{"id":"dad89798-8fba-466b-8fcb-803a0d422c5e","arxiv_id":"2411.18265","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":4.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":0,"one_line_summary":"Shoulder surfing leads victims to feel less private, work more slowly, and avoid sensitive apps, yet most have never been trained to protect themselves.","lead":"A survey of 91 UK smartphone users finds that shoulder surfing changes how people think about privacy and how they use their phones, though the impact varies widely by person. The results suggest users want protective tools but have clear conditions for adopting them, which could guide future privacy software design.","discovery_kind":"extension","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Central claim rests on self-selected victims' retrospective reports with no baseline or control; the study measures perceived aftermath, not actual risk, and cannot rule out that labeling ordinary glances as shoulder surfing drives the reported impact.","rationale":"The reader's weakest assumption is that retrospective self-reports of shoulder surfing are accurate enough to measure aftermath impact. I agree that recall bias is a real limitation, but the more load-bearing issue for the paper's central claim is attribution plus selection: the study samples people who already self-identify as victims, asks them to recall an incident, and then asks them to rate its impact. That protocol cannot separate the effect of the shoulder surfing event from pre-existing privacy attitudes, the social desirability of reporting concern, or the framing introduced by calling the event 'shoulder surfing.' Even if participants remembered the incident perfectly, the design would still not establish that the reported changes in privacy perception and device interaction were caused by shoulder surfing rather than by the participant's general disposition or by having been primed to think of themselves as victims. The paper's own Section 3.6 limitation statement explicitly says that 'more ecological studies focusing on in-the-wild investigations should look into verifying the results reported in the paper,' which supports the need for a direct test of this assumption. I also note an internal tension: Section 4.1 reports that 68.13% of participants disagreed or strongly disagreed that they experience shoulder surfing daily, while the abstract describes shoulder surfing as 'frequently occurring.' That discrepancy does not necessarily invalidate the central risk claim, but it shows the authors generalize beyond their own data. A between-subjects manipulation of the label and screening would directly test whether self-selection and framing drive the reported impact. If the unlabeled condition produces similar results, the concern is resolved and the conditional acceptance can proceed; if it does not, the central conclusion needs to be substantially softened. For these reasons, the reader's conditional verdict remains appropriate rather than being upgraded or downgraded.","tokens_in":20167,"tokens_out":3333,"duration_ms":33987,"concrete_test":"Run a pre-registered between-subjects survey on a fresh Prolific sample (N approximately 300, not pre-screened). Half are asked the current Stage 2 questions after the current shoulder-surfing definition and victim self-selection; the other half are asked identical impact questions about 'any time someone looked at your phone screen' in the past month, without the labels 'shoulder surfing' or 'victim.' If the two conditions yield statistically indistinguishable impact ratings and theme distributions, the conclusion is robust to labeling and selection; if the labeled condition reports stronger impacts, the current design conflates framing with aftermath.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The conclusion (Section 6) states that shoulder surfing is \"a high privacy risk that violates the user's and other people's privacy when data is being observed.\" For this claim to hold, the survey responses must reflect genuine causal effects of actual shoulder surfing events on victims. The design does not establish this. Stage 1 (Section 3.2) recruited only participants who self-identified as victims after reading a definition of shoulder surfing; Stage 2 then asked them to recall their most recent incident and rate agreement statements about impact. There is no baseline, no control group of non-victims, and no objective record of the alleged incident. Consequently, the Likert distributions (e.g., 58.24% agree privacy perceptions were affected, 62.63% agree tasks were slowed) may partly reflect participants' general privacy attitudes or the study's framing rather than consequences of a specific shoulder surfing event. The paper itself acknowledges recall bias (Section 3.6), but the deeper issue is attribution: by asking self-selected victims to explain impact, the design invites a narrative in which shoulder surfing caused those impacts. This is especially consequential because the authors' working definition appears to include any glance at a screen; children, partners, and the participants' own glances at others' screens are all coded as shoulder surfing (Sections 4.1, 4.2.1), so the category may be too broad to support a claim of \"high privacy risk.