Volume 24, Issue 1 - Special Issue: Usable Safety and Security

Local disasters such as the Ahr Valley flood in Germany, the international backdrop of the Russo-Ukrainian War, or the global impact of the COVID-19 pandemic place high demands on the people and organisations that are involved in these situations and contexts to save lives, mitigate damage, provide comfort, or organise reconstruction. Novel technologies are constantly making their way into everyday life, such as artificial intelligence, big data, decentralised networks, internet of things, or virtual reality. Their adaptation, acceptance, usability, usefulness, and legal framework conditions for safety-critical systems must be researched and tested thoroughly. In this special issue, we investigate the use of computer-based solutions in areas and situations of direct relevance to people’s lives and well-being (Usable Safety), as well as contributions to user-oriented resilience concepts of sociotechnical systems concerning potential attacks (Usable Security) and data protection mechanisms (Usable Privacy).

Control rooms play a crucial role in monitoring and managing safety-critical systems, such as power grids, emergency response, and transportation networks. As these systems become increasingly complex and generate more data, the role of human operators is evolving amid growing reliance on automation and autonomous decision-making. This paper explores the balance between leveraging automation for efficiency and preserving human intuition and ethical judgment, particularly in high-stakes scenarios. Through an analysis of control room trends, operator attitudes, and models of human-computer collaboration, this paper highlights the benefits and challenges of automation, including risks of deskilling, automation bias, and accountability. The paper advocates for a hybrid approach of collaborative autonomy, where humans and systems work in partnership to ensure transparency, trust, and adaptability.

Crisis management exercises provide a unique opportunity to study situational awareness in real-time scenarios. However, the federated structure of large-scale crisis management, involving multiple decentralized teams, imposes additional challenges for researchers aiming to capture comprehensive situational awareness data. Moreover, since the primary goal of these exercises is operational readiness rather than academic research, any experimental setup must be non-intrusive and place minimal extra-demand on participants. In a future exercise, we will be allowed to measure the situational awareness of crisis management staff members to evaluate a newly developed crisis management dashboard. To do so, we need to take both theoretical, as well as practical constraints into account, as we may participate in the exercise, yet must not disturb the exercise itself. To this date, neither methodology nor software tools are available to measure the situational awareness of spatially distributed crisis managers. In this paper we introduce such methodology, which requires a balancing act between scientific and practical requirements, where some scientific standards are contradicting practical circumstances and a reasonable experimental setup must be created. To achieve this, we present a methodology supported by software that allows situational awareness assessments. Given that crisis managers operate spatially distributed during a large-scale disaster or exercise and that we lack the resources to be physically present at all locations, our introduced software aims to conduct the experiment without a researcher in every situation room. This approach facilitates comprehensive data collection and analysis without setting up a complex research environment in every situation room, thereby allowing us to meet both scientific and operational objectives effectively.

In crisis situations, citizens’ situational awareness is paramount for effective response. While warning apps offer location-based alerts, their usage is relatively low. We propose a personalised messaging app channel as an alternative, presenting a warning bot that may lower adoption barriers. We employ the design science research process to define user requirements and iteratively evaluate and improve the bot’s usability and usefulness. The results showcase high usability, with over 40 % expressing an interest in utilising such a warning channel, stressing as reasons the added value of proactive warnings for personalised locations while not requiring a separate app. The derived requirements and design solutions, such as graphically enhanced user interface elements as guardrails for effective and error-free communication, demonstrate that a suitable warning chatbot does not necessarily require complex language processing capabilities. Additionally, our findings facilitate further research on accessibility via conversational design in the realm of crisis warnings.

The COVID-19 pandemic has demonstrated the limitations of traditional contact tracing in containing infectious disease outbreaks due to both scalability issues and low adoption rates. To enhance proactive responses, this paper proposes a novel digital infection prevention system focused on identifying and mitigating threatening situations posing a risk of infection. Unlike contact tracing, this approach uses near real-time context-aware adaptation to evaluate and respond to immediate risks based on individual situational data and proximity to potential infection sources. The approach leverages digital contact tracing technologies, such as BLE-based distance estimation, but advances them by integrating context-aware adaptation that considers direct and indirect transmission paths. Prevention profiles provide the system with pathogen-specific guidelines for detecting and interpreting threat levels and recommending protection measures. An extensible ontology-based context model facilitates a uniform approach to represent situational information and adapts flexibly to evolving pathogen and environmental dynamics. This study also presents the architecture, data flow, and intervention cycle of the proposed system, validated by a prototype Android application. Findings suggest that the proposed approach is both feasible and promising for managing infectious disease threats. Future work could focus on improving sensor integration, ensuring privacy-preserving data sharing for epidemiological insights, and further empirical testing in real-world settings.

