Panel: Prototyping and Building Systems Four Rants on Privacy and Ubicomp Jason I. Hong jasonh at cs cmu edu Intel Usable Privacy Forum

Rant Overview We should push client-centered ubicomp more We should examine how people already manage their privacy today We need to develop better privacy risk models We need better ways of aligning all stakeholders

Rant #1 We should push client-centered ubicomp more

Find nearby “interesting” events –Notify me whenever Yo-Yo Ma is in town –Pull out in a bar to find next thing to go to How Whisper works –Crawls web for events –Every morning, download all events in “Portland” onto PDA –Calculate location locally (ex. Place Lab) –Filter events locally based on interests and location –Whisper only knows you are in “Portland” Whisper Event Service Web Crawler Whisper Service PDA Useful location-based service in privacy-sensitive way

Basic idea: –Local sensing, local storage, local processing –Provide better control and feedback over sharing Examples: –Sensing: GPS, Cricket, Place Lab –Storage: Occasionally Connected Computing Sync up lots of potentially useful info beforehand –Anonymous Broadcast Satellites (GPS, Sirius or XM), Radio (AM / FM) Research issues: –Range of services possible? Tradeoffs? –What kinds of mental models? User interfaces? –Client-centered arch is structural, combine with algorithmic? Client- Centered Architectures

Rant #2 We should examine how people already manage their privacy today

Projecting Personas

How Do People Manage Privacy Today? What we wear, how we talk, who we eat with, etc –Not just secrecy –Not just control and feedback –Not just informed consent Interaction is a “performance” shaped by environment and audience, constructed to project an “impression” consonant with desired goals of the actor

How Do We Manage Impressions? Spatial boundaries –Ex. closing door, seeing who else is around –Leverages our understanding of physics Temporal boundaries –Ex. Big Hair in the 80s Social and Organizational boundaries –Ex. student and advisor, student and peers –Leverages our understanding of social roles and power “Place / Activity” boundaries –Ex. “at work”, “at home”, “in the car”, “on my way”

But Ubicomp Disrupts Our Understanding You think you are in one context, actually overlapped in many others Without this understanding, cannot act appropriately and project desired persona

Possible Research Directions Foster better mental models –Sensor notifications, ex. beeps at new people to see –Make sensing viscerally clear at the physical layer Match people’s existing mental models –Be mostly harmless, ex. reduce identifiability –Locality, ex. limit queries or broadcast by location –Minimize boundary crossings at deploy-time –Sense bounds and adapt (possible??) Leverage other existing techniques –Plausible deniability, ex. missed cell phone call Ex. How good / reliable do we want infrastructure to be? –Incremental steps with familiar tech, ex. web browser or IM –Make risky things look scary, “hair standing on back of neck”

But a Word of Caution… Lederer, MS Thesis, UC Berkeley, 2004

Rant #3 We need to develop better privacy risk models

Privacy Risk Model Analogy Security Threat Model “[T]he first rule of security analysis is this: understand your threat model. Experience teaches that if you don’t have a clear threat model – a clear idea of what you are trying to prevent and what technical capabilities your adversaries have – then you won’t be able to think analytically about how to proceed. The threat model is the starting point of any security analysis.” - Ed Felten

Example privacy risks –Overzealous parents, “friendly stalkers” –Undesired social obligations –Location-based spam –Employer monitoring –Identity theft, spyware, viruses, phishing –Muggers, domestic abusers, not-so-friendly stalkers –1984 governments No system can account for every conceivable risk Need methods and tools for assessing and prioritizing risks to provide a reasonable level of privacy against foreseeable risks Why Privacy Risk Models?

Getting it right the first time is hard Need better support for going quickly around this loop Iterative Design for Assessing Risks Design Prototype Evaluate

Basic Idea: –Get feedback from real users early on –Go thru multiple iterations quickly and easily before actually building and deploying apps –Involve people beyond application developers Ex. Interaction designers, sociologists, lawyers, etc Examples: –Topiary Li, Hong, Landay, UIST2005 Idea #1: Rapid Prototyping Tools

Basic Idea: –Get feedback from real users early on –Go thru multiple iterations quickly and easily before actually building and deploying apps –Involve people beyond application developers Ex. Interaction designers, sociologists, lawyers, etc Examples: –Topiary Research issues: –How far can we go with prototyping tools for ubicomp? Ex. How much sensing can we fake? Range of apps? Space and time issues? –How to support larger-scale prototypes? Idea #1: Rapid Prototyping Tools

