Meeting communities where they are — the increasing preference of messaging apps
By John Warnes, Innovation Officer
Engaging with communities through their preferred channels is something frequent readers will have read countless times on the pages of UNHCR Innovation Service’s web portal. But how can this work in practice when such channels are increasingly digital, and when utilising these platforms is complicated and fraught with different types of risk? In this post, we unpack parts of the journey we have gone through in understanding this challenge. We focus on a new pilot that UNHCR is undertaking to engage with communities through WhatsApp, an increasingly preferred channel of communication for refugees. We also illustrate how UNHCR has paid strong attention to data protection issues, and put measures in place to ensure we are engaging through these channels responsibly.
“Key characteristics of feedback and response systems include multiple communication channels tailored to the different needs and capacities of persons of concern, including, for example, children, older persons, and persons with disabilities. Such channels can take the form of face-to-face communications, help desks, call centres, dedicated e-mail accounts, two-way SMS systems, and social media.”
-UNHCR’s Age, Gender and Diversity policy
UNHCR is committed to putting people at the centre of its humanitarian response. As part of this, the organisation takes measures to ensure that it is accountable to those affected in terms of the quality and nature of the assistance provided. Building off UNHCR’s commitments within the Grand Bargain, UNHCR’s Age, Gender and Diversity policy outlines how the organization seeks to achieve this, detailing approaches in a number of areas — including how UNHCR communicates with communities.
This has been an area of focus for UNHCR’s Innovation Service for a number of years. Through our Communicating with Communities web portal, the Service has sought to build up a repertoire of effective approaches. The Service has developed these out of emerging practices from country teams as well as new solutions tested by the Service itself. From this, the Service has built up a range of guidance and tools that can help these very teams achieve their goals and operationalize our Age, Gender and Diversity policy.
The Service has dug deep into understanding more about communities’ preferences with regards to communication channels, and specifically how to adapt to more omnichannel approaches — using a number of different communication channels to give users choice. This is important as diverse communities increasingly wish to use a variety of channels to access information and engage with UNHCR.
As part of this, the Service built tools to help understand communities’ information and communication needs, including their preferred communication channels. Many of the assessments frequently demonstrate that social media and messaging apps — more often than not WhatsApp, context depending — are preferred channels for communities.
The findings further state that these tools are not only used as the preferred channels for people to communicate with each other and find out information, but for engaging with the humanitarian community to learn more about the services available to them.
How humanitarian organizations are adapting: the elusive centre ground
For many humanitarian organizations the response to these findings has been marked by two extremes. On the one hand, quick solutions are put together to respond to immediate needs, recognising community preferences and the importance of swift action. On the other hand, identifying unintended consequences and understanding risks often take time and require careful consideration of mitigation strategies.
Teams facing these challenges generally find themselves in unexplored territory within their organization, with limited material in both theory or practice to guide them. Could establishing such a channel create broader problems or unidentified risk? In absence of guidance, the response has often been either inertia (taking significant time to understand complexities) or action (to meet immediate needs), but rarely in the middle ground between the two.
To break this down, a number of humanitarian organizations have started to move beyond ad-hoc, reactive responses to more intentional approaches that put them on firmer footing. Firstly, some are eager to move forward in engaging communities where they are; they seek to use messaging applications as a channel for engaging with affected people. This often means building on the success of utilising SMS for humanitarian interventions, and adapting to new forms of communication taking place through messaging app platforms, specifically those that use end-to-end encryption that are an order of magnitude safer. For example, UNICEF has added services such as WhatsApp and Facebook Messenger to their U-Report platform, which is aimed at building a feedback channel for young people across a range of social issues.
Similarly, through their Signpost platform, the International Rescue Committee (IRC) has set up a WhatsApp service for communities in El Salvador. More about the approach they’ve taken, and how the service is playing a critical role in IRC’s COVID-19 response is available through this explanatory post. There are also other services that have been set up, including some by UNHCR in different country contexts, for example in Ecuador where usage of the WhatsApp service significantly increased during COVID-19.
In all of these examples, organizations often take advantage of automated responses — simple ‘chatbots’ to eliminate the need for extensive human follow-up (although IRC have a specific function to enable engagement with a human operator).
