# Usable Privacy and Security from the Perspective of Cognitive Abilities

Joakim Kävrestad, Allex Hagberg, Robert Roos, Jana Rambusch, Marcus Nohlberg

## ► To cite this version:

Joakim Kävrestad, Allex Hagberg, Robert Roos, Jana Rambusch, Marcus Nohlberg. Usable Privacy and Security from the Perspective of Cognitive Abilities. 16th IFIP International Summer School on Privacy and Identity Management (Privacy and Identity), Aug 2021, Virtual, Luxembourg. pp.105-121, 10.1007/978-3-030-99100-5_9. hal-04636347

HAL Id: hal-04636347

https://inria.hal.science/hal-04636347v1

Submitted on 5 Jul 2024

HAL is a multi-disciplinary open access archive for the deposit and dissemination of scientific research documents, whether they are published or not. The documents may come from teaching and research institutions in France or abroad, or from public or private research centers.

L'archive ouverte pluridisciplinaire HAL, est destinée au dépôt et à la diffusion de documents scientifiques de niveau recherche, publiés ou non, émanant des établissements d'enseignement et de recherche français ou étrangers, des laboratoires publics ou privés.

<figure><img src="image_1.png" /></figure>

Distributed under a Creative Commons Attribution 4.0 International License
<figure><img src="image_2.png" /></figure>

ifip

International Federation for Information Processing

This document is the original author manuscript of a paper submitted to an IFIP
conference proceedings or other IFIP publication by Springer Nature. As such, there
may be some differences in the official published version of the paper. Such
differences, if any, are usually due to reformatting during preparation for publication or
minor corrections made by the author(s) during final proofreading of the publication
manuscript.
# Usable privacy and security from the perspective of cognitive abilities *

Joakim Kävrestad<fnref n="1" />[0000-0003-2084-9119], Alex Hagberg<fnref n="2" />, Robert Roos<fnref n="2" />, Jana Rambusch<fnref n="1" />, and Marcus Nohlberg<fnref n="1" />[0000-0001-5962-9995]

**Abstract.** Privacy, Information, and Cybersecurity (PICS) are related properties that have become a concern for more or less everyone. A large portion of the responsibility for PICS is put on the end-user, who is expected to adopt PICS tools, guidelines, and features to stay secure and maintain organizational security. However, the literature describes that many users do not adopt PICS tools and a key reason seems to be usability. This study acknowledges that the usability of PICS tools is a crucial concern and seeks to problematize further by adding cognitive ability as a key usability aspect. We argue that a user's cognitive abilities determine how the user perceives the usability of PICS tools and that usability guidelines should account for varying cognitive abilities held by different user groups. This paper presents a case study with focus on how cognitive disabilities can affect the usability of PICS tools. Interviews with users with cognitive disabilities as well as usability experts, and experts on cognitive disabilities were conducted. The results suggest that many of the usability factors are shared by all users, cognitive challenges or not. However, cognitive challenges often cause usability issues to be more severe. Based on the results, several design guidelines for the usability of PICS tools are suggested.

**Keywords:** privacy · security · usability · user · cognitive · ability · disability

## 1 Introduction

Privacy, Information, and Cybersecurity (PICS) are related properties that have become a concern of more or less everyone [26]. Privacy is typically discussed as the individual's right to their personal information [35]. Information security and cybersecurity are terms that are often used interchangeably even if information security relates to the security of information regardless of how it is stored while cybersecurity concern the security of information and devices connected to cyberspace [16]. The three concepts are discussed together under the term PICS in this paper. The reason is that many safeguards and concept are the same for the domains of privacy, information, and cybersecurity.

<footnote n="1">¹ University of Skövde, Sweden *firstname.lastname@his.se*</footnote>

<footnote n="2">² Xenolith AB, Skövde, Sweden *firstname@iodesk.net*</footnote>

<footnote>* Supported by the Swedish Post and Telecom Authority, and Begripsam.</footnote>
In our personal lives, we rely upon digital services for banking, social contacts, dating, shopping, and more. Consequently, personal data is stored in a multitude of locations worldwide, and the confidentiality, integrity, and availability of it can be compromised in several ways unless PICS is ensured. Moreover, PICS is high on the agenda of modern organizations. Different types of adversaries, ranging from nation-states and organized crime units to less sophisticated script kiddies attempt to compromise organizations in various ways [5]. Common motives for those attacks include financial gain, destabilization of nation-critical systems, and political motivation. A successful attack against an organization can result in severe damages such as system malfunction, loss of money or intellectual property, or disclosure of personal information stored by the organization [14, 1, 24]. While service providers or organizational IT departments typically handle some aspects of PICS, a large part of the responsibility is put on the users who are expected to behave securely by use of tools, features, and procedures that intend to ensure privacy or cybersecurity (from hereon, denoted PICS tools).

PICS tools are tools, features and procedures designed to ensure or increase privacy or cybersecurity. This includes special purpose software such as password managers or encryption software [8], built in features such as password complexity requirements, captcha or privacy settings [12, 43], and policies and procedures such as password use recommendation or guidelines on phishing detection [44].

