1. CyLab Usable Privacy and Security Laboratory http://cups.cs.cmu.edu/ 1 Privacy Policy, Law and Technology Fair Information Practices September 7, 2010

2. CyLab Usable Privacy and Security Laboratory http://cups.cs.cmu.edu/ 2 Finding information with search engines

3. CyLab Usable Privacy and Security Laboratory http://cups.cs.cmu.edu/ 3 Finding info with search engines  General purpose search engines – Google, Yahoo, Bing – Ask, Altavista, Yippy, Dogpile, etc.  Search CS research literature – http://portal.acm.org http://portal.acm.org – http://citeseer.ist.psu.edu/ http://citeseer.ist.psu.edu/ – http://ieeexplore.ieee.org/ http://ieeexplore.ieee.org/ – http://scholar.google.com/ http://scholar.google.com/ – http://academic.research.microsoft.com/ http://academic.research.microsoft.com/

4. CyLab Usable Privacy and Security Laboratory http://cups.cs.cmu.edu/ 4 Advanced searching  Boolean searching – Operators: AND, OR, NOT, NEAR – Implied operators: AND is often implied – Parentheses for grouping – Wildcards – Quotes  Getting to know the ins and outs of your favorite search engines – Many search engines do not use pure boolean searching – Most search engines have some special syntax – Search engines use different algorithms to determine best match

5. CyLab Usable Privacy and Security Laboratory http://cups.cs.cmu.edu/ 5 Using Library Resources

6. CyLab Usable Privacy and Security Laboratory http://cups.cs.cmu.edu/ 6 CMU Libraries  http://www.library.cmu.edu http://www.library.cmu.edu  Engineering and Science (a.k.a. E&S) – Location: Wean Hall, 4th floor – Subjects: Computer Science, Engineering, Mathematics, Physics, Science, Technology  Hunt (CMU’s main library) – Location: Its own building (possibly 2nd ugliest on campus behind Wean), between Tepper and Baker – Subjects: Arts, Business, Humanities, Social Sciences  Software Engineering Institute (a.k.a. SEI) – Location: SEI Building (4500 Fifth Avenue), 3rd floor – Subjects: Security, Software, Technology

7. CyLab Usable Privacy and Security Laboratory http://cups.cs.cmu.edu/ 7 START HERE: Cameo  Cameo is CMU’s online library catalog – http://cameo.library.cmu.edu/  Catalogs everything CMU has: books, journals, periodicals, multimedia, etc.  Search by key words, author, title, periodical title, etc.

8. CyLab Usable Privacy and Security Laboratory http://cups.cs.cmu.edu/ 8 CAMEO: Search Result for “Cranor” Number of copies and status Library

9. CyLab Usable Privacy and Security Laboratory http://cups.cs.cmu.edu/ 9 CAMEO: Search Result for “Solove” Due date

10. CyLab Usable Privacy and Security Laboratory http://cups.cs.cmu.edu/ 10 If it’s not in Cameo, but you need it today: Local Libraries  Carnegie Library of Pittsburgh – Two closest locations Oakland: Practically on campus (4400 Forbes Ave.) Squirrel Hill: Forbes & Murray (5801 Forbes Ave.) – http://www.carnegielibrary.org/index.html http://www.carnegielibrary.org/index.html  University of Pittsburgh Libraries – 16 libraries! Information science, Engineering, Law, Business, etc. – Get a borrowing card by showing CMU ID at Hillman Library lending desk – http://pittcat.pitt.edu/ http://pittcat.pitt.edu/

11. CyLab Usable Privacy and Security Laboratory http://cups.cs.cmu.edu/ 11 If it’s not in Cameo, and you can wait: ILLiad and E-ZBorrow  ILLiad and E-ZBorrow are catalogs of resources available for Interlibrary Loan from other libraries nationwide (ILLiad) and in Pennsylvania (E- ZBorrow)  Order items online (almost always free)  Wait for delivery – average 10 business days  Find links to ILLiad and E-ZBorrow online catalogs at by following Interlibrary Loan link at http://search.library.cmu.edu/ http://search.library.cmu.edu/

12. CyLab Usable Privacy and Security Laboratory http://cups.cs.cmu.edu/ 12 Other Useful Databases  Links to many more databases, journal collections – Must be accessed on campus or through VPN – http://www.library.cmu.edu/Search/AZ.html  Lexis-Nexis – Massive catalog of legal sources – law journals, case law, news stories, etc.  IEEE and ACM journal databases – IEEE Xplore and ACM Digital Library  INSPEC database – Huge database of scientific and technical papers  JSTOR – Arts & Sciences, Business, Mathematics, Statistics

13. CyLab Usable Privacy and Security Laboratory http://cups.cs.cmu.edu/ 13 And of course…  Reference librarians are available at all CMU libraries, and love to help people find what they need – just ask!

14. CyLab Usable Privacy and Security Laboratory http://cups.cs.cmu.edu/ 14 Course project

15. CyLab Usable Privacy and Security Laboratory http://cups.cs.cmu.edu/ 15 Project overview  Individual or small group (up to ~3 students)  Pick a project from the list of suggested projects – Talk to me if you want to propose something different  All projects have final paper, presentation, and poster as deliverable  Some projects may have other deliverables such as software, user interface designs, etc.  http://cups.cs.cmu.edu/courses/privpolawtech- fa10/project.html http://cups.cs.cmu.edu/courses/privpolawtech- fa10/project.html

