Usable Privacy and Security Carnegie Mellon University Spring 2006 Cranor/Hong/Reiter 1 Introduction to Privacy January 24, 2006

Usable Privacy and Security Carnegie Mellon University Spring 2006 Cranor/Hong/Reiter 2 Administrivia Collect homework and human subjects certificates Collect student survey forms Make sure everyone has been getting mailing list messages

Usable Privacy and Security Carnegie Mellon University Spring 2006 Cranor/Hong/Reiter 3 Outline What is privacy? Privacy laws and self-regulation Privacy risks from personalization Reducing privacy risks

Usable Privacy and Security Carnegie Mellon University Spring 2006 Cranor/Hong/Reiter 4 What is privacy?

Usable Privacy and Security Carnegie Mellon University Spring 2006 Cranor/Hong/Reiter 5 What is privacy? “Being alone.” - Shane (age 4)

Usable Privacy and Security Carnegie Mellon University Spring 2006 Cranor/Hong/Reiter 6 Westin “Privacy and Freedom” 1967 “Privacy is the claim of individuals, groups or institutions to determine for themselves when, how, and to what extent information about them is communicated to others” Privacy is not an absolute

Usable Privacy and Security Carnegie Mellon University Spring 2006 Cranor/Hong/Reiter 7 Privacy as process “Each individual is continually engaged in a personal adjustment process in which he balances the desire for privacy with the desire for disclosure and communication….” - Alan Westin, 1967

Usable Privacy and Security Carnegie Mellon University Spring 2006 Cranor/Hong/Reiter 8 Westin’s four states of privacy Solitude individual separated from the group and freed from the observation of other persons Intimacy individual is part of a small unit Anonymity individual in public but still seeks and finds freedom from identification and surveillance Reserve the creation of a psychological barrier against unwanted intrusion - holding back communication

Usable Privacy and Security Carnegie Mellon University Spring 2006 Cranor/Hong/Reiter 9 Different views of privacy Privacy as limited access to self the extent to which we are known to others and the extent to which others have physical access to us Privacy as control over information not simply limiting what others know about you, but controlling it this assumes individual autonomy, that you can control information in a meaningful way (not blind click through, for example)

Usable Privacy and Security Carnegie Mellon University Spring 2006 Cranor/Hong/Reiter 10 Privacy as animal instinct Eagles eating a deer carcass Is privacy necessary for species survival?

Usable Privacy and Security Carnegie Mellon University Spring 2006 Cranor/Hong/Reiter 11 Privacy laws and self-regulation

Usable Privacy and Security Carnegie Mellon University Spring 2006 Cranor/Hong/Reiter 12 OECD fair information principles berlin.de/gesetze/internat/ben.htm Collection limitation Data quality Purpose specification Use limitation Security safeguards Openness Individual participation Accountability

Usable Privacy and Security Carnegie Mellon University Spring 2006 Cranor/Hong/Reiter 13 US FTC simplified principles Notice and disclosure Choice and consent Data security Data quality and access Recourse and remedies US Federal Trade Commission, Privacy Online: A Report to Congress (June 1998),

Usable Privacy and Security Carnegie Mellon University Spring 2006 Cranor/Hong/Reiter 14 Laws and regulations Privacy laws and regulations vary widely throughout the world US has mostly sector-specific laws, with relatively minimal protections Federal Trade Commission has jurisdiction over fraud and deceptive practices Federal Communications Commission regulates telecommunications European Data Protection Directive requires all European Union countries to adopt similar comprehensive privacy laws Privacy commissions in each country (some countries have national and state commissions) Many European companies non-compliant with privacy laws (2002 study found majority of UK web sites non-compliant) Safe Harbor allows US companies to self-certify compliance

Usable Privacy and Security Carnegie Mellon University Spring 2006 Cranor/Hong/Reiter 15 Some US privacy laws Bank Secrecy Act, 1970 Fair Credit Reporting Act, 1971 Privacy Act, 1974 Right to Financial Privacy Act, 1978 Cable TV Privacy Act, 1984 Video Privacy Protection Act, 1988 Family Educational Right to Privacy Act, 1993 Electronic Communications Privacy Act, 1994 Freedom of Information Act, 1966, 1991, 1996

