People-centred security is critical for the security of an organisation, but we know that it comes at a cost. Recently the academic literature base has started to focus on how security might be understood and promoted as a facet of the overall culture of an organisation. This work sets out to understand the experiences of employees and management when using an anonymous online discussion platform to discuss cybersecurity policies. Following a 2-week deployment in a large UK educational institution, we found that anonymity helped individuals share their experiences, and that these experiences helped others understand more about the rationale for security policies. However, we also found that anonymity negatively impacted on individuals’ ability to discuss specific problems and follow up on incidents. We discuss the opportunities and challenges of using anonymous discussion platforms in organisations for improving the security culture through social participation and a more transparent listening culture.

Cybersecurity is a critical global challenge as organisations face increasingly sophisticated threats. While technical solutions remain essential, human decision-making plays a central role in determining cybersecurity outcomes. This study examines how individuals adopt cyberinsurance and protection measures, focusing on whether their decisions align with rational choice models. Using an online economic experiment with 4800 participants across four countries, we analyse purchasing behaviours and subsequent online security practices under varying scenarios of attack intentionality and pricing strategies. Our findings reveal that individuals deviate from expected utility maximisation, often choosing overprotective strategies with higher levels of insurance and security than economically optimal. We also find that contrary to concerns about moral hazard, insured individuals do not exhibit riskier behaviour post-adoption; instead, they maintain or enhance their security practices. Additionally, pricing mechanisms that link insurance premiums to protection levels promote more rational decision-making. These results highlight the interplay between human heuristics and cybersecurity strategies, suggesting that interventions must account for cognitive biases while designing effective cyberinsurance products and policies. This research contributes to the literature on behavioural economics in cybersecurity, offering insights into how decision-making frameworks can support more secure online environments.

The broader adoption of social media platforms (e.g., TikTok), combined with recent developments in Generative AI (GAI) technologies has had a transformative effect on many peoples’ ability to confidently assess the veracity and meaning of information online. In this paper, building on recent related work that surfaced the social ways that young people evaluate information online, we explore the decision-making practices, challenges and heuristics involved in young adults’ assessments of information online. To do so, we designed and conducted a novel digital diary study, followed by data-informed interviews with young adults. Our findings uncover the information practices of young adults including the social and emotional motivations for ignoring, avoiding, and engaging with online information and the ways this is entangled with collaborative arrangements with algorithms as agents. In our discussion we bring these findings in close dialogue with work on information sensibility and contribute rich insights into young peoples’ information sensibility practices embedded within social worlds. Finally, we surface how such practices are attuned to prioritise wellbeing over convenience or other commonly associated sufficing heuristics.

Individuals within organisations necessarily hold data including personal identifiable data, for individuals with a tendency to accumulate digital data and a reluctance to delete it, there is greater potential for data to be stored. Therefore, understanding why people engage in digital hoarding and how they respond to the mitigations put in place is important. Eleven people working in a large commercial organisation scoring highly on a digital hoarding questionnaire, took part in focus groups to understand the extent to which they kept digital data. The focus groups also explored employee compliance with policies and procedures including knowledge of GDPR. Thematic analysis led to three themes: (1) Organisational culture versus digital hoarding tendency, (2) Thinking about personal data, and (3) Responsibility and control. The findings highlight different motivations for data hoarding including anxiety driven by ‘blame culture’ as participants respond to workplace challenges and the need to be accountable. Participants were aware of policies including GDPR but often used workarounds to keep data longer than specified in their information retention policies. Technical approaches to data reduction were often counterproductive. Findings are discussed in relation to potential threats of digital data hoarding and technical and non-technical approaches to reducing digital data retention.

Previous research on employee voice has sought to design technological solutions that address the challenges of speaking up in the workplace. However, effectively embedding employee voice systems in organisations requires designers to engage with the social processes, power relations and contextual factors of individual workplaces. We explore this process within a university workplace through a research project responding to a crisis in educational service delivery arising from the COVID-19 pandemic. Within a successful three-month staff-led engagement, we examined the intricacies of embedding employee voice, exploring how the interactions between existing actors impacted the effectiveness of the process. We sought to identify specific actions to promote employee voice and overcome barriers to its successful establishment in organisational decision-making. We highlight design considerations for an effective employee voice system that facilitates embedding employee voice, including assurance, bounded accountability and bias reflexivity.

