Usable Privacy and Security

05-436 / 05-836 / 17-334 / 17-734 / 19-534 / 19-734
Usable Privacy and Security

Spring 2020: GHC 4215, Mondays and Wednesdays 1:30 pm-2:50 pm

Professor Lorrie Cranor
lorrie@cmu.edu
http://lorrie.cranor.org/
Office: CIC 2107
Office hours: By appointment

Jessica Colnago, Teaching Assistant (she/her)
jcolnago@cmu.edu
Office: Hamburg Hall 2106A
Office hours: By appointment

While we don't have set office hours, we do encourage you to contact us for appointments. We can often arrange a meeting the same day you contact us. In addition, we are usually available to answer questions after each class. 

This term we will be using Piazza for class discussion. Rather than emailing questions about the homework and exams to the professor and TA, we encourage you to post your questions on Piazza. You may also post links to relevant articles and papers in Piazza for your classmates to see. Find our class page at:

piazza.com/cmu/spring2020/054360583617334177341953419734/home

Course Description

There is growing recognition that technology alone will not provide all of the solutions to security and privacy problems. Human factors play an essential role in these areas, and it is important for security and privacy experts to have an understanding of how people will interact with the systems they develop. This course is designed to introduce students to a variety of usability and user-interface problems related to privacy and security and to give them experience in understanding and designing studies aimed at helping to evaluate usability issues in security and privacy systems. The course is suitable both for students interested in privacy and security who would like to learn more about usability, as well as for students interested in usability who would like to learn more about security and privacy. Students will also work on a group project throughout the semester. 

The course is open to all students who have at least some technical background (e.g. an undergraduate computer programming course). The 12-unit course numbers (17-734, 5-836, 19-734) are for PhD students and masters students. Students enrolled in these course numbers will have extended homework assignments and will be expected to play a leadership role in a group project that produces a paper suitable for publication. The 9-unit 500-level course numbers (8-534, 5-436, 19-534) are for undergraduates and masters students. 

Course goals

• Gain an appreciation for the importance of usability within security and privacy
• Learn about current research in usable privacy and security
• Learn how to conduct usability studies
• Learn how to critically examine UPS studies 

Undergraduate concentration in security and privacy

This course is part of the undergraduate concentration in security and privacy in both Computer Science and in Electrical & Computer Engineering. In particular, this courses satisfies the "Context Course Area" requirement of the concentration. The security and privacy concentrations are designed to expose students to the key facets of and concerns about computer security and privacy that drive practice, research, and legislation. On completing the curriculum, students will be prepared to continue developing their interests in security or privacy through graduate study; to take jobs in security or privacy that will provide further training in applicable areas; and to be informed participants in public and other processes that shape how organizations and society develop to meet new challenges related to computer security or privacy.

Interested in learning more about usable privacy and security beyond this course?

Students in this course may also be interested in joining the CyLab Usable Privacy and Security Lab (CUPS) mailing list to get seminar announcements and discussion.

If you are interested in doing more usable privacy and security research after taking this course, please talk to the professor. The CUPS Lab often has opportunities for students to do research for course credit or pay, during the academic year and over the summer. In addition, the professor is happy to talk about graduate programs you might consider.

Course Schedule

See course schedule below. Note, schedule is subject to change. Canvas will have the most up-to-date version. Homework assignments will usually be posted on the day the previous assignment is due.

Lecture slides will usually be posted in the calendar entry and in the Files menu (see link on left)  following each lecture. 

Course Requirements and Grading

Your final grade in this course will be based on:

• 20% Readings and Quizzes
• 30% Homework
• 20% Exams
• 30% Project

This class will have no final exam. Final project presentations will be held during the last week of class. You are required to be present for your group's final presentation.

Readings and Quizzes

Students are expected to complete the assigned reading prior to class so that they can participate fully in class discussions. To verify that students have completed the assigned reading, each class will begin with a short quiz. Quizzes will generally be collected at 1:35 pm. The quizzes will cover major points of the readings, including methodological techniques, findings, high-level takeaways, and major recommendations the authors made. Your single lowest quiz grade will be dropped.

If you know you will be absent from class, you may submit summary and highlights for the assigned readings to the TA prior to the start of class. These will be graded and this grade will be used in place of the missed quiz grade. In the event of an emergency situation that prevents you from attending class, please contact the instructor as soon as possible to arrange for an extended deadline for submitting your reading summary and highlights.

Students taking the 12-unit version of this course are expected to do additional readings each week. In some cases, we will specify which extra reading(s) to do. In other cases, we will specify that students can choose from any of the additional readings for the week. All other students are encouraged to review some of the additional readings that they find interesting, but they need not submit summaries or highlights.

Readings will be assigned from the following text (available for purchase from all the usual online book stores, and free of charge in ebook form via the CMU library):

• Research Methods in Human-Computer Interaction, 2nd edition. Jonathan Lazar, Jinjuan Heidi Feng, Harry Hochheiser, 2017.

Additional readings will be assigned from papers available online or handed out in class. In cases where a subscription is required for access, access should be available for free when you are coming from a CMU IP address (on campus or via CMU EZproxy or library VPN).

Homework

This course includes eight homework assignments. All homework is to be submitted in PDF format via Canvas and is due at 1:30 pm on the due date, unless specified otherwise. Homework is considered one day late if it is submitted after 1:30 pm on the due date. You will be penalized 10% for every late day. Your single lowest homework grade will be dropped from your homework average. In extenuating circumstances, please contact the professor to arrange for an extended deadline.

