In a 'digital by default' society, essential services must be accessed online. This opens users to digital deception not only from criminal fraudsters but from a range of actors in a marketised digital economy. Using grounded empirical research from northern England, we show how supposedly 'trusted' actors, such as governments,(re)produce the insecurities and harms that they seek to prevent. Enhanced by a weakening of social institutions amid a drive for efficiency and scale, this has built a constricted, unpredictable digital channel. We conceptualise this as a "snipers' alley". Four key snipers articulated by participants' lived experiences are examined: 1) Governments; 2) Business; 3) Criminal Fraudsters; and 4) Friends and Family to explore how snipers are differentially experienced and transfigure through this constricted digital channel. We discuss strategies to re-configure the alley, and how crafting and adopting opportunity models can enable more equitable forms of security for all.

In this article, we report on a 3-year endeavor that fostered 18 collaborations between academic and non-academic organizations to co-create responses to social (in)justice issues in digital societies. The projects and range of individuals and organizations connected to this program offer a snapshot of the state of social justice thinking within the UK digital economy research sector. Our analysis shows how the program’s constellations of actions enacted different modes of resistance attempting to reshape people’s relationship to power dynamics, addressing institutions and exposing systems, and developing and restoring values for social justice. We explore how these efforts invite nuanced understanding of what constitutes resistance in knowledge co-production endeavors and how they helped surface tensions at the intersection of agencies and the distribution of responsibilities. Drawing from our insights and experience, we discuss implications for HCI concerned with the creation of the conditions for social justice in our digital societies.

Purpose As part of the growing necessity for inter-organisational and multi-disciplinary interaction to facilitate complex innovation in digital security, there needs to be greater engagement with regulation in the innovation process. This is particularly true in the case of security technologies that are embedded within wider systems and that are largely invisible to most of the users of that system. This paper aims to describe stakeholders’ perspectives on regulation in the digital security innovation process and evaluates the implications of these perspectives on anticipatory regulation in digital security. Design/methodology/approach Using a qualitative methodology based on semi-structured expert interviews and ethnographic participant observation, the study draws on the authors’ involvement in a formally organised programme of academia–industry–government collaboration called Digital Security by Design (DSbD). Findings The study highlights a relational dimension to establishing regulatory responsibilities that is enabled through interdisciplinary dialogue. The study contributes to understanding the multifaceted roles of regulation in digital security innovation across organisations and areas of expertise. It does so by identifying four themes in how regulation is perceived in the DSbD programme: ethical imperative, adding value, adoption lever and passive compliance. Practical implications Incorporating regulatory responsibilities through dialogue early in the innovation process, rather than only once a security technology’s deleterious effects are noticeable, which could make digital innovation and transformation safer and better regulated. It can also make regulation successfully adopted, rather than an exercise in damage control or an adversarial process between regulators and organisations. Originality/value This paper presents original empirical research on how regulation is considered by stakeholders in a novel multi-disciplinary digital security innovation process. It then uses these findings as a basis to evaluate the implications for establishing regulatory responsibilities for a class of security technologies that are embedded within wider systems and that are largely invisible to most of the users of those wider systems.

In a study of everyday digital identity, a set of primary drawings were made by researchers in online focus group settings as a way to capture our participants’ spoken narratives of hyper-[in]security in the usages of digital identity. In a second stage of work, key extracts from the drawings were collaged using the method described in the paper, allowing an exploratory qualitative cartography of hyper-[in]security to be constructed. These secondary collages group the [in]securities thematically without losing essential contextual information. Samples of our data are given, to illustrate the contribution of the method to experience-centred design, with special reference to security from the perspective of marginalised and underserved communities. We discuss our method as a step towards multidimensional cognitive mapping of the salient features of our participants’ narratives about hyper-[in]security, potentially paving the way for further world building explorations of digital identity futures.

