The workshop will be held in MIT Classroom 32-124 in the Stata Center, Vassar Street.

We are exremely grateful to Google, Microsoft and PGP for generously sponsoring this event.

June 10

Welcome reception (1800-2100) at Le Meridien, 30 Sidney Street, Cambridge

June 11

1. Session 1 (0900-1030): Deception
   • Mark Frank, Buffalo; Human Behaviour and Deception Detection
   • David Livingstone Smith, University of New England: Less than human: self-deception in the imagining of others; Talk on Lying at La Ciudad de Las Ideas; a subsequent discussion; Why War?
   • Jeff Hancock, Cornell: On Lying and Being Lied To: A Linguistic Analysis of Deception in Computer-Mediated Communication; Separating Fact From Fiction: An Examination of Deceptive Self-Presentation in Online Dating Profiles
   • Frank Stajano, Cambridge: Understanding victims: Six principles for systems security; Usability of Security Management: Defining the Permissions of Guests
   • Dominic Johnson, Edinburgh: Paradigm Shifts in Security Strategy; Perceptions of victory and defeat
   • Bruce Schneier, Counterpane: How Perverse Incentives Drive Bad Security Decisions; The Kindness of Strangers
2. Session 2 (1100-1230): Fraud
   • Jean Camp, Indiana: Experimental Evaluation of Expert and Non-expert Computer Users' Mental Models of Security Risks
   • Jeffrey Friedberg, Microsoft: Internet Fraud Battlefield; End to End Trust and the Trust User Experience; Testimony on "spyware"
   • Julie Downs, CMU: Behavioral Response to Phishing Risk; Parents' vaccination comprehension and decisions; The Psychology of Food Consumption
   • Matt Blaze, UPenn; Electronic vote rigging in Kentucky
   • Stuart Schechter, Microsoft: It's no secret; The Emperor's New Security Indicators
   • Tyler Moore, Harvard: The Consequences of Non-Cooperation in the Fight Against Phishing; Information Security Economics - and Beyond
3. Session 3 (1400-1530): Usability
   • Andrew Patrick, NRC Canada: Fingerprint Concerns: Performance, Usability, and Acceptance of Fingerprint Biometric Systems
   • Luke Church, Cambridge: SHB Position Paper; Usability and the Common Criteria
   • Diana Smetters, PARC: Breaking out of the browser to defend against phishing attacks; Building secure mashups; Ad-hoc guesting: when exceptions are the rule
   • Rob Reeder, Microsoft: Expanding Grids for Visualizing and Authoring Computer Security Policies
   • Lorrie Cranor, CMU: A Framework for Reasoning About the Human in the Loop; Timing Is Everything? The Effects of Timing and Placement of Online Privacy Indicators; School of Phish: A Real-Word Evaluation of Anti-Phishing Training; You've Been Warned: An Empirical Study of the Effectiveness of Web Browser Phishing Warnings
   • Jon Callas, PGP: Improving Message Security With a Self-Assembling PKI
4. Session 4 (1600-1730): Methodology
   • Angela Sasse, UCL: The Compliance Budget: Managing Security Behaviour in Organisations; Human Vulnerabilities in Security Systems
   • Bashar Nuseibeh, Open University: A Multi-Pronged Empirical Approach to Mobile Privacy Investigation; Security Requirements Engineering: A Framework for Representation and Analysis
   • James Pita, USC: Deployed ARMOR Protection: The Application of a Game Theoretic Model for Security at the Los Angeles International Airport
   • Markus Jakobsson, PARC: Male, late with your credit card payment, and like to speed? You will be phished!; Social Phishing; Love and Authentication; Quantifying the Security of Preference-Based Authentication; talk slides
   • Rachel Greenstadt, Drexel: Practical Attacks Against Authorship Recognition Techniques (pre-print); Reinterpreting the Disclosure Debate for Web Infections
   • Mike Roe, Microsoft

   Conference banquet: Legal Sea Foods (1900-2200)

   June 12

5. Session 5 (0900-1030): Foundations
   • Terence Taylor, ICLS: Darwinian Security; Natural Security (A Darwinian Approach to a Dangerous World)
   • Andrew Odlyzko, University of Minnesota: Network Neutrality, Search Neutrality, and the Never-Ending Conflict Between Efficiency and Fairness in Markets, Economics, psychology, and sociology of security
   • danah boyd, Microsoft Research: Taken Out of Context - American Teen Sociality in Networked Publics
   • Mark Levine, Lancaster: The Kindness of Crowds; Intra-group Regulation of Violence: Bystanders and the (De)-escalation of Violence
   • Jeff MacKie-Mason, Michigan: Humans are smart devices, but not programmable; Security when people matter; A Social Mechanism for Supporting Home Computer Security
   • Joe Bonneau: The Privacy Jungle: On the Market for Data Protection in Social Networks
6. Session 6 (1100-1230): Terror
   • Bill Burns, Decision Research: The Diffusion of Fear: Modeling Community Response to a Terrorist Strike
   • Chris Cocking, London Met: Effects of social identity on responses to emergency mass evacuation
   • Richard John, USC: Decision Analysis by Proxy for the Rational Terrorist
   • Mark Stewart, University of Newcastle, Australia: A risk and cost-benefit assessment of United States aviation security measures; Risk and Cost-Benefit Assessment of Counter-Terrorism Protective Measures to Infrastructure
   • John Adams, UCL: Deus e Brasileiro?; Can Science Beat Terrorism?; Bicycle bombs: a further inquiry
   • Dan Gardner, the Ottawa Citizen
7. Session 7 (1400-1530): Privacy
   • Alessandro Acquisti, CMU: What Can Behavioral Economics Teach Us About Privacy?; Privacy in Electronic Commerce and the Economics of Immediate Gratification
   • Adam Joinson, Bath: Privacy, Trust and Self-Disclosure Online; Privacy concerns and privacy actions
   • Peter Neumann, SRI: Holistic systems; Risks; Identity and Trust in Context
   • Eric Johnson, Dartmouth: Access Flexibility with Escalation and Audit; Security through Information Risk Management
   • Christine Jolls, Yale: Rationality and Consent in Privacy Law; Employee Privacy
   • Andrew Adams, Reading: Regulating CCTV
8. Session 8 (1600-1730): How do we fix the world?
   • David Mandel, DRDC Toronto: Applied Behavioral Science in Support of Intelligence Analysis, Radicalization: What does it mean?; The Role of Instigators in Radicalization to Violent Extremism
   • Alma Whitten, Google: Why Johnny can't encrypt: A usability evaluation of PGP 5.0
   • Adam Shostack, Microsoft
   • John Mueller, Ohio State: Reacting to Terrorism: Probabilities, Consequences, and the Persistence of Fear; Evaluating Measures to Protect the Homeland from Terrorism; Terrorphobia: Our False Sense of Insecurity
   • Ross Anderson, Cambridge: Database State; book chapters on psychology and terror; slides

Session chairs: