Panel: Prototyping and Building Systems Four Rants on Privacy and Ubicomp

1. Panel: Prototyping and Building Systems Four Rants on Privacy and Ubicomp Jason I. Hong jasonh at cs cmu edu Intel Usable Privacy Forum

2. Rant Overview • We should push client-centered ubicomp more • We should examine how people already manage their privacy today • We need to develop better privacy risk models • We need better ways of aligning all stakeholders

3. Rant #1 We should push client-centered ubicomp more

4. Whisper Event Service • Find nearby “interesting” events • Notify me whenever Yo-Yo Ma is in town • Pull out in a bar to find next thing to go to • How Whisper works • Crawls web for events • Every morning, download all events in “Portland” onto PDA • Calculate location locally (ex. Place Lab) • Filter events locally based on interests and location • Whisper only knows you are in “Portland” • Useful location-based service in privacy-sensitive way Web Crawler Whisper Service PDA

5. Client- Centered Architectures • Basic idea: • Local sensing, local storage, local processing • Provide better control and feedback over sharing • Examples: • Sensing: GPS, Cricket, Place Lab • Storage: Occasionally Connected Computing • Sync up lots of potentially useful info beforehand • Anonymous Broadcast • Satellites (GPS, Sirius or XM), Radio (AM / FM) • Research issues: • Range of services possible? Tradeoffs? • What kinds of mental models? User interfaces? • Client-centered arch is structural, combine with algorithmic?

6. Rant #2 We should examine how people already manage their privacy today

7. Projecting Personas

8. How Do People Manage Privacy Today? • What we wear, how we talk, who we eat with, etc • Not just secrecy • Not just control and feedback • Not just informed consent Interaction is a “performance” shaped by environment and audience, constructed to project an “impression” consonant with desired goals of the actor

9. How Do We Manage Impressions? • Spatial boundaries • Ex. closing door, seeing who else is around • Leverages our understanding of physics • Temporal boundaries • Ex. Big Hair in the 80s • Social and Organizational boundaries • Ex. student and advisor, student and peers • Leverages our understanding of social roles and power • “Place / Activity” boundaries • Ex. “at work”, “at home”, “in the car”, “on my way”

10. But Ubicomp Disrupts Our Understanding • You think you are in one context, actually overlapped in many others • Without this understanding, cannot act appropriately and project desired persona

11. Possible Research Directions • Foster better mental models • Sensor notifications, ex. beeps at new people to see • Make sensing viscerally clear at the physical layer • Match people’s existing mental models • Be mostly harmless, ex. reduce identifiability • Locality, ex. limit queries or broadcast by location • Minimize boundary crossings at deploy-time • Sense bounds and adapt (possible??) • Leverage other existing techniques • Plausible deniability, ex. missed cell phone call • Ex. How good / reliable do we want infrastructure to be? • Incremental steps with familiar tech, ex. web browser or IM • Make risky things look scary, “hair standing on back of neck”

12. But a Word of Caution… Lederer, MS Thesis, UC Berkeley, 2004

13. Rant #3 We need to develop better privacy risk models

14. Privacy Risk Model AnalogySecurity Threat Model “[T]he first rule of security analysis is this: understand your threat model. Experience teaches that if you don’t have a clear threat model – a clear idea of what you are trying to prevent and what technical capabilities your adversaries have – then you won’t be able to think analytically about how to proceed. The threat model is the starting point of any security analysis.” - Ed Felten

15. Why Privacy Risk Models? • Example privacy risks • Overzealous parents, “friendly stalkers” • Undesired social obligations • Location-based spam • Employer monitoring • Identity theft, spyware, viruses, phishing • Muggers, domestic abusers, not-so-friendly stalkers • 1984 governments • No system can account for every conceivable risk • Need methods and tools for assessing and prioritizing risks to provide a reasonable level of privacy against foreseeable risks

16. Design Prototype Evaluate Iterative Design for Assessing Risks • Getting it right the first time is hard • Need better support for going quickly around this loop

17. Idea #1: Rapid Prototyping Tools • Basic Idea: • Get feedback from real users early on • Go thru multiple iterations quickly and easily before actually building and deploying apps • Involve people beyond application developers • Ex. Interaction designers, sociologists, lawyers, etc • Examples: • Topiary Li, Hong, Landay, UIST2005

18. Idea #1: Rapid Prototyping Tools • Basic Idea: • Get feedback from real users early on • Go thru multiple iterations quickly and easily before actually building and deploying apps • Involve people beyond application developers • Ex. Interaction designers, sociologists, lawyers, etc • Examples: • Topiary • Research issues: • How far can we go with prototyping tools for ubicomp? • Ex. How much sensing can we fake? Range of apps? Space and time issues? • How to support larger-scale prototypes?

