An Architecture for Privacy-Sensitive Ubiquitous Computing Jason I. Hong HCI Institute Carnegie Mellon University James A. Landay Computer Science and Eng. University of Washington

Ubicomp Privacy is a Serious Concern From a nurse required to wear active badge “[It] could tell when you were in the bathroom, when you left the unit, and how long and where you ate your lunch. EXACTLY what you are afraid of.” -allnurses.com

Ubicomp Presents Range of Privacy Risks Everyday RisksExtreme Risks Stalkers, Muggers _________________________________ Well-being Personal safety Employers _________________________________ Over-monitoring Discrimination Reputation Friends, Family _________________________________ Over-protection Social obligations Embarrassment Government __________________________ Civil liberties How to maximize real benefit of ubicomp while minimizing perceived and actual privacy risks?

Approach Confab Privacy Toolkit Informed by End-User Needs Hard to analyze privacy –Analysis of end-user needs for ubicomp privacy Interviews, surveys, postings on message boards Hard to implement privacy-sensitive systems –Confab toolkit for privacy-sensitive ubicomp apps Capture, processing and presentation of personal info Focus on location privacy –Evaluation thru building apps Location-enhanced messenger Location-enhanced web proxy

Outline  Motivation  End-user Privacy Needs  Confab Toolkit for Privacy-Sensitive Ubicomp  Applications Built

An HCI Perspective on Privacy “The problem, while often couched in terms of privacy, is really one of control. If the computational system is invisible as well as extensive, it becomes hard to know: – what is controlling what – what is connected to what – where information is flowing – how it is being used The Origins of Ubiquitous Computing Research at PARC in the Late 1980s Weiser, Gold, Brown Empower people so they can choose to share: the right information with the right people or services at the right time

Analysis of End-User Privacy Needs Lots of speculation about ubicomp privacy, little data Published Sources –Examined papers describing usage of ubicomp systems –Examined existing and proposed privacy protection laws Surveys and Interviews –Analyzed survey data of 130 people on ubicomp privacy prefs –Interviewed 20 people on location-based services Existing Systems –Analyzed postings on nurse message board on locator systems

Summary of End-User Privacy Needs Clear value proposition Simple and appropriate control and feedback Plausible deniability Limited retention of data Decentralized control Special exceptions for emergencies Alice’s Location Bob’s Location

Outline  Motivation  End-user Privacy Needs  Confab Toolkit for Privacy-Sensitive Ubicomp  Applications Built

Confab Toolkit for Privacy-Sensitive Ubicomp Confab for privacy-sensitive ubicomp apps –Cover end-user privacy needs –Provide solid technical foundation for privacy-sensitive ubicomp A toolkit needs to support all three of these layers –Must capture, store, process, & share in privacy-sensitive manner Physical / Sensor Infrastructure Presentation I might present choices well to users… …but not have control over how the info was acquired or processed …but not help developers process it safely or provide visibility to end-users I might acquire information privately…

Past Work Addresses at Most One Layer Today, building privacy-sensitive apps would have to be done in an ad hoc manner Physical / Sensor Infrastructure Presentation Cricket Location Beacons, Active Bats P3P, Privacy Mirrors ParcTab System, Context Toolkit

Confab High-Level Architecture Capture, store, and process personal data on my computer as much as possible (laptops and PDAs) Provide greater control and feedback over sharing InfoSpace Data Store InfoSpace Data Store LocName App On Operators Source Sources Out OperatorsIn Operators My Computer Logging Check Privacy Tag Invisible Mode Enforce Access User Interfaces Garbage Collect Periodic Reports

Example Built-in Confab Operator Flow Control Goal: Disclose different info to different requestors Conditions –Age of data– Data Format –Requestor Domain– Data Type –Requestor ID– Current Time –Requestor Location Actions –Lower Precision– Allow –Set (fake value)– Hide (data is removed) –Invisible(no out data)– Timeout (fake network load) –Interactive– Deny (forbidden)

Outline  Motivation  End-user Privacy Needs  Confab Toolkit for Privacy-Sensitive Ubicomp  Physical layer for acquiring location  Infrastructure layer  Presentation layer  Applications Built

Physical / Sensor Layer Intel’s Place Lab Location Source Determine location via local database of WiFi Access Points –Unique WiFi MAC Address -> Latitude, Longitude –Periodically update your local copy ABC –Works indoors and in urban canyons –Works with encrypted nodes –No special equipment –Privacy-sensitive –Rides the WiFi wave

PlaceLab Data at SF Bay Area SF Bay Area ~60000 Nodes (~4 Megs)

PlaceLab Data at UC Berkeley University of California Berkeley Berkeley Campus ~1000 Nodes

