"The System Will Choose Security Over Humanity Every Time": Understanding Security and Privacy for U.S. Incarcerated Users

1. Problem Statement

The proliferation of digital devices (tablets, kiosks, media players) in U.S. prisons, primarily controlled by two monopolistic vendors (ViaPath and Securus), has created a complex security and privacy landscape for incarcerated individuals ("system-impacted people"). While these technologies offer potential benefits for education, legal access, and family communication, they introduce severe risks:

• Lack of Agency: Incarcerated users have no choice in providers, contracts, or device types.
• Consumer Protection Exclusion: These users are carved out of standard consumer protection laws.
• Surveillance and Censorship: Devices are used as tools for pervasive monitoring, often justified by vague "security" concerns that may be unsubstantiated.
• Downstream Harms: The current implementation strains relationships, hinders rehabilitation, creates financial burdens, and exacerbates the digital divide upon release.

The core problem is a misalignment of incentives: the system prioritizes institutional "security" (often based on flawed threat models) over the privacy, safety, and human rights of the end-users.

2. Methodology

The researchers employed a qualitative, human-centered approach to investigate the lived experiences of system-impacted people.

• Participants: 17 participants total, consisting of:
  • 12 formerly incarcerated individuals.
  • 5 family members/loved ones of currently or formerly incarcerated people.
  • Note: The study excluded currently incarcerated individuals to minimize risk, relying on proxies (former inmates and family) who had direct experience with the technology.
• Data Collection:
  • 4 Focus Groups (leveraging existing social networks for comfort).
  • 5 One-on-one interviews.
  • Sessions lasted ~1 hour, conducted in-person or remotely, with compensation provided.
• Recruitment: Partnered with advocacy organizations (e.g., for Black, Native American, and housing-insecure formerly incarcerated populations) and used snowball sampling.
• Analysis:
  • Positionality: The research team acknowledged their lack of personal incarceration experience but highlighted their long-term work with re-entry organizations.
  • Coding: Collaborative open coding followed by inductive thematic analysis.
  • Ethical Safeguards: Manual transcription (no third-party services), de-identification of all data, and member checking (participants reviewed the manuscript before submission).

3. Key Contributions & Conceptual Framework

The paper introduces a modified Alice and Bob communication model tailored to the carceral context to visualize the flow of information and power:

• Alice: The incarcerated user.
• Bob: The loved one outside.
• The Interceptor: Prison officials/staff who act as the "Man-in-the-Middle," exercising unilateral control over the channel.

Key Contributions:

1. Empirical Evidence of "Technology Stockholm Syndrome": Documenting how users feel powerless yet grateful for minimal access due to the lack of alternatives.
2. Critique of Threat Models: Revealing that prison staff often operate on "misguided mental models" regarding technology (e.g., fearing inmates will hack the internet or steal identities) which leads to disproportionate restrictions.
3. Downstream Impact Analysis: Moving beyond immediate privacy violations to show how surveillance affects post-release reintegration, mental health, and digital literacy.
4. Policy Recommendations: Proposing concrete steps for transparency, accountability, and public oversight of prison tech contracts.

4. Key Results & Findings

A. Direct Security and Privacy Experiences

• Overwhelming Censorship: Participants reported that "everything is monitored." Censorship extends to words, images, music, and educational materials.
• Involuntary Consent: Users have no option to opt-out; consent is implied by the desire to communicate.
• Technological Regression: Updates (e.g., JPay to Securus) often resulted in worse usability, increased censorship, and broken hardware (e.g., swelling batteries, cracked screens).
• Communication Delays: Messages are held in "mailrooms" for review, causing unpredictable delays. Users often do not know if a message was censored or simply lost.

B. The "Man-in-the-Middle" (Power Dynamics)

• Arbitrary Power: Officers have unilateral discretion to censor or revoke access based on personal whims or bias, with no recourse for the user.
• Flawed Threat Models: Staff often restrict access due to ignorance of how the technology actually works (e.g., believing inmates can hack secure platforms), leading to the removal of beneficial tools.
• Weaponization of Scarcity: Limited access to devices creates competition and conflict among inmates, which officers then use to justify increased security budgets and staffing.

C. Downstream Impacts

• Internalized Threats: Users develop self-censorship and paranoia ("panopticon effect") that persists after release, hindering their ability to use the internet freely.
• Erosion of Community: Censorship prevents intimate communication and legal collaboration (e.g., rejecting photos of legal documents).
• Rehabilitation Barriers: The lack of meaningful digital literacy training and the punitive nature of the tech prevent successful reentry.
• Financial Exploitation: High fees for messages, calls, and data, combined with "kickback" schemes, burden incarcerated individuals and their families.
• Apathy: Users feel defeated by the lack of accountability, leading to a resigned acceptance of the system's flaws.

5. Significance and Recommendations

Significance:
This study challenges the prevailing narrative that "security" in prisons is synonymous with "safety" for all stakeholders. It demonstrates that prioritizing institutional security often results in the violation of human rights, the degradation of mental health, and the creation of a "carceral web" that follows individuals post-release. It highlights a critical gap in security research: the need to include marginalized and vulnerable populations in threat modeling.

Recommendations:

1. Transparency and Accountability:
   • Prisoners must be notified when and why messages are censored.
   • Clear, non-arbitrary guidelines for disallowed language must be established.
   • Privacy Impact Assessments (PIAs) should be mandatory for prison tech contracts and made public.
2. Public Oversight:
   • Contracts between prisons and tech vendors should undergo a public comment period, specifically soliciting input from system-impacted communities.
3. Cost and Access Reform:
   • Technology should be free or heavily subsidized to prevent financial exploitation.
   • Digital opportunities must be paired with non-digital education to avoid fostering mere "consumerism."
4. Staff Education:
   • Correctional officers need training on actual technology capabilities to dispel myths and reduce fear-based restrictions.
5. Design Philosophy:
   • Future research and design must center the "end-user" (the incarcerated person) rather than the institution, recognizing that the carceral system itself is a source of trauma.

Conclusion:
The authors conclude that while technology can aid reentry, the current implementation in U.S. prisons serves as a tool of surveillance and control that ultimately harms the very people it claims to rehabilitate. The system consistently chooses "security" (as defined by the institution) over "humanity."