Students taking the 12-unit version of the course will be asked to submit a short summary (3-7 sentences) and a "highlight" for particular readings specified in each homework assignment. The highlight may be something you found particularly interesting or noteworthy, a question you would like to discuss in class, a point you disagree with, etc.

Exams

We will hold two in-class exams during the course. These exams will be centered around designing experiments, interpreting results, and analyzing research claims related to usable privacy and security. In essence, performing well on these exams will require that you apply the skills you learn in this course, rather than remembering trivia. However, you will be expected to remember key terms and definitions discussed in class. The best way to prepare for these exams is to critically read all of the assigned readings for the course and to be an engaged participant in class discussions throughout the semester. Then review the course slides prior to each exam. 

Project

Students will work on semester projects in small groups that include students with a variety of areas of expertise. A choice of projects will be provided, and students will be given an opportunity to indicate their preferences before projects are assigned. Students who have their own ideas for projects should discuss them with the instructor early in the semester. As part of the project students will:

• Return their project preference form by Monday, February 10 so that they can be assigned to a project team by Wednesday, February 12.
• Submit a brief project proposal (2 to 3 pages) by Monday, February 24. Detailed instructions are in the  project proposal assignment.
• Complete an IRB application with all necessary attachments and submit it to IRB as early in the semester as possible, and no later than March 4. Include the professor, TA, and any mentor you are working with as co-PIs and send them a draft by March 2 to get their feedback.
• Design all questionnaires, scripts, scenarios, interview protocols, etc. necessary to carry out the user study.
• Develop any prototypes necessary to carry out the user study.
• Pilot test the user study protocol on at least two people (can be members of the class from other project groups) and refine it based on these tests.
• Submit a progress report by Monday, March 30. Detailed instructions are in the progress report assignment.
• Give a brief (7-10 minutes) progress report presentation on March 30 or April 1  and submit the slides online.
• Conduct a study using the revised protocol with at least 6 subjects (or more if this is not a lab study). Optionally, you can conduct a larger study that would be likely to lead to publishable results. If your study has only 6 subjects, likely this will be useful mostly as a pilot study and should be positioned as such in your paper.
• Give a 10-minute final project presentation in class on April 27 or April 29 and submit the slides online.
• Write a final project report and submit it by 9 am on Sunday, May 10. Detailed instructions are in the final project report assignment.
• Submit a peer evaluation by 9 am on May 10. Submitting a peer evaluation is required in order to receive your grade for this class.

The final paper will count for 80% of your project grade. The other project deliverables will collectively count for the remaining 20% of your project grade. If your project team is having trouble at any stage, please contact the professor for help!

Students are encouraged to submit their project as a poster to the 2020 Symposium On Usable Privacy and Security, and/or as a full paper to SOUPS 2021 or another conference. A paper submission will likely require additional work after the end of the semester. To submit a poster will require submitting a 2-page abstract. Professor Cranor will provide funds for one student from each project team to attend the SOUPS conference if their paper or poster is accepted.

Students signed up for the 12-unit version of this course are expected to play a leadership role in a project group that writes a project paper suitable for publication. Your final paper should be written in a style suitable for publication at a conference or workshop. The conference papers in the readings provide good examples of what a conference paper looks like and the style in which they are written. 

Collaboration Policy

You are permitted to talk to the instructor, or to anyone else about any of the homework assignments. Any assistance, though, must be limited to discussion of the problem and sketching general approaches to a solution. Each student must write out his or her own solutions to the homework, unless collaboration is explicitly authorized as part of the assignment. Consulting another student's solution or a solution found on the Internet is prohibited, and submitted solutions may not be copied from any source. These and any other form of collaboration on assignments constitute cheating. Any form of collaboration is strictly prohibited on the exams and is considered cheating. If you have any question about whether some activity would constitute cheating, please ask. Cheating on an assignment/exam will result in failure of the course, and the university administration will be notified per the appropriate procedures. Simply stated, feel free to discuss problems with each other, but do not cheat. It is not worth it, and you will get caught. In addition to the above, please also review fully and carefully Carnegie Mellon University's policies regarding Academic Integrity at https://www.cmu.edu/policies/student-and-student-life/academic-integrity.html and https://www.cmu.edu/student-affairs/ocsi/students/.

Take Care of Yourself and Ask for Help

Do your best to maintain a healthy lifestyle this semester by eating well, exercising, avoiding drugs and alcohol, getting enough sleep and taking some time to relax. This will help you achieve your goals and cope with stress. All of us benefit from support during times of struggle. You are not alone. There are many helpful resources available on campus and an important part of the college experience is learning how to ask for help. Asking for support sooner rather than later is often helpful. If you or anyone you know experiences any academic stress, difficult life events, or feelings like anxiety or depression, we strongly encourage you to seek support. Counseling and Psychological Services (CaPS) is here to help: call 412-268-2922 and visit their website at http://www.cmu.edu/counseling. Consider reaching out to a friend, faculty or family member you trust for help getting connected to the support that can help.

If you or someone you know is feeling suicidal or in danger of self-harm, call someone immediately, day or night:

• Counseling and Psychological Services (CaPS): 412-268-2922
• Re:solve Crisis Network: 888-796-8226

If the situation is life threatening, call the police:

• On campus - CMU Police: 412-268-2323
• Off campus: 911