Losing a child tragically impacts the well-being and functioning of parents. With these effects extending beyond emotional, physical morbidity and compromising self-perceptions, appropriate, longitudinal, timely and personalised support is key to effective care of bereaved parents. However, in the absence of a comprehensive understanding of parental bereavement, effective support of bereaved parents remains suboptimal. To address this gap, we scrutinise prevailing data on the effects of a child’s death, aged 0–12 years, through the lens of the Ring Theory of Personhood (RToP).To study prevailing accounts of bereaved parents following the death of a child, we adopt Krishna’s Systematic Evidence Based Approach (SEBA) to structure our Systematic Scoping Review (SSR in SEBA).Three thousand seventy-four abstracts were reviewed, 160 full text articles were evaluated, and 111 articles were included and analysed using thematic and content analysis. Four themes/categories were identified relating to the four rings of the RToP. Findings reveal that static concepts of protective and risk factors for grief are misplaced and that the support of healthcare professionals is key to assisting bereaved parents.In the absence of consistent support of bereaved parents, this study highlights the need for effective training of healthcare professionals, beginning with an appreciation that every aspect of an individual parent’s personhood is impacted by the loss of their child. Acknowledging grief as a complex, evolving and personalised process subjected to parental characteristics, settings, context and available support, this SSR in SEBA calls attention to effective nurturing of the relationship between parents and healthcare professionals, and suggests use of the RToP to assess and direct personalised, timely, specific support of parents in evolving conditions. We believe the findings of this review also call for further studies to support healthcare professionals as they journey with bereaved parents.The online version contains supplementary material available at 10.1186/s12904-021-00831-1. The loss of a child has tragic implications upon a parent’s wellbeing , 2 and sIt is to this sense of disruption of a parent’s concept of personhood or “what makes ‘you’ you” –35 that The employ of the RToP to capture the impact of bereavement is not new –32. The Here, the RToP’s unique ability to capture change in the parent’s perspective of themselves and their relationships , roles iThe Innate Ring is the innermost ring of the RToP and may be seen to derive itself from the genes that define oneas human and the individual’s religious beliefs, such as their ties with a Higher Power. The Innate Ring is also shaped by historical factors such as the person’s gender, race, culture, religion and heritage that they are born into. The combination of all these considerations confers the individual with respect and rights reserved for all human beings until their death. Here, the RToP's dynamic nature may be used to capture change in the bereaved parent’s  spirituaThe Individual Ring builds upon the Innate Ring and relates to the person’s conscious function, ability to think, feel, communicate, act and maintain his or her own personhood. The loss of conscious function eliminates the Individual Ring. The Individual Ring guides the motivations, inclinations, thoughts, traits and actions behind their individual identity. The RToP’s ability to detect change in the Individual Ring will help healthcare professionals better understand the bereaved parent’s thought process, emotions and coping mechanisms , 40.The Relational Ring contains relationships that the individual determines to be important to them. These relationships may be with family members or friends. For bereaved parents, it is members of the Relational Ring that often provide comfort and support. Changes within the Relational Ring will highlight support and stressors upon the bereaved parent .The Societal Ring, which is the outermost ring, contains relationships with colleagues, acquaintances, contacts and members of networks that the individual does not have significant personal ties with. The Societal Ring also houses cultural norms, professional standards, and societal obligations such as familial, professional, and societal expectations prescribed to the individual within their role in the community. The Societal Ring will also capture society’s support and consideration for the bereaved parent as well as the parent’s perception of their cultural and social roles and responsibilities , 43.Perhaps more significantly, each ring contains specific values, beliefs, principles, and expectations that come together within the Individual Ring and influence preferences, motivations, decisions and biases, thoughts, and actions. This highlights the interrelatedness of the rings and the central role of the Individual Ring. Concurrently, changing conditions , evolvinA systematic scoping review (SSR) has been undertaken to study the scope and depth of current data on the complex multidimensional aspects of grief , 50 and However, the reproducibility and transparency of current forms of SSRs are subject to concern due to a lack a consistent approach to structuring, reporting and analysis of the included data. To counter these issues, Krishna’s Systematic Evidence Based Approach (SEBA) guided SSR (henceforth SSR in SEBA) is adopted. Built on a constructivist perspective and a relativist lens, SSRs in SEBA are able to effectively contend with the notion of psychological constructivism  used to In keeping with the SEBA methodology, a team of experts was engaged to oversee and advise the research team at all stages of the research process. This expert team included a medical librarian from the Yong Loo Lin School of Medicine (YLLSoM) at the National University of Singapore (NUS) and local educational experts and clinicians at the National Cancer Centre Singapore (NCCS), Palliative Care Institute Liverpool, YLLSoM and Duke-NUS Medical School. They served to enhance the accountability of the SSR in SEBA findings.Conforming to the SEBA methodology, the research and expert teams adopted the principles of interpretivist analysis and immersed themselves in the data through repeated reading, analysis and reflexive discussions so as to piece the qualitative data together in a meaningful manner –66. The i.Determining the title and background of the reviewIn order to ensure a systematic, reproducible and transparent approach to the review, the expert and research team discussed and agreed upon the overall goals, study population, context and concept to be evaluated.ii.Identifying the research questionThe four members of the research team discussed the research question with a medical librarian from the expert team. Guided by the Population Concept, Context (PCC) elements of the inclusion criteria, the research question was determined to be: “How is the personhood of parents affected by the death of their child (aged 0 to 12 years)?” The secondary research questions were determined to be: “What are the key characteristics of the bereavement process for parents?” and “How do their relationships with others change following the death of their child?” To help focus attention upon the loss of a child we adopted the World Health Organisation’s classification of a child and a young child .iii.Inclusion criteriast January 2000 and 31st December 2020 were included in the PICOs [All grey literature, peer reviewed articles, narrative reviews, systematic, scoping and systematic scoping reviews published between 1he PICOs , 69 outliv.Searchingst January 2000 and 31st December 2020. The searches were carried out between 18th October 2020 and 17th January 2021 using the following search terms: “personhood”, “selfhood” AND “end of life”, “palliative care” AND “death”, “sudden death”, “neonate” AND “infant”, “paediatrics’” and their combinations. The search strategies are presented in Additional file Four members of the research team carried out independent searches of four bibliographic databases  and a grey literature database (Google Scholar). In keeping with Pham, Rajić ’s recommv.Extracting and chartingresearch team members articulate, defend, and persuade others of the “cogency” or “incisiveness” of their points of view or show their willingness to abandon views that are no longer tenable. The essence of negotiated validity is consensus.” (p.229) This final list was then reviewed by the last author.Using an abstract screening tool, the research team independently reviewed the titles and abstracts to identify a list of relevant articles believed to be of relevance that met the inclusion criteria that were set out in Table entire experience of anticipating a death, the death itself and the subsequent adjust to living” [The research team was divided into two teams to concurrently analyse the included articles using Braun and Clarke ’s approa living” . All 111“represent some level of patterned response or meaning within the data set” [In Phase 1 of Braun and Clarke approach, an iterative step-by-step thematic analysis was carried out by a team of three researchers who who independently and actively read the included articles to identify meaning and patterns. In Phase 2, ‘codes’ were constructed from the ‘surface’ meaning and collated into a code book to code and analyse the rest of the articles using an iterative step-by-step