Keywords

1 Introduction

Technology has advanced at a significant rate over the past few decades, and it is challenging for most people to understand what is required to protect themselves online [18, 32]. This rapid evolution can also make it difficult for older generations to keep pace with their younger counterparts. Within a family, it can therefore be challenging for parents to stay apprised of their children’s activities, and especially, to ensure their protection. This is a particular challenge for parents when children have access to a wide range of Internet-enabled devices, and connect to a variety of people online [7]. These challenges can be further exacerbated for marginalised users [10], such as older people, and people with disabilities such as visual impairments or conditions such as autism spectrum disorder (ASD) [1, 6, 20]. According to Benford [4], autism affects an individual’s social interaction, communication and imagination.

In this paper we study security concerns and protection needs (we define security broadly to include areas such as safety and privacy) of carers of children with ASD who access online services through home PCs, mobile phones, tablets, etc. Security technologies that might otherwise be used by carers (e.g., parental controls) to protect their children are often designed for security, not usability [26], and therefore may not take into account the special needs of some users. With ASD, children can display obsessive behaviour with internet-capable technology and they are also particularly exposed to strangers misrepresenting themselves online. In addition, they can have difficulty predicting what the technology will do, the risks associated with sharing information, and how others may perceive shared information [4]. This makes ASD children a potential ‘at risk’, marginalised community of internet users. Responsibility for the protection of childrens’ online activities remains solely with their carer, who undertakes this role, along with caring for their physical and emotional needs.

There has been significant research into the behaviour of children with ASD spanning over five decades [2, 13, 23] with more recent innovative research looking at technological solutions to aid well-being and experience [16, 17, 28, 29, 33]. In some cases, this has resulted in related benefits for parent carers, e.g., by showing parents a child’s perspective [24]. Others have specifically examined the needs of carers of people with ASD, though this has tended to focus on specialist carers such as therapists [19]. Related work has investigated the needs of more informal carers, though not for ASD [30]. In terms of security protection, researchers have investigated options for helping people with special needs using assistive technologies, such as for people with ASD [20], for people with visual impairments [1, 9], and for older adults [6]. However, there is little research that focuses on understanding and supporting carers’ security concerns for their children. One exception is studies on the relationship between parents and teens for security and privacy [7, 34]. Cranor et al. [7] investigated the different perspectives that parents and their teenage children have on privacy and technology, and they studied parents’ use of some technology, such as monitoring software. However, in cases where children have special needs, such as children with ASD, there can be new challenges, and given the wide range of the autism spectrum, families could face unique challenges requiring varying levels of support.

Thus, our aim was to investigate the challenges of carers of children with ASD, and the methods they use to address these challenges in order to protect their children online. To achieve this aim we sought to answer the following research questions:

  • RQ1: How do carers characterise the online behaviour of their autistic children, and how do the characteristics affect the children’s online security?

  • RQ2: What are the challenges to carers’ ability to protect autistic children online?

To answer our research questions we conducted two workshops with 16 parent carers of children with ASD in which we used rich pictures (RPs) [3] and focus group discussions to gather carer responses. While our focus was on ASD, we felt that our results could be more broadly applicable. Our use of RPs to augment a traditional focus group discussion was motivated by similar approaches for novel user engagements to better understand their security and privacy needs [11, 14].

Our main contribution here is to provide novel insight into a carer’s experience of, and perspective on the online activity of children with ASD. Additionally, and drawing partly on these insights, we discuss design implications for developing supportive tools for carers and children with ASD. We believe this to be the first study of the challenges of protecting an autistic child online from the perspective of a parent carer.

2 Background

Autism spectrum disorder (ASD) is a permanent developmental disability that affects all aspects of communication, usually resulting in an impaired ability to socially interact. People with ASD often have difficulty making sense of the world around them and thus can have a variety of care needs. Those with ASD often have an almost obsessive desire for ‘sameness of environment’ and a constant unchanging daily routine [2]. Many of those on the autism spectrum have unique and diverse abilities in visual skills, music and academic skills. Others have significant learning disabilities and are unable to live independently. People with ASD come from all nationalities and cultural, religious and social backgrounds. There are around 700,000 people in the UK diagnosed with autism with a majority of male over female [5]. Online communication devices, computer programs, apps and other technological resources can be extremely beneficial tools for individuals with autism. There has been considerable data collection and research into autistic online behaviour with evidence to suggest that the internet offers a ‘comfortable space more suited to the autistic communication style’ [13]. Benford [4] suggests that the introduction of the internet has encouraged the autistic community to better communicate with each other via chatrooms and bulletin boards and thus social isolation is reduced. However she also advises of negative issues for autistic people online suggesting they may be particularly vulnerable to individuals misrepresenting themselves or to the possibility of over-reliance on computer-mediated interaction resulting in an exacerbation of obsessive behaviour and withdrawal from face-to-face interaction. Davis [8] sees internet use as a continuum with healthy use on one side and pathological use on the other with problematic use of the internet being less of a product of the technology and rather the responsibility of the individual. Hartikainen et al. [15] suggest that restriction and monitoring controls are required however they stress the importance of a trusting parent-child relationship and collaboration of both parties for any design solution.

