Privacy and Contextual Integrity Framework and Applications Adam

Privacy and Contextual Integrity: Framework and Applications Adam Barth, Anupam Datta, John C. Mitchell (Stanford) Helen Nissenbaum (NYU)

Privacy in Health Care Doctor Electronic Health Record Specialist Patient Portal HIPAA Compliance Patient Insurer

Broad Goal • Protect privacy – Can a banker tell a marketer a customer’s address? • Express policy precisely – Enterprise privacy policies – Privacy provisions from legislation • Analyze privacy policies – Action complies with policy? – Policy enforces law?

Approach • Privacy model – Agents communicating about each other • Logic over model – Linear temporal logic • Policies as logical formulas – Control expressive power • Apply logical tools – Leverage LTL research

Contextual Integrity • Philosophical account of privacy – Transfer of personal information – Describes what people care about • Flow governed by norms – Agents act in roles in social contexts – Rejects public/private dichotomy • Principles of transmission – Confidentiality, reciprocity, dessert, etc

Privacy Model for CI Alice Charlie’s SSN is 078 -05 -1120 • Restrict messages – Messages about subjects • Judgments over traces – Past and future relevant • Agents reason about attributes Bob

Access Control vs. Privacy • Access control – Subject (= actor) – Object – Action • Stateless – Except Chinese wall • Discrete elements • Privacy policies – – – Sender Recipient Subject (of message) Attribute Transmission principle • Temporal – Past: Opt-in / opt-out – Future: Notification • Structured attributes

Syntax • Grammar for logic – : : = send(p 1, p 2, m) | contains(m, q, t) | inrole(p, r) | incontext(p, c) | t t’ | | | x: . | U | S | O p 1 sends p 2 message m m contains attrib t about q p is active in role r p is active in context c Attrib t is part of attrib t’ Classical operators Temporal operators • Policies use a restricted class of formulas

CI Norms and Policies • Policy consists of norms (+) inrole(p 1, r 1) inrole(p 2, r 2) inrole(q, r) t t’ ( ) inrole(p 1, r 1) inrole(p 2, r 2) inrole(q, r) t t’ – is an agent constraint – is a temporal condition • Norms assembled into policy formula – p 1, p 2, q: P. m: M. t: T. incontext(p 1, c) send(p 1, p 2, m) contains(m, q, t) { + | + norms+(c) } { | norms (c) }

Gramm-Leach-Bliley Example Sender role Attribute Subject role Financial institutions must notify consumers if they share their non-public personal information with nonaffiliated companies, but the notification may occur either before or after the information sharing occurs Recipient role Transmission principle

Expressiveness of CI • Evaluated on privacy laws – HIPAA, GLBA, and COPPA • Captured most privacy provisions – Missed de-identified health info in HIPAA • Laws used most features – Roughly as expressive as required

Structure of Attributes Health Information Psychotherapy Notes Test Results Date of Birth Age Zodiac Sign Heath care providers can tell patients their health information Sender role Recipient role Subject role Attribute Heath care providers can tell patients their psychotherapy notes only if a psychiatrist has approved

Extensional vs. Intentional • Extensional semantics – Equates policies with judgments – Ignores why judgments reached • Intentional semantics – Policies as list of rules – Reason for judgment preserved • Extensional combination tricky – Attribute inheritance

Difficulties in Combination Date of Birth AND Age = Zodiac Sign Age Date of Birth OR Age Zodiac Sign Age = Age Zodiac Sign

Refinement and Combination • Policy refinement – Basic policy relation – Does hospital policy enforce HIPAA? • P 1 refines P 2 if P 1 P 2 – Requires careful handling of attribute inheritance • Combination becomes logical conjunction – Defined in terms of refinement

Compliance Contemplated Action Judgment Policy Future Reqs History • Strong compliance – Future requirements after action can be met – PSPACE • Weak compliance – Present requirements met by action – Polynomial time

Related Languages Model RBAC Sender Recipient Subject Role XACML Flexible Attributes Past Future Combination Identity Flexible o o EPAL Fixed Role Fixed o P 3 P Fixed Role Fixed o o CI Role • Legend: unsupported o partially supported full supported • CI fully supports attributes and combination

Conclusions • Privacy about agents communicating – Different model than access control • Sender, recipient, subject, attribute, transmission principle – Past and future important • CI: A language for privacy policies – Based on linear temporal logic – Expresses most privacy laws • Combination and compliance tractable

Questions?