This study examines the pedagogical approaches and experiences of community-engaged educators—individuals who teach privacy, online safety, or security to specific communities through community organizations, companies, or local institutions, such as libraries. We draw on interviews with 21 such educators across the United States and find that, unlike some privacy and security advice that may emphasize knowledge retention of common skills and strategies, these educators prioritized teaching for independent decision-making. Our participants conceptualized privacy literacy as a process for taking informed action, and, from their insights, we identified five core competencies of privacy literacy: (1) data fluency, (2) account security, (3) fraud detection, (4) information vetting, and (5) surveillance capitalism. Notably, these competencies integrate privacy, security, and online safety concepts into privacy literacy—reflecting an increasingly integrated threat landscape. Embedded within the communities they serve, these educators shared their deep understanding of their students’ needs, which varied dramatically, and shared ways in which they tailored their programming accordingly. However, educators also shared significant teaching constraints, including limited time, resources, and organizational support. We discuss the implications of our findings for privacy literacy and for supporting community-engaged privacy literacy efforts.

Transparent reporting of research is a crucial aspect of good scientific practice and contributes to trustworthy science. Transparency helps to understand research processes, assess the validity of research contributions, and facilitates replication of studies and reported results. In the face of reproducibility crises in other fields, the security and privacy (SP) research community in general and the usable privacy and security (UPS) community in particular lack clear standards for transparent research reporting. To gain insights into current research transparency practices and associated challenges and obstacles in the UPS community, we report findings from 24 semi-structured interviews with UPS researchers. We find that researchers value research transparency and already apply several transparency reporting practices. However, an implicit community standard without incentives that outweigh challenges and drawbacks appears to prevent further advances in research transparency. Based on our findings, we conclude with recommendations for transparency practices and guidance for publication venues to better incentivize research transparency (e.g., adapting artifact evaluation to typical UPS artifacts like study materials) and to alleviate constraints that hinder transparency (e.g., removing page limits on appendices). We hope our findings can spur community discussion and effort to improve research quality through more transparent research reporting.

Social media platforms pose privacy risks when data is used in unexpected ways (e.g., for advertising or data sharing with partners). Using a custom browser extension and an online survey with 195 Facebook users, we investigated (1) whether participants’ expected values of their Facebook privacy settings were (mis)aligned with their actual settings; (2) demographic differences in privacy expectation-setting mismatches; and (3) participants' privacy concerns and trust towards Facebook.Our study presents a current and comprehensive analysis of Facebook users' privacy settings. We find that expectation-setting mismatches are prevalent: all participants had at least one mismatch; many had multiple, often expecting their settings to be more restrictive than they were. We also found that Facebook's default values are not aligned with people's expectations and/or actual settings, which suggests that those defaults are ineffective. Furthermore, mismatches differed along certain demographic variables.Participants' trust in Facebook decreased after they became aware of mismatches and their actual settings. Our empirical findings indicate that, despite increased public awareness, media scrutiny, and regulatory attention regarding privacy issues, there is still a substantial and concerning disconnect between how private people perceive their social media data to be and how exposed their data actually is, opening them up to both interpersonal and institutional privacy risks. We discuss design and public policy implications of our findings.

Data breaches are prevalent. We provide novel insights into individuals’ awareness, perception, and responses to breaches that affect them through two online surveys: a main survey (n= 413) in which we presented participants with up to three breaches that affected them, and a follow-up survey (n= 108) in which we investigated whether the main study participants followed through with their intentions to act. Overall, 73% of participants were affected by at least one breach, but participants were unaware of 74% of breaches affecting them. Although some reported intention to take action, most participants believed the breach would not impact them. We also found a sizable intention-behavior gap. Participants did not follow through with their intention when they were apathetic about breaches, considered potential costs, forgot, or felt resigned about taking action. Our findings suggest that breached organizations should be held accountable for more proactively informing and protecting affected consumers.

Timely detection of an individual’s stress level has the potential to improve stress management, thereby reducing the risk of adverse health consequences that may arise due to mismanagement of stress. Recent advances in wearable sensing have resulted in multiple approaches to detect and monitor stress with varying levels of accuracy. The most accurate methods, however, rely on clinical-grade sensors to measure physiological signals; they are often bulky, custom made, and expensive, hence limiting their adoption by researchers and the general public. In this article, we explore the viability of commercially available off-the-shelf sensors for stress monitoring. The idea is to be able to use cheap, nonclinical sensors to capture physiological signals and make inferences about the wearer’s stress level based on that data. We describe a system involving a popular off-the-shelf heart rate monitor, the Polar H7; we evaluated our system with 26 participants in both a controlled lab setting with three well-validated stress-inducing stimuli and in free-living field conditions. Our analysis shows that using the off-the-shelf sensor alone, we were able to detect stressful events with an F 1-score of up to 0.87 in the lab and 0.66 in the field, on par with clinical-grade sensors.

This Research Full Paper presents a qualitative interview and descriptive study on computing resilient identity development of African Americans who have earned a Ph.D. in a computing field. Low sense of belonging and self-efficacy contributes to low participation and performance of African Americans have lower participation and performance in computing as compared to their White and Asian counterparts. Computing identity including sense of belonging and self-efficacy contributes to this deficit. To increase African American successful representation in computing, resilience is explored to identify the support systems, challenges, and coping processes of African Americans who have earned a Ph.D. in computing. In depth, semi-structured interviews of African American post-docs, faculty, and industry researchers in computing fields were implemented. Interviews were audio recorded and transcribed. Transcriptions were analyzed with a hybrid inductive-deductive qualitative content analysis. Surveys were employed to document participants' work resilience and personality to supplement the qualitative data. Results include the resilient identity development of participants by reciting background information, challenges and support systems in their respective employment, and how they react to such stressors and supports, and the productive they are while persevering. Findings from this work can be used to improve academia and industry conditions for African American professionals and to identify resources that were suggested to be pivotal in participants' resilient identity development within the computing field. This paper is in conjunction with other papers in an extended case study on resilient identity development in African American computer scientists.

This study presents an ultra-low resource platform for physiological sensing that uses on-chip wavelet compression to enable long-term recording of electrodermal activity (EDA) within a 64kB microcontroller. The design is implemented on a wearable platform and provides improvements in size and power compared to existing wearable technologies and was used in a lab setting to monitor EDA of 27 participants throughout a stress induction protocol. We demonstrate the device's sensitivity to stress induction by providing descriptive statistics of 8 common EDA signal features for each stressor of the experiment. To the best of our knowledge, this is the first time a generic, 16-bit microcontroller (MCU) has been used to record real-time physiological signals on a wearable platform without the use of external memory chips or wireless transmission for extended periods of time. The compression techniques described can lead to reductions in size, power, and cost of wearable biosensors with little or no modifications to existing sensor hardware and could be valuable for applications interested in monitoring long-term physiological trends at lower data rates and memory requirements.