Technology-facilitated abuse (TFA) is a widespread and harmful dimension of interpersonal violence. Documenting TFA can unlock mitigative actions for survivors such as legal orders of protection, but existing documentation tools are insufficient. This paper considers whether a trauma-informed design approach could yield more effective methods for documenting TFA and how, concretely, to approach trauma-informed digital evidence collection. Toward this goal, we use trauma-informed methods to design a new tool, Sherloc, that helps identify and document TFA within tech clinic interventions. We evaluated Sherloc in feedback sessions with legal experts, then in a small pilot program in the U.S. From our design inquiry, we present novel guidelines for trauma-informed digital evidence collection. We call on HCI researchers to build on our work to envision trauma-informed methods of documenting TFA.

Indigenous peoples across Turtle Island (North America) face disproportionate rates of disappearance and murder, a "genocide" rooted in settler-colonial violence and systemic erasure. Technology plays a crucial role in the Missing and Murdered Indigenous Relatives (MMIR) crisis: perpetuating harm and impeding investigations, yet enabling advocacy and resistance. Communities utilize technologies such as AMBER alerts, news websites, social media groups, and campaigns (like #MMIW, #MMIWR, #NoMoreStolenSisters, and #NoMoreStolenDaughters) to mobilize searches, amplify awareness, and honor missing relatives. Yet, little research in HCI has critically examined technology's role in shaping the MMIR crisis by centering community voices. Through a large-scale study, we analyze 140 webpages to identify systemic, technological, and institutional barriers that hinder communities' efforts, while highlighting socio-technical actions that foster healing and safety. Finally, we amplify Indigenous voices by providing a dataset of stories that resist epistemic erasure, along with recommendations for HCI researchers to support Indigenous-led initiatives with cultural sensitivity, accountability, and self-determination.

Technology-facilitated abuse (TFA) is a pervasive form of intimate partner violence (IPV) that leverages digital tools to control, surveil, or harm survivors. While tech clinics are one of the reliable sources of support for TFA survivors, they face limitations due to staffing constraints and logistical barriers. As a result, many survivors turn to online resources for assistance. With the growing accessibility and popularity of large language models (LLMs), and increasing interest from IPV organizations, survivors may begin to consult LLM-based chatbots before seeking help from tech clinics. In this work, we present the first expert-led manual evaluation of four LLMs - two widely used general-purpose non-reasoning models and two domain-specific models designed for IPV contexts - focused on their effectiveness in responding to TFA-related questions. Using real-world questions collected from literature and online forums, we assess the quality of zero-shot single-turn LLM responses generated with a survivor safety-centered prompt on criteria tailored to the TFA domain. Additionally, we conducted a user study to evaluate the perceived actionability of these responses from the perspective of individuals who have experienced TFA. Our findings, grounded in both expert assessment and user feedback, provide insights into the current capabilities and limitations of LLMs in the TFA context and may inform the design, development, and fine-tuning of future models for this domain. We conclude with concrete recommendations to improve LLM performance for survivor support.

The recent rollout of passkeys by hundreds of web services online is the largest attempt yet to achieve the goal of pass-wordless authentication. However, new authentication mechanisms can often overlook the unique threats faced by at-risk users, such as survivors of intimate partner violence, human trafficking, and elder abuse. Such users face interpersonal threats: adversaries who routinely have physical access to devices and either know or can compel disclosure of passwords or PINs. The extent to which passkeys enable or mitigate such interpersonal threats has not yet been explored. We perform the first analysis of passkeys in interpersonal threat models. To do so, we introduce an abusability analysis framework to help practitioners and researchers identify ways in which new features can be exploited in interpersonal threat models. We then apply our framework to the setting of passkeys, ultimately investigating 19 passkey-supporting services. We identify a variety of abuse vectors that allow adversaries to use passkeys to cause harm in interpersonal settings. In the most egregious cases, flawed implementations of major passkey-supporting services allow ongoing illicit adversarial access with no way for a victim to restore security of their account. We also discover abuse vectors that prevent users from accessing their accounts or that help attackers emotionally manipulate (gaslight) users.

Automation apps such as iOS Shortcuts and Android Tasker enable users to "program" new functionalities, also called recipes, on their smartphones. For example, users can create recipes to set the phone to silent mode once they arrive at their office or save a note when an email is received from a particular sender. These automation apps provide convenience and can help improve productivity. However, these automation apps can also provide new avenues for abuse, particularly in the context of intimate partner violence (IPV). This paper systematically explores the potential of automation apps to be used for surveillance and harassment in IPV scenarios. We analyze four popular automation apps — iOS Shortcuts, Samsung Modes & Routines, Tasker, and IFTTT — evaluating their capabilities to facilitate surveillance and harassment. Our study reveals that these tools can be exploited by abusers today to monitor, impersonate, overload, and control their victims. The current notification and logging mechanisms implemented in these automation apps are insufficient to warn the victim about the abuse or to help them identify the root cause and stop it. We therefore built a detection mechanism to identify potentially malicious Shortcuts recipes and tested it on 12,962 publicly available Shortcuts recipes. We found 1,014 recipes that can be used to surveil and harass others. We then discuss how users and platforms mitigate such abuse potential of automation apps.