It is well known that it is hard to get users to use PICS tools. Unsurprisingly, the usability of such tools has been the attention of much research, and it is obvious that usability of PICS tools is a factor that determines what tools and features users choose to adopt or not [19, 3, 41, 31]. A related discussion is that of the digital divide, a phenomenon that can be described as some people being excluded from the digital world for various reasons [32]. One such reason, discussed in previous literature, is disabilities that impact the ability to use technology [17]. Along that line, cognitive workload and fatigue have been discussed in previous research as important factors that influence security behaviour [11, 33]. In essence, the use of PICS tools requires cognitive resources from the user. If those resources are depleted, so is the users' ability to use PICS tools [15]. For instance, previous research has found that cognitive depletion leads to creation of worse passwords [10], that cognitive ability affects the ability to solve captcha functions [2] and detect phishing [39], and that use of privacy settings can be increased by minimizing cognitive effort needed to use such settings [36]. Consequently, cognitive ability should be a factor of importance when researching the usability of PICS tools. The reasons are several:

- A user's cognitive abilities determine the amount of effort a user can spend using PICS tools. Thus, PICS tools requiring less cognitive effort can be used by more users and with better results.

- Users with cognitive disabilities run the risk of being excluded from using PICS tools, which is an inclusion problem. An example can be that the ability to solve a captcha can be limited due to a cognitive disability. In such a case, the captcha can exclude a user from using the service protected by the captcha.
- Since people with cognitive disabilities are working in organizations, just like anyone else, excluding them from the design of PICS tools becomes an organizational cybersecurity problem. The rationale is that excluding this group from design of PICS tools makes the effect of those tools unknown for this group of users, with possible PICS issues as a consequence.

- With or without a disability, a user's cognitive abilities vary over time. Since the need for security does not, a PICS tool must be usable even when a user's cognitive ability is lowered. It can, for instance, be assumed that a user's ability to detect phishing is lower when the user is tired as the end of a working day.

Our research specifically highlights users with cognitive disabilities, and the goal of this study is to provide insight into how users with cognitive disabilities perceive PICS tools by identifying usability requirements considered important by this group. This study was carried out as a case study where data was gathered from domain experts and people with cognitive disabilities. The results are expressed as design guidelines that PICS tools should meet in order to be considered inclusive with regard to users with cognitive disabilities. Those guidelines are discussed in relation to a commonly used framework for web accessibility, Web Content Accessibility Guidelines 2.1 (WCAG 2.1) [40]. This research contributes with increased understanding of the importance of usability in PICS. Specifically, the implications that a lack of usability has for users with cognitive challenges are highlighted and guidelines for increased usability are proposed.

The research was supported by Begripsam, a non-profit organization specializing in inclusive design with regard to users with cognitive disabilities. Begripsam specializes in usability testing for cognitive inclusion and helped the research by recruiting participants from their network.

The rest of the paper is structured as follows: A background to concepts used in the paper is provided in Section 2. Section 3 describes the used methodology before the results are presented in Section 4. The results are discussed in section 5. Section 6 outlines the contributions of this paper and directions for future work.

## 2 Background

Cognitive ability includes a person's ability to reason, plan, solve problems, and more [18]. It also affects a person's memory and ability to concentrate [25]. Cognitive abilities can be affected by several conditions such as autism and attention deficit hyperactivity disorder (ADHD) [13, 45]. It is also affected by other factors such as stress and fatigue, [28] which clearly shows that it is not constant but rather a dynamic spectrum. In fact, cognitive ability can shift during the day based on numerous factors including not only fatigue and stress but also mood, anxiety and more [38].

While someones cognitive abilities varies over time, there are several conditions, in this paper discussed as cognitive disabilities, that affects cognitive
abilities more permanently [42]. A cognitive disability is, in this paper, defined
as a condition that impacts on a person's cognitive abilities [27]. Someone with-
out such a condition is denoted neurotypical. While cognitive disabilities are
highly individual, they impact a person's cognitive abilities in one or more ways
[7]. Lundin and Mellgren describe that a person with a cognitive disability may
experience difficulties with one or more of memory, problem-solving, attention,
linguistic comprehension, math comprehension, or visual comprehension [23].
As exemplified by Rabiee et al, the level of cognitive impairment, in addition to
what cognitive abilities that are impacted, is also individual [30]. Consequently,
the impact of a cognitive disability will vary greatly depending on the specific
disability, and how that disability is manifested.

The focus of this research is on users with cognitive disabilities who are able
to autonomously use computers. The rationale is that this user group is required
to handle PICS on their own. Further, a focus on users with cognitive disabili-
ties is imperative in order to understand the cognitive challenges that may come
with the use of PICS tools. We argue that this user group is underrepresented
in past PICS research discussing usability of PICS tools which is typically fo-
cused on the users in general and treats users as one homogeneous group. Given
the individuality of cognitive disabilities the research focus is the cognitive im-
plications of cognitive disabilities rather than cognitive disabilities themselves.
While participants included in the research cover different cognitive conditions,
including dyslexia, ADHD, autism, language impairment, and brain fatigue, the
results are discussed in relation to impact on memory, cognitive processing etc,
rather than individual conditions.

