publications
conference papers
- “I’m trying not to get hacked:” How Adults with Intellectual and Developmental Disabilities Navigate Security and Privacy NotificationsHailey L. Johnson, Julia Nonnenkamp, Bilge Mutlu, and Rahul ChatterjeeACM Conference on Computers and Accessibility (ASSETS), Oct 2026
Security and privacy notifications, such as login alerts, spam email warnings, and cookie consent requests, play a critical role in shaping users’ responses to digital risks. Yet most notifications overlook cognitive accessibility, limiting their effectiveness for people with intellectual and developmental disabilities (IDD). We investigate how adults with IDD perceive and respond to common security and privacy notifications across mobile and web applications. Through a formative user study with seven adults with IDD, we identify three factors shaping understanding and decision-making: (1) interpretation is influenced by task and interface context; (2) unfamiliar terms, both technical and non-technical, are grounded in everyday concepts; and (3) uncertainty about outcomes leads to hesitation, avoidance, diagnostic exploration, or support-seeking. These findings lead to three design implications: (1) address context-dependent language misunderstandings beyond jargon simplification; (2) make action-outcome connections transparent; and (3) enable interdependent decision-making. Together, these insights aim to inform the design of more cognitively accessible security and privacy notifications that better support safe and supported user action.
- Hidden in Plain Bytes: Investigating Interpersonal Account Compromise with Data ExportsJulia Nonnenkamp, Naman Gupta, Abhimanyu Dev Gupta, and Rahul ChatterjeeACM Conference on Computer and Communications Security (CCS), Oct 2025
When survivors of technology-facilitated abuse (TFA) suspect someone has accessed their online accounts, they often rely on built-in account security interfaces (ASIs), such as trusted device lists within settings, to assess account compromise. However, these interfaces typically offer limited or ambiguous details about past account accesses and security-critical events. Under right of access provisions in data protection laws, users can request structured exports of their personal data from online services. In this study, we explore whether and how data exports can supplement ASIs to support compromise investigations, particularly in interpersonal threat contexts. We simulated four types of account compromise attacks across six popular platforms, analyzing the resulting data exports and ASIs. Our findings show that data exports consistently contain more granular login histories and richer device/network identifiers than interfaces. Some even link security-related actions (e.g., password changes) and other post-authentication activity to specific devices, offering forensic value for identifying compromise. We discuss usability and other practical challenges of using data exports during TFA interventions.
posters & non-archival work
- Clinicas: Agentic Diagnosis and Mitigation of Technology-Facilitated AbuseShirley Zhang, Guruprasad Viswanathan Ramesh, Julia Nonnenkamp, Rahul Chatterjee, and Kassem FawazNeurIPS Workshop on Human-AI Coevolution, Dec 2026
- Hidden in Plain Bytes: Investigating Interpersonal Account Compromise with Data ExportsJulia Nonnenkamp, Naman Gupta, Abhimanyu Dev Gupta, and Rahul ChatterjeePoster at GREPSEC (doctoral consortium) at USENIX Security, Aug 2026