1. Contextual Integrity in PORTIA PI: Helen Nissenbaum Students: Timothy Weber & Michael Zimmer New York University In collaboration with: Sam Hawala (U.S. Census) Dan Boneh (Stanford)

2. Embedding Values in Design: Constitutive Activities Discovery Discovering the values relevant to a project Translation Realizing values in design features –Operationalization ** Finding correct concrete expression of value –Implementation ** Specifying design features per operationalized values Verification Verifying that it worked

3. Privacy as Contextual Integrity In a given setting, contextual integrity is maintained when norms of information flow -- appropriateness and transmission --are respected; it is violated otherwise.

4. Norms of Contextual Integrity Norms of Appropriateness –Govern types/categories of information (e.g. fields in a database) Norms of Transmission –Principles governing of flow of information from agent to agent A1 shares info voluntarily with A2 A2 infers information about A1 A1 is mandated to share info with A2 (e.g. earnings to IRS) Confidentiality: A1 shares with A2; A2 may not share further Commercial exchange: A2 buys information about A1 Reciprocity? Information about A1 flows to A2; vice versa? Entitlement: A2 is entitled to information about A1 Etc.

5. Applying CI as a Decision Heuristic A.What is the governing context? B.What type of information is at issue? C.According to what transmission principles (flow and actors)? Red flag if CI is violated.

6. CI in PORTIA: Current work 1.Refine conceptual framework Book 2.“Proof of Concept” in User spaces Model information flow policies and question selection in context of US Census in terms of norms of information flow (Hawala & Weber) P Cybercrime and cyber-policing 3.Implement CI in PORTIA technical projects Vehicle Safety Communication System (Boneh & Zimmer) P

7. CI in PORTIA: Future work 1.Conceptual Framework Address problem of conservatism Complete book 2.Analysis of User Spaces More cases (healthcare; cyber-policing) 3.Technical Implementation More cases (“privacy-sensitive data mining”; aggregation and profiling, e.g. Choicepoint, differential authorization)