There are several studies that investigate the efforts of parents to protect their children’s security and privacy online. Rode [25] performed an ethnographic study with 14 households and categorized the households based on how security roles were allocated in the family, and described a set of five rules that parents used to protect their children online. We identify similar rules in our study. Yardi and Bruckman [35] discovered a diversity of parental approaches, with parents often struggling to find the right balance between control and independence for their children. Cranor et al. [7] examined the different privacy perspectives of parents and their teens and found differences, especially for access to text messages. Further, they highlight communication problems as a key challenge, and for parents this often resulted from their lack of experience with some technology. Wisniewski et al. [34] examined the effects of different strategies by parents to protect their children’s privacy, finding that direct intervention (e.g., using parental controls) reduced child risk but at the cost or limiting the benefits of a child’s online interactions. However, the above research has not tended to focus on children with special needs, such as children with ASD.

In terms of caregiver support. Kientz et al. [19] focused on assisting caregivers with their support of children with ASD, where caregivers referred to therapists (e.g., behavioural, occupational, speech) who were external to the child’s home and who are trained to treat children with ASD. They investigated technology solutions used to gather information about a child’s behaviour (e.g., wearable sensors) in order to assist a caregiver in their treatment plan. Marcu et al. took a similar approach for families [24]. However, in general there is little focus on supporting family carers, especially in terms of their protection of children with ASD online.

3 Methodology

We recruited carers of children with ASD through a local autism support centre. The centre offers people with ASD, and their families, information, advice and local support. As well as acting as an information hub, the centre works closely with other groups and agencies, collaborating to understand and respond to the needs of the autism community. We advertised on the centre’s Facebook page, inviting carers of children with ASD to one of two 1 to 1.5 h focus group sessions (early afternoon and late afternoon on the same day) on internet security in order to discuss the challenges they face with protecting their children online. Participants registered directly with the centre. Carers who participated in the workshop were compensated with the equivalent of about 30 US dollars. Prior to contacting the centre, our project was approved by our institution’s ethics committee.

Each carer participated in one of two identically-run four-stage sessions. In Stage 1, once participants read a short project description and signed a consent form, we collected age and gender information, and asked participants to provide the age of the persons with ASD who they care for, and their relationship to them.

In Stage 2, we introduced the purpose of the session by presenting two questions that we wanted the carers to consider, under the heading “Internet Security”:

  • Q1: What are your concerns related to the security of the person you care for?

  • Q2: What do you currently do to protect the person you care for?

To stimulate input we made some initial suggestions on areas that groups might consider exploring: passwords, sharing accounts, posting online, making friends and purchasing online. Carers were asked to respond to the questions by drawing their answers with pictures, and 2–3 examples of previous RPs (from areas unrelated to security or child protection) were briefly shown to participants. Participants were split into small groups of 3–4, lead to separate rooms in the centre, and they were provided with a number of coloured markers and a flip chart.

In Stage 3 each group of carers drew their rich picture (RP) responses to the two questions. A RP is a physical picture drawn by many hands which encourages discussion and debate supporting empathetic understanding within groups [3]. Groups were asked for all group members to draw on a sheet (size: 32 × 23”) of poster paper at the same time. We facilitated the sessions with limited input to encourage discussion amongst group members, an approach termed ‘eductive observation’ [3]. An example of one of the RPs produced from the sessions is shown in Fig. 1.

Fig. 1.
figure 1

Rich picture (size: 32 × 23”) example from workshops.

Full size image

In Stage 4 we brought all groups into in a single room, and asked each group to gather beside their pictures, which the facilitators had pinned to the wall, and discuss what they drew and why. Each group did this in succession. This discussion was facilitator-led with carers encouraged to share stories and verbally enhance their picture drawings. The discussion was audio recorded and later transcribed.

Analysis of transcripts (from Stage 4) and RPs (from Stage 3) was achieved by first logically separating the data for each into two key analysis themes, based on the two questions that we posed to the carers: carer concerns and carer protections. The transcripts were then analysed and coded using a grounded theory approach [12] with inductive content analysis [27]. Each of two researchers first independently reviewed and coded the transcripts in order to ensure inter-coder reliability [22], once for concerns and once for protections. The researchers then met to agree on a coding system, after which they re-coded the transcripts. The researchers met again to agree on the final transcript coding, afterwhich the final codes were recorded.