process. As new codes emerged, these were associated with previous codes and concepts. In Phase 3, codes were organised into themes that ata set” . In PhasHsieh and Shannon’s approach to directed content analysis was employed to enhance the validity of the findings, add ‘consistency’ to the delineation of themes by drawing upon prevailing codes and categories, and address the relative failure of thematic analysis to address contradictory data .Accounting for personhood in palliative sedation: the Ring Theory of Personhood” which was chosen due to its holistic study of various aspects of personhood amongst terminally ill patients. Each code was defined in the code book and used in the second stage to independently extract and code relevant data from the included articles. In keeping with deductive category application, any relevant data not captured by these codes were assigned a new code. “Negotiated consensual validation” was used to achieve consensus on the codes, and this code book was then used to code the rest of the articles [The first stage saw three reviewers draw codes and categories from Krishna ’s articlarticles .Here, the Jigsaw Perspective saw the themes and categories viewed as pieces of a jigsaw puzzle where areas of overlap allowed for these pieces to be combined to create a bigger picture of the overlying data. The combined themes and categories are referred to as themes/categories. The Jigsaw Perspective employs Phases 4 to 6 of France, Wells ’s adaptaAs per France, Wells adaptation, the themes and categories identified in the Split Approach were grouped according to their focus. Each theme and category within the group were contextualised by reviewing the articles from which they were drawn. Reciprocal translation determined if the new data provided by the respective themes and categories could be used interchangeablyThe funnelling process sees the themes/categories identified in the Jigsaw Perspective compared with the tabulated summaries created, in keeping with recommendations set out by Wong, Greenhalgh ’s RAMESEThe Funnelling Process employed Phases 3 to 5 from France, Wells adaptation where the themes/categories identified in the Jigsaw Perspective were juxtaposed with key messages identified in the tabulated summaries. The funnelled themes/categories formed the basis for the discussion narrative’s ‘line of argument’ in Stage 6 of SEBA.A total of 3074 abstracts were reviewed, 160 full text articles evaluated, and 111 articles included as outlined in Fig. In the interest of space and ease of review, the themes and categories identified are summarised in Table ▪ Spirituality/Religion1) Innate Ring▪ Positive thinking▪ Setting and timing of child’s death▪ Attitude to Life and Death▪ Positive coping▪ Development of psychosocial morbidities▪ Coping Mechanism2) Individual Ring3) Relational Ring4) Societal RingThe Funnelled themes/categories were as follows.Whilst spiritual support is generally seen to help a parent’s coping and grieving process –85, atteFalkenburg, van Dijk  found thvan der Geest, van den Heuvel-Eibrink  found thBereavement is influenced by personality traits , culturei.Positive thinking towards deathSome parents viewed their child’s death as relief from pain and suffering , 105, anii.Setting and timing of child’s deathThe setting and timing of a child’s death greatly impacts the parent’s bereavement. A death following a protracted illness predisposed them to complicated grief  and desei.Positive Copingseeing and holding or being allowed to touch and hold helps the bereaved person adapt to the loss and say goodbye” [Parents who could share their feelings , 128, angoodbye” , 145.Also helpful were healthcare professionals who maintained contact with the parents after the child’s demise , 147. ThPositive coping facilitated personal growth , resilieii.Development of psychosocial morbiditiesPsychosocial morbidities were precipitated by anticipatory grief , loss ofInadequate gender and personalised bereavement support also raised concerns . Fathersrelational grieving” for the individual, family unit and the larger community.Scocco, Idotta  suggest Whilst such loss can strengthen marital relationships , 158 andConversely, neglect of the other children jeopardised nuclear and extended familial ties and dynamics , 155. TiHonest, timely, personalised, empathetic, kind, culturally sensitive and respectful support enable healthcare professionals to provide more effective ‘external’ and longitudinal assistance to parents , 181. ItHowever, poor bereavement support may leave parents feeling ‘abandoned’ , 183, reAcknowledging the potential impact of poor quality appraisal scores amongst the largely non-evidence based grey literature and opinions, perspectives, editorials, letters and non-primary data-based articles underlined the need to assess the impact of such data on the synthesis of the discussion portion of this SSR in SEBA. The research team found that the themes identified from separate thematic analysis of evidence-based and non-evidence-based data were similar, suggesting that the latter included in this review did not bias the analysis untowardly.In keeping with SEBA, the discussion portion of this SSR in SEBA was guided by the Best Evidence Medical Education (BEME) Collaboration guide  and the the impact of death of a child between 0 to 12 years on the personhood of a parent through the lens of the RToP. To begin, this review highlights evidence that the loss of a child will impact every aspect of a parent’s life. These changes to their spiritual beliefs, psychoemotional state , relationships, roles and expectations are captured within the Innate, Individual, Relational and Societal domains of the RToP. Secondly, perhaps more significantly, this SSR in SEBA highlights the dynamic nature of the bereavement process and the influence of a variety of factors within each of the four rings of the RToP. These findings undergird the notion of a personalised grief experience that requires an individualised, holistic, and longitudinal support mechanism. Overall, this data underscores the significant role that healthcare professionals play in supporting bereaved parents and in assessing and engaging with different elements of the parent’s life to better support them [In answering its primary research question, this SSR in SEBA highlights three key findings in viewing ort them .However, this review also highlights a number of consistent factors that attenuate and exacerbate the acute effects of loss Table  that mayWhilst this SSR in SEBA brings to the fore several considerations, perhaps the most significant and thus the focus of our discussion is the role of the relationship between bereaved parents and the healthcare professional journeying with them. Built upon trust, individualised relationships allow for the provision of appropriate, specific, timely, accessible, holistic, and longitudinal support , 193. ThTo meet their longitudinal roles and responsibilities, healthcare professionals should be equipped with longitudinal support and training. This is underlined by the knowledge that factors previously deemed supportive to coping and meaning-making may turn into risk factors and vice versa. With Knapp and Contro , Jonas, With present accounts suggesting grief support training to be inadequate  and thusTo aid these endeavours, we believe that it is possible to adapt the RToP’s four domains into a framework to assess each parent’s state and needs Table . CriticaThis SSR in SEBA was limited by use of the RToP which remains unproven in this context despite it being utilised in other populations in palliative care. There is also an array of methodological weaknesses amongst the included articles including failure to detail sample populations, information on care settings, place of death, duration of illness, available support, research methodologies, validity of findings as well as a lack of longitudinal data. There could also be differences in individual approaches during data analysis, though this was minimised as much as possible through corroboration with the team at each stage of the analysis. This raises questions as to the veracity of conclusions drawn and applicability of recommendations made beyond North America and Europe as most of the included articles were from these English-speaking Western countries.This SSR in SEBA has important implications for neonate, paediatric and bereavement units highlighting the longitudinal and personalised expectations upon healthcare professionals in this field. It also emphasises the need for training and support of these healthcare professionals, forwarding the idea of the RToP as a training tool and as an assessment tool to evaluate change in the individual parent’s coping abilities. We envision that this tool will help to guide the provision of timely, personalised, appropriate, holistic and longitudinal support for both the healthcare professional and the bereaved parent. As we look forward to engaging in future discussions in this critical area of study, we believe it is vital for further research to be conducted to better elucidate ways in which healthcare professionals may be more comprehensively trained and supported as they journey with these parents. In addition, it is crucial to further determine the viability of the RToP as an education and assessment tool.Additional file 1. Search Strategy.Additional file 2. Tabulated Summaries.


