This introduction discusses the background and motivations for this special issue on Personal Information Management (PIM). We summarize accepted papers and outline future issues for PIM research.

People are often asked to provide their email addresses for identification, authentication, or communication purposes. In many such circumstances, people provide made-up email addresses instead of their own. To understand why people provide made-up email addresses, we interviewed 20 people who reported doing so. We found that the participants provided made-up email addresses to avoid information overload and protect privacy. The participants chose to provide made-up email addresses based on several factors, such as the context, personal benefits and risks, past experiences, and verification requirements. When composing made-up email addresses, the participants employed several common patterns based on their mental models of email address formats and threat models for undesirable uses of their email addresses. The participants reported using these patterns strategically to navigate the social expectations to comply with such requests and to avoid embarrassment from being perceived as deceptive. We connect our findings to email privacy more broadly through the theoretical perspectives of boundary regulation, communication privacy management, contextual integrity, social desirability, and interdependent privacy. Our insight points to design and regulatory suggestions to address the interdependent privacy issues resulting from made-up email addresses and to help users deal more effectively with email overload and email marketing. • Explores how people use made-up email addresses for privacy and information overload. • Describes interdependent privacy issues in using made-up email addresses. • Connects email privacy practices to key privacy-related theories. • Proposes unified client-side management for misdirected and unwanted email messages. • Advocates input validation and double opt-in for email address collection.

A long standing goal of usable privacy and security (UPS) research is to align end-user behaviors with expert suggestions, such as through developing tools to increase user control and awareness of security and privacy (S&P) threats. These approaches, while necessary, are not sufficient to combat the ubiquitous slow violence of S&P harms that impede on people’s motivation to change and erode their trust in the institutions in which experts are often entrenched. We propose that we can only effect true change and rebuild trust with users if we first deconstruct our norms of telling users what’s best and expecting them to comply. We draw from concepts in critical computing, design, and games research, to propose a research agenda—“Transformational Provocation”—that involves provoking transformation in not just users’ S&P knowledge, skills, or behaviors, but also their senses of truth, self, relationships, and society. Moreover, we demonstrate the value and application of our framework through illustrative case studies. With this framework, we call upon the UPS community to pursue new design opportunities for engendering organic and enduring intrinsic motivation for people to act on their S&P, both on their own and together.

A large proportion of email messages in an average Internet user's inbox are unwanted commercial messages from mailing lists, bots, and so on. Although such messages often include instructions to unsubscribe, people still struggle with stopping unwanted email. We investigated the user experience of unsubscribing from unwanted email messages by recruiting 18 individuals for via a lab study followed by semi-structured interviews. Based on unsubscribing practices of the study participants, we synthesized eight common unsubscription mechanisms and identified the corresponding user experience challenges. We further uncovered alternative practices aimed at circumventing the need to unsubscribe. Our findings reveal frustration with the prevailing options for limiting access to the self by managing email boundaries. We apply our insight to offer design suggestions that could help commercial providers improve the user experience of unsubscribing and provide users more control over the email they receive.

In "smart speaker'' digital assistant systems such as Google Home, there is no visual user interface, so people must learn about the system's capabilities and limitations by experimenting with different questions and commands. However, many new users give up quickly and limit their use to a few simple tasks. This is a problem for both the user and the system. Users who stop trying out new things cannot learn about new features and functionality, and the system receives less data upon which to base future improvements. Symbiosis---a mutually beneficial relationship---between AI systems like digital assistants and people is an important aspect of developing systems that are partners to humans and not just tools. In order to better understand requirements for symbiosis, we investigated the relationship between the types of digital assistant responses and users' subsequent questions, focusing on identifying interactions that were discouraging to users when speaking with a digital assistant. We conducted a user study with 20 participants who completed a series of information seeking tasks using the Google Home, and analyzed transcripts using a method based on applied conversation analysis. We found that the most common response from the Google Home, a version of "Sorry, I'm not sure how to help'', provided no feedback for participants to build on when forming their next question. However, responses that provided somewhat strange but tangentially related answers were actually more helpful for conversational grounding, which extended the interaction. We discuss the connection between grounding and symbiosis, and present recommendations for requirements for forming partnerships with digital assistants.

Digital technology that is prevalent in people's everyday lives, including smart home devices, mobile apps and social media, increasingly lack regulations for how the user data can be collected, used or disseminated. The CSCW and the larger computing community continue to evaluate and understand the potential negative impacts of research involving digital technologies. As more research involves digital data, Institutional Review Boards (IRBs) take on the difficult task of evaluating and determining risks--likelihood of potential harms--from digital research. Learning more about IRBs' role in concretizing harm and its likelihood will help us critically examine the current approach to regulating digital research, and has implications for how researchers can reflect on their own data practices. We interviewed 22 U.S.-based IRB members and found that, for the interviewees, "being digital" added a risk. Being digital meant increasing possibilities of confidentiality breach, unintended collection of sensitive information, and unauthorized data reuse. Concurrently, interviewees found it difficult to pinpoint the direct harms that come out of those risks. The ambiguous, messy, and situated contexts of digital research data did not fit neatly into current human subjects research protection protocols. We discuss potential solutions for understanding risks and harms of digital technology and implications for the responsibilities of the CSCW and the larger computing community in conducting digital research.

