Kimmo Tarkkanen
email: kimmo.tarkkanen@utu.fi

Ville Harkke
email: ville.harkke@abo.fi

Manifestations of Users' Privacy Concerns in a Formative Usability Test of Social Networking Site

Keywords: Privacy, Social Networking Site, Usability Testing

Social media and social network sites (SNS) need to preserve users' privacy, in order to achieve full acceptance and to succeed in the application markets. Thus, SNS developers need to understand and take into account users' privacy concerns as early as possible in the development. It is difficult, however, to foresee how the system fulfills users' privacy expectations until the system is in actual use. Different user-centered techniques applied during the development can offer insights for developers into users' privacy expectations and concerns. In this paper, we empirically show what kinds of privacy concerns users spontaneously brought forth in a formative usability test of a social networking site and how these were attributable to different features of the application and related coping mechanisms. The identified manifestations of privacy concerns help SNS designers and evaluators to pay attention early to privacy issues as a natural part of user centered development.

Introduction

Many people perform their daily activities through different social online applications, ubiquitous services and social networking (and network) sites (SNS). In order to be useful and usable, these systems require us to share and disclose personal information. For example the personal tracking, monitoring and surveillance capabilities of new technologies may bring many useful applications to everyday life, be it about personal sports or targeted ads based on personal online consuming behavior. Despite their interest in the benefits, people are more and more concerned about what other people can see and how their personal information is used in the future, and by whom. In the era of popularity of social media and SNSs, privacy issues have become one of our major daily concerns, which are seemingly complex to manage in practice. 1From the system developer point of view, it is noteworthy that the users' privacy concerns and trust towards the system affects its future acceptance and adaptation [START_REF] Iachello | End-user privacy in human-computer interaction[END_REF].

While some of the systems are only a channel for communication and some have become an "institutionalized" norm (such as Facebook), people as consumers and citizens do have the possibility to select which service, platform and SNS application they take into use. Systems that do not meet our expectations concerning security and privacy are most likely not the ones we want to use in the future and take into use in the first place. Thus, privacy becomes also one of the determinants for the success of social media applications in the consumer markets that businesses and developers need to be aware of and be prepared to design for.

However, it is often difficult to evaluate the effects of a certain technology on privacy [START_REF] Iachello | End-user privacy in human-computer interaction[END_REF]. One of the challenges for developers is to identify the evolving norms and values of users before they can take the application into use [START_REF] Vitak | The Future of Networked Privacy: Challenges and Opportunities[END_REF][START_REF] Dourish | Collective information practice: Exploring privacy and security as social and cultural phenomena[END_REF]. For example, the expanded use of Facebook has certainly shaped public opinion about privacy and created personal mechanisms for preserving it, which may have been difficult to foresee before launching such system. On the other hand, users' privacy concerns may be at their peak in the beginning of the use, but decrease over time [START_REF] Iachello | End-user privacy in human-computer interaction[END_REF]. One of the ongoing problems is that the privacy design toolbox for developers is rather technology-oriented and data protection centric. Developers may focus for instance on user authentication, user account settings and security of program code when designing privacy for their systems. Yet, with social networking sites and services, people have many strategies to preserve their privacy, other than the dedicated settings and features the system offers [START_REF] Wisniewski | Fighting for my space: Coping mechanisms for SNS boundary regulation[END_REF]. Thus, when designing these systems we need to understand people's personal privacy preferences i.e. how they construct and manage privacy in socio-technical interactions [START_REF] Lampinen | Privacy for a Networked World: bridging theory and design[END_REF]. The lack of a clear link between privacy and design currently hampers this work. For example, the workshop of the latest popular HCI conference welcomes research that seeks to translate academic privacy insights into a set of guidelines and practices useful to design practitioners [START_REF]Workshop at CHI 2016: Bridging the Gap between Privacy by Design and Privacy in Practice. Call for Participation[END_REF]. There is a need for privacy-centric design principles and effective methods for exploring people's privacy preferences [START_REF] Iachello | End-user privacy in human-computer interaction[END_REF][START_REF] Vitak | The Future of Networked Privacy: Challenges and Opportunities[END_REF], [START_REF] Lampinen | Privacy for a Networked World: bridging theory and design[END_REF], [START_REF] Boyle | The language of privacy: Learning from video media space analysis and design[END_REF].

During the software development process, the designers gather information about the target audience of the system and their specific needs and preferences. Usability and user experience evaluation methods are widely applied for these purposes. We believe that these common methods introduce a promising base for privacy inclusion in the design practice. A vast amount of privacy research in the field of HCI already shows a tight interconnection of privacy and usability concepts (e.g. [START_REF] Iachello | End-user privacy in human-computer interaction[END_REF], [START_REF] Boyle | The language of privacy: Learning from video media space analysis and design[END_REF]). Like usability, privacy is a holistic property and a pervasive feature of interactive systems that cannot be an afterthought in the design process [START_REF] Iachello | End-user privacy in human-computer interaction[END_REF], [START_REF] Dourish | Collective information practice: Exploring privacy and security as social and cultural phenomena[END_REF]. In consequence, addressing privacy and usability problems during the system development with similar methods is worth studying in detail. The question is: How do these privacy concerns manifest themselves in a usability test and what kind of privacy issues such a classical method can reveal. In this paper, we conduct an analysis of what kinds of privacy concerns users naturally and spontaneously bring forward in a usability test of a social networking prototype, which aims at sharing content around real life events. By manifestation of privacy concern, we mean users' verbal and non-verbal behavioral indicators during the system use that could determine opportunities for encountering loss of privacy in the future. Our perspective is on those users' privacy concerns at time of use that trigger potential coping mechanisms unless directly supported by the technology. The previous research has mostly studied the actual coping mechanisms after excessive use period (cf. [START_REF] Lampinen | We're in it together: interpersonal management of disclosure in social network services[END_REF][START_REF] Wisniewski | Give Social Network Users the Privacy They Want[END_REF]). Thus, originality of this research lays apart from scrutinizing usability testing as a method for revealing potential privacy issues, also in studying privacy concerns of firsttime users with a short-term user intervention during the system development phase. We list the different privacy manifestations observed in the test. This helps SNS developers and evaluators to pay attention to privacy in a more elaborate way during similar design phases and eventually design their SNS for users' desired levels of privacy.

Privacy Concerns in Designing Social Networking Sites

The boundaries of social online network sites are somewhat blurred. Most sites share the core feature of a public or semi-public user profile that others can traverse and peruse with different intentions such as contacting, friending or dating [START_REF] Gross | Information revelation and privacy in online social networks[END_REF][START_REF] Boyd | Social network sites: Definition, history, and scholarship[END_REF]. However, the user profile may not be in the essence of the SNS usage, but the feed of shared content, mutual activities and communication in the extended social network. Social media, a close concept to SNS, can be defined through seven functional blocks as identity, presence, relationships, reputation, groups, conversations and sharing [START_REF] Kietzmann | Social media? Get serious! Understanding the functional building blocks of social media[END_REF], or simply as being "all about sharing content with a community" [START_REF] Lampinen | We're in it together: interpersonal management of disclosure in social network services[END_REF].

A definition of privacy by Altman [START_REF] Altman | The Environment and Social Behavior -Privacy, Personal Space, Territory, Crowding[END_REF] states, that privacy is a process that paces and regulates our interactions with others. In social environments, people try to maintain an appropriate level of access they give of themselves to others. Altman's processual and dynamic view draws a sharp distinction between how much privacy users want and what they attain during the system use [START_REF] Boyle | The language of privacy: Learning from video media space analysis and design[END_REF], [START_REF] Palen | Unpacking privacy for a networked world[END_REF]. The fit between the desired and the attained level of privacy is not only sound, but also may enhance individual's social relationships and benefits of SNS [START_REF] Wisniewski | Give Social Network Users the Privacy They Want[END_REF].

