Managing security and privacy policies is known to be a difficult problem. Studies have shown that lay users often do not know their own policies or are unable to express them. Even in a desktop computing environment, end users have great difficulty using the Windows XP file permission system to create security policies for file access. In mobile and pervasive computing settings, this situation is often exacerbated by the limitations of access devices and the numerous tasks users concurrently engage in. To make matters worse, desired security and privacy settings are not just difficult to articulate, but they also tend to change over time. In short, emerging demands for empowering end users to set up policies are often unrealistic. This in turn may result in new sources of vulnerability and high levels of user frustration.

We believe it is important that new user interfaces be developed to effectively and efficiently support lay users in understanding and managing security and privacy policies – their own as well as those implemented by systems and individuals with whom they interact. Solutions in this area have traditionally taken a relatively narrow view of the problem by limiting the expressiveness of policy languages or the number of options available in templates, restricting some decisions to specific roles within the enterprise, etc. As systems grow more pervasive and more complex, and as demands for increasing flexibility and delegation continue to grow, it is imperative to take a more fundamental view that weaves together issues of security, privacy and usability to:

• Systematically evaluate key tradeoffs between expressiveness, tolerance for errors, burden on users and overall user acceptance, and

• Develop novel mechanisms and technologies that help mitigate these tradeoffs, maximizing accuracy and trustworthiness while minimizing the time and effort required by end users.

The objective of this project is to develop new interfaces that combine user-centered design principles with dialog, explanation and learning technologies to assist users in specifying and refining policies. This involves developing policy authoring tools for a growing collection of pervasive computing applications and evaluating the effectiveness of these tools with users in longitudinal studies. Evaluation metrics look at both accuracy and overall user acceptance, including user burden. Users should feel that they have adequate control over the behavior of the applications they interact with.