Projects | Kami Vaniea

E-Government Engagement

Thu, 16 Oct 2025 00:00:00 +0000

Developer-centered privacy

Tue, 10 Sep 2024 00:00:00 +0000

Smart Speaker Privacy

Wed, 27 Apr 2022 00:00:00 +0000

Smart speakers interact with anyone that is near them with no regard for who is the account owner, who has signed the terms of service agreement, or who’s account is being interacted with. Newer controls do allow linking some actions to specific voice profiles, but fundamentally smart speakers are designed to interact with anyone who speaks to them. Such authentication-minimal interaction can have some problematic side-effects for nearby bystanders who may not even know that there is a smart speaker in the room, much less have had an opportunity to read the terms of service or see what the settings are.

This research project looks into the privacy concerns of smart speaker account owners, co-habitants who regularly interact with the speaker, and bystanders who may be visiting a space for the first time. Through a sequence of studies we explore the different privacy concerns of these groups and how we might best support them. We also build a taxonomy of such concerns which should enable other researchers to explore the space of privacy-problematic smart speaker interactions in a more structured and comparable way.

People

Nicole Meng
Adam Jenkins
Maria K. Wolters
Kami Vaniea

Patch Management

Tue, 27 Apr 2021 00:00:00 +0000

Updating software is one of the most effective methods of protecting computers from security vulnerabilities, yet many people and organisations choose to not install them. In this project we endevor to understand the attitudes of people making update decisions and the barriers they face that can impact their willingness and ability to keep their software up to date.

Updating software means changing it. Ideally those changes are for the better such as improved security, better features, fixed bugs, and additional functionality. However, they can also lead to worse outcomes such as slower software, new problems, changes to frequently used functionality, and new security vulnerabilities. According to our research, many of the issues around software updating are actually issues around balancing risks and benefits when neither of these are fully known. For example, the update that protected against the WannaCry ransomeware attack was made available a month before the attack happened, those that installed it were therefore protected and not impacted by the attack. But it would have been impossible for a system administrator to know at the time of update release that a devistating world wide ransomware attack was comming. Incidents like WannaCry suggest that installing patches quickly is a good idea, which is true, but it should also be understood that installing patches quickly also carries risks. For example, Microsoft released a Windows 10 update which then started deleting all the files on the desktop. They acknowledged the issue and offered a work around, but the issue was terrifying and highly disruptive for users, particularly those who installed updates quickly.

PhishEd

Tue, 27 Apr 2021 00:00:00 +0000

Phishing is one of the most effective vectors for tricking users into providing sensitive information, such as account details, to attackers who then use the information to harm users, organizations, and society at large. Recent attacks, such as the Colonial Pipeline shutdown in the US can be attributed to phishing. In the UK, 86% of businesses reported receiving phishing attacks [1] and while 76% of UK users believe that they can recognize and avoid suspicious links in emails [2], our own research shows that only about 8% can accurately read a URL [3]. The staggering £53.7 million lost in the UK in 2020 to impersonation fraud also attests to the problem [4].

Employer-provided training tends to be delivered either up-front or given after the employee has fallen for a mock phishing attack. These approaches do work, but they are very employer-centric in that employers choose the time and content of the training. Delivering the same training to everyone also forces a compromise between comprehensively covering topics and containing detailed actionable guidance. For example, training commonly advises users to “look at the destination of links” but does not have the space to explain how to do so. Users in this situation have virtually no agency or control and lack the ability to shape their own learning to match their needs. Users also experience phishing as an infrequent unexpected event that is mixed in with other activities. Phishing by its nature is designed to appear urgent or threatening. A user receiving such a message may be worried or scared about what might happen if they were to ignore it. Currently their only options are to delete the potential phish (scary) or report it and ask for advice (slow).

In this project, we propose a novel phishing-advice tool, PhishEd, which accepts reports from users of potential phishing emails, uses AI to parse out contextual phishing features, and quickly responds back to the user with advice based on the content of the reported email. to explain the reasoning or frame the decision the user needs to make. For example, a reported phishing might contain “HMRC” but have links leading to Dropbox. The auto response would inform the user that the email is not from HMRC (DKIM) and the links lead to Dropbox which HMRC would never use. It would also provide examples from the email to evidence these claims. The objectives of this project are: (i) help users confidently make safety decisions, (ii) teach them skills about how to detect fraud, and (iii) make them want to report phishing in the future.

NCSC Cyber Security Breaches Survey 2020.
UK Consumer Digital Index 2019.
S.S. Albakry, K. Vaniea, M.K. Wolters; What is this URL’s Destination? Empirical Evaluation of Users’ URL Reading; In Proceedings of the 2020 CHI Conference on Human Factors in Computing Systems. 2020.
UK Finance, Fraud – The Facts 2021.

Phishing

Tue, 27 Apr 2021 00:00:00 +0000

My lab has a range of publications and projects involving phishing. This project page provides an overview of the different types of work we conduct.

PhishEd aims to make reporting phishing a helpful and friendly experience where the user feels heard, gets helpful feedback, and can confidently determine if an urgent sounding email is fraudulent or real.

