Smart cities are often presented as modern, sustainable, and efficient environments that enhance safety and convenience through advanced technologies. However, their heavy reliance on data collection raises significant privacy concerns. As technology evolves faster than public awareness, questions emerge about whether these cities adequately protect individuals’ data. This study explores residents’ understanding of smart cities and their perceptions of data collection and sharing. In this study, we conduct semi-structured interviews with 19 residents across two countries to examine how people conceptualise smart cities and interpret the collection, processing, and sharing of their data. Our analysis shows that residents hold fragmented and often inaccurate mental models of smart-city infrastructures; view data practices as simultaneously beneficial and risky; and lack meaningful clarity about data flows, retention, and institutional responsibility. Participants considered consent important yet mostly infeasible given the pervasive and unavoidable nature of smart-city data collection. We also identify culturally grounded differences in trust, privacy sensitivities, and expectations of governance across the two contexts. Our findings challenge assumptions embedded in current smart-city governance and consent models and point to the need for transparent, accountable, and contextually attuned data practices.

Data protection Impact Assessments (DPIA) are used to assess how well a series of design choices safeguard the privacy concerns of data subjects, but they don’t address how to analyse privacy conflicts. The challenge with current work on privacy conflict is the necessity to understand the perceived levels of sensitivity to facilitate negotiations. It is unclear how this can be achieved in DPIA procedure. In this work we introduce our model checking tool along with our method to address privacy conflict. We present our evaluation plan before concluding with our research roadmap.

With the parallel growth of the Android operating system and mobile malware, one of the ways to stay protected from mobile malware is by observing the permissions requested. However, without careful consideration of these permissions, users run the risk of an installed app being malware, without any warning that might characterize its nature. We propose a permission-based risk signal using a taxonomy of sensitive permissions. Firstly, we analyse the risk of an app based on the permissions it requests, using a permission sensitivity index computed from a risky permission set. Secondly, we evaluate permission mismatch by checking what an app requires against what it requests. Thirdly, we evaluate security rules based on our metrics to evaluate corresponding risks. We evaluate these factors using datasets of benign and malicious apps (43580 apps) and our result demonstrates that the proposed framework can be used to improve risk signalling of Android apps with a 95% accuracy.

There have been concerting policy and legal initiatives to mitigate the privacy harm resulting from badly designed software technology. But one main challenge to realizing these initiatives is the difficulty in translating proposed principles and regulations into concrete and verifiable evidence in technology. This is partly due to the lack of systematic techniques and tools to address privacy in the software design, hence making it difficult for the designer to measure disclosure risk in a more intuitive way, taking into account the privacy objective that matters to each end user. To bridge this gap, we propose a framework for verifying the satisfaction of user privacy objectives in software design. Our approach is based on the (un)awareness that users acquire when information is disclosed, as it relates to the communication properties of objects in a design. This property is used to determine the expected privacy utility that users will derive from the design for a specified privacy objective. We demonstrate through case studies how this approach can help designers determine which design decision undermines users’ privacy expectations and better design alternatives.

User reluctance and context-dependent factors during information disclosure imply that people cannot always be counted on to indicate their appropriate privacy preference. This phenomenon is the well-known 'privacy paradox', which shows that users of modern technologies are constantly concerned about their privacy, but do not apply these concerns to their usage behaviour accordingly. The problem is that this mismatch between privacy concerns and the indicated privacy preference in software, is not considered when reasoning about the satisfaction of privacy requirements.

Applications that continuously gather and disclose personal information about users are increasingly common. While disclosing this information may be essential for these applications to function, it may also raise privacy concerns. Partly, this is due to frequently changing context that introduces new privacy threats, and makes it difficult to continuously satisfy privacy requirements. To address this problem, applications may need to adapt in order to manage changing privacy concerns. Thus, we propose a framework that exploits the notion of privacy awareness requirements to identify runtime privacy properties to satisfy. These properties are used to support disclosure decision making by applications. Our evaluations suggest that applications that fail to satisfy privacy awareness requirements cannot regulate users' information disclosure. We also observe that the satisfaction of privacy awareness requirements is useful to users aiming to minimise exposure to privacy threats, and to users aiming to maximise functional benefits amidst increasing threat severity.

In a dynamic environment where context changes frequently, users’ privacy requirements can also change. To satisfy such changing requirements, there is a need for continuous analysis to discover new threats and possible mitigation actions. A frequently changing context can also blur the boundary between public and personal space, making it difficult for users to discover and mitigate emerging privacy threats. This challenge necessitates some degree of self-adaptive privacy management in software applications.

Security is primarily concerned with protecting assets from harm. Identifying and evaluating assets are therefore key activities in any security engineering process - from modeling threats and attacks, discovering existing vulnerabilities, to selecting appropriate countermeasures. However, despite their crucial role, assets are often neglected during the development of secure software systems. Indeed, many systems are designed with fixed security boundaries and assumptions, without the possibility to adapt when assets change unexpectedly, new threats arise, or undiscovered vulnerabilities are revealed. To handle such changes, systems must be capable of dynamically enabling different security countermeasures. This paper promotes assets as first-class entities in engineering secure software systems. An asset model is related to requirements, expressed through a goal model, and the objectives of an attacker, expressed through a threat model. These models are then used as input to build a causal network to analyze system security in different situations, and to enable, when necessary, a set of countermeasures to mitigate security threats. The causal network is conceived as a runtime entity that tracks relevant changes that may arise at runtime, and enables a new set of countermeasures. We illustrate and evaluate our proposed approach by applying it to a substantive example concerned with security of mobile phones.