In Germany, both law enforcement agencies (LEAs) and dedicated reporting centers (RCs) engage in various activities to counter illegal online hate speech (HS). Due to the high volume of such content and against the background of limited resources, their personnel can be confronted with the issue of information overload. To mitigate this issue, information filtering, classification, prioritization, and visualization technologies offer great potential. However, a nuanced understanding of situational awareness is required to inform the domain-sensitive implementation of supportive technology and adequate decision-making. Although previous research has explored the concept of situational awareness in policing, it has not been studied in relation to online HS. Based on a qualitative research design employing a thematic analysis of qualitative expert interviews with practitioners from German LEAs and RCs ( N = 29), we will contribute to the state of research in human-computer interaction with a systematization of 23 information types of relevance for situational awareness of online HS in the law enforcement and RC domain. On that basis, we identify victim, perpetrator, context, evidence, legal, and threat awareness as domain-specific situational awareness sub-types and formulate ten implications for designing reporting, open-source intelligence, classification, and visual analytics tools.

Information Security Policies (ISPs) are crucial artefacts in organisations, governments, and civil societies to mitigate information security threats and risks. However, poorly designed ISPs can lead to hidden costs and decreased compliance in daily practices. While behavioural factors such as social norms, positive attitudes, and knowledge are well-known to influence compliance, the usability of ISPs, which takes the context of use seriously, remains understudied. To address this, we introduce the concept of Usable Information Security Policy (UISP). This concept is derived from the argument that usability is not just about the usable design of the document itself, but a relational property of the ISP in a specific context of regulation. We argue that UISPs integrate usability as an inherent feature of policies besides compliance. Based on this, an extended scope of content, adapted policy management methods, and strong alignment with said context are required. Our research provides implications for theory and practice. By providing a new concept for engagement including a research agenda, we provide usable security research with a new tool to increase protection between socio-technical contexts and artefacts. For practitioners, the concept provides first guidance on how to incorporate usability more strongly in the otherwise formal policy-making processes.

Digital identity wallets enable the storage and management of digital identities and verifiable credentials in one place on end users’ devices. This includes discount vouchers or customer cards, and security-critical data such as ID cards or driving licences. However, digital identity wallets face significant challenges due to weaknesses in user experience and information security. Users often find it difficult to understand the concept of digital identity wallets, resulting in personal information being inadvertently shared with untrusted parties. Additionally, user experience and information security can influence each other, so that both aspects must be evaluated and improved together. To this end, the Method for Enhancing User Experience and Information Security (MEUSec) can be used. This article reports on an experimental application of the MEUSec method to the wallet “Hidy” with two research goals: First, to evaluate the MEUSec method and the quality of its results against a set of criteria, and second, to collect suggestions for improving the user experience and information security of the Hidy wallet. In total, 41 weaknesses and 7 strengths of user experience and information security, 32 heuristics and 26 improvement suggestions for the Hidy wallet could be identified.

Automated decision-making algorithms are increasingly prevalent in consumer-facing industries, particularly in insurance risk assessments. The traceability of these decisions is crucial for trust, acceptance, and individual autonomy. While the General Data Protection Regulation (GDPR) grants individuals the right to information about such decisions, the implementation of this right remains under-researched from a usable privacy perspective. This study employs a qualitative exploratory approach with 12 participants exercising their right to be informed about automated decision-making with German household insurers. Through interviews and observations, we investigate consumer requirements and prevailing implementation practices. Our findings unveil actual process design practices that may undermine the usability and efficacy of this data subject right. By identifying these concerns and correlating them to existing deceptive patterns, our research contributes to usable security by alerting process designers, data protection authorities, and enterprises to the significance of user-centric implementations. Furthermore, this study advances research on GDPR data subject rights, emphasizing the need for secure and usable interfaces in the context of automated decision-making systems. Our work highlights the practical challenges of safeguarding usable implementation of regulatory compliance in the realm of data protection.

