Engineering Privacy By Design Seda Gürses COSIC, ESAT K.U. Leuven Belgium 1
Outline - Introduction and Approach - Privacy Requirements Definition Problem - Privacy Requirements Analysis Problem - Policy and Compliance - Privacy By Design - Data Minimization - Conclusion 2 2
privacy? - what is privacy? - what are privacy requirements? - in security engineering: confidentiality 3 3
online social networks (SNS) 4 4
100m 350m 500m 680m 50m 12m 5m 1m universal 1 in 5 divorces User “ comment ” and telephone due to numbers and “ send ” buttons on facebook data addresses 50K sites in addition revealed to Third Parties to “ like ” NHS Discriminatory Behavioral Profiling reveals data to Facebook User IDs revealed to Homeland Security cyberbullying bans Third Parties protests friends Aliens protests Canadian Privacy Commissioner protests FACECLOAK user 50.000 in 3 days NOYB BEACON friends lists 740.000 SCRAMBLE voting newsfeed chat protests Mobile facebook unlimited leak google xss attacks Facebook API 1.600.000 CONNECTIONS license to Highschools LIVE FEED Facebook PUBLIC user content 2011 2004 2005 2006 2007 2008 2009 2010 5 5
- all of these are (somehow) about privacy and the design of the system - how do we deal with these issues when developing systems? - specifically: during requirements engineering 6 6
Zave and Jackson Model of RE ENVIRONMENT SYSTEM - domain assumptions describe the behavior of the environment as it is - requirements are statements about the desired conditions in an environment - specification is a restricted form of requirement providing enough information for the engineer to implement the system 7 7
requirements - functional requirements state the desired behavior of the environment - non-functional requirements either constrain the behavior of the environment or define certain desired qualities of the environment 8 8
multilateral privacy requirements engineering - reconcile: - privacy notions (legal & surveillance studies) - privacy solutions (computer science) - in a social context - multilaterally - during requirements engineering 9 9
data protection privacy 10 10
data protection privacy non-absolute contextual relational opacity of the individual 10 10
data protection privacy non-absolute contextual procedural safeguards relational accountability transparency opacity of the individual personal data 10 10
surveillance studies 11 11
surveillance studies surveillance 11 11
surveillance studies surveillance dataveillance covaillance sousveillance 11 11
privacy requirements definition subjectivity lack of contrivability lack of satisfiability universality legal compliance agonism negotiability counter - factuality environmental factors temporality 12 12
multilateral privacy requirements engineering - reconcile: - privacy notions (legal & surveillance studies) - privacy solutions (computer science) - in a social context - multilaterally - during requirements engineering 13 13
solutions from privacy research data Differential confidentiality anonymous Privacy database communications anonymization anonymous Discrimination certificates aware data mining IDMS anonymous Feedback and certificates Awareness Systems Privacy Policy Languages 14 14
privacy research paradigms hiding information and identity the right to be let alone. Warren & Brandeis (1890) privacy as confidentiality 15 15
privacy research paradigms hiding information and identity right of the individual to decide what information about himself should be communicated to the right to be let alone. others and under what Warren & Brandeis (1890) circumstances. (Westin 1970) privacy as separation of privacy confidentiality identities, data as control protection principles 16 16
privacy research paradigms hiding information and identity right of the individual to decide what information about himself should be communicated to the right to be let alone. others and under what Warren & Brandeis (1890) circumstances. (Westin 1970) privacy as separation of privacy confidentiality identities, data as control protection principles privacy as practice the freedom from unreasonable constraints on the construction of one’s own identity (Agre, 1999) transparency and feedback 17 17
privacy research paradigms hiding information and identity privacy as separation of privacy confidentiality identities, data as control protection principles privacy as practice transparency and feedback 18 18
security engineering & paradigms SECURITY ENGINEERING privacy privacy as control as confidentiality privacy as practice 19 19
multilateral privacy requirements engineering - reconcile: - privacy notions (legal & surveillance studies) - privacy solutions (computer science) - in a social context - multilaterally - during requirements engineering 20 20
privacy and the Zave & Jackson Model - Zave and Jackson model is limited: - does not account for requirements that are not absolutely satisfiable - does not facilitate subjective articulations of domain assumptions, requirements or specifications - does not express stakeholder attitudes and emotions (only beliefs, desires and intentions) 21 21
Zave and Jackson Model of RE ENVIRONMENT SYSTEM - domain assumptions describe the behavior of the environment as it is - requirements are statements about the desired conditions in an environment - specification is a restricted form of requirement providing enough information for the engineer to implement the system 22 22
requirements - functional requirements state the desired behavior of the environment - non-functional requirements either constrain the behavior of the environment or define certain desired qualities of the environment 23 23
privacy requirements ontology quality ill-defined well-defined quality subjective structured space privacy privacy concern constraint Σ Q 24 24
privacy requirements ontology quality ill-defined well-defined quality subjective structured space privacy privacy concern constraint Σ Q munsell color notation: 10 red color: red hue 7 chroma 8 25 25
quality ill-defined well-defined quality subjective structured space privacy privacy concern constraint justified approximation Σ Q evaluation 26 26
privacy requirements ontology stakeholder surveillance functionality arbitration information privacy concerns due to experiences or expectations of harms due to informational constraints on info. self-determination due to significance of information 27 27
privacy requirements ontology stakeholder surveillance functionality functionality arbitration information privacy concerns due to experiences or expectations of harms due to informational constraints on info. self-determination due to significance of information 27 27
privacy requirements ontology stakeholder surveillance functionality arbitration information privacy concerns justified designation privacy goals control confidentiality SECURITY ENGINEERING practice 28 28
privacy requirements ontology stakeholder surveillance functionality arbitration information privacy concerns justified designation privacy goals justified approximation privacy constraints 29 29
privacy requirements ontology stakeholder surveillance functionality arbitration information privacy concerns justified designation communication analysis privacy goals justified confidentiality approximation privacy strength of anonymity constraints 30 30
role of security engineering SECURITY ENGINEERING privacy privacy as control as confidentiality privacy as practice 31 31
data protection trust stakeholder privacy concerns assumptions adversary privacy goals functionality information threats privacy usability constraints justified approximation justified designation 32 32
privacy engineering - requires learning skills (craft) - complicated practice - market incentives - assume functionality vs. privacy - policy and regulation 33 33
Policy and Privacy By Design communication of the ec data protection compliance throughout the entire life cycle of technologies and procedures FTC report data security, reasonable collection limits, sound retention practices, data accuracy 34 34
Policy and Privacy By Design define the purpose further legitimize collection generally to collect any through consent and “technical data control” vulnerabilities of PbyD as compliance limit the scope of “personal data” 35 35
centralized engineer introduces databases PbyD symbolic mimicry of bureaucracy as compliance leaves out security “trust us, we engineering do not do increase consumer evil” confidence 36 36
the Cavoukian PbyD principles privacy by design is privacy embedded into design 37 37
Recommend
More recommend
