Data Sharing in Humanitarian Cash and Voucher Assistance (CVA): A look at risks, threats and mitigation technologies

This research, conducted by The Engine Room between March and October 2023, was commissioned by the Norwegian Refugee Council in collaboration with the DIGID consortium to map risks and threats related to data sharing in CVA, and to evaluate potential technological approaches that might mitigate these risks. The research forms part of a broader initiative focused on interoperability and data sharing in the humanitarian sector.

This report aims to support decision-makers involved in considering, evaluating or building new technological approaches to data sharing in CVA. It should however, be of interest to many others working in humanitarian CVA, as it covers important topics that are relevant to anyone who handles data in the course of their humanitarian work. As such, we hope that it will find its way to a broader audience.

The research had two main aims:

1. Analyse risks and threats related to data sharing in CVA, taking into account a landscape scan conducted by the DIGID consortium that identified key use cases.
2. Evaluate potential technologies for mitigating these risks, as identified by interviewees as well as by parallel research commissioned by DIGID consortium and conducted by Caribou Digital.

Risk, however, tends to be highly context-specific: risk assessments and threat modelling are usually applied to specific systems and contexts, whether projected or actual. As humanitarian CVA contexts are complex and varied, and the data-sharing use cases that were the starting point for this research were fairly generalised, there were natural limitations to the kind of risk and threat analysis that could be done.

With this in mind, the research surfaced a set of key risk areas to consider when looking at data sharing in CVA. These can be used to inform data-related safety by design in subsequent work, and to guide risk and threat analysis in more contextually-specific scenarios.

In aiming to evaluate how well a set of identified technological approaches might be able to mitigate these risks, similar limitations arose. Data protection and security involve many factors, and technical tools and protocols are just one part of the overall ecosystem. How well or how little a technical system protects data will depend on the details of the full ecosystem and the context the technology operates within, as well as the finer details of how it is set up and deployed, how well it can be maintained, and so on.

Here, too, this report offers guidance for future, more context-specific work by offering decisionmakers an overview and explanation of some of the mitigation technologies that surfaced, and by presenting key questions that should be asked in the context of specific deployments.

These are designed to support decision-makers to better understand and determine how much protection that technology is likely to be able to provide in a given context – or whether it’s even feasible to deploy in the first place. (It should be noted here that technical security expertise will still likely be needed for this kind of contextual evaluation).