Introduction to Privacy January 23 2007 Usable Privacy

Introduction to Privacy January 23, 2007 Usable Privacy and Security • Carnegie Mellon University • Spring 2007 • Cranor/Hong • http: //cups. cmu. edu/courses/ups-sp 07/ 1

Administrivia n Collect homework and human subjects certificates n Collect student survey forms n Make sure everyone has been getting mailing list messages Usable Privacy and Security • Carnegie Mellon University • Spring 2007 • Cranor/Hong • http: //cups. cmu. edu/courses/ups-sp 07/ 2

Outline n What is privacy? n Privacy laws and self-regulation n Privacy risks from personalization n Reducing privacy risks Usable Privacy and Security • Carnegie Mellon University • Spring 2007 • Cranor/Hong • http: //cups. cmu. edu/courses/ups-sp 07/ 3

What is privacy? Usable Privacy and Security • Carnegie Mellon University • Spring 2007 • Cranor/Hong • http: //cups. cmu. edu/courses/ups-sp 07/ 4

What is privacy? “Being alone. ” - Shane (age 4) Usable Privacy and Security • Carnegie Mellon University • Spring 2007 • Cranor/Hong • http: //cups. cmu. edu/courses/ups-sp 07/ 5

Westin “Privacy and Freedom” 1967 n “Privacy is the claim of individuals, groups or institutions to determine for themselves when, how, and to what extent information about them is communicated to others” n Privacy is not an absolute Usable Privacy and Security • Carnegie Mellon University • Spring 2007 • Cranor/Hong • http: //cups. cmu. edu/courses/ups-sp 07/ 6

Privacy as process “Each individual is continually engaged in a personal adjustment process in which he balances the desire for privacy with the desire for disclosure and communication…. ” - Alan Westin, 1967 Usable Privacy and Security • Carnegie Mellon University • Spring 2007 • Cranor/Hong • http: //cups. cmu. edu/courses/ups-sp 07/ 7

Westin’s four states of privacy n Solitude • individual separated from the group and freed from the observation of other persons n Intimacy • individual is part of a small unit n Anonymity • individual in public but still seeks and finds freedom from identification and surveillance n Reserve • the creation of a psychological barrier against unwanted intrusion - holding back communication Usable Privacy and Security • Carnegie Mellon University • Spring 2007 • Cranor/Hong • http: //cups. cmu. edu/courses/ups-sp 07/ 8

Different views of privacy n Privacy as limited access to self • the extent to which we are known to others and the extent to which others have physical access to us n Privacy as control over information • not simply limiting what others know about you, but controlling it • this assumes individual autonomy, that you can control information in a meaningful way (not blind click through, for example) Usable Privacy and Security • Carnegie Mellon University • Spring 2007 • Cranor/Hong • http: //cups. cmu. edu/courses/ups-sp 07/ 9

Privacy as animal instinct n Is privacy necessary for species survival? Eagles eating a deer carcass http: //www. learner. org/jnorth/tm/eagle/Capture. E 63. html Usable Privacy and Security • Carnegie Mellon University • Spring 2007 • Cranor/Hong • http: //cups. cmu. edu/courses/ups-sp 07/ 10

Privacy laws and self-regulation Usable Privacy and Security • Carnegie Mellon University • Spring 2007 • Cranor/Hong • http: //cups. cmu. edu/courses/ups-sp 07/ 11

OECD fair information principles http: //www. datenschutzberlin. de/gesetze/internat/ben. htm n Collection limitation n Data quality n Purpose specification n Use limitation n Security safeguards n Openness n Individual participation n Accountability Usable Privacy and Security • Carnegie Mellon University • Spring 2007 • Cranor/Hong • http: //cups. cmu. edu/courses/ups-sp 07/ 12

US FTC simplified principles n Notice and disclosure n Choice and consent n Data security n Data quality and access n Recourse and remedies US Federal Trade Commission, Privacy Online: A Report to Congress (June 1998), http: //www. ftc. gov/reports/privacy 3/ Usable Privacy and Security • Carnegie Mellon University • Spring 2007 • Cranor/Hong • http: //cups. cmu. edu/courses/ups-sp 07/ 13