3 Methodology

An interpretative research approach using qualitative data was used. The ratio-
nale was that previous research in this domain is scarce, making it important to
understand the individual experiences of members of the target population.

As shown in Figure 1, the research began with semi-structured interviews
with domain experts. Those guided target group workshops that were held next.
The data from all sessions were used to identify requirements on PICS tools that
were in turn used to propose guidelines. The methodology is described in more
detail in the rest of this section.

We employed a purposeful sampling approach where we selected to include
study participants who were expected to provide valuable input to the research.
We included experts in the domain to acquire data from professionals working
with the topic discussed in this research as suggested by Etikan et al. [6]. We
further included participants from the target group, namely users with cognitive
disabilities. The rationale was that it allowed for recruitment of participants
that were able to contribute to the study with first-hand experiences. While the
study design does not allow for generalization, the study aim was to provide a
basis for further research and generate a better understanding of problems faced
by the target group, rather than quantifying the occurrence of the problems.
<figure><img src="image_3.png" /><figcaption>Fig. 1. Overview of methodology</figcaption></figure>

Further, including both members of the target group and domain experts served as a means of triangulation as suggested by Lincoln and Guba [22]. This allows for comparison of the results and intends to make the combined results more reliable.

The expert interviews included four participants and were held as semi-structured interviews. The participants were identified for inclusion by considering domain experts already known to the research group. Semi-structured interviews were used since it allowed for pre-defined interview themes that guided the interviews in a uniform direction while allowing for follow-up questions based on the answers from the participants. Three interviews were held with one participant working as a coordinator for university students with disabilities, one user experience design expert with personal experience supporting close relatives with cognitive disabilities, and two participants who organize and lead usability evaluations with participants with cognitive disabilities as their profession. The interview with organizers of usability evaluations included two participants upon request from the participants.

The topics discussed during the semi-structured interviews were:

- Differences between neurotypical users and users with cognitive disabilities regarding PICS.

- How different cognitive disabilities can impact a user to be more or less susceptible to risks.

- If users with cognitive disabilities differ from neurotypical users regarding training, use of PICS tools or cognitive abilities affecting memory, willingness to take risks, and impulse control.
The workshops with members of the target group included ten participants. They were organized as two workshops where one discussed password security specifically and the other described cybersecurity in general. The rationale was that a more specific topic would yield more detailed data while a broader topic would also result in broader discussions. The workshops were carried out as follows:

- The workshop on password security included four participants and took the form of a usability analysis of a security education, training, and awareness (SETA) method called Context Based Micro training (CBMT) used to train users on password security [20]. The implementation is described in detail in Kävrestad and Nohlberg [20]. Framing the workshop as a usability analysis intended to spark a discussion on the usability of password guidelines and methods for presenting security related information to users.

- The general workshop included six participants and was arranged as a discussion on cybersecurity topics and problems encountered by the participants relating to security features. Questions were asked about the participants experiences with various PICS tools and situations. The topics included passwords, phishing, fake news, fraud, multi-factor authentication, privacy, and more. Having a more general theme intended to make the participants describe the topics they considered as most important.

Workshops were used with the intention of revealing the participants spontaneous reactions to the workshop topics [9]. Begripsam supported the design and execution of the workshops. All workshop participants were included in Begripsams network of users and Begripsams participation in the workshops intended to make the participants more comfortable while sharing their experiences. It should also be mentioned that the participants were used to discussing design issues as part of their involvement with Begripsam. They should therefore be considered as more knowledgeable than the average user.

All interview and workshop participants consented to participate in the study via e-mail before the sessions. The study purpose and data collection procedures were described to the participants again at the beginning of each session and the participants confirmed their consent to participate before the sessions started. Note that all participants were capable of giving consent to participate on their own.

All interviews and workshops were held by the same researcher (A) to maintain consistency and then transcribed by another member of the research group (B). The analysis was then conducted by researcher A and reviewed by researcher B, and finally reviewed by the rest of the research group. The video conferencing software Zoom was used to hold and record all sessions since the ongoing Covid-19 pandemic did not allow for physical sessions.

The analysis used an inductive thematic approach [4] employed to identify requirements that users with cognitive disabilities consider important. The identified requirements were then transformed to design guidelines presented as the conclusion of this study. The analysis was carried out in three steps with different purposes as follows:
1. The transcripts were first read and all sections where respondents described something that was positive or negative with regards to usability were extracted.

2. The marked sections were reread and assigned a descriptive label. The descriptive labels formed themes expressed as requirements that PICS tools should follow to be usable.

3. The sections in each theme were analyzed again, and the data in each theme was summarized and related to WCAG 2.1.

The expert interviews were analyzed before the target group workshops were held, and the output guided the workshops. The expert interviews emphasized that cognitive disabilities are very individual and that many users have more than one cognitive disability. As a result, it was not considered meaningful to discuss the impact of individual conditions and the workshops rather considered the impact of cognitive disabilities at a general level. During the workshops, the participants described how their cognitive abilities, rather than conditions, impacted their way of using PICS tools. The target group workshops were then analyzed separately before the results from the two steps were compared and used to propose guidelines for the inclusion of users with cognitive challenges.

