Software vulnerabilities are present in many software systems, putting people who entrust software with their data in harm's way. Many vulnerabilities are avoidable since they are well documented - yet they remain widespread. One explanation for their persistence is they represent software blindspots, problems that are implicit in the mental models of developers and which escape attention (Brun et al., 2023). Our current understanding of how attention and decision making influence specific secure coding behaviours is limited, and so we present a preregistered study to evaluate whether differences in decision making style impact blindspots and the identification of code vulnerabilities. Programmers were given code puzzles to complete, including some that contained vulnerabilities. Participants also competed the cognitive reflection test and measures of rational decision making. We replicate several key predictions from previous blindspot research, map the analysis onto dual-systems research, and describe effect sizes of psychological constructs. We then model data simulations to demonstrate the sampling required for highly powered empirical studies in this domain. We support previous findings that technical or cybersecurity expertise have little impact on the ability to detect vulnerabilities. We argue that dual processing theory helps to interpret security behaviours and the presence of software blindspots.

Autonomous agents operating in socio-critical settings must coordinate with humans under uncertainty while respecting explicit safety constraints. Existing approaches either account for social dynamics without formal guarantees or provide formal assurance while abstracting away human behaviour. We introduce FormIDEAble, a formally grounded approach for synthesising socially-aware cooperation strategies with safety guarantees. The cooperation between humans and the autonomous agent is modelled as a Priced Timed Markov Decision Process, and decision-making is formulated as a cost-bounded reachability problem. We illustrate the approach using an emergency evacuation scenario. Initial experimental evidence demonstrates the effectiveness of the approach and highlights the trade-offs between optimisation and safety guarantees. FormIDEAble provides a principled foundation for formally assured, socially-aware decision-making in socio-critical systems.

Security vulnerabilities are present in many software systems, putting those who entrust software with their data in harm’s way. Many vulnerabilities are avoidable since they are not new and are well-described. Despite this awareness, they remain widespread. One hypothesis for their persistence is that they represent software blindspots, problems that are implicit in the mental models of developers and thus escape attention (Brun et al., 2023; Oliveira et al. 2018). Our current understanding of how cognitive influences secure coding is limited, and we address this by extending the hypothesis by suggesting differences in decision making approaches alter the ability to detect vulnerabilities. Through an empirical study and power analysis, we show the potential value of dual processing theory, where individuals make decisions using one of two cognitive systems: a default system reliant on heuristics and intuitive mechanisms, and a more deliberate and computational interventionist system. This preregistered study replicates key predictions from previous blindspot research, extends the analysis towards cognition, and models effect sizes of variables that might impact software security. We complement this analysis with data simulations to expose the sampling scale of empirical studies that would be necessary for highly powered work in this domain.

Software technology is undergoing a paradigm shift driven by two converging trends. First, the scope of software responsibility has expanded significantly: as “software-defined everything” becomes a reality, software has evolved into the integration core of sociocyber-physical systems (SCPSs). Second, the capabilities and development methods of software are being greatly enhanced by recent breakthroughs in artificial intelligence (AI). This article presents perspectives and observations on software engineering in this era of rapid progress. We aim to outline a set of foundational challenges in engineering SCPSs and highlight the need for innovative software solutions that extend beyond AI technologies alone. Specifically, we examine the need for a new paradigm that can address the complexities introduced by SCPSs, which challenge conventional paradigms through the blurring of system boundaries, continuous lifecycle evolution, and the embracing of inherent uncertainty. We highlight new engineering principles of socio-technical co-design, cyber-physical integration, and development-operation convergence, and a knowledge- and data-driven approach to taming uncertainty. Emerging proposals, including digital humanism, agentic SCPS, ubiquitous operating system, and continuous quality assurance, are discussed alongside possible extensions to existing technologies. We then outline key research directions for both runtime support and quality assurance. On the runtime side, we argue for a new generation of software infrastructure for SCPSs, including unified hardware abstractions, scalable and resilient runtime systems, AI-enabled system management, and human-centric operating system primitives. On the assurance side, we highlight the need for new approaches combining unified socio-cyber-physical modeling, specification of both technical and non-technical properties, data-driven simulation and testing, continuous verification, and runtime monitoring under uncertainty. Furthermore, we present specific challenges within key application domains, including intelligent vehicles, smart manufacturing, and smart cities. In doing so, we aim to stimulate discussion within the software engineering community and encourage support from industry and government to address the critical engineering and governance issues inherent to this new generation of systems.

