Grant: Discovery Grants Program - Individual

Users are exposed to a variety of security and privacy risks, ranging from sophisticated cybersecurity attacks such as ransomware to the collection and distribution of their personal information. To protect users, we must i). improve the design of security and privacy systems so that they meet the needs of users, and ii) improve their mental models of security and privacy systems. A mental model is the user's understanding of how a security or privacy system works and improving these mental models can lead to more security and privacy conscious behaviours. With regards to users, prior work in usable security has primarily focused on a homogenous group of users with similar capabilities, backgrounds, and experiences. This means that the design of security and privacy systems, such as those for improving users' mental models of security and privacy do not reflect the needs of underserved groups, making these systems less effective for them. This is especially problematic as some underserved groups may be more vulnerable to security and privacy risks due to their backgrounds or circumstances (e.g., low digital literacy skills). The objective of this research program is to understand the security and privacy experiences of underserved users, such as those from low-socioeconomic (SES) backgrounds and immigrants, and design interactive systems to improve their security and privacy. The long-term objective of this research program is to enable Canadians from low-SES backgrounds and new Canadian immigrants to safely access digital services and resources, by creating a design framework and technical solutions which are sensitive to the unique security and privacy threats faced by individuals from these communities. The short-term objective is to develop the design guidelines for the security and privacy of individuals from low-socioeconomic (SES) backgrounds. Specifically, we explore low-SES users experiences with web-based technologies and mobile devices, using threat-modelling to understand the threats they experience and mitigation strategies they use to protect themselves from these threats. Finally, we look at understanding the security and privacy mental models of Canadian low-SES users, and design interactive technologies to improve these mental models in the context of the Canadian digital ecosystem.