[my last name]@wisc.edu

Julia Nonnenkamp (she/her)

I’m a 3rd year computer science PhD student at the University of Wisconsin–Madison advised by Dr. Rahul Chatterjee in the MadS&P (Security & Privacy) research group. Previously, I did my undergrad in math and computer science at Georgetown University, where I was a Fritz Fellow with GU’s Tech & Society Initiative and had the privilege of working with Dr. Elissa Redmiles and Dr. Lisa Singh through the Massive Data Institute and Georgetown Law’s Center on Privacy & Technology.

I’m interested in making software security & authentication better for everyday people by building and evaluating systems. Much of my work focuses on unique considerations that arise in shared home environments and for users experiencing tech-facilitated interpersonal violence.

I am the director of the Madison Tech Clinic, a volunteer initiative that provides trauma-informed cybersecurity assistance to survivors of intimate partner violence around Wisconsin. I spend way too much of my free time on the NYT Cooking site and not nearly enough of it implementing my saved recipes.

Are you a security expert who does direct advocacy with at-risk users (e.g., IPV survivors, journalists)? Let's connect!

news

Aug 2026	I presented a poster on our data export work at GREPSEC @ USENIX Security.
Jun 2026	Very excited that our paper on accessible security notifications (led by the wonderful Hailey Johnson) is accepted to ASSETS 2026!
Feb 2026	I gave a talk about the Madison Tech Clinic at UChicago’s first ever Tech for Good Conference. Very grateful to the organizers for putting it together!
Oct 2025	I presented our paper, Hidden in Plain Bytes, at ACM CCS in Taipei.

(see more...)

publications

“I’m trying not to get hacked:” How Adults with Intellectual and Developmental Disabilities Navigate Security and Privacy Notifications

Hailey L. Johnson, Julia Nonnenkamp, Bilge Mutlu, and Rahul Chatterjee

To appear in ASSETS, Oct 2026
Hidden in Plain Bytes: Investigating Interpersonal Account Compromise with Data Exports

Julia Nonnenkamp, Naman Gupta, Abhimanyu Dev Gupta, and Rahul Chatterjee

ACM CCS, Oct 2025

Abstract DOI PDF Slides

When survivors of technology-facilitated abuse (TFA) suspect someone has accessed their online accounts, they often rely on built-in account security interfaces (ASIs), such as trusted device lists within settings, to assess account compromise. However, these interfaces typically offer limited or ambiguous details about past account accesses and security-critical events. Under right of access provisions in data protection laws, users can request structured exports of their personal data from online services. In this study, we explore whether and how data exports can supplement ASIs to support compromise investigations, particularly in interpersonal threat contexts. We simulated four types of account compromise attacks across six popular platforms, analyzing the resulting data exports and ASIs. Our findings show that data exports consistently contain more granular login histories and richer device/network identifiers than interfaces. Some even link security-related actions (e.g., password changes) and other post-authentication activity to specific devices, offering forensic value for identifying compromise. We discuss usability and other practical challenges of using data exports during TFA interventions.