Project Usable Sercurity

CS 6204 Project Proposal 9/22/09 1. Title: Process and Situated Practice: The Unofficial Rules of Childcare Information

Management 2. Researchers: Monika Akbar & Stacy Branham, working with Laurian Vega 3. Project overview: This project seeks to understand how the security of sensitive childcare

information is physically and socially managed by directors in real childcare facilities. Previous work has identified that directors at childcare facilities access and release sensitive information in ways that cannot be adequately described by official policies. While the practices at several childcare facilities have been documented by in situ interviews with stakeholders, there is little evidence to verify or add to the richness of claims made in these interviews. Thus, we plan to extend this work by carrying out an observational study of directors as they move through the motions of their daily work activities. 4. Methodology: We will begin by conducting 20-30 minute structured interviews with each of

our subjects. These will serve to establish familiarity and add to previous understandings of information management practices. After the conclusion of each interview, the researcher will begin a 2-hour in situ observation of the participant. Rich field notes will be taken with respect to the security of sensitive childcare information. Evidence from these observations will be used to verify and extend interview-elicited data. Each researcher aims to perform 4 of these interview-observation sessions independently. 5. Timeline: Task / Time

September (15-30)

October (1-15)

October (16-31)

November (1-15)

November (16-30)

(joint)

(joint)

December (1-7)

IRB, planning, lit. review Interviews/ Observations Transcription Data Analysis Final Report

(joint)

(joint)

6. Deliverables: Each researcher will produce written transcripts of interviews she conducted as

well as digital write-ups of her field notes. A final, jointly-constructed report of 10-15 pages will provide the final analysis of gathered data. 7. Project relevance: This project has important implications for usable security. We believe,

firstly, that researchers must understand how sensitive information––such as that managed by childcare facilities––is currently overseen in order to create functional electronic systems that can manage this information. In particular, we believe that the findings may shed light on the nature of trust in human-mediated information management systems that may lead to specific implications for technology design. Secondly, we believe that approaches to usable security across domains may benefit from in-depth observations on the complex, dynamic nature of trust.