1. Methods: Deciding What to Design In-Young Ko iko.AT. icu.ac.kr Information and Communications University (ICU) iko.AT. icu.ac.kr Fall 2005 ICE0575 Lecture #18 Data Privacy / Business Value Concepts

2. Fall 2005 2 ICE 0575 – Methods: Deciding What to Design © In-Young Ko, Information and Communications University Announcements This Friday: Special Session on Software Economics by Prof. Jongmoon Baik This Friday: Special Session on Software Economics by Prof. Jongmoon Baik Readings: Readings: Barry Boehm and Kevin Sullivan, “Software Economics: A Roadmap,” ICSE 2000 Barry Boehm and Kevin Sullivan, “Software Economics: A Roadmap,” ICSE 2000 COCOMO II Model Manual COCOMO II Model Manual Optional EVRs for Extra Credits (Individual Work) Optional EVRs for Extra Credits (Individual Work) For the Business Unit (December 6 th ) For the Business Unit (December 6 th ) For the Engineering Unit (December 13 th ) For the Engineering Unit (December 13 th )

3. Fall 2005 3 ICE 0575 – Methods: Deciding What to Design © In-Young Ko, Information and Communications University Picture of the Day: Fairfax Apartments 4614 5th Ave.

4. Fall 2005 4 ICE 0575 – Methods: Deciding What to Design © In-Young Ko, Information and Communications University Data Privacy First Principles First Principles Different approaches to implement First Principles Different approaches to implement First Principles Self-regulatory approach Self-regulatory approach Social protection approach Social protection approach Technical approach Technical approach A privacy concerns model A privacy concerns model

5. Fall 2005 5 ICE 0575 – Methods: Deciding What to Design © In-Young Ko, Information and Communications University Technical Approach System-based approach to ensure personal data protection System-based approach to ensure personal data protection Standardization of data protection technology Standardization of data protection technology Add data protection options to the Internet architecture Add data protection options to the Internet architecture Develop protocols to automatically negotiate privacy requirements Develop protocols to automatically negotiate privacy requirements [Korba & Kenny 2002] [Reidenberg 2000]

6. Fall 2005 6 ICE 0575 – Methods: Deciding What to Design © In-Young Ko, Information and Communications University A Private Rights Management System [Korba & Kenny 2002] Adapting Digital Rights Management (DRM) systems for managing personal information Adapting Digital Rights Management (DRM) systems for managing personal information

7. Fall 2005 7 ICE 0575 – Methods: Deciding What to Design © In-Young Ko, Information and Communications University W3C’s Platform for Privacy Preferences Project (P3P) An emerging industry standard that provides a simple, automated way for users to control the use of personal information on Web sites An emerging industry standard that provides a simple, automated way for users to control the use of personal information on Web sites Users can easily set privacy preferences in their Web browsers and agents by using a policy editor Users can easily set privacy preferences in their Web browsers and agents by using a policy editor Major aspects of a Web site's privacy policies are represented in a standard, human-readable, machine- readable (XML-based) format Major aspects of a Web site's privacy policies are represented in a standard, human-readable, machine- readable (XML-based) format We browsers and agents can automatically accept or reject a Web site's requests for information, based on user preferences We browsers and agents can automatically accept or reject a Web site's requests for information, based on user preferences The HTTP header from a Web server includes a privacy policy reference (e.g., a URL of the policy XML file) The HTTP header from a Web server includes a privacy policy reference (e.g., a URL of the policy XML file) http://www.w3.org/P3P/

8. Fall 2005 8 ICE 0575 – Methods: Deciding What to Design © In-Young Ko, Information and Communications University A P3P Privacy Report Example

9. Fall 2005 9 ICE 0575 – Methods: Deciding What to Design © In-Young Ko, Information and Communications University Analysis on the Technical Approach Pros: Pros: Might narrow the scope of divergences in the execution of First Principles Might narrow the scope of divergences in the execution of First Principles Cons: Cons: Only effective when organizations adopt technical standards Only effective when organizations adopt technical standards Require data protection agencies to have technical experts Require data protection agencies to have technical experts [Reidenberg 2000]

