Parental control applications, software tools designed to manage and monitor children’s online activities, serve as essential safeguards for parents in the digital age. However, their usage has sparked concerns about security and privacy violations inherent in various child monitoring products. Sideloaded software (i.e. apps installed outside official app stores) poses an increased risk, as it is not bound by the regulations of trusted platforms. Despite this, the market of sideloaded parental control software has remained widely unexplored by the research community. This paper examines 20 sideloaded parental control apps and compares them to 20 apps available on the Google Play Store. We base our analysis on privacy policies, Android package kit (APK) files, application behaviour, network traffic and application functionalities. Our findings reveal that sideloaded parental control apps fall short compared to their in-store counterparts, lacking specialised parental control features and safeguards against misuse while concealing themselves on the user's device. Alarmingly, three apps transmitted sensitive data unencrypted, half lacked a privacy policy and 9 out of 20 were flagged for potential stalkerware indicators of compromise (IOC).

Virtual and Extended Reality (VR/XR) headsets have promised to enhance police training through the delivery of immersive simulations able to be conducted anywhere, anytime. However, little consideration has been given to reviewing the evidenced benefits and potential issues posed by XR police training. In this paper, we summarise the evidenced usage and benefits of XR police training through a formative targeted literature review (n=41 publications). We then reflect on the prospective technical, security, social and legal issues posed by XR police training, identifying four areas where issues or vulnerabilities exist: training content, trainees and trainers, systems and devices, and state and institutional stakeholders. We highlight significant concerns around e.g. the validity of training; the psychological impact and risks of trauma; the safety and privacy risks posed to trainees and trainers; and the risks to policing institutions. We aim to encourage end-user communities (e.g. police forces) to more openly reflect on the risks of immersive training, so we can ultimately move towards transparent, validated, trusted training that is evidenced to improve policing outcomes.

The right to data portability (RtDP) was enshrined in law with the introduction of the EU's General Data Orotection Regulation (GDPR, Article 20) in 2018. RtDP gives a user the right to obtain and transfer their data to a different service, and the data controller the obligation to facilitate this transfer. Since GDPR's implementation, RtDP has been highlighted in the Digital Markets Act (DMA; 2022) and the proposed Data Act. Despite these reinforcements, there are gaps in understanding of RtDP amongst digital service users. Additionally, many organisations struggle to facilitate data transfer, particularly when it comes to the Internet of Things (IoT). This study examines the attitudes towards IoT data portability by conducting semi-structured interviews with users of consumer IoT devices (n = 28), academics/industry experts (n = 11) and policymakers (n = 8). Results indicate that whilst policymakers and consumers value this right in principle, it is rendered meaningless without a data subject's ability to exercise it in practice. A lack of guidance for data controllers and consumers has created an atmosphere of uncertainty which urgently needs to be addressed.

The use of Internet of Things (IoT) devices is an emerging trend for citizens. These devices may have implications for the security of various areas of life; for survivors of technology-facilitated domestic abuse and violence (tech-abuse), a shared ecosystem of IoT devices poses new risks. Here we develop a novel adaptation of `heuristic walkthrough' usability assessment, applying it to two readily available families of consumer smart assistant devices (Amazon Echo and Google Home). The paradigm underpinning the method considers the shared device ecosystem, and the potential threats to a person sharing smart devices with another. Prior tech abuse research informed the design of 11 tasks representing different phases of potential IoT tech-abuse. Phenomena produced by the tasks were assessed across well-defined design heuristics. Assessment was from both primary and secondary user perspectives, via a range of service interfaces (such as App, browser interface, and visual device cues). We find that many security-related elements of devices do not present usability problems, including that a secondary user has only a very limited view of the actions of a primary device user. We differentiate between features which delay or block effective use, informing potential areas for developing support solutions. For instance, findings indicate that task feedback and instructions may impact a tech-abuse survivor in an IoT ecosystem. Our results have implications for the definition of usability for concurrent users with differing expectations and needs, especially within a tech-abuse context. Our approach can inform the stakeholder conversations necessary to explore these issues across a range of other IoT devices.