\" The frequency result in Section 4.1 (only 20.88% agree daily; 68.13% disagree; median=2) further weakens the abstract's \"frequently occurring\" characterization, although frequency alone is not required for risk.","agreement_with_reader":"partial"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper reports an online survey of 91 UK smartphone users who self-identified as victims of shoulder surfing. Participants were screened in a first stage and then asked in a second stage to recall their most recent shoulder surfing incident and to respond to Likert items and open-ended questions about how the experience affected their privacy perceptions and device interaction. The authors report that participants perceived shoulder surfing as frequent and unavoidable, that it often slowed task completion, that it raised concerns about their own and others' privacy, and that participants were conditionally willing to adopt protective measures. The paper concludes with discussion themes and future research directions. The authors acknowledge limitations including recall bias, the UK-only sample, and the self-selected recruitment channel.","tokens_in":20437,"tokens_out":7051,"duration_ms":62269,"significance":"As an exploratory study of perceived aftermath, the paper addresses a genuine gap in the usable-privacy literature and offers useful qualitative material. The strengths include a non-student, gender-balanced UK sample; a two-stage screening procedure that anchors participants to a concrete incident; dual coding of a 25% subset with discussion-based resolution (Section 3.7); and a candid limitations section (Section 3.6). The value of the contribution, however, lies in characterizing victims' perceptions rather than in establishing an objective risk level. If the authors reframe the claims accordingly, the paper can serve as a solid foundation for future, more ecologically valid studies.","major_comments":[{"comment":"The concluding statement that shoulder surfing \"is a high privacy risk that violates the user's and other people's privacy when data is being observed\" is stronger than the evidence supports. The design (Section 3.2) recruited only participants who self-identified as victims after reading a definition, and then asked them to recall their most recent incident and rate its impact; there is no baseline or control group, and the outcome measures are retrospective self-reports. The data can justify claims about perceived impact, e.g., \"participants perceived shoulder surfing as a high privacy risk,\" but not an objective risk statement. Please temper the conclusion and the abstract to match the evidence level and carry the acknowledged limitations (Section 3.6) into the framing of the main findings.","section":"Section 6 (Conclusion)"},{"comment":"The screening definition of shoulder surfing and the reported incidents include observations by children, partners, colleagues, and friends. This inclusive definition may conflate deliberate adversarial glances with incidental or benign looks. Because the paper's headline claim concerns \"high privacy risk,\" the authors should explicitly discuss how the breadth of the category affects interpretation, and ideally analyse whether the Likert responses differ for incidents involving strangers versus known observers. At minimum, the discussion should acknowledge that a child reading a parent's screen and a stranger covertly observing a PIN entry are different events.","section":"Sections 3.2 and 4.1"},{"comment":"The full survey instrument is not included in the paper, so readers cannot see the exact wording of the Likert items behind the percentages in Sections 4.2.1 and 4.3.2 or the precise definition of shoulder surfing that was shown to participants. This limits reproducibility and makes it difficult to assess whether items were leading (e.g., \"experiencing shoulder surfing prevented or slowed me down\"). Please provide the complete questionnaire as an appendix or supplementary material.","section":"Section 3.1"}],"minor_comments":[{"comment":"The statistic that the smartphone user base in the UK will reach 9.72 million is implausibly low (the current figure is on the order of tens of millions); please verify the source and the number.","section":"Section 2.1"},{"comment":"\"Zezschwitz et al. resented three image distortion techniques\" should read \"presented.\"","section":"Section 2.3"},{"comment":"The sentence \"The following quotes from participants reflect the concerns. The following quotes from participants narrate the concerns of participants:\" is duplicated; please remove one.","section":"Section 4.4.1"},{"comment":"\"Considering the workaround and the success of training\" is unclear; likely \"work done\" or \"work around\" was intended.","section":"Section 5.3"},{"comment":"The phrase \"protect children from unwanted device observations\" is ambiguous because the preceding paragraph discusses children as observers rather than as victims; please clarify who is being protected.","section":"Section 5.2"},{"comment":"Figure 1 defines qualifier-to-frequency mappings, but the precise mapping (e.g., \"some,\" \"a few\") should also be stated in the caption, and providing exact code counts in a table would improve transparency if the journal permits it.","section":"Section 3.7"}],"recommendation":"major_revision","confidential_remarks":"The paper is a plausible exploratory survey, but the authors should be pushed to align the abstract and conclusion with the correlational, self-report design. I would be supportive of publication after major revision that softens the risk claim and includes the survey instrument. The topic fits the journal's scope, and I do not see concerns about novelty or citation patterns."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Worth a look if you work on usable privacy. The paper contributes a new UK survey dataset of 91 self-identified shoulder surfing victims, focusing on the aftermath—privacy perceptions, device interaction, and concerns for others. The qualitative analysis is careful: dual coding of 25%, discussion to resolve disagreements, and a transparent limitations section that admits recall bias and the UK-only sample. The themes—situational awareness, perceived unavoidability, behavior adjustment, willingness to adopt protective tools conditional on effectiveness and cost—are coherent and consistent with prior work. It also surfaces a genuinely underexplored angle: concern for bystanders' privacy and the specific case of children shoulder surfing.