1. Privacy in online social networks: Software agents and beyond Bettina Berendt Dept. Computer Science KU Leuven http://people.cs.kuleuven.be/~bettina.berendt/

2. Who am I ? Privacy, Discrimination

3. You can sell your privacy, but you can”t buy it back.

4. ?

5. Meet Kris (1) Kris weighs 120 kilos. Kris wants to lead a “normal online life”.

6. Meet Kris (2) Does Kris want others to know about his/her weight? a)In an online dating site? 1.Kris wants to buy a pair of trousers. Does Kris want the salesperson to know about his/her weight? (analogously: diet plan / doctor) 2.The shop/doctor wants to sell patients information to health insurance companies. Does Kris want this? a)The insurance company asks a premium for risk factors. b)The insurance company cannot act on weight information. Privacy is about... Confidentiality. Context. Confidentiality? Information – value! Confidentiality? Purpose specification, notification … control! Knowledge? Consequences!

7. Meet Kris (2) Does Kris want others to know about his/her weight? a)In an online dating site? 1.Kris wants to buy a pair of trousers. Does Kris want the salesperson to know about his/her weight? (analogously: diet plan / doctor) 2.The shop/doctor wants to sell patients information to health insurance companies. Does Kris want this? a)The insurance company asks a premium for risk factors. b)The insurance company cannot act on weight information. Privacy is about... Confidentiality. Context. Confidentiality? Information – value! Confidentiality? Purpose specification, notification … control! Knowledge? Consequences!

8. Meet Kris (2) Does Kris want others to know about his/her weight? a)In an online dating site? 1.Kris wants to buy a pair of trousers. Does Kris want the salesperson to know about his/her weight? (analogously: diet plan / doctor) 2.The shop/doctor wants to sell patients information to health insurance companies. Does Kris want this? a)The insurance company asks a premium for risk factors. b)The insurance company cannot act on weight information. Privacy is about... Confidentiality. Context. Confidentiality? Information – value! Confidentiality? Purpose specification, notification … control! Knowledge? Consequences!

9. Meet Kris (2) Does Kris want others to know about his/her weight? a)In an online dating site? 1.Kris wants to buy a pair of trousers. Does Kris want the salesperson to know about his/her weight? (analogously: diet plan / doctor) 2.The shop/doctor wants to sell patients information to health insurance companies. Does Kris want this? a)The insurance company asks a premium for risk factors. b)The insurance company cannot act on weight information. Privacy is about... Confidentiality. Context. Confidentiality? Information – value! Confidentiality? Purpose specification, notification … control! Knowledge? Consequences!

10. Meet Kris (2) Does Kris want others to know about his/her weight? a)In an online dating site? 1.Kris wants to buy a pair of trousers. Does Kris want the salesperson to know about his/her weight? (analogously: diet plan / doctor) 2.The shop/doctor wants to sell patients information to health insurance companies. Does Kris want this? a)The insurance company asks a premium for risk factors. b)The insurance company cannot act on weight information. Privacy is about... Confidentiality. Context. Confidentiality? Information – value! Confidentiality? Purpose specification, notification … control! Knowledge? Consequences!

11. Meet Kris (2) Does Kris want others to know about his/her weight? a)In an online dating site? 1.Kris wants to buy a pair of trousers. Does Kris want the salesperson to know about his/her weight? (analogously: diet plan / doctor) 2.The shop/doctor wants to sell patients information to health insurance companies. Does Kris want this? a)The insurance company asks a premium for risk factors. b)The insurance company cannot act on weight information. Privacy is about... Confidentiality. Context. Confidentiality? Information – value! Confidentiality? Purpose specification, notification … control! Knowledge? Consequences!

12. Meet Kris (2) Does Kris want others to know about his/her weight? a)In an online dating site? 1.Kris wants to buy a pair of trousers. Does Kris want the salesperson to know about his/her weight? (analogously: diet plan / doctor) 2.The shop/doctor wants to sell patients information to health insurance companies. Does Kris want this? a)The insurance company asks a premium for risk factors. b)The insurance company cannot act on weight information. Privacy is about... Confidentiality. Context. Confidentiality? Information – value! Confidentiality? Purpose specification, notification … control! Knowledge? Consequences!

