1. Norman M. Sadeh ISR - School of Computer Science Carnegie Mellon University User-Controllable Security and Privacy

2. Copyright © 2001-2007 Norman M. SadehCMU/Microsoft Mindswap – Oct 2007 - Slide 2 Privacy in Mobile & Pervasive Computing  MyCampus project over the past 7 years Piloted a number of context-aware applications on campus Privacy as a major impediment to adoption  Wikipedia’s definition of privacy: “… the ability of an individual or group to keep their lives and personal affairs out of public view, or to control the flow of information about themselves. Privacy is the ability of an individual or organization to reveal oneself selectively…”

3. Copyright © 2001-2007 Norman M. SadehCMU/Microsoft Mindswap – Oct 2007 - Slide 3 Computational Thinking Challenge  …But lay users (and even “experts”) are not very good at defining privacy policies… Complexity of people’s policies “One size fits all” often doesn’t apply Policies change over time Poor understanding of the consequences of how one’s information will be used Trust Engine technologies are ahead of usability research

4. Copyright © 2001-2007 Norman M. SadehCMU/Microsoft Mindswap – Oct 2007 - Slide 4 Question  Can we develop technologies that empower users to more accurately specify their policies?  And some related questions such as: User burden vs. accuracy  Incl. expressiveness issue How does this change from one application to another, from one user to another?

5. Copyright © 2001-2007 Norman M. SadehCMU/Microsoft Mindswap – Oct 2007 - Slide 5 Three Application Domains  MyCampus - Current focus: People Finder  Grey – Defining policies to control access to rooms in a building  IMBuddy – Contextual Instant Messaging

6. Copyright © 2001-2007 Norman M. SadehCMU/Microsoft Mindswap – Oct 2007 - Slide 6 People Finder Architecture JimMary Combines GPS, GSM and WiFi Available on cell phones and laptops PEA = Policy Enforcing Agent Policies represented in rule extension of OWL language MyCampus Server Mary’s PEA Jim’s PEA Jim’s KB Mary’s KB

7. Copyright © 2001-2007 Norman M. SadehCMU/Microsoft Mindswap – Oct 2007 - Slide 7 People’s Policies Are Often Varied & Complex  User’s willingness to share their location depends on: Who is asking When Where they are What they are doing Who they are with And more…

8. Copyright © 2001-2007 Norman M. SadehCMU/Microsoft Mindswap – Oct 2007 - Slide 8 People Finder – Defining Rules

9. Copyright © 2001-2007 Norman M. SadehCMU/Microsoft Mindswap – Oct 2007 - Slide 9 Users Are Not Good At Defining Policies Mean (sec) Standard Deviation (sec) Rule Creation 321.53206.10 Rule Maintenance 101.15110.02 Total 422.69213.48 People Finder Application: Lab study with 19 users 30 queries per user

10. Copyright © 2001-2007 Norman M. SadehCMU/Microsoft Mindswap – Oct 2007 - Slide 10 …and it’s not for lack of trying…

11. Copyright © 2001-2007 Norman M. SadehCMU/Microsoft Mindswap – Oct 2007 - Slide 11 It’s Not Because of the Interface

12. Copyright © 2001-2007 Norman M. SadehCMU/Microsoft Mindswap – Oct 2007 - Slide 12 Only Slight Correlation with # Rules -Total of 30 requests -Post-hoc accuracy

13. Copyright © 2001-2007 Norman M. SadehCMU/Microsoft Mindswap – Oct 2007 - Slide 13 Only Slight Correlation with Time Spent -Total of 30 requests -Post-hoc accuracy

14. Copyright © 2001-2007 Norman M. SadehCMU/Microsoft Mindswap – Oct 2007 - Slide 14 Some Users Realize They Can’t Get It Right Adoption Impediment

15. Copyright © 2001-2007 Norman M. SadehCMU/Microsoft Mindswap – Oct 2007 - Slide 15 Approach Pervasive Computing Environments Pervasive Computing Environments User Interface CredentialsPolicies Policy Engine(s) Explanation Learning Dialog Policy Support Agent Meta- Control Legend: Project Focus Resource (incl. policies) Organization (incl. policies) Other users

16. Copyright © 2001-2007 Norman M. SadehCMU/Microsoft Mindswap – Oct 2007 - Slide 16 Importance of Feedback - Notifications PeopleFinder application

17. Copyright © 2001-2007 Norman M. SadehCMU/Microsoft Mindswap – Oct 2007 - Slide 17 Feedback – Summaries IMBuddy Application - Courtesy: Jason Hong

18. Copyright © 2001-2007 Norman M. SadehCMU/Microsoft Mindswap – Oct 2007 - Slide 18 IMBuddy Evaluation  Usefulness of bubble notification, 1.6 (σ=0.6) Scale of 1 to 5, where 1=strongly agree that it was useful, 3=neutral, 5=srongly disagree

19. Copyright © 2001-2007 Norman M. SadehCMU/Microsoft Mindswap – Oct 2007 - Slide 19 Feedback Through Audit Logs Explanation

20. Copyright © 2001-2007 Norman M. SadehCMU/Microsoft Mindswap – Oct 2007 - Slide 20 Machine Learning  Audited Logs can be used to refine a user’s policies