Whilst participatory practice is increasingly adopted in end user studies, there has been far less use of a participatory approach when designing lower down the software stack. As a result, end users are often presented with security controls over which they have no control but for which they retain the responsibility. Conversely, hardware and software engineers struggle to innovate new security control designs that are resilient to new and emerging threats. In a study utilising ethnographic research and stakeholder interviews, we show that there is a siloing of communities of practice between hardware security engineers, software engineers and coders, manufacturers in the technology supply chain and end users. Our findings indicate that this siloing and a lack of participatory practice impedes the development of a more cohesive digital security design that integrates security through the stack from the hardware layer upwards to the OS and application layers. These barriers make difficult the negotiation between what is possible lower down the stack with what is needed and wanted higher up the stack. Our findings suggest that a more holistic and comprehensive participatory design approach is required to negotiate a digital security by design paradigm that more evenly distributes power over and responsibility for security controls throughout the stack. Working with the HCI literature on co-production in design, this paper will suggest that a pathway for breaking through this impasse is to utilise objects in the design process of the hardware secure instruction set architecture as a feedback mechanism to incorporate other sets of designers and users in the design process to create a more workable stack.

A successful digital society is, in part, predicated on people having secure access to digitally-delivered services when they need it. It has long been recognised that parts of society are not able to access digital services without assistance, often as a result of economic precarity. During the COVID-19 pandemic, the importance of third and voluntary sector organisations in providing assisted digital access has come to the fore. As access to essential everyday services moved to digital-only and family and friendship networks of support became disrupted by the pandemic, for many, voluntary and third sector organisations were the source of digital assistance to claim welfare, pay bills, take part in education and purchase food. Our study explores the types of assisted digital access that voluntary and third sector organisations have provided thus far during the COVID-19 pandemic. We capture the dimensions of this assistance and evaluate the steps such organisations take to ensure that this access is safe for both the assister and assisted. From these findings we set out a security strategy with supporting design principles that combines digital security with human security in a security approach we term 'positive-first'.

Whilst user- and people-centered design are accepted routes for digital services, they are less commonly used in the design of technologies that control access to data and the security of information. The ubiquity of both technology and programmes such as "digital by default" as well as the weaving of digital systems into the everyday fabric of society, create an environment in which people and technology become enmeshed. Such an environment might be termed "post-digital" and its security is dependent on a people-centered approach to its design. In this paper we present a study that uses critical design techniques coupled with critical security analysis to examine how security might be approached in a post-digital context. We call for a paradigm shift towards a people-centered security practice and using a case study then make practical recommendations as to how this shift might be achieved.

Across Europe, refugees are required to engage with the "civic turn" -- a process of integrating refugees into the social and cultural aspects of the new land. Over a two-year period, we engaged 89 refugees settling in Sweden, to explore how accelerated and digitalised resettlement processes shape the civic turn. Framed within wider literature on transitioning and everyday insecurities, we show how this "digital turn" exacerbates existing barriers to resettlement experienced by refugees. By critically analysing these barriers, we reveal how the civic turn rests upon a series of everyday social and cultural practices and relations, which are largely ignored in digital service design. We show how this leads to a "vacuum" for our participants. We call on the HCI community to engage with this vacuum and understand resettlement as encompassing multiple digitally-mediated transitional phases of citizenry. We do so by focusing on the digitalisation processes shaping these transitions.

This paper brings together three distinct case studies to explore how social isolation and notions of liminality shape ontological security within communities on "the edge" of society. Each case study exemplifies the differing nature of liminality in everyday contexts and the extent to which increased digitalisation perturbs it in multiple ways. Taking an ethnographic approach, the research engaged with seafarers onboard container ships in European waters, communities in Greenland and welfare claimants in the North East of England. It posits that technological innovation must attend to the routinisation of everyday life through which people establish ontological security if such innovation is to be supportive. The paper thus moves beyond existing HCI scholarship by foregrounding the contextual and relational aspects of social isolation rather than the technological. It does so by advocating a ground-up design process that considers ontological security in relation to notions of liminality among communities on the edge.