Usable Privacy and Security Carnegie Mellon University Spring 2006 Cranor/Hong/Reiter 16 US law – recent additions HIPAA (Health Insurance Portability and Accountability Act, 1996) When implemented, will protect medical records and other individually identifiable health information COPPA (Children‘s Online Privacy Protection Act, 1998) Web sites that target children must obtain parental consent before collecting personal information from children under the age of 13 GLB (Gramm-Leach-Bliley-Act, 1999) Requires privacy policy disclosure and opt-out mechanisms from financial service institutions

Usable Privacy and Security Carnegie Mellon University Spring 2006 Cranor/Hong/Reiter 17 Voluntary privacy guidelines Online Privacy Alliance Direct Marketing Association Privacy Promise privacy/privacypromise.shtml Network Advertising Initiative Principles CTIA Location-based privacy guidelines com.com/news/press/body.cfm?record_id=907

Usable Privacy and Security Carnegie Mellon University Spring 2006 Cranor/Hong/Reiter 18

Usable Privacy and Security Carnegie Mellon University Spring 2006 Cranor/Hong/Reiter 19 Chief privacy officers Companies are increasingly appointing CPOs to have a central point of contact for privacy concerns Role of CPO varies in each company Draft privacy policy Respond to customer concerns Educate employees about company privacy policy Review new products and services for compliance with privacy policy Develop new initiatives to keep company out front on privacy issue Monitor pending privacy legislation

Usable Privacy and Security Carnegie Mellon University Spring 2006 Cranor/Hong/Reiter 20 Seal programs TRUSTe – BBBOnline – CPA WebTrust – Japanese Privacy Mark

Usable Privacy and Security Carnegie Mellon University Spring 2006 Cranor/Hong/Reiter 21 Seal program problems Certify only compliance with stated policy Limited ability to detect non-compliance Minimal privacy requirements Don’t address privacy issues that go beyond the web site Nonetheless, reporting requirements are forcing licensees to review their own policies and practices and think carefully before introducing policy changes

Usable Privacy and Security Carnegie Mellon University Spring 2006 Cranor/Hong/Reiter 22 Privacy policies Policies let consumers know about site’s privacy practices Consumers can then decide whether or not practices are acceptable, when to opt-in or opt-out, and who to do business with The presence of privacy policies increases consumer trust What are some problems with privacy policies?

Usable Privacy and Security Carnegie Mellon University Spring 2006 Cranor/Hong/Reiter 23 Privacy policy problems BUT policies are often difficult to understand hard to find take a long time to read change without notice

Usable Privacy and Security Carnegie Mellon University Spring 2006 Cranor/Hong/Reiter 24 Privacy policy components Identification of site, scope, contact info Types of information collected Including information about cookies How information is used Conditions under which information might be shared Information about opt-in/opt-out Information about access Information about data retention policies Information about seal programs Security assurances Children’s privacy There is lots of information to convey -- but policy should be brief and easy-to-read too! What is opt-in? What is opt-out?

Usable Privacy and Security Carnegie Mellon University Spring 2006 Cranor/Hong/Reiter 25 Short Notices Project organized by Hunton & Williams law firm Create short version (short notice) of a human-readable privacy notice for both web sites and paper handouts Sometimes called a “layered notice” as short version would advise people to refer to long notice for more detail Now being called “highlights notice” Focus on reducing privacy policy to at most 7 boxes Standardized format but only limited standardization of language Proponents believe highlights format may eventually be mandated by law A work in progress -- not yet in use Alternative proposals from privacy advocates focus on check boxes Interest Internationally Interest in the US for financial privacy notices

Usable Privacy and Security Carnegie Mellon University Spring 2006 Cranor/Hong/Reiter 26 Acme Company Privacy Notice Highlights For more information about our privacy policy, write to: Consumer Department Acme Company 11 Main Street Anywhere, NY Or go to the privacy statement on our website at acme.com. We collect information directly from you and maintain information on your activity with us, including your visits to our website. We obtain information, such as your credit report and demographic and lifestyle information, from other information providers. PERSONAL INFORMATION We use information about you to manage your account and offer you other products and services we think may interest you. We share information about you with our sister companies to offer you products and services. We share information about you with other companies, like insurance companies, to offer you a wider array of jointly-offered products and services. We share information about you with other companies so they can offer you their products and services. USES You may opt out of receiving promotional information from us and our sharing your contact information with other companies. To exercise your choices, call (800) or click on “choice” at ACME.com. YOUR CHOICES You may request information on your billing and payment activities. IMPORTANT INFORMATION HOW TO REACH US This statement applies to Acme Company and several members of the Acme family of companies. SCOPE NY142510v1 5/28/2002 Dated: May 28, 2002 Template prepared by the Notices Project, a program ofthe Center for Information Policy Leadership at Hunton &Williams © 2002 Center for Information Policy Leadership Privacy Notice Highlights Template