The RPs were also coded using the same coding system. Icons were isolated and categorised when they represented an issue, action or emotion that was particularly significant, expressive, sensitive or descriptive. One researcher took notes during the sessions that were later used to link each RP with different discussions from the transcript. As with Bell et al. [3] we looked specifically for instances where the pictures communicated additional knowledge to the transcribed description. For each transcript code, we recorded which had a RP associated with it, and which did not.

4 Results

In this section we discuss our participant carers, followed by results on Carer Concerns, Carer Protections, and Carer Rich Pictures. For our concerns and protections, we highlight some of the individual carer pictures in Figs. 2 and 3 (p. 14).

Fig. 2.
figure 2

Example concern images

Full size image
Fig. 3.
figure 3

Example protection images

Full size image

A total of 16 carers participated in the two sessions of our study (see Table 1), 14 of whom were female (88%). The seven carers from session 1 (S1) were split into two groups, while the 9 carers in session 2 (S2) were split into three groups. The most frequent age range for the carers was from 41–50 years with 9 carers. Most of the carer-child relationships were parent-to-child (12; 75%) with some step-parent (2; 12.5%) and grandparent (2; 12.5%). The carers were attending to the needs of 18 ASD young people between the ages of 8–25 (mean = 12, med = 11.5).

Table 1. Workshop carers.
Full size table

4.1 Carer Concerns Results Analysis

From the audio transcripts, we coded 103 concerns that we grouped into 5 categories (see Table 2). Below, we summarise the results for each category of concern.

Table 2. Carer concerns. ‘RP’ = # codes with rich pics; ‘No RP’ = # codes without rich pics
Full size table

Buying Online.

There were three concern areas for buying online with examples of inappropriate spending, and carer concern for children’s spending (9 of 20 codes).

  • C7: “and my middle one had spent £2500 within 24 h on two separate cards of mine, on FIFA points.”

  • C9: “if my son had access I would be millions pounds in debt never mind thousands of pounds in debt.”

Further, carers noted examples of the persistent and addictive behaviour of their children to spend, even if unsuccessful, when the spend allowed them to meet other goals, such as the collection of points.

  • C7: “I cancelled my cards that day because at first I thought my card had been stolen. So it’s still the wrong cards that are in, but he now I’ve realised […] he’s still buying transactions with the cards, the same cards, but they’re failing. But he’s found a glitch in the system where he then asks for a refund to get out of the fact that he’s used a failed card, but the system still thinks it’s OK for him to have the points so he’s still getting the points.”

In these cases, it was difficult for children to understand the consequences of their actions, with carers highlighting the misunderstandings of their children, and the challenges of explaining some aspects of spending to a child with ASD.

  • C14: “I said to him ‘you can buy this’ and he wanted to get to the next stage, so he went and got it and bought it! And then I was like ‘But [NAME], that is my money, where am I going to get that from?’ and he goes ‘It’s ok mummy you get interest, cause if you leave your money in the bank the interest comes and you’ll get it all back!’ So a small piece of information that he’s very right about doesn’t mean what he thinks, it doesn’t interpret the same way. So when you’re speaking to him you have to be aware of that.”

Secondly, carers identified how their children gain access to spend (7 of 20 codes):

  • C1: “So one concern is buying things online, so [NAME]’s quite astute when it comes to the internet, so he could quite easily work out how to use a debit card or anything like that.”

Similar to their inability to understand inappropriate spending, carers noted their children’s misconceptions for inappropriately accessing the carers’ account information, and the further challenges for carers in terms of dealing with this behaviour:

  • C14: “And we’ve often been places, like in Asda and I’m putting in my PIN and he goes ‘Mum, is your number still 1234?’ And I’m like ‘It WAS!’ I stand there sometimes and think ‘Oh, shit - I can’t remember my number’ - I’ve changed it that often, and you have to go back up to the bank […] he just needs to see your fingers moving and he’ll tell you what code it is. But he couldn’t spell his surname.”

Thirdly, carers noted concerns regarding the ability of their older children to be able to independently spend in order to manage their well-being (4 of 20 codes).

  • C7: “look at the bigger picture for his future, and his own money in the financial sense, he could just go through any money he’s got on this.”

Meeting Online.

There were two concern areas related to meeting online. Firstly, carers expressed concern regarding who their children meet online (9 of 15 codes), particularly people who might impersonate young children.

  • C8: “my fear is that the hidden people, the deceit and danger that when they do go on they say that they are an eight-year-old the same as him.” (see Fig. 2(b2))

Carers also noted the particular vulnerability for their children as they are less capable to recognise such deceit (see Fig. 2(d2)).