10. Fall 2005 10 ICE 0575 – Methods: Deciding What to Design © In-Young Ko, Information and Communications University A Privacy Concerns Model [Milberg et al., 1995] Values Nationality Regulatory Approaches Information Privacy Concerns Analysis on relationships among nationality, cultural values, and the nature and levels of information concerns Analysis on relationships among nationality, cultural values, and the nature and levels of information concerns

11. Fall 2005 11 ICE 0575 – Methods: Deciding What to Design © In-Young Ko, Information and Communications University Privacy Concerns and Cultural Value Dimensions of Information Privacy Concerns Dimensions of Information Privacy Concerns Collection of personal information Collection of personal information Unauthorized secondary use of personal information Unauthorized secondary use of personal information Errors in personal information Errors in personal information Improper access to personal information Improper access to personal information Cultural Value Indices Cultural Value Indices Uncertainty Avoidance Index (UAI) Uncertainty Avoidance Index (UAI) Power Distance Index (PDI) Power Distance Index (PDI) Individualism Index (IDV) Individualism Index (IDV) [Milberg et al., 1995]

12. Fall 2005 12 ICE 0575 – Methods: Deciding What to Design © In-Young Ko, Information and Communications University Analysis Results Levels of information privacy concern differ across countries Levels of information privacy concern differ across countries The hierarchy of dimensions of information privacy concerns appear consistent across nationalities The hierarchy of dimensions of information privacy concerns appear consistent across nationalities Government Involvement Levels Government Involvement Levels High ‘uncertainty avoidance’ level countries exhibit higher levels of government involvement High ‘uncertainty avoidance’ level countries exhibit higher levels of government involvement Higher ‘power distance’ level countries exhibit higher levels of government involvement Higher ‘power distance’ level countries exhibit higher levels of government involvement Higher ‘individualism’ level countries exhibit less government involvement Higher ‘individualism’ level countries exhibit less government involvement [Milberg et al., 1995] 1/2

13. Fall 2005 13 ICE 0575 – Methods: Deciding What to Design © In-Young Ko, Information and Communications University Analysis Results Values Nationality Regulatory Approaches Information Privacy Concerns Countries with no privacy regulation or the most strict regulation are associated with lower privacy concerns Countries with no privacy regulation or the most strict regulation are associated with lower privacy concerns Higher levels of privacy concern are associated with more moderate regulatory structures Higher levels of privacy concern are associated with more moderate regulatory structures Cultural values do not directly affect privacy concern levels Cultural values do not directly affect privacy concern levels 2/2 [Milberg et al., 1995]

14. Fall 2005 14 ICE 0575 – Methods: Deciding What to Design © In-Young Ko, Information and Communications University Safe Harbor A framework developed by the US Department of Commerce (DoC) A framework developed by the US Department of Commerce (DoC) To bridge the gap of policy differences on data privacy between US and EU To bridge the gap of policy differences on data privacy between US and EU Approved by EU in 2000 Approved by EU in 2000 Benefits of participating organizations: Benefits of participating organizations: EU’s requirements for prior approval of data transfers either will be waived or approval will be automatically granted EU’s requirements for prior approval of data transfers either will be waived or approval will be automatically granted Claims brought by EU citizens against US organization will be heard in US Claims brought by EU citizens against US organization will be heard in US http://www.export.gov/safeharbor/

15. Fall 2005 15 ICE 0575 – Methods: Deciding What to Design © In-Young Ko, Information and Communications University How Safe Harbor Works Entering the safe harbor is voluntary Entering the safe harbor is voluntary Participants must comply with the safe harbor’s requirements; Participants must comply with the safe harbor’s requirements; Publicly declare that they do so Publicly declare that they do so Self certify annually – send a self certification letter to DoC Self certify annually – send a self certification letter to DoC DoC maintain a list of all participants, and make it publicly available DoC maintain a list of all participants, and make it publicly available http://www.export.gov/safeharbor/

