• Designing for Privacy in Mobile Sensing Systems, book chapter in Mobile Sensing in Psychology: Methods and Applications
• Understanding Frontline Workers’ and Unhoused Individuals’ Perspectives on AI Used in Homeless Services (CHI 2023) (best paper award)
• Participation and Division of Labor in User-Driven Algorithm Audits: How Do Everyday Users Work together to Surface Algorithmic Harms? (CHI 2023)
• Zeno: An Interactive Framework for Behavioral Evaluation of Machine Learning (CHI 2023)
• Improving Human-AI Collaboration with Descriptions of AI Behavior (CSCW 2023)
• The Security and Privacy Acceptance Framework (SPAF): A review of why users accept or reject cybersecurity and privacy best practices (FnT)
• "Give Everybody [..] a Little Bit More Equity": Content Creator Perspectives and Responses to the Algorithmic Demonetization of Content Associated with Disadvantaged Groups (CSCW 2022)
• Peekaboo: A Hub-Based Approach to Enable Transparency in Data Processing within Smart Homes (Oakland 2022)

Note: I am currently working on a new startup and am scaling back all academic and research commitments for the foreseeable future.

My primary field is human-computer interaction. My areas of work are in usable privacy and security, mobile computing, Internet of Things, and AI fairness and bias. I draw on ideas from systems, behavioral sciences, and machine learning. Here is a long description of my research accomplishments, below are some highlights:

• Pioneered research on protecting people from phishing scams. Our work on anti-phishing was adopted by industry groups, and inspired the design of anti-phishing browser warnings. Our work was also commercialized as Wombat Security, which was acquired by Proofpoint in 2018.
• Deployed Livehoods, which was the first paper to use geotagged social media to understand the dynamics of cities. Won ICWSM test of time award in 2022.
• Investigated Social Cybersecurity, which looked at how to adopt ideas from social psychology to positively influence people’s privacy and security behaviors. Won Honorable Mention for NSA Competition for Best Scientific Cybersecurity Paper.
• Pioneered new system architectures and developer tools for smartphone privacy, which has had positive impact on consumer privacy and on industry
• Deployed PrivacyGrade.org, a web site where we analyzed the privacy of over a million Android apps based on a model of people’s expectations of privacy
• Wrote The Design of Sites, one of the earliest books on user interface design patterns
• Developed WeAudit, a suite of tools for helping everyday people collectively audit AI systems for bias and fairness
• Co-founded the Master’s of Product Management (MSPM), a joint program between HCII and Tepper School of Business
• Supervised 21 Postdocs and PhD students, and taught hundreds of undergrads and master’s students in classes, independent studies, and research projects

Our work has been featured in CNN, New York Times, BBC, CBS News, MIT Tech Review, World Economic Forum, and more. Our team has been generously funded by DARPA, National Science Foundation, Army Research Office, Amazon, IBM, Google, Intel, Microsoft, Nokia, NQ Mobile, Pitney Bowes, Portugal Telecom, Samsung, Yahoo, CMU Cylab, Alfred P. Sloan Foundation, Cisco, and more.

What's New?

I gave a talk entitled An Overview of Privacy for Mobile Sensing Systems for the mDOT NIH Center.

Along with several of my colleagues at CMU, I was named a 2024 Microsoft Research AI & Society fellow to do work on to do work on “Regulating AI in Light of the Challenges of Doing Responsible AI in Practice”.

I gave a distinguished lecture at Univ Wisconsin-Madison entitled Helping Developers with Privacy.

New book chapter, Designing for Privacy in Mobile Sensing Systems, book chapter in Mobile Sensing in Psychology: Methods and Applications. I tried to summarize everything I know about legal, philosophical, design, and technical issues about privacy in this chapter.

My blog post What Can the FATE Community Learn from the Successes and Failures in Privacy? was published in CACM August 2023 issue.

I had the honor of being the 2023 commencement speaker at the South Carolina Governor's School for Science and Math, my alma mater. See the text of the speech or video here.

Our paper What makes people install a COVID-19 contact-tracing app? Understanding the influence of app design and individual difference on contact-tracing app adoption intention won Best Research Paper 2019-2021 in Pervasive and Mobile Computing.

Our paper Understanding Frontline Workers’ and Unhoused Individuals’ Perspectives on AI Used in Homeless Services won a best paper award at CHI 2023.

I was named an ACM Fellow!

Our work on Livehoods won ICWSM Test of Time award! See the press release and livehoods.org web site.

Our paper on Software-Defined Cooking Using a Microwave Oven is a Research Highlight in the Dec 2021 issue of CACM.

