
Mohamed Moustafa Dawoud
PhD Student · UC Santa Cruz
I am a PhD student in Computer Science & Engineering at UC Santa Cruz, working with Prof. Ram Sundara Raman. I study the sociotechnical dimensions of AI-enabled privacy risks and abuse, and how they impact people and society. I am particularly interested in how AI facilitates new forms of harm — such as non-consensual deepfakes, synthetic media generation, and the commodification of abuse services — and in how the stakeholders affected by these threats understand, misinterpret, and struggle to keep pace with them: how everyday users form mental models of digital protections, how engineers and practitioners weigh privacy trade-offs under regulatory pressure, and how policymakers interpret ambiguous or conflicting frameworks. I use large-scale internet measurements, qualitative interviews, and controlled experiments to surface these misalignments. I am equally driven by the complementary question: can AI itself be turned into a tool for defense? I explore how the same technology that enables harm can also empower users to recognize and resist threats, help practitioners build safer systems under regulatory uncertainty, and provide policymakers with the empirical grounding they need to act.
News
Work in Progress
The Impact of Age Verification Laws on the Consumption of Pornographic Content in the US
In progressAlejandro Cuevas, Mohamed Moustafa Dawoud, Zhibin Shen, Ram Sundara Raman, Manoel Horta Ribeiro
We leverage individual-level panel data derived from mobile browsing activity to study the impact of age verification laws on adult content consumption, from both compliant and non-compliant sites, in the US.
Publications
View allPrivAudit: A Dual-Lens Auditing Framework for Website Privacy Practices under the CCPA
Mohamed Moustafa Dawoud, Riya Aggarwal, Likith Rahul Krishnamurthy, Ram Sundara Raman
ACM CCS 2026To appear
An automated framework that audits website privacy two ways at once: LLM scoring of privacy policies against CCPA provisions, and browser measurement of what cookies actually get written. Across 998 sites, CCPA-subject policies disclose more, but tracking barely moves: 6,392 targeting cookies, 49% of them third-party writes, largely unresponsive to privacy signals.
From Underground to Mainstream Marketplaces: Measuring AI-Enabled NSFW Deepfakes on Fiverr
Mohamed Moustafa Dawoud, Alejandro Cuevas, Ram Sundara Raman
USEC 2026, co-located with NDSS
We investigate whether AI-enabled NSFW services have moved into mainstream gig marketplaces. Through keyword searches, sitemap analysis, and snowball sampling, we identify 593 AI-enabled NSFW gigs on Fiverr: 82.8% expose deepfake-enabling features, 74.9% of sellers joined in 2025, and sellers disproportionately target platforms like OnlyFans and Instagram.
Vendor communication themes in darknet Ransomware-as-a-Service (RaaS) advertisements
Taylor Fisher, Zacharias Pieri, C. Jordan Howell, Roberta O'Malley, Lauren Tremblay, Mohamed Dawoud
Computers in Human Behavior
A thematic analysis of RaaS advertisements on darknet markets. The most common theme was victimization, appearing in 70% of the dataset, revealing the strategic mechanisms vendors employ to attract both novice and experienced cybercriminals through the commodification of ransomware.
DVa: Extracting Victims and Abuse Vectors from Android Accessibility Malware
Haichuan Xu, Mingxuan Yao, Runze Zhang, Mohamed Moustafa Dawoud, Jeman Park, Brendan Saltaformaggio
USENIX Security 2024
We developed DVa, a malware analysis pipeline using dynamic victim-guided execution and symbolic analysis, to uncover accessibility malware's targeted victims and abuse vectors. Deployed on 9,850 a11y malware samples, DVa uncovered 215 unique victims targeted with an average of 13.9 abuse routines.
Recent Posts
View allCommunity Notes Across Languages and Cultures: The World Cup as a Case Study
I spent a World Cup testing how well Community Notes catches fakes, in dozens of languages, using both machines and people.
The Geography of Nonconsensual Intimate Images
What counts as an intimate image is not fixed. It shifts by country, by law, and by faith, and it decides who the law protects and who it charges.
A World Cup of Deepfakes
Making a lie got cheap. Catching one didn't. I spent this tournament watching the gap widen.
Messi vs. Egypt vs. the Deepfakes: A World Cup Story in Arabic
Fake Messi videos flooded Egyptian timelines before Tuesday's match. I took them apart, frame by frame.
So, What Would You Do?
On nonconsensual intimate imagery, and how cultural context changes the answer.
Let's Collaborate
I welcome research collaborations and enjoy mentoring students finding their path. If something here resonated, I'd love to connect.
Get in touch