Smart homes promise to improve the quality of life of residents. However, they collect vasts amounts of personal and sensitive data, making privacy protection critically important. We propose a framework, called PRASH, for modeling and analyzing the privacy risks of smart homes. It is composed of three modules: a system model, a threat model, and a set of privacy metrics, which together are used for calculating the privacy risk exposure of a smart home system. By representing a smart home through a formal specification, PRASH allows for early identification of threats, better planning for risk management scenarios, and mitigation of potential impacts caused by attacks before they compromise the lives of residents. To demonstrate the capabilities of PRASH, an executable version of the smart home system configuration was generated using the proposed formal specification, which was then analyzed to find potential attack paths while also mitigating the impacts of those attacks. Thereby, we add important contributions to the body of knowledge on the mitigations of threat agents violating the privacy of users in their homes. Overall, the use of PRASH will help residents to preserve their right to privacy in the face of the emerging challenges affecting smart homes. In recent years, the pervasiveness of Internet of Things (IoT) technologies has contributed to transforming the home into a smart home. The smart home is one of the most well-known IoT applications, in which heterogeneous devices ranging from smart speakers to electronic door locks are connected to the home network and controlled remotely through the Internet. These connected devices collect and exchange data with each other and their users using embedded sensors and the Internet, seamlessly merging the physical and digital worlds inside the home. Consequently, these technologies are linked to a variety of benefits, including improved convenience, energy efficiency, enhanced security and safety, and more . The smaAs smart homes become more popular, the potential for exploitation by malicious threat agents is likely to increase. Indeed, the growing use of smart home devices in households is accompanied by substantial privacy risks stemming from having data being misused by malicious threat agents ,4,5. TheAccordingly, we propose a novel contribution to the field of smart homes, specifically a framework called PRASH , for modeling and analyzing privacy risks of smart homes. PRASH is primarily aimed at researchers and analysts with an interest in smart home systems to help deepen their understanding and reasoning about the privacy concerns affecting such systems. The proposed framework is intended to guide these people in systematically identifying privacy threats and assessing the privacy risks associated with them. For analyzing privacy risks and automating their detection and evaluation, PRASH uses a privacy attack taxonomy, attack trees, and privacy metrics. Given the dynamic and evolving features of smart home technologies, providing automatic methods for conducting risk evaluation is a vital requirement. Existing risk assessment procedures were developed in large part prior to the IoT , and as The rest of the paper is organized as follows. In Smart homes can be analyzed from the perspective of sociotechnical systems of systems. Sociotechnical systems of systems incorporate human behavior, technology, and policies that influence human behavior by combining the cyber  world with the physical world . Based oHardware layer. The physical layer consists of the physical components of the smart home. Components include the connected devices, such as home appliances; networking devices such as routers, switches, and gateways; and sensors that can be attached to different objects. Included here are also mobile devices such as smartphones that are used by end-users to configure and manage the home. Typically, commercial smart homes interconnect devices through a central gateway (hub) device . GatewayNetwork layer. The network layer connects devices found in the hardware layer and allows for remote control of the home. A core enabler for smart homes is the communication infrastructure and related networking protocols. Various networking technologies such as Zigbee, Wi-Fi, and BLE protocols may be supported by devices found in the hardware layer. The network layer may also incorporate application layer protocols such as MQTT, CoAP, and HTTP. A smart home may also have communication endpoints that interconnect it to systems hosted and managed outside of the physical home environment, e.g., to network storage, file sharing applications, and application programming interfaces (APIs), managed by third-parties.User layer. The user layer forms or recognizes the human entities. This layer includes the smart home residents and other stakeholders that interact with the home. Typically, the user roles can be grouped into data subject, data controller, and data user . The datThe integration and interdependencies of the different cyber and physical components of a smart home result in vulnerabilities that can be compromised through cyber attacks. In the next section, we present an overview of attacks aimed at compromising the privacy of the smart home residents.Privacy threats affecting IoT systems, and hence also smart homes, are characterized by access, collection, processing, and disclosure of sensitive information in contravention of individuals’ expectations ,14. TypiUsing the smart home conceptual layers introduced in While we do not claim that the constructed taxonomy is comprehensive, we conducted a systematic search process for identifying literature related to privacy attacks. Specifically, we queried three key databases, i.e., Google Scholar, Scopus, and Web of Science, using the search terms: (“The resulting taxonomy is displayed in For grouping the retrieved attacks we use the threatened entity as the main classifier and the access level (active attack or passive attack) as a second dimension. The access level dimension was observed as a distinguishing category for privacy attacks in comparison to other attributes, e.g., the attacker’s location. Active attacks occur when a threat agent attempts to alter the system’s resources or affect their operation in order to gain access to information . PassiveHardware layer attack. Smart home devices come in various forms, with some being installed at fixed locations , some being portable and possibly brought in by guests , and others being able to roam around the home . Regardless of the cases, such devices tend to be subject to hardware compromise.Node tampering: These attacks may range from changing a physical component, e.g., an integrated circuit, in a device, to the installation of a compromised device that may act as a covert spy. An example of a device tampering attack against a smart meter was demonstrated by the researchers in . TamperiNode theft: By stealing a device , a threaNode cloning: Devices, especially tags, can be captured by a threat agent which can then build replicas of them, which look like the original ones. These can then be used to compromise a radio frequency identification (RFID) system by deceiving even the RFID readers . Other dRadio signal capture: Radio signals that are emitted by devices, including the residential router, can be used to detect the presence of people and track movements inside the home. For instance, MIT’s RF-Pose project team  have traNetwork layer attack. The smart home network may be threatened by different attacks to violate the user’s privacy. Attacks may take advantage of the lack of security measures implemented on the smart home network, for example, a lack of authentication.5.Routing attack: These attacks occur when the routing table or graph structure of the home network is modified to benefit the malicious intruder. An example of this attack class is a sinkhole attack  where an6.Service attack: Instances of this attack, such as denial of service (DoS) attacks, degrade the quality of a service while causing privacy leaks . When sy7.Man-in-the-middle (MITM) attack: These attacks occur when a threat agent first uses eavesdropping to learn about the communication keys used by two network peers and then impersonates one part to the other by manipulating messages and their flow, controlling the conducted communications . Recentl8.Eavesdropping: These attacks occur typically when the communication channels  are monitored to extract the content and information of a conversation. Eavesdropping may also occur through side-channel information emitted by IoT devices, e.g., power consumption and timing information. For instance, recently, researchers demonstrated a novel long-distance side-channel attacking technique called “lamphone” that can be applied to recover full sound from a victim’s room that contains an overhead hanging bulb .9.Location tracing: These attacks occur when the user location is obtained or inferred, for example, by GPS spoofing or distance-attacks . This ca10.Inference attack: These attacks occur when information about an ongoing task or application running on an IoT device is inferred . For exaUser layer attack. Residents may be the direct target of privacy attacks. Typically, this happens by having them lured to install phony applications or by having them agree to policies and terms and conditions without being aware of privacy implications. Nonetheless, these attacks may be also initiated at the smart home remote’s backend.11.Data poisoning: In poisoning attacks, the malicious threat agents seeks to damage the integrity and confidentiality of a system, including its machine learning model . Similar12.Model inversion: By interacting with a machine learning model, subtly changing its activity, and using a technique known as model inversion, a threat agent may be able to deduce key features of the underlying data on which the system was trained, essentially gaining access to classified data .13.Membership inference: This attack allows a threat agent to deduce whether a given individual is present in the training data; and not necessarily learn additional personal data; of a machine learning model . This ca14.Social engineering: This may result in users installing malware, e.g., in the form of fake applications or browser plugins on their devices, resulting in unauthorized access to their data. Shoulder surfing is a type of