arXiv subjects

Rebekah Overdorf

Publications and source records attributed to Rebekah Overdorf.

18 recordsLinked to original sources

arXiv2026

Stop Abandoning Me: Exploring the Landscape of Unmaintained Intimate Partner Abuse Support Applications

Many support applications are developed to help users living through intimate partner abuse (IPA). However, many of those projects get abandoned, because the application was a prototype that never got turned into an actual product, funding ran out, or the people maintaining it moved onto other projects. This abandonment can have devastating consequences because the users of these applications are vulnerable by definition. In this ongoing research, we aim to measure the abandonment of intimate partner abuse support applications. Our preliminary results with a dataset of 197 support tools indicate that 58.9\% of applications have lost support over time, either no longer receiving updates or not being available online at all.

cs.CY↗

arXiv2026

It is not enough to give your moderation rules to ChatGPT: Policy-as-Prompt Moderation and Its Potential Impacts on Community Governance

Content moderation practices and governance paradigms are changing rapidly, as fewer human moderators are deployed as `experts' by social media companies in a centralized manner. Instead, the companies are focusing more on community approaches, relying on volunteers to provide accurate information and make correct decisions. In decentralized moderation, communities have always relied on volunteers, updated community guidelines, and internal discussions thereof. For both content moderation paradigms, Artificial Intelligence (AI) seems like it could help ease moderation burdens of time, mental health, and accuracy. One possible way to operationalize AI in content moderation is a `policy-as-prompt'' approach, where the policy is formulated as a natural-language prompt and then passed to a large language model (LLM). This model then aids in moderation tasks. In this paper, we briefly lay out the technical and governance properties of this approach, and argue that its limitations lead to specific risks and harms that have to be addressed. Towards alleviating them, we lay out multiple considerations towards more effective prompt governance, but ultimately find that writing prompts alone is not appropriate for ensuring meaningful community governance.

cs.CY↗

arXiv2026

Traces of Abuse: How Generative AI Impacts Image-Based Sexual Abuse (IBSA) Investigations

The introduction of generative AI (GAI) into the workflow of image-based sexual abuse (IBSA) only worsened the ease of creation and distribution, victimizing more people than ever. We outline how the introduction of generative AI (GAI-IBSA) impacts the creation of traces and the type of reasoning they allow. We illustrate the impact by comparing the forensic traces available in four different IBSA scenarios. We discuss the impacts on the (possibility of) investigation, arguing that the advent of generative AI overall benefits abusers by making perpetration easier, and the perpetrator harder to trace.

cs.CY↗

arXiv2025

Unfair Mistakes on Social Media: How Demographic Characteristics influence Authorship Attribution

Authorship attribution techniques are increasingly being used in online contexts such as sock puppet detection, malicious account linking, and cross-platform account linking. Yet, it is unknown whether these models perform equitably across different demographic groups. Bias in such techniques could lead to false accusations, account banning, and privacy violations disproportionately impacting users from certain demographics. In this paper, we systematically audit authorship attribution for bias with respect to gender, native language, and age. We evaluate fairness in 3 ways. First, we evaluate how the proportion of users with a certain demographic characteristic impacts the overall classifier performance. Second, we evaluate if a user's demographic characteristics influence the probability that their texts are misclassified. Our analysis indicates that authorship attribution does not demonstrate bias across demographic groups in the closed-world setting. Third, we evaluate the types of errors that occur when the true author is removed from the suspect set, thereby forcing the classifier to choose an incorrect author. Unlike the first two settings, this analysis demonstrates a tendency to attribute authorship to users who share the same demographic characteristic as the true author. Crucially, these errors do not only include texts that deviate from a user's usual style, but also those that are very close to the author's average. Our results highlight that though a model may appear fair in the closed-world setting for a performant classifier, this does not guarantee fairness when errors are inevitable.

