Abstract Evidence from data breach reports shows that many competent software development teams still do not implement secure, privacy-preserving software, even though techniques to do so are now well-known. A major factor causing this is simply a lack of priority and resources for security, as decided by product managers. So, how can we help developers and product managers to work together to achieve appropriate decisions on security and privacy issues? This paper explores using structured workshops to support teams of developers in engaging product managers with software security and privacy, even in the absence of security professionals. The research used the Design Based Research methodology. This paper describes and justifies our workshop design and implementation, and describes our thematic coding of both participant interviews and workshop discussions to quantify and explore the workshops’ effectiveness. Based on trials in eight organizations, involving 88 developers, we found the workshops effective in helping development teams to identify, promote, and prioritize security issues with product managers. Comparisons between organizations suggested that such workshops are most effective with groups with limited security expertise, and when led by the development team leaders. We also found workshop participants needed minimal guidance to identify security threats, and a wide range of ways to promote possible security improvements. Empowering developers and product managers in this way offers a powerful grassroots approach to improve software security worldwide.

Within Computer Science (CS) education, women have long been underrepresented. In the UK, women make up less than 20% of CS students at A-Level and undergraduate level. The lack of diversity within CS has become well-studied, often through quantitative surveys of female CS students or evaluations of different pedagogical or cultural interventions aimed to increase diversity and inclusivity. However, there have been far fewer studies that explore the experiences of female CS students at a more in-depth, qualitative level. This paper reports on the results of 15 in-depth semi-structured interviews with first year female CS undergraduate students at a UK university. Several of our findings are consistent with much existing research, such as the prevalence of gendered CS stereotypes and a lack of confidence. However, we also find two key strategies by which female Computer Science students navigate their minority experience that have not been given much prior attention. Firstly, we find that female CS students find it hard to articulate their minority experience without utilising the linguistic device of hedging. Asked about their experiences as a minority, participants would often mention a negative feeling in relation to this situation, followed quickly by a diminishing clause- 'it's a bit weird, but it's ok'. Secondly, participants tended to individualise the problem, stressing the importance of their own individual responsibility to fit into CS and succeed, despite having sometimes experienced discrimination or sexism. We conclude by considering the implications of these findings for educators.

Summary Though some software development teams are highly effective at delivering security, others either do not care or do not have access to security experts to teach them how. Unfortunately, these latter teams are still responsible for the security of the systems they build: systems that are ever more important to ever more people. We propose that a series of lightweight interventions, six hours of facilitated workshops delivered over three months, can improve a team's motivation to consider security and awareness of assurance techniques, changing its security culture even when no security experts are involved. The interventions were developed after an Appreciative Inquiry and Grounded Theory survey of security professionals to find out what approaches work best. We tested the interventions in a participatory action research field study where we delivered the workshops to three software development organizations and evaluated their effectiveness through interviews beforehand, immediately afterwards, and after twelve months. We found that the interventions can be effective with teams with limited or no security experience and that improvement is long‐lasting. This approach and the learning points arising from the work here have the potential to be applied in many development teams, improving the security of software worldwide.

As in all collaborative work, trust is a vital ingredient of successful computer supported cooperative work, yet there is little in the way of design principles to help practitioners develop systems that foster trust. To address this gap, we present a set of design patterns, based on our experience designing systems with the explicit intention of increasing trust between stakeholders. We contextualize these patterns by describing our own learning process, from the development, testing and refinement of a trust model, to our realization that the insights we gained along the way were most usefully expressed through design patterns. In addition to a set of patterns for trust, this paper seeks to demonstrate of the value of patterns as a means of communicating the nuances revealed through ethnographic investigation.

Research into the values motivating unsustainable behavior has generated unique insight into how NGOs and environmental campaigns contribute toward successfully fostering significant and long-term behavior change, yet thus far this research has not been applied to the domain of sustainable HCI. We explore the implications of this research as it relates to the potential limitations of current approaches to persuasive technology, and what it means for designing higher impact interventions. As a means of communicating these implications to be readily understandable and implementable, we develop a set of antipatterns to describe persuasive technology approaches that values research suggests are unlikely to yield significant sustainability wins, and a complementary set of patterns to describe new guidelines for what may become persuasive technology best practice.

This paper challenges the sustainable HCI community to move away from a focus on demand and instead address climate change as a supply problem. We identify a new route to impact, namely addressing the psychological barriers that interfere with political mobilization toward limiting the use of fossil fuels. Five barriers are explored as a means of re-focusing research objectives for the community.

Driven by changes in working practices and technology trends, organizations are increasingly reliant on mobile workers and the data they capture. However, while significant work has been carried out on increasing the usability of mobile devices and applications, little attention has been paid to the quality of data captured by mobile workers. If this data is inaccurate or untrustworthy, serious consequences can ensue. In this paper we study a system targeted at mobile workers in the highways sector that is deliberately designed to increase the accuracy and trustworthiness of the data collected. The resulting Inspections application has been very positively received by workers and we present lessons that we believe can be applied to other applications of this type.

This paper develops a holistic framework of questions which seem to motivate sustainability research in computing in order to enable new opportunities for critique. Analysis of systematically selected corpora of computing publications demonstrates that several of these question areas are well covered, while others are ripe for further exploration. It also provides insight into which of these questions tend to be addressed by different communities within sustainable computing. The framework itself reveals discursive similarities between other existing environmental discourses, enabling reflection and participation with the broader sustainability debate. It is argued that the current computing discourse on sustainability is reformist and premised in a Triple Bottom Line construction of sustainability. A radical, Quadruple Bottom Line alternative is explored as a new vista for computing research.

1 Computing Department, Lancaster University, UK