Policies which address security and privacy are pervasive parts of both technical and social systems, and technology to enable both organizations and individuals to create and manage such policies is seen as a critical need in IT. This paper describes policy authoring as a key component to usable privacy and security systems, and advances the notions of policy templates in a policy management environment in which different roles with different skill sets are seen as important. We discuss existing guidelines and provide support for the addition of new guidelines for usable policy authoring for security and privacy systems. We describe the relationship between general policy templates and specific policies, and the skills necessary to author each of these in a way that produces high-quality policies. We also report on an experiment in which technical users with limited policy experience authored policy templates using a prototype template authoring user interface we developed.

In this article, we introduce a comprehensive framework supporting a privacy-aware access control mechanism, that is, a mechanism tailored to enforce access control to data containing personally identifiable information and, as such, privacy sensitive. The key component of the framework is a family of models (P-RBAC) that extend the well-known RBAC model in order to provide full support for expressing highly complex privacy-related policies, taking into account features like purposes and obligations. We formally define the notion of privacy-aware permissions and the notion of conflicting permission assignments in P-RBAC, together with efficient conflict-checking algorithms. The framework also includes a flexible authoring tool, based on the use of the SPARCLE system, supporting the high-level specification of P-RBAC permissions. SPARCLE supports the use of natural language for authoring policies and is able to automatically generate P-RBAC permissions from these natural language specifications. In the article, we also report performance evaluation results and contrast our approach with other relevant access control and privacy policy frameworks such as P3P, EPAL, and XACML.

The goal of the research study reported here was to investigate policy authors' ability to take descriptions of changes to policy situations and author high-quality, complete policy rules that would parse with high accuracy. As a part of this research, we investigated ways in which we could assist policy authors in writing policies. This paper presents the results of a user study on the effectiveness of providing syntax highlighting in a natural language policy authoring interface. While subjects liked the new interface, they showed no improvement in accuracy when writing rules. We discuss our results in terms of a three phase authoring process that users move through when authoring or modifying policies. We describe this process, discuss why and how our interface failed to support it and make recommendations to designers on how to better support this process.

The new usability agenda is driving empirical and experimental studies into a growing range of quality criteria such as engagement, user experience, and aesthetics. Some see this as a positive move to theorise about the nature of good design qualities, and to objectively test such hypotheses on the new usability theme. However, others (e.g. [1], [2]) have argued for interpretation-based inquiry into user engagement and experience on the grounds that such phenomena can only be understood by investigations into contexts of use which defy quantitative approaches. Many in the design community would agree with them and go further to argue that quality in design is a matter of creativity and can not be measured or theorised per se; instead, research should focus on understanding and improving the process of design. This panel will debate the tensions between these positions and explore possible common ground between them as a contribution towards the research agenda that is being debated in the DIS conference series.

Privacy policy rules are often written in organizations by a team of people in different roles. Currently, people in these roles have no technological tools to guide the creation of clear and implementable high-quality privacy policy rules. High-quality privacy rules can be the basis for verifiable automated privacy access decisions. An empirical study was conducted with 36 users who were novices in privacy policy authoring to evaluate the quality of rules created and user satisfaction with two experimental privacy authoring tools and a control condition. Results show that users presented with scenarios were able to author significantly higher quality rules using either the natural language with a privacy rule guide tool or a structured list tool as compared to an unguided natural language control condition. The significant differences in quality were found in both user self-ratings of rule quality and objective quality scores. Users ranked the two experimental tools significantly higher than the control condition. Implications of the research and future research directions are discussed.

Today organizations do not have good ways of linking their written privacy policies with the implementation of those policies. To assist organizations in addressing this issue, our humancentered research has focused on understanding organizational privacy management needs, and, based on those needs, creating a usable and effective policy workbench called SPARCLE. SPARCLE will enable organizational users to enter policies in natural language, parse the policies to identify policy elements and then generate a machine readable (XML) version of the policy. In the future, SPARCLE will then enable mapping of policies to the organization’s configuration and provide audit and compliance tools to ensure that the policy implementation operates as intended. In this paper, we present the strategies employed in the design and implementation of the natural

Privacy is a concept which received relatively little attention during the rapid growth and spread of information technology through the 1980's and 1990's. Design to make information easily accessible, without particular attention to issues such as whether an individual had a desire or right to control access to and use of particular information was seen as the more pressing goal. We believe that there will be an increasing awareness of a fundamental need to address privacy concerns in information technology, and that doing so will require an understanding of policies that govern information use as well as the development of technologies that can implement such policies. The research reported here describes our efforts to design a privacy management workbench which facilitates privacy policy authoring, implementation, and compliance monitoring. This case study highlights the work of identifying organizational privacy requirements, analyzing existing technology, on-going research to identify approaches that address these requirements, and iteratively designing and validating a prototype with target users for flexible privacy technologies.

This article investigates the use of streaming multimedia narratives in Web entertainment. Based on experience gained during the user-centered design of a Web site for art and culture, evidence is provided that users want and like "less clicking, more watching" Web experiences where the point of view of experts, artists, or celebrities is presented in a narrative form. A study was conducted where users evaluated 2 prototypes of cultural tours that stream continuously for several minutes unless the user chooses to exercise control over the flow or to explore hotlinks that lead to extra information. Those tours were positively evaluated as both entertaining and engaging. By analyzing mouse activity, it was determined that users who interacted more tended to report less entertainment and engagement. It was also found that such "watchable" experiences are not necessarily a solitary experience and can be enjoyed by groups of people. Finally, users see the Web experiences as a highly enriching and accessible way to augment the cultural experiences and performances they enjoy in brick-and-mortar cultural institutions around the world, rather than as a substitute for them.

