The tension of usable safety, security and privacy

1 Introduction

Local disasters such as the Ahr Valley flood in Germany, ¹ the international consequences of the Russian invasion of Ukraine, ² the global COVID-19 pandemic, ³ the long-term effects of biodiversity loss and climate change, ⁴ as well as numerous conflicts and crises such as the Gaza war ⁵ place high demands on the people and organisations that are involved in these situations and contexts to save lives, mitigate damage, provide comfort, or organise reconstruction.

Although computer-based solutions have become indispensable, new technologies are constantly making their way into everyday life, such as big data and artificial intelligence, ^{6 , 7} the Internet of Things (IoT) and the development of disruption-tolerant networks, ^{8 , 9} or the development of so-called digital twins in virtual reality, ^{10 , 11} whose adaptation, acceptance, usability, usefulness, and legal framework conditions for safety-critical systems must be researched and tested thoroughly. ¹²

These technologies also pose new challenges and problems for people and organisations in safety-critical situations, which must be considered in both research and practice. While social media, for example, can help to mobilise volunteers and improve situational awareness, ^{7 , 13} inconsistent and incorrect information, the flood of information in large-scale emergencies, uncoordinated activities and a lack of financial and human resources can increase the complexity of tasks for organisations. ^{14 , 15}

Past research has showcased how different actors, such as citizens, ^{16 , 17} computer emergency response teams, ^{18 , 19} control room operators, ²⁰ emergency services, ^{21 , 22} medical staff, ^{23 , 24} or law enforcement agencies, ^{25 , 26} amongst others, have been expressing changing and diverse needs for technology adoption and design. To address these challenges, the research domain of human-computer interaction (HCI) has brought up a plentitude of user-centred design and evaluation methods. ^{27 , 28}

In this editorial, we provide a concise background on the relationship between usable safety and security (Section 2) and present the scope of this special issue, reflecting our call for contributions (Section 3). We then present five accepted articles on usable safety (Section 4) and a further five accepted articles on usable safety, which also include contributions to privacy (Section 5). We end with a brief conclusion and outline potential for future directions (Section 6).

2 Background

What’s the relationship between usability and security in interactive systems? The introduction ²⁹ of the textbook “Safety Critical Human-Computer-Interaction” ³⁰ elaborates on their relationship. Accordingly, the key question is whether these two aspects are inherently opposed – meaning that improving security comes at the expense of usability, and vice versa – or whether they can actually reinforce each other, with increased usability leading to greater security.

There are different perspectives on this issue: ²⁹ Some argue that overly simple systems cannot be secure, while others suggest that security should be established first, with usability optimized as much as possible within those constraints. A third viewpoint claims that intuitive and well-designed usability can actually enhance security. ²⁹ Supports this latter perspective and explores ways to achieve both usability and security simultaneously.

Moreover, safety and security cannot be ensured through technical measures alone. While valid theoretical assumptions, appropriate mechanisms, and their correct technical implementation form a necessary foundation, the crucial question remains: Is this sufficient, or do additional challenges arise from human-system interaction?

True safety and security emerge when mechanisms are easy to understand, seamlessly integrated into system use, and do not create unnecessary obstacles. Only when humans and machines “understand” each other can a system be both secure and user-friendly. This principle applies not only to security, which protects against attacks and misuse but also to safety, which refers to protection from accidents and malfunctions. In both areas, optimized human-computer interaction helps ensure that protective systems provide greater security through improved usability. ²⁹

Usable security ³¹ focus addresses the usability of security concepts themselves and develops approaches to enhance users’ security awareness. In research, it is often combined with the field of usable privacy. ³² In contrast, usable safety explores human-computer interaction in safety-critical contexts, such as control rooms, healthcare, disaster management, and the automotive sector – considering both potential threat scenarios and functional safety aspects.

The special interest group Usable Safety and Security was originally founded in 2015 under the name Human-Machine Interaction in Safety-Critical Systems within the Human-Computer Interaction division of the German Informatics Society (GI). The group is dedicated to a holistic examination of the intersection between human-computer interaction and security. ³³ In 2025, so a decade after it’s foundation, this special issue presents some current advancements in the field.

