A quarter century of usable security and privacy research: transparency, tailorability, and the road ahead

ABSTRACT

In the last decades, research has shown that both technical solutions and user perceptions are important to improve security and privacy in the digital realm. The field of ‘usable security’ already started to emerge in the mid-90s, primarily focussed on password and email security. Later on, the research field of ”usable security and privacy” evolved and broadened the aim to design concepts and tools to assist users in enhancing their behaviour with regard to both privacy and security. Nevertheless, many user interventions are not as effective as desired. Because of highly diverse usage contexts, leading to different privacy and security requirements and not always to one-size-fits-all approaches, tailorability is necessary to address this issue. Furthermore, transparency is a crucial requirement, as providing comprehensible information may counter reactance towards security interventions. This article first provides a brief history of the research field in its first quarter-century and then highlights research on the transparency and tailorability of user interventions. Based on this, this article then presents six contributions with regard to (1) privacy concerns in times of COVID-19, (2) authentication on mobile devices, (3) GDPR-compliant data management, (4) privacy notices on websites, (5) data disclosure scenarios in agriculture, as well as (6) rights under data protection law and the concrete process should data subjects want to claim those rights. This article concludes with several research directions on user-centred transparency and tailorability.

KEYWORDS:

• Usable security
• usable privacy
• transparency-enhancing technologies
• intervention mechanisms
• security and privacy literacy

CCS Concepts:

• Security and privacy$\to$ Social aspects of security and privacy; Usability in security and privacy;

• Human-centred computing$\to$ Empirical studies in visualisation.

1. Introduction

Addressing end users' needs and capabilities adequately is a decisive factor when aiming to enhance security and privacy. Hence, researchers stress the importance of finding effective ways to assist users to make informed and adequate security and privacy decisions, and act accordingly. While most transparency-enhancing technologies and user intervention mechanisms are one-size-fits-all approaches, they are often not as effective as they should be from a user perspective. Thus, context-aware, and user-centred solutions constitute a current trend to increase transparency and intervention effectiveness. Considering variations in security and privacy behaviour is critical, both in terms of different contexts and different groups of end users. There are different types of transparency views and intervention mechanisms, ranging from default configurations to providing end users with risk information. When forcing people's decisions towards a desired outcome without being neither clear nor convenient, people tend to find workarounds. For example, if users are forced to adopt higher online security, it may reduce their willingness to follow the advice when the benefits are not clear and the desired behaviour appears to be a disproportionately big effort. In that case, users often choose convenience over security. To avoid this, it is necessary to provide both the required and desired information to users in a way that aligns with their internal representations – so-called mental models. Once users understand the mechanisms they are confronted with, they could make better decisions.

This article aims to address the research on transparent and tailorable interventions for usable security and privacy. For this purpose, at first an overview about the history of the research field and current challenges is provided in Chapter 2. Subsequently, in Chapter 3 the topic of transparency and tailorability of user interventions is addressed with reference to several specific application fields. In Section 4, six articles on current research are presented, which partially address the challenges discussed in the previous sections with regards to different contexts and user groups. Building upon this, in Section 5, the road ahead in usable security and privacy research and corresponding areas for future research are outlined and a conclusion is given.

2. A brief history of usable security and privacy

The opinion that users are the weakest link in cyber security is widespread. This view is fuelled by security incidents in which human error is found to be the unintended cause of missing or malfunctioning means of protection. In doing so, users only act within the boundaries of the environment provided. Furthermore, it is important to recognise that users interacting with computerised systems aim to fulfil their primary task, which is never to take protective measures. Thus, if means of protection hinder users in completing their primary task, they will intentionally avoid, override, or circumvent them, thus rendering them ad absurdum. In contrast, a critical view of the lack of system-side support and usability that triggers unintentional and intentional misuse is often not common in cyber security. However, this perspective is urgently needed, as research has proven (Adams and Angela Sasse 1999). Security and user-friendliness are not mutually exclusive quality features of a system, as is commonly assumed (Sasse et al. 2016). Human factors are therefore very important for security and privacy (Sasse and Rashid 2021).

2.1. The beginnings and the launch of ‘usable security’ and ‘usable privacy’

The groundbreaking works ‘User-Centered Security’ (Zurko and Simon 1996), ‘Users Are Not the Enemy’ (Adams and Angela Sasse 1999), and ‘Why Johnny Can't Encrypt: A Usability Evaluation of PGP 5.0’ (Whitten and Doug Tygar 1999), which manifest the beginning of the research field of usable security around 1996, already convey a different paradigm through their titles. They address the problem of how systems can support users in the reliable use of security mechanisms. Researchers put user perceptions, expectations, and capabilities at the centre of development considerations to enable users to become a strong link in a security system or even ‘the strongest link’, which is a paradigm shift.