Laws and regulations n Privacy laws and regulations vary widely throughout the world n US has mostly sector-specific laws, with relatively minimal protections • Federal Trade Commission has jurisdiction over fraud and deceptive practices • Federal Communications Commission regulates telecommunications n European Data Protection Directive requires all European Union countries to adopt similar comprehensive privacy laws • Privacy commissions in each country (some countries have national and state commissions) • Many European companies non-compliant with privacy laws (2002 study found majority of UK web sites non-compliant) • Safe Harbor allows US companies to self-certify compliance Usable Privacy and Security • Carnegie Mellon University • Spring 2007 • Cranor/Hong • http: //cups. cmu. edu/courses/ups-sp 07/ 14

Some US privacy laws n Bank Secrecy Act, 1970 n Fair Credit Reporting Act, 1971 n Privacy Act, 1974 n Right to Financial Privacy Act, 1978 n Cable TV Privacy Act, 1984 n Video Privacy Protection Act, 1988 n Family Educational Right to Privacy Act, 1993 n Electronic Communications Privacy Act, 1994 n Freedom of Information Act, 1966, 1991, 1996 Usable Privacy and Security • Carnegie Mellon University • Spring 2007 • Cranor/Hong • http: //cups. cmu. edu/courses/ups-sp 07/ 15

US law – recent additions n HIPAA (Health Insurance Portability and Accountability Act, 1996) • When implemented, will protect medical records and other individually identifiable health information n COPPA (Children‘s Online Privacy Protection Act, 1998) • Web sites that target children must obtain parental consent before collecting personal information from children under the age of 13 n GLB (Gramm-Leach-Bliley-Act, 1999) • Requires privacy policy disclosure and opt-out mechanisms from financial service institutions Usable Privacy and Security • Carnegie Mellon University • Spring 2007 • Cranor/Hong • http: //cups. cmu. edu/courses/ups-sp 07/ 16

Voluntary privacy guidelines n Online Privacy Alliance http: //www. privacyalliance. org n Direct Marketing Association Privacy Promise http: //www. thedma. org/library/ privacy/privacypromise. shtml n Network Advertising Initiative Principles http: //www. networkadvertising. org/ n CTIA Location-based privacy guidelines http: //www. wowcom. com/news/press/body. cfm? record_id=907 Usable Privacy and Security • Carnegie Mellon University • Spring 2007 • Cranor/Hong • http: //cups. cmu. edu/courses/ups-sp 07/ 17

Usable Privacy and Security • Carnegie Mellon University • Spring 2007 • Cranor/Hong • http: //cups. cmu. edu/courses/ups-sp 07/ 18

Chief privacy officers n Companies are increasingly appointing CPOs to have a central point of contact for privacy concerns n Role of CPO varies in each company • • Draft privacy policy Respond to customer concerns Educate employees about company privacy policy Review new products and services for compliance with privacy policy • Develop new initiatives to keep company out front on privacy issue • Monitor pending privacy legislation Usable Privacy and Security • Carnegie Mellon University • Spring 2007 • Cranor/Hong • http: //cups. cmu. edu/courses/ups-sp 07/ 19

Seal programs n TRUSTe – http: //www. truste. org n BBBOnline – http: //www. bbbonline. org n CPA Web. Trust – http: //www. cpawebtrust. org/ n Japanese Privacy Mark http: //privacymark. org/ Usable Privacy and Security • Carnegie Mellon University • Spring 2007 • Cranor/Hong • http: //cups. cmu. edu/courses/ups-sp 07/ 20

Seal program problems n Certify only compliance with stated policy • Limited ability to detect non-compliance n Minimal privacy requirements n Don’t address privacy issues that go beyond the web site n Nonetheless, reporting requirements are forcing licensees to review their own policies and practices and think carefully before introducing policy changes Usable Privacy and Security • Carnegie Mellon University • Spring 2007 • Cranor/Hong • http: //cups. cmu. edu/courses/ups-sp 07/ 21

Privacy policies n Policies let consumers know about site’s privacy practices n Consumers can then decide whether or not practices are acceptable, when to opt-in or opt-out, and who to do business with n The presence of privacy policies increases consumer trust What are some problems with privacy policies? Usable Privacy and Security • Carnegie Mellon University • Spring 2007 • Cranor/Hong • http: //cups. cmu. edu/courses/ups-sp 07/ 22

