CyLab Usable Privacy and Security Laboratory 1 Privacy Policy, Law and Technology Fair Information Practices September 7, 2010

CyLab Usable Privacy and Security Laboratory 2 Finding information with search engines

CyLab Usable Privacy and Security Laboratory 3 Finding info with search engines  General purpose search engines – Google, Yahoo, Bing – Ask, Altavista, Yippy, Dogpile, etc.  Search CS research literature – – – – –

CyLab Usable Privacy and Security Laboratory 4 Advanced searching  Boolean searching – Operators: AND, OR, NOT, NEAR – Implied operators: AND is often implied – Parentheses for grouping – Wildcards – Quotes  Getting to know the ins and outs of your favorite search engines – Many search engines do not use pure boolean searching – Most search engines have some special syntax – Search engines use different algorithms to determine best match

CyLab Usable Privacy and Security Laboratory 5 Using Library Resources

CyLab Usable Privacy and Security Laboratory 6 CMU Libraries   Engineering and Science (a.k.a. E&S) – Location: Wean Hall, 4th floor – Subjects: Computer Science, Engineering, Mathematics, Physics, Science, Technology  Hunt (CMU’s main library) – Location: Its own building (possibly 2nd ugliest on campus behind Wean), between Tepper and Baker – Subjects: Arts, Business, Humanities, Social Sciences  Software Engineering Institute (a.k.a. SEI) – Location: SEI Building (4500 Fifth Avenue), 3rd floor – Subjects: Security, Software, Technology

CyLab Usable Privacy and Security Laboratory 7 START HERE: Cameo  Cameo is CMU’s online library catalog –  Catalogs everything CMU has: books, journals, periodicals, multimedia, etc.  Search by key words, author, title, periodical title, etc.

CyLab Usable Privacy and Security Laboratory 8 CAMEO: Search Result for “Cranor” Number of copies and status Library

CyLab Usable Privacy and Security Laboratory 9 CAMEO: Search Result for “Solove” Due date

CyLab Usable Privacy and Security Laboratory 10 If it’s not in Cameo, but you need it today: Local Libraries  Carnegie Library of Pittsburgh – Two closest locations Oakland: Practically on campus (4400 Forbes Ave.) Squirrel Hill: Forbes & Murray (5801 Forbes Ave.) –  University of Pittsburgh Libraries – 16 libraries! Information science, Engineering, Law, Business, etc. – Get a borrowing card by showing CMU ID at Hillman Library lending desk –

CyLab Usable Privacy and Security Laboratory 11 If it’s not in Cameo, and you can wait: ILLiad and E-ZBorrow  ILLiad and E-ZBorrow are catalogs of resources available for Interlibrary Loan from other libraries nationwide (ILLiad) and in Pennsylvania (E- ZBorrow)  Order items online (almost always free)  Wait for delivery – average 10 business days  Find links to ILLiad and E-ZBorrow online catalogs at by following Interlibrary Loan link at

CyLab Usable Privacy and Security Laboratory 12 Other Useful Databases  Links to many more databases, journal collections – Must be accessed on campus or through VPN –  Lexis-Nexis – Massive catalog of legal sources – law journals, case law, news stories, etc.  IEEE and ACM journal databases – IEEE Xplore and ACM Digital Library  INSPEC database – Huge database of scientific and technical papers  JSTOR – Arts & Sciences, Business, Mathematics, Statistics

CyLab Usable Privacy and Security Laboratory 13 And of course…  Reference librarians are available at all CMU libraries, and love to help people find what they need – just ask!