As computer security threats continue to grow, it is critical that all computer science (CS) students develop foundational security principles, including the complex but essential concept of a security mindset. However, much of the existing security education literature lacks grounding in the learning sciences, often portraying students as passive recipients of facts rather than active co-constructors of knowledge. To address this gap, we conducted a qualitative study to examine evidence of a security mindset in situ, laying the foundation for future research on when and how this mindset emerges. We analyzed think-aloud coding sessions modeled on the Build-It phase of the Build-It, Break-It, Fix-It (BIBIFI) competition. Despite limited or no prior exposure to computer security, participants exhibited core aspects of a security mindset, including secure design practices and threat perception. These findings suggest that students can demonstrate meaningful security reasoning even without formal coursework, highlighting opportunities for low-overhead interventions to cultivate a security mindset. Our results inform future research and pedagogical design targeting foundational security thinking in undergraduate CS education.

When survivors of technology-facilitated abuse (TFA) suspect someone has accessed their online accounts, they often rely on built-in account security interfaces (ASIs), such as trusted device lists within settings, to assess account compromise. However, these interfaces typically offer limited or ambiguous details about past account accesses and security-critical events. Under right of access provisions in data protection laws, users can request structured exports of their personal data from online services. In this study, we explore whether and how data exports can supplement ASIs to support compromise investigations, particularly in interpersonal threat contexts. We simulated four types of account compromise attacks across six popular platforms, analyzing the resulting data exports and ASIs. Our findings show that data exports consistently contain more granular login histories and richer device/network identifiers than interfaces. Some even link security-related actions (e.g., password changes) and other post-authentication activity to specific devices, offering forensic value for identifying compromise. We discuss usability and other practical challenges of using data exports during TFA interventions.

FIDO synced passkeys address account recovery challenges by enabling users to back up their FIDO2 private signing keys to the cloud storage of passkey management services (PMS). However, it introduces a serious security risk — attackers can steal users' passkeys through breaches of PMS's cloud storage. Unfortunately, existing defenses cannot eliminate this risk without reintroducing account recovery challenges or disrupting users' daily account login routines. In this paper, we present CASPER, the first passkey breach detection framework that enables web service providers to detect the abuse of passkeys leaked from PMS for unauthorized login attempts. Our analysis shows that CASPER provides compelling detection effectiveness, even against knowledgeable attackers who strategically optimize their attacks to evade CASPER's detection. We also show how CASPER can be seamlessly integrated into the existing passkey backup, synchronization, and authentication processes, with only minimal impact on user experience, negligible performance overhead, and minimum deployment and storage complexity for the participating parties.

Abusers routinely use technology to spy on and harass their targets. This harmful behavior is known as technology-facilitated abuse, or tech abuse. Survivors of tech abuse may turn to the legal system for safety and security, and to do so, they need evidence of tech abuse. However, prior work indicates challenges to collecting evidence of tech abuse and using it in legal proceedings. Thus, in this work, we study legal evidence used by survivors of tech abuse in Wisconsin, USA. We report on qualitative interviews and focus groups with 19 legal support providers who work with survivors seeking protective orders, divorces, and criminal charges. Our findings surface current practices that survivors and legal support providers use to prepare and present evidence of tech abuse in Wisconsin and the challenges they face. For example, survivors struggle to collect evidence of covert monitoring and surveillance. When they can collect evidence, it is often difficult to connect that evidence to the abuser due to the anonymous nature of many forms of tech abuse. In court, evidence of tech abuse is frequently challenged and vulnerable to objections and counter-evidence. And at the end of a proceeding, it's not uncommon for a judge to determine that the tech abuse does not meet the statutes. Informed by these results, we encourage CSCW and HCI researchers to work towards designing and deploying sociotechnical solutions that support survivors' use of evidence, in careful collaboration with advocates, legal experts, and survivors.

Social media applications have benefited users in several ways, including ease of communication and quick access to information. However, they have also introduced several privacy and safety risks. These risks are particularly concerning in the context of interpersonal attacks, which are carried out by abusive friends, family members, intimate partners, co-workers, or even strangers. Evidence shows interpersonal attackers regularly exploit social media platforms to harass and spy on their targets. To help protect targets from such attacks, social media platforms have introduced several privacy and safety features. However, it is unclear how effective they are against interpersonal threats. In this work, we analyzed ten popular social media applications, identifying 100 unique privacy and safety features that provide controls across eight categories: discoverability, visibility, saving and sharing, interaction, self-censorship, content moderation, transparency, and reporting. We simulated 59 different attack actions by a persistent attacker — aimed at account discovery, information gathering, non-consensual sharing, and harassment — and found many were successful. Based on our findings, we proposed improvements to mitigate these risks.