cs.SI↗

arXiv2024

Characterizing and Detecting Propaganda-Spreading Accounts on Telegram

Information-based attacks on social media, such as disinformation campaigns and propaganda, are emerging cybersecurity threats. The security community has focused on countering these threats on social media platforms like X and Reddit. However, they also appear in instant-messaging social media platforms such as WhatsApp, Telegram, and Signal. In these platforms information-based attacks primarily happen in groups and channels, requiring manual moderation efforts by channel administrators. We collect, label, and analyze a large dataset of more than 17 million Telegram comments and messages. Our analysis uncovers two independent, coordinated networks that spread pro-Russian and pro-Ukrainian propaganda, garnering replies from real users. We propose a novel mechanism for detecting propaganda that capitalizes on the relationship between legitimate user messages and propaganda replies and is tailored to the information that Telegram makes available to moderators. Our method is faster, cheaper, and has a detection rate (97.6%) 11.6 percentage points higher than human moderators after seeing only one message from an account. It remains effective despite evolving propaganda.

cs.SI↗

arXiv2024

DFRWS EU 10-Year Review and Future Directions in Digital Forensic Research

Conducting a systematic literature review and comprehensive analysis, this paper surveys all 135 peer-reviewed articles published at the Digital Forensics Research Conference Europe (DFRWS EU) spanning the decade since its inaugural running (2014-2023). This comprehensive study of DFRWS EU articles encompasses sub-disciplines such as digital forensic science, device forensics, techniques and fundamentals, artefact forensics, multimedia forensics, memory forensics, and network forensics. Quantitative analysis of the articles' co-authorships, geographical spread and citation metrics are outlined. The analysis presented offers insights into the evolution of digital forensic research efforts over these ten years and informs some identified future research directions.

cs.CR↗

arXiv2022

Misleading Repurposing on Twitter

We present the first in-depth and large-scale study of misleading repurposing, in which a malicious user changes the identity of their social media account via, among other things, changes to the profile attributes in order to use the account for a new purpose while retaining their followers. We propose a definition for the behavior and a methodology that uses supervised learning on data mined from the Internet Archive's Twitter Stream Grab to flag repurposed accounts. We found over 100,000 accounts that may have been repurposed. We also characterize repurposed accounts and found that they are more likely to be repurposed after a period of inactivity and deleting old tweets. We also provide evidence that adversaries target accounts with high follower counts to repurpose, and some make them have high follower counts by participating in follow-back schemes. The results we present have implications for the security and integrity of social media platforms, for data science studies in how historical data is considered, and for society at large in how users can be deceived about the popularity of an opinion.

cs.SI↗

arXiv2022

Characterizing Retweet Bots: The Case of Black Market Accounts

Malicious Twitter bots are detrimental to public discourse on social media. Past studies have looked at spammers, fake followers, and astroturfing bots, but retweet bots, which artificially inflate content, are not well understood. In this study, we characterize retweet bots that have been uncovered by purchasing retweets from the black market. We detect whether they are fake or genuine accounts involved in inauthentic activities and what they do in order to appear legitimate. We also analyze their differences from human-controlled accounts. From our findings on the nature and life-cycle of retweet bots, we also point out several inconsistencies between the retweet bots used in this work and bots studied in prior works. Our findings challenge some of the fundamental assumptions related to bots and in particular how to detect them.

cs.SI↗

arXiv2021

Tactical Reframing of Online Disinformation Campaigns Against The Istanbul Convention

In March 2021, Turkey withdrew from The Istanbul Convention, a human-rights treaty that addresses violence against women, citing issues with the convention's implicit recognition of sexual and gender minorities. In this work, we trace disinformation campaigns related to the Istanbul Convention and its associated Turkish law that circulate on divorced men's rights Facebook groups. We find that these groups adjusted the narrative and focus of the campaigns to appeal to a larger audience, which we refer to as "tactical reframing." Initially, the men organized in a grass-roots manner to campaign against the Turkish law that was passed to codify the convention, focusing on one-sided custody of children and indefinite alimony. Later, they reframed their campaign and began attacking the Istanbul Convention, highlighting its acknowledgment of homosexuality. This case study highlights how disinformation campaigns can be used to weaponize homophobia in order to limit the rights of women. To the best of our knowledge, this is the first case study that analyzes a narrative reframing in the context of a disinformation campaign on social media.

