With ‘Cyber Collective,’ BIPOC Women Educate On Digital Data Privacy And Ethics

As a security specialist in the cybersecurity industry, Tazin Khan Norelius noticed several troubling trends. 

For starters, while advancing in her career, she saw inequality and a lack of representation for minorities and women. This raised red flags for Khan Norelius, because, in her mind, this was an industry tasked with protecting all consumers online. It wasn’t just that, though; she also saw coworkers, friends, and family unaware of internet dangers and their privacy rights. 

Khan Norelius eventually voiced her ethical privacy concerns to the companies she worked for. Those concerns, she says, went unanswered.

So, in 2019, she took matters into her own hands, virtually launching two events to educate the public about cybersecurity concerns. 

“It was hard, because I was by myself, doing it alone,” Khan Norelius explained.

Fast forward to the summer of 2020. During the heat of the Black Lives Matter protests in the wake of George Floyd’s murder, Khan Norelius found herself worried once again. She was specifically concerned about the protestors around the country, who she believed were in danger, not realizing they could be tracked by law enforcement with their smartphones. 

But this time, she found other women online with like-minded worries — women like Caroline Hsu, Fara Islam, Rebecca Richard, and Vanessa Miranda, all with cybersecurity, ethics, privacy, and public policy backgrounds.

The five women, who live in various cities across the United States and range in ages from 21 to 30, jumped on a call to discuss what could be done. 

What they came up with is called Cyber Collective. It’s the only women of color owned and operated community-centered research organization that focuses on data ethics, privacy, and cyber security research. They host events for the public to teach and help them understand the ways data and privacy impact consumers, particularly consumers from marginalized communities. Cyber Collective works to center marginalized voices in the data ethics dialogue, assess their knowledge, and then gather their input to influence change. They also advocate for legislation to protect consumers.

In October of 2020, they officially launched, nicknaming the organization CyCo, with Khan Norelius as the founder and CEO. 

“Tech research is done, but it’s so data centric, it’s so numbers oriented, and they leave out the fact that data is human based, and where do narratives come into play with how this technology can affect us?” Khan Norelius said. 

“What we strive to do is put together research sessions and events where people can attend. We teach them a topic of some sort. We educate them, and then we assess the retention of that topic. We give a series of polls and surveys during the session as well. And then we switch into what we call our analysis part, and we allow people to take the information that they’re learning, and give their opinions and how it affects them.”

The research sessions or educational workshop events that Cyber Collective has hosted focus on a range of topics from data privacy, algorithms, and technology that harms marginalized groups, what apps have access to a person’s private data, and what data apps are giving away. The events feature industry thought leaders, domain experts, creatives and entrepreneurs, to educate consumers on their lack of data ownership and encouragement to practice mindfulness in cybersecurity. The data and research obtained is then posted on their website.

“The technologies that exist in today’s world operate so quickly, and there’s often a disproportionate impact on marginalized communities,” Hsu, the head of ethics for Cyber Collective, said. 

“People of color, Black and brown communities, women, queer folks, disabled folks— these are the people whose voices are so badly needed in the discourse around data ethics and privacy, but they’re historically just not given a seat at the table.”

Currently, there is no single law regulating digital privacy in the United States. Instead, there is a patchwork of federal and state laws that can apply. Some of the more comprehensive state laws include the California Consumer Protection Act (CCPA) and the recently approved California Privacy Rights Act (CPRA.) In March of 2021, Virginia became the second state to enact sweeping digital data protection legislation called the Consumer Data Protection Act (VCDPA) that will come into effect on January 1, 2023. According to TechRepublic, a group of IT professionals and journalists covering the tech market, VCDPA incorporates many concepts of the CCPA and CPRA, including allowing consumers to access, delete, and stop the sale of their personal information. Companies will also need consumer permission before collecting, using, or disclosing sensitive information. However, they continue, there are a few notable differences, including the lack of “private action,” meaning ordinary “people cannot sue companies for making money off of their data.” 

In January, Cyber Collective started a federal petition with the data privacy company, Elroi to demand the U.S. government start working on new national privacy laws. In the petition, they ask the government to create diverse and public subcommittees as part of the regulation drafting, conduct an annual review of regulation, require affirmative consent from individuals before processing their sensitive data, provide individuals the right to access, correct and delete personal data, among various other requests. 

“For the subcommittees, we want people with different backgrounds, and not just ethnic backgrounds but different domain expertise,” Khan Norelius said. “You know, a journalist could sit on this subcommittee. People that are doctors, lawyers, creative directors, or people in the entertainment industry because this impacts everyone, and having that diverse committee, and revisiting the accuracy of this legislation is something that we ask for as well.”

The women of Cyber Collective said through their workshops, they’ve seen changed behavior in their participants. Most of which, they say, are more mindful about what apps they download and what they agree to digitally. They hope that with their easily digestible workshops and research, they can influence consumers to protect themselves and lawmakers to create a policy with consumers in mind. 

“I think the immediate goal is to find a sustainable way to share information, reach communities, keep them informed, but not fearmonger them,” Khan Norelius said. “In the same light advocate for these people in the spaces where their voices are not heard.”

“And give ownership of our digital space back to people.”