Interestingly, the first thoughts in the direction of explicitly considering users in the design and development of security mechanisms were expressed much earlier. When the Dutch-born linguist and cryptographer Auguste Kerckhoffs published two journal articles on ‘La Cryptographie Militaire’ in 1883, he listed six principles for the development of military ciphers in the first article (Kerckhoffs 1883). What is known as the ‘Kerckhoffs’ principle' is an excerpt from the six principles according to which a cryptosystem should be secure even if everything about the system, except the key, is publicly known. A less known fact is that in his sixth principle, he states that ‘given the circumstances in which such a system is applied, it must be easy to use and must neither stress the mind nor require the knowledge of a long series of rules '. It took more than 100 years for this principle to be rediscovered in computer security research on usable password security. The same is true for the security principles proposed by Saltzer and Schroeder (1975). Amongst ‘Psychological Acceptability’, two aspects are important to achieve end users' acceptance of protection measures: (i) user interfaces that promote usability, and (ii) congruence between internal system mechanisms and users' mental models. The latter is indispensable and at the same time difficult to achieve, as there is often no self-evident mental representation for the complex concepts of technical protection mechanisms, as they do not exist in the physical world and therefore cannot be experienced, such as key pairs or public key certificates.

When the new research field of usable security was launched in the mid-90s (Zurko and Simon 1996), it focussed primarily on passwords and email security from the end user perspective, building on the pioneering work of Adams and Angela Sasse (1999), and Whitten and Doug Tygar (1999). The field gained further traction through special workshops, which over the years have become established venues that are now an integral part of the scientific discourse. In 2003, at the ACM Conference on Human Factors in Computing Systems (CHI), a first workshop was held that paired user studies with security analyses. Due to the success of the CHI workshop, a larger Workshop on Usable Privacy and Security Software (WUPSS) was organised in 2004. This led to the Symposium on Usable Privacy and Security (SOUPS) in 2005, which has been held annually since. Today, usable security is a recognised field that is part of almost every human-computer-interaction (HCI) and security-related scientific venue.

A similar development path and timeline can be seen for the research area of usable privacy. Initial work focussing on the intersection of HCI and privacy research appeared around 1979 and focussed mainly on the employment context (Ganster et al. 1979). With the commercialisation of the World Wide Web and the subsequent development into Web 2.0, the focus shifted to the private and online privacy context as websites began to track and analyse their users' behaviour (Cranor and Garfinkel 2005). At that time, technical approaches such as the Platform for Privacy Preferences Project (P3P) (Hochheiser 2002) were proposed to increase user trust in the Web. P3P is a machine-readable language that can be used to manage data usage policies. When a user visits a website, P3P compares what personal information the user wants to share according to their policy and what information the website wants to receive according to its policy. If the two policies do not match, P3P informs the user and asks them if they are willing to visit the website and risk disclosing more personal information. P3P formed the basis for more than a decade of research to find out whether the standard could actually be used by consumers to express their privacy choices. Since the beginnings of usable privacy coincided with usable security, the workshops and conferences that emerged around 2005 also focussed on usable privacy. However, usable privacy-specific events have also emerged, most notably workshops at the annual Privacy Enhancing Technologies Symposium (PETS) since 2008.

2.2. The evolvement of the ‘usable security and privacy’ field

From this initial and still very narrowly focussed research, the field of usable security and privacy has evolved over the last decade to encompass broader topics, and also the variety of stakeholders has increased in recent years. For example, researchers have begun to address security and privacy issues of employees (Nicholson, Coventry, and Briggs 2018; Tolsdorf, Reinhardt, and Iacono 2022; Tolsdorf et al. 2021), sex workers (McDonald et al. 2021), people with disabilities (Hayes et al. 2019; Marne, Nasrullah, and Wright 2017; Napoli et al. 2021), refugees (Steinbrink et al. 2021), youth (Brodsky et al. 2021; Cranor et al. 2014; Lastdrager et al. 2017), and seniors (Frik et al. 2019). Topics that have recently been focussed on in academia still include passwords and passwordless authentication with all conceivable approaches, devices, and contexts of use (Farke et al. 2020; Gerlitz, Häring, and Smith 2021; Golla et al. 2021; Kunke et al. 2021; Lassak et al. 2021; Lyastani et al. 2020; Owens et al. 2021; Tan et al. 2020; Ulqinaku et al. 2021; Wiefling, Dürmuth, and Iacono 2020; Wiefling et al. 2020). In the last years, usable security and privacy research also started to include developers and software engineers as a target user group (Gorski et al. 2021; Naiakshina et al. 2019; Plöger, Meier, and Smith 2021; Roth et al. 2021; Tahaei, Vaniea, and Saphra 2020). This was due to the fact that many security incidents in practice result from insecure code (Green and Smith 2016). Therefore, providing usable development support and tools is considered in research as a solution to achieve more secure code. This branch of research is also known as Developer-Centered Security (DCS). Furthermore, research has also focussed on email security. After numerous works on usable email encryption (Ruoti and Seamons 2019), phishing is back in the spotlight (Althobaiti, Meng, and Vaniea 2021; Hasegawa et al. 2021; Wash, Nthala, and Rader 2021), as it has become a serious threat in the era of working from home during the COVID-19 pandemic. For other technological developments that the COVID-19 pandemic has accelerated, such as remote communication or digital vaccination certificates, attitudes and preferences are also being explored (Emami-Naeini et al. 2021; Kowalewski et al. 2022). In addition, research continues to explore users' overall understanding, attitudes, and needs toward information technologies. Be it mental models about the IoT (Zheng et al. 2018; Zimmermann et al. 2018), encryption mechanisms (Krombholz et al. 2019; Wu and Zappala 2018), the internet (Brodsky et al. 2021; Kang et al. 2015), or conceptualisations of privacy in an information society (Oates et al. 2018; Tolsdorf et al. 2021).

Over the past two decades, the usable privacy research community, in particular, has made great efforts to explore people's attitudes, privacy concerns, and disclosure behaviours with the aim of understanding ‘privacy’. This process has long been characterised by finding and studying a ‘privacy paradox’ (Brown 2001; Norberg, Horne, and Horne 2007), followed by numerous approaches with the aim to explain and resolve it Gerber, Gerber, and Volkamer (2018) and Kokolakis (2017). The efforts culminated in numerous theories that have helped us to come closer to understanding privacy (Knijnenburg et al. 2022). However, the efforts made have also shown that the deeper one explores the question of what ‘privacy’ is, the more diverse and multifaceted it appears.

Furthermore, the implementation of new privacy legislation has had a major impact on the usable privacy domain. On the one hand, the problem arose that online users were flooded with cookie banners that, contrary to the principle of privacy by design, exploited dark patterns to secure users' consent for the purpose of processing personal data (Machuletz and Böhme 2020). At the same time, numerous ideas were developed to address the transparency requirements of modern data protection laws – either by further developing existing transparency tools (Murmann and Fischer-Hübner 2017) or by developing new ideas. Approaches have been developed to make privacy statements easier to understand, for example with the help of privacy icons (Habib et al. 2021), comics (Knijnenburg and Cherry 2016; Tabassum et al. 2018), graph-based visualisations (Angulo et al. 2015; Schufrin et al. 2021), ordinary privacy nutrition labels (Emami-Naeini et al. 2022; Kelley et al. 2010; Railean and Reinhardt 2018), and hybrid labels that include privacy settings in the visualisation (Reinhardt, Borchard, and Hurtienne 2021). At the same time, research was carried out into how people's right to access their personal data can be designed and visualised in a meaningful way (Alizadeh et al. 2020; Veys et al. 2021), and made easily accessible via privacy dashboards (Bier, Kühne, and Beyerer 2016).

3. Transparency and tailorability of user interventions

While most user interventions – as external measures to encourage users' secure behaviour (e.g. by providing end users with risk information) – are one-size-fits-all approaches (giving the same intervention to all user groups), they are often not as effective as desired. Accordingly, already in Garfinkel and Lipford (2014) mentioned personalisation as one of the trends for the next decade.

The main reason for this is that users and use contexts are highly diverse and thus lead to individual intrinsic privacy and security requirements. Furthermore, a lack of transparent information may lead to reactance, which means that users tend to behave contrary to the proposed pattern. Providing comprehensible information may counter that reactance, also for security and privacy. Therefore, we would like to elaborate on the transparency and tailorability of user interventions.

