Some older research I did looking at one way of building privacy-sensitive apps for ubiquitous computing environments. The core idea is to focus on locality, where all of the data is sensed and processed locally as much as possible.
Privacy is the most often-cited criticism of ubiquitous computing, and may be the greatest barrier to its long-term success. However, developers currently have little support in designing software architectures and in creating interactions that are effective in helping end-users manage their privacy. To address this problem, we present Confab, a toolkit for facilitating the development of privacy-sensitive ubiquitous computing applications. The requirements for Confab were gathered through an analysis of privacy needs for both end-users and application developers. Confab provides basic support for building ubiquitous computing applications, providing a framework as well as several customizable privacy mechanisms. Confab also comes with extensions for managing location privacy. Combined, these features allow application developers and end-users to support a spectrum of trust levels and privacy needs.
Authors are Jason Hong and James Landay
2. Ubicomp Privacy is a Serious
Concern
From a nurse required to wear active badge
“[It] could tell when you were in the
bathroom, when you left the unit, and
how long and where you ate your lunch.
EXACTLY what you are afraid of.”
- allnurses.com
3. Ubicomp Presents Range of Privacy
Risks
Everyday Risks Extreme Risks
Stalkers, Muggers
_________________________________
Well-being
Personal safety
Employers
_________________________________
Over-monitoring
Discrimination
Reputation
Friends, Family
_________________________________
Over-protection
Social obligations
Embarrassment
Government
__________________________
Civil liberties
How to maximize real benefit of ubicomp while
minimizing perceived and actual privacy risks?
4. Approach
Confab Privacy Toolkit Informed by End-User
Needs
Hard to analyze privacy
– Analysis of end-user needs for ubicomp privacy
Interviews, surveys, postings on message boards
Hard to implement privacy-sensitive systems
– Confab toolkit for privacy-sensitive ubicomp apps
Capture, processing and presentation of personal info
Focus on location privacy
– Evaluation thru building apps
Location-enhanced messenger
Location-enhanced web proxy
6. An HCI Perspective on Privacy
“The problem, while often couched in terms of privacy,
is really one of control. If the computational system is
invisible as well as extensive, it becomes hard to know:
– what is controlling what
– what is connected to what
– where information is flowing
– how it is being used
The O rig ins o f Ubiq uito us Co m puting Re se arch at PARC in the Late
1 9 8 0 s
We ise r, Go ld, Bro wn
Empowerpeople so they can
choose to share:
• the right information
• with the right people orservices
• at the right time
7. Analysis of End-User Privacy Needs
Lots of speculation about ubicomp privacy, little data
Published Sources
– Examined papers describing usage of ubicomp systems
– Examined existing and proposed privacy protection laws
Surveys and Interviews
– Analyzed survey data of 130 people on ubicomp privacy prefs
– Interviewed 20 people on location-based services
Existing Systems
– Analyzed postings on nurse message board on locator systems
8. Summary of End-User Privacy
Needs
Clear value proposition
Simple and appropriate
control and feedback
Plausible deniability
Limited retention of data
Decentralized control
Special exceptions for
emergencies
Alice’s
Location
Bob’s
Location
10. Confab Toolkit for
Privacy-Sensitive Ubicomp
Confab for privacy-sensitive ubicomp apps
– Cover end-user privacy needs
– Provide solid technical foundation for privacy-sensitive ubicomp
A toolkit needs to support all three of these layers
– Must capture, store, process, & share in privacy-sensitive manner
Physical / Sensor
Infrastructure
Presentation I might present choices
well to users…
…but not have control
over how the info was
acquired or processed
…but not help
developers process it
safely or provide
visibility to end-usersI might acquire
information privately…
11. Past Work Addresses at Most One
Layer
Today, building privacy-sensitive apps would have to
be done in an ad hoc manner
Physical / Sensor
Infrastructure
Presentation
Cricket Location Beacons, Active Bats
P3P, Privacy Mirrors
ParcTab System, Context Toolkit
12. Confab High-Level Architecture
Capture, store, and process personal data on my
computer as much as possible (laptops and PDAs)
Provide greater control and feedback over sharing
InfoSpace
Data Store
InfoSpace
Data Store
LocName
App
On Operators
Source
Sources
Out OperatorsIn Operators
My Computer
Logging
CheckPrivacy Tag