16. CyLab Usable Privacy and Security Laboratory http://cups.cs.cmu.edu/ 16 Past projects  http://cups.cs.cmu.edu/courses/privpolawtech-fa07/poster.html http://cups.cs.cmu.edu/courses/privpolawtech-fa07/poster.html  http://lorrie.cranor.org/courses/fa05/poster.html http://lorrie.cranor.org/courses/fa05/poster.html  http://lorrie.cranor.org/courses/fa04/poster.html http://lorrie.cranor.org/courses/fa04/poster.html  Several past projects have been turned into a thesis or published paper – The Real ID Act: Fixing Identity Documents with Duct Tape. I/S: A Journal of Law and Policy for the Information Society, Fall/Winter 2005 (Serge Egelman). – How Technology Drives Vehicular Privacy. I/S: A Journal of Law and Policy for the Information Society, 2(3), Fall 2006, 981-1015 (Aleecia McDonald). – Scrubbing Stubborn Data: An evaluation of counter-forensic privacy tools. IEEE Security & Privacy, September/October 2006 (Matthew Geiger). – Peripheral Privacy Notifications for Wireless Networks. In Proceedings of the 2005 Workshop on Privacy in the Electronic Society, 7 November 2005, Alexandria, VA (Braden Kowitz). – Privacy in India: Attitudes and Awareness. In Proceedings of the 2005 Workshop on Privacy Enhancing Technologies (PET2005), 30 May - 1 June 2005, Dubrovnik, Croatia (Ponnurangam Kumaraguru). – PANAMA: Privacy Assured Name-Addressable Messaging Architecture For Unlinkable Instant Message Conversations. INI Thesis 2005 (Ryan Mahon).

17. CyLab Usable Privacy and Security Laboratory http://cups.cs.cmu.edu/ 17 Selecting a research topic

18. CyLab Usable Privacy and Security Laboratory http://cups.cs.cmu.edu/ 18 Selecting a research topic  Brainstorm – What are you interested in? – What would you like to learn more about? – What topics might be relevant to your thesis work? – What topics might be relevant to your future career?  Select a small number of candidate topics  Read – How much information seems to be available? – Is this topic over done? – What open questions are there? – Do you still find this topic interesting? – Do you have the skills necessary to pursue this topic?  Focus (September 28 - one paragraph description) – Select a topic – Define a focused research question  Read some more – Conduct a “literature review” – Adjust your topic as needed  Write a project proposal (October 19)

19. CyLab Usable Privacy and Security Laboratory http://cups.cs.cmu.edu/ 19 Writing a Literature Review

20. CyLab Usable Privacy and Security Laboratory http://cups.cs.cmu.edu/ 20 Writing a literature review  What is a literature review? – A critical summary of what has been published on a topic What is already known about the topic Strengths and weaknesses of previous studies – Often part of the introduction or a section of a research paper, proposal, or thesis  A literature review should – be organized around and related directly to the thesis or research question you are developing – synthesize results into a summary of what is and is not known – identify areas of controversy in the literature – formulate questions that need further research Dena Taylor and Margaret Procter. 2004. The literature review: A few tips on conducting it. http://www.writing.utoronto.ca/advice/specific-types-of- writing/literature-reviewhttp://www.writing.utoronto.ca/advice/specific-types-of- writing/literature-review

21. CyLab Usable Privacy and Security Laboratory http://cups.cs.cmu.edu/ 21 Literature review do’s and don’ts  Don’t create a list of article summaries or quotes  Do point out what is most relevant about each article to your paper  Do compare and contrast the articles you review  Do highlight controversies raised or questions left unanswered by the articles you review  Do take a look at some examples of literature reviews or related work sections before you try to create one yourself – For an example, of a literature review in a CS conference paper see section 2 of http://cs1.cs.nyu.edu/~waldman/publius/paper.html http://cs1.cs.nyu.edu/~waldman/publius/paper.html

22. CyLab Usable Privacy and Security Laboratory http://cups.cs.cmu.edu/ 22 Fair Information Practices

23. CyLab Usable Privacy and Security Laboratory http://cups.cs.cmu.edu/ 23 Privacy terminology  Data subject  Data controller  Secondary use of data

24. CyLab Usable Privacy and Security Laboratory http://cups.cs.cmu.edu/ 24 OECD fair information principles  http://www.oecd.org/document/18/0,3343,en_2649_ 34255_1815186_1_1_1_1,00.html http://www.oecd.org/document/18/0,3343,en_2649_ 34255_1815186_1_1_1_1,00.html  Collection limitation  Data quality  Purpose specification  Use limitation  Security safeguards  Openness  Individual participation  Accountability

25. CyLab Usable Privacy and Security Laboratory http://cups.cs.cmu.edu/ 25 US FTC simplified principles  Notice and disclosure  Choice and consent  Data security  Data quality and access  Recourse and remedies US Federal Trade Commission, Privacy Online: A Report to Congress (June 1998), http://www.ftc.gov/reports/privacy3/ http://www.ftc.gov/reports/privacy3/

26. CyLab Usable Privacy and Security Laboratory http://cups.cs.cmu.edu/ 26 How do the various FIPs differ?

27. CyLab Usable Privacy and Security Laboratory http://cups.cs.cmu.edu/ 27 The Prada NYC dressing room  http://www.sggprivalite.com/ http://www.sggprivalite.com/  What aspects seem privacy invasive?  How could the design be changed to reduce privacy concerns?

28. CyLab Usable Privacy and Security Laboratory http://cups.cs.cmu.edu/ 28 Discussion questions  Which technologies are privacy invasive?  Which technologies are privacy protective?  Can we turn one into the other?  How can we use the FIPs in our analysis?

29. CyLab Usable Privacy and Security Laboratory http://cups.cs.cmu.edu/ 29 Applying the FIPs  Google Street View  Gmail advertising  Hillman Library Web Cam  Amazon.com book recommendations  Giant Eagle Advantage Card  Transportation Security Administration watch lists