Academics and community organisations are increasingly adopting co-research practices where participants contribute to qualitative data collection, analysis, and dissemination. These qualitative practices can often lack transparency that can present a problem for stakeholders (such as funding agencies) who seek evidence of the rigour and accountability in these decision-making processes. When qualitative research is done digitally, paradata is available as interaction logs that reveal the underlying processes, such as the time spent engaging with different segments of an interview. In practice, paradata is seldom used to examine the decisions associated with undertaking qualitative research. This paper explores the role of paradata arising from a four-month engagement with a community-led charity that used a digital platform to support their qualitative co-research project. Through observations of platform use and reflective post-deployment interviews, our findings highlight examples of paradata generated through digital tools in qualitative research, e.g., listening coverage, engagement rate, thematic maps and data discards. From this, we contribute a conceptualisation of paradata and discuss its role in qualitative research to improve process transparency, enhance data sharing, and to create feedback loops with research participants.

Phishing emails continue to be a major cause of cybersecurity breaches despite the development of technical measures designed to thwart these attacks. Most phishing studies have investigated desktop email platforms, but the use of mobile devices for email exchanges has soared in recent years, especially amongst young adults. In this paper, we explore how the digital platform (desktop vs. mobile) influences users' phish detection strategies. Twenty-one young adults (18-25 years) were asked to rate the legitimacy of emails using a live inbox test while using a think-aloud protocol on both platforms. Our results suggest that a lack of knowledge about key defence information on the mobile platform results in weak phish detection. We discuss the implications of these findings and offer design recommendations to support effective phish detection by smartphone users.

New students face challenges when they make the transition from school to university. Existing digital technologies used during this transition can sometimes increase the stressors associated with change. In order to explore ways forward for technology design in this space, we developed a brochure of questionable concepts. The concepts were grounded in findings of our prior research, yet were also intended to act as provocations to promote discussion in workshops involving 32 first year university students. Our analysis of workshop discussions documents the diverse issues students face around social bonding, their home environment, and their academic performance. Our findings challenge assumptions made in prior work about the ease of transition to university. We demonstrate how questionable concepts can play an important role in prompting 'safe' conversations around stressful life events for adolescents.

A growing body of work explores the well-being of students. However, little work has addressed the experiences of student mothers, who must juggle the demands of study and childcare simultaneously. The rise of the student mother is taking place at a time when student learning and engagement as well as childcare has become highly digitised. Existing literature on work/life balance suggests a key issue for student mothers is management of the work-family border, such that they can choose to segregate or blend roles as appropriate. In this study, we used work-family border theory to examine the role that technology plays in supporting both the segregation and blending of student and parent roles, making recommendations for the ways that boundary maintenance might be more explicitly considered in digital systems design.

Community engagements are qualitative processes that make use of participants local knowledge for democratic decision-making, but often exclude participants from data analysis and dissemination. This can mean that they are left feeling that their voice is not properly represented in the final output. This paper presents a digital community engagement process, TalkFutures, that actively involves participants in the production, distributed analysis and summarization of qualitative data. The design of TalkFutures was explored through a five-week deployment with the International Federation of Red Cross and Red Crescent Societies (IFRC) as part of a consultation designed to inform future strategy. Our analysis of deployment metrics and post-deployment interviews outline how TalkFutures: (i) increased modes of participation across the qualitative workflow; (ii) reduced barriers to participation; and (iii) improved representation in the engagement processes.

Employee voice and workplace democracy have a positive impact on employee wellbeing and the performance of organizations. In this paper, we conducted interviews with employees to identify facilitators and inhibitors for voice within the workplace and a corresponding set of appropriate qualities: Civility, Validity, Safety and Egalitarianism. We then operationalised these qualities as a set of design goals - Assured Anonymity, Constructive Moderation, Adequate Slowness and Controlled Access - in the design and development of a secure anonymous employee voice system. Our novel take on the Enterprise Social Network aims to foster good citizenship whilst also promoting frank yet constructive discussion. We reflect on a two-week deployment of our system, the diverse range of candid discussions that emerged around important workplace issues and the potential for change within the host organization. We conclude by reflecting on the ways in which our approach shaped discourse and supported the creation of a trusted environment for employee voice.

