When preparing a security education session, it's crucial to know your audience. That's why we emphasize working closely with members of the community that you'll be teaching as you prepare for a session. Even still, don’t be surprised to find your audience isn’t exactly as you anticipated. There are many cultural variables that will stay unknown no matter how much research and preparation you do.
There's an inherent paradox in security education: every participant has a unique set of circumstances that will affect their particular threat profile, making generalization difficult and often dangerous. On the other hand, a certain degree of generalization about the audience is necessary and even useful: if each member of a group adopts a different solution for encrypted communications tailored to their own specific needs, then members of the group will still be unable to communicate securely with each other.
One way to help strike that balance between too much generalization and too little is to ensure that the generalizations you make are broad enough to include differences among participants that might not be immediately obvious to you. If you're leading a discussion about security practices with a group of ten people, you'd be wise to assume that at least one person in the room:
Being an inclusive trainer means more than simply allowing a diverse group to participate. It means catering to a wide spectrum of experiences and perspectives both in your teaching style and your tech recommendations, remembering that the diversity you can't see is just as important as the diversity you can.
There's an acronym that educational publishers use to help ensure that they don't accidentally use offensive images or examples in their textbooks: PARSNIP stands for politics, alcohol, religion, sex, narcotics, ideologies, and pigs.
It's good to use PARSNIP when putting together your slides or planning discussions and activities: if you want a photograph of a person eating breakfast, choose one featuring a nice, healthy fruit instead of bacon. When writing characters in security scenarios, aim for a good mix of "he," "she," and "they." Measures like these aren't about censoring yourself or trying to suppress your training style. They're about expanding your training style to reach more people, and making sure that small details don't get in the way of the material you're teaching.
On the other hand, discussions of digital security practices often directly touch on issues like politics, religion, sex, narcotics, and ideologies. After all, these are often the very issues that can endanger people in a surveillance state. Participants should feel welcome and safe in discussing their own specific threats at whatever level of specificity they feel comfortable with. Take care not to shut down a participant's story or force them to silence themselves. That can signal to participants that their needs are less important than those of other participants.
Think of how many different people might recognize their own threats in Bit's story: people afraid of their spouses installing spyware on their phones, survivors of sexual abuse, LGBTQ teenagers who haven't come out to their parents. By telling a friendly story, you speak to those threat profiles in a way that won't put off participants. More importantly, participants may feel more comfortable talking and asking questions about Bit's situation with less fear of exposing private details about their own lives. Similarly, bringing home a handout about Bit won't raise the same level of suspicion as bringing home a pamphlet for victims of abuse.
By using abstract examples like Bit, we’re able to talk about sensitive issues in a way that keeps participants feeling safe and welcome. At the same time, participants can identify with those examples with less fear of endangering themselves in the process.