Definitions of privacy concern vary from "a loss of control over their personal information" [START_REF] Tan | Impact of privacy concern in social networking web sites[END_REF] to ones that cover a broader range of human behaviors depending on the view on privacy. In Altman's view, privacy concerns can cover broadly any interpersonal action that serves regulation of one's social interactions [START_REF] Wisniewski | Give Social Network Users the Privacy They Want[END_REF]. For example, privacy concerns can be studied as individuals' concerns of suppressing their true identity (anonymity), losing control of unwanted information (intrusion) and control of distribution of personal information (autonomy), or being exposed to monitoring and tracking by others (surveillance) [START_REF] Metzger | Public opinion and policy initiatives for online privacy protection[END_REF]. Following Altman's view, privacy concerns have been decomposed into three basic elements [START_REF] Boyle | The language of privacy: Learning from video media space analysis and design[END_REF], [START_REF] Palen | Unpacking privacy for a networked world[END_REF]: 1) regulating social interactions, 2) giving access to and disclosing information about oneself and 3) managing own identity and self-presentation over time. Each can introduce a personal privacy risk when the boundaries of privacy are negotiated with the environment and in collaborative discourse with others (privacy as a discourse see e.g. [START_REF] Dourish | Collective information practice: Exploring privacy and security as social and cultural phenomena[END_REF]). The extent of the privacy risk can be determined by rationally evaluating our personal coping capabilities in this potentially difficult task or situation (privacy as an economic rationality, see e.g. [START_REF] Dourish | Collective information practice: Exploring privacy and security as social and cultural phenomena[END_REF]). In using SNS, usability of the system features and user interfaces will inevitably affect how people perceive their personal coping capabilities, i.e. determine their self-efficacy, and thus further affects how concerned they are about their privacy [START_REF] Yao | Predicting user concerns about online privacy[END_REF]. People who feel confident about their survival capabilities over a potential risk (e.g. they have some privacy control mechanisms) experience less anxiety towards the system. Enabling every user to achieve their desired level of privacy should be in interest of SNS developers as well [START_REF] Wisniewski | Give Social Network Users the Privacy They Want[END_REF].

Different user strategies and coping mechanisms exist to preserve interpersonal privacy boundaries in social networking sites [START_REF] Wisniewski | Fighting for my space: Coping mechanisms for SNS boundary regulation[END_REF], [START_REF] Lampinen | We're in it together: interpersonal management of disclosure in social network services[END_REF]. These strategies can be distinguished between mechanisms supported by the user interfaces of SNSs and "coping mechanisms which are an individual's response outside of these confines to mitigate potential boundary interpersonal violations." [START_REF] Wisniewski | Fighting for my space: Coping mechanisms for SNS boundary regulation[END_REF]. Coping mechanisms can be divided into mental and behavioral, preventive and corrective, and further into collaborative and individuals' actions [START_REF] Lampinen | We're in it together: interpersonal management of disclosure in social network services[END_REF]. Users apply corrective coping mechanisms after a privacy risk has realized and preventive mechanisms before. For example, individuals apply a corrective mechanism when they are untagging a photo whereas when they ask approval before tagging a photo from the persons involved they apply a preventive collaborative mechanism. Karr-Wisniewski et al. [START_REF] Karr-Wisniewski | A new social order: Mechanisms for social network site boundary regulation[END_REF] identified five types of boundaries that people regulate with different mechanisms, in order to achieve the desired privacy level in SNSs: network, territorial, disclosure, relationship and interactional boundaries 2 . For example, turning off the wall on Facebook is about controlling the interactional boundary, whereas removing someone's distracting comment from the personal wall is about controlling the territorial boundary [START_REF] Karr-Wisniewski | A new social order: Mechanisms for social network site boundary regulation[END_REF][START_REF] Wisniewski | Framing and Measuring Multi-dimensional Interpersonal Privacy Preferences of Social Networking Site Users[END_REF]. In practice, these mechanisms need controlling actions by users such as filtering, ignoring, and blocking connections, withdrawal from sharing content, aggression, compliance and compromise [START_REF] Wisniewski | Fighting for my space: Coping mechanisms for SNS boundary regulation[END_REF].

Because not all of these identified coping mechanisms are implemented in current SNSs, understanding the privacy mechanisms people use within SNSs can help in pinpointing areas where personal privacy management can be supported by improving user interface design [START_REF] Wisniewski | Fighting for my space: Coping mechanisms for SNS boundary regulation[END_REF]. For instance, SNSs could implement more sophisticated filtering functions for generating relationships, support collaborative negotiation for co-owned content (e.g. about photos where one is tagged) and facilitate reconciling conflicts and motivations behind different actions e.g. due to unfriending [START_REF] Wisniewski | Fighting for my space: Coping mechanisms for SNS boundary regulation[END_REF]. Moreover, photo tagging features of SNSs could be redesigned with customized permissions, untagging and negotiation features [START_REF] Besmer | Moving beyond untagging: photo privacy in a tagged world[END_REF] and online video media spaces could need for instance more fine-grained content control [START_REF] Boyle | The language of privacy: Learning from video media space analysis and design[END_REF].

In this paper, we are mainly interested in coping mechanisms that technology does not support, in accordance with the aim of the classical usability test: to identify different usability problems of the system that need fixing. Our approach is both evaluative and constructive. Evaluative approach on privacy examines the users' preferred and achieved levels of privacy, whereas the constructive approach offers design solutions and principles [START_REF] Wisniewski | Give Social Network Users the Privacy They Want[END_REF]. In our study, this meant that privacy concerns expressed by the users were traced back to the specific features and functions of the system so that practical design solutions could be suggested.

3

Research Method

Introducing the social networking site

We tested usability of a new social networking application developed by a global IT company. The idea of the application was to collect users' photos and videos taken in the same event to a single site. The situations where the application was deemed useful were family get-togethers, celebrations, large public concerts and sports events where every attendant could contribute to the shared content by taking and sharing photos and videos of that event. Depending on the privacy settings of the event in the application, the other application users could see the content. The disruptive innovation here was to replace photo sharing with USB sticks, provide a public or private space for photo sharing and allow each member to contribute and access to content.

We conducted one to one usability test sessions for 7 test participants in April, two weeks after the developer launched the beta version for public. The application was under continuous development and during the test only the main use case, creating an event and inviting friends, joining an event and publishing photos in it, was implemented. The application was downloadable free for all major mobile platforms as well as accessible free as a desktop version for computer use.

The application is used in practice as follows: A user creates a shared space for a certain event with the application, acts as the founder of the event and invites people to join the event. The event founder sets also other parameters, like the publicity, location, duration and the name of the event. The founder sends invitations by email or SMS as the current application version did not implement a list of friends attached to a user profile. Users could search events by the name or spot these in the location map as well as access published public ones. The users who had joined the event could download and 'like' photos and videos of the event. The feature that allowed commenting the content was under development during the time of the test, the developers planned integrating it with Facebook comments.

The application implemented characteristics of a social network site due to embedding a user profile, allowing connections with others through joined events, and aiming at sharing photos and videos with the connections. However, at the time of the study, the user profile feature was practically empty and contained only a profile picture, username, and a URL address for viewing events hosted and joined by the user (not accessible from mobile). Thus, a list of friends was not implemented in isolation from the events, and "a wall" feature attached to one's profile contained only events and was accessible only by following the given link with a browser. The application was closer to a social "networking" than a "network" site [START_REF] Boyd | Social network sites: Definition, history, and scholarship[END_REF], because one's articulated network was missing and the connections to others were more temporary and indirect. On the other hand, the application would appear even more different from SNSs, if we took the event and the shared content as the unit of analysis (e.g. as a crowdsourcing application to collect photos from the event). Of the building blocks of social media [START_REF] Kietzmann | Social media? Get serious! Understanding the functional building blocks of social media[END_REF], the application did not explicitly reveal the presence of other users although this is implicitly inherent within events that last a limited time (i.e. users could assume that attendees are present in the application and in the real life event). Nor did it support written conversations, which were to be implemented. The application, however, did embed characteristics of the rest of the building blocks. As it has been found that photo tagging in SNSs caused users to lose their control over information disclosure and identity [START_REF] Besmer | Moving beyond untagging: photo privacy in a tagged world[END_REF], it was important to identify such features that could be sources of users' privacy concerns and might prevent the desired level of privacy early in the design process.

