1. On Privacy and Compliance: Philosophy and Law meets Computer Science Anupam Datta Stanford University Oakland PC Crystal Ball Workshop January 2007

2. Privacy Research Space What is privacy? PHILOSOPHY Privacy Laws LEGAL POLICY System ModelPolicy Specification Check Compliance COMPUTER SCIENCE

3. Our Approach What is privacy? CONTEXTUAL INTEGRITY [N04] Privacy Laws HIPAA, GLBA, COPPA Model: Communicating Agents in Roles Temporal Logic based Policy Specification Check Compliance using generic model-checking and specialized algorithms

4. Privacy Model AliceBob Charlie’s SSN is 078-05-1120 Sender: Alice Recipient: Bob Subject of message: Charlie Attribute: SSN Transmission principles: –Is this communication allowed? –Can Bob share this information? [Barth, Datta, Mitchell, Nissenbaum] Inspired by “Contextual Integrity” [Nissenbaum04]

5. Sender roleSubject roleAttribute Transmission principle GLBA Example Recipient role Financial institutions must notify consumers if they share their non-public personal information with non- affiliated companies, but the notification may occur either before or after the information sharing occurs

6. Policy language  ::= send(p 1,p 2,m)p 1 sends p 2 message m | contains(m, q, t)m contains attrib t about q | inrole(p, r)p is active in role r | incontext(p, c)p is active in context c | t  t’Attrib t is part of attrib t’ |    |  |  x: .  Classical operators |  U  |  S  | O  Temporal operators

7. Related Languages ModelSenderRecipientSubjectAttributesPastFutureCombination RBACRoleIdentity  XACMLFlexible o  o  EPALFixedRoleFixed  o  P3PFixedRoleFixed  o  o CIRole  u Legend:  unsupported opartially supported  full supported u CI fully supports attributes, combination, temporal conditions

8. Publication uA. Barth, A. Datta, J. C. Mitchell, H. Nissenbaum Privacy and Contextual Integrity: Framework and Applications Proceedings of 27th IEEE Symposium on Security and Privacy, pp. 184-198, May 2006. uLots more to do!

9. Thanks! Questions?

10. Broad Goal uProtect privacy State and enforce restrictions on transmission and use of data Using a formal policy language uExamples: Systems enforcing –HIPAA rule for medical privacy –GLBA for financial transactions –COPPA for children online privacy –Other legal and enterprise privacy policies