social engineering attack where sensitive data may be revealed to an intruder example by hearing sensitive information being spoken. For instance, certain smart speakers may require the user to speak a PIN code aloud for protecting voice purchasing . However15.Data disclosure: A data controller with legal access to consumer data may disseminate the information legally, e.g., to advertisement firms for marketing purposes, and thus violate the privacy rights of an individual . MoreoveThe developed taxonomy is a first approach towards categorizing privacy attacks targeting smart homes. This taxonomy is used as a core component in Over the last few decades, ample research has been conducted on various aspects of privacy. From a risk management perspective, this work includes the identification and organization of privacy threats, mitigation strategies, and methods to evaluate the risk of privacy violations. This work lies at the intersection of the research areas of privacy and security threat modeling and risk analysis. Accordingly, we present an overview of the related work according to these two research areas and discuss similarities with and differences from our work.Threat modeling is a process for discovering, classifying, and evaluating the risk of threats to a system from an attacker’s perspective. Originally, threat modeling was exclusively used for security purposes, however, privacy researchers have extended it to address privacy concerns .The STRIDE model was proposed by Microsoft  as a secLINDDUN  is a priThe Quantitative Threat Modeling Methodology (QTMM)  is a quaEPIC  is an opOther notable privacy threat modeling approaches and frameworks, e.g., FPFSD  and PriSComparison to related work. In this paper, we adopt a similar approach to QTMM for modeling attacks and quantifying privacy risks. However, unlike QTMM, we model the system using a formal system specification rather than using a Data Flow Diagram (DFD). While DFDs can be used to identify threats, their use is restricted, especially when it comes to representing specific system properties that could help an automated analysis of risks. A second difference is that, unlike the previously described research works, PRASH is not intended to provide a generic or complete methodology. It is instead focused on smart homes, and it is designed to help persons who are concerned about privacy risks in their homes as a result of smart home technology implementation. Consequently, we create metrics and associated guidelines designed for measuring the privacy exposure of a smart home in a quantitative manner. For developing these metrics, and given the similar data-intensive nature of CSSs to smart homes, we use EPIC as a reference for constructing the metrics. However, different to both EPIC and QTMM, we also incorporate the dynamic element of a threat agent. An advantage of including threat agents into threat modeling is that more effective protection strategies can be identified that cater for more realistic attack scenarios.Several papers focus on providing models or theoretical frameworks for the identification and analysis of risks, i.e., risk analysis, in relation to the smart home. Typically, a framework tends to give an organized structure of concepts and other things and sometimes offering guidance and direction, whereas a model represents or explains the operation and mechanism of some concept, typically developed within a framework . In the Denning et al.  provide Kirkham et al.  explore Jacobsson et al.  apply riNurse et al.  outline Psychoula et al.  present Sturgess et al.  present Park et al.  propose IoT frameworks. While the frameworks and models mentioned above are focused on the smart home, there are other frameworks having a broader scope but also have relevance and applicability to the smart home. Moshin et al.  present Comparison to related work. In this paper, we organize the risk analysis framework and select privacy metrics in the same way that Ge et al.  did. HowAdditionally, given the relationship between privacy and security, we also address requirements of security  in PRASH. To the best of our knowledge, PRASH is the first framework that uses a formal graphical model for modeling and analyzing privacy risks in smart homes, and taking into account the dynamic concept of a threat agent. Moreover, while the number of attacks featured in other frameworks tends to be rather limited  which are used for remotely controlling and managing C. For B, this is typically a cloud data center, but it can also be an edge device such as a dedicated home server. While C are located inside H, both B and M can be located outside H. Here, we assume that there are a finite set n implements capability C were summarized earlier in N or indirectly through services  which are incorporated in N. Here, we assume that there are a set R of roles u has a role r with respect to node n.N and U, and over which D are transferred. Effectively, N. Here, we assume that D is represented as a set of tuples –data item, representing the specific attributes that N is collects or processes. This ranges from a specific data item, e.g., name, to more generic data types, e.g., biometric data, depending on N  | User ParameterName [Link].Write = “write” Node Parameter [Link].Relay = “relay” Parameter Node [Link].BinaryLogicalOp = “AND” | “OR”.BinaryTermOp = “=” | “!=” | “>” | “>=” | “<” | “=<”.Parameter = ParameterName ParameterValue.ParameterName = “:” String.ParameterValue = “?” String.i et al. , we repraur form  as folloU and N. The action U or N. The action N. The action N. Each specified action takes an optional parameter, an instance of L, indicating the communication channel over which a parameter is read or sent to. In practice, the value of a parameter, represented as In the grammar above, we define three actions–We define a smart home, S can be mapped to the architecture layers described in N→ hardware layer, L→ network layer, and U→ user layer. Moreover, as discussed in D is pervasive across the different architecture layers. As shown in In Definition 1 (Data flow).We define a data flow as Definition 2 (Data context).We define a data context as For privacy risk analysis, we assume that the data contexts have been identified and labeled according to their type and sensitivity. This would allow for instance differentiating between sharing health data from a smartwatch to a doctor . Attacks targeting the smart home were established earlier and grouped in a taxonomy in query-taxonomy, that returns a set of attack types  from the taxonomy given c representing the entity threatened  and We assume that there is a global set of vulnerabilities, Each Definition 3 (Attack tree).Using the attack tree formalization proposed by Ge et al.  we definS. The algorithm assumes the existence of a helper function, build-attack-tree, that generates an attack-goal as the goal of the attack, attack-types representing children nodes; and a function N, U, and L are combined using logical Algorithm 1 Computation of attack metrics for each vulnerability. Input:S:smart home,   Output: 1:  2:inSdo 3:  4:  5:  6:   7:p(discoverability) × p(reproducability) × p(exploitability)    8:C)DecisionSupportSystem     11:end if    12:end for   13:join   14:end if  15:returnat  16:end if In Algorithm 1, we document how the threat model is created from S typically as a result of conducting attacks as identified in L, reading data directly from N when stored or being processed, and obtaining it data directly from U. Hereunder, we identify instances of malicious external threat agents targeting the smart home ordered according to their respective offensive capabilities [Threat agent. A threat agent, r attack . Each tabilities ,71,72,73Hackers. Malicious individuals, script kiddies, and employees of an organization who may be disgruntled, nosy, or whistle-blowers. This agent is typically moved by curiosity to experiment and try things out. An example of an attack conducted by a hacker is a social engineering attack  that compete for revenues or resources . Competitors and organized crime are most likely moved by financial gains and in part by terrorism motives. An example of an attack conducted by competitors and organized crime is a routing attack ; S, e.g., reading data from N; and action-result is the result of the attacker-property and system-property act as preconditions to perform threat agent’s power.Using Rocchetto et al.  work on  clauses . In pracS and perform different actions. We assume the threat agent power, S and its offensive capabilities. A high value of S, e.g., in terms of the devices used, home network configuration, and residence routines, and having advanced offensive capabilities, e.g., in terms of tools (hardware and software) and skills , whereas a low value of Threat agent power. Threat agents can exploit vulnerabilities in y theory . NonetheS. Accordingly, we develop three metrics–attack success likelihood, attack impact, and risk score, described as follows.The privacy metrics help us measure the privacy risk, i.e., the risk to the data subject after an attack is performed on Attack success likelihood. This metric determines the probability of In order to populate Equation .(1)αl=∏Based on the DREAD risk assessment model , we adopN can also affect N implements remote access it is more likely that this allows a N. Similarly, the more capabilities N supports, the more likely it is that N is exposed to more vulnerabilities. For instance, if N implements API, IFTTT, web browser accessibility, and smartphone accessibility, this is likely to increase the discoverability of potential attacks as the attack surface of S is widened.Some of the capabilities of S and It is also possible to positively correlate e Theory ,77,78 weUsing Equation  we can rAttack impact. This metric determines the potential loss to the privacy of a data subject caused when identification level and data context sensitivity. We also assume a corresponding lookup function, In determining analysis —we also Identification level. The identification level, and more . We assuP) can determine whether the data flow respects the designated context or not.Data context sensitivity. The data context sensitivity,  privacy  we assocLookup function. The impact is determined by AD model  we incluN collects and processes, and the data subjects . We assume that a higher value of damage potential is associated also as to when there are vulnerable data subjects involved. Some examples of vulnerable data subjects are children, employees, and people needing special protection . The damnd, etc. . ArguablB). For instance, if B is a cloud backend, then it is more likely that a group (2) is affected. It can also be argued that if a node (N) implements gateway functionality as a capability then arguably more users, e.g., the entire family, could be affected in case N is compromised.For affected users, we assume that this represents whether the leaked data affects one individual to multiple users, e.g., the entire family, and grade this using an ordinal scale (1–3). The affected users is also related to the smart home backend , with In In order to populate Equation .