16. Fall 2005 16 ICE 0575 – Methods: Deciding What to Design © In-Young Ko, Information and Communications University Safe Harbor Principles Notice to individuals about data collection and processing, and contact information for inquiries or complaints Notice to individuals about data collection and processing, and contact information for inquiries or complaints Choice of making personal data disclosed to a third party or be used for different purposes Choice of making personal data disclosed to a third party or be used for different purposes Onward Transfer of data to a third party only if the third party provides the same level of privacy protection Onward Transfer of data to a third party only if the third party provides the same level of privacy protection Access to personal data to modify or delete the information Access to personal data to modify or delete the information Security mechanism to protect personal data Security mechanism to protect personal data Data Integrity for ensuring reliability of data for its intended use Data Integrity for ensuring reliability of data for its intended use Enforcement mechanisms to investigate complaints and disputes, to verify companies’ compliance, and to remedy any problems Enforcement mechanisms to investigate complaints and disputes, to verify companies’ compliance, and to remedy any problems http://www.export.gov/safeharbor/

17. Fall 2005 17 ICE 0575 – Methods: Deciding What to Design © In-Young Ko, Information and Communications University Limitations of Safe Harbor Cannot ensure the transparent processing of personal information Cannot ensure the transparent processing of personal information Cannot force all organizations that handle personal information to sign up Cannot force all organizations that handle personal information to sign up

18. Fall 2005 18 ICE 0575 – Methods: Deciding What to Design © In-Young Ko, Information and Communications University Privacy Legislations in U.S. GLBA (The Gramm-Leach Bliley Act), 1999 GLBA (The Gramm-Leach Bliley Act), 1999 Protects against the sale of private financial info. Protects against the sale of private financial info. COPPA (Children’s Online Privacy Protection Act), 2000 COPPA (Children’s Online Privacy Protection Act), 2000 Requests parental consent for the collection or use of any personal information of children under 13 Requests parental consent for the collection or use of any personal information of children under 13 HIPPA (Health Insurance Portability and Accountability Act), 1996 HIPPA (Health Insurance Portability and Accountability Act), 1996 Regulates the collection, use and storage of health-sensitive information Regulates the collection, use and storage of health-sensitive information CAN-SPAM (Controlling the Assault of Non-Solicited Pornography and Marketing) Act, 2003 CAN-SPAM (Controlling the Assault of Non-Solicited Pornography and Marketing) Act, 2003 Imposes limitations and penalties on the transmission of unsolicited commercial electronic mails Imposes limitations and penalties on the transmission of unsolicited commercial electronic mails http://www.epic.org/privacy/

19. Fall 2005 19 ICE 0575 – Methods: Deciding What to Design © In-Young Ko, Information and Communications University The CAN-SPAM Act Main Provisions Main Provisions Bans false or misleading header information Bans false or misleading header information Prohibits deceptive subject lines Prohibits deceptive subject lines Requires that commercial emails give recipients an opt- out method Requires that commercial emails give recipients an opt- out method Requires that commercial emails be identified as an advertisement and include the sender's valid physical postal address Requires that commercial emails be identified as an advertisement and include the sender's valid physical postal address Penalties Penalties Up to $11,000 fine for each violation of the provisions Up to $11,000 fine for each violation of the provisions Additional fines for harvesting email address, “dictionary attacks”, relaying emails without permission Additional fines for harvesting email address, “dictionary attacks”, relaying emails without permission http://www.ftc.gov/bcp/conline/pubs/buspubs/canspam.htm

20. Fall 2005 20 ICE 0575 – Methods: Deciding What to Design © In-Young Ko, Information and Communications University Privacy Statements

21. Fall 2005 21 ICE 0575 – Methods: Deciding What to Design © In-Young Ko, Information and Communications University Recommended Privacy Statement What personal information is collected What personal information is collected How personal information is used How personal information is used Instructions to make choices regarding the dissemination and use of personal information Instructions to make choices regarding the dissemination and use of personal information Instructions to access, update and correct personal information Instructions to access, update and correct personal information How to ensure data integrity How to ensure data integrity The process to manage and address consumer concerns The process to manage and address consumer concerns http://www.truste.org/pdf/WriteAGreatPrivacyPolicy.pdf

