1. Data Privacy Technology @ UMich Kristen LeFevre, Assistant Professor CSE Current Group Members: Daniel Fabbri (Ph.D. student) Lujun Fang (Ph.D. student) Xunjia Lu (Undergraduate student)

2. Motivation Mass digitization of personal data –Web: E-mail, web searches, clickstreams, social network profiles, user-generated content –Healthcare: Electronic health records, clinical trials, genome data –Many more… Legal, ethical, and technical questions surrounding data ownership, collection, dissemination, and use

3. Our Work Overarching Goal: Developing new technologies to better control the collection, dissemination, and use of sensitive data. Specific Projects: –User-Centric Privacy Controls –Data Use and Compliance Auditing –Privacy-Preserving Data Publishing, Private Data Analysis

4. User-Centric Privacy Controls (w/ Lujun Fang) Social media requires non-technical end- users to specify access control policies for their data –E.g., Facebook fine-grained privacy settings Hard for most people! Privacy “Wizard” Project applies data mining and machine learning techniques to recommend detailed privacy settings with minimal user input

5. Data Use Auditing, Compliance Reporting (w/ Dan Fabbri, Xunjia Lu) Access control prevents unauthorized data access –Policies may be incomplete or incorrect –Policies may be deliberately loose E.g., Electronic Health Records Complementary tool: Maintain an audit log to support a posteriori investigation Interesting Challenges: –Misconfiguration response and breach reporting (Dan) –Log monitoring, analysis, and proactive detection of data breaches (Xunjia, Lujun)

6. Thank you! Questions? E-Mail: klefevre@umich.eduklefevre@umich.edu Web: http://www.eecs.umich.edu/~klefevre