\n\nThe soft spots are mostly about framing, not the data collection. The abstract says shoulder surfing is 'frequently occurring,' but the paper's own Likert shows only 20.88% agree it happens daily, with median 2. That is a clear mismatch. The conclusion calls shoulder surfing 'a high privacy risk,' which is stronger than what self-selected victims' retrospective reports can establish. This is a descriptive study with no baseline or control group; participants were recruited after being told the study was about shoulder surfing, and they were asked to attribute impact to their most recent incident. The results measure perceived aftermath, not objective risk. The paper largely acknowledges this by citing recall bias, but the abstract and conclusion still drift into causal phrasing. Fixing that is a matter of rewording rather than redesign.\n\nMinor issues: no shared questionnaire or data, and the code-frequency reporting is vague ('some,' 'a few'), which the paper itself flags. The exclusion of fast completers is fine. The citation pattern is reasonable—the authors cite their own prior work, but those are genuine related studies.\n\nOverall: this is a useful empirical contribution that deserves a serious referee. The central themes are credible as perceptions, and the limitations are honestly stated. A good reviewer will ask the authors to align the abstract and conclusion with the evidentiary strength, and to share materials for reproducibility. I'd accept it for peer review and expect minor-to-moderate revision.","headline":"Useful qualitative dataset on shoulder surfing aftermath, but the abstract and conclusion overclaim frequency and risk relative to what self-selected retrospective reports can support.","tokens_in":20982,"tokens_out":2083,"would_cite":true,"duration_ms":19140,"reading_group":"yes","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"Shoulder surfing is a high privacy risk with an aftermath for victims, a survey of 91 UK smartphone users argues.","keywords":["shoulder surfing","smartphone privacy","privacy perceptions","device interaction","user-centred mitigation","survey study","usable security","victim perspectives"],"falsifier":"An experience-sampling study in which participants log shoulder surfing moments as they happen and are asked immediately about task completion, mood, and privacy concern would settle whether the retrospective pattern holds; if real-time logs show no slowing, no avoidance, and no change in concern, the central claim of an aftermath would be refuted.","tokens_in":19987,"feed_emoji":"👀","tokens_out":5488,"duration_ms":46586,"temperature":0.7,"pith_summary":"This paper tries to establish that shoulder surfing, someone looking at a smartphone screen without permission, leaves measurable traces on victims' privacy perceptions and device habits. Surveying 91 UK adults who had been shoulder surfed, the authors argue that the experience is widely seen as unavoidable, frequent, and privacy-violating, and that it slows task completion, reduces phone use, and pushes people to restrict sensitive apps. A central further claim is that victims worry not only about their own data but about other people's data seen on their screens, and that they are willing to adopt protective software if it is effective, affordable, reliable, and available. The stakes are practical: if shoulder surfing genuinely changes everyday behaviour, mitigation should be designed around user-centred criteria rather than purely technical defences.","feed_headline":"Shoulder surfing victims report slower, guarded phone use","feed_subtitle":"Survey of 91 UK victims links onlooker glances to privacy fears, longer task times, and avoided apps.","key_machinery":"The central instrument is a two-stage online survey: a short screening study identified self-reported victims of smartphone shoulder surfing, and a second questionnaire captured Likert-scale agreement plus open-ended explanations of their most recent incident, privacy perceptions, device usage, concerns, and training. The open-ended responses were analysed through open coding and grouped into themes by two researchers, with disagreements resolved in discussion. This machinery turns individual anecdotes into recurring themes about aftermath: the Likert items supply rates such as 58.24% affected privacy perceptions and 62.63% slowed task completion, while the coded quotes supply the mechanisms, such as situational awareness, restricted app access, and protective repositioning.","core_discovery":"On the paper's own terms, the central discovery is that shoulder surfing is not a transient nuisance but a privacy violation with an aftermath: it alters how victims perceive the safety of their information and how they use their smartphones afterwards. Most participants (58.24%) agreed that shoulder surfing affected their privacy perceptions, 62.63% said it slowed or prevented task completion, and 67.39% continued using the phone in the same setting but changed what they did there, such as avoiding sensitive apps or waiting for private spaces. Victims described shoulder surfing as a gateway to more serious threats, including identity theft, device theft, stalking, and blackmail, and about half explicitly named privacy as a top concern. The authors also report that almost no participants had received training or education about shoulder surfing, and that willingness to adopt protective measures is conditional on effectiveness, cost, reliability, and availability.","pith_inferences":["A natural next step, which the authors call for but do not perform, is to verify these retrospective reports with in-the-wild logging: having participants record shoulder surfing incidents as they happen and measuring task time and mood immediately, which would separate true impact from memory bias.","If the findings hold, designers of privacy-preserving screen filters and gaze-based defences should benchmark against