Adherence to data protection measures such as pseudonymization or anonymization is critical in human subjects research because it has a direct impact on the confidentiality of participants' sensitive information, trust in research practices, and compliance with ethical and legal standards. Regulations such as the General Data Protection Regulation (GDPR) and guarantees made by researchers in informed consent forms mandate strict protocols for data security. However, compliance with these is not always straightforward. To gain qualitative insights into data protection practices in the field of Usable Security and Privacy (USP), we conducted interviews with 22 practitioners (five professors, eight researchers, nine data protection officers) and one focus group with five researchers. Overall, our results show a high awareness of ethical and legal responsibilities but highlight many practical and procedural issues. Based on these, we make concrete recommendations on how to improve the protection of personal data in research.

Statistical reporting, especially of effect sizes, is at the root of many methodological issues in quantitative research at CHI. Effect sizes are necessary for assessing practical relevance of results, a-priori power analysis, and meta-analyses, but currently, they are often not reported. Interpretations in the context of the study and the research field are also rare. To aid to researchers in reporting and contextualizing their effect sizes within their research field as well as choosing effect sizes for power analysis, we conducted a meta-study of quantitative CHI papers. We extracted statistics from all quantitative CHI papers published between 2019-2023 (N=1692). Based on effect sizes and the papers' CCS categories, we present effect size distributions in 12 CHI research fields. Through an additional qualitative analysis of 67 quantitative CHI'23 publications, we identify five categories of approaches that researchers take when interpreting effect size: Comparing test-specific values, assigning size labels, using a statistical or methodological reference frame, comparing different observations and interpreting for the big picture.

For decades, law enforcement and privacy advocates have struggled to find common ground regarding surveillance and privacy, resulting in the so-called Crypto Wars. When Apple announced it was planning to implement client-side scanning (CSS) in 2021 as a privacy-preserving compromise to detect known child sexual abuse material (CSAM), it received such intense pushback, especially from IT experts, that it dropped the plans within weeks. However, a study of the European population by ECPAT [1] and another of the German population by Geierhaas et al. [2] showed that despite concerns, the majority stated that they supported CSS for the detection of CSAM. This highlights a potential mismatch between “the majority” and “the experts.” To examine the different attitudes toward CSS further, we extend the work by Geierhaas in two ways. First, we conducted qualitative interviews with 19 IT security and privacy researchers at two major IT security conferences: the Symposium on Usable Privacy and Security (SOUPS) and the USENIX Security Symposium. In our second study, we replicated the German survey with a representative sample (age, gender, and state) from the USA. This was done both to examine possible cultural differences between Germany and the U.S. and to have a U.S. view to compare to our interview study. In this paper, we discuss key similarities and differences between the U.S. and German samples and contrast these with the researchers' views on the matter.

When conducting qualitative research it is necessary to decide how many researchers should be involved in coding the data: Is one enough or are more coders beneficial? To offer empirical evidence for this question, we designed a series of studies investigating qualitative coding. We replicated and extended a usable security and privacy study by Ion et al. to gather both simple survey data and complex interview data. We had a total of 65 students and seven researchers analyze different parts of this data. We analyzed the codebook creation process, similarity of outcomes, inter-rater reliability, and compared the student to the researcher outcomes. We also surveyed five years of SOUPS-PC members about their views on coding. The reviewers view on coding practices for complex and simple data are almost identical. However, our results suggest that the coding process can be different for the two types of data, with complex data benefiting more from interaction between coders.