Usability testing procedure

The usability test was the first usability test with real users for the application and it took place in laboratory premises. The test objectives were set in the two-hour discussions with the development manager. The test aimed at evaluating the usability of installation procedure (mobile app) and the usage flow of the main use case. The main use case was defined as creating an event and inviting friends, joining an event and publishing photos in it. Installing the application included registering and downloading the app from the particular app store into a mobile phone. The number of test participants, seven, was judged to be adequate for the purposes of this evaluation. In general, it is enough to find the majority of critical usability problems.

The usability test was incorporated into a real event marketed by the company. The event was the celebration of the 1 st of May and targeted at university student associations who could compete against each other of the price of "the best event". We used this real event as a reference scenario for usability test tasks. Usability test included 13 test tasks, which covered almost all application functions (create event, search events, my events -functions). Short versions of the tasks were as follows: 1) Install the application into your mobile phone 2) Create your own event 3) Invite your friends to your event 4) Add a photo to your event 5) Add a video 6) Search an event nearby you and view its photos 7) View photos of the X event 8) Select the best photo 9) Send the best photo to your friend 10) Join to the Y event 11) Add a photo to the Y event 12) Save a photo 13) Delete your own event.

All the seven test sessions were video and audio recorded and analyzed later based on the recordings. The test participants were all university students, three females and four males, 20-39 years old recruited randomly. The basic information about the participants was collected with pre-test questionnaire including: Age, gender, mobile phone information, trials and continuous usage of different SNSs, photo sharing practices in the SNSs and regarding some specific events, and earlier use experience of the tested application. Two of the test participants had already downloaded the application and tried it once.

The testing procedure was an informal think aloud where the test administrator had an active role, which means that we exceeded the classical "keep talking" style [START_REF] Boren | Thinking aloud: Reconciling theory and practice[END_REF] and took more interactive and relaxed communication style [START_REF] Hertzum | Scrutinising usability evaluation: does thinking aloud affect behaviour and mental workload?[END_REF]. This meant that the administrator not only handed the tasks, but also asked actively what participants are trying to do and what they think of particular way of operating the system. The communication with the participants was not limited to test tasks, but continued during the post-test questionnaire, which included, for example, the following open questions and the questions answered in Likert-scale: How fluent was adding photos to your event? How satisfied you are with the following features of the application? What was the best/worst in the application use? In what situation would you use the application in the future? Despite the active role of the test administrator any direct questions about privacy issues were not raised and those were not asked in the pre-and post-questionnaires. We emphasize that the test was of classical and standard nature where privacy concerns were not included in the objectives and targets of data collection. The case study presented in this paper exploits a retrospective data analysis, which, in contrast, had its target on privacy and its manifestations in a usability test. Data analysis was performed bottomup with the final test report, related documents, notes, test recordings and transcriptions, iteratively building understanding about different types of privacy concern manifestations.

Results

The idea and the purpose of the application got very warm reception among the test participants. For example, one participant told that: "Personally I have had need for this kind of service for a long time."3 (P1) The participants operated very fluently through the main use case, i.e. all the test tasks from installing the application to creating an event and sharing some content in it. The main use case was a logically flowing procedure and well understood by the users. No major usability problems were observed in the operation and, thus, the system usability was considered rather excellent in that regard. However, the observations indicated that participants were more concerned of application use before and after the actual event took place. Largely, these were concerns of personal privacy, intimacy and security that were attributable to certain features and functions of the application. Before the event, the participants were mainly concerned of administrative rights of the founder of the event. The participants did not easily perceive their rights and responsibilities before creating and sharing the event to others. After the event and as a member of the specific event, the participants were mainly concerned of what rights and possibilities they have in downloading and deleting, possibly embarrassing, photos shared in the event. Such privacy concerns and related conceptual design directions were introduced as the main results of the test for the developers and discussed next in detail.

First, some of the privacy concerns were manifested explicitly, because the participants could identify and express a privacy problem in detail. For example, the majority of the participants spontaneously remarked that the event founder has a possibility to change the name of the event after people had already joined it. Others considered renaming a compulsory feature that should not redesigned, while the rest pointed out its problems if the founders misused the feature and the application did not inform the attendees about the name change. Although the participants' opinions were polarized, they all identified and acknowledged the privacy risk attached with the feature. Renaming is possible also in other SNSs that allow creating groups and shared spaces (e.g. Facebook), which may be the reason for the sensitivity and awareness of the participants for this privacy concern. The studied SNS did not support users' need to regulate their territorial outward-facing boundaries, which means for example withdrawing from obscene content posted on user's wall 4 . As with other SNS, the participants needed to select a corrective coping mechanism with the risk (e.g. unjoin the event), because no other solutions were implemented or preventive coping mechanisms available.

Second, and in contrast to clear identification of the risks in advance, the participants were totally unaware of some of the privacy risks and consequences of features used. In particular, they had problems in understanding how the duration of the event affected on its visibility and accessibility (i.e. publicity). For example, one participant assumed that after the event reaches its end duration it will be not visible in the public map and accessible through the search functions of the application i.e. eventually it "becomes private" (P3). Instead of restricting public discovery, another participant interpreted that the duration only closes the possibility to upload more photos to the event. Privacy concerns then varied between disabling and blocking interactional boundaries (i.e. giving access to oneself) to regulating territorial inward-facing content (i.e. what appears in a "news feed"). Both assumptions about the functioning above seem to be justified, although wrong, interpretations about the of the feature: The duration only restricted new joining the event i.e. controlled network-discovery boundaries (i.e. access to network) and relationship boundaries, which regulate whom one lets be part of network. This example further shows how users can be unaware of or misinterpret privacy related consequences when they are not exactly sure about the meaning of a functionality. Moreover, such features may not be related to built-in "privacy settings" at all. Nevertheless, the participants seemed to naturally relate the use of these features of the SNS to privacy issues and made them part of their personal privacy management. The utmost problem of this type of concerns is that users may not identify and apply any coping mechanisms at all, as the privacy problem itself stays hidden in the first place. This kind of a situation leads users inevitably to corrective mechanisms after the risk has realized, although the effectiveness of the chosen mechanism may vary by case. Similar, unintended privacy violations were common in the context of P2P file sharing due to misunderstood logic and functions of the application [START_REF] Good | Usability and privacy: a study of Kazaa P2P file-sharing[END_REF]. For the developers, these types of privacy concerns indicate a need for clarifying the meaning of the feature in a way that decreases misunderstandings by the users and gives them all the potential to evaluate the threat to their privacy. In this case, the application could have implemented a simple text explaining the meaning of the event duration.

Third, a type of privacy manifestations became apparent when the participants had a clear expectation about how something should be working and a vision of to-be state of the system regarding the privacy issue. In this type of manifestation, they not only expressed and identified their potential privacy concern, but they were astonished about certain functions (i.e. they expect something else to happen) and/or had alternative (technical) solutions directly in their mind. For example, the participants raised a highly negative concern of someone uploading inappropriate photos to the service and, in the first place noted, about their inability to remove these photos. "If someone takes a photo of me vomiting and I cannot do anything for it without contacting the application developer, it is very sad. Ok, the same problem appears in other applications, also in Facebook […] but here I feel it is a bigger problem because this application has a different kind of character." (P6) According the participants, an inappropriate photo of oneselfor even a photo where ones "hair is not washed or set correctly" (P7)should be possible to delete. These privacy concerns relate to missing corrective mechanisms for regulating confidant-disclosure boundary, which occurs when someone publishes personal information about someone else. Deleting the uploaded content was possible only for the founder of the event. The event represents its founder's "wall", where the system supports both territorial outward-facing and confident-disclosure controls only for the founder. Because one's own photos were not removable either, this privacy concern is also about controlling the boundary of self-disclosure, which considers what personal information one discloses in the network.