A study was conducted to evaluate user performance and satisfaction in completion of a set of text creation tasks using three commercially available continuous speech recognition systems. The study also compared user performance on similar tasks using keyboard input. One part of the study (Initial Use) involved 24 users who enrolled, received training and carried out practice tasks, and then completed a set of transcription and composition tasks in a single session. In a parallel effort (Extended Use), four researchers used speech recognition to carry out real work tasks over 10 sessions with each of the three speech recognition software products. This paper presents results from the Initial Use phase of the study along with some preliminary results from the Extended Use phase. We present details of the kinds of usability and system design problems likely in current systems and several common patterns of error correction that we found.

Article Free Access Share on Maintaining a focus on user requirements throughout the development of clinical workstation software Authors: Janette M. Coble Washington Univ. School of Medicine, Box 8005, 660 S. Euclid, St. Louis, MO Washington Univ. School of Medicine, Box 8005, 660 S. Euclid, St. Louis, MOView Profile , John Karat IBM T. J. Watson Research, 30 Saw Mill River Road, Hawthorne, NY IBM T. J. Watson Research, 30 Saw Mill River Road, Hawthorne, NYView Profile , Michael G. Kahn Washington Univ. School of Medicine, Box 8005, 660 S. Euclid, St. Louis, MO Washington Univ. School of Medicine, Box 8005, 660 S. Euclid, St. Louis, MOView Profile Authors Info & Claims CHI '97: Proceedings of the ACM SIGCHI Conference on Human factors in computing systemsMarch 1997 Pages 170–177https://doi.org/10.1145/258549.258698Published:27 March 1997Publication History 27citation1,256DownloadsMetricsTotal Citations27Total Downloads1,256Last 12 Months44Last 6 weeks9 Get Citation AlertsNew Citation Alert added!This alert has been successfully added and will be sent to:You will be notified whenever a record that you have chosen has been cited.To manage your alert preferences, click on the button below.Manage my Alerts New Citation Alert!Please log in to your account Save to BinderSave to BinderCreate a New BinderNameCancelCreateExport CitationPublisher SiteeReaderPDF

Goals and content: Through this tutorial, participants will: understand distinctions among various types of meetings and the role of various types of conversations in successful meetings; understand the importance of partnership for achieving team results in meetings; formulate plans for successful technological support for meetings. Participants will experience, through a series of connected exercises, an ad hoc meeting designed to highlight what is important about meetings. Out of this experience, various theories that apply to meetings will become relevant. From an integration of experience and theory, we will explore how technology can be used innovatively and effectively to support meetings.

Article Practical education for improving software usability Share on Authors: John Karat IBM T. J. Watson Research Center, 30 Saw Mill River Road, Hawthorne, NY IBM T. J. Watson Research Center, 30 Saw Mill River Road, Hawthorne, NYView Profile , Tom Dayton Bellcore, 444 Hoes Lane, RRC 4A-1112, Piscataway, NJ Bellcore, 444 Hoes Lane, RRC 4A-1112, Piscataway, NJView Profile Authors Info & Claims CHI '95: Proceedings of the SIGCHI Conference on Human Factors in Computing SystemsMay 1995 Pages 162–169https://doi.org/10.1145/223904.223925Published:01 May 1995 21citation873DownloadsMetricsTotal Citations21Total Downloads873Last 12 Months29Last 6 weeks8 Get Citation AlertsNew Citation Alert added!This alert has been successfully added and will be sent to:You will be notified whenever a record that you have chosen has been cited.To manage your alert preferences, click on the button below.Manage my AlertsNew Citation Alert!Please log in to your account Save to BinderSave to BinderCreate a New BinderNameCancelCreateExport CitationPublisher SiteGet Access

Over several years we have participated as facilitators in many Human-Computer Interaction (HCI) design meetings.Our focus has been on developing team results needed to achieve user-centered design of software for computer systems.We describe frameworks for partnership, stages of meetings, and team conversations that we have found useful.In order to illustrate our general approach, we select one design meeting experience as a case study.We close with observations on how facilitation skills might be developed by design team participants.This is needed in response to an emerging requirement for effective collaborative teamwork in HCI design activities.

Raison d'Etre is a hypermedia design history application.It provides access to a database of video clips containing stories and ersonal perspectives of desi 1 r team members recorde at various times through t e course of a project.The system is intended to provide a simple framework for recording and organizing the informal history and rationale that design teams create and share in the course of their collaboration.This paper describes (1) the scenarios of use we are trying to support, (2) the methods we used collecting and organizing the database, and (3) the status of our prototype,

A study was conducted to examine knowledge transfer between word processing systems. The study examined the performance of naive subjects learning to use a word processing system, as well as performance of individuals with word processing experience as they learned to use a new system. Subjects initially familiar with one system carried out a series of tasks on this system and then were asked to carry out a similar series of tasks on a second system with which they were initially unfamiliar. The second systems varied in similarity to the first system along several dimensions. Subject performance was significantly slower on the second set of tasks for all groups compared to a control group using a single system. The reduced performance is attributed primarily to 'syntactic' differences in the user interfaces of the systems.