Software profoundly influences how we live and work, often reflecting human behavior and societal values. Consequently, software-intensive systems and software engineering technologies must be developed and deployed responsibly to avoid harming users, society, or the environment. This raises questions about what constitutes the responsible development and use of technology, including which human values and which social and environmental norms are embedded in software engineering practices and products. With the increased incorporation of AI in software-intensive systems, software engineers are confronted with even more ethical and moral choices to incorporate into these processes and products. To address these responsibility issues, the workshop hosted a half-day event featuring themed presentation tracks, interactive discussions, and a stimulating concluding panel. The workshop comprised research papers (visionary, exploratory, empirical, and solution-oriented) and industrial papers (lessons learned and challenges) published in the ACM workshop proceedings.

Gender-based online harm has become a global problem due to technological advances and affordances. Despite an increasing interest in designing technical and legal interventions in tackling online harm, the level of online violence against women and girls remains high. Responsible design plays a pivotal role in mitigating technological harms, and it has particularly captured attention in the era of Artificial Intelligence (AI). This workshop aims to use the sociotechnical imaginary framework to bring together HCI researchers, developers, and practitioners across domains and sectors to collectively reflect and envision how responsible design can address gender-based online harm. Through facilitated hands-on activities, participants will explore how new approaches, paradigms, technologies, and mechanisms can be designed and implemented to better understand the responsibility in responsible design. This will also help the HCI community understand how to put responsible design into practice and shape the future of responsible technology that prevents gender-based online harms.

Social identity is a concept from psychology that refers to the part of an individual's identity that derives from their group membership(s). In this paper, we explore social identity in members of the professional community of Research Software Engineers (RSEs). Using a mixed-methods approach, our study combined computational linguistic analysis and inferential statistics to examine over 28,000 social media posts, 1,700 blogs, and survey responses from 381 professional RSEs. The findings highlight the emergence of a collective RSE identity and demonstrate its role in shaping professional wellbeing. This study contributes an interdisciplinary perspective by integrating social psychology and software engineering to show how a professional identity evolves and why it matters.

Authentication is crucial to confirm that an individual or entity trying to perform an action is actually who or what they claim to be. In dynamic environments such as the Internet of Things (IoT), Internet of Vehicles (IoV), healthcare, and smart cities, security risks can change depending on varying contextual factors (e.g., user attempting to authenticate, location, device type). Thus, authentication methods must adapt to mitigate changing security risks while meeting usability and performance requirements. However, existing adaptive authentication systems provide limited guidance on (a) representing contextual factors, requirements, and authentication methods (b) understanding the influence of contextual factors and authentication methods on the fulfilment of requirements, and (c) selecting effective authentication methods that reduce security risks while maximizing the satisfaction of the requirements. This paper proposes a framework for engineering adaptive authentication systems that dynamically select effective authentication methods to address changes in contextual factors and security risks. The framework leverages a contextual goal model to represent requirements and the influence of contextual factors on security risks and requirement priorities. It uses an extended feature model to represent potential authentication methods and their impacts on mitigating security risks and satisfying requirements. At runtime, when contextual factors change, the framework employs a Fuzzy Causal network encoded using the Z3 SMT solver to analyze the goal and feature models, enabling the selection of effective authentication methods. We demonstrate and evaluate our framework through its application to real-world authentication scenarios in the IoV and the healthcare domains.

Digital forensic investigations can be disrupted when actors tamper with digital artefacts on devices before they are seized. This activity, when undetected, misleads investigations and results in incorrect findings. Several established research approaches in digital forensics use formal models to identify whether a specific action has occurred through event reconstruction. However, we address two specific concerns which limit their use when investigating tampering actions. First, current understanding of tampering is based solely on informal natural language descriptions; no representations of tampering exist that can be used with the reasoning applied with formal models. Second, mathematically solving these types of reconstruction problems relies on generating relevant input models and analysing their state-space, which is considered to be impractical for real-life cases. For the first of these concerns, we extend the ‘Temporal Logic of Security Actions’ (S-TLA) language to describe a general system and introduce the property of ‘action visibility’. We use this to create a model that represents one type of tampering, artefact destruction, and characterise it into four specific sub-types. For the second concern, we apply inductive reasoning to study the impact of artefact destruction on a generic system through comparing its state before and after the action. From this we characterise features of a system which has been subject to this tampering action. We present two brief case studies which illustrate how such features can be used to recognise whether tampering has occurred. Finally, we extend this technique to other types of artefact tampering to create a knowledge framework that can be used to aid the recognition of tampering activity.