Another example about third type of privacy manifestation became during inviting people to the event. In the role of the founder of the event, the participants made an instant assumption that if they create a private event, they will know who have been invited in the event and that they can moderate invitations i.e. control who will get the invitation. The assumption was however false, because the invitations were sent with a code in an email or in a SMS message that could be shared further by the receivers. The situation weakens users' trust towards the applications features and their own capabilities to preserve privacy of the photos and overall intimacy of the event: "If there is an option to create either a public or a private event, I suppose I should be able to monitor and moderate that private event… it is quite unpleasant situation if anybody can invite any friend, and at that stage, my trust is not very high that my shared photos will remain private… that can be a serious problem to someone." (P7). Thus, regulating one's relationship boundaries within the event in a preventive way was poorly supported. On the other hand, the participants found that the event founder could select and remove specific individuals from the event. However, the participants did not discuss this corrective mechanism as a solution to the initial controlling problem probably because the damage had been already done: The mechanism came too late (i.e. corrective) and was not effective for the initial problem that needed mechanisms that are more preventive. Now the participants implicitly employed a collaborative mechanism not to share the code with third parties.

Fourth, a type of privacy manifestation was related to use situations where the participants felt unconfident and uncertain about the actions they had taken and their effects within the application (e.g. what just happened?) or in some other way expressed distrust towards the system. For example, the application did not give any feedback whether the invitation message was delivered or not: "I suppose the message was sent" (P6), "You get a feeling that you should send the message again" (P5). The subsequent privacy related problem the participants experienced was that the founder did not know how many and to whom invitations were already sent, thus jeopardizing again their control of relationship-connection boundaries. The problems related to the technical infrastructure, in this case mostly the slow speed of the mobile internet connection, introduced more these type of privacy concerns among participants. A common denominator is that these took place by accident. For example, five out of seven participants used their own smart phones in the test, which meant that their phones were of different quality and speed in internet connection during the test. Quite many suffered from poor quality of the touch screen (P7), slowness of the phone and the internet connection (P5, P6, P7), or slowness of the service response on the server side (P5), and dismissed point of touch (P1). These became privacy concerns, because participants were uncertain if and when something was touched, downloaded and uploaded and so forth: "I am always about to press twice because this does not show the download symbol…[waiting]…now it shows that it is going somewhere." (P6). For example, one participant meant to scroll the screen by wiping, but notified few minutes later that he had accidentally joined an event (i.e. pressed the join-button instead wiping). This raised a user requirement for the application to confirm whether "you really want to join?"(P5). With the dialog, users could better control their identity and self-presentation (see [START_REF] Boyle | The language of privacy: Learning from video media space analysis and design[END_REF]). Adding photos and videos to the event introduced another accidental privacy threat that was due to inconsistent interface design and slowness, which similarly made participants feel unsure whether some action were already processing. Adding a photo from the photo gallery did not have any confirmation dialog (as when using the camera application) and users needed to pick the photo without viewing it in a full screen. That increased the risk of uploading a wrong photo: "Pretty odd that it did not ask if I want to share this photo but it directly shared it. What if I had touched the wrong photo?" (P3)

Another participant (P5) uploaded two times the same video, because of the missing confirmation dialog and the slow internet connection, which prevented him noticing the ongoing video uploading. The fourth type of privacy manifestations tended to end up in users' distrust or in inventing preventive technical mechanisms. Confirmation dialogs for both photo uploading and joining the event, as well as system status feedback introduce simple preventive solutions for regulating self-disclosure when the corrective ones were not supported (e.g. deleting own photos).

Conclusions

Usability testing as a method for the evaluation of SNS prototypes seems to invoke spontaneous privacy concerns among test participants. The behavioral patterns of how privacy concerns emerged in the formative usability test of the application were of four distinct types (Table 1). Users either expect a certain system behavior, identify a privacy risk directly, feel unconfident about system behavior, or are unaware and assume potential privacy risks to be present. The types are not exclusive, but rather related and represent a continuum from users being ignorant or slightly worried to expressions that involve more detailed risk identification and suggestions for improvement. For example, when people have strong expectations about the desired level of privacy regarding some functionality and suggest some improvement, they presumably also can identify the risk in detail. Based on the case findings, we emphasize that users do not necessarily express any explicit concern. They can be unaware of the meaning and functioning of some specific feature, which eventually will affect their achieved and experienced level of privacy. Thus, a privacy risk itself may stay hidden during use and require interpretation by the evaluators, in order to become exposed and eliminated by redesignas is the common case with usability problems analysis in general. This work is complicated by the wide range of system features that have an effect on privacy, but that are not part of official privacy settings at all. Most likely, these "hidden" features are in the majority and lead to users' false assumptions or stay unrecognized during the first-time use. For example, "often participants did not know that private information was being shared at all and blamed the site"5 and did not exploit interface controls available for information disclosure. Respectively, users may explicitly express a privacy concern related to some feature when it actually does not have an effect on their privacy. However, there are no false positives when experiencing something: The desired level of privacy is based on personal experiences and satisfaction, and it is important to collect these experiences and fix the misunderstandings caused by the design. The procedure of the usability testing applied in the case study was very classical in nature. The industry and practitioners employ widely this kind of formative usability testing for the systems and prototypes under development. The interactive and relaxed think-aloud protocol applied in the study is the most used protocol in usability testing [START_REF] Boren | Thinking aloud: Reconciling theory and practice[END_REF]. The chosen think-aloud protocol affects very little on the number and type of usability problems found [START_REF] Bruun | An Empirical Study of the Effects of Three Think-Aloud Protocols on Identification of Usability Problems[END_REF]. Therefore, we must emphasize that, in this setting, the test participants brought up the privacy issues naturally and spontaneously in discussion about system features and usability. This natural approach for privacy exploration, the lack of explicit privacy questions and exploring concerns of first-time users is different from research settings found in literature. For example, Sadeh et al. [START_REF] Sadeh | Understanding and capturing people's privacy policies in a mobile social networking application[END_REF] deliberately designed their study for understanding people's attitudes and behaviors towards privacy when they interact with an application. That kind of predefined and experimental approach to study privacy would naturally be the most beneficial in improving the match between the preferred and implemented levels of privacy during the system development. On the other hand, this is not always possible and a need arises to observe privacy related concerns and behavior as a natural part of user-centered methods, in which this paper has contributed. Spontaneity of privacy concerns drives us to note that usability is a privacy issue, equally as it has shown to be a security issue [START_REF] Whitten | Why Johnny Can't Encrypt: A Usability Evaluation of PGP 5.0[END_REF]. Users can desire some level of privacy only to the extent they are conscious of such state. Achieving a certain level of privacy depends on the usage skills of the user as well as on what the system offers. In that regard, the users' both privacy states, desired and attained, are phenomena that traditional usability testing can help to explore. The coping mechanisms presented by [START_REF] Lampinen | We're in it together: interpersonal management of disclosure in social network services[END_REF], and [START_REF] Karr-Wisniewski | A new social order: Mechanisms for social network site boundary regulation[END_REF][START_REF] Wisniewski | Framing and Measuring Multi-dimensional Interpersonal Privacy Preferences of Social Networking Site Users[END_REF] help us in understanding the nature and causes of the issues unearthed in testing as well as in making more adequate suggestions for system redesign.