Invisible Mode
Enforce Access
UserInterfaces
Garbage Collect
Periodic Reports
13. Example Built-in Confab Operator
Flow Control
Goal: Disclose different info to different requestors
Conditions
– Age of data – Data Format
– Requestor Domain – Data Type
– Requestor ID – Current Time
– Requestor Location
Actions
– Lower Precision – Allow
– Set (fake value) – Hide (data is removed)
– Invisible (no out data) – Timeout (fake network load)
– Interactive – Deny (forbidden)
14. Outline
Motivation
End-user Privacy Needs
Confab Toolkit for Privacy-Sensitive Ubicomp
Physical layer for acquiring location
Infrastructure layer
Presentation layer
Applications Built
15. Physical / Sensor Layer
Intel’s Place Lab Location Source
Determine location via local database of WiFi Access Points
– Unique WiFi MAC Address -> Latitude, Longitude
– Periodically update your local copy
A
B
C
–Works indoors and
in urban canyons
–Works with encrypted nodes
–No special equipment
–Privacy-sensitive
–Rides the WiFi wave
17. PlaceLab Data at UC Berkeley
University of
California Berkeley
Berkeley Campus
~1000 Nodes
18. Outline
Motivation
End-user Privacy Needs
Confab Toolkit for Privacy-Sensitive Ubicomp
Physical layer for acquiring location
Infrastructure layer
Presentation layer
Applications Built
19. Infrastructure Layer
Confab’s Built-in MiniGIS Operator
People and apps need semantically useful names
– “Meet me at 37.875, -122.257”
MiniGIS operator transforms location info locally
– Using network-based services would be privacy hole
Whittled down to 30 megs from public sources
– Places hardest to get, 3 ugrads + me scouring Berkeley
Country Name = United States
Region Name = California
City Name = Berkeley
ZIPCode = 94709
Place Name = Soda Hall
Latitude/Longitude = 37.875, -122.257
20. Confab Architecture
InfoSpace
Data Store
InfoSpace
Data Store
LocName
PlaceLab
Source
Tourguide
Location
Messenger
How to make users aware of
and be able to control the flow
of personal info?
My Computer
Out Operators
• Flow Control
• MiniGIS
21. Outline
Motivation
End-user Privacy Needs
Pitfalls in User Interfaces for Privacy
Confab Toolkit for Privacy-Sensitive Ubicomp
Physical layer for acquiring location
Infrastructure layer
Presentation layer
Applications Built
22. Notification UI when others request your location (pull)
– Default is always “unknown” (plausible deniability)
Presentation Layer
Notifications
25. Privacy Tags
Digital Rights Management for Privacy
– Like adding note to email, “Please don’t forward”
– Notify address - notify-abc@cs.berkeley.edu
– Time to live - 5 days
– Max number of sightings - last 5 sightings of my location
Provide libraries for making it easy for app developers
Requires non-technical solutions for deployment
– Market support thru TrustE, Consumer Reports
– Legal support thru data retention laws
26. Outline
Motivation
Analysis of End-user Privacy Needs
Confab Toolkit for Privacy-Sensitive Ubicomp
Applications Built
29. Putting it Together #2
Location-Enhanced Web Proxy
Auto-fills location information on existing web sites
Starbucks
MapQuest
PageModification
URL =http://www.starbucks.com/
txtCity =CityName
txtState =RegionCode
txtZip =ZIPCode
30. Location-aware web sites
– Different content based on your current location
Putting it Together #2
Location-Enhanced Web Proxy
31. Application Details
Location-enhanced Instant Messenger
– Uses Hamsam library for cross-platform IM
– ~2500 LOCs across 23 classes, about 5 weeks (mostly GUI)
– Acquiring location, InfoSpace store (and prefs), location queries,
automatic updates, access notifications, MiniGIS + dataset
Location-enhanced web proxy
– Added ~800 LOCs to existing 800 LOCs, about 1 week
– Location queries, automatic updates, MiniGIS + dataset, PlaceBar
Other apps
– Emergency Response app, distributed querying app
Confab reduces what would be a lot of duplicated work
32. Other Parts of this Work
Common risks to design for in privacy-sensitive systems?
Hong, Ng, Lederer, Landay [DIS2004]
Privacy Risk Models for Designing Privacy-Sensitive
Ubiquitous Computing Systems
Common mistakes to avoid in the user interface?
Lederer, Hong, Dey, Landay [PUC 2004]
Personal Privacy through Understanding and Action:
Five Pitfalls for Designers
Design rationale at presentation layer
User evaluations of the apps
33. Conclusions
Confab toolkit for facilitating construction of privacy-
sensitive ubicomp applications
– Privacy at physical, infrastructure, and presentation layers
– Push architecture towards local capture, processing, storage
– Couple w/ better UIs for greater choice, control, and feedback
“Use technology correctly to enhance life. It is important
that people have a choice in how much information can
be disclosed. Then the technology is useful.”