# 4 Results

This section outlines the results from the individual research steps and their combined results.

## 4.1 Expert interviews

Three expert interviews were held and covered four participants as described in the section Methodology. The transcription of the interviews totaled 10741 words, and the total time of the interviews was 79 minutes. The combined result of the three interviews revealed four different themes of requirements that PICS tools should follow to be perceived as usable for users with cognitive disabilities.

The themes were established by categorizing and aggregating quotes from the participants. Table 1 shows the themes and a subset of the quotes leading up to the themes. Note that the interviews were held in Swedish, and quotes are translated by researcher A.

## 4.2 Target group workshops

Following the expert interviews, two group workshops with participants with different cognitive disabilities were held. The first workshop included four participants and the second included six participants. The transcription of the workshops totaled 17913 words, and the total time of the workshops was 181 minutes.

The analysis was based on the four themes developed during the analysis of the expert interviews. Quotes from the workshops were labeled using the four
<table><caption>**Table 1.** Part of data set from the expert interviews. *Bank-ID is a national authentication feature in Sweden. It is issued by banks and therefore requires a bank account. It is not available for users who cannot get a bank account, or who are not allowed to control their own bank account.</caption><thead><tr><td>Quote</td><td>Theme</td><td>Summary</td></tr></thead><tbody><tr><td>It must be clear and well-structured</td><td>Clarity and simplicity</td><td rowspan="4">Informative elements must be short and easy to read, and that tools should behave predictably. It should also be well-structured. Confusing elements and lack of control are perceived as bad and may result in paralysis.</td></tr><tr><td>..it is too much information....many with ADHD does not read it</td><td>Clarity and simplicity</td></tr><tr><td>I think it is good if it is clear</td><td>Clarity and simplicity</td></tr><tr><td>Reasonable amount of information in small chunks</td><td>Clarity and simplicity</td></tr><tr><td>Then you don't need to rethink or learn</td><td>Low memory load</td><td rowspan="4">It should not require users to learn or re-learn.</td></tr><tr><td>Limited memory capacity</td><td>Low memory load</td></tr><tr><td>Storing in memory is a hard process</td><td>Low memory load</td></tr><tr><td>Tasks that are slightly different appear completely new and require re-learning</td><td>Low memory load</td></tr><tr><td>Access to reading of text</td><td>Availability functions</td><td rowspan="2">It should have text-to-speech functionality that supports users with a wide range of disabilities.</td></tr><tr><td>Functions that everyone can use</td><td>Availability functions</td></tr><tr><td>Users with autism may experience anxiety when unexpected events happen</td><td>Discriminating design</td><td rowspan="3">Design that is impossible for some user groups to use should be avoided. In Sweden, this includes Bank-ID, which is an authentication feature that is not available for all users, for instance, users who are declared incapacitated.</td></tr><tr><td>Don't like when things happen without your control</td><td>Discriminating design</td></tr><tr><td>Not everyone is allowed to use Bank-ID* even if it is used for increased security</td><td>Discriminating design</td></tr></tbody></table>

themes. Two themes, *Availability functions* and *Low memory load*, were discussed in a broader sense during the workshops compared to the interviews. The themes were renamed to better capture the full meaning of the interviews and workshops combined. *Availability functions* was renamed because the expert interviews only described availability functions while the workshop participants also described the usefulness of different kinds of media. The new name *Media*
*diversity* intends to reflect the richer meaning of the combined data. Likewise, *Low memory load* was renamed to *Limit cognitive load* because the workshops suggested that the key aspect of the category was to minimize need for cognitive processing in a broader sense then to just avoid the need for learning and re-learning. The new label better captures that nuance. The analysis of the workshops is summarized in Table 2 which shows summaries of the four themes and examples of quotes, for each theme, from the participants.

## 4.3 Combined results and proposed guidelines

This research aimed to identify inhibitors and enablers for the usability of PICS tools with regards to users with cognitive challenges and use that data to draft design guidelines intending to support the design of inclusive and usable PICS tools. This section will describe the identified themes presented above further and propose guidelines that seek to address the identified inhibitors and enablers. The guidelines will be discussed in relation to WCAG 2.1.

The first theme is *Media diversity* where the expert interviews suggested that text-to-speech functions are crucial for several users, and that was emphasized further during the target group workshops. Text-to-speech functions enable users with various challenges such as dyslexia to understand masses of text with lower effort. While not a cognitive condition, several participants highlighted that text-to-speech is also beneficial for users with visual impairment. The first suggested design guideline is, therefore, to *include text-to-speech functionality in tools, functions, and guidelines that requires the users to read text*.

