The popularization of video security devices promises to improve security in and outside people's home, yet they also expose their owners, neighbors and visitors to privacy risks. Most studies have focused on the primary users’ privacy, yet we know the implications of such technology span far beyond the individual into the wider neighborhood. Utilizing a combinatorial matrix survey, guided by Contextual Integrity Theory, we explore how people manage privacy in relation to these devices within the context of their own neighborhood. We demonstrate that in this neighborhood context, privacy management is socially situated, shaped primarily by transmission principles (e.g., whether footage is shared for security or gossip purposes), and nuanced by social factors related to the individual (e.g., social class), and their neighborhood (e.g., closeness to the neighborhood community). We highlight that privacy norms are not stable individual constructs but emergent, context-dependent, and collectively managed concepts, thereby contributing to work on Contextual Integrity Theory by applying it to a group-level context—neighborhoods. This work has several implications for product design and policy that prioritizes privacy beyond the individual.

Cyber attacks are increasing in frequency year by year, presenting a substantial and growing threat to the security of organisations (Verizon, 2023). (Spear) phishing—or the practice of sending (targeted) fraudulent emails to employees—is one means by which cyber attackers attempt to infiltrate secure systems. These messages typically exploit vulnerabilities in human decision-making, aiming to elicit sensitive information or distribute malware via fraudulent emails. Although various factors including individual, cultural, environmental, and message-related factors are known to influence susceptibility to phishing emails, current understanding of the nature of their interplay remains severely limited (Williams et al., 2017a).Addressing this gap, the current study investigates the role of habit in the context of phishing susceptibility, leveraging data from the pilot launch of PhiT. This tool—a collaboration between the UK’s National Protective Security Authority (NPSA), the authors, and other stakeholders—is a sophisticated browser-based simulated email client for ecologically valid research and training on phishing. PhiT provides realistic scenarios for roles such as IT Specialist, HR Assistant, and Procurement Manager, and has extensive data-gathering capabilities, facilitating a nuanced exploration of email interaction patterns and their impact on phishing vulnerability.While engaging with emails in an automatic, habitual way can be detrimental to one’s ability to spot phishing emails, the current study explores whether certain ‘good’ security habits, like consistently verifying sender email addresses, might offer protective benefits. We explore patterns in participants’ email interactions using Markov chains and k-medoids clustering. Our analysis indicates that individuals who reliably verify sender email addresses may be less likely to fall for phishing attacks. However, correlations between sender checks and phishing rates were significant only in the IT specialist scenario, suggesting role-specific differences in the effectiveness of this security behaviour. The various critical implications of this finding for cybersecurity research and practice are discussed in the context of habit theory. Based on this, we suggest that future research should explore the possibility of ‘cue engineering’—making changes to the UI with the aim of facilitating habit formation by designing better cues.

Researchers have been debating whether our online identities are different from our offline identities since technology enabled us to operate in the digital space. This paper advances the online-offline debate by utilizing Natural Language Processing (NLP) techniques to compare identity-related statements across online and offline contexts. Participants (N = 120) completed twenty “I am…” statements in two conditions: one reflecting online identity and one reflecting offline identity. Distinct linguistic patterns in textual data were identified using TF-IDF and LIWC, with statistical differences determined using Fisher test and t- tests, respectively. The results revealed that online identity statements emphasized themes of (anonymous) connectivity and knowledge, whereas offline identity statements focused on personal relationships and physical and emotional states. These findings suggest that, despite blurring boundaries between online and offline worlds, individuals continue to present their identities in contextually distinct ways. This research provides insights into the conceptualization of identity and highlights the need to design digital spaces that better balance connectivity with opportunities for deeper emotional and relational engagement.

The use of digital banking has increased over the last decade, with children's banking services and apps now being offered by both digital and traditional banks. However, no academic research has explored how the design of digital banking has influenced family financial behaviour or evaluated how these online family banking services are meeting the needs of their customers. To address this research gap, an exploratory study has been designed to develop an understanding of children's online financial behaviour. The study will conduct at least 30 semi-structured interviews with adolescents (between the ages of 13-17), as well as parents and guardians, to gain insight into their experiences and challenges when using digital banking services. Furthermore, this study is the first step in understanding how families use online banking services and identifying potential limitations in their current designs.