Public commentary related to reality TV can be overwhelmed by thoughtless reactions and negative sentiments, which often problematically reinforce the cultural stereotyping typically employed in such media. We describe the design, and month-long evaluation, of a mobile "second-screening" application, Screenr, which uses co-voting and live textual tagging to encourage more critical co-viewing in these contexts. Our findings highlight how Screenr supported interrogation of the production qualities and claims of shows, promoted critical discourse around the motivations of programmes, and engaged participants in reflecting on their own assumptions and views. We situate our results within the context of existing second-screening co-viewing work, discuss implications for such technologies to support critical engagement with socio-political media, and provide design implications for future digital technologies in this domain.

Older adults are increasingly vulnerable to cybersecurity attacks and scams. Yet we know relatively little about their understanding of cybersecurity, their information-seeking behaviours, and their trusted sources of information and advice in this domain. We conducted 22 semi-structured interviews with community-dwelling older adults in order to explore their cybersecurity information seeking behaviours. Following a thematic analysis of these interviews, we developed a cybersecurity information access framework that highlights shortcomings in older adults' choice of information resources. Specifically, we find that older users prioritise social resources based on availability, rather than cybersecurity expertise, and that they avoid using the Internet for cybersecurity information searches despite using it for other domains. Finally, we discuss the design of cybersecurity information dissemination strategies for older users, incorporating favoured sources such as TV adverts and radio programming.

We describe the iterative design, development and learning process we undertook to produce Gabber, a digital platform that aims to support distributed capture of spoken interviews and discussions, and their qualitative analysis. Our aim is to reduce both expertise and cost barriers associated with existing technologies, making the process more inclusive. Gabber structures distributed audio data capture, facilitates participatory sensemaking, and supports collaborative reuse of audio. We describe our design and development journey across three distinct field trials over a two-year period. Reflecting on the iterative design process, we offer insights into the challenges faced by non-experts throughout their qualitative practices, and provide guidance for researchers designing systems to support engagement in these practices.

We conducted an online experiment ( n = 2024) on a representative sample of internet users in Germany, Sweden, Poland, Spain and the UK to explore the effect of notifications on security behaviour. Inspired by protection motivation theory (PMT), a coping message advised participants on how to minimize their exposure to risk and a threat appeal highlighted the potential negative consequences of not doing so. Both increased secure behavior – but the coping message significantly more so. The coping message was also as effective as both messages combined, but not so the threat appeal. Risk attitudes, age and country had a significant effect on behavior. Initiatives seeking to promote secure behavior should focus more on coping messages, either alone or in combination with fear appeals.

HCI draws on a variety of traditions but recently there have been calls to consolidate contributions around the problems researchers set out to solve. However, with this comes the assumption that problems are tractable and certain, rather than constructed and framed by researchers. We take as a case study a Tumblr community of teen shoplifters who post on how to steal from stores, discuss shoplifting as political resistance, and share jokes and stories about the practice. We construct three different "problems" and imagine studies that might result from applying different design approaches: Design Against Crime; Critical Design and Value Sensitive Design. Through these studies we highlight how interpretations of the same data can lead to radically different design responses. We conclude by discussing problem making as a historically and politically contingent process that allow researchers to connect data and design according to certain moral and ethical principles.

Increasingly our digital traces are providing new opportunities for self-reflection. In particular, social media (SM) data can be used to support self-reflection, but to what extent is this affected by the form in which SM data is presented? Here, we present three studies where we work with individuals to transform or remediate their SM data into a physical book, a photographic triptych and a film. We describe the editorial decisions that take place as part of the remediation process and show how the transformations allow users to reflect on their digital identity in new ways. We discuss our findings in terms of the application of Goffman's (1959) self-presentation theories to the SM context, showing that a fluid rather than bounded interpretation of our social media spaces may be appropriate. We argue that remediation can contribute to the understanding of digital self and consider the design implications for new SM systems designed to support self-reflection.