The workgroups further made it obvious that different users want to process information in different ways. While some users may benefit from having a video present information, others may get stressed by not being able to control the pace that information is presented with. It was made clear during the interviews that informative elements must be concise, well-structured, and relevant. However, different media formats benefit different user groups, and a resulting guideline is to *present information in different formats and allow for the user to choose the preferred format*. An example could be to have information displayed as text as a default setting, but allow a user to configure that information is instead presented as audio. The guidelines in the *Media diversity* share commonalities with the WCAG 2.1 chapter named *perceivable* that outlines ways to make information easy to perceive. The results, in this theme, therefore serves to emphasize the need of following accessibility frameworks when designing PICS tools.

The second theme was *Clarity and simplicity*, and all respondents describe that information must be relevant, easy to understand, and well-structured. They emphasize that processing information is very energy consuming, and one respondent described that processing badly worded information can be so exhaustive that they need to rest afterwards. The expert interviews further describe that a common reaction to tools that are seen as too hard to understand is not to use them at all. A resulting guideline is to *only provide the most important information, and in an easy-to-digest manner*.
<table><caption>**Table 2.** Part of data set from the workshops</caption><thead><tr><td>Quote</td><td>Theme</td><td>Summary</td></tr></thead><tbody><tr><td>I don't understand the purpose of that picture ... it confuses and takes energy</td><td>Clarity and simplicity</td><td>The respondents describe that informative elements must be short and easy to read and that tools should behave predictably.</td></tr><tr><td>It is distracting that it starts moving automatically ... takes focus completely</td><td>Clarity and simplicity</td><td>Further, unnecessary design elements such as animations or images that do not provide additional content should be avoided since they require unnecessary cognitive processing.</td></tr><tr><td>It should be coherent so I know what to expect</td><td>Clarity and simplicity</td><td>The respondents also emphasize that it is beneficial to use simplistic language.</td></tr><tr><td>In general ... good with limited text and short sentences.</td><td>Clarity and simplicity</td><td></td></tr><tr><td>I want information but ... prefer it short and to the point</td><td>Limit cognitive load</td><td>Minimize cognitive load by using consistent design choices, avoiding flashy design elements, and minimize the choices the user has to make. It was also mentioned that spelling errors could take a lot of energy.</td></tr><tr><td>Security is important, but it should be fewer options...it should not be so hard.</td><td>Limit cognitive load</td><td></td></tr><tr><td>It is always good with a text to speech function</td><td>Media diversity</td><td>Using different media to provide information is beneficial since different user groups may benefit from consuming information differently. For instance, text to speech is crucial for users with language difficulties, while some users may prefer video or text.</td></tr><tr><td>...no not a lot of text...I would rather have a video</td><td>Media diversity</td><td></td></tr><tr><td>It is good with large font size and short texts</td><td>Media diversity</td><td></td></tr><tr><td>...good with a video...I should be the one starting the video, and it should read the text next-by</td><td>Media diversity</td><td>This is exemplified by the respondents who express different preferences and needs</td></tr><tr><td>You can be denied access if you are not allowed to have Bank-ID</td><td>Discriminating design</td><td>Design that is impossible for some user groups to use should be avoided. In addition to Bank-ID, hidden text fields and captcha are described as close to impossible for some participants to use. The participants suggest that tools should support different forms of authentication to be more inclusive.</td></tr><tr><td>I misspell every tenth word...my email ended up in the trash folder</td><td>Discriminating design</td><td></td></tr><tr><td>I went to a webpage that said "I am not a robot" and "which of these pictures are bridges" ... do you see a bridge or not?</td><td>Discriminating design</td><td></td></tr></tbody></table>

The workshop part made it evident that the participants experienced processing of information as very energy-consuming. They described that moving
design elements such as animations or videos required a lot of cognitive work. They further described that images that do not provide information or did not make sense were disruptive and caused them to consider their purpose. In summary, a PICS tool should *avoid unnecessary design elements and allow the user to control moving media*. The rationale behind those guidelines is to emphasize that design elements that are created just to make a tool look fancy, but with no added functionality still require cognitive processing and can have a negative impact on the usability of the tool. Providing information that is easy to understand, allow users to control media, and avoiding unnecessary design elements make part of WGAC 2.1 emphasizing their importance for PICS tools. Keeping to the most important information and thereby minimizing the need for cognitive processing is, is not a focus of WCAG 2.1 and in that regard, this results makes an addition.

The third theme, *limit cognitive load* further emphasizes the importance of the guidelines just presented. Under this theme, the expert interviews describe learning and re-learning as energy-consuming processes. Further, they have shown that it is beneficial for users to limit the need to memorize new things. Similarly, the target group workshops suggest that tools with as little interaction as possible is favorable. The respondents describe that security is important, but seldom their primary target and a tool that adds security without involving the user is wanted, as long as that tool is indeed able to do its intended job. A further insight that became evident during the first workshop was that consistent design within a tool is also important. If a user quickly understands how the tool works, and the tool continues to work in the same way, it becomes intuitive to use and the need for cognitive processing is limited. Added guidelines under this theme are to *use consistent design choices and minimize the need for user interaction*. In regards to the second guideline, this research differs from WCAG 2.1 in that it suggests minimizing user interaction whereas WCAG 2.1 emphasize making interaction possible for different user groups [40]. While enabling different user groups to use a system is important, this research highlight the value of minimizing interactions to minimize cognitive load.