Usable Privacy and Security Carnegie Mellon University Spring 2006 Cranor/Hong/Reiter 27 Checkbox proposal WE SHARE [DO NOT SHARE] PERSONAL INFORMATION WITH OTHER WEBSITES OR COMPANIES. Collection: YESNO We collect personal information directly from you   We collect information about you from other sources:   We use cookies on our website   We use web bugs or other invisible collection methods   We install monitoring programs on your computer   Uses: We use information about you to:With YourWithout Your ConsentConsent Send you advertising mail   Send you electronic mail   Call you on the telephone   Sharing: We allow others to use your information to:With YourWithout YourConsent Maintain shared databases about you   Send you advertising mail   Send you electronic mail   Call you on the telephoneN/AN/A Access: You can see and correct {ALL, SOME, NONE} of the information we have about you. Choices: You can opt-out of receiving fromUsAffiliatesThird Parties Advertising mail   Electronic mail   Telemarketing  N/A Retention: We keep your personal data for:{Six Months Three Years Forever} Change:We can change our data use policy {AT ANY TIME, WITH NOTICE TO YOU, ONLY FOR DATA COLLECTED IN THE FUTURE}

Usable Privacy and Security Carnegie Mellon University Spring 2006 Cranor/Hong/Reiter 28 Platform for Privacy Preferences Project (P3P) Developed by the World Wide Web Consortium (W3C) Final P3P1.0 Recommendation issued 16 April 2002 Offers an easy way for web sites to communicate about their privacy policies in a standard machine-readable format Can be deployed using existing web servers Enables the development of tools (built into browsers or separate applications) that Summarize privacy policies Compare policies with user preferences Alert and advise users

Usable Privacy and Security Carnegie Mellon University Spring 2006 Cranor/Hong/Reiter 29 Basic components P3P provides a standard XML format that web sites use to encode their privacy policies Sites also provide XML “policy reference files” to indicate which policy applies to which part of the site Sites can optionally provide a “compact policy” by configuring their servers to issue a special P3P header when cookies are set No special server software required User software to read P3P policies called a “P3P user agent”

Usable Privacy and Security Carnegie Mellon University Spring 2006 Cranor/Hong/Reiter 30 What’s in a P3P policy? Name and contact information for site The kind of access provided Mechanisms for resolving privacy disputes The kinds of data collected How collected data is used, and whether individuals can opt-in or opt-out of any of these uses Whether/when data may be shared and whether there is opt-in or opt-out Data retention policy

Usable Privacy and Security Carnegie Mellon University Spring 2006 Cranor/Hong/Reiter 31 A simple HTTP transaction Web Server GET /index.html HTTP/1.1 Host: Request web page HTTP/ OK Content-Type: text/html... Send web page

Usable Privacy and Security Carnegie Mellon University Spring 2006 Cranor/Hong/Reiter 32 … with P3P 1.0 added Web Server GET /w3c/p3p.xml HTTP/1.1 Host: Request Policy Reference File Send Policy Reference File GET /index.html HTTP/1.1 Host: Request web page HTTP/ OK Content-Type: text/html... Send web page Request P3P PolicySend P3P Policy

Usable Privacy and Security Carnegie Mellon University Spring 2006 Cranor/Hong/Reiter 33 P3P increases transparency P3P clients can check a privacy policy each time it changes P3P clients can check privacy policies on all objects in a web page, including ads and invisible images

Usable Privacy and Security Carnegie Mellon University Spring 2006 Cranor/Hong/Reiter 34 P3P in IE6 Privacy icon on status bar indicates that a cookie has been blocked – pop-up appears the first time the privacy icon appears Automatic processing of compact policies only; third-party cookies without compact policies blocked by default

Usable Privacy and Security Carnegie Mellon University Spring 2006 Cranor/Hong/Reiter 35 Users can click on privacy icon for list of cookies; privacy summaries are available at sites that are P3P-enabled

Usable Privacy and Security Carnegie Mellon University Spring 2006 Cranor/Hong/Reiter 36 Privacy summary report is generated automatically from full P3P policy