Many social media platforms support the curation of personal digital data, and, more recently, the use of that data for review and reflection. We explored the process of reflection by asking users to create a meaningful ‘triptych’ of photographs drawn from their Facebook accounts. In a first study, we asked participants to manually trawl their own accounts and select three relevant images, which we then framed and used as an interview probe. In a second study, we designed an automated triptych generation system and assessed participants’ experiences of using this system. We conducted qualitative analyses of participant interviews from both studies. Consistent with other ‘slow technology’ work, we found the act of creating a physical artefact from social media data gave that data new meaning, albeit with notable differences between manual versus automatically generated triptychs. We conclude by discussing possible improvements to the design of the automated triptych system.

A number of interventions exist to support older adults in ageing well and these typically involve support for an active and sociable ageing process. We set out to examine the privacy implications of an intervention that would monitor mobility and share lifestyle and health data with a community of trusted others. We took a privacy-by-design approach to the system in the early stages of its development, working with older adults to firstly understand their networks of trust and secondly understand their privacy concerns should information be exchanged across that network. We used a Johari Windows framework in the thematic analysis of our data, concluding that the social sharing of information in later life carried significant risk. Our participants worried about the social signaling associated with data sharing and were cautious about a system that had the potential to disrupt established networks.

This paper considers how parents use the social media platform Instagram to facilitate the capture, curation and sharing of 'family snapshots'. Our work draws upon established cross-disciplinary literature relating to film photography and the composition of family albums in order to establish whether social media has changed the way parents visually present their families. We conducted a qualitative visual analysis of a sample of 4,000 photographs collected from Instagram using hashtags relating to children and parenting. We show that the style and composition of snapshots featuring children remains fundamentally unchanged and continues to be dominated by rather bland and idealised images of the happy family and the cute child. In addition, we find that the frequent taking and sharing of photographs via Instagram has inevitably resulted in a more mundane visual catalogue of daily life. We note a tension in the desire to use social media as a means to evidence good parenting, while trying to effectively manage the social identity of the child and finally, we note the reluctance of parents to use their own snapshots to portray family tension or disharmony, but their willingness to use externally generated content for this purpose.

A number of digital platforms and services have recently emerged that allow users to create posthumous forms of communication, effectively arranging for the delivery of messages from "beyond the grave". Despite some evidence of interest and popularity of these services, little is known about how posthumous messages may impact the people who receive them. We present a qualitative study that explores the type of experiences potentially triggered upon receiving such messages. Our findings firstly suggest that posthumous messaging services have the potential to alter the relationship between the bereaved and the deceased, and secondly provide insight into how users make sense of this altered relationship. Through the inference of a set of design considerations for posthumous communication services, we reveal a number of conflicts that are not easily solvable through technological means alone, and which may serve as starting points for further research. Our work extends the growing body of research that is concerned with digital interactions related to death and dying.

Mobile devices offer a common platform for both leisure and work-related tasks, but this has resulted in a blurred boundary between home and work. In this paper, we explore the security implications of this blurred boundary, both for the worker and the employer. Mobile workers may not always make optimal security-related choices when “on the go” and more impulsive individuals may be particularly affected as they are considered more vulnerable to distraction. In this study, we used a task scenario, in which 104 users were asked to choose a wireless network when responding to work demands while out of the office. Eye-tracking data was obtained from a subsample of 40 of these participants in order to explore the effects of impulsivity on attention. Our results suggest that impulsive people are more frequent users of public devices and networks in their day-to-day interactions and are more likely to access their social networks on a regular basis. However, they are also likely to make risky decisions when working on-the-go, processing fewer features before making those decisions. These results suggest that those with high impulsivity may make more use of the mobile Internet options for both work and private purposes, but they also show attentional behavior patterns that suggest they make less considered security-sensitive decisions. The findings are discussed in terms of designs that might support enhanced deliberation, both in the moment and also in relation to longer term behaviors that would contribute to a better work–life balance.

New systems have been introduced that support the visualisation and sharing of personal digital data, but relatively little work has been done to establish how such systems support reminiscence and personal reflection. In this paper, we explore Intel’s Museum of Me , a tool that collates and presents Facebook data in the form of a virtual museum, by asking how such an automated biography might support personal reflection and a process of life review. We supported users in their creation of personal virtual museums and interviewed them about their experiences, using a theoretical framework that highlighted the importance of personal narratives and life review in identity formation and psychological well-being. Our participants enjoyed the experience and welcomed the opportunity for reminiscence, but considered their resulting videos to be rather shallow representations of self, reflective of some of the more trivial exchanges and relationships that can come to dominate social media. We argue that social media in its current form is not well suited to support a meaningful life-review process.