*Discriminating design* was the final theme and included two main discussions. First, some tools and designs are simply impossible to use for some user groups. The reasons can be that some user groups are simply excluded because of legal reasons or similar, as is the case with the Swedish national identification system "Bank-ID." Another reason for exclusion is that some design elements are impossible or close to impossible for users to use because of a cognitive challenge. The most persistently described examples where:

- Hidden text fields which are extremely difficult to use for users with dyslexia where writing in the blind becomes an additional challenge. If it is hard to spell passwords normally, it is almost impossible when the input is hidden.

- Captchas, which requires cognitive processing and good vision.

- Text elements with small font size are hard to notice and hard to read by a user with limited vision.
The workgroup participants further described that allowing different forms of authentication helped different user groups since it allows each user to select a method that works for them. On this topic, some participants did prefer password-based authentication while others preferred biometric options or Bank-ID. In summary, two additional guidelines were developed under this theme. *Avoid design elements or functions that are unreasonably hard, or impossible for some user groups to use* is the first guideline. It requires that user groups are identified with inclusion in mind, and that accessibility is considered from the viewpoint of each user group. Elements that are hard or even impossible for one or more groups to use should be removed or complemented with an additional element that meets the requirements of the identified group. The last guideline is to allow for various forms of authentication. It is proposed since authentication forms were central to the workshop discussions and make a central function in the use of information systems. Ensuring that various user groups can be authenticated securely and conveniently should therefore be seen as a key usability factor. An example can be to allow for biometric authentication instead of password based since using a biometric reader can be easier than to remember a password for some users.

# 5 Discussion

This research employed an interpretative approach using interviews. As a consequence, the degree to which the data is representative beyond the participants is unknown. However, the study's intent was not to gather a representative dataset but to gain a deeper understanding of the target group's experiences. No effort has been made to generalize the results in this study outside of the targeted population. The study presents results in the form of guidelines, and while the guidelines are designed to meet the needs of the target group, they are not validated in this work. We further acknowledge that the guidelines may not cover all usability requirements faced by users with cognitive challenges. Future endeavors in this domain could use the results of this study as a starting point and extend and validate the results presented here. A natural extension could be to conduct additional data gathering to further understand the impact of usability issues. An especially interesting direction would be to research how implementation of usability guidelines in the PICS domain impacts security. A second effect of the research design is that it is not possible to track the results to individual disabilities or challenges. It was decided to not collect or describe the participants individual disabilities to safeguard the individuals privacy. However, that means that any inference as to if and how the recommendations should be modified for different groups is impossible. The intent of the research is to provide results that describe users with cognitive difficulties on a general level and a second natural extension of this work would be continued research with more specific populations.

Previous research describes that security is only as strong as the weakest link [29] and that user behavior is a key aspect of security [34]. User behavior includes
that users adopt procedures and guidelines, and use tools designed to increase cybersecurity. Usability is a key factor for such adoption [31]. Since PICS tools are expected, or even required, to be used by all users, it is important to discuss the implication of our results on the general population. The proposed guidelines are intended to increase usability for users with cognitive challenges, but they must do so without negatively impacting usability for other user groups. The results in this study align well with previous research conducted on the same topic, but with a focus on the general user rather than on users with cognitive challenges [21]. Further, the interviews in this study suggest that all users face similar usability challenges when it comes to PICS tools. The main difference identified is that the impact of those challenges is more severe for users with cognitive challenges. Thus, we suggest that the guidelines presented in this study will positively affect the usability of PICS tools for all user groups. It should, however, be noted that this makes a natural area for future research were the security implications of the guidelines should be given attention. It can also be noted that some functions may render users with cognitive challenges unable to use some services, highlighting the importance of accessibility. Ensuring that a cognitive challenge does not exclude someone from using a particular service should be given high priority. The guideline proposed for this purpose posits that a PICS tool developer should consider all potential user groups and their challenges. While that can be a difficult task, different frameworks exist and can provide support. One such example is WCAG 2.1 [40]. While WCAG 2.1 is not specifically designed for PICS tools, this research showcase that many usability problems are the same in the PICS domain as in other domains. However, this research suggests that limiting cognitive load is a key usability issue for PICS tools and that is not a top priority of WCAG 2.1. As such, a call for a focus on minimizing cognitive load makes a contribution of this research.

The consistent theme through the interviews were that simplicity and minimal requirement for interaction from the user were sought-after properties that PICS tools should strive to achieve. However, the respondents also describe a desire for pluralism. Here, the respondents describe that it is good if the information is presented in different media and if different ways for performing the same task (e.g., authentication) is provided. Combining pluralism and simplicity could be challenging, and it seems natural that a feature added to accommodate one user group can be seen as redundant for another group. It also adds complexity in terms of development, where developers may need to implement more features than they would if they choose not to adopt the guidelines proposed in this paper. Future work considering the implementability of the proposed guidelines would make a natural extension of this study. Further, one could imagine a dilemma where a developer may opt not to adopt the guidelines even if that means that the product developed can be used by less users. The added user-base may be too small to financially motivate adoption of the guidelines if that requires additional work. While research into this dilemma is a natural direction for future work, we argue that inclusion should be a natural part of many devel-
opment projects. Not least considering the United Nation goals for sustainable
development where inclusive societies are promoted [37].