Secure multi-party computation (MPC) techniques can be used to provide data privacy when users query deep neural network (DNN) models hosted on a public cloud. State-of-the-art MPC techniques can be directly leveraged for DNN models that use simple activation functions such as ReLU. However, these techniques are ineffective and/or inefficient for the complex and highly non-linear activation functions used in cutting-edge DNN models. We present Compact, which produces piece-wise polynomial approximations of complex AFs to enable their efficient use with state-of-the-art MPC techniques. Compact neither requires nor imposes any restriction on model training and results in near-identical model accuracy. To achieve this, we design Compact with input density awareness and use an application-specific simulated annealing type optimization to generate computationally more efficient approximations of complex AFs. We extensively evaluate Compact on four different machine-learning tasks with DNN architectures that use popular complex AFs silu, gelu, and mish. Our experimental results show that Compact incurs negligible accuracy loss while being 2x-5x computationally more efficient than state-of-the-art approaches for DNN models with large number of hidden layers. Our work accelerates easy adoption of MPC techniques to provide user data privacy even when the queried DNN models consist of a number of hidden layers and trained over complex AFs.

Trace-based simulation is a widely used methodology for system design exploration. It relies on realistic traces that represent a range of behaviors necessary to be evaluated, containing a lot of information about the application, its inputs and the underlying system on which it was generated. Consequently, generating traces from real-world executions risk leakage of sensitive information. To prevent this, traces can be obfuscated before release. However, this can undermine their ideal utility, i.e., how realistically a program behavior was captured. To address this, we propose Camouflage, a novel obfuscation framework, designed with awareness of the necessary architectural properties required to preserve trace utility , while ensuring secrecy of the inputs used to generate the trace. Focusing on memory access traces, our extensive evaluation on various benchmarks shows that camouflaged traces preserve the performance measurements of the original execution, with an average τ correlation of 0.66. We model input secrecy as an input indistinguishability problem and show that the average security loss is 7.8%, which is better than traces generated from the state-of-the-art.

We aim to explore the bubble nature of the exotic nucleus ^20 N within the microscopic antisymmetrized molecular dynamics (AMD) approach. Constraining its structural parameters, we analyse its static properties. Subsequently, we use the AMD infused finite range distorted wave Born approximation theory to calculate the Coulomb breakup of ^20 N as an indirect approach to estimate the ^19 N (n,γ )^20 N radiative capture rate.

Previous research has shown that abusers in an intimate relationship can find plenty of technical advice, tools, and how-to guides online for covertly conducting intimate partner surveillance (IPS). However, it is unclear what resources survivors seeking to defend themselves against IPS can use. To address this gap, we first conducted a survey-based study with 63 survivors recruited via Prolific to understand what resources survivors rely on. We showed that 45% utilized online resources for assistance, with 67% of them relying on search engines. We then conducted a systematic survey of the results obtained via Google search engine to identify resources available for survivors. We found that the resources survivors can find online contain poor, inaccurate, and unactionable advice. They are hard to understand and do not help mitigate IPS. To investigate whether the lack of useful resources is solely experienced by survivors, we also crawled resources that abusers will find online. We found that abusers can easily find resources recommending spyware apps and hidden devices and often explicitly promoting IPS. We also compared the understandability and actionability of the resources using an adopted Patient Education Materials Assessment Tool (PEMAT) score. We concluded that resources available to abusers are significantly more understandable and actionable than those available to survivors.

Technology-facilitated abuse (TFA) from an intimate partner is a growing concern for survivors' safety and security. Prior research introduced tailored interventions to support the survivors of TFA. However, most survivors do not have access to these interventions or are unaware of the appropriate support networks and resources in their community. We conducted nine semi-structured interviews to examine survivors' support-seeking dynamics from their social networks and the effectiveness of social networks in addressing survivors' needs. Through survivors' lived experiences, we systematize socio-technical barriers that impede the participant from seeking support and challenges in seeking support. Further, we identify coping mechanisms used by the survivors despite those barriers and challenges. Through a participatory lens, we echo survivors' call for action to improve support networks and propose recommendations for technology design to promote safer support-seeking practices and resources, consciousness-raising awareness campaigns, and collaborations with the community. Finally, we call for a restorative-justice-oriented framework that recognizes TFA.

