WiP: A Qualitative Study of Service-Learning Oriented Cybersecurity Clinics' Processes and Challenges

Cybersecurity clinics, inspired by long-standing university clinics in fields like law and medicine, provide essential cybersecurity services to at-risk groups such as municipal governments and LGBTQ+ support organizations. These clinics aim to bridge this gap in cybersecurity expertise, which is often inaccessible to these groups. However, organizing and running these clinics can be challenging both technically and socially, as clinics have to balance student access to provide services with clinic privacy and autonomy, while also ensuring students are given practical learning experiences and clients are served in a way that respectful and empowering.

In this paper we present the results of initial interviews with clinic stakeholder groups (i.e., clinic leadership, clients, and student clinicians) from a single institution, the Tufts University Cybersecurity Clinic. In these interviews, we investigate each clinic experience and perceptions, as well as their relationships with other stakeholder groups. We apply a critical service learning lens when developing the interview and analyzing results. We found that while clients recognize their need for cybersecurity, logistical challenges, rather than technical ones, often limit the clinics' effectiveness. We also found that the concepts of critical service learning, though emphasized in the clinic's mission, are not always fully instilled in students in practice. This study's findings aim to inform the development of future cybersecurity clinics, ensuring they address both immediate cybersecurity needs and broader social justice issues.