A fundamental aspect of specifying data usage in the context of business-to-business data sharing is the definition of data usage conditions, technically represented as policies. Policies can be multifaceted and complex and are primarily used in a case dependent way. This often leads to challenges in the requirements engineering process, e.g., unclear requirements, complex representations, and/or inconsistent interpretations of policies. To address these problems, we introduce the Data Usage Policy pattern that defines the syntax of policies in data sharing. The pattern helps with the structured elicitation and analysis of data usage conditions and enables the creation of a consistent system design. We derive six pattern primitives and a policy grammar from scientific literature and existing requirements of four selected dataspace initiatives, that show a high level of technical maturity, and present them along with a three-step process for policy analysis. We demonstrate the applicability of our contributions with an application example.

Privacy policies are often used to fulfill the requirement of transparency of data protection legislation like the General Data Protection Regulation of the European Union. The privacy policies are used to describe how the data subject’s data are handled by the data controller. Domain and legal experts mostly create these policies manually. We propose a tool-supported method to improve the creation of accurate privacy policies based on information from the development phase of a system. During privacy and security threat analyses information about system behavior is collected in form of data-flow diagrams. These diagrams describe which data flows from where to where within the system and to which external actors. Based on this data-flow information we can create the basic structure of a privacy policy, already containing the data-flows. The extracted information is one of the most important parts of a privacy policy, providing transparency when data is transferred to external parties.

In a previous publication, we have introduced Risk Issue Questionnaires (RIQs) that serve to support risk identification for critical systems. The starting point of our risk identification method are architectural patterns contained in a system architecture, e.g., process control loops or interactive systems. A RIQ enumerates the typical risks associated with such a pattern. By assessing for each issue contained in a RIQ whether it is relevant or not, risks for the system under analysis are identified in a systematic way. In this paper, we complement the RIQ method by a method to set up and validate CORAS threat models for documenting the identified risks. In this way, we provide a basis to perform the further steps of a model-based risk management process. We equip our RIQs with modeling hints that specify what kind of modeling element should be used to represent a given issue in a threat model. Furthermore, we define formal validation conditions (VCs) that allow the risk modeler to check the generated threat models for coherence and completeness, and present a modeling tool that is able to check the defined VCs.

Stack Overflow (SO) is a popular platform among developers seeking advice on various software-related topics, including privacy and security. As for many knowledge-sharing websites, the value of SO depends largely on users’ engagement, namely their willingness to answer, comment or post technical questions. Still, many of these questions (including cybersecurity-related ones) remain unanswered, putting the site’s relevance and reputation into jeopardy. Hence, it is important to understand users’ participation in privacy and security discussions to promote engagement and foster the exchange of such expertise. Objective : Based on prior findings on online social networks, this work elaborates on the interplay between users’ engagement and their privacy practices in SO. Particularly, it analyses developers’ self-disclosure behaviour regarding profile visibility and their involvement in discussions related to privacy and security. Method : We followed a mixed-methods approach by (i) analysing SO data from 1239 cybersecurity-tagged questions along with 7048 user profiles, and (ii) conducting an anonymous online survey (N=64). Results : About 33% of the questions we retrieved had no answer, whereas more than 50% had no accepted answer. We observed that proactive users tend to disclose significantly less information in their profiles than reactive and unengaged ones. However, no correlations were found between these engagement categories and privacy-related constructs such as perceived control or general privacy concerns . Implications : These findings contribute to (i) a better understanding of developers’ engagement towards privacy and security topics, and (ii) to shape strategies promoting the exchange of cybersecurity expertise in SO.

: Privacy policies are used to inform end-users about the processing of their personal data by service providers on the Internet. These policies are, however, not systematically enforced. There could be discrepancies between the policy provided to the end-users and the actual access control policies applied by the service provider. We propose the Privacy Policy Based Access Control (P2BAC) system to tackle this issue. P2BAC uses computer-processable privacy policies expressed in the Prolog-Layered Privacy Language (P-LPL) to make decisions on whether some data may be accessed for a specific purpose. With P2BAC we extend the Privacy Policy Compliance Guidance (PriPoCoG) framework. Since P-LPL privacy policies can be customized by the end-user, we can consider end-users’ privacy preferences during access control. P2BAC uses query rewriting to perform the access control. The decision point is implemented in Prolog and directly operates on the P-LPL privacy policy.

Access-Control Lists (ACLs) (a.k.a. friend lists) are one of the most important privacy features of Online Social Networks (OSNs) as they allow users to restrict the audience of their publications. Nevertheless, creating and maintaining custom ACLs can introduce a high cognitive burden on average OSNs users since it normally requires assessing the trustworthiness of a large number of contacts. In principle, community detection algorithms can be leveraged to support the generation of ACLs by mapping a set of examples (i.e. contacts labelled as untrusted) to the emerging communities inside the user's ego-network. However, unlike users' access-control preferences, traditional community-detection algorithms do not take the homophily characteristics of such communities into account (i.e. attributes shared among members). Consequently, this strategy may lead to inaccurate ACL configurations and privacy breaches under certain homophily scenarios. This work investigates the use of community-detection algorithms for the automatic generation of ACLs in OSNs. Particularly, it analyses the performance of the aforementioned approach under different homophily conditions through a simulation model. Furthermore, since private information may reach the scope of untrusted recipients through the re-sharing affordances of OSNs, information diffusion processes are also modelled and taken explicitly into account. Altogether, the removal of gatekeeper nodes is further explored as a strategy to counteract unwanted data dissemination.

