2018 IEEE Symposium on Security and Privacy (SP) (2018)
San Francisco, CA, US
May 21, 2018 to May 23, 2018
DOI Bookmark: http://doi.ieeecomputersociety.org/10.1109/SP.2018.00019
Stevens Le Blond , École polytechnique fédérale de Lausanne
Alejandro Cuevas , École polytechnique fédérale de Lausanne
Juan Ramón Troncoso-Pastoriza , École polytechnique fédérale de Lausanne
Philipp Jovanovic , École polytechnique fédérale de Lausanne
Bryan Ford , École polytechnique fédérale de Lausanne
Jean-Pierre Hubaux , École polytechnique fédérale de Lausanne
Humanitarian action, the process of aiding individuals in situations of crises, poses unique information-security challenges due to natural or manmade disasters, the adverse environments in which it takes place, and the scale and multi-disciplinary nature of the problems. Despite these challenges, humanitarian organizations are transitioning towards a strong reliance on the digitization of collected data and digital tools, which improves their effectiveness but also exposes them to computer security threats. In this paper, we conduct a qualitative analysis of the computer-security challenges of the International Committee of the Red Cross (ICRC), a large humanitarian organization with over sixteen thousand employees, an international legal personality, which involves privileges and immunities, and over 150 years of experience with armed conflicts and other situations of violence worldwide. To investigate the computer security needs and practices of the ICRC from an operational, technical, legal, and managerial standpoint by considering individual, organizational, and governmental levels, we interviewed 27 field workers, IT staff, lawyers, and managers. Our results provide a first look at the unique security and privacy challenges that humanitarian organizations face when collecting, processing, transferring, and sharing data to enable humanitarian action for a multitude of sensitive activities. These results highlight, among other challenges, the trade offs between operational security and requirements stemming from all stakeholders, the legal barriers for data sharing among jurisdictions; especially, the need to complement privileges and immunities with robust technological safeguards in order to avoid any leakages that might hinder access and potentially compromise the neutrality, impartiality, and independence of humanitarian action.
Operational-security, Coercion-resistance, Privileges-and-Immunities, Data-protection, Anonymity-networks, Block-chains, Privacy-enhancing-technologies
S. Le Blond, A. Cuevas, J. Ramón Troncoso-Pastoriza, P. Jovanovic, B. Ford and J. Hubaux, "On Enforcing the Digital Immunity of a Large Humanitarian Organization," 2018 IEEE Symposium on Security and Privacy (SP), San Francisco, CA, US, , pp. 302-318.