3.1. Transparency of user interventions

A major challenge is the transparency of user interventions in the areas of privacy and security. Often, cyber security and privacy measures are difficult for the average user to understand. Providing transparency in relevant aspects in cyber security and privacy is therefore critical to help users better understand interventions. This has already been applied in various contexts, e.g. end user key verification services (Melara et al. 2015), and processing of personal data (Pulls, Peeters, and Wouters 2013). There are various measures to create transparency that take different levels into account. For example, transparency can be improved by visualising relevant information or by providing visual feedback on decisions in critical situations to respond to visual perception, as it provides ‘the highest bandwidth channel from computer to the human’ (Ware 2012, 2). Therefore, transparency should be considered an important part of the intervention design.

Transparency can be facilitated by presenting relevant information in a disaggregated way instead of showing an aggregated output. Disaggregation can be achieved, for instance, by applying suitable visualisation techniques such as radar charts (also known as star coordinate, spider chart, or polar chart) or parallel coordinates that allow multiple dimensions to be displayed at once without overwhelming end users. These visualisation techniques are considered an effective way for displaying information in a variety of contexts (Kwon and Lee 2016).

Concerning the visualisation of information, users' preferences regarding transparency are diverse. While for some users it is sufficient to only see an aggregated output of a calculation, others will not trust the output unless they can comprehend how it was generated. For the latter, algorithmic transparency is essential. There are mainly two different approaches to algorithms: black-box and white-box approaches (Cheng et al. 2019). In a black-box approach, the user can observe the input and the output but not what happens in between. As a result, this may lead to reactance for those who want to know how information is processed. Reactance can be seen as the result of the Backfire Effect (Nyhan and Reifler 2010), as an emotional reaction to paternalism or persuasion, leading users to tend to behave contrary to the proposed pattern. The advantage, however, of black-box approaches is that they are less likely to cause information overload. In contrast, white-box approaches enable the user to understand how the output was generated by making the underlying basis for output generation transparent to the user. This can be beneficial especially for individuals that are otherwise likely to feel reactance or mistrust (Hartwig and Reuter 2019). Such so-called explainable algorithms have become a highly relevant field of research, for instance, to understand how decisions in health and finance are made by machine learning techniques (Abdul et al. 2018; Cheng et al. 2019).

Currently, the majority of user intervention mechanisms are based on uni-dimensional visualisations of aggregated information. For instance, password metres usually show aggregated results of metrics using colour code. However, these interventions only tell if a password is weak, but not why this is the case. This shows that they are black-box-based and, hence, do not let users know what to do to improve their passwords. In this way, the visualisation of a more comprehensive collection of information rather than just aggregated results can assist users in making informed security and privacy decisions (Ur et al. 2016). Here, white-box approaches can facilitate an understanding of why a certain output was generated by showing multiple dimensions in one visualisation. Thus, it is not only transparent to the users on which dimensions the calculation of password strength is based on, but also what is required to improve the password. Studies have emphasised that transparency and user control in the areas of security and privacy do not necessarily lead to users making consistent decisions (Acquisti, Adjerid, and Brandimarte 2013) and, thus, have to be implemented with caution. Therefore, it is crucial to further investigate the circumstances in which transparent interventions are more effective for specific user groups, than aggregated information (Hartwig and Reuter 2021). Providing transparent and comprehensible information to end users is highly relevant also with regard to other contexts such as fake news interventions, where findings regarding user interventions can benefit from each other when comparing the contexts of fake news and cyber security (Kaiser et al. 2021).