13. Meet Kris (2) Does Kris want others to know about his/her weight? a)In an online dating site? 1.Kris wants to buy a pair of trousers. Does Kris want the salesperson to know about his/her weight? (analogously: diet plan / doctor) 2.The shop/doctor wants to sell patients information to health insurance companies. Does Kris want this? a)The insurance company asks a premium for risk factors. b)The insurance company cannot act on weight information. Privacy is about... Confidentiality. Context. Confidentiality? Information – value! Confidentiality? Purpose specification, notification … control! Knowledge? Consequences!

14. Meet Kris (2) Does Kris want others to know about his/her weight? a)In an online dating site? 1.Kris wants to buy a pair of trousers. Does Kris want the salesperson to know about his/her weight? (analogously: diet plan / doctor) 2.The shop/doctor wants to sell patients information to health insurance companies. Does Kris want this? a)The insurance company asks a premium for risk factors. b)The insurance company cannot act on weight information. Privacy is about... Confidentiality. Context. Confidentiality? Information – value! Confidentiality? Purpose specification, notification … control! Knowledge? Consequences!

15. Meet Kris (2) Does Kris want others to know about his/her weight? a)In an online dating site? 1.Kris wants to buy a pair of trousers. Does Kris want the salesperson to know about his/her weight? (analogously: diet plan / doctor) 2.The shop/doctor wants to sell patients information to health insurance companies. Does Kris want this? a)The insurance company asks a premium for risk factors. b)The insurance company cannot act on weight information. Privacy is about... Confidentiality. Context. Confidentiality? Information – value! Confidentiality? Purpose specification, notification … control! Knowledge? Consequences!

16. Meet Kris (2) Does Kris want others to know about his/her weight? a)In an online dating site? 1.Kris wants to buy a pair of trousers. Does Kris want the salesperson to know about his/her weight? (analogously: diet plan / doctor) 2.The shop/doctor wants to sell patients information to health insurance companies. Does Kris want this? a)The insurance company asks a premium for risk factors. b)The insurance company cannot act on weight information. Privacy is about... Confidentiality. Context. Confidentiality? Information – value! Confidentiality? Purpose specification, notification … control! Knowledge? Consequences!

17. Meet Kris (2) Does Kris want others to know about his/her weight? a)In an online dating site? 1.Kris wants to buy a pair of trousers. Does Kris want the salesperson to know about his/her weight? (analogously: diet plan / doctor) 2.The shop/doctor wants to sell patients information to health insurance companies. Does Kris want this? a)The insurance company asks a premium for risk factors. b)The insurance company cannot act on weight information. Privacy is about... Confidentiality. Context. Confidentiality? Information – value! Confidentiality? Purpose specification, notification … control! Knowledge? Consequences!

18. Meet Kris (2) Does Kris want others to know about his/her weight? a)In an online dating site? 1.Kris wants to buy a pair of trousers. Does Kris want the salesperson to know about his/her weight? (analogously: diet plan / doctor) 2.The shop/doctor wants to sell patients information to health insurance companies. Does Kris want this? a)The insurance company asks a premium for risk factors. b)The insurance company cannot act on weight information. Privacy is about... Confidentiality. Context. Confidentiality? Information – value! Confidentiality? Purpose specification, notification … control! Knowledge? Consequences!

19. Meet Kris (2) Does Kris want others to know about his/her weight? a)In an online dating site? 1.Kris wants to buy a pair of trousers. Does Kris want the salesperson to know about his/her weight? (analogously: diet plan / doctor) 2.The shop/doctor wants to sell patients information to health insurance companies. Does Kris want this? a)The insurance company asks a premium for risk factors. b)The insurance company cannot act on weight information. Privacy is about... Confidentiality. Context. Confidentiality? Information – value! Confidentiality? Purpose specification, notification … control! Knowledge? Consequences!