3 Call for contributions

In this special issue, we invited contributions that investigate the use of computer-based solutions in areas and situations of direct relevance to people’s lives and well-being (Usable Safety), as well as contributions to user-oriented concepts of the resilience of sociotechnical systems concerning potential attacks (Usable Security). Possible topics included but were not limited to:

1. Usability and user experience in safety-critical contexts (e.g. cybersecurity, healthcare, crisis management, process management, traffic management)

2. Case studies and evaluations on usable safety or usable security in different target groups (e.g. authorities, citizens, enterprises, or emergency organisations)

3. Algorithms and systems for user-centred and comprehensible big data analytics (e.g. artificial intelligence, visual analytics) in the context of safety-critical human-computer interaction

4. Resilience and training in crises, disasters, and conflicts (including resilience, population warning, first aid, extended reality, recommendations for action, and emergency prevention)

5. Participation and social media (including neighbourhood and self-help, crowdsourcing, digital volunteers, virtual operations support teams, and crisis mapping)

6. Ethical, legal, and social implications in safety-critical systems (e.g. inclusive and ability-based design, value-sensitive design)

7. Methods and tools for modelling and validating usable safety and security in sociotechnical systems (e.g. cyber-physical systems, human-robot collaboration, or digital twins)

8. Sustainable human-machine-environment interaction in safety-critical contexts (e.g. limiting biodiversity loss, adapting to, and mitigating global warming).

We welcomed a broad range of contribution types, such as systematisation of knowledge (survey) research, conceptual and methodological research, qualitative and quantitative empirical research, and design and evaluation research. We received numerous submissions. After two rounds of rigorous review, the following 10 articles were accepted for publication.

4 Usable safety

A first selection of papers deals with crisis informatics and management, including the topics of control room collaboration, crisis management exercises, citizen warning, infection prevention, and hate speech detection.

First, the evolving role of human operators in control rooms for safety-critical systems such as power grids, emergency response, and transportation networks is a timeless topic. As automation and autonomous decision-making continue to advance, the paper Keeping the Human in the Loop: Are Autonomous Decisions Inevitable? of Jonas Pöhler, Nadine Flegel, Tilo Mentler, and Kristof Van Laerhoven (University of Siegen and Trier University of Applied Sciences) examines how to balance efficiency gains with the need to retain human intuition and ethical oversight, especially in high-stakes situations. By analyzing current trends, operator perspectives, and human-computer collaboration models, the authors identify key challenges, including the risks of deskilling, automation bias, and accountability gaps. The study advocates for a hybrid approach of collaborative autonomy, in which human operators and automated systems work in partnership to ensure transparency, trust, and adaptability in decision-making.

Second, crisis management exercises provide a unique opportunity to study situational awareness in real-time scenarios. However, the federated structure of large-scale crisis management, involving multiple decentralized teams, imposes additional challenges for researchers aiming to capture comprehensive situational awareness data. Moreover, since the primary goal of these exercises is operational readiness rather than academic research, any experimental setup must be non-intrusive and place minimal extra-demand on participants. In the paper iSAM – Towards a Cost-Efficient and Unobtrusive Experimental Setup for Situational Awareness Measurement in Administrative Crisis Management Exercises Tobias Hellmund, Henrik Kayser, and Jürgen Moßgraber (Fraunhofer IOSB) present a methodology supported by software that allows situational awareness assessments. Given that crisis managers operate spatially distributed during a large-scale disaster or exercise and that they lack the resources to be physically present at all locations, the introduced software aims to conduct the experiment without a researcher in every situation room. This approach facilitates comprehensive data collection and analysis without setting up a complex research environment in every situation room, thereby allowing us to meet both scientific and operational objectives effectively.

Third, in crisis situations, citizens’ situational awareness is paramount for effective response. While warning apps offer location-based alerts, their usage is relatively low. In the paper Breaking Down Barriers to Warning Technology Adoption: Usability and Usefulness of a Messenger App Warning Bot, the authors Jasmin Haunschild, Markus Henkel, and Christian Reuter (TU Darmstadt) propose a personalised messaging app channel as an alternative, presenting a warning bot that may lower adoption barriers. They employ the design science research process to define user requirements and iteratively evaluate and improve the bot’s usability and usefulness. The results showcase high usability, with over 40 % expressing an interest in utilising such a warning channel, stressing the added value of proactive warnings for personalised locations while not requiring a separate app. The derived requirements and design solutions, such as graphically enhanced user interface elements as guardrails for effective and error-free communication, demonstrate that a suitable warning chatbot does not necessarily require complex language processing capabilities. Additionally, the findings facilitate further research on accessibility via conversational design in the realm of crisis warnings.

