# Managing Access to Confidential Documents: A Case Study of an Email Security Tool
## 5 Results
### Expectations from the Recipient's Side  
After the participants shared their documents based on the given scenarios, they were asked whether they thought the emails they sent could be misused if they set a longer expiration date, such as a year. According to the scenarios, the employee information form needed to be accessed by HR during one week, the medical history form needed to be accessed by the doctor's office for three days, and the W-9 needed to be accessed by a CPA for 24 h.  
We found that the majority of our participants agreed that their encrypted emails could be misused by the same entities if they set a longer access time. The participants provided their reasons for the possibility that their emails could be misused, since there was no trust in the entities' attitudes that allowed them to misuse their information (12/19). For example, participant P17 commented, _\"I think there's always the possibility that the information could be misused, because of the fact that it's being sent to a human. You could also have someone who was in that position who was not an honest and trustworthy person, and because they would have access to my social security number, there is a possibility that they could misuse that.\"_  
Also, the participants were concerned about entities taking screenshots or copies of their information (3/19). For example, participant P8 commented, _\"I believe that if I set the expiration date for a year, it gives them enough time to copy the entire document, and they won't even need the document at all. They have a hard copy for themselves to manipulate.\"_  
Additionally, a few participants discussed the possibility that someone could hack the entities' email accounts and access their information if they set a long access time (3/19). For instance, participant P16 commented, _\"If you set it for like a year, that gives more time for people to, I guess, hack into either [their] Gmail or the other way is, they could exceed the information when they're not supposed to, and then use it against you.\"_  
On the other hand, we found that four participants did not think the email could be misused even if they set a longer expiration date. The prominent reason was that the email was secure due to encryption (e.g., the comment shown below), and the attachment features were enabled, such as persistent protection and watermarking.  
Participant P1 commented, _\"Because these emails are actually encrypted and not just sent out, it'd be a lot harder for them to be accessed by third-parties or anyone I didn't intend for it to be sent to. It'll be hard for them to access it. Each email had documentation; I made sure to secure that. So I feel like even after or during a year, it'd be hard for them to be viewed.\"_  
We also asked the participants how they would handle the situation where they accidentally sent an email to the wrong person and they realized it afterward. In this task, the participants demonstrated how they would change the security setting using one of the emails they sent.  
Half of our participants (N = 9) initially suggested changing the security settings. The expiration time on their email content was changed to one minute. In addition, many of them mentioned revoking email access after that.  
Participant P8 commented, _\"I would change the security setting... change the expiration date to a minute, so that immediately, the email, after a few minutes, gets deleted from the site... Along with these settings, I would first select this red route. It is revoked.\"_  
Nine other participants pointed out the Revoke Access button on the top of the email window, as shown in Figure 2b, which disables access to the email content and attachments. For example, participant P19 said, _\"Before Virtru... Google doesn't allow me to undo it after 30 s or something, but I can delete the email sent accidentally just by using revoke the message. That's a great advantage of using Virtru cause without that; the email once sent, we cannot do anything.\"_