20. Meet Kris (2) Does Kris want others to know about his/her weight? a)In an online dating site? 1.Kris wants to buy a pair of trousers. Does Kris want the salesperson to know about his/her weight? (analogously: diet plan / doctor) 2.The shop/doctor wants to sell patients information to health insurance companies. Does Kris want this? a)The insurance company asks a premium for risk factors. b)The insurance company cannot act on weight information. Privacy is about... Confidentiality. Context. Confidentiality? Information – value! Confidentiality? Purpose specification, notification … control! Knowledge? Consequences! …

21. Meet Kris (3) 3.Kris has a traffic accident and is unconscious. Normally, the paramedics come with a stretcher that can carry up to 100 kilos. Time loss could be deadly. Would Kris want the doctor to inform the paramedics of his/her weight? 4.Kris wants to join / open a group on the SNS, the HeavyweightDaters. Does Kris want others to know about his/her weight? 5.Kris” teenage child Kim is (a) also overweight and (b) on Facebook. What advice does Kris give to Kim? Privacy is about … (contd.) Control? Trust! (and Consequences) Hiding? Identity-building, which includes strategic revelations! …

22. Meet Kris (3) 3.Kris has a traffic accident and is unconscious. Normally, the paramedics come with a stretcher that can carry up to 100 kilos. Time loss could be deadly. Would Kris want the doctor to inform the paramedics of his/her weight? 4.Kris wants to join / open a group on the SNS, the HeavyweightDaters. Does Kris want others to know about his/her weight? 5.Kris” teenage child Kim is (a) also overweight and (b) on Facebook. What advice does Kris give to Kim? Privacy is about … (contd.) Control? Trust! (and Consequences) Hiding? Identity-building, which includes strategic revelations! …

23. Meet Kris (3) 3.Kris has a traffic accident and is unconscious. Normally, the paramedics come with a stretcher that can carry up to 100 kilos. Time loss could be deadly. Would Kris want the doctor to inform the paramedics of his/her weight? 4.Kris wants to join / open a group on the SNS, the HeavyweightDaters. Does Kris want others to know about his/her weight? 5.Kris” teenage child Kim is (a) also overweight and (b) on Facebook. What advice does Kris give to Kim? Privacy is about … (contd.) Control? Trust! (and Consequences) Hiding? Identity-building, which includes strategic revelations! …

24. Meet Kris (3) 3.Kris has a traffic accident and is unconscious. Normally, the paramedics come with a stretcher that can carry up to 100 kilos. Time loss could be deadly. Would Kris want the doctor to inform the paramedics of his/her weight? 4.Kris wants to join / open a group on the SNS, the HeavyweightDaters. Does Kris want others to know about his/her weight? 5.Kris” teenage child Kim is (a) also overweight and (b) on Facebook. What advice does Kris give to Kim? Privacy is about … (contd.) Control? Trust! (and Consequences) Hiding? Identity-building, which includes strategic revelations! …

25. Meet Kris (3) 3.Kris has a traffic accident and is unconscious. Normally, the paramedics come with a stretcher that can carry up to 100 kilos. Time loss could be deadly. Would Kris want the doctor to inform the paramedics of his/her weight? 4.Kris wants to join / open a group on the SNS, the HeavyweightDaters. Does Kris want others to know about his/her weight? 5.Kris” teenage child Kim is (a) also overweight and (b) on Facebook. What advice does Kris give to Kim? Privacy is about … (contd.) Control? Trust! (and Consequences) Hiding? Identity-building, which includes strategic revelations! …

26. Meet Kris (3) 3.Kris has a traffic accident and is unconscious. Normally, the paramedics come with a stretcher that can carry up to 100 kilos. Time loss could be deadly. Would Kris want the doctor to inform the paramedics of his/her weight? 4.Kris wants to join / open a group on the SNS, the HeavyweightDaters. Does Kris want others to know about his/her weight? 5.Kris” teenage child Kim is (a) also overweight and (b) on Facebook. What advice does Kris give to Kim? Privacy is about … (contd.) Control? Trust! (and Consequences) Hiding? Identity-building, which includes strategic revelations! …

27. Meet Kris (3) 3.Kris has a traffic accident and is unconscious. Normally, the paramedics come with a stretcher that can carry up to 100 kilos. Time loss could be deadly. Would Kris want the doctor to inform the paramedics of his/her weight? 4.Kris wants to join / open a group on the SNS, the HeavyweightDaters. Does Kris want others to know about his/her weight? 5.Kris” teenage child Kim is (a) also overweight and (b) on Facebook. What advice does Kris give to Kim? Privacy is about … (contd.) Control? Trust! (and Consequences) Hiding? Identity-building, which includes strategic revelations! …