Privacy policy problems n BUT policies are often • • difficult to understand hard to find take a long time to read change without notice Usable Privacy and Security • Carnegie Mellon University • Spring 2007 • Cranor/Hong • http: //cups. cmu. edu/courses/ups-sp 07/ 23

Privacy policy components n Identification of site, scope, contact info n Security assurances n Types of information collected n Children’s privacy • Including information about cookies n How information is used n Conditions under which information might be shared n Information about opt-in/opt-out n Information about access n Information about data retention policies There is lots of information to convey -- but policy should be brief and easy-to-read too! n Information about seal programs What is opt-in? What is opt-out? Usable Privacy and Security • Carnegie Mellon University • Spring 2007 • Cranor/Hong • http: //cups. cmu. edu/courses/ups-sp 07/ 24

Short Notices n Project organized by Hunton & Williams law firm • Create short version (short notice) of a human-readable privacy notice for both web sites and paper handouts • Sometimes called a “layered notice” as short version would advise people to refer to long notice for more detail • Now being called “highlights notice” • Focus on reducing privacy policy to at most 7 boxes • Standardized format but only limited standardization of language • Proponents believe highlights format may eventually be mandated by law n Alternative proposals from privacy advocates focus on check boxes n Interest Internationally • http: //www. privacyconference 2003. org/resolution. asp n Interest in the US for financial privacy notices • http: //www. ftc. gov/privacyinitiatives/ftcfinalreport 060228. pdf Usable Privacy and Security • Carnegie Mellon University • Spring 2007 • Cranor/Hong • http: //cups. cmu. edu/courses/ups-sp 07/ 25

Usable Privacy and Security • Carnegie Mellon University • Spring 2007 • Cranor/Hong • http: //cups. cmu. edu/courses/ups-sp 07/ 26

Usable Privacy and Security • Carnegie Mellon University • Spring 2007 • Cranor/Hong • http: //cups. cmu. edu/courses/ups-sp 07/ 27

Usable Privacy and Security • Carnegie Mellon University • Spring 2007 • Cranor/Hong • http: //cups. cmu. edu/courses/ups-sp 07/ 28

Checkbox proposal WE SHARE [DO NOT SHARE] PERSONAL INFORMATION WITH OTHER WEBSITES OR COMPANIES. Collection: We collect personal information directly from you We collect information about you from other sources: We use cookies on our website We use web bugs or other invisible collection methods We install monitoring programs on your computer Uses: We use information about you to: Send you advertising mail Send you electronic mail Call you on the telephone Sharing: We allow others to use your information to: Maintain shared databases about you Send you advertising mail Send you electronic mail Call you on the telephone YES NO With Your Consent Without Your Consent With Your Consent N/A Without Your Consent N/A Access: You can see and correct {ALL, SOME, NONE} of the information we have about you. Choices: You can opt-out of receiving from Advertising mail Electronic mail Telemarketing Retention: Change: We keep your personal data for: Us {Six Months Three Years Affiliates Third Parties N/A Forever} We can change our data use policy {AT ANY TIME, WITH NOTICE TO YOU, ONLY FOR DATA COLLECTED IN THE FUTURE} Usable Privacy and Security • Carnegie Mellon University • Spring 2007 • Cranor/Hong • http: //cups. cmu. edu/courses/ups-sp 07/ 29

Usable Privacy and Security • Carnegie Mellon University • Spring 2007 • Cranor/Hong • http: //cups. cmu. edu/courses/ups-sp 07/ 30

Usable Privacy and Security • Carnegie Mellon University • Spring 2007 • Cranor/Hong • http: //cups. cmu. edu/courses/ups-sp 07/ 31

Usable Privacy and Security • Carnegie Mellon University • Spring 2007 • Cranor/Hong • http: //cups. cmu. edu/courses/ups-sp 07/ 32

