SOUPS 2021 Call for Papers

The Seventeenth Symposium on Usable Privacy and Security (SOUPS 2021) will be held as a virtual event on August 8–10, 2021, and will be co-located with the 30th USENIX Security Symposium.

In cooperation with USENIX, the Advanced Computing Systems Association

Important Dates

All dates are at 23:59 AoE (Anywhere on Earth) time. These are firm deadlines; no extensions will be granted.

  • Mandatory Paper Registration Deadline: Thursday, February 18, 2021
  • Paper Submission Deadline: Thursday, February 25, 2021
  • Early Rejection Notification: Tuesday, March 30, 2021
  • Response Period: Thursday, April 29–Thursday, May 6, 2021
  • Paper Notifications: Friday, May 21, 2021
  • Final Paper Files Due: Wednesday, June 9, 2021
  • Video Presentations Due: Tuesday, July 20, 2021

Symposium Organizers

General Chair

Sonia Chiasson, Carleton University

Technical Papers Co-Chairs

Joe Calandrino, Federal Trade Commission
Manya Sleeper, Google

Technical Papers Committee

Yasemin Acar, Max Planck Institute for Security and Privacy
Florian Alt, Bundeswehr University Munich
Olabode Anise, Google
Adam J. Aviv, The George Washington University
Rebecca Balebako, Google
Lujo Bauer, Carnegie Mellon University
Jasmine Bowers, MITRE
Cristian Bravo-Lillo, Ciberseguridad Humana
Lynne Coventry, Northumbria University
Lorrie Cranor, Carnegie Mellon University
Carrie Gates, Bank of America
Maximilian Golla, Max Planck Institute for Security and Privacy
Julie Haney, National Institute of Standards and Technology (NIST)
Marian Harbach, Google
Jun Ho Huh, Samsung Research
Iulia Ion, Google
Hassan Khan, University of Guelph
Bart Knijnenburg, Clemson University
Katharina Krombholz, CISPA Helmholtz Center for Information Security
Janne Lindqvist, Aalto University
Shri Mare, Western Washington University
Abigail Marsh, Macalester College
Susan E. McGregor, The Data Science Institute at Columbia University
Mainack Mondal, Indian Institute of Technology
Xinru Page, Brigham Young University
Irwin Reyes, Two Six Labs
Scott Ruoti, The University of Tennessee
Florian Schaub, University of Michigan
Kent Seamons, Brigham Young University
Elizabeth Stobert, Carleton University
Jose M. Such, King's College London
Eran Toch, Tel Aviv University
Blase Ur, University of Chicago
Kami Vaniea, University of Edinburgh
Emanuel von Zezschwitz, Google
Yang Wang, University of Illinois at Urbana–Champaign
Rick Wash, Michigan State University
Josephine Wolff, Tufts University
Leah Zhang-Kennedy, University of Waterloo
Mary Ellen Zurko, MIT Lincoln Laboratory

Lightning Talks and Demos Co-Chairs

Sanchari Das, University of Denver
Blase Ur, University of Chicago

Lightning Talks and Demos Junior Co-Chair

Amel Bourdoucen, Aalto University

Karat Award Chair

Nalin Asanka Gamagedara Arachchilage, La Trobe University

Posters Co-Chairs

Camille Cobb, Carnegie Mellon University
Maximilian Golla, Max Planck Institute for Security and Privacy

Posters Junior Co-Chair

Yixin Zou, University of Michigan

Tutorials and Workshops Co-Chairs

Katharina Krombholz, CISPA Helmholtz Center for Information Security
Leah Zhang-Kennedy, University of Waterloo

Tutorials and Workshops Junior Co-Chair

Imani Sherman, University of Florida

Mentoring Co-Chairs

Adam J. Aviv, The George Washington University
Mohamed Khamis, University of Glasgow

Mentoring Junior Co-Chairs

Ruba Abu-Salma, International Computer Science Institute (ICSI) and University of California, Berkeley
Borke Obada-Obieh, University of British Columbia

Publicity Co-Chairs

Charles Weir, Lancaster University
Yaxing Yao, Carnegie Mellon University

Email List Chair

Lorrie Cranor, Carnegie Mellon University

Accessibility Chair

Liz Markel, USENIX Association

USENIX Liaison

Casey Henderson, USENIX Association


The 2021 Symposium on Usable Privacy and Security (SOUPS) will bring together an interdisciplinary group of researchers and practitioners in human computer interaction, security, and privacy. The program will feature:

  • Technical papers, including replication papers and systematization of knowledge papers
  • Workshops and tutorials
  • A poster session
  • Lightning talks

Technical Papers

We invite authors to submit previously unpublished papers describing research or experience in all areas of usable privacy and security. We welcome a variety of research methods, including both qualitative and quantitative approaches. Papers will be judged on their scientific quality, overall quality, and contribution to the field. Topics include, but are not limited to:

  • Innovative security or privacy functionality and design
  • Field studies of security or privacy technology
  • Usability evaluations of new or existing security or privacy features
  • Security testing of new or existing usability features
  • Longitudinal studies of deployed security or privacy features
  • Studies of administrators or developers and support for security and privacy
  • The impact of organizational policy or procurement decisions
  • Lessons learned from the deployment and use of usable privacy and security features
  • Foundational principles of usable security or privacy
  • Ethical, psychological, sociological aspects of usable security and privacy
  • Usable security and privacy implications/solutions for specific domains (e.g., IoT, medical, vulnerable populations)
  • Replicating or extending important previously published studies and experiments
  • Systematization of knowledge papers that integrate and systematize existing knowledge to provide new insight into a previously studied area

Paper Registration: Technical papers must be registered by February 18, 2021. Registration is mandatory for all papers. Registering a paper in the submission system requires filling out all the fields of the online form that describe the submission, but does not require uploading a PDF of the paper. This information must describe the paper accurately, in sufficient detail to assign appropriate reviewers. Placeholder, incomplete, or inaccurate titles and abstracts may result in rejection without review.

Paper Submission: Technical papers must be uploaded as PDFs by February 25, 2021 (but note the mandatory February 18 registration deadline above). All submissions must follow the guidelines described below. Submissions that violate any of the requirements below may be rejected without review.

Contact the program chairs at if you have any questions about these requirements.

Format and Page Limits: Papers must use the SOUPS formatting template (available for MS Word or LaTeX) and be submitted as a PDF via the web submission system. Submissions must be no more than 12 pages (excluding acknowledgments, bibliography, and appendices). For the body of your paper, brevity is appreciated, as evidenced by the fact that many published papers in prior years have been well under this limit.

Submissions may include as many additional pages as needed for references and for supplementary material in appendices. The paper should stand alone without the supplementary material, but authors may use this space for content that may be of interest to some readers but is peripheral to the main contributions of the paper. Note that members of the program committee are free to not read this material when reviewing the paper. Final papers have an official limit of 20 pages including references and appendices, but the program committee chairs will grant any extension they determine reasonable to accommodate references and supplemental material.

Paper Content: Papers need to describe the purpose and goals of the work, cite related work, show how the work effectively integrates usability or human factors with security or privacy, and clearly indicate the innovative aspects of the work or lessons learned as well as the contribution of the work to the field. The paper abstracts should contain a sentence summarizing the contribution to the field and literature.

All submissions must clearly relate to the human aspects of security or privacy. Papers on security or privacy that do not address usability or human factors will not be considered. Likewise, papers on usability or human factors that do not address security or privacy will not be considered. The determination of whether a paper is within scope will be solely at the discretion of the program committee chairs.

Your paper and research approach—including research instruments—should be inclusive and respectful. A variety of guidance exists on this topic. Please be sure to follow guidance on language use from the USENIX statement on racism and Black, African-American, and African Diaspora inclusion.

Systematization of Knowledge Papers: We are soliciting Systematization of Knowledge (SoK) papers that integrate and systematize existing knowledge to provide new insight into a previously studied area of usable security or privacy. SoK papers should draw on prior work to put forth a new taxonomy, argument, or observation in an area in which substantial work has already been done. SoK papers should be more than a survey or summary of prior work in an area. SoK papers will be held to the same scientific and presentation standards as other technical papers. Please prefix the title of these papers with "SoK:" and check the SoK checkbox on the submission form to flag them for the review process.

Replication Papers: In addition to original work, we are soliciting well-executed replication studies that meaningfully confirm, question, or clarify the result under consideration. Please prefix the title of these papers with the word "Replication:" for the review process.

Replication papers should aim to replicate important/influential findings from the literature. They may not necessarily offer new or unexpected findings; papers confirming previous findings are also considered contributions. Replication of a result that has already been replicated many times is less valuable. Replication of an obscure study that originally had only minimal influence on the community is less valuable. Authors should clearly state why they conducted a replication study, describe the methodological differences precisely, and compare their findings with the results from the original study.

Replication papers will be held to the same scientific standards as other technical papers. They should use currently accepted methodologies and technologies. Authors should not reuse outdated methods/technologies simply because they were used in the original paper. Replications may follow the same protocol as the original study, or may vary one or more key variables to see whether the result is extensible (e.g., re-running a study with a sample from a different population).

Anonymous Submission: Reviewing is anonymous. No names or affiliations should appear on the title page or in the body of the paper, acknowledgments should be removed, and papers should avoid revealing the authors' identities in the text. Any references to the authors' own work should be made in the third person, as if it was work by someone else. Appendices and figures should also be de-identified (e.g., do not leave logos or contact info on study materials, and remove identifying URLs from screenshots). Please ensure all author names, affiliations, URLs, etc. have been removed; even minor mistakes may result in rejection without review. Contact the program chairs at if you have any questions.