This paper explores the disruptive and transformative effects of digital technology on gendered security asymmetries in Greenland. Through ethnographic fieldwork conducted in Greenland and Denmark, research findings emerged through in-depth interviews, collaborative mappings and field observations with 51 participants. Employing a critical feminist lens, the paper identifies how Greenlandic women develop digital security practices to respond to Greenland's ecologically, politically and socially induced transformation processes. By connecting individual security concerns of Greenlandic women with the broader regional context, the findings highlight how digital technology has created transitory spaces in which collective security is cultivated, shaped and challenged. The contribution to HCI scholarship is therefore threefold: (1) identification and acknowledgement of gendered effects of increased usage of digital technology in remote and hard-to-reach communities, (2) a broader conceptualisation of digital security and (3) a recommendation for more contextualised, pluralistic digitalisation policies and design.

Over half of Syrian refugee households in Lebanon are food insecure with some reliant on an electronic voucher (e-voucher) system for food aid. The interplay between the digitisation of food aid, within the socio-technical context of refugees, and community collaborative practices is yet to be investigated. Through design engagements and interviews with refugees and shop owners we explore the experiences of a Syrian refugee community in Lebanon using the e-voucher system. We provide insights into the socio-technical environment in which the e-voucher system is dispensing aid, the information and power asymmetries experienced, refugee collaborative coping practices and how they interplay with the e-voucher system. We highlight the need for: (1) expanding refugee digital capabilities to encompass understandings of aid technologies and identifying trusted intermediaries and (2) for technologies to support in upholding humanitarian principles and mitigating power and information asymmetries. Lastly, we call for CSCW researchers and humanitarian innovators to consider how humanitarian technologies can enable refugee collaborative practices and adopt everyday security as a lens for designing aid technologies. The paper contributes to CSCW knowledge regarding the interplay between aid technologies and refugees? socio-technical contexts and practices that provides a basis for future technological designs for collaborative technologies for refugee food security.

This paper presents a study of mobile phone use by people settling in a new land to access state provided digital services. It shows that digital literacy and access to technology are not the only resources and capabilities needed to successfully access digital services and do not guarantee a straightforward resettlement process. Using creative engagement methods, the research involved 132 "newcomers" seeking to settle in Sweden. Ribot and Peluso's theory of access (2003) was employed to examine the complex web of access experienced by our participants. We uncover that when communities are dealing with high levels of precarity, their primary concerns are related to accessing the benefits of a service, rather than controlling access. Broadening the HCI framework, the paper concludes that a sociotechnical model of access needs to connect access control and access benefit to facilitate the design of an effective digital service.

Critical approaches to smart technologies have emerged in HCI that question the conditions necessary for smart technologies to benefit people. Smart services rely on a relation of trust and sense of security between people and technology requiring a more expansive definition of security. Using established design methods, we worked with two residents' groups to critically explore and rethink smart services in the home and city. From our data analysis, we derive insights about perceptions and understandings of trust, privacy and security of smart devices, and identify how technological security needs to work in concert with social and relational forms of security for smart services to be effective. We conclude with an orientation for HCI that focuses on designing services for and with smart people and things.

Framed within the theoretical lens of positive and negative security, this paper presents a study of newcomers to Sweden and the roles of mobile phones in the establishment of a new life. Using creative engagement methods through a series of workshops, two researchers engaged 70 adult participants enrolled into further education colleges in Sweden. Group narratives about mobile phone use were captured in creative outputs, researcher observations and notes and were analysed using thematic analysis. Key findings show that the mobile phone offers security for individuals and a safe space for newcomers to establish a new life in a new land as well as capitalising on other spaces of safety, such as maintaining old ties. This usage produces a series of threats and vulnerabilities beyond traditional technological security thinking related to mobile phone use. The paper concludes with recommendations for policies and support strategies for those working with newcomers.