Fourth, learning from the COVID-19 pandemic is an important precursor for preparedness and response capabilities in future pandemics. The paper Use of Context-Based Adaptation to Avoid Threatening Situations in Times of a Pandemic of Andrej Sibirski and Dirk Veiel (University of Hagen) explores the limitations of traditional contact tracing in containing infectious disease outbreaks, particularly during the COVID-19 pandemic. The authors propose a novel digital infection prevention system that goes beyond mere contact tracing by dynamically assessing and mitigating infection risks in real-time. Their approach utilizes context-aware adaptation, incorporating individual situational data and proximity to potential infection sources to deliver proactive recommendations. Unlike conventional methods, this system not only relies on Bluetooth-based distance estimation but also integrates an ontology-based context model to consider both direct and indirect transmission paths. The use of pathogen-specific prevention profiles ensures adaptable threat detection and targeted protective measures. A prototype Android application validates the feasibility of the approach, demonstrating its potential for managing infectious disease threats. The paper highlights key areas for future research, including improved sensor integration, privacy-preserving data sharing, and real-world empirical testing.

Fifth, German law enforcement agencies (LEAs) and dedicated reporting centers (RCs) engage in various activities to counter illegal online hate speech (HS). Due to the high volume of such content and against the background of limited resources, their personnel can be confronted with the issue of information overload. To mitigate this issue, information filtering, classification, prioritization, and visualization technologies offer great potential. However, a nuanced understanding of situational awareness is required to inform the domain-sensitive implementation of supportive technology and adequate decision-making. Based on a qualitative research design employing a thematic analysis of qualitative expert interviews with practitioners from German LEAs and RCs (N = 29), the paper Cyber Hate Awareness: Information Types and Technologies Relevant to the Law Enforcement and Reporting Center Domain of Julian Bäumler, Georg Voronin, and Marc-André Kaufhold (TU Darmstadt and University of Potsdam) contributes to the state of research in human-computer interaction with a systematization of 23 information types of relevance for situational awareness of online HS in the law enforcement and RC domain. On that basis, they identify victim, perpetrator, context, evidence, legal, and threat awareness as domain-specific situational awareness sub-types and formulate ten implications for designing reporting, open-source intelligence, classification, and visual analytics tools.

5 Usable security and privacy

A second selection of papers focuses on usable security and privacy, including the topics of information security policies, digital identity wallets, insurance risk assessments, privacy assistants, and smart home privacy.

Sixth, effective Information Security Policies (ISP) are crucial for organisations to mitigate information security threats and risks. However, poorly designed information security policies can lead to hidden costs and decreased compliance in daily work routines. The paper From Usable Design Characteristics to Usable Information Security Policies: A Reconceptualisation of Dennis Lawo and Gunnar Stevens (University of Siegen) deals with ISPs that need to be realized in a usable way in order to ensure compliance and cost effectiveness. A conceptual research approach is followed to assess the role of usability in ISPs. Following this approach, the authors provide arguments for considering usability as essential aspect of ISPs. They introduce the concept of Usable Information Security Policies (UISPs). It based on HCI and IT security research findings and combines security and safety measures. The authors argue that UISPs must be aligned with governmental, organisational and civil society policies. Furthermore, guidance on incorporating usability in policy-making processes is provided.

Seventh, digital identity wallets enable the storage and management of digital identities and verifiable credentials in one place on end users’ devices. This includes discount vouchers or customer cards, and security-critical data such as ID cards or driving licences. However, digital identity wallets face significant challenges due to weaknesses in user experience and information security. Users often find it difficult to understand the concept of digital identity wallets, resulting in personal information being inadvertently shared with untrusted parties. Additionally, user experience and information security can influence each other, so that both aspects must be evaluated and improved together. The paper A Case Study of the MEUSec Method to Enhance User Experience and Information Security of Digital Identity Wallets of Max Sauer, Christoph Becker, Lukas Kneis, Andreas Oberweis, Simon Pfeifer, Akim Stark, and Jan Sürmeli (FZI Research Center for Information Technology) reports on an experimental application of the Method for Enhancing User Experience and Information Security (MEUSec) method to the wallet “Hidy” with two research goals: First, to evaluate the MEUSec method and the quality of its results against a set of criteria, and second, to collect suggestions for improving the user experience and information security of the Hidy wallet. In total, 41 weaknesses and 7 strengths of user experience and information security, 32 heuristics and 26 improvement suggestions for the Hidy wallet could be identified.