CyLab Usable Privacy and Security Laboratory 14 Course project

CyLab Usable Privacy and Security Laboratory 15 Project overview  Individual or small group (up to ~3 students)  Pick a project from the list of suggested projects – Talk to me if you want to propose something different  All projects have final paper, presentation, and poster as deliverable  Some projects may have other deliverables such as software, user interface designs, etc.  fa10/project.html fa10/project.html

CyLab Usable Privacy and Security Laboratory 16 Past projects     Several past projects have been turned into a thesis or published paper – The Real ID Act: Fixing Identity Documents with Duct Tape. I/S: A Journal of Law and Policy for the Information Society, Fall/Winter 2005 (Serge Egelman). – How Technology Drives Vehicular Privacy. I/S: A Journal of Law and Policy for the Information Society, 2(3), Fall 2006, (Aleecia McDonald). – Scrubbing Stubborn Data: An evaluation of counter-forensic privacy tools. IEEE Security & Privacy, September/October 2006 (Matthew Geiger). – Peripheral Privacy Notifications for Wireless Networks. In Proceedings of the 2005 Workshop on Privacy in the Electronic Society, 7 November 2005, Alexandria, VA (Braden Kowitz). – Privacy in India: Attitudes and Awareness. In Proceedings of the 2005 Workshop on Privacy Enhancing Technologies (PET2005), 30 May - 1 June 2005, Dubrovnik, Croatia (Ponnurangam Kumaraguru). – PANAMA: Privacy Assured Name-Addressable Messaging Architecture For Unlinkable Instant Message Conversations. INI Thesis 2005 (Ryan Mahon).

CyLab Usable Privacy and Security Laboratory 17 Selecting a research topic

CyLab Usable Privacy and Security Laboratory 18 Selecting a research topic  Brainstorm – What are you interested in? – What would you like to learn more about? – What topics might be relevant to your thesis work? – What topics might be relevant to your future career?  Select a small number of candidate topics  Read – How much information seems to be available? – Is this topic over done? – What open questions are there? – Do you still find this topic interesting? – Do you have the skills necessary to pursue this topic?  Focus (September 28 - one paragraph description) – Select a topic – Define a focused research question  Read some more – Conduct a “literature review” – Adjust your topic as needed  Write a project proposal (October 19)

CyLab Usable Privacy and Security Laboratory 19 Writing a Literature Review

CyLab Usable Privacy and Security Laboratory 20 Writing a literature review  What is a literature review? – A critical summary of what has been published on a topic What is already known about the topic Strengths and weaknesses of previous studies – Often part of the introduction or a section of a research paper, proposal, or thesis  A literature review should – be organized around and related directly to the thesis or research question you are developing – synthesize results into a summary of what is and is not known – identify areas of controversy in the literature – formulate questions that need further research Dena Taylor and Margaret Procter The literature review: A few tips on conducting it. writing/literature-reviewhttp:// writing/literature-review

CyLab Usable Privacy and Security Laboratory 21 Literature review do’s and don’ts  Don’t create a list of article summaries or quotes  Do point out what is most relevant about each article to your paper  Do compare and contrast the articles you review  Do highlight controversies raised or questions left unanswered by the articles you review  Do take a look at some examples of literature reviews or related work sections before you try to create one yourself – For an example, of a literature review in a CS conference paper see section 2 of

CyLab Usable Privacy and Security Laboratory 22 Fair Information Practices

CyLab Usable Privacy and Security Laboratory 23 Privacy terminology  Data subject  Data controller  Secondary use of data

CyLab Usable Privacy and Security Laboratory 24 OECD fair information principles  _ _1_1_1_1,00.html _ _1_1_1_1,00.html  Collection limitation  Data quality  Purpose specification  Use limitation  Security safeguards  Openness  Individual participation  Accountability

CyLab Usable Privacy and Security Laboratory 25 US FTC simplified principles  Notice and disclosure  Choice and consent  Data security  Data quality and access  Recourse and remedies US Federal Trade Commission, Privacy Online: A Report to Congress (June 1998),

CyLab Usable Privacy and Security Laboratory 26 How do the various FIPs differ?

CyLab Usable Privacy and Security Laboratory 27 The Prada NYC dressing room   What aspects seem privacy invasive?  How could the design be changed to reduce privacy concerns?

CyLab Usable Privacy and Security Laboratory 28 Discussion questions  Which technologies are privacy invasive?  Which technologies are privacy protective?  Can we turn one into the other?  How can we use the FIPs in our analysis?

CyLab Usable Privacy and Security Laboratory 29 Applying the FIPs  Google Street View  Gmail advertising  Hillman Library Web Cam  Amazon.com book recommendations  Giant Eagle Advantage Card  Transportation Security Administration watch lists