(3)αi=mRisk score. Following a common approach in computer security, we compute the privacy violation risk as the combination of likelihood of occurrence of a privacy violation and its impact. Specifically, by multiplying In order to populate Equation .(4)rμ=αIn this section, we demonstrate the usefulness of the proposed framework for analyzing privacy risks of smart homes. We start by describing how we generated a smart home instance from the formal system model specification . Next, whttps://github.com/bugejajoseph/smarthome (accessed on 8 September 2021)).To generate a sample smart home we used the open source language and analyzer called Alloy as our formal specification language. Three alternatives to it are B, TLA+, and Z. However, we adopted Alloy in particular as it supports, through its automated tool called Alloy Analyzer, the generation of graphical results which are convenient for analysis work. Moreover, we used Alloy to capture the specifications of the smart home and the structural relations between its various components. The source code we developed and used for specifying and generating a smart home system model is available on Github  when a visitor arrived at the door. Live footage from the video doorbell was sent to the mobile phone of the parent. Both the connected toy and video doorbell were connected to the cloud. By using the system model described in House = Nodes = Users = Links = Data = {For the smart home }The data items represent instances of the smart home data types household data, biometric data, and other data, which we identified earlier in Policy = {}The policy indicates that when motion is detected by Though Alloy we encoded the described smart home setup as shown in S.We can assume Finally, we assume In our threat model, let us assume that the attack goal is that of profiling of the house occupants. Profiling is a threat of collecting and correlating information about individual activities, and subsequently using them to generate new information from the original data . AggregaS, is that described in the previous section. The attack tree describes how the different components of the model can be compromised to achieve the attack’s goal. We assumed that the attack is conducted by exploiting a set of hypothetical vulnerabilities ), targeting a certain type and brand of connected camera, was reported as critical, and thus associated with high Vulnerability databases. We used vulnerability databases for finding actual/practical instances of weakness of smart home devices. A search for vulnerabilities for smart home devices embedding cameras revealed various instances where such cameras have been repeatedly exploited. For example, atically .In N or L without being physically present inside the house.Moreover, to implement the attacks, we assumed U by being physically located inside the home network.Moreover, Based on the privacy metrics established in Attack success likelihood: We calculated Equation .  =  =  =  = 0.8The computational results indicate that the most likely target for achieving the attack goal with 80% success rate is by attacking the Next, we applied Equation  to calcuAttack impact: We calculate Equation .  =  =  =  = 10affected users = 2 and damage potential = 5. Nonetheless, conducting an attack targeting a service provider might be challenging, as they are likely to have personnel professionally trained on privacy and security, who aware of potential legal, compliance, and regulatory ramifications.The computational results indicate that the most severe impact to privacy is when a data disclosure attack targets the service provider. Potentially, this attack could reveal aggregated data of multiple families, including past, current, and inferred data about vulnerable data subjects and other subjects. Effectively, this may translate to: Risk scores: Using Equation  we compuWhile the proposed privacy risk analysis framework is useful for better understanding the type of attacks that can target the smart home and in analyzing privacy risks therein, our research does not come without limitations.Attack taxonomy. There are multiple ways for organizing privacy attacks. The approach we have taken is admittedly biased towards the selected dataset, primarily consisting of scholarly articles that we have analyzed. Consequently, the selected dataset may have excluded certain attack types, such as coordinated or interdependency-based attacks, that could be theoretically harnessed to invade user privacy as well. Moreover, while the taxonomy is focused on the compromise of user privacy, some attacks, as mentioned in System model. In the smart home system model, we did not explicitly represent the decision logic, i.e., the control algorithms, that are responsible for controlling and satisfying the system level specific constraints . Instead, we assumed that such services, rightly so, reside in the nodes, and that their inputs/outputs consist of data. This is akin to a black box modeling approach where the focus is on the interface and the messages being exchanged, which we represented as policy rules using a formal grammar, instead of the internal behavior of the system. Nonetheless, we represent the capabilities, which may act as an enabler for an attack to occur, as attributes in the nodes. This approach allows for extending the model in the future to cater for additional threats, including concrete instances of nodes.Threat model. Similarly to other works on quantitative risk modeling, we make use of attack trees for quantifying privacy risks. While this approach is useful, it is worthwhile considering other alternatives. For instance, attack-defense trees that include countermeasures within the attack tree. Attack-defense trees are useful for conducting risk assessment, and thus going beyond risk analysis. Moreover, we assumed a threat agent that has a global threat agent power parameter. While this works, to simulate more advanced use cases an extension of the threat model could leverage for instance, Hidden Markov Models, to represent dynamic behavior changes. Moreover, while the constructed threat model, can also cater for physical attacks, focusing on threats targeting directly the users, e.g., the threat of coercion to make a user yield certain information, is not the main scope of our work.Privacy expertise. PRASH was primarily designed for persons who have some privacy expertise. These users tend to have experience with privacy by design and knowledge of secure development practices. Especially for some IoT vendors, in particular startups, this privacy expertise, might not be available. Nonetheless, such knowledge requirements may not be necessary for all the framework modules. Additionally, we also assume that smart home residents are the designated owners, and thus the accountable entities, of the smart home. In practice, this implies that they are also somewhat involved in the risk analysis process. However, in our case, we assume that this involvement is only needed to override certain parameters of the framework, in particular with respect to the attack impact.Smart homes can contribute to improving the quality of life of individuals. Nonetheless, smart homes challenge the notion of the home as a private and protected space. Smart homes are vulnerable to diverse privacy risks that are challenging to identify and analyze, especially given the dynamic and evolving features of their enabling IoT technologies and the processes supporting those. Accordingly, we proposed a framework called PRASH for modeling and assessing the privacy risks of smart homes. This framework uses as input a system model, a threat model, and a set of privacy metrics for helping with automating the discovery and evaluation of privacy risks affecting such systems. The capabilities of PRASH for describing a smart home for privacy risk analysis were demonstrated through a use case involving a smart home that was automatically generated through Alloy, and consequently its risks were computed. Modeling the smart home with a formal specification enables early identification of threats, better planning for risk management scenarios, and mitigation of potential impacts caused by attacks before they actually hit the homes and impact lives of residents. Overall, the proposed framework contributes to advancing the research in the area of risk analysis as applied to smart homes, and helps deepen the understanding and reasoning about privacy concerns affecting such systems.For future work, it would be useful to develop a tool that automatically creates attack trees from a system model instantiation. This could be done by traversing the different elements of the proposed model and representing them on a graph to, e.g., illustrate the weak points of any given smart home. The computation of the different attack metrics can be done partially automatically, particularly for the nodes, by harnessing vulnerability databases such as the CVSS or NVD. A second avenue for future work would be to investigate the best ways to present risk analysis results to non-technical users and also how to communicate risks to users when they occur. Having the users engaged with the risk analysis process may contribute to increasing the trust in smart homes. Finally, it would be beneficial to evaluate the framework in a setting involving different stakeholders, e.g., smart home developers, service providers, and residents. This could serve as a means of better assessing the feasibility and usefulness of the presented framework. Potentially, in order to achieve this, prototypes could be developed and a participatory design approach could be employed.