Privacy requirements for mobile applications offer a distinct set of challenges for requirements engineering. First, they are highly dynamic, changing over time and locations, and across the different roles of agents involved and the kinds of information that may be disclosed. Second, although some general privacy requirements can be elicited a priori, users often refine them at runtime as they interact with the system and its environment. Selectively disclosing information to appropriate agents is therefore a key privacy management challenge, requiring carefully formulated privacy requirements amenable to systematic reasoning. In this paper, we introduce privacy arguments as a means of analysing privacy requirements in general and selective disclosure requirements (that are both content- and context-sensitive) in particular. Privacy arguments allow individual users to express personal preferences, which are then used to reason about privacy for each user under different contexts. At runtime, these arguments provide a way to reason about requirements satisfaction and diagnosis. Our proposed approach is demonstrated and evaluated using the privacy requirements of BuddyTracker, a mobile application we developed as part of our overall research programme.

This paper presents SecuriTAS, a tool to engineer adaptive security. It allows software designers to model security concerns together with the requirements of a system. This model is then used at runtime to analyze changes in security concerns and select the best set of security controls necessary to protect the system.

Adaptation requires a system to monitor its operational context to ensure that when changes occur, a suitable adaptation action is planned and taken at runtime. The ultimate goal of adaptation is that users get their dynamic requirements met efficiently and correctly. Context changes and users' judgment of the role of the system in meeting their requirements are drivers for adaptation. In many cases, these drivers are hard to identify by designers at design time and hard to monitor by the use of exclusively technological means by the system at runtime. In this paper, we propose Social Sensing as the activity performed by users who act as monitors and provide information needed for adaptation at runtime. Such information helps the system cope with technology limitations and designers' uncertainty. We discuss the motivation and foundations of Social Sensing and outline a set of research challenges to address in future work.

Abstract Software development projects are inherently cooperative, requiring many developers to coordinate their efforts to produce complex systems. An integral part of this process is the development and maintenance of a shared understanding concerning the state of software project tasks, artefacts, and the activities and expertise of developers working on the project. In co‐located settings, this vitalawareness informationthat concerns developers, either directly or tangentially, is typically acquired using formal, regular meetings, informal personal interruptions and electronic communication. Developing and maintaining such an awareness are far more difficult in distributed teams where developers are separated by time and space. The goal of this review is to help bridge the gap between the theoretical benefits of distributed collaborative software development and the practical impediments to successful implementation, and more specifically, achieving similar levels of awareness in distributed settings to those available in co‐located settings. The review starts with a detailed discussion of awareness and awareness types with particular relevance to collaboration. This is followed by a discussion of how awareness information is disseminated during collaborative processes. Awareness information needs and dissemination mechanisms in software development teams are then presented. The main contribution of the review, derived from a comparison of awareness needs in distributed collaborative software engineering and current support from tools and techniques, is that more support is required for the type of awareness known ascontext awareness. Context awareness crosscuts other (more basic) forms of awareness and arises because, over time, individual collaborators work on different sets of tasks and artefacts and form different perceptions of their colleagues; their colleagues' work, roles, and relationships; and, the workspace. This awareness is highlycontextualand therefore cannot be generalized across individuals, entities or activities that are found in a collaboration space. Copyright © 2010 John Wiley & Sons, Ltd.

Requirements traceability is a challenge for modern software projects where task dependencies and technical expertise are spread across system developers, abstract model representations such as use cases, and a myriad of code artefacts. This paper presents an approach that monitors the navigation trails left by developers when building code artefacts to realise project use cases. These trails are analysed to generate a relevance ranking of entities that constitute a traceability link between uses cases and code artefacts and the developers responsible for them. Investigation in a software development scenario shows that a range of use case traceability questions can be answered through visualisations which present ordered relevance lists of the entities associated with use cases and by the use of trace graphs where the size of nodes show the importance, or 'information centrality', of system entities.

Software development is a global activity unconstrained by the bounds of time and space. A major effect of this increasing scale and distribution is that the shared understanding that developers previously acquired by formal and informal face-to-face meetings is difficult to obtain. This paper proposes a shared awareness model that uses information gathered automatically from developer IDE interactions to make explicit orderings of tasks, artefacts and developers that are relevant to particular work contexts in collaborative, and potentially distributed, software development projects. The research findings suggest that such a model can be used to: identify entities (developers, tasks, artefacts) most associated with a particular work context in a software development project; identify relevance relationships amongst tasks, developers and artefacts e.g. which developers and artefacts are currently most relevant to a task or which developers have contributed to a task over time; and, can be used to identify potential bottlenecks in a project through a ‘social graph’ view. Furthermore, this awareness information is captured and provided as developers work in different locations and at different times.

Today's large software projects are often characterised by distributed environments with numerous developers separated in space and/or time. This separation means that the common understanding and tacit knowledge that is a feature of closely co-located project teams is very hard to come by. As a consequence, relatively simple tasks such as identifying functionally related modules or finding individuals who are experts in aspects of the system become more challenging and time-consuming. This paper presents a continuum of relevance index (CRI) model that uses information gathered from developer IDE interactions to generate orderings of relevant tasks, project artefacts and developers. A case study is used to demonstrate how the model can be used to attain a shared knowledge and common understanding of the extent to which tasks, artefacts and developers are relevant in a group development work context.