Research on intelligent systems has emphasized the benefits of providing explanations along with recommendations. But can explanations lead users to make incorrect decisions? We explored this question in a controlled experimental study with 18 professional network security analysts doing an incident classification task using a prototype cybersecurity system. The system provided three recommendations on each trial. The recommendations were displayed with explanations (called "justifications") or without. On half the trials, one of the recommendations was correct; in the other half none of the recommendations was correct. Users were more accurate with correct recommendations. Although there was no benefit overall of explanation, we found that a segment of the analysts were more accurate with explanations when a correct choice was available but were less accurate with explanations in the absence of a correct choice. We discuss implications of these results for the design of intelligent systems.

Analysts engaged in real-time monitoring of cybersecurity incidents must quickly and accurately respond to alerts generated by intrusion detection systems. We investigated two complementary approaches to improving analyst performance on this vigilance task: a graph-based visualization of correlated IDS output and defensible recommendations based on machine learning from historical analyst behavior. We tested our approach with 18 professional cybersecurity analysts using a prototype environment in which we compared the visualization with a conventional tabular display, and the defensible recommendations with limited or no recommendations. Quantitative results showed improved analyst accuracy with the visual display and the defensible recommendations. Additional qualitative data from a "talk aloud" protocol illustrated the role of displays and recommendations in analysts' decision-making process. Implications for the design of future online analysis environments are discussed.

We motivate the need for new environments for collaborative reasoning and describe the foundations of our approach, namely collaboration, semantics, and adaptability. We describe the CRAFT collaborative reasoning interface and infrastructure that we are developing to explore this approach.

Mission critical applications and legacy systems may be difficult to revise and rebuild, and yet it is sometimes desirable to retrofit their user interfaces with new collaborative features without modifying and recompiling the original code. We describe the use of Aspect-Oriented Programming as a lightweight technique to accomplish this, present an example of incorporating presence awareness deeply into an application's user interface, and discuss the implications of this technique for developing CSCW software.

We present contextual collaboration, an approach to building collaborative systems that embeds collaborative capabilities into core applications, and discuss its advantages. We describe the Jazz collaborative application development environment that we are using to explore this concept and discuss design guidelines that have emerged from our experience.

Information hiding is one of the most important and influential principles in software engineering. It prescribes that software modules hide implementation details from other modules in order to decrease the dependency between them. This separation also decreases the dependency among software developers implementing modules, thus simplifying some aspects of collaboration. A common instantiation of this principle is in the form of application programming interfaces (APIs). We performed a field study of the use of APIs and observed that they served many roles. We observed that APIs were successful indeed in supporting collaboration by serving as contracts among stakeholders as well as by reifying organizational boundaries. However, the separation that they accomplished also hindered other forms of collaboration, particularly among members of different teams. Therefore, we think argue that API's do not only have beneficial purposes. Based on our results, we discuss implications for collaborative software development tools.

The principle of information hiding has been very influential in software engineering since its inception in 1972. This principle prescribes that software modules hide implementation details from other modules in order to decrease their interdependencies. This separation also decreases the dependency among software developers implementing modules, thus simplifying some aspects of collaboration. A common instantiation of this principle is in the form of application programming interfaces (APIs). We performed a qualitative study on how practitioners use APIs in their daily work. Although particularly interested in aspects of collaboration, we report all findings about their observed use. The findings include mundane observations that are predicted by theory, ways that APIs support collaborative software development. But the findings also include some surprises, ways that APIs hinder collaboration. The surprises indicate directions for further improvement of collaborative software development practices and tools.

One of the most challenging problems facing builders and facilitators of community networks is to create and sustain social engagement among members. In this paper, we investigate the drivers of social engagement in a community network through the analysis of three data sources: activity logs, a member survey, and the content analysis of the conversation archives. We describe three important ways to encourage and support social engagement in online communities: through system design elements such as conversation channeling and event notification, by various selection criteria for community members, and through facilitation of specific kinds of discussion topics.

Goals and content: To provide an organized and entertaining overview of the world fo CSCW for newcomers to the field. We will offer a framework for understanding CSCW as a research domain, a management opportunity, and a business challenge. We will analyze some of the great successes and great disasters in CSCW.

We introduce the Notification Service Transfer Protocol (NSTP), which provides a simple, common service for sharing state in synchronous multi-user applications. A Notification Server provides items of shared state to a collection of clients and notifies the clients whenever one of the items changes. The division between client and server in this system is unusual; the centralized state is uninterpreted by the server. Instead, the responsibility for semantics and processing falls on the clients, which collude to implement the application. After describing NSTP, we differentiate it from other systems in terms of the four design principles that have guided its development. Keywords Synchronous groupware, multi-user applications, group-ware infrastructure, client/server architectures, notification, protocol, design principles, performance, state sharing.