This paper showcases a user study on users’ preferences and perceptions of data protection (e.g., intervenability and transparency) in a privacy assistant application. The tool aims to assist users in maintaining higher data protection of their personal data with minimal effort. The study involved 20 participants and employed a mixed-methods approach, including qualitative analysis to assess user perceptions and usability. The findings of the study are two-fold, (1) to understand the user requirements and attitudes towards data protection and privacy and (2) to evaluate whether the privacy assistant application meets these requirements in terms of transparency, intervenability, user experience, and usability. The results indicate that participants had varying attitudes toward privacy and exhibited diverse knowledge levels regarding the GDPR. The high-fidelity prototype demonstrated excellent usability and received positive evaluations in terms of user experience across various dimensions. The results shed light on both the strengths and areas for improvement in the design and implementation of the privacy assistant application prototype.

Large Language Models (LLMs) have demonstrated potential in automating data-driven tasks, enabling non-experts to analyze raw inputs such as tables or sensor data using conversational queries. Advances in Machine Learning (ML) and Human-Computer Interaction (HCI) have further reduced entry barriers, pairing sophisticated model capabilities and background knowledge with user-friendly interfaces like chatbots. While empowering users, this raises critical privacy concerns when used to analyze data from personal spaces, such as smart-home environments. This paper investigates the capabilities of LLMs, specifically GPT-4 and GPT-4o, in analyzing smart-home sensor data to infer human activities, unusual activities, and daily routines. We use datasets from the CASAS project, which include data from connected devices such as motion sensors, door sensors, lamps, and thermometers. Extending our prior work, we evaluate whether advances in model design, prompt engineering, and pre-trained knowledge enhance performance in these tasks and thus increase privacy risks. Our findings reveal that GPT-4 infers daily activities and unusual activities with some accuracy but struggles with daily routines. With our experimental setup, GPT-4o underperforms its predecessor, even when supported by structured CO-STAR prompts and labeled data. Both models exhibit extensive background knowledge about daily routines, underscoring the potential for privacy violations in smart-home contexts.

This paper explores technical implications and design opportunities that are conceptualized to inform a socio-robotic system with digital applications to support the recovery process of patients within a rehabilitation facility. By conducting observations and interviews with patients and therapists, we identified key challenges and design opportunities in a specific orthopaedic rehabilitation context and process. The findings indicate the design potentials of a socio-robotic system to enhance patient engagement and recovery by providing personalized activities, a meaningful interaction and a motivating surrounding by using music-based exercises. Our research suggests that integrating digital applications with robotic systems may be used in the long-run to offer tailored exercises, stimulating concepts to motivate and maintain patients in therapy process, real-time feedback, and data-driven progress tracking, thereby improving the overall therapeutic outcomes. By addressing these factors, our proposed socio-robotic system aims to create a more interactive and engaging orthopaedic rehabilitation experience and environment, ultimately supporting patient recovery and improving overall treatment.

Increasing life expectancy and low birth rates have led to a larger aging population requiring more care, especially in rural areas. Information and communications technology may enhance older adults’ quality of life and digital health services. Assistive robotic systems, especially telepresence robots, are increasingly used in healthcare. These robots represent a significantly higher embodiment level than tablets, as they can provide the remote person with an additional body. This work explores the effects of different embodiment levels in video consultation, focusing on Presence and Perception from a Human-Computer Interaction (HCI) perspective. For this purpose, between-participants experiments were conducted in which 18 participants assumed the role of the patient and engaged in a video consultation with a remote, medically experienced person acting as the physician. A shortened medical check-up simulated the real assessment. Qualitative and quantitative data were collected during and after the experiment focusing on presence and interaction. Results show no significant influence of embodiment level in a video consultation from a HCI perspective. However, a trend towards more natural communication with stronger embodiment was observed, suggesting it may positively influence interaction.

This paper examines the potential impact of social robots on people with mild cognitive impairments in a nursing home. Within a 4-month design case study, we investigated the practices, attitudes, and social contexts of residents with mild cognitive impairment and their caregivers and designed two prototype apps for a robotic-based system. Subsequently, 10 residents, the former nursing home manager, and one social caregiver participated in a prototype evaluation study for 10 weeks. The goal was to assess group-based user experience and social interactions. Qualitative results indicate that the system can support participants in their individual, social, and daily activities and, therefore, consequently initiate potentially meaningful interactions. One key observation from the video analysis was that the participants initiated unanticipated conversations with the robot, which we discuss regarding the prompting character, design appearance, and affordances of the robot in interaction.