  • C13: “It’s […] the vulnerability because there are people out here who know what they’re doing - victimisation - and obviously our kids are an easy target.”

Secondly, additional concerns were raised regarding children socialising online, and the increased risk to their children of being bullied (6 of 15). One carer noted the challenges that their children have in terms of appropriately adding friends:

  • C2: “Basically what it is - if he’s on Facebook and he has a load of friends on Facebook, and then he adds somebody and then there’s somebody that wants to friend his friends. That’s a danger because one was saying really inappropriate remarks and they were taking it out on him, defriending him because they had allowed somebody to friend him.” (see Fig. 2(f2)).

In another example, children became the target of ridicule based on material they posted (see Fig. 2(e1)).

  • C12: “You know, being the butt of the jokes, he tends to go on Instagram and again a lot of it’s to do with cars, the Grand Prix etcetera, but there’s grid girls, so they’re quite, I mean they’ve got clothes on but some of them can be quite, you know. So somebody likes a lot of things, so when he’s added friends from school, they’ve commented on how he likes that kind of thing.”

This has sometimes resulted in children being rejected online (C12: “you know he’s been booted offline”, see Fig. 2(d1)).

Posting Online.

In terms of posting online, concerns were raised about posting with regard to three groups of people: family, friends, themselves. Firstly, carers raised concerns about their children posting information, primarily photos, of family or friends (6 of 10 codes).

  • C1: “Yeah, I’ve said to her about those pictures - don’t put pictures up.”

  • C3: “And also I said don’t put pictures on of your friends because their parents might not want their child to be on.”

Secondly, carers noted concerns related to the availability of their children’s own photos, and related information (e.g., emojis) that might be associated with the photos (4 of 10 codes):

  • C3: “And also Facebook, they were warned not to check in anywhere in case somebody sees their picture.”

Lack of Solutions.

There were three concern areas related to a lack of solutions. Firstly, carers lamented their lack of skills and experience, especially when compared to their children (8 of 26 codes):

  • C1: “I stupidly don’t know how to protect the account, thankfully her older sister does and she’s sorted all that for me.”

  • C4: “I have difficulty with is I don’t know enough about the security, and putting passwords in, it’s such a vast thing that I don’t know if that would be possible so that would be my concern.”

Secondly, carers highlighted the inadequacy of existing solutions, indicating that while they did implement some solutions, they were frustrated at their inadequacy, or their own inability to make the solutions work for them (12 of 26 codes). This was particularly evident in terms of various types of filters or parental controls.

  • C7: “so that’s the only thing I can do, is switch off the WiFi.” (see Fig. 2(e2))

  • C8: “Some of these things are X-rated. How do you … you can’t control that. There’s nothing you can … There’s no parental control you can put on a music video. So that’s one of the things that affects me.”

  • C11: “all the links that come down the side - one day it was lesbians that came up and he clicked on the video. Now he was in the same room as us and we knew what it was and we could get it off him, but I don’t even know how to set.”

One carer further highlighted the lack of standards across devices, and the negative impact this has for carers for remembering, and properly setting, privacy protections:

  • C9: “but then the phones have different privacy settings as well. So you can’t access the same things on a phone that you can do on a computer.”

Thirdly, carers highlighted general concerns related to their difficulties with communicating with, or influencing their autistic children (6 of 26 codes):

  • C1: “Ben just doesn’t seem to have a barrier, he’ll speak to anybody, as long as it’s not to peers.”

  • C6: “He’s very very private, even with other people he doesn’t like other people knowing, if he was doing a presentation in school about himself he’d refuse to do it, because he doesn’t want people to know about him. So it’s very difficult to keep tabs on what he’s doing.”

Inappropriate Behaviour.

We coded behaviours as inappropriate if the behaviour went against the stated wishes of the parent. This included codes for concerns already covered above (statements could be assigned multiple codes), related to inappropriate spending and posting of material online, and to two additional areas: creating accounts, and accessing inappropriate material. Whether the behaviour was intentional or not is difficult to determine, moreso for children with ASD.

Firstly, carers expressed concern about the ease with which their children could create online accounts, even if the child was forbidden to do so.

  • C1: “we disable a Google account but he just goes back in and can do another one. Or he can go and make another Facebook account. And he knows that if his date of birth doesn’t work, he just puts my date of birth in!”

  • C9: “Cos my sister in law set it up for and I was a wee bit, I wasn’t very happy about it but my sister-in-law had it set up for her before I could even say I don’t want that for her at this moment in time so.”

Secondly, carers expressed concern regarding the ability of their children to access to inappropriate material.

  • C4: “has access to all the information that’s on the internet, including drugs, so we had a bit of a misfortune with that.”