3.2. Tailorability of user interventions

A second major challenge is the tailorability of user interventions for privacy and security. A user-centred approach is generally recommended when trying to improve users' privacy and security (Franz et al. 2021; Stransky et al. 2021). However, many security and privacy systems are designed for the average user (Egelman and Peer 2015). Accordingly, compliance is limited to certain end users while others do not necessarily benefit. Furthermore, it has been shown that compliance is likely to improve when it is designed for an individual (Egelman and Peer 2015). To address this problem, a recent trend for user interventions is personalisation. Several researchers point out the advantages of using personalised interventions according to user traits instead of one-size-fits-all interventions (Knijnenburg 2017; Egelman and Peer 2015; Peer et al. 2019; Renaud et al. 2017; Jeske, Coventry, and Briggs 2014). For instance, some researchers argue that using tailored nudges can support users in making better privacy decisions (Knijnenburg 2017). A nudge is ‘any aspect of the choice architecture that alters people‘s behaviour in a predictable way without forbidding any options or significantly changing their economic incentives’ (Thaler and Sunstein 2009, 6). To provide individuals with the subjectively most effective intervention, distinct user groups need to be identified. In this regard, there are various approaches to segment users. For example, different clusters of users have been identified: ‘Fundamentalists, Lazy Experts, Technicians, Amateurs and the Marginally Concerned’ (Dupree et al. 2016, 5228). Further, segmenting users according to their decision-making styles and risk-taking attitudes via short and established psychometric tests is suggested to predict privacy and security behaviour and accordingly show the best fitting user interventions (Egelman and Peer 2015). This idea was also followed up by conducting online experiments (Egelman, Harbach, and Peer 2016). The results suggest that the Security behaviour Intentions Scale (SeBIS) indeed predicts certain computer security behaviours. While several studies show promising advantages of personalised user interventions, only a few have implemented the concept within a cyber security context. The context of manual password creation remains relevant in usable security, as passwords continue to be the first choice for user authentication, despite various strong alternatives and end users’ struggle to follow password requirements to create usable and strong passwords. Peer et al. (2019) tested people‘s decision-making styles to personalise interventions for stronger passwords in two online experiments. They argue that choosing a user intervention from a pool of multiple existing interventions could be more effective than showing the same to everyone (Peer et al. 2019). Applying five frequently used nudges (e.g. feedback on how long it takes to crack the password) according to the decision-making style of a person, the study found that decision-making styles can indeed indicate which user intervention is likely to be most effective. They achieved stronger passwords with personalisation than with one-size-fits-all interventions (Peer et al. 2019). Another study investigated the effectiveness of interventions depending on user characteristics, such as impulse control when selecting a public wireless network, by asking students in a role-playing game to select a network given a specific intervention (Jeske, Coventry, and Briggs 2014). Here, user differences were found to indeed play a role in security decision-making. Yet another study examined whether white-box-based multidimensional visualisations have a positive effect on password creation. Here, Hartwig and Reuter (2021) found that the intervention was particularly appreciated by players of role-playing games, giving reasons for further investigations.

In addition to personalisation based on specific user characteristics, customised needs can also be met by providing control opportunities for users themselves. These represent an alternative to the previously elaborated personalisation approaches. Here, it has been empirically shown that individuals who perceive more control over their privacy sometimes reveal more sensitive information than those who perceive less control over their privacy (Brandimarte, Acquisti, and Loewenstein 2013; Gerber, Gerber, and Volkamer 2018), also known as privacy paradox. Nevertheless, providing good and usable control opportunities to enable personalised user interventions might generally be a promising path to pursue, as long as possible caveats are taken into account.

3.3. Possible application fields: phishing and privacy protection

For illustration purposes, we highlight two contemporary and highly relevant application fields for user-centred interventions and transparency mechanisms in security and privacy, namely phishing and interdependent privacy protection.

Phishing is a frequently employed cyber attack to get hold of users’ sensitive information, such as login details or bank account numbers. The consequences of a successful attack can reach from individual personal losses or compromised accounts, to complete organisations, or networks being infected with malware, often combined with ransom demands. It is crucial to keep in mind that phishing attacks do not primarily target hardware or software vulnerabilities, but rather the user – the human factor within the socio-technical system. While there are several tools and approaches that aim to identify malicious content automatically (see e.g. Tian et al. 2018; Verma and Dyer 2015), the increasingly sophisticated and personalised nature of phishing attacks makes it hard for algorithms to detect and block phishing emails, websites, or malicious software. This leaves a large amount of responsibility to the user, so that user-centred interventions and transparency mechanisms play a key role in helping users to protect themselves.

Key questions to answer in this area are amongst others: (1) Which phishing attack vector (e.g. email, URL, website, malware) does the intervention address? (2) When (pre-decision, during decision, post-decision) does the intervention take place? (3) Does the intervention require user interaction? Research and practice have developed a number of user-oriented interventions against phishing attacks to address these questions. Among those are education and training approaches (e.g.Canova et al. 2015; Kumaraguru et al. 2009), where users develop knowledge and skills that they can apply to real-world phishing attempts. Moreover, awareness-raising measures or design considerations (e.g.Marforio et al. 2016; Nicholson, Coventry, and Briggs 2017; Petelka, Zou, and Schaub 2019) aim to guide users towards secure online behaviour in situ. More recent research has developed a taxonomy of user-oriented phishing interventions (Franz et al. 2021) including educational interventions (e.g.Text-based, video-based, or in-class education), training (e.g. serious games, embedded training, mindfulness-based training), awareness-raising warnings (e.g. interactive warnings, passive warnings), and anti-phishing designs (e.g. colour coding, highlighting, customising), which users need to navigate through when being pushed towards secure online behaviour.

