Translating knowledge about potential risks in the digital environment into actual practices of data and privacy protection is not a straightforward process. Activists often do not have the time, resources, or capacity to make security practice decisions based on nuanced risk assessment. And when they do try to do so, they may find certain tools and practices too cumbersome to use. Critically, individuals’ approaches to communication technologies are shaped by their expectations, attitudes, and perceptions as much as by the technical configuration and usability of tools and applications. Users develop “mental models” to process information systems and guide their evaluation of risks and risk mitigation.96 As sociologist David Lyon notes, ideas about surveillance “are constructed through everyday involvement with surveillance as well as from news reports and popular media.” These “surveillance imaginaries” inform the way individuals respond to, and engage with, processes of monitoring and data collection.97 The complexity of digital technologies and the constant evolution of threat environments only work to aggravate the feelings of uncertainty that activists experience with regards to regime security agency capabilities. An Egyptian human rights defender coordinating with colleagues inside Egypt and across several other countries stressed the difficulty of everyday security choices: “All the time when we talk in our online meetings we don’t know if we can speak freely or not. We have no alternatives, we are between two options: to be practical or to be secure. Every discussion is a test for us, to mention a name, to say something or not, dates, passwords, etc.”98 Moreover, recurring reports on successful hacking and surveillance operations or new security flaws in popular applications can overwhelm activists and lead to feelings of resignation and hopelessness. A Syrian security trainer described the mechanisms leading to “security paralysis” 99 as follows: “This ‘I don’t care’-attitude, this ignorance is sometimes also the result of a high level of stress. If you think about all the possibilities of getting hacked, then it can result in this attitude: OK, I will get hacked anyway. It is a kind of response mechanism to the level of stress (…) Some people can attend three or five trainings, but after all this training they will say OK I will get hacked anyway, if I put antivirus or not, VPN or not.”100 Very few respondents who did not have explicit expertise in digital security felt confident about their ability to protect themselves against potential threats. Most interviewees expressed the need for regular information and advice on practices of digital security. Some reported trying to educate themselves on evolving threats by following the Twitter accounts of experts in the field or studying other online sources. Others did so by consulting with friends and colleagues and asking for advice and recommendations on Internet security. A Syrian editor stressed this reliance on access to support: “We are not technical, we are journalists—and it is important to know that there is someone who can help and protect you when you are facing a problem.” 101 Some respondents, aware of the potential risks, felt they did not have the knowledge they needed to protect themselves. A few independent freelancers, for instance, highlighted the difficulties they experienced in trying to obtain information and organizational support in matters of digital security. 96 McGregor, S., & Watkins, E. (2016). “Security by Obscurity”: Journalists’ Mental Models of Information Security. International Symposium of Online Journalism. http://isoj.org/research/security-by-obscurity-journalists-mental-models-of-information-security. 97 Lyon, D. (2017). Surveillance culture: Engagement, exposure, and ethics in digital modernity. International Journal of Communication, 11(19), p. 830. 98 Interview E6, November 2018. 99 Electronic Frontier Foundation. Security Education Companion: Why your audience should care – and act. https://sec.eff.org/ articles/why-your-audience-should-care. 100 Interview S10, January 2019. 101 Interview S4, October 2018. 29