The assessment tool “READY?” supports care facilities and services in their institutional reflection on the use of robotics for nursing care. The tool contains a digitally supported question catalog completed in an accompanying workshop in the respective institution with the involvement of various stakeholders. The question catalog includes questions from the categories “Care”, “Privacy and legal issues”, “Ethical criteria”, “Technology and infrastructure”, “Institutional and social embeddedness”, and “Economic criteria” and thus pursues a multi-perspective approach. The assessment tool is empirically and theoretically based and was tested in four care facilities and services in the field. Four focus groups and a supplementary survey ( n = 32) were conducted during the testing. The results indicate that the assessment tool can assist in initiating an institutional debate on the prerequisites for the possible use of robotics. The focus group participants report that the tool offers an opportunity for professional discussion and the possibility to strengthen collaboration within the institution. Suggestions for improving the assessment tool were collected, including the prospective provision of literature-based recommendations and optimizing the introduction of the workshops.

Data-driven storytelling has grown significantly, becoming prevalent in various fields, including healthcare. In medical narratives, characters are crucial for engaging audiences, making complex medical information accessible, and potentially influencing positive behavioral and lifestyle changes. However, designing characters that are both educational and relatable to effectively engage audiences is challenging. We propose a GenAI-assisted pipeline for character design in data-driven medical stories, utilizing Stable Diffusion, a deep learning text-to-image model, to transform data into visual character representations. This approach reduces the time and artistic skills required to create characters that reflect the underlying data. As a proof-of-concept, we generated and evaluated two characters in a crowd-sourced case study, assessing their authenticity to the underlying data and consistency over time. In a qualitative evaluation with four experts with knowledge in design and health communication, the characters were discussed regarding their quality and refinement opportunities. The characters effectively conveyed various aspects of the data, such as emotions, age, and body weight. However, generating multiple consistent images of the same character proved to be a significant challenge. This underscores a key issue in using generative AI for character creation: the limited control designers have over the output.

In recent years, immersive environments and the technologies employed within them, such as Augmented Reality (AR), Virtual Reality (VR), and Mixed Reality (MR), have become increasingly significant, particularly in the domains of education, work, and entertainment. Moreover, the concept of persistent, immersive virtual worlds – commonly referred to as Metaverses – has gained attention due to advancements and opportunities in VR and AR. These immersive environments are transforming how we work, especially in communication, coordination, and collaboration. Hence, an important question that arises is how these environments influence Quality of Working Life (QWL). This study provides an overview of the effects of immersive environments on QWL. We conducted a scoping review following the framework by Arksey and O’Malley in accordance with the PRISMA guidelines. The findings identify three major QWL topics influenced by immersive environments: (i) Mental Health, highlighting stress reduction and well-being enhancement; (ii) Safety & Prevention, emphasizing accident prevention and risk mitigation; and (iii) Workplace Design, focusing on improved ergonomics. We derive practical implications for QWL and provide theoretical implications to scoping reviews. While our study considered the short-term effects of such technologies as limitations, future studies should address the long-term effects of immersive environments on QWL.

Participatory processes are key for designing technology solutions but challenging since target groups rarely have technological expertise. They are, however, experts in their lives. Vulnerable young people are even more challenged when asked to participate. A toolkit approach can introduce non-tech-savvy individuals to digital technology. This paper presents the process of (co-)designing a toolkit for vulnerable young people and social workers. The evaluation provides insights into what components are needed to prepare for participatory technology development. The toolkit can be seen as a mobile laboratory that supports technology development and builds on considerations from other research and design processes. The toolkit was (co-)designed in two phases. An initial version based on other prototypes and the state of the art was evaluated according to feedback from social work professionals. The revised version was evaluated by both professionals and vulnerable young people, leading to refinement and final redesign. The final toolkit, focusing on the smart home domain, was evaluated through participant observation and qualitative content analysis. The results show how feedback, inductively derived in four categories, led to the design of the toolkit with three modules relevant to engaging vulnerable young people in technology design: experience, understand and co-design.