Platform for Privacy Preferences Project (P 3 P) n Developed by the World Wide Web Consortium (W 3 C) http: //www. w 3. org/p 3 p/ • Final P 3 P 1. 0 Recommendation issued 16 April 2002 n Offers an easy way for web sites to communicate about their privacy policies in a standard machine -readable format • Can be deployed using existing web servers n Enables the development of tools (built into browsers or separate applications) that • Summarize privacy policies • Compare policies with user preferences • Alert and advise users Usable Privacy and Security • Carnegie Mellon University • Spring 2007 • Cranor/Hong • http: //cups. cmu. edu/courses/ups-sp 07/ 33

Basic components n P 3 P provides a standard XML format that web sites use to encode their privacy policies n Sites also provide XML “policy reference files” to indicate which policy applies to which part of the site n Sites can optionally provide a “compact policy” by configuring their servers to issue a special P 3 P header when cookies are set n No special server software required n User software to read P 3 P policies called a “P 3 P user agent” Usable Privacy and Security • Carnegie Mellon University • Spring 2007 • Cranor/Hong • http: //cups. cmu. edu/courses/ups-sp 07/ 34

What’s in a P 3 P policy? n Name and contact information for site n The kind of access provided n Mechanisms for resolving privacy disputes n The kinds of data collected n How collected data is used, and whether individuals can opt-in or opt-out of any of these uses n Whether/when data may be shared and whethere is opt-in or opt-out n Data retention policy Usable Privacy and Security • Carnegie Mellon University • Spring 2007 • Cranor/Hong • http: //cups. cmu. edu/courses/ups-sp 07/ 35

A simple HTTP transaction GET /index. html HTTP/1. 1 Host: www. att. com. . . Request web page Web Server HTTP/1. 1 200 OK Content-Type: text/html. . . Send web page Usable Privacy and Security • Carnegie Mellon University • Spring 2007 • Cranor/Hong • http: //cups. cmu. edu/courses/ups-sp 07/ 36

… with P 3 P 1. 0 added GET /w 3 c/p 3 p. xml HTTP/1. 1 Host: www. att. com Request Policy Reference File Web Server Send Policy Reference File Request P 3 P Policy Send P 3 P Policy GET /index. html HTTP/1. 1 Host: www. att. com. . . Request web page HTTP/1. 1 200 OK Content-Type: text/html. . . Send web page Usable Privacy and Security • Carnegie Mellon University • Spring 2007 • Cranor/Hong • http: //cups. cmu. edu/courses/ups-sp 07/ 37

P 3 P increases transparency n P 3 P clients can check a privacy policy each time it changes http: //www. att. com/accessatt/ n P 3 P clients can check privacy policies on all objects in a web page, including ads and invisible images http: //adforce. imgis. com/? adlink|2|68523|1|146|ADFORCE Usable Privacy and Security • Carnegie Mellon University • Spring 2007 • Cranor/Hong • http: //cups. cmu. edu/courses/ups-sp 07/ 38

P 3 P in IE 6 Automatic processing of compact policies only; third-party cookies without compact policies blocked by default Privacy icon on status bar indicates that a cookie has been blocked – pop-up appears the first time the privacy icon appears Usable Privacy and Security • Carnegie Mellon University • Spring 2007 • Cranor/Hong • http: //cups. cmu. edu/courses/ups-sp 07/ 39

Users can click on privacy icon for list of cookies; privacy summaries are available at sites that are P 3 P-enabled Usable Privacy and Security • Carnegie Mellon University • Spring 2007 • Cranor/Hong • http: //cups. cmu. edu/courses/ups-sp 07/ 40

Privacy summary report is generated automatically from full P 3 P policy Usable Privacy and Security • Carnegie Mellon University • Spring 2007 • Cranor/Hong • http: //cups. cmu. edu/courses/ups-sp 07/ 41

P 3 P in Netscape 7 Preview version similar to IE 6, focusing, on cookies; cookies without compact policies (both first-party and third-party) are “flagged” rather than blocked by default Indicates flagged cookie Usable Privacy and Security • Carnegie Mellon University • Spring 2007 • Cranor/Hong • http: //cups. cmu. edu/courses/ups-sp 07/ 42

Privacy Bird n Free download of beta from http: //privacybird. com/ • Origninally developed at AT&T Labs • Released as open source n “Browser helper object” for IE 6 n Reads P 3 P policies at all P 3 P-enabled sites automatically n Bird icon at top of browser window indicates whether site matches user’s privacy preferences n Clicking on bird icon gives more information Usable Privacy and Security • Carnegie Mellon University • Spring 2007 • Cranor/Hong • http: //cups. cmu. edu/courses/ups-sp 07/ 43