In the cases that UNHCR has examined while researching the issue, it is often difficult for users or other practitioners interested in the service to easily find information relating to the platform and how it is set up. This information is often not front and centre, if available at all. While there’s often no obligation of transparency in all of these areas, this is something most users of these services like to see and it has been demonstrated to build trust. As such, humanitarian organizations would be well-minded to make a concerted effort to make such information available, understandable and accessible.
Specifically, across the majority of examples to date where messaging apps have been used to support community engagement in humanitarian settings, issues relating to privacy and data protection have not been tackled extensively. It is very difficult to access information either within the service itself or on associated web platforms (UNICEF do have a short privacy policy on their web page, for example).
Ultimately, it is in this arena that humanitarian organizations need to tread with caution. Our experience within UNHCR’s Innovation Service has shown us that, in most cases, the challenges with setting up services through messaging platforms are not primarily technological or administrative. There are plenty of companies and even re-sellers who can get this up and running very quickly. Rather, the issues lie in humanitarian principles, protection in the digital age, and data rights, and how these can be upheld when working with non-humanitarian actors. At worst, these issues are simply not considered, and at best, they are theory and rhetoric that have yet to be fully tested in practice.
Do no digital harm
Acknowledging this deficit, a counter-narrative has developed aiming to address this imbalance, focussing on ‘doing no digital harm’, and risk prevention and mitigation. Digital rights advocates and activists are increasingly wary of social media platforms and messaging applications, vigorously encouraging the use of privacy-centric products and services. This skepticism is beginning to manifest itself in robust discussions around everything from biometrics to the application of data protection legislation such as GDPR, to emphasising issues relating to rumour and misinformation.
The safety and security of refugees in a digital and connected environment is an issue that warrants much more attention than it currently gets (UNHCR has an open challenge to support teams addressing such issues). While there is a general acknowledgement of community preference for using certain messaging applications, these advocates sometimes recommend humanitarian organizations encourage communities to leave their preferred channels in favour of something arguably safer. This is a non-starter, and comes with a degree of paternalism that isn’t conceptually coherent with our goals as a rights-based organization. It sometimes feels that the pendulum has swung too far the other way. Humanitarian organisations are not here to tell crisis-affected people which apps to use, rather to inform and present all the options for them to make their own decisions, being as transparent and clear about risks as possible.
So, where to go from this current state of affairs? It is imperative that humanitarian organizations move beyond a knee-jerk reaction and develop strong approaches that are more institutional in nature, and grounded in humanitarian principles and protection for the benefit of the communities using such services.
Is there a middle ground where humanitarian organizations can meet communities on the channels they would like — and expect — us to be on, while responsibly maintaining the highest standards of data rights and security?
“Deploying a less popular communication platform may exclude the people the organization is seeking to help.”
-ICRC Data Protection Handbook Second Revision, p189.
The ICRC and Privacy International collaborated on a report — ‘the humanitarian metadata problem’ — “Doing no harm” in the digital era that aimed to provide more tangible ways forward for humanitarian organizations. This report, to which UNHCR contributed, aimed to capture a broader portfolio of risk than had previously been considered by humanitarian actors. It examined pursuing data flows and unpacking all of the different elements within the landscape to lift the lid on overlooked risks, more often than not linked to the use of metadata.
Similarly, the latest revision of the ICRC Data Protection Handbook and their publication “Humanitarian Futures for Messaging Apps” (where UNHCR also closely collaborated with the ICRC) highlight critical data protection risks that may manifest when crisis-affected communities use such platforms, alongside considerations for humanitarian responders to manage and mitigate these risks. While the handbook unpacks risk from primarily a data protection perspective, the recommendations in the messaging apps report are practically focussed and can help organizations such as UNHCR deliver these types of initiatives responsibly. The report does not dissuade humanitarian actors from engaging through such platforms, but rather presents key considerations for organizations to be able to utilise them responsibly.
UNHCR’s Innovation Service has started to explore such issues with a review of the academic and grey literature relating to the online safety of forcibly displaced persons and how access to connectivity and the plethora of digital services that come with it may impact their protection risk profile. This will soon be complemented by another report focussing on these issues, based on primary research undertaken with communities in Uganda and Kenya.
All things considered, when a humanitarian organization looks at the level of complexity within this landscape, and opens what might not be too far-fetched to say a pandora’s box of risk, it’s easy to conceive that they might be put off or even fearful of utilising such channels for engaging community members. To this end, UNHCR wanted to move forward from the analysis and recommendations provided in these reports, and work out how the agency could practically use messaging apps — specifically WhatsApp, owned by Facebook — to engage with communities in the most responsible way possible.