This study proposes a psychometric validation of the Italian version of the Mentalized Affectivity Scale (MAS) developed by Greenberg and colleagues in 2017. The mentalized affectivity construct integrates mentalization ability in the process of emotional regulation. An adult sample (N = 506) completed the 60-items MAS online version. In contrast to the three-factor structure of the original version, the Italian context confirmatory and exploratory factor analyses with splitted sample  revealed a five-factor structure. The hierarchically structured MAS factors are: Emotional Processing (being able to process emotion in situations); Expressing Emotions ; Identifying Emotions (awareness of emotions); Control Processing , and Autobiographical Memory (related to childhood experiences). We also verified the convergent validity and reliability of the Italian version of the MAS by correlating the above five factors with measures of emotion regulation and reflective functioning. Moreover, we analyzed the relationships among the factors of the MAS, personality measures and well-being indexes, such as life satisfaction and self-efficacy: The new 35-item MAS scale showed robust correlations with all the tested constructs. Our results confirm that the MAS is a useful measure to assess mentalized affectivity, with the Italian version showing a more complex structure than the original English one, thus enriching the literature about mentalization. For the sample characteristics, mean values and standard deviations (SDs) for continuous variables were calculated; for categorical/nominal variables, frequencies and percentages were computed. Skewness and kurtosis of the MAS items were first checked to assess normal distribution; West, Finch, & Curran [Data analyses were performed using Jamovi statistical software [The Jamovi project (2020). Jamovi (Version 1.2) (Computer Software). Retrieved from & Curran  recommenThe factorial validity of the MAS, considering the model proposed by Greenberg et al. , was assAs is often the case, scales translated in different languages and analyzed in different cultural contexts, may not have the same latent factor structure of the original version: in this case, it is appropriate to examine the latent structure of the assessment through an exploratory factor analysis (EFA), followed by a new confirmative factor analysis (CFA). Since this is the case of this study, we examined the latent structure of the MAS through an exploratory factor analysis (EFA), followed by a new confirmative factor analysis (CFA). The total sample was later randomly divided into two halves. The first sample was used to perform an EFA , and the second was used to perform a CFA in order to validate the EFA structure .On Sample A, the Kaiser Meyer Olkin (KMO) and the Bartlett’s test of sphericity were run in order to be sure that the correlation matrix could be subjected to analyses . The Cattell scree test (judging the elbow of a scree plot) and the Kaiser-Guttman criteria  were used to identify the number of factors to be extracted using EFA. EFA with the Oblimin oblique rotation was used to analyze the items on the MAS. Oblique rotation was used because the factors extracted from the MAS are likely to correlate with each other. In the first step, all 60 items were included. Subsequent factor analyses were conducted in a stepwise fashion, in order to eliminate items until a stable factor solution emerged. Loadings in the .40 range or above are generally considered the cut-off on substantial loadings , 37; forOn Sample B, CFA was conducted. Maximum Likelihood (ML) was used as an estimation method. Hu and Bentler’s guidelines for various fit  indices Cronbach’s alpha coefficients were performed on the total sample to examine internal consistency. Cronbach’s Alpha below .60 are unacceptable .To examine the hierarchical structure of the scale, the one-component through five component solutions was explored using the procedure proposed by Goldberg . First, The concurrent validity of the MAS scale was evaluated by correlating the MAS factors with age, education, personality, emotion regulation, life satisfaction, self-efficacy and reflective functioning with the Pearson’s r correlation coefficient. Following Cohen’s guidelines  we interThe descriptive analysis of the MAS items is presented in A confirmative analysis with varimax rotation was run using Greenberg and colleagues’ criteria , 42. TheData from Sample A and 60 items were used in these analyses. The Bartlett’s sphericity test  and the KMO = 0.84 have ensured that the correlation matrix could be subjected to factor analysis. The Cattell scree test and the Kaiser-Guttman criteria indicated that a five-factor solution was the most appropriate. EFA was then conducted, with five factors extracted. The initial pool of 60 general items, after subsequent factor analyses conducted in a stepwise fashion, was reduced to 35. The following twelve items were excluded, because their loadings were lower than .40: “I am good at understanding other people’s complex emotions.”; “I use tools I have learned to help when I am in difficult emotional situations.”; “I can see how prior relationships influence my current emotions.”; “I put effort into managing my emotions.”; “It is easy for me to notice when I am feeling different emotions at the same time.”; “I am good at increasing emotions that I want to feel more.”; “When I am filled with a positive emotion, I know how to keep the feeling going.”; “I am quick to act on my emotions.”; “I am aware of recurrent patterns to my emotions.”; “I am open to what others say about me to help me know what I am feeling.”; “Thinking about other people’s emotional experiences helps me to think about my own.”; “I am open to other people’s view of me because it helps me to better understand myself”.The following thirteen items were excluded because they showed a ratio higher than 2 among the primary loading and the highest secondary loading: “I can express my emotions clearly to others.”; “It is hard for me to manage my emotions.”; “I often think about my past experiences to help me understand emotions that I feel in the present.”; “I am able to keep my emotions to myself if the timing to express them isn’t right.”; “People tell me I am good at expressing my emotions.”; “I often look back at my life history to help inform my current emotional state and situation.”; “People get confused when I try to express my emotions.”; “I can see how prior relationships influence the relationships that I have now.”; “It is helpful to think about how my emotions stem from family dynamics.”; “I rarely think about the reasons behind why I am feeling a certain way.”; “It’s important to understand the major life events that have had an impact on my behavior.”; “I am more comfortable “talking around” emotions I am feeling, rather than talking about them directly.”; “When I express my emotions to others, it is usually jumbled”.The pattern of factor loadings from the five-factors exploratory measurement model for the MAS scale with 35 items is given in 2 (584) = 1076.00 p < .001; RMSEA = .058; SRMR = .074). Loadings from the CFA were comparable with those found in the EFA, identifying the five factors.CFA was conducted separately on data from Sample B using the 35 items; item selection to load on CFA factors was based on EFA loadings. The hierarchical structure of the one-component through five-components solution was conducted using the procedure proposed by Goldberg  on the tAll the factor scores showed an acceptable distribution; skewness and kurtosis showed normal distribution .The analysis of reliability performed on the data collected from all participants showed that the scale has adequate internal consistency for all factors. All Cronbach’s alphas were adequate: “Identifying Emotions” = .86, “Expressing Emotions” = .84, “Curiosity about Emotions”.82, “Processing Emotions” = .79, “Autobiographical Memory”. = .75. As long as correlations among the five factors, “Identifying Emotions” and “Curiosity about Emotions”, “Expressing Emotions” and “Processing Emotions”, “Curiosity about Emotions” and “Processing Emotions” are not linked, whereas all the other factors show significantly positive correlations.Convergent validity was assessed with correlations among the five mentalized affectivity factors, and the reflective functioning and emotion regulation.As it can be seen in Correlations among mentalized affectivity factors and the other measures are displayed in Identifying Emotions is moderately positively correlated with age, and weakly positively correlated with education. Expressing Emotions and Curiosity about Emotions are both significantly positively correlated with education. Finally, Processing Emotions is significantly positively correlated with age.As for personality scales, Identifying Emotions is positively correlated with Conscientiousness and Agreeableness traits, it is weakly positively correlated with Openness and Extraversion traits, while it is strongly negatively correlated with Neuroticism. Expressing Emotions is strongly positively correlated with Openness and Extraversion. Curiosity about Emotions is positively correlated with Openness, Agreeableness and Extraversion traits. Processing Emotions is significantly positively correlated with Agreeableness, it is weakly positively correlated with Openness and Conscientiousness traits, and it is negatively correlated with Neuroticism. Finally, Autobiographical Memory is not correlated with the others measures.Identifying Emotions, Expressing Emotions and Processing Emotions are strongly positively correlated with Life satisfaction.Identifying Emotions and Processing Emotions are positively correlated with General Self-Efficacy, while Expressing Emotions and Curiosity about Emotions are weakly positively correlated with this