Usable Privacy and Security Carnegie Mellon University Spring 2006 Cranor/Hong/Reiter 37 P3P in Netscape 7 Preview version similar to IE6, focusing, on cookies; cookies without compact policies (both first-party and third-party) are “flagged” rather than blocked by default Indicates flagged cookie

Usable Privacy and Security Carnegie Mellon University Spring 2006 Cranor/Hong/Reiter 38 Privacy Bird Free download of beta from Origninally developed at AT&T Labs Released as open source “Browser helper object” for IE6 Reads P3P policies at all P3P-enabled sites automatically Bird icon at top of browser window indicates whether site matches user’s privacy preferences Clicking on bird icon gives more information

Chirping bird is privacy indicator

Red bird indicates mismatch

Check embedded content too

Privacy settings

Example: Sending flowers

Usable Privacy and Security Carnegie Mellon University Spring 2006 Cranor/Hong/Reiter 46 Privacy Finder Prototype developed at AT&T Labs, improved and deployed by CUPS Uses Google or Yahoo! API to retrieve search results Checks each result for P3P policy Evaluates P3P policy against user’s preferences Reorders search results Composes search result page with privacy annotations next to each P3P-enabled result Users can retrieve “Privacy Report” similar to Privacy Bird policy summary

Demo

Usable Privacy and Security Carnegie Mellon University Spring 2006 Cranor/Hong/Reiter 48 P3P Resources For further information on P3P see:

Privacy risks from personalization

Usable Privacy and Security Carnegie Mellon University Spring 2006 Cranor/Hong/Reiter 50 Unsolicited marketing Desire to avoid unwanted marketing causes some people to avoid giving out personal information

Usable Privacy and Security Carnegie Mellon University Spring 2006 Cranor/Hong/Reiter 51 My computer can “figure things out about me” The little people inside my computer might know it’s me… … and they might tell their friends

Usable Privacy and Security Carnegie Mellon University Spring 2006 Cranor/Hong/Reiter 52 Inaccurate inferences “My TiVo thinks I’m gay!”

Usable Privacy and Security Carnegie Mellon University Spring 2006 Cranor/Hong/Reiter 53 Surprisingly accurate inferences Everyone wants to be understood. No one wants to be known.

Usable Privacy and Security Carnegie Mellon University Spring 2006 Cranor/Hong/Reiter 54 You thought that on the Internet nobody knew you were a dog… …but then you started getting personalized ads for your favorite brand of dog food

Usable Privacy and Security Carnegie Mellon University Spring 2006 Cranor/Hong/Reiter 55 Price discrimination Concerns about being charged higher prices Concerns about being treated differently

Usable Privacy and Security Carnegie Mellon University Spring 2006 Cranor/Hong/Reiter 56 Revealing private information to other users of a computer Revealing info to family members or co-workers Gift recipient learns about gifts in advance Co-workers learn about a medical condition Revealing secrets that can unlock many accounts Passwords, answers to secret questions, etc.

Usable Privacy and Security Carnegie Mellon University Spring 2006 Cranor/Hong/Reiter 57 The Cranor family’s 25 most frequent grocery purchases (sorted by nutritional value)!

Usable Privacy and Security Carnegie Mellon University Spring 2006 Cranor/Hong/Reiter 58 Exposing secrets to criminals Stalkers, identity thieves, etc. People who break into account may be able to access profile info People may be able to probe recommender systems to learn profile information associated with other users

Usable Privacy and Security Carnegie Mellon University Spring 2006 Cranor/Hong/Reiter 59 Subpoenas Records are often subpoenaed in patent disputes, child custody cases, civil litigation, criminal cases

Usable Privacy and Security Carnegie Mellon University Spring 2006 Cranor/Hong/Reiter 60 Government surveillance Governments increasingly looking for personal records to mine in the name of fighting terrorism People may be subject to investigation even if they have done nothing wrong

Usable Privacy and Security Carnegie Mellon University Spring 2006 Cranor/Hong/Reiter 61 Little Brother as Big Brother

Usable Privacy and Security Carnegie Mellon University Spring 2006 Cranor/Hong/Reiter 63 Risks may be magnified in future Wireless location tracking Semantic web applications Ubiquitous computing

Usable Privacy and Security Carnegie Mellon University Spring 2006 Cranor/Hong/Reiter 64 If you’re not careful, you may violate data protection laws Some jurisdictions have privacy laws that Restrict how data is collected and used Require that you give notice, get consent, or offer privacy-protective options Impose penalties if personal information is accidentally exposed

