  Existing end-to-end-encrypted (E2EE) email systems, mainly PGP, have long
been evaluated in controlled lab settings. While these studies have exposed
usability obstacles for the average user and offer design improvements, there
exist users with an immediate need for private communication, who must cope
with existing software and its limitations. We seek to understand whether
individuals motivated by concrete privacy threats, such as those vulnerable to
state surveillance, can overcome usability issues to adopt complex E2EE tools
for long-term use. We surveyed regional activists, as surveillance of social
movements is well-documented. Our study group includes individuals from 9
social movement groups in the US who had elected to participate in a workshop
on using Thunderbird+Enigmail for email encryption. These workshops tool place
prior to mid-2017, via a partnership with a non-profit which supports social
movement groups. Six to 40 months after their PGP email encryption training,
more than half of the study participants were continuing to use PGP email
encryption despite intervening widespread deployment of simple E2EE messaging
apps such as Signal. We study the interplay of usability with social factors
such as motivation and the risks that individuals undertake through their
activism. We find that while usability is an important factor, it is not enough
to explain long term use. For example, we find that riskiness of one's activism
is negatively correlated with long-term PGP use. This study represents the
first long-term study, and the first in-the-wild study, of PGP email encryption
adoption.