Computer security incident response teams (CSIRTs) are critical to maintaining business continuity in the face of cyber-attacks. Yet there has been little research conducted in the last decade to understand the root causes of the challenges they face to sustain their effectiveness. Moreover, they operate in complex sociotechnical multiteam systems, making it challenging to understand the causes of problems and how to bring about improvements. This paper proposes the use of a Systemic Design approach to develop a more in-depth understanding of the complex sociotechnical system(s) of cyber security incident response, in order to find intervention points that can be leveraged in one area to transition the whole system into a better state. We present the first steps of a case study that uses Gigamap workshops and in-depth interviews with a range of stakeholders to frame the system and understand its effectiveness.

The idea that people should form positive security habits is gaining increasing attention amongst security practitioners. Habit is a well-studied concept in psychology, but the extent to which the richness of that literature has been fully utilised for security is currently unclear. In order to address this gap, we compared usage of the term “habit”—and connected constructs —in the cybersecurity and habit fields using a co-occurrence networks-based analysis. We aimed to answer three research questions: 1. What is the context within which habit has been discussed in the habit literature and the cybersecurity literature; 2. How does the discussion in these two fields compare; and 3. What are the implications of the outcomes of this analysis for the future research agenda for cybersecurity behaviour? The analysis showed that the habit construct tended to be discussed primarily in the context of other models, rather than on its own. The depth of discussion was therefore limited; resulting gaps in knowledge have important implications for security, like the idea that habits moderate the relationship between intention and behaviour. Given the popularity of the theory of planned behaviour in security research, this represents a key omission. Furthermore, the cybersecurity literature we surveyed contained very little discussion surrounding methods for formation and changing of habits, nor of the role of cues in triggering habitual behaviours. Habits require a different behaviour change approach than intentional behaviours, and many day-to-day security behaviours may in fact be habits. For that reason, these topics represents a potentially productive avenue of research for both security and privacy behaviour.

Phishing emails provide a means to infiltrate the technical systems of organisations by encouraging employees to click on malicious links or attachments. Despite the use of awareness campaigns and phishing simulations, employees remain vulnerable to phishing emails. The present research uses a mixed methods approach to explore employee susceptibility to targeted phishing emails, known as spear phishing. In study one, nine spear phishing simulation emails sent to 62,000 employees over a six-week period were rated according to the presence of authority and urgency influence techniques. Results demonstrated that the presence of authority cues increased the likelihood that a user would click a suspicious link contained in an email. In study two, six focus groups were conducted in a second organisation to explore whether additional factors within the work environment impact employee susceptibility to spear phishing. We discuss these factors in relation to current theoretical approaches and provide implications for user communities.

Items in social media such as photos may be co-owned by multiple users, i.e., the sharing decisions of the ones who upload them have the potential to harm the privacy of the others. Previous works uncovered coping strategies by co-owners to manage their privacy, but mainly focused on general practices and experiences. We establish an empirical base for the prevalence, context and severity of privacy conflicts over co-owned photos. To this aim, a parallel survey of pre-screened 496 uploaders and 537 co-owners collected occurrences and type of conflicts over co-owned photos, and any actions taken towards resolving them. We uncover nuances and complexities not known before, including co-ownership types, and divergences in the assessment of photo audiences. We also find that an all-or-nothing approach seems to dominate conflict resolution, even when parties actually interact and talk about the conflict. Finally, we derive key insights for designing systems to mitigate these divergences and facilitate consensus.