Reducing privacy risks

Usable Privacy and Security Carnegie Mellon University Spring 2006 Cranor/Hong/Reiter 66 Tends to be MORE Privacy Invasive Tends to be LESS Privacy Invasive Implicit Explicit Persistent (profile) Transient (task or session) System initiated User initiated Predication basedContent based Axes of personalization Data collection method Duration User involvement Reliance on predictions

Usable Privacy and Security Carnegie Mellon University Spring 2006 Cranor/Hong/Reiter 67 A variety of approaches to reducing privacy risks No single approach will always work Two types of approaches: Reduce data collection and storage Put users in control

Usable Privacy and Security Carnegie Mellon University Spring 2006 Cranor/Hong/Reiter 68 Collection limitation: Pseudonymous profiles Useful for reducing risk and complying with privacy laws when ID is not needed for personalization But, profile may become identifiable because of unique combinations of info, links with log data, unauthorized access to user’s computer, etc. Profile info should always be stored separately from web usage logs and transaction records that might contain IP addresses or PII

Usable Privacy and Security Carnegie Mellon University Spring 2006 Cranor/Hong/Reiter 69 Collection limitation: Client-side profiles Useful for reducing risk and complying with laws Risk of exposure to other users of computer remains; storing encrypted profiles can help Client-side profiles may be stored in cookies replayed to server that discards them after use Client-side scripting may allow personalization without ever sending personal info to the server For some applications, no reason to send data to server

Usable Privacy and Security Carnegie Mellon University Spring 2006 Cranor/Hong/Reiter 70 Collection limitation: Task-based personalization Focus on data associated with current session or task - no user profile need be stored anywhere May allow for simpler (and less expensive) system architecture too! May eliminate problem of system making recommendations that are not relevant to current task Less “spooky” to users - relationship between current task and resultant personalization usually obvious

Usable Privacy and Security Carnegie Mellon University Spring 2006 Cranor/Hong/Reiter 71 Putting users in control Users should be able to control what information is stored in their profile how it may be used and disclosed

Usable Privacy and Security Carnegie Mellon University Spring 2006 Cranor/Hong/Reiter 72 Developing good user interface to do this is complicated Setting preferences can be tedious Creating overall rules that can be applied on the fly as new profile data is collected requires deep understanding and ability to anticipate privacy concerns

Usable Privacy and Security Carnegie Mellon University Spring 2006 Cranor/Hong/Reiter 73 Possible approaches Provide reasonable default rules with the ability to add/change rules or specify preferences for handling of specific data Up front With each action After-the-fact Explicit privacy preference prompts during transaction process Allow multiple personae

Example: Google Search History

Usable Privacy and Security Carnegie Mellon University Spring 2006 Cranor/Hong/Reiter 75 Amazon.com privacy makeover

Streamline menu navigation for customization

Usable Privacy and Security Carnegie Mellon University Spring 2006 Cranor/Hong/Reiter 77 Provide way to set up default rules Every time a user makes a new purchase that they want to rate or exclude they have to edit profile info There should be a way to set up default rules  Exclude all purchases  Exclude all purchases shipped to my work address  Exclude all movie purchases  Exclude all purchases I had gift wrapped

Usable Privacy and Security Carnegie Mellon University Spring 2006 Cranor/Hong/Reiter 78 Remove excluded purchases from profile Users should be able to remove items from profile If purchase records are needed for legal reasons, users should be able to request that they not be accessible online

Usable Privacy and Security Carnegie Mellon University Spring 2006 Cranor/Hong/Reiter 79 Better: options for controlling recent history

Usable Privacy and Security Carnegie Mellon University Spring 2006 Cranor/Hong/Reiter 80 Use personae Amazon already allows users to store multiple credit cards and addresses Why not allow users to create personae linked to each with option of keeping recommendations and history separate (would allow easy way to separate work/home/gift personae)?

Usable Privacy and Security Carnegie Mellon University Spring 2006 Cranor/Hong/Reiter 81 Allow users to access all privacy- related options in one place Currently privacy-related options are found with relevant features Users have to be aware of features to find the options Put them all in one place But also leave them with relevant features

Usable Privacy and Security Carnegie Mellon University Spring 2006 Cranor/Hong/Reiter 82 I didn’t buy it for myself How about an “I didn’t buy it for myself” check- off box (perhaps automatically checked if gift wrapping is requested) I didn’t buy it for myself