28. Meet Kris (3) 3.Kris has a traffic accident and is unconscious. Normally, the paramedics come with a stretcher that can carry up to 100 kilos. Time loss could be deadly. Would Kris want the doctor to inform the paramedics of his/her weight? 4.Kris wants to join / open a group on the SNS, the HeavyweightDaters. Does Kris want others to know about his/her weight? 5.Kris” teenage child Kim is (a) also overweight and (b) on Facebook. What advice does Kris give to Kim? Privacy is about … (contd.) Control? Trust! (and Consequences) Hiding? Identity-building, which includes strategic revelations! …

29. Meet Kris (3) 3.Kris has a traffic accident and is unconscious. Normally, the paramedics come with a stretcher that can carry up to 100 kilos. Time loss could be deadly. Would Kris want the doctor to inform the paramedics of his/her weight? 4.Kris wants to join / open a group on the SNS, the HeavyweightDaters. Does Kris want others to know about his/her weight? 5.Kris” teenage child Kim is (a) also overweight and (b) on Facebook. What advice does Kris give to Kim? Privacy is about … (contd.) Control? Trust! (and Consequences) Hiding? Identity-building, which includes strategic revelations! …

30. Meet Kris (3) 3.Kris has a traffic accident and is unconscious. Normally, the paramedics come with a stretcher that can carry up to 100 kilos. Time loss could be deadly. Would Kris want the doctor to inform the paramedics of his/her weight? 4.Kris wants to join / open a group on the SNS, the HeavyweightDaters. Does Kris want others to know about his/her weight? 5.Kris” teenage child Kim is (a) also overweight and (b) on Facebook. What advice does Kris give to Kim? Privacy is about … (contd.) Control? Trust! (and Consequences) Hiding? Identity-building, which includes strategic revelations! …

31. Meet Kris (3) 3.Kris has a traffic accident and is unconscious. Normally, the paramedics come with a stretcher that can carry up to 100 kilos. Time loss could be deadly. Would Kris want the doctor to inform the paramedics of his/her weight? 4.Kris wants to join / open a group on the SNS, the HeavyweightDaters. Does Kris want others to know about his/her weight? 5.Kris” teenage child Kim is (a) also overweight and (b) on Facebook. What advice does Kris give to Kim? Privacy is about … (contd.) Control? Trust! (and Consequences) Hiding? Identity-building, which includes strategic revelations! …

32. Kris and metadata Would Kris be relieved to hear that the saves only metadata? “They know that you called the suicide help line from the Golden Gate Bridge, but they don”t know what was said.”

33. A multi-faceted approach Law allow, forbid, require,...

34. A multi-faceted approach Technology encryption, access control,... Law allow, forbid, require,...

35. A multi-faceted approach Technology encryption, access control,... Law allow, forbid, require,... Awareness of problems, solutions, „what“s going on“,...

36. A multi-faceted approach Technology encryption, access control,... Law allow, forbid, require,... Awareness of problems, solutions, „what“s going on“,...

37. A multi-faceted approach Technology encryption, access control,... Law allow, forbid, require,... Awareness of problems, solutions, „what“s going on“,...

38. Meet SPION

39. Tammy Schellens Martin Valcke Ellen Vanderhoven Ero Balsa Seda Gürses Claudia Diaz Bart Preneel Alessandro Acquisti Fred Stutzman Jos Dumortier Eva Lievens Brendan Van Alsenoy Bettina Berendt Bo Gao Thomas Peetz Dave Clarke Frank Piessens Rula Sayaf Bram Lievens Jo Pierson Ralf De Wolf

