What is a Good Secure Messaging Tool? The EFF Secure Messaging Scorecard and the Shaping of Digital (Usable) Security

Abstract

In today's diverse and crowded landscape of messaging systems, what are the most secure and usable tools? The Electronic Frontier Foundation (EFF), a digital rights group based in San Francisco, CA, has been considering this question for a long time. Their most prominent initiative in this regard has been the 2014 release of the Secure Messaging Scorecard (SMS), a 7-criteria evaluation of `usable security' in messaging systems. While the 2014 version of the SMS (now 1.0) displays a number of apparently straightforward criteria, a first look into the backstage shows that the selection and formulation of these criteria has been anything but linear, something that has been made particularly evident by the EFF's recent move to renew and update the SMS. Indeed, in a digital world where the words security and privacy are constantly mobilized with several different meanings, it seems relevant to analyse the SMS's first release, and the subsequent discussions and renegotiations of it, as processes that co-produce particular definitions of security, of defence against surveillance, and of privacy protection. This article argues that, by means of the SMS negotiations around the categories that are meaningful to qualify and define encryption, the EFF is in fact contributing to the shaping of what makes a `good' secure messaging application, and what constitutes a `good' categorization system to assess (usable) security, able to take into account all the `relevant' aspects - not only technical but social and economic.