Feminist digital forensics: A study and a proposal for development
As a feminist hacker organization, MariaLab questions how digital forensics can be used to address TFGBV cases, with the aim of developing feminist helplines through the systematization and improvement of consensual digital forensics.
Digital forensics became especially relevant for the team at MariaLab when they faced the challenges of creating Maria d’Ajuda, a feminist helpline to address digital security emergencies. Their work experience and interaction with other feminist helplines led them to identify a common problem: the limitation of resources – human, financial and technical knowledge – that often restricts helplines in supporting harm-reduction actions and digital care. This research report, Feminist digital forensics: A study and a proposal for development, unfolds their incursion into the field of digital forensics. Starting with the investigation of what they call traditional forensics, a technical field deeply connected to the criminal justice system, where forensic experts and other actors, such as lawyers and police officers, work together in legal investigations.
Their research questions inquired how forensic analysis can be a tool to advance the fight against technology-facilitated gender-based violence (TFGBV). They started with the hypothesis that improving their knowledge for the identification and collection of evidence for forensic analysis would improve their collective capacity to generate data about digital threats from an intersectional and feminist perspective. The central objective of this research is to boost the development of feminist helplines through the systematisation of information and the development of knowledge in digital forensics.
Methodology
Recognising that all knowledge is situated, the research sought methods to ensure that the ideas, data and experiences gathered in the research were not merely reflections of the individuals documenting them. Action research – a process of investigation that intentionally seeks to generate practical effects within the reality being studied – was the path they chose to adopt. This method dialogues closely with their interpretation of technology as knowledge organised around action.
For the development of the study, they dialogue mainly with two types of interlocutors: international organisations that respond to civil society security incidents, recognised as references in this field; and with feminist digital security helplines from Latin America, with whom we have already collaborated on prior projects and established a relationship of trust.
The initial phase of field exploration was conducted through interviews with representatives from seven expert organisations providing digital security support to civil society and human rights defenders. These interviews allowed them to map out the scope of work of these groups and their many changes in recent years. Other than that, the organisation’s direct participation in alliances and training processes was fundamental for outlining the state of the art in digital forensics for civil society. As the last methodological step, a three-day immersive in-person meeting with representatives from each feminist helpline participating in this project was held. Beyond a workshop on implementing forensic techniques in helplines’ routines, the meeting was a time of sharing and collaboration that resulted in rich discussions about what they aim to achieve by applying forensic analysis with a feminist care perspective.
Key findings
- The development of digital forensics in civil society is largely driven by the increase in surveillance technology cases used against human rights defenders – a context that is still largely defined by the Pegasus Project. In July 2021 the Pegasus Project – a collaborative investigation by 17 international media organisations – revealed a list of over 50,000 phone numbers potentially targeted for surveillance by NSO Group’s powerful malware. This highlights how most attacks remain invisible to victims, emphasising the need for systematic investigations.
- The growing impact of spyware and the need for advanced expertise have driven efforts to strengthen forensic capabilities within the D Digital Security Helpdesks for Civil Society (DSHCS) community.
- Amid the countless scandals and billions generated by the spyware industry, a parallel market is rapidly developing. Classified as stalkerware, this software category has surveillance capabilities but is routinely marketed to the public to facilitate intimate partner violence (IPV), abuse or harassment. While some companies claim legitimate uses like parent-child monitoring or employee control – still problematic though – these tools are commonly repurposed for online gender-based violence (OGBV).
- With most digital helplines focusing their support on human rights defenders and civil society organisations, TFGBV affecting those outside of these groups were not covered by them. The research argued that when examining the human rights landscape through a broader lens, it becomes evident that digital violations against socially marginalised groups also pose a significant human rights concern, even when the affected person does not belong to formally organised civil society structures.
- Feminist digital helplines play a fundamental role in providing direct assistance to victims of gender-based violence, racism and LGBTQIA+ phobia. They share a common political perspective that prioritises survivors' needs, collectivity, autonomy and intersectionality as fundamental elements for creating protection strategies that go beyond technical solutions. These security measures respond to a combination of subjectivity, co-responsibilities and mutual care.
- The research advocate for an approach that recognises the technical and political as inseparable dimensions in both the development of and lived experience with technologies. When applied to feminist helplines practices, this perspective reveals its transformative potential: technical excellence in forensic analysis is not only compatible with psychosocial care, but is strengthened when combined with it. In operational practice, this translates into methodologies that integrate investigative rigour with socio-political commitment, where detailed examination of digital evidence goes hand in hand with attention to the emotional and social impacts experienced by affected people. This breaks with the false dichotomy that opposes technical objectivity to the subjectivity of care, proposing instead a comprehensive model of action that recognises the complexity of TFGBV and of digital threats in general.
- A visual summary of their mutual support process and a proposal for integration with consensual forensics, named the Feminist Support Chain was developed at the end of the process, extending the research to a more practical document.