Modern cloud-based IoT services comprise an integrator service and several device vendor services. The vendor services enable users to remotely control their devices, while the integrator serves as a central intermediary, offering a unified interface for managing devices from different vendors. Although such a model is quite beneficial for IoT services to evolve quickly, it also creates a serious privacy concern: the vendor and integrator services observe all interactions between users and devices. Toward this, we propose Mohito, a privacy-preserving IoT system that hides such interactions from both the integrator and the vendors. In Mohito, we protect both the interaction data and the metadata, so that no one learns which user is communicating with which device. By utilizing oblivious key-value storage as a primitive and leveraging the unique communication graph of IoT services, we build a scalable protocol specialized in handling large concurrent traffic, a common demand in IoT systems. Our evaluation shows that Mohito can achieve up to 600x more throughput than the state-of-the-art general-purpose systems that provide similar security guarantees.

The ubiquitous use of technology by college students makes them vulnerable to harassment, harm, and intimidation via technological means. We evaluate the prevalence of such technology-facilitated abuse (TFA) among college students in the USA using a critical, feminist, and trauma-informed lens, which is essential to inform policymakers and advocates who support students. We surveyed 776 college students in a large R1 university located in the Midwest region of the USA to examine the prevalence of TFA faced by students marginalized by socio-economic factors, the support sought by student survivors, and the efficacy of support structures. Our findings indicate that 70% students experience TFA, but more than half of them do not seek support. Among the survivors who seek support, 93% students solely rely on informal resources like friends and family, and 6% solely seek support from formal networks such as survivor services or law enforcement. Therefore, we call on policymakers to direct attention to TFA, create tailored interventions to support marginalized students and propose campus-wide campaigns to spread awareness among college students.

Victim-survivors of intimate partner violence (IPV) are facing a new technological threat: Abusers are leveraging IoT devices such as smart thermostats, hidden cameras, and GPS trackers to spy on and harass victim-survivors. Though prior work provides a foundation of what IoT devices can be involved in intimate partner violence, we lack a detailed understanding of the factors which contribute to this IoT abuse, the strategies victim-survivors use to mitigate IoT abuse, and the barriers they face along the way. Without this information, it is challenging to design effective solutions to stop IoT abuse. To fill this gap, we interviewed 20 participants with firsthand or secondhand experience with IoT abuse. Our interviews captured 39 varied instances of IoT abuse, from surveillance with hidden GPS trackers to harassment with smart thermostats and light bulbs. They also surfaced 21 key barriers victim-survivors face while coping with IoT abuse. For instance, victim-survivors struggle to find proof of the IoT abuse they experience, which makes mitigations challenging. Even with proof, victim-survivors face barriers mitigating the abuse; for example, mitigation is all but impossible for victim-survivors living with an abusive partner. Our findings pinpoint several solutions to combat IoT abuse, including increased transparency of IoT devices, updated IoT access control protocols, and raising awareness of IoT abuse.

Tech-enabled interpersonal abuse (IPA) is a pervasive problem. Abusers, often intimate partners, use tools such as spyware to surveil and harass victim-survivors. Unfortunately, anecdotal evidence suggests that smart, Internet-connected devices such as home thermostats, cameras, and Bluetooth item finders may similarly be used against victim-survivors of IPA. To tackle abuse involving smart devices, it is vital that we understand the ecosystem of smart devices that enable IPA. Thus, in this work, we conduct a large-scale qualitative analysis of the smart devices used in IPA. We systematically crawl Google Search results to uncover web pages discussing how abusers use smart devices to enact IPA. By analyzing these web pages, we identify 32 devices used for IPA and detail the varied strategies abusers use for spying and harassment via these devices. Then, we design a framework-abuse vectors-which conceptualizes IoT-enabled IPA as four overarching patterns: Covert Spying, Unauthorized Access, Repurposing, and Intended Use. Using this lens, we pinpoint the necessary solutions required to address each vector of IoT abuse and encourage the security community to take action.

Recent anecdotal evidence suggests that abusers have begun to use covert spy devices such as nanny cameras, item trackers, and audio recorders to spy on and stalk their partners. Currently, it is difficult to combat this type of intimate partner surveillance (IPS) because we lack an understanding of the prevalence and characteristics of commercial spy devices. Additionally, it is unclear whether existing devices, apps, and tools designed to detect covert devices are effective. We observe that many spy devices and detectors can be found on mainstream retailers. Thus, in this work, we perform a systematic survey of spy devices and detection tools sold through popular US retailers. We gather 2,228 spy devices, 1,313 detection devices, and 51 detection apps, then study a representative sample through qualitative analysis as well as in-lab evaluations. Our results show a bleak picture of the IPS ecosystem. Not only can commercial spy devices easily be used for IPS, but many of them are advertised for use in IPS and other covert surveillance. On the other hand, commercial detection devices and apps are all but defective, and while recent academic detection systems show promise, they require much refinement before they can be useful to survivors. We urge the security community to take action by designing practical, usable detection tools to detect hidden spy devices.