Publications

List of Publications:

Gröber, L., Arshad, W., Goetzen, A., Redmiles, E. M., Mustafa, M., & Krombholz, K. (2024). “I chose to fight, be brave, and to deal with it”: Threat Experiences and Security Practices of Pakistani Content Creators.

Content creators are exposed to elevated risks compared to the general Internet user. This study explores the threat landscape that creators in Pakistan are exposed to, how they protect themselves, and which support structures they rely on. We conducted a semi-structured interview study with 23 creators from diverse backgrounds who create content on various topics. Our data suggests that online threats frequently spill over into the offline world, especially for gender minorities. Creating content on sensitive topics like politics, religion, and human rights is associated with elevated risks. We find that defensive mechanisms and external support structures are non-existent, lacking, or inadequately adjusted to the sociocultural context of Pakistan.

Mustafa, M., Asad, A. M., Hassan, S., Haider, U., Durrani, Z., & Krombholz, K. (2023, November). Pakistani Teens and Privacy - How Gender Disparities, Religion and Family Values Impact the Privacy Design Space. In Proceedings of the 2023 ACM SIGSAC Conference on Computer and Communications Security (pp. 195-209).

The understanding of how teenagers perceive, manage and perform privacy is less well-understood in spaces outside of Western, educated, industrialised, rich and democratic countries. To fill this gap we interviewed 30 teens to investigate the privacy perceptions, practices, and experienced digital harms of young people in Pakistan, a particularly interesting context as privacy in this context is not seen as an individual right or performed within an individualistic framework but instead is influenced by a combination of factors including social norms, family dynamics and religious beliefs. Based on our findings, we developed four personas to systematize the needs and values of this specific population and then conducted focus groups with co-design activities to further explore privacy conflicts. Among other things that confirm and extend existing theories on teen’s privacy practices and perceptions, our findings suggest that young women are disproportionately impacted by privacy violations and the harms extend beyond themselves to include their families.

Sumair Hashmi*, Niklas George*, Eimaan Saqib, Fatima Ali, Nawaal Siddique, Shafay Kashif, Shahzaib Ali, Nida Bajwa, and Mobin Javed, "Training Users to Recognize Persuasion Techniques in Vishing Calls", CHI Extended Abstracts, May 2023.

Voice-based phishing attacks, in which a scammer uses social engineering techniques over a phone call to convince victims to divulge sensitive information, cause losses of several million dollars. We present a pilot study of a novel intervention that trains users to recognize phishing calls by identifying the persuasion principles used by the scammer. The training is implemented via a Whatsapp chatbot that includes example audio recordings and exercises of scam calls, and how the scammer employs the principle of authority in order to persuade the victim. 50 students from a university participated in the persuasion principles training. We then conducted a simulated vishing call a few days later to test how well the participants recognize the call compared to a control group (also 50 students) that was only given a general awareness training, and was not specifically trained to recognize authority via chatbot exercises. We also conducted interviews with participants from both the groups to understand the perceived usefulness of the training.

Afaq Ashraf, Taha, Nida Bajwa, Cornelius Konig, Mobin Javed, and Maryam Mustafa, “Stalking is immoral but not illegal: Understanding Security, Cyber Crimes and Threats in Pakistan”, Symposium on Usable Privacy and Security (SOUPS), August 2023. (IAPP SOUPS Privacy Award).

We explore the experiences, understandings, and perceptions of cyber-threats and crimes amongst young adults in Pakistan, focusing on their mechanisms for protecting themselves, for reporting cyber threats and for managing their digital identities. Relying on data from a qualitative study with 34 participants in combination with a repertory grid analysis with 18 participants, we map users mental models and constructs of cyber crimes and threats, their understanding of digital vulnerabilities, their own personal boundaries and their moral compasses on what constitutes an invasion of privacy of other users in a country where there is little legal legislation governing cyberspace and cyber crimes. Our findings highlight the importance of platform adaptation to accommodate the unique context of countries with limited legal mandates and reporting outlets, the ways in which digital vulnerabilities impact diverse populations, and how security and privacy design can be more inclusive.