In our case, we could especially observe situations where the users experienced too low privacy levels [START_REF] Wisniewski | Give Social Network Users the Privacy They Want[END_REF]. This is because usability testing is a problem-centric technique that does not strive for positive findings i.e. it is not targeted at identifying situations where the system exceeds all the expectations of the users. Moreover, the users' concerns and coping mechanisms in the test were not real behavioral adaptations in the long term, but their intentions and conceptions due to the first time and short-term use situation. Originality of this research lays, apart from scrutinizing usability testing as a method for revealing potential privacy issues, also in studying privacy concerns of firsttime users with a short-term user intervention during the system development phase. Users' intuitive and instant opinions about system privacy have definitely practical value in systems development, but may also offer analytical insights into how privacy concerns change over time; what kind of system features are involved in these considerations; and how SNSs can provide new controls and support mechanisms in the future. These are also interesting new research areas.

The types of privacy concern manifestations presented here are to help design practitioners pay attention to privacy as a natural part of practicing user-centered design methods. The found types do not represent a complete set of all possible user behaviors, nor are all technological and interpersonal coping mechanisms found in the literature present and applicable in the context of this research (cf. [START_REF] Karr-Wisniewski | A new social order: Mechanisms for social network site boundary regulation[END_REF][START_REF] Wisniewski | Framing and Measuring Multi-dimensional Interpersonal Privacy Preferences of Social Networking Site Users[END_REF]). Our analysis leans on one usability test only. The studied application was very simple system compared to features and purposes of the most popular SNSs. Built around real-life events, without a list of friends to traverse or interpersonal relations as its primary focus, the application could only involve few mechanisms for regulating personal privacy. The method used here could be used to discover different privacy coping mechanisms applied within different kinds of more complex SNSs in the future.

Table 1 .

 1 Types of manifestations of users' privacy concerns during a formative usability test

	Types of privacy	How manifests in a	Example in the case	Unsupported mech-
	manifestations	usability test?	study	anisms 6
	Users expect a cer-tain system behavior	Users require correc-tive and preventive	Removing own and oth-ers' photos of oneself;	Confidant-disclosure; Relationship-connection
		functions	disseminating invitations
			to strangers
	Users identify a pri-	Users point out how a	Obscene renaming of the	Territorial outward-fac-
	vacy risk directly	feature can be misused	event by the founder	ing
	Users feel unconfi-	Users wish for preven-	Confirmation dialogs for	Relationship-connec-
	dent and express	tive functions, more	joining the event and up-	tion; Self-disclosure
	distrust	control and con-	loading content; tech-
		sistency of features	nical infrastructure prob-
			lems
	Users are unaware	Users misunderstand a	Setting the duration of	(Experienced by the us-
	of risks or assume	meaning of a feature	the event	ers:) Territorial inward-
	potential			facing; Interactional dis-
				abling and blocking

For example, numerous web pages exist to instruct SNS users for managing their privacy.

We refer to these mechanisms by Karr-Wisniewski et al. (2011)[START_REF] Karr-Wisniewski | A new social order: Mechanisms for social network site boundary regulation[END_REF] and[START_REF] Wisniewski | Framing and Measuring Multi-dimensional Interpersonal Privacy Preferences of Social Networking Site Users[END_REF] [START_REF] Wisniewski | Framing and Measuring Multi-dimensional Interpersonal Privacy Preferences of Social Networking Site Users[END_REF] throughout the results section and identify which mechanisms emerge in a usability test.

Participants' comments are translated from the original to English language. P1 refers to test participant 1.

Privacy boundaries and coping mechanisms are discussed based on Karr-Wisniewski et al. (2011) [18] and Wisniewski et al. (2016) [19].

[START_REF] Karr-Wisniewski | A new social order: Mechanisms for social network site boundary regulation[END_REF] p.5

Coping mechanisms that the studied SNS did not support (see[START_REF] Wisniewski | Framing and Measuring Multi-dimensional Interpersonal Privacy Preferences of Social Networking Site Users[END_REF]).


Tharntip Tawnie Chutikulrungsee
email: tchutikulrungsee@csu.edu.au

Oliver Kisalay Burmeister

Yeslam Al-Saggaf
email: yalsaggaf@csu.edu.au

Maumita Bhattacharya
email: mbhattachar-ya@csu.edu.au

Denial of Choice: Group Level Disclosure of Private Information

Keywords: Online social networks information privacy, users' privacy, disclosure 1

While online social networks (OSNs) allow users to selectively share content as well as limit access to information within users' own virtual spaces, unfortunately there is little or no control on other-generated content. The full study explores an interdependent privacy regarding other-generated disclosures on OSNs from insiders' perspectives (the 'discloser' and the 'disclosed'), based upon their lived experiences. An online survey was used to recruit suitable participants who meet the purposive sampling criteria. This paper presents some preliminary findings from a current study, based on an online survey. The online survey result reveals a likelihood of activities associated with othergenerated disclosure. This study makes a contribution to the scant literature on OSN interdependent privacy as well as draws attention to tackle these privacy issues in order to discover effective detection mechanisms towards practical solutions in the future.

Introduction

Online privacy is not only a global problem becoming difficult to ignore but also one of the most significant debates in law and moral philosophy, particularly in an era of ubiquitous computing and online social networks (OSNs). One of major privacy issues on OSNs is information disclosures by either users themselves or others during interaction or activities, especially tagging and re-sharing. While managing information we share ourselves is difficult, how to manage information that others share about us is more complicated and challenging. Of particular concern is that there is little or no control on other-generated disclosures, particularly outside users' profiles. For instance, if a user posts a comment in a friend's space, the friend cannot specify which users can view the comment. In another case, when a user uploads a photo and tags friends who appear in the photo, the tagged friends cannot restrict who can see this photo.

Other-generated disclosures lead to privacy issues such as privacy breaches, privacy invasions, privacy violation, privacy infringement, privacy threats, or privacy risks despite existing lengthy privacy policies as well as fine-grained privacy settings. In advanced societies, media have repetitively reported other-generated disclosures on news stories, court cases, and allegations. Some cases of other-generated disclosures can be claimed for legal protection whereas other cases are still under a shadow of the law, which varies differently among countries. A lack of sufficient privacy control and absolute legal protection highlight a need to better understand a privacy interdependence in OSNs and to effectively manage this privacy at a group level.

Although there is considerable research on OSN privacy [START_REF] Fodor | Do privacy concerns matter for Millennials? Results from an empirical analysis of Location-Based Services adoption in Germany[END_REF][START_REF] Patsakis | Distributing privacy policies over multimedia content across multiple online social networks[END_REF][START_REF] Al-Saggaf | Self-disclosure on Facebook among female users and its relationship to feelings of loneliness[END_REF][START_REF] Zlatolas | Privacy antecedents for SNS selfdisclosure: The case of Facebook[END_REF][START_REF] Taddicken | The "Privacy Paradox" in the Social Web: The Impact of Privacy Concerns, Individual Characteristics, and the Perceived Social Relevance on Different Forms of Self-Disclosure[END_REF][START_REF] Heatherly | Preventing Private Information Inference Attacks on Social Networks[END_REF], the majority tend to view privacy as independent, mostly focus on self-disclosures [START_REF] Al-Saggaf | Self-disclosure on Facebook among female users and its relationship to feelings of loneliness[END_REF][START_REF] Zlatolas | Privacy antecedents for SNS selfdisclosure: The case of Facebook[END_REF], [START_REF] Kwak | SNS flow, SNS self-disclosure and post hoc interpersonal relations change: Focused on Korean Facebook user[END_REF][START_REF] Utz | The function of self-disclosure on social network sites: Not only intimate, but also positive and entertaining self-disclosures increase the feeling of connection[END_REF][START_REF] Chang | Self-construal and Facebook activities: Exploring differences in social interaction orientation[END_REF]. So far only a few studies has highlighted a concept of privacy interdependence on OSNs [START_REF] Biczók | Interdependent Privacy: Let Me Share Your Data[END_REF][START_REF] Jin | Mutual-friend based attacks in social network systems[END_REF][START_REF] Chen | Information Privacy Concern About Peer Disclosure in Online Social Networks[END_REF]. Nonetheless, the interdependent privacy regarding other-generated disclosures has yet been unexplored, particularly within the scope of this present study that is based on both insiders' viewpoints and lived experiences. In addition to an attempt to fill the gap in existing literature, this study aims to provide an in-depth understanding of these phenomena in multi-dimensional aspects together with interdependent privacy. This present study is valuable and makes contribution to OSN communities, service providers, organisations, and users. The OSN service providers can gain benefits from this study in terms of technical or operational designs, collaborative privacy management and control among users, as well as privacy policies. In addition, business, organisations, and communities would gain insights into users' privacy concern, influences of other-generated disclosures, and awareness of interdependent privacy to apply those insights in terms of marketing campaign as well as preserving customers' privacy. This study also increases users' awareness and suggests strategies to mitigate risks of these phenomena.

