SECURITY NEEDS AND HURDLES These insights are confirmed by the security needs and hurdles identified by interviewees for the realization of digital security among activist groups and communities. The need for more technical expertise and better equipment was repeatedly mentioned. Tellingly, only a few of the larger organizations involved in the research process had data protection policies and dedicated staff for digital security. The smaller groups and media organizations often lacked the necessary funds to invest in the training, staff, and equipment needed to improve their digital protection. For example, a Syrian digital security trainer emphasized the problem of using pirated and outdated software. Syrian activists in Turkey and the liberated areas often could not afford to buy original products, even when working for NGOs. Moreover, access to pirated software was more common in Syria as copyrights were not enforced. And sanctions against the country meant Syrian citizens often could not open bank accounts or use credit cards to purchase software updates and anti-virus protection even if they tried. “How do you want to build the capacity of these people?” the trainer asked. ”Without offering them the original version of a program that is more expensive than anything in your training budget?!”106 Another security expert and trainer working with exiled members of the Syrian media pointed out that organizations often worked for years with risky tools without any incidents. Consequently, it was difficult to convince them that they needed to change their routines. This problem was exacerbated by the fact that in-country contacts often lacked sufficient knowledge on digital security and failed to use recommended security tools and applications. For instance, when an exiled journalist needed to quickly get in touch with a source, encrypting emails or shifting to more secure messaging service was considered cumbersome.107 Several of the interviewed trainers and experts for digital security emphasized the difficulty of changing the behaviour of individuals in order to improve their protection against digital threats. An Egyptian trainer pointed out the trade-offs of digital security for users without technical expertise: “When you add more security you add an extra layer to deal with every day. In the beginning people start to fight the change.”108 And an Iranian trainer complained that he had to “chase” participants after trainings because if not they would soon disable important security features, such as two-step verification. He noted that under pressure and in moments of emergency, activists tend to forget the security methods learned in trainings.109 Another Iranian security expert stressed the need to better inform activists about how to collect samples of suspicious emails and files so they could be analyzed to learn about the capabilities of threat actors and possibly identify other targets. He said: “I am really going from door to door begging for samples. There is too little information sharing on threats.”110 106 Interview S10, January 2019. 107 Interview S3, October 2018. 108 Interview E10, January 2019. 109 Interview I13, February 2019. 110 Interview I1, November 2018. 31