6 Conclusions

This study aimed to propose design guidelines that PICS tools should meet to be considered usable for users with cognitive challenges. Data was gathered from domain experts and the target group, and the data from the two participant groups revealed similar findings. The results showcase that the target group is heterogeneous in regards to the challenges they face. Nevertheless, while there are individual differences this study supports the notion that most solutions are beneficial for most users. A conclusion that can be drawn from the requirements described by the participants is that simplicity and clarity are crucial properties. Further, some commonly used design elements such as captchas or hidden text elements may render a function hard, or even impossible, for some users to use and should be avoided or combined with alternative functions for the same purpose. A further conclusion of this study is that users with cognitive disabilities to a large extent experience similar difficulties as neurotypical users, regarding the usability of PICS tools. However, the consequences of these usability issues are often more severe for users with cognitive disabilities. A usability issue that is annoying for a neurotypical user may render a user with a cognitive disability unable to use a service. This conclusion warrants further studies into how current design of PICS tools presents an inclusion problem, and how that problem can be addressed with maintained level of security.

There are few, if any, previous studies that specifically address the usability of PICS tools and features from the perspective of users with cognitive challenges. This study contributes to the scientific community with insights into how the usability of such functions is perceived from this perspective. As a contribution to the community of practitioners, this study proposes guidelines that can be used when developing future PICS tools, functions, and features. Needless to say, people with cognitive disabilities are using digital services and working in organizations world-wide. On the back of that, this study highlights that including this user-group in the design of PICS tools is an important matter for inclusion as well as PICS.

References

1. Andreasson, A., Blix, F.: "special commando move"-when informal, formal and technical cybersecurity components fail. In: Proceedings of the 5th International Workshop on Socio-Technical Perspective in IS Development. pp. 26–33 (2019)

2. Belk, M., Fidas, C., Germanakos, P., Samaras, G.: Do human cognitive differences in information processing affect preference and performance of captcha? International Journal of Human-Computer Studies 84, 1–18 (2015)

3. Bhagavatula, R., Ur, B., Iacovino, K., Kywe, S.M., Cranor, L.F., Savvides, M.: Bio-metric authentication on iphone and android: Usability, perceptions, and influences on adoption. In: USEC’15: Workshop on Usable Security. pp. 1–10 (2015)
4. Braun, V., Clarke, V.: Using thematic analysis in psychology. Qualitative research in psychology 3(2), 77–101 (2006)

5. Canadian Centre for Cyber security: Cyber threat and cyber threat actors (2020), https://cyber.gc.ca/en/guidance/cyber-threat-and-cyber-threat-actors

6. Etikan, I., Musa, S.A., Alkassim, R.S.: Comparison of convenience sampling and purposive sampling. American journal of theoretical and applied statistics 5(1), 1–4 (2016)

7. Gazzaniga, M.S., Ivry, R.B., Mangun, G.: Cognitive Neuroscience. The biology of the mind. Norton: New York (2006)

8. Gerber, N., Zimmermann, V., Henhapl, B., Emeröz, S., Volkamer, M.: Finally johnny can encrypt: But does this make him feel more secure? In: Proceedings of the 13th International Conference on Availability, Reliability and Security. pp. 1–10 (2018)

9. Gibbs, A.: Focus groups. Social research update 19(8), 1–8 (1997)

10. Groß, T., Coopamootoo, K., Al-Jabri, A.: Effect of cognitive depletion on password choice. In: The {LASER} Workshop: Learning from Authoritative Security Experiment Results ({LASER} 2016). pp. 55–66 (2016)

11. Gutzwiller, R., Dykstra, J., Payne, B.: Gaps and opportunities in situational awareness for cybersecurity. Digital Threats: Research and Practice 1(3), 1–6 (2020)

12. Habib, H., Pearman, S., Wang, J., Zou, Y., Acquisti, A., Cranor, L.F., Sadeh, N., Schaub, F.: "it's a scavenger hunt": Usability of websites' opt-out and data deletion choices. In: Proceedings of the 2020 CHI Conference on Human Factors in Computing Systems. pp. 1–12 (2020)

13. Happé, F.G., Mansour, H., Barrett, P., Brown, T., Abbott, P., Charlton, R.A.: Demographic and cognitive profile of individuals seeking a diagnosis of autism spectrum disorder in adulthood. Journal of Autism and Developmental Disorders 46(11), 3469–3480 (2016)

14. Henriquez, M.: The top 12 data breaches of 2019 (2019), https://www.securitymagazine.com/articles/91366-the-top-12-data-breaches-of-2019

15. Horcher, A.M., Tejay, G.P.: Building a better password: The role of cognitive load in information security training. In: 2009 IEEE International Conference on Intelligence and Security Informatics. pp. 113–118. IEEE (2009)