Interdependent privacy protection is a second important and salient application field for user-centred interventions and transparency mechanisms. In online contexts such as social media or e-commerce, privacy losses or violations are ‘not always trivial to perceive and decide upon, neither for users nor for regulators’ (Garcia 2017, 1). Privacy is a highly complex affair, with one crucial factor being the various types of inherent connections among individuals and their personal data (Biczók et al. 2021; Spiekermann et al. 2022). Take the example of LinkedIn, a professional social network, that relies on users' opinions on their contacts' skills (e.g. ‘Help us identify Anna Smith's top skill’) in order to offer and sell personalised job opportunities. Another example: When a user installs a third-party application on Facebook, the application might collect not only the user's personal data, but also that of their friends. While sharing data might be advantageous for (some) consumers or users, too much transparency could at the same time pose risks to other actors, e.g. in terms of privacy or a business's market position (Linsner et al. 2021). Depending on how great the risk is perceived, the respective digital behaviour changes. This is particularly relevant with regard to vulnerable social groups, such as refugees (Steinbrink et al. 2021). These examples demonstrate that a person's privacy is not only affected by their own decisions, but also by those of other individuals or organisations, which we refer to as interdependent privacy, where ‘personal information is shared without the knowledge and/or direct consent of the data subject’ (Biczók et al. 2021). Presently, the issue of interdependent privacy displays a regulatory loophole even for the European Union (EU) General Data Protection Regulation (GDPR) (Kamleitner and Sotoudeh 2019), which confines itself to a dyadic understanding of privacy (e.g. between a company and a consumer), while leaving room for grey areas with regard to interdependent privacy infringements.

Key questions to answer in this research field are for example: (1) What are the underlying mechanisms of users' decision-making when protecting or disclosing others' personal information online? (2) To what extent can interdependent privacy infringements be reduced via design choices, such as transparency mechanisms? Although previous research on how to safeguard against interdependent privacy is still scarce, the literature on digital nudging (Weinmann, Schneider, and vom Brocke 2016) might help to provide a solid foundation for adequate protection mechanisms: Popular mechanisms are, for example, default options, positioning, colour coding, reminding of the consequences, or enabling social comparison (e.g. Caraban et al. 2019; Schneider et al. 2020; Roethke et al. 2020). Regarding users' preferences towards the design of a privacy nudge, Schöbel et al. (2020) have found default mechanisms, presentation or framing (e.g. red colour for risk), as well as privacy-related information to be among users' most preferred privacy nudges. Kamleitner and Mitchell (2019) have suggested several interventions to improve interdependent privacy protection across stakeholders, e.g. requiring additional steps of decision control in the transfer process or a preview of the actual data which is about to be shared. These suggestions provide a valuable foundation for the design of nudges in an interdependent privacy context.

4. Contributions to transparency and tailorability

In order to contribute to the state of the art in transparency and tailorability for usable security and privacy, we searched for authors that are willing to address current challenges with their research efforts. We received 13 submissions for this special issue. After two rounds of rigorous reviewing, six articles were accepted for publication. These are presented in the following.

The article ‘Exploring people's perceptions and support for data-driven technology in times of COVID-19: the role of trust, risk, and privacy concerns’ by Brahim Zarouali, Joanna Strycharz, Natali Helberger, Claes de Vreese (Universiteit van Amsterdam) addresses societal responses to, as well as the democratic legitimacy of data-driven technological applications during the COVID-19 pandemic. In the struggle against the spread of the virus, containment and tracking strategies of many European governments included the collection and use of online data. In a national representative survey in the Netherlands, the authors investigated whether the general public supports state technologies that make use of these data. The result in form of a typology revealed three different social groups, namely sceptical, carefree, and neutral respondents, which differed with regard to trust perceptions, risk beliefs, and privacy concerns. Besides clear correlations of the groups with demographic characteristics, different support levels regarding specific governmental digital solutions were also found.

The article ‘User-centred Multimodal Authentication: Securing Handheld Mobile Devices using Gaze and Touch Input’ by Mohamed Khamis, Karola Marky, Andreas Bulling and Florian Alt (University of Glasgow & University of Stuttgart & Universität der Bundeswehr München) addresses multimodal authentication schemes for the secure use of mobile devices. Since mobile devices store a large amount of sensitive personal data and metadata, such as emails or photographs, the protection of this data by secure authentication is essential. The authors, however, note that such mobile devices are often only secured by so-called single-modal authentication schemes, which can easily be bypassed. Consequently, a multimodal authentication is proposed, where several potential attacks, namely shoulder surfing, smudge attacks, and thermal attacks, are considered at the same time. Moreover, guidelines for enhanced usability and security of user authentication on mobile devices are presented.

