The Weaponization of Data

Summary

Podcast Summary: Smart Women, Smart Power

Episode Title: The Weaponization of Data
Host: Dr. Kathleen McInnis, CSIS
Guest: Pavlina Pavlova, ShareThemikEnCyber Fellow, New America Foundation, and Cybercrime Expert, United Nations Office of Drugs and Crime
Release Date: January 31, 2025

---

Episode Overview

In this insightful episode, Dr. Kathleen McInnis speaks with Pavlina Pavlova about the growing weaponization of data—particularly how cyber threats and data breaches disproportionately impact women. Drawing on Pavlova’s recent research and professional experiences in cybersecurity and international policy, the discussion dives deep into gendered data harms, illustrative real-world incidents, and policy responses needed to protect vulnerable populations.

---

Key Discussion Points and Insights

Pavlina Pavlova’s Background and Path to Cybersecurity

• Pavlina describes being shaped by political transformation in Slovakia during her youth, which inspired her interest in international relations and the rule of law.

  "Growing up I was very much influenced by political shifts in my home country, Slovakia...I just saw how much depends on the rule of law, on strong democratic institutions." (01:21)

• Her professional journey led her from studying geopolitics in Prague and Leuven to opportunities at the European Parliament, where she engaged with legislation on network and information security.
  • Entry was via internships, then progressed into more substantial roles. (02:53)

The Weaponization of Data: Gendered Harm Online

• Pavlova’s research, “Gender Impacts Data Weaponization,” exposed alarming trends, including the rise of sexualized deepfakes and online gendered attacks.

  "These threats are very much connected. They are connected to data breaches. They are connected to a set of online but also offline contextual threats." (03:36)

• She underscores the problem’s scale: attacks on women aren’t incidental but structurally embedded in both targeted data breaches and disinformation campaigns.

Four Factors of Gendered Data Harm

• Pavlova outlines a framework for understanding gendered online harm, highlighting attacks that exploit:
  1. Gender-specific data
  2. Healthcare sector data
  3. Contextual vulnerabilities stemming from online/offline intersection
  4. The compounding effects of marginalization
     (05:06–05:38)
• The healthcare sector is especially vulnerable, with women’s medical data (such as reproductive health records) often exploited for targeted shaming or blackmail.

Case Study: Medibank Data Breach (Australia, 2022)

• Pavlova details the "emblematic" Medibank breach by the REvil ransomware group, which leaked customer data, including abortion-related medical information, after ransom demands were unmet.

  “A spreadsheet listing patients personal information alongside billing codes related to pregnancy terminations... calling it the naughty list.” (07:07)

• She highlights how these gendered breaches have devastating consequences for privacy, wellbeing, and access to services—especially in politically sensitive contexts. (08:00)

Gendered Disinformation & Deepfakes as Foreign Interference Tools

• Gendered attacks are systematically used to undermine women’s participation in public life, politics, and journalism.

  “Gender disinformation is a tool in the toolkit of foreign actors who try to disrupt elections and democratic institutions at large.” (08:17)

• Examples include sexualized deepfakes and orchestrated misogynist campaigns, which create psychological harm and drive women out of public spaces, worsening gender inequality both online and offline.

Policy Recommendations & Gaps

• Pavlova identifies a lack of data and recognition as the starting point for effective policy.

  "It starts from the evidence. It starts in believing that this issue is important." (10:34)

• She urges governments to:
  • Explicitly acknowledge gendered cyber harm
  • Invest in research and data collection
  • Empower impacted populations through testimony and lived experience
  • Develop methodologies to quantify harm and inform prevention strategies
    (10:34–12:16)
• Without this, cyber threats remain minimized as “annoyances” rather than tangible harm to individuals and national security.

What Individuals Can Do

• Practical cybersecurity tips for individuals:
  • Data minimization—be judicious in sharing personal information online
  • Adjust platform settings, especially location data
  • Enable multi-factor authentication
  • Stay vigilant about phishing and always patch devices/software (12:24)
• But, Pavlova emphasizes the limits of individual action given systemic vulnerabilities—e.g., mandatory data disclosure to hospitals, which can then be breached through no fault of the individual.

  “So much of this harm is outside of our realm of protection… so it's not just about our accounts and our digital security; it's about more systematic security in the systems and how they process data." (13:45)

Gender and Motivation in Research

• Being a woman in the field heightened Pavlova’s resolve and sensitivity to these issues. She notes broadening support from men and women in cybersecurity to address gendered digital threats.