Increasingly, connected communication technologies have resulted in people being exposed to fraudulent communications by scammers and hackers attempting to gain access to computer systems for malicious purposes. Common influence techniques, such as mimicking authority figures or instilling a sense of urgency, are used to persuade people to respond to malevolent messages by, for example, accepting urgent updates. An ‘accept’ response to a malevolent influence message can result in severe negative consequences for the user and for others, including the organisations they work for. This paper undertakes exploratory research to examine individual differences in susceptibility to fraudulent computer messages when they masquerade as interruptions during a demanding memory recall primary task compared to when they are presented in a post-task phase. A mixed-methods approach was adopted to examine when and why people choose to accept or decline three types of interrupting computer update message ( genuine , mimicked , and low authority ) and the relative impact of such interruptions on performance of a serial recall memory primary task. Results suggest that fraudulent communications are more likely to be accepted by users when they interrupt a demanding memory-based primary task, that this relationship is impacted by the content of the fraudulent message, and that influence techniques used in fraudulent communications can over-ride authenticity cues when individuals decide to accept an update message. Implications for theories, such as the recently proposed Suspicion, Cognition and Automaticity Model and the Integrated Information Processing Model of Phishing Susceptibility, are discussed.

In recent years, technological innovation has re‐ignited an interest in privacy as designers, policy makers, and users each strive to reconcile the advantages of technology with the new demands they pose for privacy. Driven by a classic approach to defining concepts, scholars have not been able to agree on a unified definition of privacy. This poses a barrier to those who seek to implement privacy through their decisions. A critical component of their work involves anticipating and responding to potential privacy risks. In choosing one definition over another, practitioners might be missing nuanced contextual overlaps that bear on privacy and thus bias their subsequent decisions. For these practical endeavors, it is important to adopt an inclusive and rich definition. Such a definition should also be responsive to how those affected by decisions that might compromise privacy, namely citizens and technology users, conceive of privacy. The present paper applies a prototype perspective on privacy that acknowledges the fuzziness of concepts and goes on to develop such a definition in a series of empirical studies. The relevance of the privacy prototype is then explored as it applies to privacy theorists, practitioners, and methodologists, suggesting new avenues for future research.

A number of commercial location tracking systems exist which enable parents to monitor where their children are when outdoors. The adoption of these services and whether, through their design, they reflect parental values has not been investigated. This question was pursued with a large-scale survey of 920 parents from the UK. The use of location tracking was not prevalent amongst parents and only a minority had considered using these technologies. Parents favoring location tracking described it in the context of security, peace of mind and the need to reduce uncertainty. Parents who were against location tracking described a general lack of need as they had established reliable mechanisms for security and valued trust in the family as well as children's self-direction. Our findings show that location tracking concurrently supports and threatens parental values. By focusing on the values it undermines, we are able to suggest new directions for location systems.

Abstract An online diary study was performed to investigate deception across different media. One hundred and four individuals participated in the study, with 76 completing the diaries. Individuals were most likely to lie on the telephone. Planned lies, which participants also rated the most serious, were more likely told via SMS (short message service) text messaging. Most lies were told to people participants felt closest to. The feature‐based model provides a better account of the deceptions reported by participants than do media richness theory or social distance theory. However, the authors propose a reworked feature‐based model to explain deception across different media. They suggest that instant messaging should be treated as a near synchronous mode of communication. We suggest that the model needs to distinguish between spontaneous and planned lies.

Privacy is frequently a key concern relating to technology and central to HCI research, yet it is notoriously difficult to study in a naturalistic way. In this paper we describe and evaluate a dictionary of privacy designed for content analysis, derived using prototype theory and informed by traditional theoretical approaches to privacy. We evaluate our dictionary categories alongside privacy-related categories from an existing content analysis tool, LIWC, using verbal discussions of privacy issues from a variety of technology and non-technology contexts. We find that our privacy dictionary is better able to distinguish between privacy and non-privacy language, and is less context-dependent than LIWC. However, the more general LIWC categories are able to describe a greater amount of variation in our data. We discuss possible improvements to the privacy dictionary and note future work.

A growing body of research has been exploring the use of control mechanisms to address the privacy concerns raised by location-tracking technology. We report on a qualitative study of two family groups who used a custom-built tracking application for an extended period of time. Akin to sociological breaching experiments, the study focuses on the interferences between location tracking and relationship management. We analyze the tensions that can arise between affordances of the technology and uses that the contracts between family members legitimize. We describe how, by fostering misperceptions and 'nudging' behaviors, location-tracking technology can generate anxieties and conflicts even in close relationships. We discuss their vulnerability to the overreaching effects of tracking, against which the use of mechanisms such as location-sharing preferences and feedback may not be socially viable.