21. Copyright © 2001-2007 Norman M. SadehCMU/Microsoft Mindswap – Oct 2007 - Slide 21 Lab Study

22. Copyright © 2001-2007 Norman M. SadehCMU/Microsoft Mindswap – Oct 2007 - Slide 22 More Recent Pilots – 12 most active target users 3 Pilots – total of over 60 participants User-Defined Rules: 79% vs. ML: 91% Note: Includes benefits of auditing

23. Copyright © 2001-2007 Norman M. SadehCMU/Microsoft Mindswap – Oct 2007 - Slide 23 Ongoing Work  Learning is a “black box” technology  Users are unlikely to understand the policies they end up with  Can we develop technology that incrementally suggests policy changes to users? Tradeoff between rapid convergence and maintaining policies that users can relate to

24. Copyright © 2001-2007 Norman M. SadehCMU/Microsoft Mindswap – Oct 2007 - Slide 24 Policy Evolution

25. Copyright © 2001-2007 Norman M. SadehCMU/Microsoft Mindswap – Oct 2007 - Slide 25 Other Promising Approaches  Visualization Techniques  Explanations & dialogues

26. Copyright © 2001-2007 Norman M. SadehCMU/Microsoft Mindswap – Oct 2007 - Slide 26 Overall Vision New Technology Policy Creation Policy Enforcement Policy Auditing & Refinement My colleagues can see my location on weekdays between 8am and 5pm Jane Time Jane is in Oakland but I can’t access Eric’s location Jane and Eric are late for our meeting. Show me where they are! Bob’s Phone Bob Why couldn’t Bob see where I was? Bob is a colleague. So far only your friends can see where you are Eric What if my colleagues could see my location too? Eric In the past you denied access to your colleague Steve OK, make it just my superiors Policy Visualization Policy Enforcing Engines Explanation Dialog Learning from the past

27. Copyright © 2001-2007 Norman M. SadehCMU/Microsoft Mindswap – Oct 2007 - Slide 27 Some of the Things We’ve Learned So Far  Adoption will depend on whether users feel they have adequate control over the disclosure of their contextual information  People often have rather complex privacy preferences People are not good at specifying their policies Not easy to identify good default policies beyond just denying all requests  Policies tend to become more complex as users grow more sophisticated Allowing more requests but in an increasingly selective way  Auditing is critical Learning, explanation & dialogs appear promising  Applies to both privacy and security policies

28. Copyright © 2001-2007 Norman M. SadehCMU/Microsoft Mindswap – Oct 2007 - Slide 28 Q&A Come & check out our poster this evening

29. Copyright © 2001-2007 Norman M. SadehCMU/Microsoft Mindswap – Oct 2007 - Slide 29 Some References  User-Controllable Security and Privacy Project: http://www.cs.cmu.edu/%7Esadeh/user_controllable_security_and_privacy.htm http://www.cs.cmu.edu/%7Esadeh/user_controllable_security_and_privacy.htm  Norman Sadeh, Fabien Gandon and Oh Buyng Kwon, “Ambient Intelligence: The MyCampus Experience”, Chapter in "Ambient Intelligence and Pervasive Computing", Eds. T. Vasilakos and W. Pedrycz, ArTech House, 2006. (Also available as Tech. Report CMU-ISRI-05-123, School of Computer Science, Carnegie Mellon University) - http://www.cs.cmu.edu/%7Esadeh/Publications/More%20Complete%20List/Ambient%20Intelli gence%20Tech%20Report%20final.pdfAmbient Intelligence: The MyCampus Experience  Jason Cornwell, Ian Fette, Gary Hsieh, Madhu Prabaker, Jinghai Rao, Karen Tang, Kami Vaniea, Lujo Bauer, Lorrie Cranor, Jason Hong, Bruce McLaren, Mike Reiter, Norman Sadeh, "User-Controllable Security and Privacy for Pervasive Computing", Proceedings of the 8th IEEE Workshop on Mobile Computing Systems and Applications (HotMobile 2007), February 2007. http://www.cs.cmu.edu/%7Esadeh/Publications/More%20Complete%20List/HotMobile2007- user-controllable-security-privacy%20submitted%20FINAL.pdfUser-Controllable Security and Privacy for Pervasive Computing http://www.cs.cmu.edu/%7Esadeh/Publications/More%20Complete%20List/HotMobile2007- user-controllable-security-privacy%20submitted%20FINAL.pdf  M. Prabaker, J. Rao, I. Fette, P. Kelley, L. Cranor, J. Hong, and N. Sadeh, "Understanding and Capturing People's Privacy Policies in a People Finder Application", 2007 Ubicomp Workshop on Privacy, Austria, Sept. 2007Understanding and Capturing People's Privacy Policies in a People Finder Application

30. Copyright © 2001-2007 Norman M. SadehCMU/Microsoft Mindswap – Oct 2007 - Slide 30 Acknowledgements Collaborators: Faculty: L. Bauer, L Cranor, J. Hong, B. McLaren, M. Reiter, P. Steenkiste Post-Docs & Students: P. Drielsma, M. Prabaker, J. Rao, I. Fette, P. Kelley, K. Vaniea, R. Reeder, A Sardinha, J. Albertson, D. Hacker, J. Pincar, M. Weber. The work presented in these slides is supported in part by NSF Cyber Trust grant CNS-0627513 and ARO research grant DAAD19-02-1-0389 ("Perpetually Available and Secure Information Systems") to Carnegie Mellon University's CyLab.