construct.The present research tested the factorial validity of the Italian version of the MAS in an Italian sample. Moreover, we tested reliability, concurrent and convergent validity by examining associations with the MAS and its socio-affective correlates, such as emotion regulation and reflective functioning. Finally, we explored possible links among mentalized affectivity as tested with the MAS and other measures of personality and well-being, such as life satisfaction and self-efficacy. Referring to the factorial structure of the Italian version of the MAS, the confirmative factor analysis did not confirm the original three-factors structure. As it can often be the case, scales translated in different languages and analyzed in different cultural contexts may not have the same latent factor structure as the original version: then, we conducted an exploratory factor analysis, followed by a new confirmative factor analysis, to examine the latent structure of the Italian version of the MAS. Following these steps, we delineated a new five-factors structure: Identifying Emotions, Expressing Emotions, Curiosity about Emotions, Processing Emotions and Autobiographical Memory.Research has started to explore cultural differences underlying the construct of mentalized affectivity, and the growing interest in cultural differences in mentalization may provide a helpful path for the interpretation of our results. In a recent review, Aival-Naveh and colleagues  proposedvs. collectivistic cultures: in individualistic/Western cultures, mentalization is mainly oriented to the self, whereas in collectivistic/Eastern cultures, mentalization abilities develop firstly with the aim to understand others. Notwithstanding the above arguments, research in this area is still limited and do not analyze specific cultures in detail. In our case, although American and Italian culture can be both considered Western cultures, i.e. individualistic cultures, it is possible to speculate about the existence of some differences in mentalistic and affective development that can have an impact on a complex skill such as mentalized affectivity. The hierarchical model that we proposed has showed that in the Italian version of the MAS structure the three original factors are already present on second level, accompanied by a fourth factor, Curiosity, that is splitted in the third level to Curiosity about Present and Past and, finally, it is divided into Curiosity about Emotions and Autobiographical memory. Both Curiosity about Emotions and Autobiographical memory factors refer to the individual’s tendency to question their present and past emotions, in particular, the role that these emotions play in their current experience; these factors are well explained by the theory of mentalized affectivity. Regarding Curiosity about emotions, Jurist [Also following the theoretical model proposed by Greenberg and colleagues , the bio, Jurist  notes, f, Jurist , autobio, Jurist . So, theIn order to assess the reliability and the concurrent and convergent validity, we examined the links between the MAS factors and emotion regulation and reflective functioning constructs, confirming our hypothesis. In fact, referring to emotion regulation, results showed positive correlations between the cognitive reappraisal and four of the five MAS factors, Identifying Emotions, Curiosity about Emotions, Processing Emotions and Autobiographical Memory: on the contrary, the link between cognitive reappraisal and expression of emotions is not present. We can assume that all the factors correlated with cognitive reappraisal refer to internal abilities of the individual, that is, being able to identify, to be curious, to process Click here for additional data file.


Childhood visual impairment (VI) has a profound impact on many aspects of childhood and adolescence. This is well-documented in cross-sectional and/or quantitative studies utilizing self-report instruments which compare children with and without VI. Young people’s views on the experience of growing up with VI as a developmental, change-driven process remain largely unexplored.As part of our broader research programme on quality of life of visually impaired children and young people in the United Kingdom, in-depth, semi-structured interviews were conducted between March and June 2015, with a stratified sample of 17 young people with VI, aged 16–19 years. An age-sensitive, empirically-based topic guide encouraged retrospective reflections on participants’ experiences of growing up with VI, including age-normative and vision-specific challenges.becoming me. Four themes representing everyday activities, attitudes, preferences and perceptions in relation to i) social relationships, ii) independence and responsibilities, iii) the future, and iv) rising to challenges emerged and were used by participants in their description of three stages in which they developed a sense of self: i) laying the foundations, ii) testing the waters, and iii) this is me. Differences in manifestation of VI influenced how young people made sense of their experiences and their sense of self.Descriptions of growing up with VI largely centered on an overarching higher-order theme labelled Findings are discussed in relation to normative and vision-specific changes in psychosocial development during adolescence, including the development of identity. They highlight the need for ongoing monitoring of subjective well-being in a clinical population with a unique early life course trajectory. I’ll give my friend ‘the look’ and he’ll be like, yeah [and help me]”.Social relationships and a surrounding social environment were discussed in relation to participants’ acceptance of VI, and to what extent they were able to integrate it into their sense of self. Some participants with early onset VI (≤2 years) compared themselves to their peers, describing VI as a personal attribute, which made them feel unique and interesting. From this perspective, some young people were able to seek benefits from their early diagnoses.“It’s never really bothered me, cos I’ve never seen properly. It’s just who I am”.Alternatively, and as stark contrast, participants with subsequent prior experience of full functional vision recalled a complex transition in their feelings of belonging and self-acceptance, occurring in the early stages of visual deterioration, which was particularly prominent when navigating social encounters. Expectations and views which had previously contributed to a sense of self had to be recalibrated.“You don’t want family or friends who you’ve seen before, and have seen you ‘seeing’, noticing that it has got bad.”.“It really upset me. I lost so many friends because I wasn’t Pearl. I was Pearl who just found out she has got an eye disability. So I had to mature like that [snaps fingers]. I had to do things for myself […] A lot of people thought I had changed […]”.“My eyes had got worse. And then I had to adapt myself again […] So it’s like losing someone. Cos you’re constantly having to, like, grieving I suppose.”.test the waters of a broader physical and social environment extending beyond their immediate home or school life. In doing so, participants described their developing confidence. New strategies were established for overcoming vision-specific challenges in the absence of functional support from parents.Participants recalled emerging and developing autonomy during childhood, initially afforded by parents and caregivers who gradually permitted, or encouraged independence through activities such as visiting local cafes or shops alone. Greater independence and autonomy, granted by parents, meant that young people could “At the end of primary school I started going out by myself. It was just going into town, in a massive group [of friends]. Then I started going places by myself, mostly to go and meet people”.“Only when I started going out, I realized I can see the board [timetable at the station] a lot better if I take a photo of it with my phone. I rely on my phone”.Exposure to new surroundings, however, increased the potential for negative experiences in public settings, which were described by some participants in the form of humiliation or frustration as a result of other people not understanding the impact of VI, and in turn influenced participants’ sense of self in a new, broader social context.“Sometimes people are really arsy towards you. Me and my friend went to the cafe and we couldn’t see the menu, so we asked “What sandwiches have you got?”, and the lady said “Can’t you see?!” Sometimes people don’t react well. We [VI persons] are like aliens to them.”.forget” to take a cane with him when he left home, or “lose” his cane at home. Whilst this strategy alleviated some of the emotional distress caused by using assistive devices in public, it introduced a new challenge of testing the waters without any support, and tripping or falling over was often a consequence.Perhaps as a result of these negative experiences, some participants described an emerging attitude towards using assistive devices, such as magnifiers, or white canes when in public. One participant described a time when he would ““I used a cane when I was younger, but now I’m reluctant to take it out. I don’t want to be singled out. There was one day when I tried [to read the menu] and somebody laughed at me.”.“I don’t like using my [cane] in front of my family. I will only use it if I’m alone and I really have to use it.”.For many participants, expanding social environments were associated with increasing awareness of age-appropriate, normative activities, and specifically, realizations of the discrepancy between those which participants were capable of, and those which might be possible if participants had better functional vision. The majority of participants described the inability to drive, or take driving lessons, for example, as an increasingly salient barrier towards independence, which had profound emotional consequences. Feelings of frustration, annoyance and despair intensified when participants reached an age in which they were legally eligible to drive, and witnessed their peers learning to drive.