This work reviews existing research about attributes, which are assessed by individuals to evaluate the trustworthiness of (i) software applications, (ii) organizations (e.g., service providers), and (iii) other individuals. As these parties are part of social media services, previous research has identified the need for users to assess their trustworthiness. Based on the trustworthiness assessment, users decide whether they want to interact with them and whether such interactions appear safe. The literature review encompasses 264 works from which so-called trustworthiness facets of 100 papers could be identified. In addition to an overview of trustworthiness facets, this work further introduces a guideline for software engineers on how to select appropriate trustworthiness facets during the analysis of the problem space for the development of specific social media applications. It is exemplified by the problem of “catfishing” in online dating.

Users generate a massive amount of personal, partly sensitive data in online social media. In the past, data breaches made evident that service providers of social media lack in adequately protecting this data leading to user concerns in regards to their privacy. Privacy-preserving social media emerged to address this issue by providing more secure environments for private social exchanges. However, these platforms often fall short of attracting users away from conventional social media and establishing users' trust in them. In this work, we aim to enhance the trustworthiness of privacy-preserving social media, in particular a hybrid social media application. For this purpose, we first analyze the relationships between privacy concerns, trusting beliefs, risk beliefs, and willingness to use. Second, we examine the effect of user characteristics on these relationships. Third, we mitigate privacy concerns via trust-related software features developed with the TrustSoFt method. We conduct a thorough user study to assess the impact of these features on the privacy concerns and trustworthiness. Our findings indicate the special importance of addressing particular privacy concerns, such as "Awareness of Privacy Practices". Furthermore, results suggest that older individuals as well as individuals that have experience with privacy incidents, are more susceptible to trust-related software features.

Online self-disclosure is perhaps one of the last decade’s most studied communication processes, thanks to the introduction of Online Social Networks (OSNs) like Facebook. Self-disclosure research has contributed significantly to the design of preventative nudges seeking to support and guide users when revealing private information in OSNs. Still, assessing the effectiveness of these solutions is often challenging since changing or modifying the choice architecture of OSN platforms is practically unfeasible. In turn, the effectiveness of numerous nudging designs is supported primarily by self-reported data instead of actual behavioral information. Objective: This work presents ENAGRAM, an app for evaluating preventative nudges, and reports the first results of an empirical study conducted with it. Such a study aims to showcase how the app (and the data collected with it) can be leveraged to assess the effectiveness of a particular nudging approach. Method: We used ENAGRAM as a vehicle to test a risk-based strategy for nudging the self-disclosure decisions of Instagram users. For this, we created two variations of the same nudge (i.e., with and without risk information) and tested it in a between-subjects experimental setting. Study participants (N=22) were recruited via Prolific and asked to use the app regularly for 7 days. An online survey was distributed at the end of the experiment to measure some privacy-related constructs. Results: From the data collected with ENAGRAM, we observed lower (though non-significant) self-disclosure levels when applying risk-based interventions. The constructs measured with the survey were not significant either, except for participants’ External Information Privacy Concerns (EIPC). Implications: Our results suggest that (i) ENAGRAM is a suitable alternative for conducting longitudinal experiments in a privacy-friendly way, and (ii) it provides a flexible framework for the evaluation of a broad spectrum of nudging solutions.

Getting to know new people online to later meet them offline for neighbourhood help, carpooling, or online dating has never been as easy as nowadays by social media performing computer-mediated introductions (CMIs). Unfortunately, interacting with strangers poses high risks such as unfulfilled expectations, fraud, or assaults. People most often tolerate risks if they believe others are trustworthy. However, conducting an online trustworthiness assessment usually is a challenge. Online cues differ from offline ones and people are either lacking awareness for the assessment’s relevance or find it too complicated. On these grounds, this work aims to aid software engineers to develop CMI that supports users in their online trustworthiness assessment. We focus on trust-related software features and nudges to i) increase user awareness, ii) trigger the trustworthiness assessment and iii) enable the assessment online. For that reason, we extend feature models to provide software engineers the possibility to create and document software features or nudges for trustworthiness assessment. The extended feature models for trustworthiness assessments can serve as reusable catalogues for validating features in terms of their impact on the trustworthiness assessment and for configuring CMI software product lines. Moreover, this work provides an example of how the extended feature models can be applied to catfishing protection in online dating.

The General Data Protection Regulation (GDPR) makes the creation of compliant privacy policies a complex process. Our goal is to support policy authors during the creation of privacy policies, by providing them feedback on the privacy policy they are creating. We present the Privacy Policy Compliance Guidance (PriPoCoG) framework supporting policy authors as well as data protection authorities in checking the compliance of privacy policies. To this end we formalize the Layered Privacy Language (LPL) and parts of the GDPR using Prolog. Our formalization, ‘Prolog-LPL’ (P-LPL), points out inconsistencies in a privacy policy and problematic parts of a policy regarding GDPR-compliance. To evaluate P-LPL we translate the Amazon.de privacy policy into P-LPL and perform a compliance analysis on this policy.

Peer-to-peer systems have become an essential element of computer networks and represent a special category of distributed systems. The strong decentralization as well as the scalability and fault tolerance are only some of the reasons why many companies have adopted this technology. Peer-to-peer systems consist of different subsystems, connected by a network. The decomposition into these subsystems requires a detailed analysis and documentation of functional requirements, which is a challenging task. In previous work, we proposed a method based on Jackson’s problem frames approach that allows for modeling and documenting of functional requirements for distributed systems. To render knowledge about requirements for distributed systems reusable, we developed patterns as an extension for problem frames. However, these patterns (socalled frames) do not capture the specific characteristics of peer-to-peer systems. We thus analyzed typical requirements of peer-to-peer systems and observed several frames specific to peer-to-peer functionalities. We call these frames P2P frames. In this paper, we present frames for bootstrapping, query routing in unstructured networks, and the data transfer process in such systems. We also present our pattern system for requirements engineering, consisting of problem frames and frames for distributed systems, which helps software engineers to select suitable frames.