  "It may start with women as the drivers for these issues, but it luckily does not stay with them." (14:54–15:52)

Defining Power

• On the meaning of “power”:

  "Power must be the ultimate catalyst. It means absolutely nothing without the action we use it for... Smart Power is so important. It's a call to use our power to our best ability and for wise impact." (16:08)

---

Notable Quotes & Memorable Moments

• On systemic impacts:

  “When it comes specifically to exploiting medical records, it can be sensitive for women because of gender specific information.” (06:18)

• On weaponized gender disinformation:

  “We are creating not only unsafe online spaces, but also unsafe offline spaces where women and their family members are threatened this way.” (09:48)

• On accountability:

  "There is still very little accountability if such, for example, data breaches happen. And also where to seek help, while it's improving the capacity for e.g. law enforcement to investigate and prosecute such crimes remains limited." (14:10)

---

Key Timestamps

• Pavlova’s origin story (01:21)
• Discussion of data weaponization and marginalized groups (03:36)
• Gendered harm: four factors explained (05:06–05:38)
• Medibank case study (07:07–08:00)
• Gendered disinformation and democracy (08:17–10:07)
• Policy recommendations (10:34–12:16)
• Cybersecurity tips for individuals (12:24–13:45)
• Gender’s role in research motivation (14:54–15:52)
• Definition of power (16:08)

---

Tone and Language

The conversation is direct, analytical, and empathetic, with both speakers emphasizing the urgency and real-world stakes of digital gender-based harms. The language is accessible, occasionally sobering—particularly when recounting case studies—but ultimately optimistic about the power of evidence, advocacy, and collective change.

---

Summary Takeaway

This episode underscores the urgent need to recognize and address the weaponization of data as a gendered security threat. Pavlina Pavlova’s research highlights that cyber incidents are not merely technical issues, but are increasingly leveraged to intimidate, silence, and harm women specifically—both in online and offline spheres. Addressing these challenges requires collective acknowledgment, more robust evidence, and action at both systemic and individual levels.

Transcript

[A]

This is Smart Women, Smart Power, a podcast that features conversations with some of the world's most powerful women. We feature thought leaders at all career levels where we explore, among other things, the many contributions that women make to the fields of international business, national security, foreign policy, and international development. Does having women in positions of power influence the outcomes of decisions in these fields? Why or why not? Join me, Dr. Kathleen McInnis, director of the Smart Women's Smart Power Initiative at the center for Strategic and International Studies. For these incredible conversations, cyberattacks disproportionately impact women and therefore the measures needed for better protection. To walk us through her recent research on these issues, we're joined by Pavlina Pavlova, a ShareThemikEnCyberfellow at the New America foundation in Washington, D.C. and a cybercrime expert at the UN Office of Drugs and Crime in Vienna. So welcome to the podcast, Pavlina. To kick us off, I'd love to hear your origin story. How did you get attracted to UNODC and cybercrime specifically?

[B]

Thank you so much for having me. It's a great pleasure to share about my research and starting with my story. Growing up I was very much influenced by political shifts in my home country, Slovakia. Being born in August 1991 meant that these were very turbulent times for the entire region, coming from communist rule to transformation into being a democracy. And I just saw how much depends on the rule of law, on strong democratic institutions. So I think I was very much drawn to the power to political power, to understanding international relations and how to make things for better. And this led to my study of geopolitics in Prague and in Leuven in Belgium. And from there being already in Belgium, close to Brussels, I had opportunities to gain experience at the European Parliament and I was assigned legislation dealing with network and information security and digital sling market. And I think this intersection of on one side security, democracy, human rights, and on the other, the very digital layer and cyber means keep me engaged ever since.

[A]

If I could follow that up a little bit, because I think both our younger listeners who are joining the field, but also our older listeners who are mentoring people who are trying to join the field would be really interested to know, like what was the specific set of opportunities that you had that allowed you to work in the European Parliament?

[B]

That's a very good question. I think it was my study record and keen interest in political issues. And since then when I saw opportunities to join, I applied and I was selected to join for first for internships and then for other opportunities okay, awesome.

[A]

So you started in as an intern and then sort of transitioned into more full time work. Okay, cool. So you recently published a report with the New America Foundation, Gender Impacts Data Weaponization, where you uncovered the alarming, disturbing rise of sexualized deepfakes and gendered attacks in online spaces. I mean, it's just horrific to think that this is the world we live in at times. But can you walk us through your decision to pursue this research?