ClearTerms data set is available here. This is a spreadsheet containing the results of several thousand crowdsourced judgements comparing different statements in Terms and Conditions for about a dozen ecommerce web sites.

We made EMA data publicly available from our study on social interactions, social support, mood, and well-being during 2020 COVID.

New paper on arxiv summarizing our work on DARPA Brandeis project for smartphone privacy: The Design of the User Interfaces for Privacy Enhancements for Android

Use our SA-6 and SA-13 survey instrument to assess people's security attitudes. You can also take the SA-6 quiz online here.

We just received $1M in new funding from NSF and Amazon to investigate Fairness in AI!

I did a keynote talk for CHIuXiD entitled Privacy for Mobile Sensing Systems.

Our web site showcasing our work on the user interfaces for DARPA Brandeis smartphone privacy is now up

I'm now a member of CHI Academy!

I wrote a blog entry on CACM entitled Why is Privacy So Hard?

My wife and I helped found two junior faculty chairs in the Human-Computer Interaction Institute at CMU.

Our team has released the MobiPurpose data set. It contains over 2 million unique intercepted traffic requests from 15k+ smartphone apps, gathered from our array of smartphones.

Wombat Security, which I co-founded in 2008, was acquired by Proofpoint for $225m!

I wrote a roadmap for privacy research entitled The Privacy Landscape for Pervasive and Ubiquitous Computing.

I was recently honored with Alumni of the Year from my old high school, South Carolina Governor's School for Science and Math. Here is a link to my speech at the commencement.

The HCII and the Tepper School of Business are offering a new Master's Degree of Product Management. I'm helping to run the HCII side.

White paper with New America entitled Toward a Safe and Secure Internet of Things.

Presented some of our team's work on using smartphones for healthcare at the World Economic Forum at Dalian.

Our CCS 2014 paper Increasing Security Sensitivity with Social Proof: A Large-Scale Experimental Confirmation won Honorable Mention at NSA's Best Scientific Cybersecurity Paper Competition.

PrivacyGrade.org presents our privacy analysis of 1 million Android apps. Our work has appeared on CNN, US News and World Report, New York Times, CNBC, IEEE Spectrum, Forbes, and more.

My brother and I have created the Frances and Chou-Chu Hong graduate fellowship at the Veterinary and Animal Sciences Department at the University of Massachusetts.

Gave a talk at PopTech 2013 on sensing and privacy. See slides and video here.

Livehoods.org re-imagines how cities work in the age of social media. Livehoods has been featured in The Atlantic Cities, Wired Insider, MIT Technology Review, Fast Company Co.Design, New York Post, Wall Street Journal, and Haaretz.

Some Past Research

Some alums of the CHIMPS group (postdocs, PhD, and some MS), in somewhat chronological order:

• Karen Tang
• Jeff Wong, now at Apple
• Bryan Pendleton, now at a startup (previously GOogle)
• Janne Lindqvist, now an Assoc Prof at Aalto (previously Rutgers)
• Polo Chau (with Christos Faloutsos and Niki Kittur), now an assoc prof at Georgia Tech
• Guang Xiang (with Carolyn Rose), now doing an AI startup in China
• Jialiu Lin (with Norman Sadeh), now at Waymo (previously was a privacy engineer at Google)
• Shah Amini, now at Facebook (previously Appthority and Google)
• Jun Ki Min, now at Motorola
• Mike Villena, now at Appthority
• Afsaneh Doryab, now an Asst Prof at UVa (previously CMU)
• Alex Sciuto, now at Maven Machines
• Song Luan, now at YouTube (previously Uber)
• Jason Wiese (with John Zimmerman), now an Assoc Prof at University of Utah
• Eiji Hayashi, now at Facebook
• Sauvik Das, now an Asst Prof at CMU
• Dan Tasse, now a data scientist at StitchFix
• Siyan Zhao, now a UX designer at Google
• Mike Czapik, now at TikTok
• Hong Shen, now an asst research prof at CMU
• Cori Faklaris (with Laura Dabbish), now an asst prof at UNC-Charlotte
• Haojian Jin, now an asst prof at UCSD
• George Hope Chidziwisano, now an Asst Prof at UTenn
• Tianshi Li, now an asst prof at Northeastern University
• Alex Cabrera (with Adam Perer), now at an AI startup
• Isadora Krsek, now a PhD student at CMU HCII

Some of My Writings and Other Stuff I Helped Create

Running Program Committees

• Notes on running Program Committees (from running Mobisys 2015)

My Cybersecurity Advice (for general audiences)

