Protecting Sensitive Email Archival Views on Challenges and Opportunities Katie Shilton, Amy Wickner, Douglas W. Oard (University of Maryland) & Jimmy Lin (University of Waterloo)

Email: Vital Record, Privacy Nightmare

Providing Access to Non-Sensitive Email Project to build an email search tool that excludes sensitive information Retrieval & machine learning expertise But – what counts as sensitive information? A social science question Sensitive information is contextual Social context, role, information uses, transmission principles all matter Email crosses social contexts. What factors matter most?

Asking experts: Digital archivists Work in progress: interviews with 10 archivists who have processed email collections Questions focused on concerns about sensitivity or secrecy shared by donors, concerns discovered by archivists, and current solutions for addressing those concerns.

Findings: Roles of Concern Protection FROM vs. protection FOR “Newspapers. Public media. Around here, if I’m talking to a distinguished alum, or I’m talking to a faculty member, almost always, if they’re concerned about something, it’s, ‘I don't want it on the front page of [the local paper],’ or, ‘I don't want it on the front page of [the student newspaper].’ That is their single biggest concern, is the media distorting what their intention was.” “So a lot of them are concerned about their family members being present. There’s a donor … he initially was like, “You don't need anything with my family, so if you screen anything out, that’s fine.” But then … he actually talked with his adult children a lot about his work, and they kind of gave him feedback, so that's gonna be a much stickier wicket than we had initially anticipated.”

Findings: Information Type Legally-protected information: PII Banking information Health information Student records Information relating to pending litigation Business secrets: Trade and strategy secrets Internal security information Contracts Nondisclosure agreements

Findings: Reputational Risk Information that, if revealed, might risk a donor’s reputation. Memberships and beliefs (“his grandfather or great-grandfather…was a member of the Klan and he was scandalized about that”) Evidence of stigmatized activity (e.g. drug use). Using foul language in work emails Gossiping, making “unfiltered” or “very very frank” remarks Expressing emotional content in professional situations Battles: “Usually, [sensitivity] is almost entirely going to be something that happened in their career that was contentious. Some controversy that they were part of, some event where they were at loggerheads with another person … and they would prefer not to have that made public.” Reputations of others: “So for example, we have the papers of a very prominent religious speaker and she gets a lot of letters from people about spiritual crises they’re going through. And in some cases that involve… heavy things like abortions, she has asked that the identifying information, the name of the person who sent her that letter be anonymized.”

Next Steps Can we automatically identify reputational risks? Soliciting a corpus of secrets Asking Turkers to contribute (anonymized) sensitive and non-sensitive emails Factorial vignette surveys To rank importance of information types, roles, contexts Building classifiers from the data and testing them on email corpora

Does it Work?

Thank You! kshilton@umd.edu Ethics & Values in Design (EViD) Lab http://evidlab.umd.edu/ Computational Linguistics & Information Processing (CLIP) Lab http://clip.umiacs.umd.edu This research supported by NSF award IIS-1618695.