Bring on the API: A pilot with Turn.io
As UNHCR began to respond to the COVID-19 crisis, a number of teams in the field — as well as the Innovation Service and the Digital Engagement Section within UNHCR’s Division of External Relations (and guardians of UNHCR’s help.unhcr.org platform) — were looking at the potential that messaging apps provide in engaging with communities at times of physical distancing. Offices needed to engage with communities to provide critical life-saving information, link to online services, create spaces for feedback and referral to other service providers. Messaging apps inherently have more flexibility and greater functionality than platforms such as SMS for engaging communities and are becoming increasingly prevalent in countries where Internet connectivity is available and refugees and forcibly displaced populations have access to the network and to smartphones.
Furthermore, security features such as end-to-end encryption are becoming more commonplace in messaging apps; these are vital when dealing with sensitive issues and provide an additional level of security. As such, UNHCR set out to build on existing initiatives, noting that UNHCR was yet to leverage the WhatsApp Business API — a tool that allows other software applications to interface with WhatsApp –anywhere in the agency, and trial a more systematic and scalable approach for engaging with communities through WhatsApp through a pilot project covering 4 countries, starting with Ecuador.
To make use of this API, there was a great deal of procurement, legal, data protection, IT and community-based protection work that was required to move from the idea phase to a soft-launch of the service. Rather than detail each specific step, here is a snapshot of 5 key areas that required careful consideration in the design of the pilot:
1- Finding the right technology partner for UNHCR. For this pilot, it was Praekelt.
The Service recognised that finding the right technology partner was critical to the pilot’s success. For medium and large organizations to engage systematically with communities, WhatsApp offers its WhatsApp Business API service through specific business solutions providers (BSPs). There is no shortage of great companies offering these services, but for this project UNHCR decided to build off an existing relationship with South African technology non-profit and public benefit corporation Praekelt.
Praekelt recently became a verified BSP of WhatsApp and it has a software application called Turn.io that supports organizations to engage with their communities through WhatsApp. With a focus on non-profit organizations, a track record of strong community engagement and, in particular, the impressive implementation of the COVID-19 Health Alert with various governments and the WHO, UNHCR believed that working with a smaller vendor provided greater flexibility and helped the agency implement a ‘privacy by design’ setup.
To this end, Turn.io has gone the extra mile to ensure that the system design is minimising the amount of personal data captured. UNHCR is able to utilise its own private cloud hosting to run the Turn application (under our framework contract with our hosting provider), with specific contractual clauses to ensure the security of the systems and recognising UNHCR’s privileges and immunities as a United Nations agency).
As UNHCR explored potential vendors, many of WhatsApp’s BSPs did not provide solutions that operate in a private cloud. Working with Praekelt allowed us to collectively determine the most secure option, which would also fulfil Praekelt’s obligations to WhatsApp as a BSP. The Turn.io platform is also packed full of great, ever-expanding features. Needless to say that everyone in the UNHCR team who was on the demos was impressed with the potential of the application.
2- Taking Data Protection seriously.
UNHCR has a comprehensive Data Protection Policy that guides teams in developing solutions that protect the personal data of persons of concern. As such, for this pilot, UNHCR opted to take a three-pronged approach to unpacking data protection issues. Firstly, the UNHCR team and Turn.io would design a system with ‘privacy by design’ in mind, and map the data flows of such a system so as to minimise the amount of personal data collected, stored or processed by either UNHCR or Turn.io, also taking any other third parties out of the loop.
Of course, with such a system, the nature of usage can differ depending on context. As such UNHCR didn’t want to pursue a generic high level Data Protection Impact Assessment (DPIA) straight away (also, for a pilot this might not be cost proportional) –rather the agency sought to look at specific country level implementation and undertake an analysis unique to each pilot country. Secondly, these would manifest in local ‘rapid’ Data Protection Impact Assessments that are signed off by the data controller in the respective UNHCR country operation. The Service soon realised they are not that rapid, and with over 20 pages of analysis per country, a thorough analysis of the potential risks was documented.