• Staying Safe Online for Kids, for South Carolina iTeams
• Leveraging Human Factors for Effective Cybersecurity Training, for ISSA 2013 CISO Forum
• Designing the User Experience for Online Privacy, for IAPP 2013
• Teaching Johnny Not to Fall for Phish, for ISSA 2011
• This List of Security Tips Goes to Eleven
• Anti-Phishing Phil game, for teaching people not to fall for phishing scams

Research Tools, Software, and Web Sites

• Lean Privacy Review is a tool to help with privacy, sort of like heuristic evaluation + crowdsourcing for privacy.
• Coconut is a plugin for IntelliJ and Android Studio to help developers with privacy.
• Use our SA-6 and SA-13 survey instrument to assess people's security attitudes. You can also take the SA-6 quiz online here.
• Ubicomp Design Patterns, DIS 2004 paper, talk, and map of the patterns
• PrivacyStreams (GitHub), a programming model for Android that makes it easier for developers to access sensitive data while also improving privacy. See IMWUT paper here.
• PrivacyProxy, a VPN for Android that identifies likely unique identifiers in your network traffic
• PrivacyGrade.org, a web site for grading the privacy of 1M+ Android apps
• Livehoods, a web site for urban analytics, showing clusters of related venues
• APWG Landing Page, for replacing fake phishing web sites

Research Data Sets

• Twitter data set of user-driven audits, see our paper Participation and Division of Labor in User-Driven Algorithm Audits: How Do Everyday Users Work together to Surface Algorithmic Harms?
• PrivacyGrade data set (warning: 800M zip file), our privacy analysis of one million Android apps
• ClearTerms data set is available here. This is a spreadsheet containing the results of several thousand crowdsourced judgements comparing different statements in Terms and Conditions for about a dozen ecommerce web sites.
• EMA data publicly available from our study on social interactions, social support, mood, and well-being during 2020 COVID.
• MobiPurpose data set, containing over 2 million unique intercepted traffic requests from 15k+ smartphone apps, gathered from our array of smartphones

Instructor Guides and Reading Seminars

• Teaching Usable Privacy and Security, with Lorrie Cranor and Mike Reiter
• Introduction to User Experience and User Interface Design: A One Hour Crash Course
• Reading list for HCI and Privacy Reading Seminar, Spring 2012 (public Google Doc)
• Reading list for Ubiquitous Personal Smart Agents, Fall 2015 (public Google Doc)

Advice for PhD students and Grad School Applicants

• Grad School Advice Page (popular)
• PhDs from the Faculty's Perspective (BLOG@CACM)

Odds and Ends

• My speech at the 2017 commencement of my old high school, the South Carolina Governor's School for Science and Math
• Why is Privacy So Hard? (Blog@CACM)
• Yet Another Major Data Breach, But Will This Time Be Any Different? (BLOG@CACM)
• Human Subjects Research for the Twenty-First Century, or, What Can We Learn from the Facebook Mood Study? (BLOG@CACM)
• Privacy and Google Glass (BLOG@CACM)
• No, your users aren't morons (wombatsecurity.com)
• Most Smartphone Apps are Spyware (BLOG@CACM)
• Password Policies are Getting Out of Control (BLOG@CACM)
• Why is Great Design so Hard? Part 1, Part 2, and Part 3 (BLOG@CACM)
• How Little Web Sites Have Changed Over the Past 6 Years
• Web 2.0 and Research
• Watch Ed Chi get Kicked in the name of science (Yes, I actually like Ed :)
• Famous Rejected Papers

The Design of Sites
I co-authored a book on web site design, which uses the notion of web design patterns as a way for facilitating the design of customer-centered web sites. Check out the web site for our book The Design of Sites. Our book has been translated into Polish, Chinese, Korean (and possibly other languages as well).

Service

Current Service

• University Faculty Review Committee
• Editorial Board for Communications of the ACM (web site subgroup)
• Program head (HCII half) for CMU's Master's of Product Management
• I occasionally write for BLOG@CACM

Some Past Service

• Program Chair or Co-Chair SOUPS 2008, SOUPS 2007, HotMobile 2009, Mobisys 2015
• Editorial Board for ACM Transactions on Human-Computer Interaction, Foundations and Trends in HCI, and IEEE Pervasive Computing
• Guest Editor, IEEE Pervasive Computing, Special Issues on Accessibility, Security & Privacy, Connected Youth, and Wearable Computing, and Privacy and Security
• Program Committees for IEEE Symposium on Security and Privacy (Oakland Security), HotMobile, Ubicomp, Mobisys, SOUPS, UIST, CHI, and more
• Subcommittee co-chair for Privacy, Security, and Visualization for CHI2018