  • C5: “And also, I drew a bunny rabbit because I can’t draw Mario and Luigi! But you watch a video on YouTube of Mario and Luigi or something, quite innocent, and the language in the background by the men who are playing the game and demonstrating it is, absolutely horrendous. And swearing … so you think it’s something that’s OK, but it’s not.” (see Fig. 2(a2))

  • C9: “On my son’s iPad which I didn’t even think he’d be able to access [X-rated material]. And my mouth fell open. I was like that, oh my goodness.”

In some cases, in an attempt to convey a behaviour that is inappropriate to their children, parents can struggle with verbalising, though their thoughts were better captured by their picture.

  • C5: “Don’t put on pictures that are not suitable of us, or don’t look at pictures that are … you know.” (see Fig. 2(a1))

Concerns Summary.

In many cases, carers identified actions by their children for which the carers wanted more knowledge or control. Throughout, we asked carers to confirm that the challenges were specific to their children with ASD. This was confirmed by the carers, and while the concerns bear some resemblance to cases with children without ASD, carers noted clear differences, e.g., C7: “I think the vulnerability, they just don’t see danger, they can’t sense danger. They can’t see the big picture, because they tunnel-vision, it’s black and white, no grey areas.” This should not be surprising and is reflective of the wide spectrum within ASD. The difference, in most cases, comes in terms of the challenges of protecting the child and influencing their behaviour, discussed further below.

4.2 Carer Protections Results Analysis

From the workshop transcripts, we coded 69 protections that we grouped into 3 categories (see Table 3). Below, we summarise the results for each protection category.

Table 3. Carer protections. ‘RP’ = # codes with rich pics; ‘No RP’ = # codes with no pics
Full size table

Control Access.

Carers highlighted four approaches to controlling online access for their children. Firstly, carers indicated that they use physical controls in order to limit the online access of their children (10 of 27 codes), such as turning off WiFi hubs, and taking away devices such as smartphones and iPads so that they are not accessible in areas such as bedrooms and dinner tables.

  • C1: “how I protect my wee boy is I take the hub away. I have to take the internet hub off so I disconnect it.” (see Fig. 3 (a1))

  • C5: “We also do no iPads at the dinner table. We’re all 5 of us at the dinner table, if they’re on their own then that’s fine but when we’re having the 5 there’s no iPads.” (see Fig. 3(d1))

  • C7: “my kids aren’t allowed any gadgets - they’ve got no TVs, XBoxes or anything - in their rooms.”

With regard to controlling the use of devices, carers also highlighted some challenges in terms of maintaining control:

  • C5: “I have confiscated the iPad, so her answer was ‘Well I’ll just use YouTube and use the internet on my phone. So I confiscated the phone, so then on went the computer, at which point that had to be confiscated and she now has a Fire box on her TV so she can get YouTube on her TV!”

Secondly, carers indicated that they try to hide information, such as passwords and bank card details, and also make use of one-time vouchers (6 of 27 codes).

  • C5: “When my kids use like iTunes or Google Play, I never ever put my bank account details in, I always use the cards, the vouchers.”

  • C8: “hidden passwords still work.”

Thirdly, carers indicated that they filter their children’s access, either by content, or time-of-day (4 of 27 codes).

  • C5: “We have a thing set up where Netflix and things, that anything that’s a PG is available all day but beyond 9 o’clock at night then my oldest daughter can access 15 s and things. Which is good because it means we’re not worrying about Netflix during the day.”

  • C6: “The settings on the iPad are all, he can’t access anything 18-plus or anything like on YouTube.”

Fourthly, carers also indicated that they will sometimes disable their children’s online accounts (2 of 27 codes), though these measures can have limited effects.

In the remaining cases (5 of 27 codes), carers indicated that they control access, but did not share a specific approach, e.g., C11: “We’ve just got him off YouTube now”.

Monitor.

Carers described several ways in which they monitor their children that we grouped into four areas. Firstly, they will use (specific) observation of their children’s devices (5 of 21 codes):

  • C9: “but I do now and again check his iPad to see what he’s been up to, so far he’s been all right. It’s been fine.”

Secondly, carers use a shared space for their computers (4 of 21 codes), though this has some challenges in terms of maintaining consistent supervision.

  • C7: “but our main PC is downstairs in a communal area, and we all kind of share it.” (see Fig. 3(c1))

  • C14: “But even if you’re in the same room with him - I’m probably in the next room bathing a child or out in the kitchen making something for tomorrow, so even though he’s in a public area, I’m very rarely there, so he might as well be in his bedroom with the door closed at times.”

Carers also used shared passwords, where they knew the passwords used by their children (2 of 21 codes):

  • C5: “We also have it where I know all my childrens’ passwords, and they don’t know when I’m going to check but it’s something we do.”