This article presents preliminary findings from a current study on other-generated disclosures and interdependent privacy on Facebook. The next phase in the work, not described in this article, is to gain deeper understanding of these phenomena through a qualitative study, based upon users' lived experiences, from both engaging partiesthe 'discloser' and the 'disclosed'. To the best of our knowledge, this is the first study of its kind that explores an interdependent privacy on OSNs in multidimensional aspects ranging from motivations, perceptions, types of disclosed contents, actions as well as effects on both online and offline relationships.

The remainder of the paper is organised as follows: Section 2 presents an overview of some of the key concepts associated with privacy and disclosures on OSNs, along with related literature. Section 3 presents the methodology and Section 4 describes the findings, limitations and future directions of the study. Finally, conclusions are drawn in Section 5.

Background and Literature

Boyd and Ellison [START_REF] Boyd | Social Network Sites: Definition, History, and Scholarship[END_REF] initially defined the term "social network sites" as web-based services that allow users to 1) create a public or semi-public profile, 2) articu-late the list of connected users, 3) view and traverse lists of connection within the system. Nonetheless, a variety of terms are used interchangeably in public such as social networking sites, online social networks (OSNs), social media, and social webs. However, Boyd and Ellison [START_REF] Boyd | Social Network Sites: Definition, History, and Scholarship[END_REF] argued that the term "social networking sites" is improper for OSNs' emphasis and scope.

OSNs like Facebook, Google+, Twitter, and Instagram have attracted billions of users worldwide and become increasingly embedded in daily life activities, especially in the evolution of smartphones. So far, Facebook is the largest and the most popular SNSs of 1.04 billion daily active users worldwide whereas 934 million mobile daily active users on average for December 2015, where a majority of our daily active users (83.6%) are outside the US and Canada [39].

An upsurge in OSN users and its popularity is owing to OSN distinction in multifunctional all-in-one platforms offering users with abilities to generate, publish, comment, share, or distribute rich content as well as interact to a large audiences worldwide with free-of-charge. Accordingly, OSNs have become a large resource of free information that can be easily accessed, leaped, crawled, inferred, or misused at any time. This results in crafting a big hole in privacy and security.

Online privacy is a challenging issue of great interest across communities including OSN service providers, users, and scholars. Privacy has been dealt with in many contexts, including how to technically achieve it [START_REF] Burmeister | Enhancing client welfare through better communication of private mental health data between rural service providers[END_REF], breaches of information privacy [START_REF] Bernoth | Information Management in Aged Care: Cases of Confidentiality and Elder Abuse[END_REF], how users value privacy in online contexts [START_REF] Burmeister | What Seniors Value About Online Community[END_REF][START_REF] Burmeister | Websites for seniors : Cognitive accessibility[END_REF], and how to define professional responses that cater to all stakeholders, including to their respective privacy requirements [START_REF] Burmeister | Applying the ACS code of ethics[END_REF][START_REF] Burmeister | Applying the new software engineering code of ethics to usability engineering: A study of 4 cases[END_REF][START_REF] Bowern | ICT Integrity: Bringing the ACS Code of Ethics up to date[END_REF][START_REF] Burmeister | Achieving the goal of a global computing code of ethics through an international-localisation hybrid[END_REF]. To date, privacy on OSNs has been studied extensively not only from technical aspects [START_REF] Heatherly | Preventing Private Information Inference Attacks on Social Networks[END_REF], [START_REF] Jin | Mutual-friend based attacks in social network systems[END_REF], [START_REF] Conti | FakeBook: Detecting Fake Profiles in On-Line Social Networks[END_REF][START_REF] Ahmadinejad | Unintended disclosure of information: Inference attacks by third-party extensions to Social Network Systems[END_REF][START_REF] Squicciarini | Identifying hidden social circles for advanced privacy configuration[END_REF][START_REF] Squicciarini | CoPE: Enabling collaborative privacy management in online social networks[END_REF] such as privacy-by-design, privacy management, and privacy control, but also from social aspects [START_REF] Al-Saggaf | Self-disclosure on Facebook among female users and its relationship to feelings of loneliness[END_REF], [START_REF] Taddicken | The "Privacy Paradox" in the Social Web: The Impact of Privacy Concerns, Individual Characteristics, and the Perceived Social Relevance on Different Forms of Self-Disclosure[END_REF], [START_REF] Chen | Information Privacy Concern About Peer Disclosure in Online Social Networks[END_REF], [START_REF] Acquisti | Privacy and human behavior in the age of information[END_REF] such as users' behaviors, privacy concerns, and privacy attitudes. Several studies also point out a flaw in existing privacy policies as well as privacy settings [START_REF] Liu | Analyzing facebook privacy settings: user expectations vs. reality[END_REF][START_REF] Madejski | The failure of online social network privacy settings[END_REF][START_REF] Masoumzadeh | Privacy settings in social networking systems: what you cannot control[END_REF][START_REF] Netter | Privacy Settings in Online Social Networks--Preferences, Perception, and Reality[END_REF][START_REF] Anthonysamy | Do the Privacy Policies Reflect the Privacy Controls on Social Networks?[END_REF]. Despite restrictive privacy settings, privacy conflicts can still arise when there is a difference in privacy practices or privacy management, especially in interconnected and dependent environments like OSNs.

Furthermore, OSNs have continuously updated privacy policies, often changed privacy settings, consistently developed and implemented new features, as well as accepted third-party applications. These on-going changes lead to other privacyrelated issues and increase in privacy concerns. Alternatively, many works have denoted users' privacy concern [START_REF] Taddicken | The "Privacy Paradox" in the Social Web: The Impact of Privacy Concerns, Individual Characteristics, and the Perceived Social Relevance on Different Forms of Self-Disclosure[END_REF], [START_REF] Chen | Information Privacy Concern About Peer Disclosure in Online Social Networks[END_REF], [START_REF] Baek | My privacy is okay, but theirs is endangered: Why comparative optimism matters in online privacy concerns[END_REF], [START_REF] Staddon | Are privacy concerns a turn-off?: engagement and privacy in social networks[END_REF] and discussed privacy-related issues [START_REF] Squicciarini | CoPE: Enabling collaborative privacy management in online social networks[END_REF], [START_REF] Parra-Arnau | Privacy-Preserving Enhanced Collaborative Tagging[END_REF][START_REF] Lang | Just untag it: Exploring the management of undesirable Facebook photos[END_REF][START_REF] Hu | Detecting and resolving privacy conflicts for collaborative data sharing in online social networks[END_REF]. New privacy challenges are inevitable with the growth of everchanging OSNs, which privacy is interdependent.

