Julia Nonnenkamp

I’m a rising 2nd year computer science (probably) PhD student at the University of Wisconsin–Madison. I’m advised by Dr. Rahul Chatterjee in the MadS&P (Security & Privacy) research group.

I’m interested in software security for everyday people, including accessible cybersecurity, mitigations for tech-facilitated abuse, and digital evidence in family law. I volunteer at the Madison Tech Clinic providing trauma-informed, cybersecurity assistance to survivors of intimate partner violence (IPV) around Wisconsin.

Before UW–Madison, I did my undergrad in math and computer science at Georgetown University (and became a tech policy wonk by osmosis). I was involved with GU’s Tech & Society Initiative as a Fritz Fellow. I had the privilege of working with Dr. Elissa Redmiles, the Massive Data Institute, and Georgetown Law’s Center on Privacy & Technology auditing forensic DNA analysis software systems. I also interned with the U.S. Office of Management and Budget, where I learned an enormous amount about how to make government and its digital systems work better for the people they serve.

I spend way too much of my free time on the NYT Cooking site and not nearly enough of it implementing my saved recipes. I’m nebulously training for a half-marathon.

Email me at [my last name]@wisc.edu.

news

Jul 02, 2025	Our paper about identifying tech abuse in GDPR data exports got accepted to ACM CCS 2025!
Nov 16, 2024	Our lab attended the Midwest Security Workshop at Purdue.
Aug 15, 2024	I started my MS/PhD at UW-Madison!

publications

[Working Title] — Hidden in Plain Bytes: Investigating Interpersonal Account Compromise with Data Exports

Julia Nonnenkamp, Naman Gupta, Abhimanyu Gupta, and Rahul Chatterjee

ACM CCS, Oct 2025

Accepted manuscript. To appear.

Abstract

When survivors of technology-facilitated abuse suspect unauthorized access to their online accounts, they (and advocates supporting them) often rely on built-in security interfaces, such as trusted device lists, to identify account compromise. However, these interfaces typically offer limited or ambiguous details about past access and security-critical events. Under right-of-access provisions in data protection laws, users can request structured exports of their personal data from online services. In this study, we explore whether and how data exports can supplement security interfaces to support compromise investigations, particularly in interpersonal threat contexts. We simulate four types of interpersonal account compromise attacks across six popular platforms, analyze the resulting data exports and user interfaces, and map data export contents to specific attack steps — such as authentication and in-account activity. Our findings show that data exports consistently contain more granular login histories and richer device/network identifiers than interfaces. Some even link security-relevant actions to specific devices, offering forensic value for identifying compromise. We conclude by discussing the practical challenges of deploying data exports in technology abuse intervention.