Thirdly, carers indicated that they will sometimes take a ‘first pass’ before their children visit a particular site, in order to ensure that it’s appropriate (3 of 21 codes):

  • C14: “But before he does that, I have to sit through it to make sure there’s no bad language, or there’s nobody asking people to do anything.”

Fourthly, participants provided examples of general observations (7 of 21 codes), indicating that they intend to monitor their child, but were not specific about how:

  • C12: “it’s about allowing him certain things because he is of that age but obviously we need to keep tabs on things.”

Instruct.

Carers indicated that they would instruct their children in order to protect them, which took the form of rules, teaching, or establishing conditions. Firstly, carers indicated that they used rules (15 of 21 codes), which included the controlled use of devices (discussed under “control access” above), as well as in response to concerns related to meeting and posting online.

  • C3: “And also Facebook, they were warned not to check in anywhere in case somebody sees their picture.”

Secondly, there was also some indication from carers that they attempt to educate their children as well (3 of 21 codes), though no specific methods were given.

  • C15: “you try to teach them, but it’s a hit or a miss whether they take in on board.”

Carers also tried to enforce conditional rules, rather than absolute rules.

  • C14: “If he wants to go on the iPad there’s a few rules - homework has to be done, then he can have it.”

Protections Summary.

Carers identified several protection measures, and highlighted their limited effectiveness. For the most part, the protections used by carers were rather one-sided, and did not always support a collaborative carer-child communication [7, 15]. For example, protections were often negative (“don’t”, “can’t”), involved hiding or controlling information such as devices and passwords, and included secret monitoring of children’s behaviour. There was some evidence of more progressive attempts by carers, including performing a “first-pass” review of an online site, and attempts to educate their children, though carers were only able to provide general approach descriptions.

4.3 Carer Rich Pictures

Of the 103 carer concerns we coded from the transcripts 57% (59/103) drew an image associated with the concern. Noticeably some concerns seemed simpler for the carers to illustrate visually whereas others seemed more complicated. In terms of posting online, of the 10 concerns coded, 9 had illustrated pictures (90%) suggesting that this particular concern may be more easily visualized. Meeting online concerns (73%) were also popular images to draw. The most difficult concern to visualize was a lack of solution (42%). In terms of protections, 40.5% (28/69) of the 69 protections that were coded from the transcripts had a rich picture associated with a protection. Controlling access protections were pictured by around half (52%) of the participant carers, while both monitoring (28.5%) and instructing (26%) protections had fewer associated pictures, suggesting they may be more demanding to illustrate.

Figures 2 and 3 represent image samples drawn within the six RPs from our workshops. There were some images that highlight and provide added insight to a concern or protection which was discussed orally. In some instances these images more readily offered enhanced clarity, more tacit understanding and stress the magnitude of the issue compared to the descriptive words. For example:

  • Figure 2(a1) is a prohibition image [3] representing a restriction (naked body images posted online) and the crossed sign through the circle shows the prohibition. The picture appears unambiguous and clear whereas the descriptive text appears more vague: C5: “don’t put on pictures that are not suitable of us, or look at pictures that are, you know.”

  • Figure 2(d2) depicts a monster preying on the vulnerable. This is a powerful image that enhances the magnitude of the issue described vocally by C13 as “there are people out there who know what they are doing, victimisation, and obviously our kids are an easy target.”

  • Figure 3(b1) illustrates a child saying no when an iPad is confiscated. This illustrates high level anxiety and distress by the two layers of jagged red lines encompassing the child. The vocal description contributed by C5 was “If I confiscate the iPad it’s a minor explosion.”

Across the six RPs in this study we isolated 14 instances of prohibition [3]. For example, Figs. 2(a1) and 3(a1) show strong visual images that clearly, and with determination, show what is not allowed or desired. Figures 2(b1) and (c1) demonstrate highly visual examples of the pictures carers drew to illustrate inappropriate behaviour. Figure 2(b1) represents the dangers of a child discussing another person online. The blindfold, in this picture, illustrates the lack of face to face interaction and the concern of gossip. Figure 2(c1) depicts the inappropriateness of posting photographs of family members on Instagram. Meeting people online was illustrated very vividly. Images (a2, b2, c2, d1, d2, e1, e2, f1, f2) in Fig. 2 all represent the issues and challenges carers face, or worry about, when their children are online. Facebook icons (Figs. 2(c2) and (f2)) were a common image with many depicting the dangers of inappropriate remarks online and the ease with which a child can set up an account outwith the Facebook age restriction. Across all RPs we had two pictures depicting naked bodies (Figs. 2(a1) and (f1)) which, when described, allowed the carer to vocalise a private and possibly difficult concern to openly discuss with others in the workshop. Many of the images give very explicit visual depiction of the concern or protection. Other images were open to interpretation and we needed to code the transcript and pictures jointly to clarify the concern or protection.