the user criteria named here, effectiveness, cost, and interruption, rather than only against attack success rates.","The authors' observations about children suggest a testable research programme: measuring whether shoulder surfing by minors is more common in home settings and whether age-adaptive mitigation, such as gaze-based bystander age estimation, reduces parents' reported anxiety.","The UK sample and the paper's citation of stronger reported consequences in other cultures imply that the aftermath might be more severe in lower-socioeconomic or non-Western contexts; replicating this survey there would tell."],"forward_implications":["If shoulder surfing is as prevalent and unavoidable as participants report, privacy protection cannot rely on users avoiding public settings; mitigation must work in the places people actually use phones.","Because victims slow down and restrict apps after being observed, shoulder surfing has a measurable productivity cost as well as an emotional one.","Concern for other people's data means shoulder surfing can damage trust in the victim, not just expose the victim's own information.","Adoption of protective software will be low unless the tools meet user-defined criteria: proven effectiveness, ease of use, low interruption, and acceptable cost.","The near-total absence of training or education points to a gap that user-centred mitigation could fill."],"supporting_citations":[{"why":"Supplies the baseline understanding of shoulder surfing in the wild, including prevalence, observer-victim relationships, and emotional responses that this study extends to aftermath.","marker":"[2]"},{"why":"Provides the diary-study evidence of where and how shoulder surfing occurs that motivates measuring its impact on device and social interaction.","marker":"[1]"},{"why":"Establishes that smartphone owners are themselves likely to snoop, supporting the paper's framing of shoulder surfing as a widespread, everyday risk.","marker":"[22]"},{"why":"Documents how personal relationships shape shoulder surfing mitigation, a theme the paper revisits in participants' responses.","marker":"[10]"},{"why":"Shows that shoulder surfing consequences vary with culture and socioeconomic status, grounding the paper's UK-focused scope and its call for replication.","marker":"[35]"},{"why":"Supplies the online participant recruitment service through which the 91 victims were sampled.","marker":"[42]"},{"why":"Provides the methodological basis for the authors' acknowledged limitation that retrospective recall may bias reported impacts.","marker":"[45]"}],"fun_headline_variants":["Shoulder surfing aftermath: victims slow down, guard privacy","Phone snooping victims change habits, fear theft afterward","A glance at your screen can leave lasting privacy fears","Shoulder surfing victims report slower, more guarded usage","After the prying eyes: victims alter phone behavior"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The conclusions rest on the assumption that people who say they were shoulder surfed remember the incident and its effects accurately enough for their reports to reflect real impact rather than memory bias or overinterpretation of ordinary glances.","fun_headline_variants_meta":{"raw":{"variants":["Shoulder surfing aftermath: victims slow down, guard privacy","Phone snooping victims change habits, fear theft afterward","A glance at your screen can leave lasting privacy fears","Shoulder surfing victims report slower, more guarded usage","After the prying eyes: victims alter phone behavior"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000316,"raw_usage":{"total_tokens":1766,"prompt_tokens":895,"completion_tokens":871,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":511,"completion_tokens_details":{"reasoning_tokens":794}},"tokens_in":511,"tokens_out":871,"duration_ms":15303,"temperature":1.0,"reasoning_tokens":794,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-12T11:21:03.186046+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"An experience-sampling study in which participants log shoulder surfing moments as they happen and are asked immediately about task completion, mood, and privacy concern would settle whether the retrospective pattern holds; if real-time logs show no slowing, no avoidance, and no change in concern, the central claim of an aftermath would be refuted.","supporting_citations":[{"cited_title":"Shoulder surfing through the social lens: A longitudinal investigation & insights from an exploratory diary study,","cited_arxiv_id":null,"evidence_quote":"Provides the diary-study evidence of where and how shoulder surfing occurs that motivates measuring its impact on device and social interaction."},{"cited_title":"Snooping on mobile phones: Prevalence and trends,","cited_arxiv_id":null,"evidence_quote":"Establishes that smartphone owners are themselves likely to snoop, supporting the paper's framing of shoulder surfing as a widespread, everyday risk."},{"cited_title":"What about my privacy, habibi? understanding privacy concerns and perceptions of users from differ- ent socioeconomic groups in the arab world,","cited_arxiv_id":null,"evidence_quote":"Shows that shoulder surfing consequences vary with culture and socioeconomic status, grounding the paper's UK-focused scope and its call for replication."},{"cited_title":"Prolific — online participant recruitment for surveys and market research,","cited_arxiv_id":null,"evidence_quote":"Supplies the online participant recruitment service through which the 91 victims were sampled."},{"cited_title":"Using experience sampling methods/ecological momentary assessment (esm/ema) in clinical as- sessment and clinical research: introduction to the special section.,","cited_arxiv_id":null,"evidence_quote":"Provides the methodological basis for the authors' acknowledged limitation that retrospective recall may bias reported impacts."}],"review_version":1}