Outline  Motivation  End-user Privacy Needs  Confab Toolkit for Privacy-Sensitive Ubicomp  Physical layer for acquiring location  Infrastructure layer  Presentation layer  Applications Built

Infrastructure Layer Confab’s Built-in MiniGIS Operator People and apps need semantically useful names –“Meet me at , ” MiniGIS operator transforms location info locally –Using network-based services would be privacy hole Whittled down to 30 megs from public sources –Places hardest to get, 3 ugrads + me scouring Berkeley Country Name= United States Region Name= California City Name= Berkeley ZIP Code= Place Name= Soda Hall Latitude/Longitude= ,

Confab Architecture InfoSpace Data Store InfoSpace Data Store LocName PlaceLab Source Tourguide Location Messenger How to make users aware of and be able to control the flow of personal info? My Computer Out Operators Flow Control MiniGIS

Outline  Motivation  End-user Privacy Needs  Pitfalls in User Interfaces for Privacy  Confab Toolkit for Privacy-Sensitive Ubicomp  Physical layer for acquiring location  Infrastructure layer  Presentation layer  Applications Built

Notification UI when others request your location (pull) –Default is always “unknown” (plausible deniability) Presentation Layer Notifications

Presentation Layer PlaceBar PlaceBar UI used when you send to others (push) –If you give me “city” location, I can offer “events, museum lines”

Confab Architecture InfoSpace Data Store InfoSpace Data Store LocName PlaceLab Source Location Messenger How to control personal info once it leaves your computer? My Computer Tourguide

Privacy Tags Digital Rights Management for Privacy –Like adding note to , “Please don’t forward” –Notify address- –Time to live- 5 days –Max number of sightings- last 5 sightings of my location Provide libraries for making it easy for app developers Requires non-technical solutions for deployment –Market support thru TrustE, Consumer Reports –Legal support thru data retention laws

Outline  Motivation  Analysis of End-user Privacy Needs  Confab Toolkit for Privacy-Sensitive Ubicomp  Applications Built

Putting it Together #1 Location-Enhanced Messenger

Putting it Together #2 Location-Enhanced Web Proxy Auto-fills location information on existing web sites Starbucks MapQuest PageModification URL= txtCity=CityName txtState=RegionCode txtZip=ZIPCode

Location-aware web sites –Different content based on your current location Putting it Together #2 Location-Enhanced Web Proxy

Application Details Location-enhanced Instant Messenger –Uses Hamsam library for cross-platform IM –~2500 LOCs across 23 classes, about 5 weeks (mostly GUI) –Acquiring location, InfoSpace store (and prefs), location queries, automatic updates, access notifications, MiniGIS + dataset Location-enhanced web proxy –Added ~800 LOCs to existing 800 LOCs, about 1 week –Location queries, automatic updates, MiniGIS + dataset, PlaceBar Other apps –Emergency Response app, distributed querying app Confab reduces what would be a lot of duplicated work

Other Parts of this Work Common risks to design for in privacy-sensitive systems? Hong, Ng, Lederer, Landay [DIS2004] Privacy Risk Models for Designing Privacy-Sensitive Ubiquitous Computing Systems Common mistakes to avoid in the user interface? Lederer, Hong, Dey, Landay [PUC 2004] Personal Privacy through Understanding and Action: Five Pitfalls for Designers Design rationale at presentation layer User evaluations of the apps

Conclusions Confab toolkit for facilitating construction of privacy- sensitive ubicomp applications –Privacy at physical, infrastructure, and presentation layers –Push architecture towards local capture, processing, storage –Couple w/ better UIs for greater choice, control, and feedback “Use technology correctly to enhance life. It is important that people have a choice in how much information can be disclosed. Then the technology is useful.”

Thanks to: DARPA Expeditions NSF ITR Intel Fellowship Siebel Systems Fellowship PARC Intel Research John Canny Anind Dey Scott Lederer Jennifer Ng Bill Schilit Doug Tygar Many, many others… Jason I. Hong Acknowledgements

Hypothesis: The Privacy Hump Pessimistic Many legitimate concerns Many alarmist rants “Right” way to deploy? Value proposition? Rules on fair use? Optimistic Things have settled down Few fears materialized Market, Social, Legal, Tech We get tangible value time fears

Missing Pieces of the Privacy Puzzle How do privacy perceptions change over time? –Ecommerce studies suggest experience important, privacy hump How do privacy perceptions vary across cultures? –Western cultures tend to be more individualistic Metrics for privacy? –Specific data types (location) or problems (price discrimination) Economic incentives for companies to do “the right thing”? Other kinds of protection at the physical layer? How perfect do we want our ubicomp systems to be? –Accurate and reliable -> harder to lie