Chirping bird is privacy indicator 44

Red bird indicates mismatch 45

Check embedded content too 46

Privacy settings 47

Example: Sending flowers 48

49

50

Privacy Finder n Prototype developed at AT&T Labs, improved and deployed by CUPS n Uses Google or Yahoo! API to retrieve search results n Checks each result for P 3 P policy n Evaluates P 3 P policy against user’s preferences n Reorders search results n Composes search result page with privacy annotations next to each P 3 P-enabled result n Users can retrieve “Privacy Report” similar to Privacy Bird policy summary Usable Privacy and Security • Carnegie Mellon University • Spring 2007 • Cranor/Hong • http: //cups. cmu. edu/courses/ups-sp 07/ 51

Demo 52

P 3 P Resources n For further information on P 3 P see: • http: //www. w 3. org/P 3 P/ • http: //p 3 ptoolbox. org/ • http: //p 3 pbook. com/ Usable Privacy and Security • Carnegie Mellon University • Spring 2007 • Cranor/Hong • http: //cups. cmu. edu/courses/ups-sp 07/ 53

Privacy risks from personalization 54

Unsolicited marketing Desire to avoid unwanted marketing causes some people to avoid giving out personal information Usable Privacy and Security • Carnegie Mellon University • Spring 2007 • Cranor/Hong • http: //cups. cmu. edu/courses/ups-sp 07/ 55

My computer can “figure things out about me” The little people inside my computer might know it’s me… … and they might tell their friends Usable Privacy and Security • Carnegie Mellon University • Spring 2007 • Cranor/Hong • http: //cups. cmu. edu/courses/ups-sp 07/ 56

Inaccurate inferences n “My Ti. Vo thinks I’m gay!” Usable Privacy and Security • Carnegie Mellon University • Spring 2007 • Cranor/Hong • http: //cups. cmu. edu/courses/ups-sp 07/ 57

Surprisingly accurate inferences Everyone wants to be understood. No one wants to be known. Usable Privacy and Security • Carnegie Mellon University • Spring 2007 • Cranor/Hong • http: //cups. cmu. edu/courses/ups-sp 07/ 58

You thought that on the Internet nobody knew you were a dog… …but then you started getting personalized ads for your favorite brand of dog food Usable Privacy and Security • Carnegie Mellon University • Spring 2007 • Cranor/Hong • http: //cups. cmu. edu/courses/ups-sp 07/ 59

Price discrimination n Concerns about being charged higher prices n Concerns about being treated differently Usable Privacy and Security • Carnegie Mellon University • Spring 2007 • Cranor/Hong • http: //cups. cmu. edu/courses/ups-sp 07/ 60

Revealing private information to other users of a computer n Revealing info to family members or co-workers • Gift recipient learns about gifts in advance • Co-workers learn about a medical condition n Revealing secrets that can unlock many accounts • Passwords, answers to secret questions, etc. Usable Privacy and Security • Carnegie Mellon University • Spring 2007 • Cranor/Hong • http: //cups. cmu. edu/courses/ups-sp 07/ 61

The Cranor family’s 25 most frequent grocery purchases (sorted by nutritional value)! Usable Privacy and Security • Carnegie Mellon University • Spring 2007 • Cranor/Hong • http: //cups. cmu. edu/courses/ups-sp 07/ 62

Exposing secrets to criminals n Stalkers, identity thieves, etc. n People who break into account may be able to access profile info n People may be able to probe recommender systems to learn profile information associated with other users Usable Privacy and Security • Carnegie Mellon University • Spring 2007 • Cranor/Hong • http: //cups. cmu. edu/courses/ups-sp 07/ 63

Subpoenas n Records are often subpoenaed in patent disputes, child custody cases, civil litigation, criminal cases Usable Privacy and Security • Carnegie Mellon University • Spring 2007 • Cranor/Hong • http: //cups. cmu. edu/courses/ups-sp 07/ 64