The article ‘Data Cart – Designing a tool for the GDPR-compliant handling of personal data by employees’ by Jan Tolsdorf, Florian Dehling, and Luigi Lo Iacono (University of Applied Sciences Bonn-Rhein-Sieg) addresses the usability of data protection compliant personal data management tools. Here, the authors concentrate on the needs of employees who process sensitive personal data in their everyday job and therefore have to comply with strict data protection guidelines and laws. For this purpose, a tool was developed following a human-centred design approach to assist employees with data management and data protection compliance. By using the developed tool, employees felt more confident in dealing with sensitive personal data and had the impression that the tool would help them to improve their overall data protection awareness, reduce errors, and increase work efficiency. This builds a strong case for increased integrated implementation of Privacy by Design in digitalisation processes.

The article ‘Transparency of privacy notices: The effect of the sequential context on comprehension’ by Mariavittoria Masotina and Anna Spagnolli (Università di Padova) addresses the connection between the understandability of privacy notices on websites and their sequential context. Privacy notices – for which website operators are required to obtain users' consent – are often not clearly understood, which is related to the sequential context in which those notices are displayed. Three studies were conducted to test whether the comprehensibility of privacy notices was improved when users could link it to a certain action preceding the appearance of the notice, measuring participants' comprehension, perceived comprehension, and response. In the first two studies, the sequential connection with the action triggering the notice was either maintained or broken, and respective references to the triggering action were altered. In the third study, different sequential environments were investigated. The results indicate that the understandability of a privacy notice is significantly more enhanced by linking it to a previous action or service than by changing the content of the notice.

The article ‘Supporting Users in Data Disclosure Scenarios in Agriculture through Transparency’ by Sebastian Linsner, Franz Kuntke, Enno Steinbrink, Jonas Franken and Christian Reuter (Technical University of Darmstadt) addresses the transparent collaboration and exchange of operational data between enterprises in the field of agriculture. While agricultural enterprises need to share operational data, the disclosure of sensitive data could be disadvantageous. At the same time, increased control and transparency could also lead to information overload and increased workload. This is especially challenging for small enterprises which have to keep pace with current developments of digitalisation. During a pre-study with German farmers, the authors explored current data sharing scenarios and inquired requirements for data sharing solutions. The evaluation of a respective prototype tested by practitioners showed that transparent data sharing tools need to be flexible, secure, adapted to their workflows, and store and process data locally. While the application is accompanied by higher time expenditure, it is easy to use and raises users' awareness.

The article ‘Finding, Getting, Understanding: The user journey for the GDPR's right to access’ by Dominik Pins, Timo Jakobi, Gunnar Stevens, Fatemeh Alizadeh and Jana Krüger (University of Siegen & University of Applied Sciences Bonn-Rhein-Sieg) addresses the discrepancy between rights under data protection law and the concrete process if data subjects want to claim those rights. Awareness and control over the collection and use of personal data are seen as key elements of digital sovereignty. This sovereignty is also protected under law, in that data subjects have the right to access information about the data collected about them. However, it is unclear how this right can be asserted in concrete terms. This question was addressed by the creation of a five-phase user experience journey regarding the right to access (finding, authentication, request, access, and data use), which was subsequently conducted and evaluated by 59 participants. Based on 422 data sets spanning 139 organisations, the authors identified several interdependencies between process design and user satisfaction.

5. Conclusion and the road ahead

This article has highlighted the interdependencies between the enhancement of security and privacy and users' needs and technical savvy. Research in the field of usable security and privacy has shown that it is essential to consider the user as a central factor for cyber security, in that measures for enhanced security have to be simple, practical, time-saving, and plausible. This is reached through the consideration of transparency in such a way that the measures applied are comprehensible for the user. In addition, the aspect of tailorability is also taken into account, meaning that user interventions are personalised according to users' knowledge, behaviour, and wishes.

Table 1 presents several research directions and questions on user-centred transparency and tailorability interventions for usable privacy and security that are based on the literature and the articles published in this special issue. We specifically highlight four research frontiers related to (1) user outcomes, heuristics and groups, (2) core paradoxes and trade-offs, (3) new technologies and affordances, and (4) research methods, which researchers may want to consider in their future research endeavours.