[B]

It was evolution of decisions. I was working on digital security and especially focusing on threats to marginalized and targeted groups. When I was with the Organization for Security and Cooperation in Europe, I was working with minorities, human rights defenders, journalists and civil society members. It was around that time that I was approached to give a lecture on gender disinformation for young diplomats. And when I was preparing for the talk, I realized that this field, it's not just about this information, it's one layer of the threats. These threats are very much connected. They are connected to data breaches. They are connected to a set of online but also offline contextual threats. And I just felt like there is so much more that needs to be evidenced in this space and so much more that needs to be set, which wasn't. And then I saw the opportunity at New America with the shared Megan Cyber Fellowship, which offers great advantage to work on underrepresented topics in support of overall strengthening of collective resilience to digital threats. And I applied with this research and it was the best decision.

[A]

So let's get into some of the brass tacks about your research and your findings, which you mentioned. This contextualized data breaches and gender disinformation and how it's a much bigger problem than many are presently aware of. So to break it down, what kinds of threats you're an ordinary woman somewhere, like what kinds of threats might you face and how.

[B]

There's so many. That's the problem. And this is what I face when I try to put it into one research. I work through different factors that create gendered harm because not all harm is necessarily based on the gender or depending on our identities. So in my research I focused on gendered harm and then I evidence it through four factors. And these are access and perception of the gender specific gender data.

[A]

So what does that mean, like access to gender data?

[B]

So you have four factors that make the attack gendered. And I just wanted to put things into perspective. So I tried with these four factors to make it more accessible for wider audiences. At the same time, it's important to speak about specifics and what I find especially interesting is how these attacks on the healthcare sector create multiple gendered harms, which are very little evidence for now and which means a lot for not only resilience of the systems as such, but also for security of people and national security.

[A]

Well, can you provide us an example of what's at stake for an individual facing a personal data leak?

[B]

Yes, absolutely. First of all, these attacks are increasingly common, especially in the United States. And medical data of half of all Americans now believe to be exposed or breached. And attacks on critical infrastructure at large disrupt operations. And these attacks are growing in frequency, scale and the impact. So these are not only individual incidents, it just compounds with the impact because they are so common nowadays. And when it comes specifically to exploiting medical records, it can be sensitive for women because of gender specific information. And there is one very emblematic case that demonstrates it very clearly. And it's the Medibank case.

[A]

Walk us through that.

[B]

I'm going to walk you step by step.

[A]

Terrific.

[B]

In 2022, Rebel ransomware group hacked the largest Australian private health insurer and leaked a data set of Medibank customers and entitled it abortions after unsuccessful ransom demands. So they demanded certain amount of money. This ransom demand was not met and they leaked those documents. The compromised data was leaked on the dark web and including a spreadsheet listing patients personal information alongside billing codes related to pregnancy terminations. So there was a list published with abortions, basically calling it the naughty list. So shaming such behavior of women and this is one of the gender specific impacts because breaches of reproductive health records can have profound implications for women's privacy, well being, access to service and also security as such.

[A]

That's terrifying. That's terrifying. Especially in our post Roe versus Wade environment. You note in your report that gender defamation and disinformation have been a distinct part of the foreign interference toolkit. Like deepfakes. How so? Can you provide specific examples?

[B]

Yes, absolutely. There's actually also the 2022 European Parliament report. I quote this reference because it's one of the key reports that acknowledges that gender disinformation is a tool in the toolkit of foreign actors who try to disrupt election elections and disrupt democratic institutions at large. In Europe and all over the world we see gender disinformation being a problem not only how it targets women and gendered. This information is gendered not just because it targets women, it's because it targets them on specific gender criteria. So for example, sexualized deep fakes or gender stereotyping or misogynist. And sexist disinformation. And in this sense it wants to create basically second rate citizens. So as a woman representing a group of people, they try women to withdraw from elections and public places because then they create these kind of negative role models for other women. And if we have space like this, we really cannot speak about safe online spaces or even equal opportunities. So this is why the perpetrators do it in the first place. But then there is also secondary aspect to it. It's not only the piece of this information which is coordinated and circulated online, but also the compound of hate which is happening in online comments and how long term this harm can be, because on average gender disinformation with this kind of gender stereotypes will have more hatred and more threats and more death threats and more rape threats than any other disinformation against, for example, political candidates or journalists. So we are creating not only unsafe online spaces, but also unsafe offline spaces where women and their family members are threatened this way.

[A]

It's been interesting to watch some people's sort of dismissal of online spaces because it's just online and reality is totally different. And actually the two are much more intertwined. And especially in this way, when women are unsafe online, they're often very unsafe offline. So what policy recommendations do you have for different governments as we try to grapple with this threat?