Email is an essential tool for communication and social interaction. It also functions as a broadcast medium connecting businesses with their customers, as an authentication mechanism, and as a vector for scams and security threats. These uses are enabled by the fact that the only barrier to reaching someone by email is knowing his or her email address. This feature has given rise to the spam email industry but also has another side-effect that is becoming increasingly common: misdirected email, or legitimate emails that are intended for somebody else but are sent to the wrong recipient. In this paper we present findings from an interview study and survey focusing on characteristics of misdirected email messages, possible reasons why they happen, and how people manage these messages when they receive them. Misdirected email arises as a result of signifiers (usernames) which were selected by people for social and self-representation purposes, that are also used by machines for addressing. Because there is no mechanism for dealing with misdirected emails in a systematic way, individual recipients must choose whether to take action and how much effort to put forth to prevent potential negative consequences for themselves and others.

Transparency can empower users to make informed choices about how they use an algorithmic decision-making system and judge its potential consequences. However, transparency is often conceptualized by the outcomes it is intended to bring about, not the specifics of mechanisms to achieve those outcomes. We conducted an online experiment focusing on how different ways of explaining Facebook's News Feed algorithm might affect participants' beliefs and judgments about the News Feed. We found that all explanations caused participants to become more aware of how the system works, and helped them to determine whether the system is biased and if they can control what they see. The explanations were less effective for helping participants evaluate the correctness of the system's output, and form opinions about how sensible and consistent its behavior is. We present implications for the design of transparency mechanisms in algorithmic decision-making systems based on these results.

It is common for researchers to use self-report measures (e.g. surveys) to measure people's security behaviors. In the computer security community, we don't know what behaviors people understand well enough to self-report accurately, or how well those self-reports correlate with what people actually do. In a six week field study, we collected both behavior data and survey responses from 122 subjects. We found that a relatively small number of behaviors -- mostly related to tasks that require users to take a specific, regular action -- have non-zero correlations. Since security is almost never a user's primary task for everyday computer users, several important security behaviors that we directly measured were not self-reported accurately. These results suggest that security research based on self-report is only reliable for certain behaviors. Additionally, a number of important security behaviors are not sufficiently salient to users that they can self-report accurately.

The Facebook News Feed prioritizes posts for display by ranking them more prominently in the News Feed, based on users’ past interactions with the system. This study investigated constraints imposed on social interactions by the algorithm, by triggering participants’ awareness of “missed posts” in their Friends’ Timelines that they did not remember seeing before. If the algorithm prioritizes posts from people that users feel closer to and want to stay in touch with, participants should be less likely to report missed posts from close Friends. However, the results showed that relationship closeness had no effect on the likelihood of noticing a missed post, after controlling for how many Facebook Friends participants had and the accuracy of participants’ memories for their Friends’ Facebook activity. Also, missed posts from close Friends were more surprising, even when participants believed that the actions of the system caused the missed posts, indicating that these instances represent participants’ unmet expectations for the behavior of their News Feeds. Because Facebook posts present opportunities for feedback important for social support and maintaining social ties, this could indicate bias in the way the algorithm promotes content that could affect users’ ability to maintain relationships on Facebook. These findings have implications for approaches to improve user control and increase transparency in systems that use algorithmic filtering.

People are becoming increasingly reliant on online socio-technical systems that employ algorithmic curation to organize, select and present information. We wanted to understand how individuals make sense of the influence of algorithms, and how awareness of algorithmic curation may impact their interaction with these systems. We investigated user understanding of algorithmic curation in Facebook's News Feed, by analyzing open-ended responses to a survey question about whether respondents believe their News Feeds show them every post their Facebook Friends create. Responses included a wide range of beliefs and causal inferences, with different potential consequences for user behavior in the system. Because user behavior is both input for algorithms and constrained by them, these patterns of belief may have tangible consequences for the system as a whole.

Installing security-relevant software updates is one of the best computer protection mechanisms. However, users do not always choose to install updates. Through interviewing non-expert Windows users, we found that users frequently decide not to install future updates, regardless of whether they are important for security, after negative experiences with past updates. This means that even non-security updates (such as user interface changes) can impact the security of a computer. We discuss three themes impacting users' willingness to install updates: unexpected new features in an update, the difficulty of assessing whether an update is ``worth it', and confusion about why an update is necessary.