16. Iso 27000:2018(en). Standard, International Organization for Standardization, Geneva, CH (2018)

17. Johansson, S., Gulliksen, J., Gustavsson, C.: Disability digital divide: the use of the internet, smartphones, computers and tablets among people with disabilities in sweden. Universal Access in the Information Society 20(1), 105–120 (2021)

18. Karwowski, M., Kaufman, J.C.: The creative self: Effect of beliefs, self-efficacy, mindset, and identity. Academic Press (2017)

19. Kävrestad, J., Eriksson, F., Nohlberg, M.: Understanding passwords–a taxonomy of password creation strategies. Information & Computer Security (2019)

20. Kävrestad, J., Nohlberg, M.: Contextbased microtraining: A framework for information security training. In: International Symposium on Human Aspects of Information Security and Assurance. pp. 71–81. Springer (2020)

21. Lennartsson, M., Kävrestad, J., Nohlberg, M.: Exploring the meaning of “usable security”. In: International Symposium on Human Aspects of Information Security and Assurance. pp. 247–258. Springer (2020)

22. Lincoln, Y.S., Guba, E.G.: Naturalistic inquiry. Sage (1985)

23. Lundin, L., Mellgren, Z.: Psykiska funktionshinder: stöd och hjälp vid kognitiva funktionsnedsättningar. Studentlitteratur (2012)
24. McLean, R.: A hacker gained access to 100 million capital one credit card applications and accounts (2019), https://edition.cnn.com/2019/07/29/business/capital-one-data-breach/index.html

25. Oberauer, K., Süß, H.M., Schulze, R., Wilhelm, O., Wittmann, W.W.: Working memory capacity—facets of a cognitive ability construct. Personality and individual differences **29**(6), 1017–1045 (2000)

26. OECD: Hows Life in the Digital Age? (2019), https://www.oecd-ilibrary.org/content/publication/9789264311800-en

27. Olney, M.F., Kim, A.: Beyond adjustment: Integration of cognitive disability into identity. Disability & Society **16**(4), 563–583 (2001)

28. Palmer, L.: The relationship between stress, fatigue, and cognitive functioning. College Student Journal **47**(2), 312–325 (2013)

29. Pfleeger, C.P., Pfleeger, S.L., Margulies, J.: Security in computing. Prentice Hall, Upper Saddle River, NJ, fifth edition edn. (2015)

30. Rabiee, A., Samadi, S.A., Vasaghi-Gharamaleki, B., Hosseini, S., Seyedin, S., Keyhani, M., Mahmoodizadeh, A., Ranjbar Kermani, F.: The cognitive profile of people with high-functioning autism spectrum disorders. Behavioral Sciences **9**(2), 20 (2019)

31. Ramokapane, K.M., Mazeli, A.C., Rashid, A.: Skip, skip, skip, accept!!!: A study on the usability of smartphone manufacturer provided default features and user privacy. Proceedings on Privacy Enhancing Technologies **2019**(2), 209–227 (2019)

32. Ramsetty, A., Adams, C.: Impact of the digital divide in the age of covid-19. Journal of the American Medical Informatics Association **27**(7), 1147–1148 (2020)

33. Reeves, A., Delfabbro, P., Calic, D.: Encouraging employee engagement with cybersecurity: How to tackle cyber fatigue. SAGE Open **11**(1) (2021)

34. Safa, N.S., Von Solms, R.: An information security knowledge sharing model in organizations. Computers in Human Behavior **57**, 442–451 (2016)

35. Solove, D.J.: A taxonomy of privacy. U. Pa. L. Rev. **154**, 477 (2005)

36. Stern, T., Kumar, N.: Improving privacy settings control in online social networks with a wheel interface. Journal of the Association for Information Science and Technology **65**(3), 524–538 (2014)

37. United Nations: Sustainable development (2021), https://sdgs.un.org/

38. Verhagen, S.J., Daniëls, N.E., Bartels, S.L., Tans, S., Borkelmans, K.W., de Vugt, M.E., Delespaul, P.A.: Measuring within-day cognitive performance using the experience sampling method: A pilot study in a healthy population. PloS one **14**(12) (2019)

39. Vishwanath, A., Harrison, B., Ng, Y.J.: Suspicion, cognition, and automaticity model of phishing susceptibility. Communication Research **45**(8), 1146–1166 (2018)

40. W3C: Web content accessibility guidelines (wcag) 2.1 (2018), https://www.w3.org/TR/WCAG21

41. Whitten, A., Tygar, J.D.: Why johnny can't encrypt: A usability evaluation of pgp 5.0. In: USENIX Security Symposium. vol. 348, pp. 169–184 (1999)

42. World Health Organization: International statistical classification of diseases and related health problems 10th revision (icd-10) (2019)

43. Yan, J., El Ahmad, A.S.: Usability of captchas or usability issues in captcha design. In: Proceedings of the 4th symposium on Usable privacy and security. pp. 44–52 (2008)

44. Yıldırım, M., Mackie, I.: Encouraging users to improve password security and memorability. International Journal of Information Security **18**(6), 741–759 (2019)

45. Young, S.: Coping strategies used by adults with adhd. Personality and Individual Differences **38**(4), 809–816 (2005)