Dissertation Research: Managing Visual Privacy in Web Browsers Dr. Kirstie Hawkey Dalhousie University

2 Incidental Information Privacy (IIP) Incidental Information Many traces of past activities are visible with casual inspection. Casual Collaboration Colleagues often jointly view information on a personal computer. Display Privacy Normative privacy for personal displays does not apply. Privacy is Contextual Purpose and setting of activity vary. What is appropriate in one setting may not be in another. Secondary Concern Privacy management occurs within the context of some primary task.

3 Personal Information Management (PIM) Activities performed to acquire, organize, maintain, retrieve, and use information items such as documents, web pages, and . PIM research goal: –Have the right information in the right place, in the right form, and of sufficient completeness and quality to meet the current need. My goal: –Make sure that information is also appropriate for the current viewing context

4 Web Browsers

5 Managing Visual Privacy in Web Browsers Exploratory research –Data collection methodologies Understanding Visual Privacy Concerns –Conceptual model of dispositional and situational factors Investigation of privacy management approaches –Feasibility of 2 automated approaches –Design and evaluation of a privacy enhanced browser, PrivateBits

6 Initial Research Questions Incidental Information Privacy in Web Browsers What is the scope of the IIP problem? How do people currently manage IIP? What factors impact privacy comfort levels in a given situation? Web Browsing Behaviours What web browsing behaviours might impact the feasibility of privacy management approaches?

7 Exploratory Research: Mixed Methodology Approach Survey represents self-reported concerns, large number of people –Incidental Information Privacy (IIP) survey June 2004-March 2005, 155 participants Field studies provide actual behaviours, rich detail, few people –Privacy Gradients 1 (PG1) field study August 2004, 20 participants –Privacy Gradients 2 (PG2) field study March 2005, 15 participants

8 IIP Survey: Goals 1.What is the scope of the problem?  Frequency  Current privacy management strategies 2.What web browsing activities occur?  Location  Device 3.How does context affect level of comfort?  Sensitivity of content  3 scenarios (positive, neutral, embarrassing)  Reflect on usual browsing  Relationship to viewer  5 types (spouse, close friend, parent, colleague, supervisor)  Level of control  3 levels (you, other, away)

9 PG1 Field Study: Goals Examine participants’ perception of the privacy of their actual web browsing activity

10

11 PG2 Field Study: Goals How does context (location, content) affect participant’s privacy classifications? Do the findings from the first field study extend to a broader participant base? –PG1: laptop users/primarily technical –PG2: varied technical experience/computer use 5 technical desktop 5 non-technical desktop 5 non-technical laptop users

12 Exploratory Study Results Incidental information privacy is a concern for many –Regular occasions of others viewing displays All 155 IIP Survey participants had at least one potential viewer –Regular occasions of others using their computers 145/155 IIP Survey participants had at least one potential user –Most concerned enough to take some actions to maintain privacy 64.3% Survey, 95% PG1, 91.7% PG2

13 Overall Effect of Viewing Context Privacy comfort is affected by level of control retained, viewer, and sensitivity of content 1=extremely uncomfortable, 4=neutral, 7=extremely comfortable

14 Participants’ privacy comfort varied within each viewing context Average privacy comfort levels when reflecting on usual browsing Level of control Viewer type

15 Inherent Privacy Concerns

16 Inherent Privacy Concerns Pragmatists

17 Model of Visual Privacy within Web Browsers Situational factors Dispositional factors Browsing Activities Privacy Concerns

18 Design Guidelines Afford selective deletion/storage of traces. Provide nuanced privacy levels. Support multi-tasking – concurrent windows containing content of differing sensitivities. Accommodate varying privacy concerns through personalization/flexibility in usage. Reduce classification burden of traces with (semi-) automated support.

19 Web Browsing Characteristics Limit Design Space Magnitude of information complicates management approach –~275 page visits per day –Frequent bursts of activity

20 Evaluated Two Automated Privacy Management Approaches Theoretically examined the feasibility of using content categorization to assign a privacy level to visited pages –Results presented at WWW 2006 –Standardized approach not feasible –Need to improve results before a personalized approach would work Explored a predictive model of privacy comfort level in a given situation –Initial results promising –Need to validate with more data

21 Patterns in Privacy Application Suggest a Semi-Automated Approach

22 Explicit Approach: PrivateBits

23 Privacy controls

24 PrivateBits Evaluation Approach effective at meeting range of privacy concerns and browsing strategies Participants’ privacy comfort levels increased (8/10 > 1+ points) for viewing scenarios 9/10 would like to use it if developed BUT Additional security features required Default settings should be configurable Concealment of the system itself