When people have meetings or discussions, frequently they use conversational props : physical models, drawings, or other concrete representations of information used to enhance the exchange of information. If the participants are geographically separated, it is difficult to make effective use of props since each physical prop can only exist in one place. Computer applications that allow two or more users to simultaneously view and manipulate the same data can be used to augment human-to-human telecommunication. We have built the Rendezvous system is similar to many UIMSs or user interface toolkits in that it is intended to simplify the construction of graphical direct-manipulation interfaces. It goes beyond these systems by adding functionality to support the construction of multiuser applications. Based on experience with several large applications built with the Rendezvous system, we believe that it is useful for building conversational props and other computer-supported cooperative work (CSCW) applications. We present a list of required features of conversational props, some example applications built with the Rendezvous system, and a description of the Rendezvous system.

Synchronous multi-user applications are designed to support two or more simultaneous users. The RENDEZVOUSTM1 system is an infrastructure for building such multi-user applications. Several multi-user applications, such as a tic-tac-toe game. a multi-user CardTable application, and a multi-user whiteboard have been or are being constructed with the RENDEZVOUS system. We argue that there are at least three dimensions of programming complexity that are differentially affected by the programming of multi-user applications as compared to the programming of single-user applications. The first, concurrency, addresses the need to cope with parallel activities. The second dimension, abstraction, addresses the need to separate the user-int~rface from an underlying application abstraction, The thmd dimension, roles, addresses the need to differentially characterize users and customize the user-interface appropriately. Certainly, single-user applications often deal with these complexities; we argue that multi-user applications cannot avoid them. [Keyworcls: User Interface Management System, Computer-Supported Cooperative Work, groupware, programming, dialogue separation, concurrency, roles]

Rendezvous is an architecture for creating synchronous multi-user applications. It consists of two parts: a run-time architecture for managing the multi-user session and a start-up architecture for managing the network connectivity. The run-time architecture is based on a User Interface Management System called MEL, which is a language extension to Common Lisp providing support for graphics operations, object-oriented programming, and constraints. Constraints are used to manage three dimensions of sharing: sharing of underlying information, sharing of views, and sharing of access. The start-up architecture decouples invoking and joining an application so that not all users need be known when the application is started. At present, the run-time architecture is completed and running test applications. As a first test of the complete Rendezvous architecture, we will implement a multi-user card game by the end of the summer.

Summary form only given. Broadband communications is said to offer a hidden benefit: it provides more time for computing. The system response time can be partitioned into two parts: the time for communications, and the time for processing. If the time for communications is less, then there is more time for processing. Within some limit end-users will not require greater speed and the extra time can be spent enhancing the application by, for example, computing more complicated displays or recognizing more complicated input, e.g. gestures.>

Three keys are suggested for unlocking the broadband future based on an analysis of human and societal communication needs. A framework is adopted that distinguished three categories of communication needs: access to people, access to information, and access to information processing. Within this framework, it is argued that applications that emphasize shared visual material, that accommodate advertisers as important end-users, and that include effective security provisions may play a crucial role in realizing the broadband future.>

We describe two experiments that compare the relative utility of pictures, labels, and the combination of both as navigational aids for computerized catalog browsing. The results point to the usefulness of example pictures as search aids in the context of menu traversal through hierarchically structured pictorial databases. We take this outcome to be a reflection of the disambiguating role that pictures can play for verbal category labels.

An iterative Bayesian decision aid was developed to give users greater control of the decisionmaking process and thereby increase the likelihood of aid implementation. The aid permits users to modify the initially assessed likelihood ratios and resulting posterior odds for the hypotheses under consideration until they feel comfortable with the inferred implications of the data. The aid was applied to the area of military tactical intelligence analysis and evaluated experimentally by experienced analysts on a training task representative of that decisionmaking environment. Experienced and inexperienced (but trained) analysts working with the aid were 1) better able to discriminate between the most and least likely hypotheses and 2) assigned final likelihoods to the hypotheses that were more similar to normative likelihoods derived from Bayes' theorem than unaided analysts. In addition, analyses of individual analysts revealed large differences in decisionmaking strategies. These differences demonstrate that users can approach the inference problem using their own decisionmaking style, thereby ensuring user control over all stages of the decisionmaking process.