Julia Nonnenkamp

I’m a 2nd year computer science PhD student at the University of Wisconsin–Madison. I’m advised by Dr. Rahul Chatterjee in the MadS&P (Security & Privacy) research group.

I’m interested in software security & authentication for everyday people, including accessibility, mitigations for tech-facilitated abuse, and digital evidence in family law. I volunteer at the Madison Tech Clinic providing trauma-informed, cybersecurity assistance to survivors of intimate partner violence (IPV) around Wisconsin.

Before UW–Madison, I did my undergrad in math and computer science at Georgetown University (and became a tech policy wonk by osmosis). I was involved with GU’s Tech & Society Initiative as a Fritz Fellow. I had the privilege of working with Dr. Elissa Redmiles, Dr. Lisa Singh, the Massive Data Institute, and Georgetown Law’s Center on Privacy & Technology auditing forensic DNA analysis software systems. I also interned with the U.S. Office of Management and Budget, where I learned an enormous amount about how to make government and its digital systems work better for the people they serve.

I spend way too much of my free time on the NYT Cooking site and not nearly enough of it implementing my saved recipes. I’m nebulously training for a half-marathon.

Email me at [my last name]@wisc.edu.

news

Oct 2025	I presented our paper, Hidden in Plain Bytes, at ACM CCS in Taipei.
Sep 2025	I’m co-organizing the MadS&P Seminar this year. Interested in being a guest speaker? Email me!
Jul 2025	Our paper about identifying account compromise using GDPR data exports got accepted to ACM CCS 2025!
Nov 2024	Our lab attended the Midwest Security Workshop at Purdue.
Aug 2024	I started my MS/PhD at UW-Madison.

publications

Hidden in Plain Bytes: Investigating Interpersonal Account Compromise with Data Exports

Julia Nonnenkamp, Naman Gupta, Abhimanyu Dev Gupta, and Rahul Chatterjee

ACM CCS, Oct 2025

Abstract DOI PDF

When survivors of technology-facilitated abuse (TFA) suspect someone has accessed their online accounts, they often rely on built-in account security interfaces (ASIs), such as trusted device lists within settings, to assess account compromise. However, these interfaces typically offer limited or ambiguous details about past account accesses and security-critical events. Under right of access provisions in data protection laws, users can request structured exports of their personal data from online services. In this study, we explore whether and how data exports can supplement ASIs to support compromise investigations, particularly in interpersonal threat contexts. We simulated four types of account compromise attacks across six popular platforms, analyzing the resulting data exports and ASIs. Our findings show that data exports consistently contain more granular login histories and richer device/network identifiers than interfaces. Some even link security-related actions (e.g., password changes) and other post-authentication activity to specific devices, offering forensic value for identifying compromise. We discuss usability and other practical challenges of using data exports during TFA interventions.