ARI: Hello, I'm Ari. [CLAUDINE: And I'm Claudine] Welcome to Proving the Negative.
ARI: We're a podcast all about exploring the different sides of cybersecurity,
from political to computer science, international relations to mathematics.
Join us as we talk to our friends about the work they do.
All right Claudine, this week we're doing [you... oh no, phrasing!!].
CLAUDINE: Oh, please leave that in.
ARI: Hello everyone, welcome back to PTNPod - Proving the Negative,
Swanning About in Cyber Security. We're going to intro, just like we did last time.
Claudine, why do you do the work that you do, in the grand scheme of things?
CLAUDINE:The Online Safety Bill's been in the news quite a bit recently.
It's purpose is to protect users from harm they might encounter on social media.
The new and controversial bit of the bill is referred to as 'legal but harmful' content.
This is content on social media that is not illegal, but might still be harmful to users.
This Bill is trying to deal with that illegal content, but also impose a duty of care.
Ari, you mentioned a 'duty of care' in your episode... this is slightly different.
[The Bill] imposes a duty of care on social media providers and search engines,
or at least the very large ones, to protect their users from harm from legal content.
ARI: We talk about qualitative and quantitative data, why's this contentious?
CLAUDINE: Quantitative data tends to be seen [in STEM fields] as better (e.g., statistics).
Qualitative data is a little bit different. It tends to be done on smaller samples.
(You shouldn't impose any pre-conceived notions...!)
I tend to think that the best approach is mixed methods. There are situations...
... in which quantitative data is absolutely appropriate, and cases where it's not.
In those situations, you need to use qualitative analysis.
ARI: We will also talk about dark patterns or deceptive design.
CLAUDINE: They're meant to nudge you to take a specific action... when you're
shopping online and it's hard to remove something from your cart, or you can't
find the unsubscribe option in an email that you're getting for a newsletter.
Hi, I'm Claudine. I'm based in the Human Centred Computing Group at Oxford.
I study the effect of social media use on well-being.
When we use social media, we have emotional responses to content we see.
We might respond a specific way to certain types of content.
One aspect that tends to be overlooked is the effect of individual context:
socio-economic background, your gender identity, ethnicity, where you grew up,
your native language... all those different factors, that's your background context.
Then there's individual context that varies depending on your mood, personality...
If you're feeling bad because you've had a professional letdown, then on Twitter
a colleague has posted about a success in their professional life, you might feel bad
in that moment. But there's nothing objectively wrong with that content.
You might feel completely different about it at a different point in time.
I study mundane social media content that is not considered illegal or harmful.
Individual differences impact how we respond to social media content.
I try to figure out how people develop strategies to address those emotions and
what user controls we can provide to make that experience more seamless.
Something I hear a lot is [that] by looking at it from this angle.
I'm putting burden and stress on the user to manage their own experience.
That's fair. But there are cases in which it is the responsibility of the platform to
manage and to moderate. When it comes to personal and individual preferences,
users should have the appropriate tools at their disposal.
ARI: What is it that you're curious about?
This seems like a really interesting mix of social and technical understanding.
CLAUDINE: Good question. I think I just side stepped into it accidentally.
I became interested in social media and impacts that aren't often talked about.
We talk a lot about 'big bad harms': exploitation, harassment, cyber bullying.
A lot of negative experiences that I was having had nothing to do with that.
A lot of it had to do with feeling bad after reading the news or feeling stressed
because other people seemed to be doing better than I was. On a selfish level,
I started wondering how we could manage this and help others
manage slow and incremental harms that build up over time.
ARI: What do you measure? CLAUDINE: That's a perpetual struggle!
There's no one way to do it. I to take as broad of a view as I can,
parsing out individual characteristics that could influence whether
someone is likely to [experience harm] around (COVID-19) news content.
I'm working on a project about the negative impact of social media on
people who have post-traumatic stress disorder and how they cope with that.
I'm working on a mobile experience sampling method, which allows us to
collect data in real time from users as they're using social media.
ARI: I don't know anything about PTSD. CLAUDINE: For people who don't know, PTSD,
post-traumatic stress disorder, is a condition that can occur in someone who
has experienced a traumatic event or a series of traumatic events.
