About Me
I am a Professor in the Khoury College of Computer Sciences at Northeastern University. I am a member of the Cybersecurity and Privacy Institute and the Associate Dean of Academic Programs and Student Experience in Khoury College.
I am a faculty associate at the Berkman Klein Center for Internet & Society at Harvard University, and an affiliate member of the Center for Law, Innovation and Creativity at Northeastern University School of Law.
My research seeks to investigate the sociotechnical systems that shape our lives using a multi-disciplinary approach. I believe that by increasing transparency we can also improve accountability of these systems. If you’re interested in my research, here is a quick primer on web privacy, here is a brief video about algorithm auditing, here is a longer video about our investigation of bias in hiring algorithms, and here is a video discussing the role of algorithm auditing in AI regulation.
Along with my co-PIs, I am currently working to launch the National Internet Observatory. This NSF-funded project seeks to gather data about the online habits of a large, representative panel of US residents and then make it available to qualified researchers around the world.
Research Highlights
Algorithm Auditing
There is growing concern about the impact of powerful, opaque algorithms on our daily lives. Our group audits algorithms: we use carefully controlled experiments and large-scale observational data to understand how companies’ algorithms work and how they affect ordinary people. Recent examples include:
- examining whether Google Search creates partisan filter bubbles, and auditing the health information in Google’s AI Overviews;
- uncovering bias in image search results and synthetic AI voice services;
- showing that errors in demographic inference undermine the guarantees of fair ranking algorithms;
- conducting a collaborative audit of a hiring algorithm.
This work has appeared in Nature, ICWSM, WWW, FAccT, SIGIR, and CSCW. With our co-PIs, we are also building the National Internet Observatory to give researchers ethical access to data about online life.
Tracking and Privacy
Tracking is everywhere online, and it is increasingly built into the physical world, yet consumers have little insight into who collects their data and how it is shared. Our recent work includes:
- the largest study to date of data privacy in connected vehicles, done in collaboration with Consumer Reports;
- showing that Google’s Topics API can be used to infer users’ demographics and sensitive interests;
- assessing whether websites and the ad industry comply with the California Consumer Privacy Act, including the IAB’s CCPA compliance framework;
- evaluating the accuracy of the interest profiles that ad networks build about users.
This work has appeared at IMC, WWW, PETS, and NDSS, and it has informed policymakers in the US Congress.
Dark Patterns
Dark patterns are deceptive or manipulative user interface designs that push people into choices they would not otherwise make, such as sharing more data, spending more money, or staying subscribed. Working at the intersection of computer science and law, our research includes:
- the first cross-modality comparison of dark patterns across apps, mobile websites, and desktop websites;
- studies of dark patterns in home IoT devices and the claims made by social robots;
- legal frameworks that recast dark patterns as disloyal design and propose design loyalty as a remedy.
This work has been cited by the OECD, in Colorado Privacy Act regulations, and in testimony before the US House.
Platform Power and Competition
A handful of dominant platforms now act as gatekeepers between businesses and consumers, raising difficult questions for competition policy. We bring empirical evidence to these debates by measuring how platforms’ designs and business practices affect users, competitors, and the broader web. Recent examples include:
- measuring how Google’s search components steer clicks and attention toward its own properties;
- estimating Google’s market shares across vertical search markets;
- quantifying the revenue Google earns from navigational and brand advertising, which companies feel compelled to buy on their own names;
- investigating the determinants and effects of Buy Box suppression on Amazon;
- showing experimentally that AI-generated answers in search reduce referrals to publishers without improving the user experience;
- making the case for standards in digital advertising.
This work has appeared at ICWSM, where it received Best Paper and Honorable Mention awards, as well as WWW and the Harvard Journal of Law & Technology. It was also covered in the press during the US v. Google antitrust case.
PKI and TLS
Public Key Infrastructure (PKI) underpins trust and security on the Internet, but today’s PKIs are brittle and hard to change. We study threats to modern PKIs and build systems to address them, including:
- CRLite, which compactly pushes all certificate revocations to browsers and is now deployed in Mozilla Firefox;
- Hammurabi, which separates certificate parsing from validation policy;
- assertion-carrying certificates;
- a path toward modernizing root stores across the ecosystem.
This work has appeared at SIGCOMM, IEEE S&P, CCS, Usenix Security, and IMC.