  People are frequently required to send documents, forms, or other materials
containing sensitive data (e.g., personal information, medical records,
financial data) to remote parties, sometimes without a formal procedure to do
so securely. The specific transmission mechanisms end up relying on the
knowledge and preferences of the parties involved. Through two online surveys
($n=60$ and $n=250$), we explore the various methods used to transmit sensitive
documents, as well as the perceived risk and satisfaction with those methods.
We find that users are more likely to recognize risk to data-at-rest after
receipt (but not at the sender, namely, themselves). When not using an online
portal provided by the recipient, participants primarily envision transmitting
sensitive documents in person or via email, and have little experience using
secure, privacy-preserving alternatives. Despite recognizing general risks,
participants express high privacy satisfaction and convenience with actually
experienced situations. These results suggest opportunities to design new
solutions to promote securely sending sensitive materials, perhaps as new
utilities within standard email workflows.
