publications

2026

1. “I’m trying not to get hacked:” How Adults with Intellectual and Developmental Disabilities Navigate Security and Privacy Notifications

   Hailey L. Johnson, Julia Nonnenkamp, Bilge Mutlu, and Rahul Chatterjee

   To appear in ASSETS, Oct 2026

2025

1. Hidden in Plain Bytes: Investigating Interpersonal Account Compromise with Data Exports

   Julia Nonnenkamp, Naman Gupta, Abhimanyu Dev Gupta, and Rahul Chatterjee

   ACM CCS, Oct 2025

   Abstract DOI PDF Slides

   When survivors of technology-facilitated abuse (TFA) suspect someone has accessed their online accounts, they often rely on built-in account security interfaces (ASIs), such as trusted device lists within settings, to assess account compromise. However, these interfaces typically offer limited or ambiguous details about past account accesses and security-critical events. Under right of access provisions in data protection laws, users can request structured exports of their personal data from online services. In this study, we explore whether and how data exports can supplement ASIs to support compromise investigations, particularly in interpersonal threat contexts. We simulated four types of account compromise attacks across six popular platforms, analyzing the resulting data exports and ASIs. Our findings show that data exports consistently contain more granular login histories and richer device/network identifiers than interfaces. Some even link security-related actions (e.g., password changes) and other post-authentication activity to specific devices, offering forensic value for identifying compromise. We discuss usability and other practical challenges of using data exports during TFA interventions.