It can lead to long term, potentially debilitating psychological effects that can
be triggered by something in their environment that reminds them of
the event (or some aspect of the events). To be diagnosed with PTSD,
there are a number of criteria that someone would have to fulfill.
If someone has developed PTSD from a very serious car accident, the experience
is the physical experience of having been in the car accident.
Witnessing news footage of a serious car accident, which has a negative
psychological impact, would not qualify someone for PTSD.
You could (clinically) experience PTSD if the event happened to a loved one,
first responders can develop 'vicarious' PTSD from repeated exposure to events.
During the pandemic, I ran a national survey about COVID-19 social media use.
(Exchanging news or information, or looking at content about COVID-19)
PCL-5 is a standard screening questionnaire for PTSD
(not a definitive diagnostic tool, I should make that clear)
I asked [people] to fill out that [survey]. What we found was that there were
types of social media use more closely associated with PTSD symptoms,
symptoms that would have qualified somebody as being above a certain score
threshold, likely to be having PTSD and referred for further examination.
We screened out individuals who were first responders, had had COVID-19, or
with a close friend or family member who had been seriously ill from COVID-19.
Active use was more clicking, posting, interacting with social media,
People who used social media passively (scrolling and browsing) were associated
with higher levels of post-traumatic stress symptoms.
There hasn't been a lot of research on social media triggers. Existing controls:
filtering or blocking content, are not very fine tuned.
This is not specific to people who have experienced trauma, dealing with PTSD.
This seems to be a case study that could be representative other groups.
ARI: Social media giants don't have a history of collaborating with researchers.
There was a study that manipulated people's news feeds to see how it would
change their emotions - they looked at how they could impact how people felt.
It didn't have any ethical oversight. Hopefully, we're doing better.
What does your work look like?
CLAUDINE: Mobile experience sampling isn't done through the platforms directly.
We are developing an app that users will download on their phones.
It will prompt them throughout the day.
The app is running in the background of their phone, and then a few times a day,
they'll get a pop up while they're using social media, they'll be asked to complete
a questionnaire about the type of content that they're looking at,
how it's making them feel and what else they're doing.
E.g., are they using social media on a break or while they are working?
The reason we ask about this is, again, it goes back to context.
It's critical to understand[ing] how and why people react the way they do.
[Social media content] use doesn't happen in a vacuum, right?
It happens in a physical/cyber environment - context is hard to discern.
We will ask specifically about the other things that they're doing and some of
the other things happening in their life throughout the course of the study.
We will collect data in the morning and the evening.
We will ask questions about any significant changes that day,
if they see something on social media that elicits a particularly strong emotion,
they can press a button to bring up the a survey at that time.
At the end of several weeks, the idea is to see if there are any strong
correlations between environmental factors and emotional responses.
We are getting around the social media platforms by doing it this way.
And as you rightly pointed out, we do need ethical review for a study like this.
There are certainly some major data protection implications.
We need to be mindful of that while we're designing the study.
We are ensuring security and privacy and (GDPR) compliance by design.
ARI: How have you approached the biggest challenge in your research?
CLAUDINE: Since I don't come from a technical background,
it can be daunting to go for projects that have a strong technical component
collaborat[ing] with people who have a software engineering/computer science background.
The biggest challenge that I have is more of a technical one
I'm at a stage in my training where I know enough to get myself into trouble,
but I don't know enough to get myself out of trouble.
Trying to go it alone is a bad idea - if you don't collaborate and seek help,
you're just going to be in for a world of hurt.
ARI: When we talked to Mary, she talked about having confidence in what
you want to do, you can use that to hang other people's expertise off of.
You direct your work and draw in the techies to support you.
Are technical people more confident that they know what is right/correct?
You have to explore questions in your work, and the answer presents itself.
CLAUDINE: I found that to be an interesting difference. I come from
a background where it's all about shades of grey in a lot of cases, right?
Politics is the art of the possible, and Law is very much... not about what is
objectively right as much as what you can argue or what you can prove.
That's a different mindset to what I've experienced of people around me who
have a clear-cut idea about what they want to do and the approaches to take.