Organisations designing, developing, and deploying machine learning systems (MLS) need to be able to check that these systems are trustworthy, and communicate this clearly to their stakeholders, be they different categories of users, engineers, or wider society. By focusing on stakeholders, Requirements Engineering is well positioned to drive the design and engineering of MLS that align with the needs of their stakeholders. Yet, we still need a systematic process for modelling and reasoning about requirements for MLS that is driven both by stakeholders' needs and constraints for MLS development. This paper proposes a framework entitled REAL (Requirements Engineering for mAchines that Learn - and Fail) to help develop MLS that align with stakeholders' needs by adopting a requirements engineering approach. This model-based framework is based on three principles. First, weaving together requirements for data, models, and the system as a whole. Second, using failure to drive the exploration of alternative requirements. Third, iterative and traceable refinement of MLS requirements. We demonstrate the proposed framework using an example from autonomous driving and show that REAL supports the development of MLS that better align with stakeholders' requirements. A replication package is available online.

Large language models (LLMs) have enabled new tools in requirements engineering (RE), often in the form of intelligent agents or virtual assistants. These tools can transform how software engineers perform RE tasks and interact with stakeholders. However, existing research primarily focuses on showcasing the capabilities of these tools rather than their design and evaluation in RE-specific contexts. This limits our understanding of their practical value and hinders broader adoption. To address this gap, we propose a reference model to guide the design, use, and evaluation of intelligent RE agents. Our work introduces new RE use cases, along with evaluation metrics for intelligent RE agents. We present a study design to support systematic development and share early findings demonstrating the feasibility of our approach. The use cases show how agents can add value for RE practitioners, while our synthesized catalogue supports tool evaluation. Finally, our analysis of commercial agents reveals that these tools already support certain aspects of the envisioned RE use cases.

The security of software systems remains a critical sociotechnical challenge despite existing tools and processes. The articles in this special issue address aspects of security that go beyond code, offering ways to empower developers, provide trust and assurance, and address planning and regulation requirements.

Smart home users often lack the technical expertise required to secure their devices and could benefit from the automated selection of security controls. In this paper, we explore the capabilities of inductive learning to adapt the requirements and system specification of a smart home system to identify security controls. We present preliminary results from using Inductive Learning via Answer Set Programming (ILASP) to learn how to produce (1) an updated system specification that enables benign behaviours while excluding malicious ones and (2) updated security requirements that the system should satisfy. We encode traces of benign and malicious execution traces from two smart home attack datasets (CICIoT2023 and IoT-23) into ILASP's language. ILASP could learn updated system specifications (to prevent DoS/Botnet attacks), new security requirements (to check for malware uploads and insecure protocols), and other integrity constraints that could be indicators of compromise. However, challenges remain when ILASP cannot perform the learning due to its sensitive syntax or complex system behaviour that lead to a large analysis space. Finally, we discuss how these limitations can be addressed in future work.

I served as Editor-in-Chief of IEEE Transactions on Software Engineering for four years between 2010 and 2013. Then and now I advocated for a broadening of software engineering to incorporate a range of multi-disciplinary inputs and to address human and social concerns. In this retrospective editorial, I reflect on the considerable progress that has been made in the intervening years and make the case for an even more radical reframing of the software engineering discipline. Such a reframing will require new trans-disciplinary methodologies for research and practice, and new representations of the lived experiences and values of software users. I suggest two conceptual shorthands for what I advocate: Living Labs 2.0 and Context 2.0. Dear reader, please forgive my indulgence.

Smart home technologies, like cameras, door locks, and speakers, are increasingly used in our everyday lives. However, their continuous data collection and internet connectivity pose various security risks. While research on smart home security has mainly focused on technological aspects, human experience and societal factors also play a crucial role. Various human and social factors, such as user experience with smart home devices, security design processes, and government regulations, are intertwined and influence each other, affecting smart home security. It is therefore important to understand and consider these interconnected factors in technology design to secure homes that contain increasingly connected devices. This scoping review provides an overview of current human-centered studies (N=102) on smart home security, which aims to help researchers and practitioners better navigate this field. We present a conceptual framework that outlines key challenges in ensuring smart home security with a synthesis of insights on contributing human factors. We then summarize general security design principles and map existing user-centred security approaches in smart homes, and highlight research directions for future investigation. Beyond mapping existing studies, the review reveals a growing emphasis on engaging multiple stakeholders, especially smart home users, in shaping human-centered security.