34. Thanks to:
DARPA Expeditions
NSF ITR
Intel Fellowship
Siebel Systems Fellowship
PARC
Intel Research
John Canny
Anind Dey
Scott Lederer
Jennifer Ng
Bill Schilit
Doug Tygar
Many, many others…
http://placelab.org
Jason I. Hong
jasonh@cs.berkeley.edu
http://guir.berkeley.edu/confab
Acknowledgements
35. Hypothesis: The Privacy Hump
Pessimistic
Many legitimate concerns
Many alarmist rants
“Right” way to deploy?
Value proposition?
Rules on fair use?
Optimistic
Things have settled down
Few fears materialized
Market, Social, Legal, Tech
We get tangible value
time
fears
36. Missing Pieces of the Privacy
Puzzle
How do privacy perceptions change over time?
– Ecommerce studies suggest experience important, privacy hump
How do privacy perceptions vary across cultures?
– Western cultures tend to be more individualistic
Metrics for privacy?
– Specific data types (location) or problems (price discrimination)
Economic incentives for companies to do “the right thing”?
Other kinds of protection at the physical layer?
How perfect do we want our ubicomp systems to be?
– Accurate and reliable -> harder to lie
Editor's Notes
Educate on HCI Be excited
Main point is that we need to address these privacy concerns upfront to maximize the benefit of ubicomp Internet Privacy Ubicomp privacy issues RFID Google GMail Sergey Brin, WSJ, on GMail “ I didn’t realize it would be of such high interest to the world, because we’re just making it available to a small group of people” From the Why People Wear Active Badges paper They (badges) will be used to track me around. They will be used to track me around in my private life. They make me furious. From Dev Horn, Former VP of Stick Networks, designing devices Locating friends and family is seen as a negative. This function was seen as “scary” and “creepy” by most consumers, especially because the exact capability of this function was hard to understand. The only exception is among college students who thought being able to find friends would be interesting. “ It creeps me out. There are already too many things that track me.” “ If they want to find me, they can call me.” “ I don’t want to be found.” “ Lord knows, I don’t want my husband to know where I am.”
Many of the threats are from Location Privacy Protection Act 2001 Never Get Lost “ John Anderton, you could use a Guinness right now” Find Friends “ Family is already very close to you, so if they’re checking up on you…sort of already smothering and this is one step further.” “ [It] could tell when you were in the bathroom, when you left the unit, and how long and where you ate your lunch. EXACTLY what you are afraid of.” Emergency Response “ I don’t see how a government or an organization will not come up with an excuse to use [location info] for another purpose.” What’s new here is the scope and scale of ubicomp Past: costly to collect, store, and use info Future: everywhere, always on, more kinds of real-time data Cute “ I would use [friend finder] for spy work and find out if my brother was up to no good. Then I would track him down.” Family [interview] “For a parent, this would be a great spying tool. I just don’t like it at all.” Workplace Abuse / Lack of Respect [survey] “ I don‘t want to be under direct surveillance of my husband or boss no matter what i am doing ” [survey] “this scheme could be used by a boss to constantly track an employee's location without the employee knowing“ [nurses] “These things give me the creeps. George Orwell never thought of this but he should have.” [nurses] “So---are these devices going to be used to track how much time nurses spend in the bathroom during their shift???” [nurses] “The stupid monitoring could tell when you where in the bathroom, when you left the unit, and how long and where you ate your lunch. EXACTLY what you are afraid of. Nurses are not prisoners of the state who need to be monitored every second of every day. ” Tradeoffs CYA (liability, garbage collectors, nurses) Efficiency
These needs and pitfalls became basis of reqts for toolkit
First two, privacy concerns and better design, informed the third, the toolkit
“ Privacy is the claim of individuals, groups or institutions to determine for themselves when, how, and to what extent information about them is communicated to others” Privacy is a deeply embedded concept in our society US Constitution, UN Decl. Human Rights, Hippocratic Oath Leads to many different perspectives on privacy Orwell - “Big Brother” Lessig - Legal, Market, Social, and Technical forces Schoeman - Moral significance of privacy, individual choice G. Marx - Privacy as part of identity and control Privacy is a malleable concept, based on risks and benefits Ex. Credit card to buy goods and services online Ex. Giving out business cards at conferences The key here is end-user choice But ubicomp risks currently seem to outweigh benefits Ex. Initial ubicomp systems, some people suspected the worst Ex. E911 debates, flip a switch and your privacy disappears Existing architectures don’t support end-user choice well Historical perspective
Interviews: did not mention “privacy” unless they did first Lots of speculation, lots of worst-case scenarios, but what are real needs? Survey done by Scott Lederer, I did further analysis on freeform comments Active Badge, PARCTab “ I would use it for spy work and find out if my brother was up to no good. Then I would track him down.” “ Family is already very close to you, so if they’re checking up on you…sort of already smothering, and this is one step further” Find Friend, Active Map, Find Place, Mobile Commerce, Emergency Theoretical work on Designing for Privacy Adams, Bellotti & Sellen, Jiang et al, Palen & Dourish