Privacy Interdependence

In such interconnected environments like OSNs, privacy is a complicated matter than just an individual importance. Privacy of individual users is bounded to activities by others and their behaviors, rather than just each user. This privacy interdependence affects not only users but also non-users. The term "interdependent privacy" was first coined in the study of Facebook gaming permission by Bicz´ok and Chia [START_REF] Biczók | Interdependent Privacy: Let Me Share Your Data[END_REF]. Other contexts of interdependent privacy are associated with as third-party applications, resharing content, tagging, or joining groups.

Interdependent privacy is not relatively new and has been inherent in OSNs. However, extensive studies have considered OSN privacy as independent, concerning at an individual level [START_REF] Al-Saggaf | Self-disclosure on Facebook among female users and its relationship to feelings of loneliness[END_REF], [START_REF] Zlatolas | Privacy antecedents for SNS selfdisclosure: The case of Facebook[END_REF], [START_REF] Kwak | SNS flow, SNS self-disclosure and post hoc interpersonal relations change: Focused on Korean Facebook user[END_REF][START_REF] Utz | The function of self-disclosure on social network sites: Not only intimate, but also positive and entertaining self-disclosures increase the feeling of connection[END_REF][START_REF] Chang | Self-construal and Facebook activities: Exploring differences in social interaction orientation[END_REF] whereas interdependent privacy is required more attention. To date, relatively limited research on interdependent privacy exists [START_REF] Heatherly | Preventing Private Information Inference Attacks on Social Networks[END_REF], [START_REF] Biczók | Interdependent Privacy: Let Me Share Your Data[END_REF], [START_REF] Wisniewski | Facebook apps and tagging: The trade-off between personal privacy and engaging with friends[END_REF], particularly with respect to third-party applications. For example, Wang et al. [START_REF] Wang | Third-party apps on Facebook: privacy and the illusion of control[END_REF] pointed out that installing a third-party application on Facebook like calendar would violate user's global privacy settings and friends' privacy. In similar line, Ahmadinejad and Fong [START_REF] Ahmadinejad | Unintended disclosure of information: Inference attacks by third-party extensions to Social Network Systems[END_REF] revealed that third-party applications can jeopardize a large number of users through Application Programming Interface (API) attacks with high success rate. The attacks can reveal information on users' profiles as well as infer other information. Likewise, Heatherly et al. [START_REF] Heatherly | Preventing Private Information Inference Attacks on Social Networks[END_REF] reported that both political and religious affiliation could be inferred from others' information available on OSNs, even when users are unwilling to disclose such information. Moreover, Ryu et al. [START_REF] Ryu | curso: protect yourself from curse of attribute inference: a social network privacy-analyzer[END_REF] demonstrated that analysing link structures can extract the hidden attributes and reveal sensitive information. They also proposed three algorithms to detect privacy breaches from attribute inference, based on friendship links and group memberships.

Our work is different from those mentioned above as we has focused on another context of interdependent privacy. Despite users' purposes and intentions, users may disclose not only their own information but also information about others through their online activities. Disclosures of information pose both information privacy and personal privacy at risks. While self-disclosures can be inhibited, disclosing information by others is beyond individual control.

2.2

Other-generated Disclosure Other-generated disclosures, which reveal about others without consent, are not uncommon on OSN wall posts, comments, videos, links, and photos. These phenomena can be seen in forms of sharing on-behalf, sharing co-owned content, sharing multiple-owned content, re-sharing content, distributing, or tagging. The most trending other-generated disclosures deal with photo sharing on OSNs; for example, parents post or share photos of their children.

Other-generated disclosures can occur not only in one-hop relationships or multihop relationships, but also within same or different platforms. 'Disclosers' is users who disclose content such as friends, friend-of-friends, friend-of-friend-of-friends, or strangers whereas 'Disclosed' can be users or non-users. Some cases of other-generated disclosure can be claimed for legal protection or compensation under privacy laws, depending on counties. For instance, Mr Madill downloaded 83 pictures of a nine-year-old girl from his friend's Facebook and then re-posted those pictures to a Russian child porn web site [START_REF]He took the innocence and made it disgusting[END_REF].

Unfortunately, not all privacy-related issues respecting other-generated disclosures can be legally protected. Some cases are still beyond current scopes of legislation or in shadow of existing regulations such as "digital kidnapping".

Digital kidnapping is a pervasive privacy issue in the era of OSNs as well as a recent trending phenomenon, widely reported since 2014. As of 4 August 2015, news reported that hashtags involving digital kidnapping (#babyrp, #babyrpl, #adoptionrp, or #orphanrp) had yielded 57,000 results on Instagram [START_REF] Chang | Baby role-play, or virtual kidnapping, is the most disturbing Instagram hashtag ever[END_REF]. This new phenomenon of "baby role play" [START_REF]Beware: Digital kidnappers of children are lurking[END_REF] occurs when someone steals a child's photo available on OSNs, then posts that stolen photo on other websites for role-playing. In general, female digital kidnappers use the stolen photo to show others as if the child belongs to them. Nevertheless, some cases of digital kidnapping are much disturbing in communities when digital kidnappers use the stolen photos in sexual and abusive role-playing. Digital kidnapping is not a crime although it can lead to kidnapping in the real world where the worst case scenarios may cause harm to a child's life.

So far, research examining other-generated disclosures has been under-represented in the OSN privacy literature. Yet, no work has addressed an interdependent privacy with regards to other-generated disclosures in the similar context of this present study. The scope of this study is considered within current privacy management and existing tools at the stage of this study.

Not only can other-generated disclosures cause privacy turbulence, but it also affects impression formation as well as desired self-image. Face threats refer to "an incident or behavior that could create an impression inconsistent with one's desired self-image"1 , making people vulnerable and leading to awkwardness, embarrassment, or relationship breakdown. Recently, relatively few studies have focused on facethreatening from other-generated disclosures [START_REF] Wohn | Reactions to other-generated face threats on Facebook and their relational consequences[END_REF], [START_REF] Litt | Awkward encounters of an "other" kind: collective self-presentation and face threat on facebook[END_REF]. While Litt et al. [START_REF] Litt | Awkward encounters of an "other" kind: collective self-presentation and face threat on facebook[END_REF] focused on users' experiences and feelings towards face threats, Wohn and Spottwoods [START_REF] Wohn | Reactions to other-generated face threats on Facebook and their relational consequences[END_REF] were interested in users' strategies in response to face threats. In this case, Litt et al. [START_REF] Litt | Awkward encounters of an "other" kind: collective self-presentation and face threat on facebook[END_REF] explored what Facebook users considered be other-generated face threats as well as how Facebook and Internet skills impacts these threats. Based on the survey of 150 Facebook users [START_REF] Litt | Awkward encounters of an "other" kind: collective self-presentation and face threat on facebook[END_REF], the result reveals that face threats result from users' neglecting and misunderstanding a target's audience or self-presentation. Furthermore, Wohn and Spottwoods [START_REF] Wohn | Reactions to other-generated face threats on Facebook and their relational consequences[END_REF] presented four reactive strategies that users used in response to other-generated face threats on Facebook even though some of those strategies can deteriorate relationship between victims and offenders. Along similar line, Litt and Hargittai [START_REF] Litt | A bumpy ride on the information superhighway: Exploring turbulence online[END_REF] report that 33.3% of students (online survey sample: N=547) experienced turbulence online whereas those with higher Internet skills are less likely to experience it. In comparison with our study, the similarity lie in an emphasis on other-generated disclosures, a platform of interest (Facebook), and a method (an online survey). However, our study is different in terms of subjects of interest (adult users), a method (using semi-structured in-depth interviews in addition to an online survey), and objectives. Our study investigates both engaging parties ('discloser' and 'disclosed') in diverse aspects such as motivations, perceptions, contents, strategies, as well as online and offline impacts, as opposed to only strategies.

