Evaluating the Impact of Community Oversight for Managing Mobile Privacy and Security
Mamtaj Akter, Madiha Tabassum, Nazmus Sakib Miazi, Leena Alghamdi, Jess Kropczynski, Pamela Wisniewski, Heather Lipford
TL;DR
The paper addresses the challenge of managing mobile privacy and security at scale by introducing CO-oPS, a mobile app that enables trusted communities to review others’ installed apps and permissions and provide feedback. It evaluates CO-oPS in a four-week field study with 101 participants across 22 groups, employing pre/post surveys, usage logs, and interviews to measure changes in transparency, awareness, trust, and participation. Key contributions include empirical evidence that community oversight can enhance individual and collective privacy management, insights into tensions around expertise and motivation, and design recommendations to support social privacy decision-making. The findings suggest that community-based privacy management tools can augment individual decision-making and collective capability, with practical implications for developer incentives, privacy controls, and expert guidance within groups.
Abstract
Mobile privacy and security can be a collaborative process where individuals seek advice and help from their trusted communities. To support such collective privacy and security management, we developed a mobile app for Community Oversight of Privacy and Security ("CO-oPS") that allows community members to review one another's apps installed and permissions granted to provide feedback. We conducted a four-week-long field study with 22 communities (101 participants) of friends, families, or co-workers who installed the CO-oPS app on their phones. Measures of transparency, trust, and awareness of one another's mobile privacy and security behaviors, along with individual and community participation in mobile privacy and security co-management, increased from pre- to post-study. Interview findings confirmed that the app features supported collective considerations of apps and permissions. However, participants expressed a range of concerns regarding having community members with different levels of technical expertise and knowledge regarding mobile privacy and security that can impact motivation to participate and perform oversight. Our study demonstrates the potential and challenges of community oversight mechanisms to support communities to co-manage mobile privacy and security.