Concerns were wide-ranged. Very little voiced concerns about government, more about over-monitoring by boss, friends, family (if young), spouses, and intrusion by advertisers Interesting thing here is that people didn’t seem to have concerns about the telecom or service providing location, more about who was using the information In other words, people cared about the endpoint, not the intermediaries Want control and feedback to prevent over-monitoring Value proposition - seemed to be greater resentment towards systems that required something from users but didn’t offer immediate value Control and feedback - lack of control and feedback often led people to suspect the worst, over-monitoring etc Plausible deniability - cell phone example Limited retention - cited in the laws, also makes information more susceptible to data mining Decentralized - came about (indirectly) in the original parctab system, heart of ongoing E911 debates as well, fear of turning a switch and it’s all over Emergencies - obvious
On one hand, ubicomp can be used for great benefit, in terms of safety, efficiency, accountability, quality of life On the other hand, ubicomp can also be used for constant surveillance, loss of control over personal life First two, privacy concerns and better design, informed the third, the toolkit
Confab Architecture and suite of mechanisms for managing privacy Prevent – Strong guarantees on your personal data Avoid – Better user interfaces for managing privacy Detect – Finding over-monitoring or accidental disclosures Architecture and mechanisms provide three different ways of managing privacy Observation: Majority of past work has focused on preventing privacy problems Ex. anonymity, encryption, access control, rule-based systems
Would be difficult w/o Confab, lots of duplicated and non-trivial work P3P (Platform for Privacy Preferences Protocol) Focuses on communicating policy and obtaining consent Privacy Mirrors No control over how information flows or how to build Cricket Location Beacons / Active Bats Does not deal with sharing of information Ubicomp infrastructures [Ex. ParcTab system, Context Toolkit] No support for privacy or end-user control Today, would have to be done in ad hoc manner
Pushing systems design to one extreme, putting as much into a single machine that you have control over
Basic idea: use WiFi Access points to approximate location I did initial Java implementation I did data collection of SF bay area and tools for updating ` http://www.techweb.com/wire/story/TWB20031024S0011 With 300,000 to 400,000 Wi-Fi access points sold every month, Kastner says it's just a question of time before urban users of the wireless technology feel the pain. “ Wifi wave = sales + #wardrivers What are the alternatives here? Centralization was an issue early on in ubicomp (though rarely addressed) Also talked to a lawyer about this (Deidre) Closer data is to you, more legal protection
Image from MapPoint, perhaps the coolest piece of Microsoft software ever written (though they did buy it from someone else, so…)
I wrote this service Telling your friends your GPS location is not useful Also, disclosing lat lon may be more than you really want (most sensitive)
Set-and-forget In-situ Configuration of time based on interviews and surveys Common theme was that people said they wanted only at workplace Another one was just temporary access, b/c acquaintances or tax attorney (temporary) Next “14” days useful for temporary access Can set prefs in situ and then can forget about it, don’t have to constantly check
On one hand, ubicomp can be used for great benefit, in terms of safety, efficiency, accountability, quality of life On the other hand, ubicomp can also be used for constant surveillance, loss of control over personal life First two, privacy concerns and better design, informed the third, the toolkit
Why location-instant messenger? Already a set of trusted friends / co-workers Most common question on SMS is “where are you?” [survey] For example, my friends should always be able to see my truefacefacename and primary email address because they already know that, but depending on what I am doing, I may or may not want them to know what I'm doing or where I am. If I am not available, I would want to be able to leave an away message as in IM.
Why location-instant messenger? Already a set of trusted friends / co-workers Most common question on SMS is “where are you?” [survey] For example, my friends should always be able to see my truefacefacename and primary email address because they already know that, but depending on what I am doing, I may or may not want them to know what I'm doing or where I am. If I am not available, I would want to be able to leave an away message as in IM.
Quote is from an interviewee
Ubiquitous computing is coming Let’s make sure it’s a world we would want to live in
NSF (IIS-0205644) DARPA (N66001-99-2-8913)
Conjecture is that ubicomp has higher hump than past technologies due to quality, quantity, scope of data capture, the encompassing and ubiquitous nature of ubicomp. We need to build things “good enough” to overcome this hump. Doesn’t have to be perfect, just good enough.
Ubiquitous computing is coming Let’s make sure it’s a world we would want to live in