19. Idea #2: Methods for Analyzing Risks • More dissemination of risks with specific data types • Case studies • Design patterns • Task analysis / Checklist analogy • Social: Relationship between people? • Tech: Where is data stored? • Interaction: Optimistic / Interactive / Pessimistic (Povey 2002) (Hong, Ng, Lederer, Landay, DIS2004) • Extreme programming analogy • One team builds, another attacks or subverts

20. Idea #3: Information Privacy Metrics • Can we measure a system’s level of privacy? • Could compare designs systematically • Crystallize idea of privacy in app developer minds • Hopefully lead to an “arms race” (MHz, GB, and “Westins”) • Example: location data • How precisely / how often can a service ID your location? • Privacy vs. bandwidth (ex. requesting chunks of data) • Privacy vs. timeliness (ex. use cached data) • Defend vs specific scenarios (ex. price discrimination) • Possible approaches: • TREC bakeoffs on corpus of location data • TREC bakeoffs on architectures

21. Rant #4 We need better ways of aligning all stakeholders

22. Hardest Part of Ubicomp Privacy • Aligning stakeholder interests • Government – homeland security / accountability • Market – making money • App developers – scalable, robust, and “cool” • … • Few incentives for doing the right thing • Why make sensors obvious? Extra cost in manufacturing • Why program it that way? Extra cost in learning and programming for app developers • Why not collect info? Lowers opportunities for marketing

23. Idea #1: Figure out sustainable biz models • Service: payment support for ubicomp • Cross-subsidization, ex. mall tour guide • Ad-based, ex. radio • Public service, ex. GPS • Service per use, ex. credit card, micropayments • Third parties for managing your privacy? • Only disclose your location info in emergencies (MedicAlert) • Warn you about bad services • You’ve already disclosed A and B, don’t disclose C • Privacy Angel, Private Computation (Boddupalli et al. WMCSA2003)

24. Idea #2: Bottom-up with App Developers • Develop better toolkits, infrastructures, etc • Market them to app developers • Easy to learn (leverage existing tech, ex. http?) • Easy to create cool apps • Scalable, robust • Oh yeah, and privacy too (for free) • Probably not best approach, but might get us 80% of the way there • Surreptitiously sneak privacy into the core ubicomp fabric • Popularize it to become the de facto standard

25. Rant Summary • Push client-centered ubicomp first • Local sensing, local storage, local processing • Better user interfaces when sharing personal info • How people already manage their privacy today • Projecting personas • Plausible deniability • Better privacy risk models • Rapid prototyping tools • Analysis methods • Metrics • Better ways of aligning all stakeholders • Biz models • App developers

26. Some Relevant Papers • Payment Support in Ubiquitous Computing Environments, by Boddupalli et al. (WMCSA2003) • Privacy Risk Models for Designing Privacy-Sensitive Ubiquitous Computing Systems, by Hong et al. Designing Interactive Systems (DIS2004). • Topiary: A Tool for Prototyping Location-Enhanced Applications, by Li, Hong, and Landay. (UIST2004)

27. Bonus Slides

28. How Ubicomp Changes the Landscape • Scope and scale • Everywhere, any time • Easier to collect and share info • Location, activities, habits, hobbies, people with • Breaks existing notions of space and time • Close the door • Whisper to people • Machine readable and searchable

29. Privacy-Sensitive Ubicomp ArchitecturesMultiple Layers of Privacy • Basic Idea: • Examples: • Research Issues Presentation P3P, Privacy Mirrors Infrastructure ParcTab System, Context Toolkit Physical / Sensor Cricket Location Beacons, Active Bats

30. Privacy Perspective #1Control and Feedback “The problem, while often couched in terms of privacy, is really one of control. If the computational system is invisible as well as extensive, it becomes hard to know: • what is controlling what • what is connected to what • where information is flowing • how it is being used • Empower people so they can • choose to share: • the right information • with the right people or services • at the right time The Origins of Ubiquitous Computing Research at PARC in the Late 1980s Weiser, Gold, Brown

31. Challenges • Make it easy for organizations to do the right thing • Detecting abuse (ex. honeypots, audits) • Better database aggregation and anonymization • Better org-wide policies and enforcement • Make it easy for organizations to do the right thing • Detecting abuse (ex. honeypots, audits) • Better database aggregation and anonymization • Better org-wide policies and enforcement

32. A B C Client- Centered Architectures • Basic idea: • Local sensing, local storage, local processing • Provide better control and feedback over sharing • Examples: • Sensing: GPS, Cricket, Place Lab