cs.CY↗

arXiv2021

A Dataset of State-Censored Tweets

Many governments impose traditional censorship methods on social media platforms. Instead of removing it completely, many social media companies, including Twitter, only withhold the content from the requesting country. This makes such content still accessible outside of the censored region, allowing for an excellent setting in which to study government censorship on social media. We mine such content using the Internet Archive's Twitter Stream Grab. We release a dataset of 583,437 tweets by 155,715 users that were censored between 2012-2020 July. We also release 4,301 accounts that were censored in their entirety. Additionally, we release a set of 22,083,759 supplemental tweets made up of all tweets by users with at least one censored tweet as well as instances of other users retweeting the censored user. We provide an exploratory analysis of this dataset. Our dataset will not only aid in the study of government censorship but will also aid in studying hate speech detection and the effect of censorship on social media users. The dataset is publicly available at https://doi.org/10.5281/zenodo.4439509

cs.SI↗

arXiv2021

Ephemeral Astroturfing Attacks: The Case of Fake Twitter Trends

We uncover a previously unknown, ongoing astroturfing attack on the popularity mechanisms of social media platforms: ephemeral astroturfing attacks. In this attack, a chosen keyword or topic is artificially promoted by coordinated and inauthentic activity to appear popular, and, crucially, this activity is removed as part of the attack. We observe such attacks on Twitter trends and find that these attacks are not only successful but also pervasive. We detected over 19,000 unique fake trends promoted by over 108,000 accounts, including not only fake but also compromised accounts, many of which remained active and continued participating in the attacks. Trends astroturfed by these attacks account for at least 20% of the top 10 global trends. Ephemeral astroturfing threatens the integrity of popularity mechanisms on social media platforms and by extension the integrity of the platforms.

cs.CR↗

arXiv2020

Thinking Taxonomically about Fake Accounts: Classification, False Dichotomies, and the Need for Nuance

It is often said that war creates a fog in which it becomes difficult to discern friend from foe on the battlefield. In the ongoing war on fake accounts, conscious development of taxonomies of the phenomenon has yet to occur, resulting in much confusion on the digital battlefield about what exactly a fake account is. This paper intends to address this problem, not by proposing a taxonomy of fake accounts, but by proposing a systematic way to think taxonomically about the phenomenon. Specifically, we examine fake accounts through both a combined philosophical and computer science-based perspective. Through these lenses, we deconstruct narrow binary thinking about fake accounts, both in the form of general false dichotomies and specifically in relation to the Facebook's conceptual framework "Coordinated Inauthentic Behavior" (CIB). We then address the false dichotomies by constructing a more complex way of thinking taxonomically about fake accounts.

cs.CY↗

arXiv2020

Can Celebrities Burst Your Bubble?

Polarization is a growing, global problem. As such, many social media based solutions have been proposed in order to reduce it. In this study, we propose a new solution that recommends topics to celebrities to encourage them to join a polarized debate and increase exposure to contrarian content - bursting the filter bubble. Using a state-of-the art model that quantifies the degree of polarization, this paper makes a first attempt to empirically answer the question: Can celebrities burst filter bubbles? We use a case study to analyze how people react when celebrities are involved in a controversial topic and conclude with a list possible research directions.

cs.SI↗

arXiv2020

POTs: Protective Optimization Technologies

Algorithmic fairness aims to address the economic, moral, social, and political impact that digital systems have on populations through solutions that can be applied by service providers. Fairness frameworks do so, in part, by mapping these problems to a narrow definition and assuming the service providers can be trusted to deploy countermeasures. Not surprisingly, these decisions limit fairness frameworks' ability to capture a variety of harms caused by systems. We characterize fairness limitations using concepts from requirements engineering and from social sciences. We show that the focus on algorithms' inputs and outputs misses harms that arise from systems interacting with the world; that the focus on bias and discrimination omits broader harms on populations and their environments; and that relying on service providers excludes scenarios where they are not cooperative or intentionally adversarial. We propose Protective Optimization Technologies (POTs). POTs provide means for affected parties to address the negative impacts of systems in the environment, expanding avenues for political contestation. POTs intervene from outside the system, do not require service providers to cooperate, and can serve to correct, shift, or expose harms that systems impose on populations and their environments. We illustrate the potential and limitations of POTs in two case studies: countering road congestion caused by traffic-beating applications, and recalibrating credit scoring for loan applicants.