This paper examines how London bus drivers have responded to performance monitoring via a telematics device called Drivewell. This device calculates a score based on various recordable driving-related events like abrupt braking or irregular turning actions. Our qualitative methodology incorporated semi-structured interviews and ethnographic fieldwork, in order to explore drivers' attitudes towards the system and its effect on driving behaviour and working conditions. Our findings illustrate how bus operators simultaneously accommodate and resist the demands Drivewell places upon them. Our work also demonstrates how this digital intervention acts in conjunction with other driver-related technologies, creating a unique digital ecosystem on the modern London bus. Our research contributes to HCI understandings of digital surveillance and performance monitoring in the modern workplace.

Social media is a common place for people to post and share digital reflections of their life events, including major events such as getting married, having children, graduating, etc. Although the creation of such posts is straightforward, the identification of events on online media remains a challenge. Much research in recent years focused on extracting major events from Twitter, such as earthquakes, storms, and floods. This paper however, targets the automatic detection of personal life events, focusing on five events that psychologists found to be the most prominent in people lives. We define a variety of features (user, content, semantic and interaction) to capture the characteristics of those life events and present the results of several classification methods to automatically identify these events in Twitter. Our proposed classification methods obtain results between 0.84 and 0.92 F1-measure for the different types of life events. A novel contribution of this work also lies in a new corpus of tweets, which has been annotated by using crowdsourcing and that constitutes, to the best of our knowledge, the first publicly available dataset for the automatic identification of personal life events from Twitter.

Identity technologies constitute one of the fastest growing areas for research and development, driven by both commercial and administrative imperatives. Crucially, they constitute the means by which we include or exclude individuals and groups in terms of access to goods, services or information -- yet few developments in this space embrace an inclusive or value sensitive design philosophy. We describe a rigorous exercise in which we source scenarios that capture new research in the identity space and use these as probes in an inclusive design process. Workshops were held with six marginalized community groups: young people, older adults, refugees, black minority ethnic (BME) women, people with disabilities, and mental health service users. Our findings echo Herzberg's two-factor theory in which we are able to identify a set of relatively common values around sources of potential dissatisfaction (hygiene factors) as well as a set of motivators that are differentially valued across communities.

This paper examines how an occupational group has adapted to the demands of working with a Location Based Service (LBS). Instead of following a rigid timetable, London's bus drivers are now required to maintain an equal distance between the bus in front and the one behind. Our qualitative study employs ethnographic fieldwork and in-depth semi-structured interviews to elicit drivers' perspectives of the new system and show how it has modified their driving and general work conditions. We explore how passengers influence the movement of the bus and how the technology frames bus drivers' relationships to their managers and commuters. This work contributes to our understanding of the impact of LBS in the workplace and shows how technological imperatives can be established that cause unanticipated consequences and gradually undermine human relationships.

Graphical authentication systems typically claim to be more usable than PIN or password-based systems, but these claims often follow limited, single-stage paradigm testing on a young, student population. We present a more demanding test paradigm in which multiple codes are learned and tested over a three-week period. We use this paradigm with two user populations, comparing the performance of younger and older adults. We first establish baseline performance in a study in which populations of younger and older adults learn PIN codes and we follow this with a second study in which younger and older adults use two face-based graphical authentication systems employing young faces vs. old faces as code components. As expected, older adults show relatively poor performance when compared to younger adults, irrespective of the authentication material, but this age-related deficit can be markedly reduced by the introduction of age-appropriate faces. We conclude firstly that this paradigm provides a good basis for the future evaluation of memory-based authentication systems and secondly that age-appropriate face-based authentication is viable in the security marketplace.

We propose a suite of user interface widgets to intuitively inform a user of a mobile device's sense of comfort at the user's proposed actions.

Invisible Design is a technique for generating insights and ideas with workshop participants in the early stages of concept development. It involves the creation of ambiguous films in which characters discuss a technology that is not directly shown. The technique builds on previous work in HCI on scenarios, persona, theatre, film and ambiguity. The Invisible Design approach is illustrated with three examples from unrelated projects; Biometric Daemon, Panini and Smart Money. The paper presents a qualitative analysis of data from a series of workshops where these Invisible Designs were discussed. The analysis outlines responses to the films in terms of; existing problems, concerns with imagined technologies and design speculation. It is argued that Invisible Design can help to create a space for critical and creative dialogue during participatory concept development.