[B]

I think it starts very basic, it starts from the evidence. It starts in believing that this issue is important. And I know it sounds very simple or rudimentary, but at the same time it's just not acknowledged. And even we see backsliding from what has been acknowledged in the past. So first of all, acknowledgement that this is an issue and we still don't know how much a problem it is for our society. And we need to evidence it more, we need to research it more, we need to devote more resources so we understand it. And this is not only for the impacted groups, which is reason enough, but it's also for increasing protection for everyone else. There is still very little known about the impacts of cyber incidents and larger cyber threats, and especially the impacts on subsets of these threats to populations across various contexts and across various vulnerabilities of those populations. So we definitely need more data and more methodologies and testimonies of those people who are impacted to understand how far reaching and very concrete is the harm. Because what is oftentimes problem with the cyber harm is that it's put aside as something that is annoyance rather than real harm. But once you start evidencing it, once you hear the concrete stories and you map them and you put them into perspective and you see them the trends. You understand that you're not only making people vulnerable, you're also making your own societies and your own space as a country, as a government, vulnerable to other actors to tap into these societal vulnerabilities and leverage them against you.

[A]

What can individuals do to better protect themselves and their data online?

[B]

So there are many ways and I think what we did right as a cyber security, cyber policy community is that there have been a lot of scaling up of initiatives for better cyber hygiene and best cybersecurity practices so you can do data minimization, which is very important. Speaking about data breaches and also selling of personal data to third parties. So just thinking twice before sharing information with platforms and individuals online, checking your settings because many platforms track for example, precise location data by default, but also multi factor authentication to prevent perpetrators to access account and misuse them. Beware phishing attacks. So be very cautious with emails and different links. Always fetch your software. But so these are best practices and I think we've done a lot on them. The other side of things is that we still know very little what are our rights when attack Audi happens. So prevention is the best thing you can do. But also what I saw when researching on these attacks, on this harm is that so much of this harm is outside of our realm of protection. So it happens to us whether we share the data. It happens to us because we share the data with healthcare providers. It happens to us because court files or public administration at large was attacked and this data was revealed. So it's not just about our accounts and our digital security, it's about more systematic security in the systems and how they process data. So I find for individuals it's also important to build the momentum to understand what are your rights if such attacks happen. And there is still very little accountability if such, for example data breaches happen. And also where to seek help while it's improving the capacity for e.g. law enforcement to investigate and prosecute such crimes remains limited.

[A]

Yeah, I remember maybe a decade ago now, China breached the data of everybody with a security clearance. And the US government's response was sending like Experian credit monitoring reports to see if somebody used our identities. And it was just like this is not sufficient relative to the problem. This is ridiculous. Anyway, do you think your gender as a woman has had an impact on your decision to pursue this research? And if so, why? If not, why not?

[B]

I think absolutely. I think it gives me more resolve to work on these issues, but it also importantly gives me more sensitivity to see how far reaching certain threats can be for well being and security of people. It's also beyond my gender. It's also because I have worked on a range of security issues and human rights violations and see how interconnected these threats can be and how very easily they can escalate both online and offline. What is heartwarming for me, being personally invested into this issue is that I was speaking to men and women in cyber security and outside, and there is a lot of interest in it because people understand that securing our societies is important. So it may start with women as the drivers for these issues, but it luckily does not stay with them. And there are many men across the field who feel like advancing this issue for better protection for us all.

[A]

Yeah, that's interesting that this issue is an indicator of where the threats are and it provides, it illuminates a new perspective on the issue that other experts can take forward. Oh, to conclude our conversation, smart women, Smart Power. What does power mean to you? How do you define power?

[B]

That's a very interesting question. To me, power must be the ultimate catalyst. It means absolutely nothing without the action we use it for. So it can be power for positive change, or power that corrupts, or even power that does nothing at all because we choose not to use it. So I find that the title of our podcast, Smart Power is so important. It's a call to use our power to our best ability and for wise impact.

[A]

Pavlina, thank you so much for joining us on the podcast today. This has been a fascinating conversation and to all of our listeners I really commend this research. Take a look. It's pathbreaking and it's something we all need to know about for all of the reasons that we've just articulated. Thank you.

[B]

Thank you very much for having me.

[A]

Subscribe to the Smart Women Smart Power podcast on Apple, Podcasts, Spotify, or wherever you listen to great content. Be sure to follow us on Twitter martwomen or you can follow me on Twitter jmcinnis1. Thanks for listening and join us next time.