Overlap with Previous Papers: USENIX policy prohibits simultaneous submission of the same work to multiple venues, submission of previously published work, and plagiarism. SOUPS further prohibits the submission of substantially similar work to multiple venues. On the recommendation of a program chair, USENIX may take action against authors who have committed these practices. Any overlap between your submitted paper and other work either under submission, previously published, or submitted elsewhere before the SOUPS notification deadline must be documented in an explanatory note sent to the chairs. If a subsequent overlapping submission is made during the review process, the chairs should be notified. State precisely how the two works differ in their goals, share experiments or data sources, and offer unique contributions. If the other work is under submission elsewhere, the program committee may ask to review that work to evaluate the overlap. Please note that program committees frequently share information about papers under review and reviewers usually work on multiple conferences simultaneously. Technical reports, e.g., arXiv reports, are exempt from this rule. If in doubt, please contact the program chairs at for advice.

Self-plagiarism includes verbatim or near-verbatim use of one's own published work without citing the original source, and is generally not acceptable. In some cases, it may be acceptable to include a brief portion of selected content from the introduction, background, related work, or methods of a closely related paper. In these cases, the original paper must be explicitly referenced and the overlap should be clear to the reader. The reused content must not be part of the main contributions of the paper and, where possible, rewriting the text is preferred. Papers with significant text reuse may be rejected because of too much overlap. If in doubt, please contact the program chairs at for advice.

Appendices: Authors may attach to their paper supplementary appendices containing study materials (e.g., survey instruments, interview guides, etc.) that would not otherwise fit within the body of the paper. These appendices may be included to assist reviewers with questions that fall outside the stated contribution of your paper on which your work is to be evaluated. Reviewers are not required to read any appendices, so your paper should be self-contained without them. (We note that in recent years, inclusion of study materials as appendices has become very common, and reviewers often find it very useful.) Accepted papers will be published online with their supplementary appendices included.

Conflicts of Interest: The submission system will request information about conflicts of interest between the paper's authors and program committee (PC) members, including a brief explanation. It is the full responsibility of all authors of a paper to identify their potential conflict-of-interest PC members, according to the following definition. A paper author has a conflict of interest with a PC member when one or more of the following conditions holds:

  1. The PC member shared an institutional affiliation with the author in the prior two years.
  2. The PC member was the advisor or advisee of the author at any time.
  3. The PC member has collaborated or published with the author in the prior two years.
  4. The PC member is serving as the sponsor or administrator of a grant that funds the author's research.
  5. The PC member is a close personal friend or relative of the author.

We recognize that special circumstances may exist, such as deep personal animosity. If you have any questions or concerns, please contact the program chairs at

Ethical Research: User studies should follow the basic principles of ethical research, including beneficence (maximizing the benefits to an individual or to society while minimizing harm to the individual), minimal risk (appropriateness of the risk versus benefit ratio), voluntary consent, respect for privacy, and limited deception. Studies that rely on crowdworkers can incur additional ethical obligations, including but not limited to paying a fair wage. Some example ethical guidelines generated by Mechanical Turk crowdworkers can be found here. If images of participants are included in the paper, make sure that these images will not create potential risk for participants and that the informed consent covers potential publication of participant images.

Authors are encouraged to include in their submissions an explanation of how ethical principles were followed, and may be asked to provide such an explanation should questions arise during the review process. If your organization or institution requires formal clearance for research with human subjects, your paper may be rejected if clearance was not obtained. However, such clearance alone does not guarantee acceptance and the program committee may reject a paper on ethical grounds.

Early Rejections: Papers that receive substantially negative initial reviews will be rejected early. The authors of early-rejected papers, and only such papers, will receive a copy of their initial reviews. At this point, papers are no longer considered under submission (except if authors appeal).

Authors who substantively disagree with the reviews can appeal to the program committee chairs. Authors' appeals must clearly and explicitly identify concrete disagreements with factual statements in the initial reviews. Appealing a submission that was rejected early will keep it under consideration, and it cannot be withdrawn or resubmitted elsewhere until the final notification of acceptance or rejection.

Response: A response period will occur after the second round of reviews. Authors will be given a chance to see reviews, and they may provide a short response that will be considered in subsequent discussions. Due to time constraints, the response period is fairly short. Please ensure that you reserve enough time between April 29 and May 6 for the response process. Late responses will not be accepted.

Publication: Accepted papers will be published by the USENIX Association, and will be freely available on the USENIX and SOUPS websites. Authors will retain copyright of their papers. Authors may also release pre-prints of their accepted work to the public at their discretion.

Presentation: For accepted papers, paper authors must submit a pre-recorded video of their presentation, attend the virtual conference, and participate in live Q&A for their presentation.

* Overlap with Previous Papers policy adapted from USENIX Security 2021
* Conflict of Interest policy adapted from USENIX Security 2020
* Early Rejection policy adapted from IEEE Symposium on Security and Privacy 2017
* Replication papers description adapted from Elsevier Journal of Molecular and Cellular Cardiology
* SoK papers description adapted from IEEE Symposium on Security and Privacy 2018