The last of the three prongs demonstrates that this is not a one-off exercise. UNHCR is not only undertaking rapid DPIAs at country level, but will also be contracting independent expertise to assess and analyse both the approach and implementation of the service over a set period of time as the pilot progresses. The idea is to generate learning around data protection risks relating to operational usage of messaging apps that will inform if and how such approaches should scale within the agency.
3- Weighing up risk holistically.
For this pilot, UNHCR has adopted as broad an approach as possible in determining user risk profiles and weighing up inherent data protection risks alongside broader protection risks communities would face. These could be due to a lack of information on support options, limited access to UNHCR or misinformation through online platforms as a result of a lack of trusted humanitarian presence on such channels. UNHCR country operations have held numerous discussions, and also linked up with teams in HQ and Praekelt to discuss and analyse different types of risks, as well as service features that aim to manage risk — for example, the ‘verified’ green tick, that allows users know who they’re really talking to.
In all cases, those who are closest to these communities are making the final determination about if and how to proceed, and to manage the risk accordingly. In all the pilot cases, the country operations believe that the opportunities presented through messaging apps — when designed and implemented correctly –outweigh the risks, from a data protection perspective. This is something that will be regularly reviewed and followed up on as part of the pilot, as, of course, these risks are not static.
4- Focus on building a meaningful service.
It’s not about spamming communities, but rather creating meaningful exchanges led by communities that, over time, contribute to building trust. In order to achieve this, UNHCR has and will continue to take a human-centred design approach in designing the service, and engaging with communities to test features and functionality, iterating as things move forward. UNHCR identified community members in each country context to make the service better, engaging participants with diverse characteristics so as to not marginalise based on age, gender, or other characteristics that may impact access to digital tools and literacy.
UNHCR is undertaking moderated user testing to develop deeper insights into what works and what might be missing from the services throughout the pilot. For example, in Ecuador significant socially distanced user-testing has taken place (see above image) to refine and improve the service. On engagement with communities itself, WhatsApp by default limits the outbound messages that can be sent — a welcome change from historical approaches to “bulk messaging” that are quite clearly less focussed on building two-way engagement. UNHCR is, however, keeping the services relatively basic from the outset, as more complex integrations to enhance service delivery require careful planning and come with extra data protection considerations.
5- Being open and straightforward with communities.
UNHCR believes that it’s important to be completely transparent with communities. In designing the services, UNHCR spent a lot of time trying to get the privacy policy right. These policies are usually glossed over by service users. We wanted to avoid this by making sure it wasn’t full of jargon and instead feature simple and accessible terminology in the relevant languages. The privacy policy is presented to users as they start to use the service, along with other information that they’ll agree to before they start using the platform and UNHCR processes their data. Of course, all the users have the right to opt-out, remove themselves from the service, and request the deletion of their data at any stage.
Understanding risk, one step at a time
As the pilot moves forward, UNHCR will continue to engage with users of the service to understand to what extent it’s meeting its primary objective of providing meaningful life-saving information. In addition, we will continue to assess levels of trust in the service and UNHCR’s data protection approach as well as building out approaches that support those without access to such platforms, and undertaking interventions to enhance the digital inclusion of communities more broadly.
As we’ve moved through the pilot, we’ve heard some commentators making statements like ‘Why don’t you use X platform which is more secure?’. While there is some merit to understanding the features and functionalities of different platforms, humanitarian organizations should adapt to what our persons of concern are utilising as far as possible, rather than push them into using any particular platform or service. It’s their choice. Where such security is paramount, and this would depend on the type of engagement and local context, UNHCR will operate alternative channels both online and offline to ensure that we’re minimising risks to the extent possible.
Of course, as with all of these approaches, it is impossible to eliminate risk entirely. UNHCR’s Data Protection Office provides comprehensive templates for Data Protection Impact Assessments to country teams and provides resources to help understand, minimise and mitigate risks. These resources help those at country level who are closest to the communities to make our engagement with them safer.
Finally, this is just the tip of the iceberg. There are plenty of tough challenges that require attention. From making such services equitably available across different ages, genders and diverse groups, such as people with disabilities, to broader challenges of digital inclusion and connectivity in challenging rural environments, all these components impact the efficacy of solutions.
UNHCR is active across these areas, through its Connectivity for Refugees initiative, aiming to ensure digital inclusion for all, and our community-based protection activities that support UNHCR’s accountability to affected populations commitments. These accordingly ensure that there are multiple channels in which communities can effectively access such information and engage with UNHCR.
