1. Steve Kenny Presented by: Larry Korba Design Embedded Privacy Risk Management Institute for Information Technology 14 th CACR, November 7,8, 2002

2. Agenda Background Objectives Approach Conclusions

3. Caveats Not all of the ideas expressed here are my own… Ask all the questions you want, I may not be able to answer!

4. Background Privacy Incorporated Software Agent (PISA) Collaboration http://www.pet-pisa.nl/ Steve – Dutch Data Protection Authority, now a privacy consultant Larry – Network Computing Group Leader, and Leader the Canadian Parts of the PISA project (Network Privacy, Scalability, & Trustworthy HCI) http://www.iit.nrc.ca/

5. Background: PISA 4 Million Euro, 4 countries, 3 years Commenced January 2003 PISA Legislation & PET WP2 WP1 Agent Application WP4 Knowledge Discovery WP3 Agent Security WP5.1 WP5.2 Privacy, Network & Scalability WP5.1 WP5.2 Privacy, Network & Scalability WP5.3 HCI & Trust WP5.3 HCI & Trust

6. Background DEPRM: A PISA development Framework for PET development in Multi- Agent Systems DEPRM offers an integrated approach to lawful distributed management of Personally Identifiable Information (PII)

7. Objectives Implement data privacy law (EU Data Directive 95/46) as accurately as possible within a Multi-Agent System Provide an integrate approach to implementation Influence the Foundation for Intelligent Physical Agents http://www.fipa.org/

8. Approach Constrain design to 95/46/EC To do this 95/46/EC was analyzed to generate requirements for an application domain Results are then implemented, consistent with the directive in late requirements phase Legal Corpus 95/46/EC Application Representation Analog Rendition

9. Approach Producing Application Representation by considering Directive Articles & Recitals in terms of what can be built into a system Secure Perceive Derive Dutch Data Protection Law

10. Approach Multidisciplinary team to implement the representation results in an analogue of the meaning of the law Privacy Specialist Ontologist Cryptosystem/ Security Agent Designer HCI Specialist

11. Approach Data Subject perception important in Directive articles, therefore HCI is vital to spirit of directive Four cognitive concepts elicited from Directive –Comprehend –Conscious –Control –Consent Interface development techniques were applied to address each requirement area, work underway at NRC

12. Approach Lawfully Managing PII is established in the Directive: particular models are not Code & computation integrity is mandated by directive Authentication required if agent representing controller (bound by directive)

13. Approach Data protection rules may be instantiated using ontology, a knowledge base, and interaction protocols Simplified data protection ontology has been created along with knowledge based in JESS Data transfer issues embedded in interaction protocols Architectural additions required as well

14. Conclusions DEPRM offers an integrated framework for complete provision of data protection law in user-oriented MAS applications Principles may be applied to non-MAS applications Data protection ontology may only take a literal agreed interpretation of the law Cryptography important to implement support for the logic of the law. Privacy implementation must be understood/felt by humans: HCI important aspect

15. Conclusions: What’s next Architectural requirements embedded through adoption of DRM model (Journal of Computer Security, Nov. 2002) HCI implications developed (submitted to IEEE Computer) Ontology/Agent implications under being implemented in PISA

16. Conclusions: What’s Next European Privacy Awarness and Consensus (EuroPAC) –FP6 consortium which will implement further DEPRM approaches –Members include NRC, IPC Ontario, Universities and commercial firms EuroPAC aims to become the EC’s de facto data protection development solution with a broad scope from DRM, Ontologies, HCI, standards, security as well as policy

17. Ontology-based Services Trust Services Value add Knowledge Services ASP-Platform Application Services XCOMPLIANCE © Knowledge Domains Trust Services Ontology Services Knowledge Exchange Business Process Interchange Knowledge Networks Semantic Web Privacy Information Retrieval Services - searching corpus - intranets - Internet Interoperability Services M2M : systems M2H : onto-forms Self-compliance Services

18. Thank You… Questions? Stephen_MH_Kenny@yahoo.com Larry.Korba@nrc.ca http://www.iit.nrc.ca Stephen_MH_Kenny@yahoo.com Larry.Korba@nrc.ca http://www.iit.nrc.ca