This paper examines the use of visualisations in the field of information security and in particular focuses on the practice of information security risk assessment. We examine the current roles of information security visualisations and place these roles in the wider information visualisation discourse. We present an analytic lens which divides visualisations into three categories: journalistic, scientific and critical visualisations. We then present a case study that uses these three categories of visualisations to further support information security practice.

The joint study of computer security, privacy and human-computer interaction (HCI) over the last two decades has shaped a research agenda focused upon usable privacy & security. However, in HCI research more generally there has long been an awareness of the need to understand and design for user experience, in recognition of the complex and multi-faceted role that technology now plays in our lives. In this paper we add to the growing discussion by introducing the notion of experience-centered privacy and security. We argue that in order to engage users of technology around issues related to experiences of privacy and security, research methods are required that may be outside of the normal repertoire of methods that we typically call upon. We describe three projects that developed non-typical research methods to reveal experiential insights into user interactions with privacy and security-related technologies. We conclude by proposing a research agenda that begins to illustrate how the discourse and methods of experience-centered design might serve to provide valuable alternative perspectives on new and enduring user-facing privacy and security problems.

Security weaknesses often stem from users trying to comply with social expectations rather than following security procedures. Such normative conflicts between security policies and social norms are therefore undesirable from a security perspective. It has been argued that system developers have a "meta-task responsibility", meaning that they have a moral obligation to enable the users of the system they design to cope adequately with their responsibilities. Depending on the situation, this could mean forcing the user to make an "ethical" choice, by "designing out" conflicts. In this paper, we ask the question to what extent it is possible to detect such potential normative conflicts in the design phase of security-sensitive systems, using qualitative research in combination with so-called system models. We then envision how security design might proactively reduce conflict by (a) designing out conflict where possible in the development of policies and systems, and (b) responding to residual and emergent conflict through organisational processes. The approach proposed in this paper is a so-called subcultural approach, where security policies are designed to be culturally sympathetic. Where normative conflicts either cannot be avoided or emerge later, the organisational processes are used to engage with subcultures to encourage communally-mediated control.

Amazon is the world's largest e-shopping site, with its market capitalization having just passed $100 billion [1]. Internet users interaction with its web site is an example of a widespread security ceremony - a ceremony focuses on security- related human interaction with technology, including security protocols and on-line service consumption [2]. This paper focuses on how Amazon's ceremony manages the users' security and privacy through the digital identities they may create with the popular web site. It leverages on the cognitive walkthrough method [3] to distill tasks, steps and walkthroughs of the ceremony, and then to pinpoint four risks affecting the users' security and privacy. It formulates four corresponding recommendations for technical web site updates that would resolve the noted risks. In particular, the recommendations address common contexts such as users accessing Amazon from their smartphones. A possible explanation of the coexistence of such risks with the late capitalization achievements is that users are more driven by familiarity and confidence than by trust. These findings are meant to be complemented with a homologous assessment from Amazon's standpoint.

With the move to deliver services on-line, there is a reduction in opportunities for a service user to discuss and agree to the terms of the management of their personal data. As the focus is turned to on-line technologies, the design question becomes one of privacy protection not privacy negotiation and conflict resolution. However, the findings from a large privacy survey and the outputs of several follow-up focus groups reflect a need for privacy systems to also support different types of privacy and consent dialogues. These dialogues are used to support the resolution of privacy dilemmas through the selection of effective privacy protection practices. As the face to face contact between service user and service provider decreases, the potential for these types of dialogues to become increasingly important grows. The work presented in this paper forms the initial part of a study to learn more about the types of privacy dialogue and negotiation that should be deployed in on-line services. In this position paper we outline the types of privacy and consent dialogues that service providers and service users want to have. We also explore how a socio-technical approach should ideally form the basis of the design and implementation of any dialogue system.