22. Fall 2005 22 ICE 0575 – Methods: Deciding What to Design © In-Young Ko, Information and Communications University Privacy References [Reidenberg 2000] J.R. Reidenberg. Resolving conflicting international data privacy rules in cyberspace. Stanford Law Review 52 (2000), pp. 1315-1376. [Reidenberg 2000] J.R. Reidenberg. Resolving conflicting international data privacy rules in cyberspace. Stanford Law Review 52 (2000), pp. 1315-1376. [Korba & Kenny 2002] L. Korba and S. Kenny. Towards Meeting the Privacy Challenge: Adapting DRM. ACM Workshop on Digital Rights Management, Washington, DC, November 2002. [Korba & Kenny 2002] L. Korba and S. Kenny. Towards Meeting the Privacy Challenge: Adapting DRM. ACM Workshop on Digital Rights Management, Washington, DC, November 2002. [Milberg et al., 1995] Sandra J. Milberg and Sandra J. Burke and H. Jeff Smith and Ernest A. Kallman. Values, personal information privacy, and regulatory approaches. Commun. ACM, Vol. 38, No. 12, 1995, pp. 65-74. [Milberg et al., 1995] Sandra J. Milberg and Sandra J. Burke and H. Jeff Smith and Ernest A. Kallman. Values, personal information privacy, and regulatory approaches. Commun. ACM, Vol. 38, No. 12, 1995, pp. 65-74. 1/2

23. Fall 2005 23 ICE 0575 – Methods: Deciding What to Design © In-Young Ko, Information and Communications University Privacy References [EC 2003] Data Protection. European Opinion Research Group, European Commission, 2003. http://europa.eu.int/comm/public_opinion/archives/ebs/ebs_196_data_protection.pdf [EC 2003] Data Protection. European Opinion Research Group, European Commission, 2003. http://europa.eu.int/comm/public_opinion/archives/ebs/ebs_196_data_protection.pdf http://europa.eu.int/comm/public_opinion/archives/ebs/ebs_196_data_protection.pdf The Directive. Directive 95/46/EC of the European Parliament and of the Council: http://europa.eu.int/comm/internal_market/privacy/law_en.htm The Directive. Directive 95/46/EC of the European Parliament and of the Council: http://europa.eu.int/comm/internal_market/privacy/law_en.htm http://europa.eu.int/comm/internal_market/privacy/law_en.htm Safe Harbor: http://www.export.gov/safeharbor/ Safe Harbor: http://www.export.gov/safeharbor/ http://www.export.gov/safeharbor/ FTC Privacy Initiatives: http://www.ftc.gov/privacy/ FTC Privacy Initiatives: http://www.ftc.gov/privacy/ http://www.ftc.gov/privacy/ EPIC Privacy site: http://www.epic.org/privacy/ EPIC Privacy site: http://www.epic.org/privacy/ http://www.epic.org/privacy/ Platform for Privacy Preferences (P3P) Project: http://www.w3.org/P3P/ Platform for Privacy Preferences (P3P) Project: http://www.w3.org/P3P/ http://www.w3.org/P3P/ 2/2

24. Fall 2005 24 ICE 0575 – Methods: Deciding What to Design © In-Young Ko, Information and Communications University Conclusion on Data Privacy Multinational coordination and cooperation are needed Multinational coordination and cooperation are needed Country-specific solutions also need to be developed based on their privacy concern levels Country-specific solutions also need to be developed based on their privacy concern levels Technological development to ensure data privacy is needed Technological development to ensure data privacy is needed Technical standards and capabilities need to be developed to protect personal data Technical standards and capabilities need to be developed to protect personal data Current standardization efforts are lead by international standardization organizations such as ISO, W3C, ICANN, IETF Current standardization efforts are lead by international standardization organizations such as ISO, W3C, ICANN, IETF

