1. Control of Personal Information in a Networked World Rebecca Wright Boaz Barak Jim Aspnes Avi Wigderson Sanjeev Arora David Goodman Joan Feigenbaum ToNC workshop 17 January, 2006

2. Networks and Information Flow Core design principles of the current Internet are focused on enabling fast and easy flow of data. Control of personal information is NOT a core principle of the current Internet. How do you enable better control of personal information while maintaining seamless flow of data? Designing a future Internet that does a better job of providing control of personal information will require a change in the way networked computation is done.

3. Some possible research agenda items Modeling and quantification: –of privacy, of utility, others? [Note that privacy means different things to different people!] –Are there reasonable definitions of privacy that would still allow businesses to collect and store personal information about their customers? Content-awareness of networking architecture. –This could enable better personal control of information but also could have efficiency advantages.

4. Understanding tradeoffs Tradeoffs: –Apparent tradeoffs may not actually be inherent. In some cases they may. –Armed with proper models, questions about existence of tradeoffs and understanding of their boundaries can be addressed. –Some examples: privacy vs. utility, privacy vs. security, security vs. usability, openness vs. control, end-to-end properties vs. ability to make decisions in the network.

5. Changing the network What kinds of control of information could be inherently provided by the network? Is it worth revisiting some old ideas to see if they are more deployable now? (e.g., Secure DNS, PKI, S-BGP) What new ideas can provide better control of personal information?

6. Specification vs. Enforcement Some work is needed to express and support privacy goals, policies, even if we assume all parties follow their instructions: –Languages, policy reconciliation, … –Example: a company has made various promises (via its privacy policy) to its customers, and now wants to know whether it can use some data product in a particular way. Another direction is architectures and protocols that ensure that these are still met even when some parties misbehave. –Lots of existing crypto and security work may be useful here, but some new work is also needed.

7. Example: Leveraging crypto theory Secure multiparty computation (SMC) results allow computation of any function of distributed inputs without revealing anything else about the inputs. But these definitions are both too strong and too weak: –Too strong: because they provide more privacy than many parties require in many settings, and the resulting cost to deploy them seems to be more than most are willing to pay. –Too weak: because they do not address what is revealed by the output itself, particularly over multiple runs of multiple computations with some or all of the same data.

8. Leveraging crypto theory, ctd. SMC has a dichotomy in its definition: it protects everything it does not explicitly compute. protected computed

9. Leveraging crypto theory, ctd. SMC has a dichotomy in its definition: it protects everything it does not explicitly compute. May be able to achieve enough privacy and better practicality via a trichotomy: a computation that explicitly computes some things (its provided utility), explicitly protects some things (its provided privacy), and doesn’t care about the rest:

10. Leveraging crypto theory, ctd. SMC has a dichotomy in its definition: it protects everything it does not explicitly compute. May be able to achieve enough privacy and better practicality via a trichotomy: a computation that explicitly computes some things (its provided utility), explicitly protects some things (its provided privacy), and doesn’t care about the rest: protected computed no guarantees

11. Summary Large scale networks create new problems for control of personal information. Some problems are more about applications of networks, while some are core-network related. Technical issues will have to interact with social and legal ones to determine appropriate design goals. Deployment of a next generation Internet gives an opportunity to build in better control from the start.