More dissemination of risks with specific data types –Case studies –Design patterns Task analysis / Checklist analogy –Social: Relationship between people? –Tech: Where is data stored? –Interaction: Optimistic / Interactive / Pessimistic (Povey 2002) (Hong, Ng, Lederer, Landay, DIS2004) Extreme programming analogy –One team builds, another attacks or subverts Idea #2: Methods for Analyzing Risks

Can we measure a system’s level of privacy? –Could compare designs systematically –Crystallize idea of privacy in app developer minds –Hopefully lead to an “arms race” (MHz, GB, and “Westins”) Example: location data –How precisely / how often can a service ID your location? –Privacy vs. bandwidth (ex. requesting chunks of data) –Privacy vs. timeliness (ex. use cached data) –Defend vs specific scenarios (ex. price discrimination) Possible approaches: –TREC bakeoffs on corpus of location data –TREC bakeoffs on architectures Idea #3: Information Privacy Metrics

Rant #4 We need better ways of aligning all stakeholders

Aligning stakeholder interests –Government – homeland security / accountability –Market – making money –App developers– scalable, robust, and “cool” –… Few incentives for doing the right thing –Why make sensors obvious? Extra cost in manufacturing –Why program it that way? Extra cost in learning and programming for app developers –Why not collect info? Lowers opportunities for marketing Hardest Part of Ubicomp Privacy

Service: payment support for ubicomp –Cross-subsidization, ex. mall tour guide –Ad-based, ex. radio –Public service, ex. GPS –Service per use, ex. credit card, micropayments Third parties for managing your privacy? –Only disclose your location info in emergencies (MedicAlert) –Warn you about bad services –You’ve already disclosed A and B, don’t disclose C –Privacy Angel, Private Computation Idea #1: Figure out sustainable biz models (Boddupalli et al. WMCSA2003)

Develop better toolkits, infrastructures, etc Market them to app developers –Easy to learn (leverage existing tech, ex. http?) –Easy to create cool apps –Scalable, robust –Oh yeah, and privacy too (for free) Probably not best approach, but might get us 80% of the way there –Surreptitiously sneak privacy into the core ubicomp fabric –Popularize it to become the de facto standard Idea #2: Bottom-up with App Developers

Rant Summary Push client-centered ubicomp first –Local sensing, local storage, local processing –Better user interfaces when sharing personal info How people already manage their privacy today –Projecting personas –Plausible deniability Better privacy risk models –Rapid prototyping tools –Analysis methods –Metrics Better ways of aligning all stakeholders –Biz models –App developers

Payment Support in Ubiquitous Computing Environments, by Boddupalli et al. (WMCSA2003) Privacy Risk Models for Designing Privacy-Sensitive Ubiquitous Computing Systems, by Hong et al. Designing Interactive Systems (DIS2004). Topiary: A Tool for Prototyping Location-Enhanced Applications, by Li, Hong, and Landay. (UIST2004) Some Relevant Papers

Bonus Slides

Scope and scale –Everywhere, any time Easier to collect and share info –Location, activities, habits, hobbies, people with Breaks existing notions of space and time –Close the door –Whisper to people Machine readable and searchable How Ubicomp Changes the Landscape

Basic Idea: Examples: Research Issues Privacy-Sensitive Ubicomp Architectures Multiple Layers of Privacy Physical / Sensor Infrastructure Presentation Cricket Location Beacons, Active Bats P3P, Privacy Mirrors ParcTab System, Context Toolkit

Privacy Perspective #1 Control and Feedback “The problem, while often couched in terms of privacy, is really one of control. If the computational system is invisible as well as extensive, it becomes hard to know: – what is controlling what – what is connected to what – where information is flowing – how it is being used The Origins of Ubiquitous Computing Research at PARC in the Late 1980s Weiser, Gold, Brown Empower people so they can choose to share: the right information with the right people or services at the right time

Make it easy for organizations to do the right thing –Detecting abuse (ex. honeypots, audits) –Better database aggregation and anonymization –Better org-wide policies and enforcement Make it easy for organizations to do the right thing –Detecting abuse (ex. honeypots, audits) –Better database aggregation and anonymization –Better org-wide policies and enforcement Challenges

Basic idea: –Local sensing, local storage, local processing –Provide better control and feedback over sharing Examples: –Sensing: GPS, Cricket, Place Lab Client- Centered Architectures ABC