us to carry out safe research that respects the basic principles of privacy and consent.

This holistic approach allowed us to release Tor Browser with continuous usability improvements.