25. Fall 2005 25 ICE 0575 – Methods: Deciding What to Design © In-Young Ko, Information and Communications University Plan for this Unit Internationalization Internationalization Data Privacy Data Privacy Basic business concepts: Value and the elements that define it; applications to software design Basic business concepts: Value and the elements that define it; applications to software design Utility: Value of outputs, tradeoffs in producing outputs Utility: Value of outputs, tradeoffs in producing outputs Competition and intellectual property: EVR reports Competition and intellectual property: EVR reports Value and versioning Value and versioning Group reports: How business and policy issues affect your designs Group reports: How business and policy issues affect your designs The content of this slide is adopted from the lecture materials of the Methods course (17-652) at Carnegie Mellon University.

26. Fall 2005 26 ICE 0575 – Methods: Deciding What to Design © In-Young Ko, Information and Communications University Software Evaluation Many analysis techniques for code Many analysis techniques for code Especially for correctness, performance Especially for correctness, performance Fewer analysis techniques for design … Fewer analysis techniques for design … Architectural analysis Architectural analysis Cost prediction, e.g. COCOMO Cost prediction, e.g. COCOMO Security analysis, e.g. Butler ’ s SAEM Security analysis, e.g. Butler ’ s SAEM … or other situations where code is not available … or other situations where code is not available COTS, where source code is proprietary COTS, where source code is proprietary Large legacy systems, where code analysis is intractable Large legacy systems, where code analysis is intractable The content of this slide is adopted from the lecture materials of the Methods course (17-652) at Carnegie Mellon University.

27. Fall 2005 27 ICE 0575 – Methods: Deciding What to Design © In-Young Ko, Information and Communications University Shortcomings Evaluations focus on properties of software products or staffing/schedule Evaluations focus on properties of software products or staffing/schedule Not systematically on other costs Not systematically on other costs Relatively little attention to evaluations of design Relatively little attention to evaluations of design But cost of change is less during design than later But cost of change is less during design than later Techniques that do exist don ’ t share a world view Techniques that do exist don ’ t share a world view Sparse, scattered, hard to teach, hard to explain Sparse, scattered, hard to teach, hard to explain The content of this slide is adopted from the lecture materials of the Methods course (17-652) at Carnegie Mellon University.

28. Fall 2005 28 ICE 0575 – Methods: Deciding What to Design © In-Young Ko, Information and Communications University Basic Value Proposition Following economics, value is benefit net of cost V ( d,  ) = B ( x,  ) – C ( d, x,m ) for { x : F ( d, x,m ) }, where x = P ( d,m ) The content of this slide is adopted from the lecture materials of the Methods course (17-652) at Carnegie Mellon University.

29. Fall 2005 29 ICE 0575 – Methods: Deciding What to Design © In-Young Ko, Information and Communications University Value of a Design The value of a design is the benefit, net of cost, of the implementation, represented by its capabilities. V ( d,  ) = B ( x,  ) – C ( d, x,m ) for { x : F ( d, x,m ) }, where x = P ( d,m ) Let d be a designin some appropriate notation x be in R n an open-ended vector of capabilities B express benefitspredicted value of x to user C express costscost of getting x from d The content of this slide is adopted from the lecture materials of the Methods course (17-652) at Carnegie Mellon University.

30. Fall 2005 30 ICE 0575 – Methods: Deciding What to Design © In-Young Ko, Information and Communications University Simplest Possible Example Licensing a software tool will cost $X, and it will save you $Y on your current project Licensing a software tool will cost $X, and it will save you $Y on your current project V = $Y - $X The content of this slide is adopted from the lecture materials of the Methods course (17-652) at Carnegie Mellon University.

31. Fall 2005 31 ICE 0575 – Methods: Deciding What to Design © In-Young Ko, Information and Communications University Uncertainty in Values Capabilities x and values v may be contingent and uncertain, so the elements may express uncertainty such as ranges, probabilities, future values V ( d,  ) = B ( x,  ) – C ( d, x,m ) for { x : F ( d, x,m ) }, where x = P ( d,m ) Let d be a designin some appropriate notation x be in R n an open-ended vector of capabilities v be in V n a multidimensional value space B express benefitspredicted value of x to user C express costscost of getting x from d The content of this slide is adopted from the lecture materials of the Methods course (17-652) at Carnegie Mellon University.