It can be difficult for social media users to tell who is paying attention to what they post. As producers of content, Facebook users make assumptions about who will be part of their intended audience. However, when the same user's role shifts to that of consumer, the criteria for consumption depends on factors outside of the original producer's control. This creates a gap between producer intentions and consumer behavior; producing content that is actually consumed by one's intended audience is neither guaranteed nor easily confirmed.

Non-expert computer users regularly need to make security-relevant decisions; however, these decisions tend not to be particularly good or sophisticated. Nevertheless, their choices are not random. Where does the information come from that these non-experts base their decisions upon? We argue that much of this information comes from stories they hear from other people. We conducted a survey to ask open- and closed- ended questions about security stories people hear from others. We found that most people have learned lessons from stories about security incidents informally from family and friends. These stories impact the way people think about security, and their subsequent behavior when making security-relevant decisions. In addition, many people retell these stories to others, indicating that a single story has the potential to influence multiple people. Understanding how non-experts learn from stories, and what kinds of stories they learn from, can help us figure out new methods for helping these people make better security decisions.

We lay out one strand of a continuing investigation into the development of a virtual peer to help children learn to use "school English" and "school-ratified science talk". In this paper we describe a detailed analysis of a corpus of child-child language use, and report our findings on the ways children shift dialects and ways of discussing science depending on the social context and task. We discuss the implications of these results for the redesign of a virtual peer that can evoke language behaviors associated with student achievement. Furthermore, our results allow us to describe the ways in which this virtual agent can tailor its level of interaction based on a child's current aptitude in this area.

Over 80 million households in the United States have a home computer and an Internet connection. The vast majority of these are administered by people who have little computer security knowledge or training, and many users try to avoid making security decisions because they feel they don't have the knowledge and skills to maintain proper security. Nevertheless, home computer users still make security-related decisions on a regular basis -- for example, whether or not to click on a shady link in an email message -- without even knowing that's what they are doing. Their decisions are guided by how they think about computer security, or their "mental models," which do not have to be technically correct to lead to desirable security behaviors [44]. In other words, sometimes even "wrong" mental models produce good security decisions. By eliminating the constraint that nontechnical users must become more like computer security experts to properly protect themselves, we believe that we can create more effective ways of helping home computer users make good security decisions. To that end, we propose a research agenda that will help us learn how to shape the mental models of regular non-technical computer users.

In an online experiment, I apply theory from psychology and communications to find out whether group information management tasks are governed by the same communication processes as conversation. This paper describes results that replicate previous research, and expand our knowledge about audience design and packaging for future reuse when communication is mediated by a co-constructed artifact like a file-and-folder hierarchy. Results indicate that it is easier for information consumers to search for files in hierarchies created by information producers who imagine their intended audience to be someone similar to them, independent of whether the producer and consumer actually share common ground. This research helps us better understand packaging choices made by information producers, and the direct implications of those choices for other users of group information systems.

Group information repositories are systems for storing and organizing files in a central location all group members can access. The functionality and capabilities of these systems are essentially the same as the desktop metaphor of personal information management (PIM) systems. Using a case study of a group information repository, I argue that social factors affect the information structure of the repository, and how it grows and evolves over time. Users restrict their activities to files they own, are reluctant to delete files that might be useful to others, dislike the clutter that results, and can become demotivated if no one views files they uploaded.

Collaborative tagging systems have the potential to produce socially constructed information organization schemes. The effectiveness of tags for finding and re-finding information depends upon how individual users choose tags; however, influences on users' tag choices are poorly understood. We quantitatively test competing hypotheses from the literature concerning these choices, using data from del.icio.us (a collaborative tagging system for organizing web bookmarks) and a computer model of possible tag choice strategies. We find evidence that users choose tags in a pattern consistent with personal information management goals, rather than as a result of social influence.

Video connections can establish a media space in which games may be played, just as people play games while collocated. Experiments with participants playing the game 'Mafia' indicate that people in a video condition have similar levels of satisfaction, fun, and frustration, to those that play while collocated. This finding holds for both those with prior experience using video systems and those without, suggesting it is not merely a "novelty effect." Results differ about whether there exist differences in focus of attention, suspicion/trust, and pointing for people playing the game while using a video system. Implications for both fun and work uses of video are suggested.

Head-mounted displays for virtual environments facilitate an immersive experience that seems more real than an experience provided by a desk-top monitor [18]; however, the cost of head-mounted displays can prohibit their use. An empirical study was conducted investigating differences in spatial knowledge learned for a virtual environment presented in three viewing conditions: head-mounted display, large projection screen, and desk-top monitor. Participants in each condition were asked to reproduce their cognitive map of a virtual environment, which had been developed during individual exploration of the environment along a predetermined course. Error scores were calculated, indicating the degree to which each participant's map differed from the actual layout of the virtual environment. No statistically significant difference was found between the head-mounted display and large projection screen conditions. An implication of this result is that a large projection screen may be an effective, inexpensive substitute for a head-mounted display.