1. Privacy Policy, Law and Technology Carnegie Mellon University Fall 2007 Lorrie Cranor http://cups.cs.cmu.edu/courses/privpolawtech-fa07/ 1 Search Engines and Social Networks October 18, 2007

2. Privacy Policy, Law and Technology Carnegie Mellon University Fall 2007 Lorrie Cranor http://cups.cs.cmu.edu/courses/privpolawtech-fa07/ 2 Homework 4 Discussion http://cups.cs.cmu.edu/courses/privpolawtech- fa07/hw/hw4.html http://cups.cs.cmu.edu/courses/privpolawtech- fa07/hw/hw4.html P3P policies and human-readable privacy policies What discrepancies did you find? What parts of human-readable policy are not captured in P3P policy? What types of errors did sites make? What are limitations of P3P? Search engine and social networking privacy policies Critique of privacy policies - protections and presentation

3. Privacy Policy, Law and Technology Carnegie Mellon University Fall 2007 Lorrie Cranor http://cups.cs.cmu.edu/courses/privpolawtech-fa07/ 3 Homework 5 http://cups.cs.cmu.edu/courses/privpolawte ch-fa07/hw/hw5.html http://cups.cs.cmu.edu/courses/privpolawte ch-fa07/hw/hw5.html Option: Attend Privacy MindSwap session instead of doing optional readingPrivacy MindSwap

4. Online Social Networks http://services.alphaworks.ibm.com/manyeyes/view/S0yoPHsOtha6O6-7UKyQH2-

5. Privacy Policy, Law and Technology Carnegie Mellon University Fall 2007 Lorrie Cranor http://cups.cs.cmu.edu/courses/privpolawtech-fa07/ 5 MySpace Profiles available to the public No login required to view information Used for “Social Browsing” Finding new friends

6. Privacy Policy, Law and Technology Carnegie Mellon University Fall 2007 Lorrie Cranor http://cups.cs.cmu.edu/courses/privpolawtech-fa07/ 6 Privacy Settings MySpace Settings

7. Privacy Policy, Law and Technology Carnegie Mellon University Fall 2007 Lorrie Cranor http://cups.cs.cmu.edu/courses/privpolawtech-fa07/ 7 Facebook Perceived as a “closed community” or “for college students only” Login required to access profiles User for “Social Searching” Finding existing friends, or people met in person

8. Privacy Policy, Law and Technology Carnegie Mellon University Fall 2007 Lorrie Cranor http://cups.cs.cmu.edu/courses/privpolawtech-fa07/ 8 Privacy Scandals Facebook Mini-Feed/Feed Uproar Introduced in Fall 2006 Aggregates all “Friend” profile updates Aggregates all actions taken on Facebook Generated Uproar and User Backlash User base opened to everyone Added geographical networks No longer limits to.edu email addresses

9. Privacy Policy, Law and Technology Carnegie Mellon University Fall 2007 Lorrie Cranor http://cups.cs.cmu.edu/courses/privpolawtech-fa07/ 9 Pimp My Privacy New Privacy Features introduced Enhanced Settings Specific Mini-Feed information can be removed Access control granularity increased to the Network Level Limited Profile introduced

10. Privacy Policy, Law and Technology Carnegie Mellon University Fall 2007 Lorrie Cranor http://cups.cs.cmu.edu/courses/privpolawtech-fa07/ 10

11. Privacy Policy, Law and Technology Carnegie Mellon University Fall 2007 Lorrie Cranor http://cups.cs.cmu.edu/courses/privpolawtech-fa07/ 11

12. Privacy Policy, Law and Technology Carnegie Mellon University Fall 2007 Lorrie Cranor http://cups.cs.cmu.edu/courses/privpolawtech-fa07/ 12 Privacy In Facebook People are more privacy-protective than default setting

14. Privacy Policy, Law and Technology Carnegie Mellon University Fall 2007 Lorrie Cranor http://cups.cs.cmu.edu/courses/privpolawtech-fa07/ 14 Search engines Search engine query logs can be very revealing Provide insights into what people are doing, interested in, thinking about Can be connected to form longitudinal profile Difficult to anonymize completely 2006 AOL search log release http://aolstalker.com http://aolpycho.com DEMO

15. 15 Why share query logs? Academia has difficulty contributing to web search Untold insights into human behavior exist within logs Source: Andrew Tomkins

16. 16 Why not share query logs? Source: Andrew Tomkins

17. 17 “Person” attack versus “Trace” attack Trace attack: given a trace, identify the person Person attack: the dual Adversaries in person attack: –“Neighborly” knowledge –Query knowledge –Browser compromise Source: Andrew Tomkins

18. 18 Person attack (750K users) Source: Andrew Tomkins

19. Privacy Policy, Law and Technology Carnegie Mellon University Fall 2007 Lorrie Cranor http://cups.cs.cmu.edu/courses/privpolawtech-fa07/ 19 Discussion What are the privacy risks associated with social networks and search engines? What are the web sites doing to mitigate these risks? Is it enough? Is opting in to having your data collected and/or shared sufficient?