People

Sara Albakry
Kholoud Althobaiti
Adam Jenkins
Tarini Saka
Nadin Kokciyan
Kami Vaniea

Twitter Privacy

Tue, 27 Apr 2021 00:00:00 +0000

Twitter has a relatively simplistic privacy setting of an account being either public or protected, yet many people are still confused about how the settings work. The project looks at various kinds of privacy leakage on Twitter including birth dates, life events, and general knowledge about how the setting feature works.

Virtual Reality Lab Studies

Tue, 27 Apr 2021 00:00:00 +0000

Chatty Factories

Sat, 27 Apr 2019 00:00:00 +0000

The first industrial revolution saw a transformation based on water and steam power. The second harnessed electricity to support mass production. The third used electronics and IT to innovate and automate. Now, the World Economic Forum defines the fourth industrial revolution as “a fusion of technologies that is blurring the lines between the physical, digital, and biological spheres”. This builds on the rapid growth of the third revolution to bring data, artificial intelligence and robotic fabrication systems to the forefront of the manufacturing industry.

Current manufacturing systems are characterised by a multitude of interconnected procedures that include many discrete, highly specialised and human intensive activities, such as: consumer research, concept design, engineering design & prototyping, and manufacturing operations that combine robots with human workers on the factory floor. Two significant limitations of current manufacturing systems are (a) the inability to quickly and continuously refine product design in response to real-time consumer insights (i.e. how the product is being used and its ’experience’ of the world) and (b) the inability to quickly reconfigure and reskill the human and robotic production elements on the factory floor in response to real-time data captured from embedded product sensors. For example - if sensor data suggests a product needs a design change based on its current use, how do we update the fabrication instructions and reshuffle the factory floor between shifts, and tell human and robot workers how to alter their duties within minutes?

Our vision for the manufacturing factory of the future is to embrace the rapid growth of internet-connected products via embedded sensors producing massive volumes of data, and transform these traditionally discrete activities into one seamless process that is capable of real-time continuous product refinement. Firstly, mindful of the potential disruption to labour markets, we will develop new fundamental theory that relates to learning and seamless communication between products, humans, robots and factory floor operations - to ensure equality and collaborative real-time learning. Secondly, we will develop data-driven systems that provide an auditable, secure and seamless flow of information between all operations inside and outside the factory to facilitate real-time adaption and re-orientation of the entire manufacturing system based on data harvested via product-embedded sensors and Internet of Things (IoT) connectivity.

The research will achieve a radical interruption of the existing ‘consumer sovereignty’ model based around surveys and market research - and introduce ‘use sovereignty’ via an embedded understanding of consumer behaviour - making products that are fit for purpose based on how they are used. This will not be unmediated but buffered by robust, secure and interpretable data analysis at scale - with ethical integration of human labour. Designers will have a completely transformed role being ’embedded in production’ in a world of “chatty” products and a dynamically evolving factory floor.

Our approach will transform the ways in which traditional factories are reconfigured in real time by adopting a first mover approach to real time reconfiguration, production element reskilling (human, robot or both collaboratively). Radically, we will use exopedagogy, the first time it has ever been applied in a practical setting and couple this with insights from robotics. Exopedagogy considers alien forms of learning and uses those metaphors to develop models of learning which go beyond human learning. In contrast to existing techniques such as jet engine telemetry that allow for optimisation tweaks around a clearly defined product, our work will allow for both i) redesigns to support new uses or usage patterns; ii) generation of new products based on observing alternative use.

Early Publications

Publications from Edinburgh-based academics from before 2020 when Kami Vaniea joined the project.

Murray-Rust, D., Gorkovenko, K., Burnett, D., & Richards, D. (2019). Entangled Ethnography: Towards a Collective Future Understanding. Proceedings of the Halfway to the Future Symposium 2019, 1–10. New York, NY, USA: Association for Computing Machinery.
Gorkovenko, K., Burnett, D. J., Thorp, J. K., Richards, D., & Murray-Rust, D. (2020). Exploring The Future of Data-Driven Product Design. Proceedings of the 2020 CHI Conference on Human Factors in Computing Systems, 1–14. New York, NY, USA: Association for Computing Machinery.
Gorkovenko, K., Burnett, D., Thorp, J., Richards, D., & Murray-Rust, D. (2019). Supporting Real-Time Contextual Inquiry Through Sensor Data. Ethnographic Praxis in Industry (EPIC2019).
Burnett, D., Thorp, J., Richards, D., Gorkovenko, K., & Murray-Rust, D. (2019). Digital Twins as a Resource for Design Research. Proceedings of the 8th ACM International Symposium on Pervasive Displays, 1–2. New York, NY, USA: Association for Computing Machinery.
Burnap, P., Branson, D., Murray-Rust, D., Preston, J., Richards, D., Burnett, D., … Thorp, J. (2019). Chatty Factories: A Vision for the Future of Product Design and Manufacture with IoT. Living in the IoT: PETRAS/IET Conference 2019.

Grant

EPSRC grant on