Government surveillance n Governments increasingly looking for personal records to mine in the name of fighting terrorism n People may be subject to investigation even if they have done nothing wrong Usable Privacy and Security • Carnegie Mellon University • Spring 2007 • Cranor/Hong • http: //cups. cmu. edu/courses/ups-sp 07/ 65

Little Brother as Big Brother Usable Privacy and Security • Carnegie Mellon University • Spring 2007 • Cranor/Hong • http: //cups. cmu. edu/courses/ups-sp 07/ 66

67

Risks may be magnified in future n Wireless location tracking n Semantic web applications n Ubiquitous computing Usable Privacy and Security • Carnegie Mellon University • Spring 2007 • Cranor/Hong • http: //cups. cmu. edu/courses/ups-sp 07/ 68

If you’re not careful, you may violate data protection laws n Some jurisdictions have privacy laws that • Restrict how data is collected and used • Require that you give notice, get consent, or offer privacy-protective options • Impose penalties if personal information is accidentally exposed Usable Privacy and Security • Carnegie Mellon University • Spring 2007 • Cranor/Hong • http: //cups. cmu. edu/courses/ups-sp 07/ 69

Reducing privacy risks 70

Axes of personalization Tends to be MORE Privacy Invasive Implicit Persistent (profile) System initiated Predication based Tends to be LESS Privacy Invasive Data collection method Duration User involvement Reliance on predictions Explicit Transient (task or session) User initiated Content based Usable Privacy and Security • Carnegie Mellon University • Spring 2007 • Cranor/Hong • http: //cups. cmu. edu/courses/ups-sp 07/ 71

A variety of approaches to reducing privacy risks n No single approach will always work n Two types of approaches: • Reduce data collection and storage (data minimization) • Put users in control (notice and choice) Usable Privacy and Security • Carnegie Mellon University • Spring 2007 • Cranor/Hong • http: //cups. cmu. edu/courses/ups-sp 07/ 72

Collection limitation: Pseudonymous profiles n Useful for reducing risk and complying with privacy laws when ID is not needed for personalization n But, profile may become identifiable because of unique combinations of info, links with log data, unauthorized access to user’s computer, etc. n Profile info should always be stored separately from web usage logs and transaction records that might contain IP addresses or PII Usable Privacy and Security • Carnegie Mellon University • Spring 2007 • Cranor/Hong • http: //cups. cmu. edu/courses/ups-sp 07/ 73

Collection limitation: Client-side profiles n Useful for reducing risk and complying with laws n Risk of exposure to other users of computer remains; storing encrypted profiles can help n Client-side profiles may be stored in cookies replayed to server that discards them after use n Client-side scripting may allow personalization without ever sending personal info to the server n For some applications, no reason to send data to server Usable Privacy and Security • Carnegie Mellon University • Spring 2007 • Cranor/Hong • http: //cups. cmu. edu/courses/ups-sp 07/ 74

Collection limitation: Task-based personalization n Focus on data associated with current session or task - no user profile need be stored anywhere n May allow for simpler (and less expensive) system architecture too! n May eliminate problem of system making recommendations that are not relevant to current task n Less “spooky” to users - relationship between current task and resultant personalization usually obvious Usable Privacy and Security • Carnegie Mellon University • Spring 2007 • Cranor/Hong • http: //cups. cmu. edu/courses/ups-sp 07/ 75

Putting users in control n Users should be able to control • what information is stored in their profile • how it may be used and disclosed Usable Privacy and Security • Carnegie Mellon University • Spring 2007 • Cranor/Hong • http: //cups. cmu. edu/courses/ups-sp 07/ 76

Developing good user interface to do this is complicated n Setting preferences can be tedious n Creating overall rules that can be applied on the fly as new profile data is collected requires deep understanding and ability to anticipate privacy concerns Usable Privacy and Security • Carnegie Mellon University • Spring 2007 • Cranor/Hong • http: //cups. cmu. edu/courses/ups-sp 07/ 77

Possible approaches n Provide reasonable default rules with the ability to add/change rules or specify preferences for handling of specific data • Up front • With each action • After-the-fact n Explicit privacy preference prompts during transaction process n Allow multiple personae Usable Privacy and Security • Carnegie Mellon University • Spring 2007 • Cranor/Hong • http: //cups. cmu. edu/courses/ups-sp 07/ 78

Example: Google Search History 79