5 Discussion

Below, we discuss the key results in terms of our two research questions.

  • RQ1: How do carers characterise the online behaviour of their autistic children, and how do these characteristics affect the children’s online security?

Carers described their autistic children using a wide variety of expressive words such as “astute”, “vulnerable”, “private”, “oblivious”, “clever”, “devious”, “tunnel-visioned”, “obsessed”, “lonely”, and “naïve”. These adjectives show the diversity and indeed the paradoxical nature of characteristics that affect online behaviour and further indicates the range of contradictory difficulties carers have with keeping their children safe online. Further, though the categories and concern areas for children with ASD bear some resemblance to those for neuro-typical children, carers indicated greater concern for the risk to their ASD children, For example, carers gave very personal and alarming examples of extreme spending by their children, giving insight into the secretive and often devious nature of children with ASD. Carers noted that the abilities of their children, at least in terms of memory, contributed to their inappropriate behaviour online, and their ability to take advantage of their carers. Carers also highlighted issues relating to addictive behaviours and an inability to understand the consequences of spending online. Carers were in agreement regarding their children’s compulsive behaviour patterns and obsession with online devices and certain websites. They shared stories concerning distressed emotional behaviours when children were prevented from being online.

Carers expressed strong concern regarding the ability of their children to distinguish strangers from friends due to an inability to detect falseness and deception. In particular, carers drew very expressive pictures about the vulnerability of their children and how they are less capable than their peers to recognise impersonators and the dangers associated with socialising online. Carers further suggested that their children may be more susceptible to behaviours such as bullying, when compared to other children, due to their inability to distinguish between sincerity and duplicity. Similarly, in terms of posting online, carers indicated that their children had difficulty with predicting the risks themselves and others with sharing personal pictures. Carers suggested their children had exceptionally high skills in some technical and memory areas, such as online gaming, setting up accounts and remembering passwords and very low social skills, such as understanding jokes, figures of speech or sarcasm.

The behaviour of children with ASD, combined with their increased vulnerability and inability to understand consequences makes them challenging to protect.

  • RQ2: What are the challenges to carers’ ability to protect autistic children online?

Carers expressed frustration with their own technical inadequacy, the limitations of current technology, as well as the wider gap between them and their high performing children in terms of technical skill. Carers noted that some of their children possessed greater skills and had more technical knowledge than themselves, though carers also highlighted non-technical issues such as difficulties with communication and regulating parental controls. Some carers could illustrate their challenge in pictorial form better than, and with more clarity, words, such as drawing pictures of naked bodies to illustrate inappropriate online pictures. In terms of protections, carers often resorted to physical protections and rule setting. Physical protections seemed to work reasonably well, though not always (e.g., with children finding alternative ways online). Physical controls (such as confiscating a child’s computing device) also exacerbated behavioural issues (e.g., C5: “if I confiscate the iPad it’s a minor explosion”). Turning off the WiFi was another physical method to control access, though it has the effect of limiting service for the remainder of the family. One participant stated that she tapes off the camera on the laptop to stop webcam communication whilst another carer used a clock timer to limit internet use. Carers also highlighted several ineffective measures, such as disabling a child’s account, since it was easy for children to set-up a new account and setting parental controls on streaming platforms such as Netflix when children would use clever solutions and ways to flout the limitation.

Rule setting, while seemingly easy for carers to establish and on which there seemed to be significant reliance, had low compliance. Some carers described improved compliance when they set conditions to the rules, such as homework to be completed before a device is allowed. The rule delivery, often in the form of an oral warning, was sometimes recognized as vague and open to interpretation by the child, requiring some carers to regularly repeat rules (C4: “but we always keep reminding him”). In some cases, rules were used to compensate for lack of knowledge and technical skill (C14: “He’s not allowed to go online, he’s not allowed on chats because I wouldn’t be able to control that, he’d be far more advanced than me.”).

Some of the carers discussed the challenges of monitoring technologies. A popular form of monitoring was to have communal areas for the family PC and another was to physically check what the child has been doing online, though both protections were difficult to consistently monitor and supervise. Another issue with maintaining observation was that children can set and change passwords to physical devices as well as to networks they are visiting online thus making supervision very problematic. This behaviour attests to the obsessive and somewhat devious nature of children with ASD.

Overall, carers provided more pictures to illustrate their concerns than their protections, and in some cases communication was enhanced by the pictures. Many of the stories the carers shared with us were private and personal and we found the pictures provided a safe and friendly platform for non-intrusive group engagement. In several cases, pictures said in one simple drawing what a carer struggled to articulate with words alone (see Sect. 4.3).