The introduction of tabletop interfaces has given rise to the need for the development of secure and usable authentication techniques that are appropriate for the co-located collaborative settings for which they have been designed. Most commonly, user authentication is based on something you know, but this is a particular problem for tabletop interfaces, as they are particularly vulnerable to shoulder surfing given their remit to foster co-located collaboration. In other words, tabletop users would typically authenticate in full view of a number of observers. In this paper, we introduce and evaluate a number of novel tabletop authentication schemes that exploit the features of multi-touch interaction in order to inhibit shoulder surfing. In our pilot work with users, and in our formal user-evaluation, one authentication scheme - Pressure-Grid - stood out, significantly enhancing shoulder surfing resistance when participants used it to enter both PINs and graphical passwords.

Developments in ubiquitous and pervasive computing herald a future in which computation is embedded into our daily lives. Such a vision raises important questions about how people, especially families, will be able to engage with and trust such systems whilst maintaining privacy and individual boundaries. To begin to address such issues, we have recently conducted a wide reaching study eliciting trust, privacy and identity concerns about pervasive computing. Over three hundred UK citizens participated in 38 focus groups. The groups were shown Videotaped Activity Scenarios [11] depicting pervasive or ubiquitous computing applications in a number of contexts including shopping. The data raises a number of important issues from a family perspective in terms of access, control, responsibility, benefit and complexity. Also findings highlight the conflict between increased functionality and the subtle social interactions that sustain family bonds. We present a Pre-Concept Evaluation Tool (PRECET) for use in design and implementation of ubicomp systems.

The use of technology to access personal information in public places is increasingly common, but can these interactions induce stress? Sixty-eight participants were led to believe that extremely sensitive personal information would be displayed via either a public or personal handheld device in isolated or crowded (in the presence of strangers) conditions. Stress responses were taken in terms of heart rate, galvanic skin response and subjective ratings. As anticipated, participants showed stronger stress reactions in the crowded rather than the isolated conditions and also experienced greater stress when the information was presented on a public screen in comparison to a personal handheld device. Implications for the design of public/private information systems are discussed.

Traditionally health advice has been anchored in face-to-face settings but increasingly patients are using the Internet for their health advice needs. This means that patients are now offered inconsistent advice from a range of sources and must determine which sites to trust and which to reject. To understand how consumers make these choices, 13 participants diagnosed with hypertension took part in a longitudinal study in which they searched for information and advice relevant to their condition. A content analysis of the group discussions revealed support for a staged model of trust in which mistrust or rejection of Websites is based on design factors and trust or selection of Websites is based on content factors such as source credibility and personalization. Based on this model, a set of guidelines for developing trust in health Websites is proposed and key differences between face-to-face communication and web-based systems are discussed.

In recent years the number of health related websites has increased dramatically and so have concerns regarding the quality of online information. The sheer volume of sites and the variety of information available have left health consumers potentially with greater choice but it is not clear whether these online changes are reflected in user behaviour. This study addresses whether users are becoming more proficient in searching for credible, high quality information and whether they are more demanding of the type of information being sought and less ready to trust online health advice. This paper describes changes in the use of the Internet for health advice over a five-year period. It compares findings from two large-scale online questionnaire studies undertaken in 2000 and 2005. Key changes and similarities in usage and trust practices are noted. The rise in unregulated sites is discussed in terms of patients “acting as scientists” using websites to test out theories regarding their health. The increasing importance of design issues is also highlighted and implications for website designers and content providers are presented.

Do different design and information content factors \ninfluence trust and mistrust of online health sites? Fifteen women faced with a risky health decision were observed while searching the Internet for information and advice over four consecutive weeks. In some sessions their searches were unstructured, whilst in other sessions they were directed to review specific sites, chosen for their trust design elements. Content analysis of concurrent \nverbalisations and group discussion protocols provided \nsupport for a staged model wherein design appeal predicted \nrejection (mistrust) and credibility of information and \npersonalisation of content predicted selection (trust) of \nadvice sites.