“[Driving] is something which has been building up in me over time and it didn’t really affect me till I reached the age of 17 […] My sister passed her test the year before and at that point I wasn’t worried. But when my friends started to take it and pass it, it really hit me and I realized that I definitely wouldn’t be able to do that. Before it always seemed like something that was gonna happen in the future.”.Being on the threshold of participation in age-appropriate activities, such as driving, was at times associated with greater, intensified negative emotions than being unable to engage with the activity outright, distinguishing participants with milder forms of VI from those with severe VI.“I’d rather be able to do it [drive] but not do it, than not be able to do it and want to do it. […] It’s about having that choice. But I’ll never have it, so, just got to deal with it.”.“That little niggle in the back of your mind ‘oh what happens if my eyesight gets better?’ I tried to push myself to see a number plate and it wasn’t working. I tried my damned hardest to see it.”.“I’ve always known I won’t be able to drive. Can you imagine, a blind person driving! [laughs]”becoming me incorporated changes in social relationships, the nature of independence and responsibilities, and for the first time, thoughts, perceptions, and activities related to the future. Participants described accumulating normative aspects of childhood and adolescence, and vision-specific challenges, resulting in realizations of i) who they had become, and ii) who they would be in the future.The final stage described by participants as important to the process of could have a laugh with”, or whom they identified as “mates”.During this later stage, adults such as teachers and parents were increasingly respected and appreciated as equals versus superiors or carers. Some participants identified teachers who they ““[On a school trip] Instead of giving me a learning support assistant, they [the school] actually paid for a ticket for Mr J to go. He’s just like one of the lads!”.These adults were valued as role models, and contributed to participants’ developing sense of self, providing a sense of direction in relation to future ambitions and, in particular, the type of career or activity which would be possible in light of VI.“My uncle’s a lawyer. And he’s told me stories about people he’s dealt with […] I like the idea of it and how, even though they’ve had such a rough background, he’s helped them. I would like to do that for other people as well”.Parents played an important role as advocates for future plans which are realistic, providing guidance, giving suggestions, and ensuring young people developed necessary independent-living skills. Input from parents, however, could be perceived as overprotective, and young people described their frustrations about imposed limitations.“I want to go and study abroad for a year. I want to go to China but my mum won’t let me go. But I want to do it all […] I wanted to study in America, but again, my mum, she’s really iffy about that.”.Newly established romantic relationships emerged in participants’ discussions of adolescence, and were described as enjoyable and comforting, and favoured in light of having somebody other than a parent, carer or teacher to offer functional support. These types of relationships triggered thoughts about the future, specifically about moving away from home, and having a family.“He [my boyfriend] helps me. Say, if we’re out at a restaurant, he reads the menu for me and things like that.”.“I’m guessing, as you grow up, being an adult, you just want to be on your own, or with your partner. And then start a family. That’s what I want.”.“I would love to have kids, but I worry…about bringing them up”.becoming me, participants described developing and modifying coping strategies which were flexible in nature, and in which they could adapt in the face of vision-specific challenges, meaning that they were able to successfully rise to challenges. Having a positive and solution-focused attitude is an important strategy seen throughout childhood and adolescence, but was particularly prominent in later adolescence, as young people developed the cognitive and emotional maturity to overcome challenges imposed by VI.Within this final stage of “Try, try, try again and if that fails, just try again! […] And after you fail, go to bed!”.“I try to find ways. Solve problems […] It’s a problem solving skill.”.“I learnt, if I can get a laugh out of it [my impairment], and make other people laugh, then why not?!”.becoming me emerged directly from the data, and best illustrate the process that young people described as important to their experiences of growing-up with VI. It is possible therefore, that beyond this stage, this process is not fixed (i.e. the foundations of identity development may continue to shift during adolescence and into adulthood). Thus, future application of this specific process will require extensive further validation.Our study of young people’s retrospectively collected experience of growing up shows the profound impact of VI, with variations by the characteristics of VI on many aspects of everyday life. We present and describe a snapshot of the potential process whereby a child/young person living with VI , comes to accept themselves as having a disability, and how this disability will shape their future. Three sequential stages of development emerged from the data as illustrative of children and young people’s experience of normative, age-specific issues, and vision-specific challenges. Just like their sighted counterparts, young people with VI experience dynamic changes and challenges during childhood and adolescence, in the nature of their social relationships; developing independence; and thoughts about the future. These normative aspects of growing up, however, were amplified by the experience of VI and a diverse range of additional, vision-specific, challenges. In this study, aspects of everyday life contributed cumulatively to participants’ developing sense of self, contributing in different ways and at different stages. The themes we developed focused on identity and th stage (spanning 12–18 years) is characterized by an individual’s exploration of their sense of self and identity. The frequency and nature in which participants spontaneously emphasized the shaping of their sense of self over time, may be explained using some elements of Erikson’s description of an identity crisis. An identity crisis is thought to be “precipitated both by the individuals’ readiness and by society’s pressure” [Overall, our findings are in keeping with the extant literature in developmental psychology and resonate with some key theories of psychosocial development. For example, Erikson proposed that personality develops in a predetermined order through eight stages of psychosocial development, spanning infancy to adulthood, each involving a psychosocial crisis. According to Erikson, the 5ressure”  (p.180),ressure” , 36; pubressure” . In thisoutcome of the identity crisis, but also the process in which young people integrate their experience into a meaningful representation.Traditionally, young people are thought to resolve the identity crisis through establishing a realistic appraisal of the self, blended out of past, present and future , 35, 38.source of social support and self-esteem, relationships with friends, but not with parents, were protective of low self-esteem [Young people with VI are traditionally thought to be at increased risk of social isolation . Howeverf-esteem . Just lif-esteem , 44. Thef-esteem . Only thf-esteem , facilitThe prevalence of mental health conditions among young people in the UK has been recently termed a ‘silent catastrophe’, with the number of adolescents reporting such conditions rising at a rate of fivefold in the last 10 years , and thoFive Year Forward View [In light of the ‘silent catastrophe’, emotional and psychological well-being for patients with long-term conditions has been prioritised in the NHS’s ard View , generatard View , 54. Indard View , and theard View . The NHSard View . Whilst ard View , which mThere are many, well-documented challenges associated with conducting interviews with children and young people . For exaprocess whereby children come to accept VI as part of their identity. These findings support the value of developing integrated physical and mental health services for this population and highlight the need for long-term monitoring of well-being and mental health in a population who may be particularly vulnerable to challenges and changes in developing a sense of identity.To conclude, we present a snapshot of the self-reported descriptions of growing up with VI, from the perspectives of young people on the brink of adulthood, which illustrate the potential sensitive nature in which a chronic condition, with fluctuating progression and severity, can influence normative aspects of growing up. Using qualitative methods, we captured young visually impaired people’s perceptions of specific changes in their psychosocial development, adding to the growing body of quantitative literature which highlights the far-reaching impact of VI on psychosocial well-being during childhood and adolescence. The findings we report add granularity to existing research studies focused on identity and self-concept among children living with VI as, when given the opportunity, young people spontaneously described the S1 File(PDF)Click here for additional data file.