6 Design Implications

While recent research promotes the need for trusting relationships and collaboration, and good carer-child communication [7, 15], we found that most carers struggled to consistently influence and protect their children. In many cases, carers struggled with current technology, and with teaching their children. We suggest here some potential educational design approaches that draw upon our analysis of parent carer concerns and that could be explored further for assisting carers and their children.

One approach for directly addressing the behaviour of children with ASD online could be to support children in asking questions, similar to Hong et al.’s [17] use of social networks. Though in addition to relying on subjective advice, and requiring specialist knowledge, such an approach would require a child with ASD to first identify that there’s an issue, and then pause their primary task in order to ask a question. Further, for the security challenges that we’ve identified, such an approach would need to ensure that it addresses related ethical and privacy concerns. We find this question/answer approach unsuitable for children with ASD as they are unlikely to be aware of danger or be able to identify possible future risk. To repeat from RQ1, our carers identified their children’s online behavior as oblivious, and naïve. From our results, we envision two possible options to support the communication and collaboration between carers and children. Firstly, augmenting the work of Hong et al. [17], we suggest the design of collaborative tools in which children can ask questions of their carers, rather than asking on open social media. Carers could then provide a more informed response, possibly interacting with other carers for answers. This would enable people who know the child to assist them in managing their privacy while also giving them the ability to make their own decisions. Secondly, we suggest a tool that would enable a user to post content contingent on the approval of a trusted person, such as a carer. In cases where the action is appropriate, the posting decision can proceed without further involvement of the child. Alternative cases can be used to initiate a discussion between carer and child. Such tools would need to address several challenges, such as identifying adequate incentives to encourage use by children and carers, supporting privacy control for the child, and options for identifying subsets of posts for approval based on content.

In addition, we propose that an education-based approach could be used, drawing on previous use of comic strips for engaging children with ASD [21]. Such an approach could be investigated as a means to explain security issues that children with ASD might encounter online, and could leverage rich pictures. Also, approaches that could improve the awareness of possible posting issues, could help children with ASD to make more informed decisions. Wang et al. [31] have studied issues of posting online and regret, and investigated a nudging solution to help people to realise the potential audience of their post, prior to posting. In some cases, the solution was perceived as helpful, while in others, it was intrusive. However, the solution has not been evaluated with people with special needs. Taking into account the work of Lewandowski [21] and Wang [31] we suggest a combined approach to assist children with ASD online through the development of an intelligent educational nudging tool using, where possible, pictures to explain security issues. Similar to Wang et al. [31], nudges could provide additional information to a child about the reach of a potential post (e.g., this video post will be seen by strangers), where such information might be based on a set of rules established by carers (e.g., C3: “don’t put pictures on of your friends because their parents might not want their child to be on”). This could allow an autistic child to follow home rules online. We envision such a nudging tool to be used primarily by the child but there is scope for carers to benefit from a tool that could warn them about possible security issues concerning their child.

From our workshops, we found that carers enjoyed sharing experiences with other carers, and learning the successes and failures of other carers, in a supportive sense, and to learn new protection approaches for caring for their own children, e.g., C7: “I’ve learned an awful lot from different parents, more than I’d ever learn from the internet.” Carers identified a lack of technical knowledge, though they did not always recognise their inconsistent application of rules, which resulted in ineffective interactions and limited benefits for a child with autism. Tixier and Lewkowicz [30] identified similar benefits for older carers. As an unfortunate example of the current state of access to support for carers, the local autism centre used for our study has since lost its funding and closed. Thus, solutions that could support carers online potentially offer significant benefits. Drawing on these results, we propose the development of an online collaborative resource for carers of children with ASD.

7 Concluding Remarks

Children with ASD can introduce unique challenges for ensuring their protection online, and carers can struggle to find appropriate protection combinations. In this paper we identified challenges faced by carers for protecting their children online. In particular, carers struggle to consistently enforce protections, and to find ways to influence their child’s behaviour. Drawing on the input from our carers, we suggest designs for several educational nudging tools to better support carers and to keep their children safe online.

For our future work, we plan to work directly with children with ASD, first to investigate more closely what they understand about security and privacy on line, and secondly to explore some of our educational approaches with families in order to influence children’s behaviour, and hopefully ensure their online safety. We also plan to further explore the differences between ASD children and neuro-typical children.

Limitations.

Our study was run from a parent carer perspective, with a limited set of carers from a particular geographic area so that studies with other carers and with children with ASD. would be helpful in order to confirm the identification of similar concerns. While our focus groups seemed helpful for allowing parent carers to interact and convey more information in some cases, interviews could also be used to elicit more specific concern and protection information.