Convincing human rights defenders, journalists, and others to sit through yet another session on digital security is an uphill battle. Competing priorities, limited resources, and limited bandwidth make it challenging for these communities to commit to training and other support mechanisms which often feel disconnected from their day-to-day work, and more like a burden than a value-add. Fatigue from traditional training is rapidly growing, with participants struggling to move from abstract concepts to concrete actions which can be easily integrated into their regular workflows.

Many people fail to prioritize digital security until they are faced with a specific incident or threat. But responding to an incident (rather than preparing in advance or even preventing an incident) places folks in a more vulnerable position as they must balance the emotional and psychosocial impacts of being compromised while also mitigating any damage caused by the incident—two tasks which can be daunting and require significant effort. For example, being detained and confronted by an authority while attending or covering a protest can elicit a range of emotions, some of which may cloud your typically sound judgment. Simulating such scenarios and practicing digital security behaviors in high-stress situations can help participants better understand those emotional responses and how they may impact their ability to respond in the real world. 

As a team that supports digital security interventions around the world, Internews’ Internet Freedom & Resilience team set out to further explore these challenges and identify creative solutions to continue to support at-risk communities. This led to a four-plus year journey of learning and adaptation. Our hope is that sharing this process and the resources we developed will help others who conduct or fund training, particularly in the Internet Freedom community.

The Early Stages of Exploration

Initial consultations with other digital security organizations and with at-risk communities quickly revealed that it was time to rethink our traditional training methods and revolutionize the way we engage with training participants. While there is value in theoretical trainings or tool-specific walkthroughs, we realized that these training sessions were falling short in terms of helping participants contextualize the security advice and make concrete changes within their workflows.

The first step in this process was to better understand the specific workflows of individuals, organizations, and communities. From the tools they use to the ways in which they communicate to the tasks they aim to complete individually or collectively, documenting these intricacies was essential. Much of this mapping took place during initial needs assessments or threat modeling exercises as we were first engaging with a community or cohort of training participants.

Personas, organizational archetypes, and adversary archetypes became useful resources in this process. These structured templates allowed us to strategically gather this information from training participants, while also pushing them to consider not only their current threat models, but also potential future threat models based on evolving adversarial capabilities.

Ultimately, knowing that our goal was to better account for context in training while also providing a safe space to practice skills and behaviors in everyday workflows, scenario-based methods seemed like a natural fit.

Selecting Scenario-Based Training Methods

The 70-20-10 Model for Learning and Development is a widely accepted model in training communities, suggesting that 70% of the information relevant to an individual’s behavior is obtained through hands-on learning experiences, 20% through engagement with others, and 10% through formal education. Utilizing scenarios within training provides that hands-on, immersive experience, while also maintaining the safety of participants given the controlled environment.

The goal of scenario-based training is to create safe spaces for participants to interactively explore advanced threats and practice implementingmitigation tactics within regular workflows through simulated experiences based on real-world examples which are likely to happen. Scenarios allow participants to visualize, experience, feel and understand threats—better preparing them for the psychosocial impacts of experiencing a real threat in the future. Scenario-based training also serves to stimulate critical discussion around digital security issues, leading participants to engage with the concepts on a deeper level.

Given the many different types of scenario-based training techniques, we considered several factors when selecting the three models we piloted. We wanted to prioritize interactivity, ensure that the methods were cost-effective and scalable, and also choose methods that would be appealing/enticing for training participants who may be experiencing training fatigue.

This led us to develop three scenario-based training models, all of which were tailored to and deployed with journalist communities in Central and Southeastern Europe:

• An interactive VR (virtual reality) experience which allows journalists to practice making critical decisions which impact their digital security and to safely experience the sensation of sustaining an attack. Internews partnered with Head Set to develop this scene and design a training of trainers curriculum for those interested in facilitating the VR scene.
• Table-top exercises in which participants discuss key digital security dilemmas and look at their organization or community’s readiness to respond to incidents. The templates developed allow for new exercises exploring different themes to be easily developed, adapted, or localized.
•  A technical simulation using canary tokens which guides participants on how to safely open documents from potentially suspicious sources.

Deploying Scenario-Based Trainings

Since the initial goal was to create training methods which were easy to replicate and deploy at-scale, our deployment model centered around training others on how to use the resources and methodologies. This specific pilot took place within our Journalist Security Fellowship, which you can read about here. Through this program, 35 journalists from Central and Southeastern Europe serving as digital security ambassadors received training on how to plan and facilitate scenario-based trainings.

These ambassadors, with support from Internews, organized and facilitated 56 scenario-based trainings within their local communities, reaching nearly 500 journalists and journalism students. These trainings included tabletop exercises, the technical simulation, and the VR training, and covered a wide range of topics: account security, data security and encryption, threat modeling, device security, secure messaging, travel security, etc.

For maximum efficacy, scenario-based trainings were designed with clear learning objectives (for example, specific behaviors that participants were meant to adopt) and used as supplements to more traditional training methods (such as topic-specific trainings and tool walkthroughs). This combination of traditional training methods and scenario-based training methods proved most effective when focused on longer-term adoption of security practices.

The Results

This pilot spanned across four years, with Internews developing and testing these innovative scenario-based training methods on the ground. The outcomes and feedback resulting from this pilot testing have been largely positive.

Internews deployed several levels of monitoring and evaluation to measure the effectiveness of this new approach to training. Quantitative and qualitative data was gathered throughout the project by the project team directly and a final external evaluation provided further evidence. This section briefly summarizes the findings from all M&E efforts.

Overwhelmingly, participants preferred scenario-based training methods to traditional methods. Participants found these new training methods more engaging and noted that they provided a deeper understanding of the topic. Scenario-based trainings were effective in capturing attention and recruiting participants for digital security training, which is otherwise considered a less appealing topic.

“Scenario-based training is an excellent tool for engaging and capturing attention. Scenario-based training is also a powerful tool for advocating for digital security. It has prepared me to act as a trainer for my local community.”

– Journalist Digital Security Ambassador Leading Scenario-Based Trainings

Notably, scenario-based trainings also helped participants apply theoretical knowledge to real-world situations, enhancing their understanding and skills, and ultimately further enabling them to implement learnings into their workflows. 95% of participants who responded to post training surveys reported improvements in digital safety practices after the training. These practices included downloading and using encrypted messenger applications, setting disappearing messages, anonymizing contacts on devices, encrypting hard drives, setting strong passwords, and many others.

“VR worked great […]. It was very exciting and useful. Because usually you are only talking, listening to presentations. It is sometimes hard to relate to risks. And SBT brings it closer to participants. First, I was a bit skeptical, because I am a gamer, familiar with such tools. But when I came back to my country and gave VR to trainees, the experience and feedback was amazing. I was genuinely surprised by the effect of it.”

– Journalist Digital Security Ambassador Leading Scenario-Based Trainings

The positive feedback and outcomes from this pilot are already informing how Internews’ Internet Freedom & Resilience team designs future digital security engagements, with a significant focus on immersive, experiential learning approaches. Many of the methodologies developed and used in this pilot are already publicly available under a CC-BY-SA 4.0 license (with the exception of the VR scene which requires a license in addition to the head set). Resources are available on Internews’ website, and the tabletop exercise templates and resources are also available on the LevelUp site. Moving forward, we plan to publish further lessons learned as we continue to deploy and iterate on these methods. If you have any questions about our process or resources, or would like support integrating them into your own trainings, please contact our team at [email protected] and [email protected].