Table 1. Transparency, Tailorability, and the Road Ahead in Usable Security and Privacy Research

User-Centred Interventions	Exemplary Intervention Mechanisms	Major Application Areas in USP Research	Research Directions and Questions
TransparencyTailorability	Mental models based Visualisations or Audibilisations of e.g. policies, feedback, warning messages, information (flows) using dashboards; dedicated application features; disaggregation, white-box approachesPersonalisation, nudging, customisation, user self-control, individual trainings	User Authentication (e.g. password managers, biometrics, CAPTCHAs) Secure Messaging and Encryption (e.g. private/ interorganisational data exchange) Anti-Phishing Efforts Storage (e.g. assured deletion, durability) Device Pairing (e.g. in IoT contexts) Web Privacy and Fair Information Practice (e.g. cookie banner, consent management, privacy dashboards) Policy Specification and Interaction Mobile/Smart Device Security and Privacy (e.g. voice assistants) Social Media Privacy (e.g. interdependent privacy) Security Administration Developer-Centred Security	User Outcomes, Heuristics and Groups What kind of user reactions depending on perceptions, attitudes, willingness and behaviours can we identify in response to intervention mechanisms across application contexts (e.g. user acceptance/reactance)? What do user sense-making-processes (i.e. mental models) and heuristics look like in detail? Which differences in interventions do various user groups and stakeholders (e.g. employees, people with disabilities, children, seniors, developers, administrators) need across all phases of product design, use, and support? How can usable security and privacy research outcomes be channelled (e.g. principles, guidelines, patterns) to enable developers to easily incorporate and apply them in their designs? Core Paradoxes and Trade-offs Disentangling the transparency paradox: Does higher transparency always lead to higher data disclosure? Is the discrepancy observed in many studies between users' privacy intentions and their actual behaviour a privacy paradox or the result of inadequate research methods? If there is such a thing as a privacy paradox, how can it be overcome? Finding a sweet spot in the trade-off between user effort and control: How to strike an optimal balance between usability and security/privacy? New Technologies and Affordances How should challenges posed by new technologies that are increasingly equipped with sensors and AI-based capabilities (e.g. wearables, smart home devices) be addressed? How can user-centred interventions based on transparency and tailorability be applied across different modalities (e.g. speech/voice control)? Research Methods How can longitudinal research methods (e.g. field experiments, ethnographic studies) be used to complement prevailing cross-sectional research methods (i.e. surveys, lab/online experiments)? How do one-off user-centred interventions differ from interventions along an entire user journey?

In sum, this article provides an introduction and the background for our special issue, which provides an overview of current contributions on usable security and privacy research with a focus on user-centred interventions and transparency mechanisms. With regard to such user interventions, the presented concepts and tools consider the issues of transparency and tailorability, in particular. Here, difficulties and challenges due to different requirements regarding different application contexts and end user groups are addressed through various technical and conceptual approaches. In addressing user needs, while at the same time providing user-friendly ways for privacy and security enhanced behaviour, the authors of the presented articles have covered various thematic fields. These include societal responses to data-driven technical applications and their democratic legitimacy; the secure use of mobile devices through the application of multi-modal authentication; easier and more secure processing of sensitive data via data protection compliant personal data management tools; transparency and understandability of privacy notices in connection with the sequential context of these notices; transparent collaboration and exchange of operational data between agricultural enterprises in the trade-off between data disclosure, time-saving, and user-friendliness; and the concrete assertion of privacy rights under data protection law as a key element of digital sovereignty.

In conclusion, we hope that this article at hand can contribute to advancing the current discourse on the topic of usable security and privacy and help stimulate and inspire future research in our discipline.

Acknowledgments

We would like to thank the editor-in-chief of Behaviour and Information Technology, Prof. Panos Markopoulos, for giving us the opportunity to edit this special issue and all authors and reviewers for their contributions to make this special issue possible.

Disclosure statement

No potential conflict of interest was reported by the authors.

Correction Statement

This article has been republished with minor changes. These changes do not impact the academic content of the article.

Additional information

Funding

This research work has been funded by the German Federal Ministry of Education and Research (BMBF, 16KIS1508) and the Hessian Ministry of Higher Education, Research, Science and the Arts within their joint support of the National Research Center for Applied Cybersecurity ATHENE, by the Centre Responsible Digitality and by the Deutsche Forschungsgemeinschaft (DFG, German Research Foundation) – SFB1119: CROSSING (236615297), and Accountable AI (471168026).