40. PET approaches (in SPION and elsewhere) Feedback & awareness

41. PET approaches (in SPION and elsewhere) Feedback & awareness

42. PET approaches (in SPION and elsewhere) Access control Feedback & awareness

43. PET approaches (in SPION and elsewhere) Access control Feedback & awareness

44. PET approaches (in SPION and elsewhere) Access control Crypto- graphy Feedback & awareness

45. PET approaches (in SPION and elsewhere) Access control Crypto- graphy

46. PET approaches (in SPION and elsewhere) Access control Crypto- graphy Feedback & awareness

47. SPION PETs Access control: Facebook and beyond Access control and information flow: FlowFox Cryptography: Scramble Feedback & awareness: FreeBu

48. Feedback & awareness: a systems view Bettina Berendt Dept. Computer Science KU Leuven http://people.cs.kuleuven.be/~bettina.berendt/

49. Established wisdoms …

50. “Overdisclosure“  privacy problems

51. Tools (technological and otherwise)  privacy solutions

52. Evaluation  validation of tools

53. Tool types à la SPION Confidentiality Control Awareness of... –„I am being tracked.“ –„which audiences do I have (whom I could give access)?“  e.g., FreeBu –„when I am thinking too small about this“

54. A bigger picture Environment - technology, society Mental schema - privacy, p. problems Behaviour - disclosure, evaluation

55. A bigger picture Environment - technology, society Mental schema - privacy, p. problems Behaviour - disclosure, evaluation

56. Society, technology  interpersonal boundaries  disclosure E B S

57. Disclosure  disclosure  (over)evaluation E B BUT: Evaluating something/someone along different dimensions can lead to worse judgements and less satisfying decisions S

58. Evaluation  disclosure E B S

59. Evaluation  privacy definitions E B S [Moreno et al., 2009] Def. of “appropriate”; Privacy is social privacy and some chilled overdisclosure (as opposed to instrumental privacy) & technology

60. Evaluation  privacy definitions E B S Slashdot article on [Jentzsch, Preibusch & Harasser, 2012] Privacy is an individually owned and tradeable good (as opposed to a fundamental right or a social good)

61. Please argue with me about Let us not divide and conquer ourselves: –The standard (scientific ?!) distribution of work can be a dangerous self-blinding and continued delegation of responsibility when it comes to problems like privacy. –(Being forced to) being responsible is not only bad, but also part and parcel of being a human & a citizen. We need awareness (tools), but we also need to build –true private spaces –true public spaces “Privacy is not only about clicking Facebook.“

62. This talk was inspired by many … Intro quote (“I asked the audience not to tweet or blog while I was talking. Not out of respect for me, but out of respect for themselves.“): Lanier, J. (2010). You are Not a Gadget. A Manifesto. New York: Knopf. http://www.jaronlanier.com/gadgetwebresources.html http://www.jaronlanier.com/gadgetwebresources.html P.9: Turkle, S. (2010). Alone Together. Why we Expect More from Technology and Less from Each Other. Basic Books. http://alonetogetherbook.com/http://alonetogetherbook.com/ Altman, I. (1976). Privacy: A conceptual analysis. Environment and Behaviour, 8(1), 7-29. P. 10: Illouz, E. (2012). Why Love Hurts. Cambridge: Polity Press. – especially her reading of Wilson, T.D. & Schooler, J.W. (1991). Thinking too much: Introspection can reduce the quality of preferences and decisions. Journal of Personality and Social Psychology, 60(2), 181-192. Ofir, C. & Simonson, I (2001). In search of negative customer feedback: The effect of expecting to evaluate on satisfaction and evaluation. Journal of Marketing Research, 38(2), 170-182.

63. Specific cited sources (these are examples of wider research areas) P. 12: Moreno MA, Vanderstoep A, Parks MR, Zimmerman FJ, Kurth A, and Christakis DA. Reducing at-risk adolescents' display of risk behavior on a social networking web site: a randomized controlled pilot intervention trial. Arch Pediatr Adolesc Med, 163(1): 35-41, 2009. P. 13: Nicola Jentzsch, Sören Preibusch, Andreas Harasser. Study on monetising privacy. An economic model for pricing personal information. European Network and information Security Agency (ENISA). Deliverable, February 2012. http://www.enisa.europa.eu/activities/identity-and- trust/library/deliverables/monetising-privacy http://www.enisa.europa.eu/activities/identity-and- trust/library/deliverables/monetising-privacy