Abstract This article presents the privacy dictionary, a new linguistic resource for automated content analysis on privacy‐related texts. To overcome the definitional challenges inherent in privacy research, the dictionary was informed by an inclusive set of relevant theoretical perspectives. Using methods from corpus linguistics, we constructed and validated eight dictionary categories on empirical material from a wide range of privacy‐sensitive contexts. It was shown that the dictionary categories are able to measure unique linguistic patterns within privacy discussions. At a time when privacy considerations are increasing and online resources provide ever‐growing quantities of textual data, the privacy dictionary can play a significant role not only for research in the social sciences but also in technology design and policymaking.

How can we best explore the range of users' reactions when developing future technologies that may be controversial, such as personal healthcare systems? Our approach -- ContraVision -- uses futuristic videos, or other narrative forms, that convey either negative or positive aspects of the proposed technology for the same scenarios. We conducted a user study to investigate what range of responses the different versions elicited. Our findings show that the use of two systematically comparable representations of the same technology can elicit a wider spectrum of reactions than a single representation can. We discuss why this is so and the value of obtaining breadth in user feedback for potentially controversial technologies.

Author biographies Adam Joinson is a psychologist with interests in information systems, computermediated communication and privacy; he is a senior lecturer in Information Systems in the School of Management at the University of Bath Ulf-Dietrich Reips is a psychologist with interests in Internet-based research methodology (particularly experimental methodology); he is Assistant professor (Oberassistent) in the Department of Psychology, University of Zürich. Tom Buchanan is a psychologist with interests in Internet behavior; he is Reader in

When an offence occurs, the victim and offender can overcome the harm done through forgiveness. This paper demonstrates how forgiveness can be supported in social system design. We first describe what forgiveness is, how it is motivated and what benefits follow from forgiveness. Based on this theoretical analysis, we propose five provisions to guide designers who want to encourage reparation in social systems.

Mobile privacy concerns are central to Ubicomp and yet remain poorly understood. We advocate a diversified approach, enabling the cross-interpretation of data from complementary methods. However, mobility imposes a number of limitations on the methods that can be effectively employed. We discuss how we addressed this problem in an empirical study of mobile social networking. We report on how, by combining a variation of experience sampling and contextual interviews, we have started focusing on a notion of context in relation to privacy, which is subjectively defined by emerging socio-cultural knowledge, functions, relations and rules. With reference to Gieryn's sociological work, we call this place, as opposed to a notion of context that is objectively defined by physical and factual elements, which we call space. We propose that the former better describes the context for mobile privacy.

No abstract available.

This paper investigates the uses of social networking site Facebook, and the gratifications users derive from those uses. In the first study, 137 users generated words or phrases to describe how they used Facebook, and what they enjoyed about their use. These phrases were coded into 46 items which were completed by 241 Facebook users in Study 2. Factor analysis identified seven unique uses and gratifications: social connection, shared identities, content, social investigation, social network surfing and status updating. User demographics, site visit patterns and the use of privacy settings were associated with different uses and gratifications.

Three studies investigated whether users' strategies for customising online avatars increase their self-focused attention, also known as private self-awareness. Study 1 showed that a high number of users adapt their avatars toreflect their own appearance. Study 2 demonstrated that users who perceive their avatars to be similar to their own appearance experience as a result heightened private self-awareness. In Study 3, private self-awareness pervadedsocial interaction taking place over time when users with representative avatars, compared to a control group, reported increased private self-awareness. Drawing from research in interpersonal communication, we suggest that avatars which increase their owners' self-focus may have an influence on online behavior in the context of social computing.

Abstract As the Internet grows in importance, concerns about online privacy have arisen. The authors describe the development and validation of three short Internet‐administered scales measuring privacy‐related attitudes (Privacy Concern) and behaviors (General Caution and Technical Protection). In Study 1, 515 people completed an 82‐item questionnaire from which the three scales were derived. In Study 2, scale validity was examined by comparing scores of individuals drawn from groups considered likely to differ in privacy‐protective behaviors. In Study 3, correlations between the scores on the current scales and two established measures of privacy concern were examined. The authors conclude that these scales are reliable and valid instruments suitable for administration via the Internet, and present them for use in online privacy research.