I find that sometimes it can take a little bit of work to get on the same
wavelength, and that was a challenge that I had to learn to adapt to.
ARI: When you say 'qualitative' data or methods, why is that different?
Why is that something that presents a challenge?
CLAUDINE: In the research I do, a lot of it is exploratory, which sounds weird
because you think that social media is something that's been studied to death,
on the scale of things, it's actually a fairly new field. Social media has been
around for 20 years or so and has only been widespread since Facebook.
I was a teenager before I got my first Facebook page (well into high school)
The areas of it that have been studied cluster around certain topics,
around specific sub-populations (e.g., body image/eating disorders in teenage girls).
When you're doing qualitative analysis in certain areas of social media,
you do occasionally end up with these spaces where there's just nothing.
Research around PTSD and social media triggers has not been studied much.
Other areas and sub-populations really haven't been studied all that much.
You can end up navigating in the dark, a little bit!
You're starting off with some research questions and assumptions, and if
you have a grounded approach, collecting data before extracting ideas,
you're not going in with any preconceived notions.
ARI: It sounds like you're comfortable with uncertainty.
CLAUDINE: I occasionally have stress dreams about it, but other than that...
ARI: About social media in particular, or computer scientists?!
CLAUDINE: All of the above... *laughter*
ARI: I can't think of anything that lets me filter what I what I see.
In addition to the actual content, you've also got advertising.
That is content you have zero control over... what's been the biggest surprise?
CLAUDINE: It's been an accumulation of little ones, of being OK with,
with uncertainty in a situation where you feel like the minority,
I don't have a technical background and I am in a more technical field.
General uncertainty in terms of thinking, when I'm doing research or starting out
It still happens to me very regularly that I look at something and go, "Oh...
"... I don't know how to do X, how to code this... but I don't have a choice...
"... this is the only framework that exists to do X". Teaching myself to do it I think
"Hmm, do I actually... do I actually know what I'm doing here?"
That's always a little bit of a struggle for me. It's not the biggest single challenge
but it is a constant to manage because if you don't, it can become paralysing.
If you allow yourself to be too uncertain and too insecure, nothing gets done.
On the other hand, if you don't have a healthy level of self-reflection,
you can end up doing something that is not sufficiently rigorous or appropriate.
It's figuring out where the balance of self-doubt and self-assurance is.
I'm always, even now (and I'm at a fairly late stage at this point), trying to be OK
with that level of uncertainty, risk and knowing that sometimes you just don't know.
It is kind of a daily struggle. I'm just fascinated by the 'squishy' bits.
I'm interested in how life shapes the way we think, and interact with technology.
AR: How do the squishy bits relate to cyber security? Why're they important?
If you look at a really basic notion that cybersecurity has to do with protecting
the security of information systems infrastructure,
this isn't strictly speaking cybersecurity. However, there has been a shift,
largely due to the advent of social media and connected digital devices
humans are increasingly permanently connected to technology. In some cases,
24 hours a day, 7 days a week. There's been an expansion of cybersecurity
to include more and more of a human centred focus. When we look at the
individual and the way an individual experiences social media, for instance,
that is more what I would consider cyber safety,
the general psychological and emotional safety when being online.
That's becoming an increasingly important aspect
of being safe in general and of being secure in general.
Cyber security is going to include cyber safety as a notion. There is some debate
right now as to whether cyber safety and cyber security should be considered
part of the same general group. I think they should.
Some of our more technically minded friends might disagree with me...
Given how connected humans are to technology in general,
they should at this point be considered part of systems and infrastructure.
ARI: I would disagree with you saying what you do is not cyber security.
'Cyber' comes from this [idea of] 'cybernetics', a self-governing system.
You have a complex system of systems, there's all sorts of interactions going on.
This presents a massive...
I would call it threat surface - there are all sorts of things that could go wrong.
This surface is quite wide. You can't ignore safety.
To find vulnerabilities and gaps and places where things could go wrong,
you have to understand that there are different moving pieces.
People are, of course, a really important part of those systems.
Cyber safety, that's incredibly important.
The nature of what we do is interdisciplinary - it doesn't fit into preconceived buckets.