cs.CY↗

arXiv2019

Subtle Censorship via Adversarial Fakeness in Kyrgyzstan

With the shift of public discourse to social media, we see simultaneously an expansion of civic engagement as the bar to enter the conversation is lowered, and the reaction by both state and non-state adversaries of free speech to silence these voices. Traditional forms of censorship struggle in this new situation to enforce the preferred narrative of those in power. Consequently, they have developed new methods for controlling the conversation that use the social media platform itself. Using the Central Asian republic of Kyrgyzstan as a main case study, this talk explores how this new form of "subtle" censorship relies on pretence and imitation, and why interdisciplinary methods of research are needed to grapple with it. We examine how "fakeness" in the form of fake news and profiles is used as methods of subtle censorship.

cs.CY↗

arXiv2018

Questioning the assumptions behind fairness solutions

In addition to their benefits, optimization systems can have negative economic, moral, social, and political effects on populations as well as their environments. Frameworks like fairness have been proposed to aid service providers in addressing subsequent bias and discrimination during data collection and algorithm design. However, recent reports of neglect, unresponsiveness, and malevolence cast doubt on whether service providers can effectively implement fairness solutions. These reports invite us to revisit assumptions made about the service providers in fairness solutions. Namely, that service providers have (i) the incentives or (ii) the means to mitigate optimization externalities. Moreover, the environmental impact of these systems suggests that we need (iii) novel frameworks that consider systems other than algorithmic decision-making and recommender systems, and (iv) solutions that go beyond removing related algorithmic biases. Going forward, we propose Protective Optimization Technologies that enable optimization subjects to defend against negative consequences of optimization systems.

cs.CY↗

arXiv2018

Under the Underground: Predicting Private Interactions in Underground Forums

Underground forums where users discuss, buy, and sell illicit services and goods facilitate a better understanding of the economy and organization of cybercriminals. Prior work has shown that in particular private interactions provide a wealth of information about the cybercriminal ecosystem. Yet, those messages are seldom available to analysts, except when there is a leak. To address this problem we propose a supervised machine learning based method able to predict which public \threads will generate private messages, after a partial leak of such messages has occurred. To the best of our knowledge, we are the first to develop a solution to overcome the barrier posed by limited to no information on private activity for underground forum analysis. Additionally, we propose an automate method for labeling posts, significantly reducing the cost of our approach in the presence of real unlabeled data. This method can be tuned to focus on the likelihood of users receiving private messages, or \threads triggering private interactions. We evaluate the performance of our methods using data from three real forum leaks. Our results show that public information can indeed be used to predict private activity, although prediction models do not transfer well between forums. We also find that neither the length of the leak period nor the time between the leak and the prediction have significant impact on our technique's performance, and that NLP features dominate the prediction power.

cs.CR↗

arXiv2017

How Unique is Your .onion? An Analysis of the Fingerprintability of Tor Onion Services

Recent studies have shown that Tor onion (hidden) service websites are particularly vulnerable to website fingerprinting attacks due to their limited number and sensitive nature. In this work we present a multi-level feature analysis of onion site fingerprintability, considering three state-of-the-art website fingerprinting methods and 482 Tor onion services, making this the largest analysis of this kind completed on onion services to date. Prior studies typically report average performance results for a given website fingerprinting method or countermeasure. We investigate which sites are more or less vulnerable to fingerprinting and which features make them so. We find that there is a high variability in the rate at which sites are classified (and misclassified) by these attacks, implying that average performance figures may not be informative of the risks that website fingerprinting attacks pose to particular sites. We analyze the features exploited by the different website fingerprinting methods and discuss what makes onion service sites more or less easily identifiable, both in terms of their traffic traces as well as their webpage design. We study misclassifications to understand how onion service sites can be redesigned to be less vulnerable to website fingerprinting attacks. Our results also inform the design of website fingerprinting countermeasures and their evaluation considering disparate impact across sites.

cs.CR↗