Supply chains are fundamental to the economic functioning of society, through the assembly and transport of essential goods such as food, clothes and medicine. Technological advancements have driven supply chains to become increasingly automated, to optimise for efficiency and cost, and to respond to disturbances. However, optimising for social concerns is less prevalent. Increasing consumer preferences towards purchasing goods whose production is more aligned with those consumers’ values (such as sustainability), requires values-management capabilities within supply chain software. Such capabilities include tracing, monitoring, and verifying values-alignment between end-consumers and stakeholders. In this paper, we advocate for adaptive values-alignment between end-consumers and stakeholders in cyber-physical supply chains. We motivate this by means of an example of a coffee supply chain, which in turn surfaces social and technical challenges to values-alignment. We then propose a distributed, locally adaptive values-alignment approach. We implement this approach within a software framework and quantitatively illustrate its impact in increasing alignment from two competing perspectives: supply chain stakeholders and end-consumers. We show that end-consumer bias performs better by reducing values-misalignment by up to 85

Context and Motivation] Software engineers can interact with users through digital channels (e.g., online forums) to exchange information about software products and achieve their requirements engineering (RE) goals. However, conducting RE manually is challenging due to the large number of users and the volume of their online feedback. [Question/Problem] Previous work has proposed tools to automatically extract useful information from online feedback (e.g., feature requests); however, these tools suffer from three major limitations: (i) an overlooked RE perspective in their design and evaluation; (ii) insufficient functional and performance capabilities; and (iii) missing evaluations of their ability to address RE needs. [Principal Idea/Results] This paper presents a vision for an intelligent RE software agent designed to overcome these limitations. Specifically, our vision explores how RE can guide the design and evaluation of software agents powered by large language models (LLMs), proposes empirical assessments of LLMs for RE usage and the agent's ability to meet RE needs. [Contributions] Our contribution is threefold: (i) a vision for an RE agent, (ii) identification of key challenges, and (iii) a roadmap to address current limitations.

Loneliness is a growing public health concern, particularly among older adults, and has been linked to adverse physical and mental health outcomes. This study presents a machine learning approach to predict levels of loneliness using behavioural and emotional data collected from 124 participants through a mobile phone application over a 71-day period. The dataset includes 27 features derived from self-logged information such as wellbeing scores, mood fluctuations, and time spent in various home locations.Feature selection was applied to identify the most discriminative indicators, with classification and regression models evaluated using both Support Vector Machine (SVM), and Random Forest (RF). We applied feature selection to identify the most discriminative indicators and evaluated both Support Vector Machine (SVM) and Random Forest (RF) models for classification and regression. The highest classification accuracy—69.19% on a 7-point loneliness scale—was achieved using a five-fold SVM with the top 13 features. In the regression task, the best performance was observed using 26 features, resulting in a minimum Mean Squared Error (MSE) of 0.6752.These findings indicate that a selected subset of behavioural and emotional features can offer a meaningful estimation of loneliness levels. This has potential to inform the design of real-time, personalised digital tools aimed at identifying and supporting individuals at risk of loneliness.

While the technical and ethical challenges of using drones in Search-and-Rescue operations for transnationally displaced individuals have been explored, how drone footage can shape psychological processes at play and impact post-rescue legal decision-making has been overlooked. This paper investigates how transnationally displaced individuals' social identities are portrayed in court and the role of drone footage in reinforcing these identities. We conducted a discourse analysis of 11 open-access asylum and deportation cases following drone-assisted Search-and-Rescue operations at sea (2015–2021). Our results suggest two primary identity constructions: as victims and as traffickers, each underpinned by conflicting psychological processes. The defence portrayed the defendants through the lens of vulnerability, while the prosecution through unlawfulness. Psychological attributions of drone footage contributed differently to identity portrayal, influencing legal decisions regarding the status and entitlements of transnationally displaced individuals. We discuss the socio-ethical implications of these findings and propose a psychosocial account for responsible innovation in technology mediated humanitarian contexts.