CLAUDINE: The types of people with a valuable (cyber security) skill set
has changed significantly, even just since I started in twenty eighteen.
It's really important to be flexible. There are always going to be tensions
around what's considered part of the field, what isn't
and where we draw the line in terms of being inclusionary or exclusionary.
Last year, I was working on a project circumventing dark patterns in apps.
This plays into social media - as you pointed out earlier Ari, to do with ads.
Dark patterns can play a huge role in targeted advertising and often do.
I wanted to figure out how people felt about dark patterns,
whether users necessarily felt that dark patterns were bad.
Even the words 'dark pattern' sound menacing and ominous.
It's really hard to ask people about dark patterns. They're hidden, not obvious...
We can ask about them conceptually, but that's not asking about experiences.
That's why I'm doing experience sampling now.
You can ask people a questionnaire about their social media use and ask,
"What type/s of social media content make you angry, sad, happy...?"
"What do you think were factors in your life that influenced that?"
I can ask those questions, but you're never going to get the precision of data
[as] asking people in the moment when experiencing emotion or using technology.
You're never going to get the same level of clarity about context in hindsight.
ARI: There's this whole conversation we have about privacy,
[Experts] say people don't care about privacy as they SAY they do, but DO nothing.
And a lot of studies that this has come from are based on reported data.
They asked people, but not when they were making a choice to share data.
ARI: I would like to ask you about the Online Safety Bill.
CLAUDINE: It's a Bill currently working its way through [UK] Parliament.
It's been evolving for the last few years. The purpose of this Bill, if it passes, is to
impose a duty of care on social media providers and search engines to protect
users from harms that they might encounter when using their services.
They do things called 'Calls for evidence' periodically.
(I am currently working on one which I need to send out very soon!)
Unfortunately, academia tends to be a little bit underrepresented in the experts
it's been a lot of industry people and people from non-profit organisations.
There have not been a lot of academics involved. ARI: Why is the Bill important?
CLAUDINE: One of the aspects that has been neglected...
(and I should say that this is my personal opinion...
... it does not reflect the University of Oxford or anyone in my group...
... disclosure over)
They have not solicited experts in the field of human centric computing,
specifically around issues like user controls.
There's a big thing that's been added to the Online Safety Bill about empowering
users to have more control over harmful content that they see.
Theoretically, that's great.
The problem is there's no detail in terms of how that would be done.
The language is vague - I'm paraphrasing, but it says that,
users should have tools [to] reduce exposure to certain types of harmful content.
What does that mean? What is the scope? It could mean what we have is sufficient.
There really isn't much of a focus on users' needs in this Bill,
that's the main focus of the recommendations I'm going to submit.
What does that mean? Potentially, what's happening is that the scope is wrong.
E.g., content discussing self-harm [could be] around supporting individuals
attempting to recover from, or manage, self-harm.
The concern is that if the guidance to be provided to social media companies,
(given by Ofcom), is not sufficiently narrow and is not sufficiently specific,
then there is a risk that this power will either be delivered far too broadly,
(the potential good is wiped out with potential harm), or far too narrowly,
(the mark will be missed for many groups whose interests are ignored).
Specific interests may not be factored into the assessments that social media
companies will [need] to determine whether content is at risk of being harmful.
ARI: Do you have any tips for keeping up to speed with cybersecurity?
CLAUDINE: Twitter is always a good place to start! For the work that I do...
Journals like Social Media in Society or New Media in Society.
The ACM CHI Conference on Human Factors in Computing Systems.
Wired (https://www.wired.com) is a good mainstream publication.
A blog (https://www.cyberleagle.com) run by attorney Graham Smith.
ARI: Where can our listeners find out more?
CLAUDINE: You can follow me on Twitter (@ClaudineTinsman).
Join us next week for another fascinating conversation.
In the meantime, you can tweet at us @HelloPTNPod
and you can subscribe on Apple Podcasts or wherever you listen to podcasts.
The title there is PTNPod. See you next week. [ARI: Bye!]
This has been a podcast from the Centre for Doctoral Training in Cybersecurity, University of Oxford.
Funded by the Engineering and Physical Sciences Research Council.