Eighth, automated decision-making algorithms are increasingly prevalent in consumer-facing industries, particularly in insurance risk assessments. The traceability of these decisions is crucial for trust, acceptance, and individual autonomy. While the General Data Protection Regulation (GDPR) grants individuals the right to information about such decisions, the implementation of this right remains under-researched from a usable privacy perspective. The paper Evaluating GDPR Right to Information Implementation in Automated Insurance Decisions of Timo Jakobi, Patrix Harms, and Salih Arslan (Nuremberg Institute of Technology Georg Simon Ohm) employs a qualitative exploratory approach with twelve participants exercising their right to be informed about automated decision-making with German household insurers. Through interviews and observations, the study investigates consumer requirements and prevailing implementation practices. The findings unveil actual process design practices that may undermine the usability and efficacy of this data subject right. By identifying these concerns and correlating them to existing deceptive patterns, the research contributes to usable privacy by alerting process designers, data protection authorities, and enterprises to the significance of user-centric implementations. Furthermore, this study advances research on GDPR data subject rights, emphasizing the need for secure and usable interfaces in the context of automated decision-making systems. This work highlights the practical challenges of safeguarding usable implementation of regulatory compliance in the realm of data protection.

Ninth, for many users, protecting their digital privacy remains a challenging task, which is why personal privacy assistants have been emerging as a promising approach to help users manage their privacy. The paper Human-Centered Design of a Privacy Assistant and its Impact on Perceived Transparency and Intervenability by Lennart Kiss and Rachelle Sellung (University of Stuttgart) presents a user study on preferences and perceptions of data protection, particularly regarding transparency and intervenability, in a privacy assistant application. The tool is designed to help users maintain a high level of data protection with minimal effort. The study, involving 20 participants, employed a mixed-methods approach, including qualitative analysis, to assess user perceptions and usability. The findings highlight two key aspects: (1) understanding user requirements and attitudes toward data protection and privacy, and (2) evaluating whether the privacy assistant meets these requirements in terms of transparency, intervenability, user experience, and usability. The results indicate varying privacy attitudes and differing levels of GDPR knowledge among participants. The high-fidelity prototype demonstrated excellent usability and received positive evaluations across multiple user experience dimensions. These insights provide valuable guidance for improving the design and implementation of privacy assistant applications.

Tenth, large language models (LLMs) have demonstrated potential in automating data-driven tasks, enabling non-experts to analyze raw inputs such as tables or sensor data using conversational queries. Advances in machine learning and HCI have further reduced entry barriers, pairing sophisticated model capabilities and a wealth of background knowledge with user-friendly interfaces like chatbots. While empowering users, this raises critical privacy concerns when used to analyze data from personal spaces, such as smart-home environments. The paper ChatAnalysis Revisited: Can ChatGPT Undermine Privacy in Smart Homes with Data Analysis? of Victor Jüttner, Arthur Fleig, and Erik Buchmann (Center for Scalable Data Analytics and Artificial Intelligence) investigates the capabilities of LLMs, specifically GPT-4 and GPT-4o, in analyzing smart-home sensor data to infer human activities, unusual activities, and daily routines. The authors use datasets from the CASAS project, which include data from connected devices such as motion sensors, door sensors, lamps, and thermometers. Extending prior work, they evaluate whether advances in model design, prompt engineering, and pre-trained knowledge enhance performance in these tasks and thus increase privacy risks. The findings reveal that GPT-4 infers daily activities and unusual activities with some accuracy but struggles with daily routines. With this experimental setup, GPT-4o underperforms its predecessor, even when supported by structured CO-STAR prompts and labeled data. Both models exhibit extensive background knowledge about typical daily routines, underscoring the potential for privacy violations in smart-home contexts.

6 Conclusions

This special issue highlights current research at the intersection of usable safety, security and privacy. The selected papers emphasize the importance of situational awareness, adaptive crisis communication, and the role of human-centered design in safety-critical decision-making. Additionally, they explore challenges in cybersecurity, digital identity management, and the impact of AI on data privacy. By addressing these topics, the contributions provide valuable insights into designing more resilient, user-friendly, and secure digital infrastructures. Future research should continue bridging the gap between usability, security, and technological advancements to enhance trust and effectiveness in critical applications.