Methodology

This qualitative study is underpinned upon the interpretivist philosophy and designed using a phenomenology methodology. The purpose of this phenomenological research is to explore other-generated disclosures from users' lived experiences as well as to better understand the essence of the phenomena. To gain insiders' perspectives of the phenomena, the purposive sampling is most appropriate in recruiting suitable participants as per sampling criteria through an online survey. This present study consists of two phases as shown in Fig. 1. Phase I used an online survey to recruit at least 300 qualified respondents according to the purposive sampling criteria as well as to categorize suitable respondents into two groups -the 'discloser' and the 'disclosed'. The preliminary online survey was launched on Sur-veyMonkey.com in December 2015. The invitation for an online preliminary survey was advertised on several OSNs including Facebook, LinkedIn, and Twitter. This online survey consists 31 questions, which take approximately 10 minutes to complete. By taking this online survey, there is no obligation for respondents to further participate in the next phase of this study. At this stage, our study is in Phase I.

Phase II uses a semi-structured, in-depth interview to extensively examine multidimensional aspects of other-generated disclosures ranging from motivations, perceptions, types of disclosed contents, actions, and impacts on to both online and offline relationships. The chief investigator will send an interviewinvitation, a consent form, and information package via e-mail to suitable respondents according to e-mail given at the end of the online survey (Phase I).

Sampling Criteria and Participants' Characteristics

This phenomenological study examines an OSN interdependent privacy, using Facebook as platform of interest because of its long existing popularity and influences. This present study focuses on adult users, rather than teenagers in many existing studies. The suitable participants must be active Facebook users (age 25-60 years old) for at least two years, have at least 100 Facebook friends, use Facebook (more than twice per week), upload and share photos regularly (at least once a week), make comments (at least once a week), post content (at least once per fortnight).

In the next phase of this current study (Phase II), the chief investigator will send an e-mail to invite qualified survey respondents for each semi-structured in-depth interview. Then data from in-depth interviews will be analysed according to the phenomenological analysis. The results from this phase will reveal multi-dimensional aspects of other-generated disclosure and its privacy, ranging from motivations, perceptions, types of content, actions as well as impacts on users in physical and virtual world.

Results and Discussion

At the time of writing, the survey is still being administered and hence only preliminary results are reported here. Currently, there are a total of 166 respondents consisting of Facebook users with a variety of ages and backgrounds. The majority of respondents (92.1%, N=166) are adult Facebook users who are older than 25 years (a group of interest) whereas the minority of respondents (7.83%) are under 25 years old.

There is a growing tendency towards more female (70.73%) than male (29.27%) respondents. A large proportion of respondents reside in Australia (51.2%) and Indonesia (33.73%) whereas the minority live in United States, United Kingdom, China, Brazil, Finland, India, Italy, and Pakistan. Location of respondents revealed: metropolitan (53.61%), rural (34.34%) and remote areas (12.05%).

The majority of respondents are working professionals (67.88%), which meets the sampling criteria for this study. Others are students (24.24%) and 'others' (7.88%), who described themselves as either stay-at-home parents or job seekers. Most respondents (89.02%) have Facebook accounts more than three years whereas some have Facebook accounts between 2-3 years (3.66%) and less than 2 years (7.32%). Accordingly, the first two groups are suitable participants for further in-depth interviews in Phase II as per the sampling criteria. The number of friends that respondents have vary such as 100-200 (16.88%), 201-300 (15.63%), 300 or more (50.63%); subsequently, these three groups are met a sampling criteria in terms of number of friends.

There is more problematic in tags, photos, posts, and comments, rather than videos and links. Respondents often deal with photos and tags on Facebook; 30.1% of respondents asked a Facebook friend to delete a group photo that includes them whereas 79.56% of respondents have tagged photos. While the majority of respondents (99.26%) were tagged on Facebook, 26.47% asked others to remove tags and 25.74% asked others to remove photos (Table .1). In contrast, 16.65% were asked by other users to remove tags. Besides tagging, re-sharing is another most popular activity of other-generated disclosures on Facebook. A description of a term "re-share" is noted on the question that "it means passing on content which is generated by others and shared with you". The majority of respondents re-share other-generated content (Table . 2). While the number of respondents re-sharing posts (84.78%) are almost equal to the number of respondents re-sharing links (85.5%), the remainders re-share photos (75.36%) and video (69.56%).

Other-generated disclosure is beyond individual control when it occurs in another user's profile, rather than own profiles. In this case, users generally have to deal with this phenomenon offline by asking the 'discloser' to remove or delete those content. The number of respondents who have removed or deleted photos (23.53%) are relatively same as the number of respondents who have removed or deleted tags (23.13%), due to a friend's request. Similarly, the number of respondents who have removed or deleted posts (17.78%) are slightly different from the number of respondents who have removed or deleted comments (16.30%), due to a friend's request.

Users have involved in an argument on friends' profiles (34.81%), closed groups (28.89%), and public groups (25.74%) (Fig. 2).

Fig. 2. Number of respondents engage in an argument

The reports from preliminary survey presented here have some limitations. First, the majority of respondents were female, professionals (63.16%), and adult Facebook users. This is expected to diminish as the sample sizes grow. Despite our attempt to have a balance of gender in the final survey results and two groups from purposive sampling, there is a possibility that the derivatives of this purposive sample may yield a disproportion between male and female population. Second, the data sets obtained from this survey were not a complete representation of the general human population, since the ages of participants from both groups are in between 25-60 years. Third, this preliminary online questionnaire involved self-reporting.

The final survey result of this project will engage larger sample size. In the next phase, the qualitative findings from a semi-structured in-depth interview will reveal multi-dimensional aspects of the phenomena from insiders' perspective based upon their lived experiences.

This area of research could also expand beyond behaviors of Facebook users to that of other OSNs such as Twitter, Instagram and Snapchat. So far little attention has focused on other-generated disclosures on OSNs such as Instagram, WhatApps, and Xing. 0.00% 10.00% 20.00% 30.00% 40.00% 50.00% 60.00% 70.00% 80.00%

Closed groups

Public groups

Friend's profiles No Yes

Conclusion

Interdependent privacy on OSNs regarding other-generated disclosures is beyond individual control and in need more attention. As of this writing, no work has yet explored an interdependent privacy regarding other-generated disclosures in the multi-dimensional aspects from OSN insiders' perspectives (the 'discloser' and the 'disclosed'). This paper presents a preliminary results based upon an online survey, which is Phase I in this current study.

Other-generated disclosures on OSNs is an inevitable phenomena, which can occur to either users or non-users. To date, existing studies on privacy management cannot fully resolve these problems as well as current tools are inadequate to mitigate this privacy related issues. New designs of privacy management and policy are in need to protect personal and information privacy. In addition, future detection mechanisms or tools would be helpful to mitigate privacy risks. The preliminary survey findings will increase users' awareness as well as call for scholars' attention to tackle these privacy challenges in the right direction.

5.1

Fig. 1 .

 1 Fig. 1. Overview of research design

Table 1 .

 1 Number of respondents asked others to remove or delete the following content from others' profile.

	Content	Yes	No	Total
	Posts	27 19.85%	109 80.15%	136
	Comments	26 19.12%	110 80.88%	136
	Tags	36 26.47%	100 73.53%	136
	Photos	35 25.74%	101 74.26%	136
	Videos	15.44%	84.56%	136
		21	115

Table 2 .

 2 Users' re-sharing activities

	Re-share	Yes	No
	Posts	117	21
	Photos	104	34
	Video	96	42
	Links	118

[START_REF] Litt | A bumpy ride on the information superhighway: Exploring turbulence online[END_REF] p.187

Acknowledgement

We would like to thank Gail Fuller for help in SurveyMonkey and thank survey respondents for their contribution and support to this current study.