32. Fall 2005 32 ICE 0575 – Methods: Deciding What to Design © In-Young Ko, Information and Communications University Present Value Analysis First assignment for today considered the time value of money and the sensitivity of decisions to interest rates First assignment for today considered the time value of money and the sensitivity of decisions to interest rates The content of this slide is adopted from the lecture materials of the Methods course (17-652) at Carnegie Mellon University.

33. Fall 2005 33 ICE 0575 – Methods: Deciding What to Design © In-Young Ko, Information and Communications University Time = Money Further, values and capabilities are multidimensional V ( d,  ) = B ( x,  ) – C ( d, x,m ) for { x : F ( d, x,m ) }, where x = P ( d,m ) Let d be a designin some appropriate notation x be in R n an open-ended vector of capabilities v be in V n a multidimensional value space B express benefitspredicted value of x to user C express costscost of getting x from d The content of this slide is adopted from the lecture materials of the Methods course (17-652) at Carnegie Mellon University.

34. Fall 2005 34 ICE 0575 – Methods: Deciding What to Design © In-Young Ko, Information and Communications University Multidimensional Cost Analysis Different factors in a problem are appropriately measured in different ways Different factors in a problem are appropriately measured in different ways It ’ s tempting to convert everything to dollars, but this can lead to … It ’ s tempting to convert everything to dollars, but this can lead to … Loss of information related to different properties Loss of information related to different properties Errors by converting nominal, ordinal, or interval scales to a ratio scale Errors by converting nominal, ordinal, or interval scales to a ratio scale Loss of flexibility by early choice of conversion Loss of flexibility by early choice of conversion Confusion of precision with accuracy Confusion of precision with accuracy Many analysis techniques require a single cost unit, but you should delay the conversion as long as possible Many analysis techniques require a single cost unit, but you should delay the conversion as long as possible The content of this slide is adopted from the lecture materials of the Methods course (17-652) at Carnegie Mellon University.

35. Fall 2005 35 ICE 0575 – Methods: Deciding What to Design © In-Young Ko, Information and Communications University Properties of Resources Divisibility/granularity: available increments Divisibility/granularity: available increments Continuousbattery power remaining Continuousbattery power remaining Discrete but dense currency Discrete but dense currency Discrete but sparsesystem version, app choice Discrete but sparsesystem version, app choice Fungibility: convertibility to other resources Fungibility: convertibility to other resources Completecommon currency Completecommon currency Partialbandwidth vs CPU (compression) Partialbandwidth vs CPU (compression) Nonecalendar time vs staff months Nonecalendar time vs staff months Measurement scale: appropriate scale & operations Measurement scale: appropriate scale & operations Nominal, ordinal, interval, ratio Nominal, ordinal, interval, ratio The content of this slide is adopted from the lecture materials of the Methods course (17-652) at Carnegie Mellon University.

36. Fall 2005 36 ICE 0575 – Methods: Deciding What to Design © In-Young Ko, Information and Communications University Measurement Scales and Scale Types ScaleIntuitionPreservesExampleLegitimate transformations NominalSimple classif-Differences Horse, dog, catAny one-to-one remapping ication, no order OrdinalRanking accordingOrderTiny, small, Any monotonic increasing to criterion medium, largeremapping IntervalDifferences are Size of Temperature in Linear remappings with meaningfuldifferenceCelsius or offset (ax+b) Fahrenheit RatioHas a zero pointRatios of Absolute Linear remappings without values are temperature offset (ax) meaningful (Kelvin), values in currency units The content of this slide is adopted from the lecture materials of the Methods course (17-652) at Carnegie Mellon University.

37. Fall 2005 37 ICE 0575 – Methods: Deciding What to Design © In-Young Ko, Information and Communications University Questions??