1. C MU U sable P rivacy and S ecurity Laboratory http://cups.cs.cmu.edu/ 1 Privacy Policy, Law and Technology Fair Information Practices September 9, 2008

2. C MU U sable P rivacy and S ecurity Laboratory http://cups.cs.cmu.edu/ 2 Assignments for HW2 #4  TRUSTe  Network Advertising Initiative  Safe Harbor  The Privacy Act of 1974  The Federal Wiretap Act  The Fair Credit Reporting Act  HIPPA  The Gramm-Leach Bliley Act  The Video Privacy Protection Act  Children's Online Privacy Protection Act  Family Educational Rights and Privacy Act (FERPA)  CPNI rules  Cable TV Privacy Act  EU Directive  PIPEDA (Canadian privacy law)  Japanese Personal Information Protection Act (PIPA)  California SB-1386  Australian Federal Privacy Law  Other US laws?  Other international laws?

3. C MU U sable P rivacy and S ecurity Laboratory http://cups.cs.cmu.edu/ 3 Using Library Resources

4. C MU U sable P rivacy and S ecurity Laboratory http://cups.cs.cmu.edu/ 4 CMU Libraries  http://www.library.cmu.edu http://www.library.cmu.edu  Engineering and Science (a.k.a. E&S) –Location: Wean Hall, 4th floor –Subjects: Computer Science, Engineering, Mathematics, Physics, Science, Technology  Hunt (CMU’s main library) –Location: Its own building (possibly 2nd ugliest on campus behind Wean), between Tepper and Baker –Subjects: Arts, Business, Humanities, Social Sciences  Software Engineering Institute (a.k.a. SEI) –Location: SEI Building (4500 Fifth Avenue), 3rd floor –Subjects: Security, Software, Technology

5. C MU U sable P rivacy and S ecurity Laboratory http://cups.cs.cmu.edu/ 5 START HERE: Cameo  Cameo is CMU’s online library catalog –http://cameo.library.cmu.edu/  Catalogs everything CMU has: books, journals, periodicals, multimedia, etc.  Search by key words, author, title, periodical title, etc.

6. C MU U sable P rivacy and S ecurity Laboratory http://cups.cs.cmu.edu/ 6 CAMEO: Search Result for “Cranor” Number of copies and status Library

7. C MU U sable P rivacy and S ecurity Laboratory http://cups.cs.cmu.edu/ 7 CAMEO: Search Result for “Solove” Due date

8. C MU U sable P rivacy and S ecurity Laboratory http://cups.cs.cmu.edu/ 8 If it’s not in Cameo, but you need it today: Local Libraries  Carnegie Library of Pittsburgh –Two closest locations Oakland: Practically on campus (4400 Forbes Ave.) Squirrel Hill: Forbes & Murray (5801 Forbes Ave.) –http://www.carnegielibrary.org/index.html  University of Pittsburgh Libraries –16 libraries! Information science, Engineering, Law, Business, etc. –http://pittcat.pitt.edu/http://pittcat.pitt.edu/

9. C MU U sable P rivacy and S ecurity Laboratory http://cups.cs.cmu.edu/ 9 If it’s not in Cameo, and you can wait: ILLiad and E-ZBorrow  ILLiad and E-ZBorrow are catalogs of resources available for Interlibrary Loan from other libraries nationwide (ILLiad) and in Pennsylvania (E-ZBorrow)  Order items online (almost always free)  Wait for delivery – average 10 business days  Find links to ILLiad and E-ZBorrow online catalogs at http://www.library.cmu.edu/Services/ILL/ http://www.library.cmu.edu/Services/ILL/

10. C MU U sable P rivacy and S ecurity Laboratory http://cups.cs.cmu.edu/ 10 Other Useful Databases  Links to many more databases, journal collections –Must be accessed on campus or through VPN –http://www.library.cmu.edu/Search/AZ.html  Lexis-Nexis –Massive catalog of legal sources – law journals, case law, news stories, etc.  IEEE and ACM journal databases –IEEE Xplore and ACM Digital Library  INSPEC database –Huge database of scientific and technical papers  JSTOR –Arts & Sciences, Business, Mathematics, Statistics

11. C MU U sable P rivacy and S ecurity Laboratory http://cups.cs.cmu.edu/ 11 And of course…  Reference librarians are available at all CMU libraries, and love to help people find what they need – just ask!

12. C MU U sable P rivacy and S ecurity Laboratory http://cups.cs.cmu.edu/ 12 Writing a Literature Review

13. C MU U sable P rivacy and S ecurity Laboratory http://cups.cs.cmu.edu/ 13 Writing a literature review  What is a literature review? –A critical summary of what has been published on a topic What is already known about the topic Strengths and weaknesses of previous studies –Often part of the introduction or a section of a research paper, proposal, or thesis  A literature review should –be organized around and related directly to the thesis or research question you are developing –synthesize results into a summary of what is and is not known –identify areas of controversy in the literature –formulate questions that need further research Dena Taylor and Margaret Procter. 2004. The literature review: A few tips on conducting it. http://www.utoronto.ca/writing/litrev.htmlhttp://www.utoronto.ca/writing/litrev.html

14. C MU U sable P rivacy and S ecurity Laboratory http://cups.cs.cmu.edu/ 14 Literature review do’s and don’ts  Don’t create a list of article summaries or quotes  Do point out what is most relevant about each article to your paper  Do compare and contrast the articles you review  Do highlight controversies raised or questions left unanswered by the articles you review  Do take a look at some examples of literature reviews or related work sections before you try to create one yourself –For an example, of a literature review in a CS conference paper see section 2 of http://cs1.cs.nyu.edu/~waldman/publius/paper.html http://cs1.cs.nyu.edu/~waldman/publius/paper.html

15. C MU U sable P rivacy and S ecurity Laboratory http://cups.cs.cmu.edu/ 15 Privacy terminology  Data subject  Data controller  Secondary use of data

16. C MU U sable P rivacy and S ecurity Laboratory http://cups.cs.cmu.edu/ 16 OECD fair information principles  http://www.oecd.org/document/18/0,3343,en_2649 _34255_1815186_1_1_1_1,00.html http://www.oecd.org/document/18/0,3343,en_2649 _34255_1815186_1_1_1_1,00.html  Collection limitation  Data quality  Purpose specification  Use limitation  Security safeguards  Openness  Individual participation  Accountability

17. C MU U sable P rivacy and S ecurity Laboratory http://cups.cs.cmu.edu/ 17 US FTC simplified principles  Notice and disclosure  Choice and consent  Data security  Data quality and access  Recourse and remedies US Federal Trade Commission, Privacy Online: A Report to Congress (June 1998), http://www.ftc.gov/reports/privacy3/ http://www.ftc.gov/reports/privacy3/

18. C MU U sable P rivacy and S ecurity Laboratory http://cups.cs.cmu.edu/ 18 USACM Policy Recommendations on Privacy (June 2006)  http://usacm.acm.org/usacm/Issues/Privac y.htm http://usacm.acm.org/usacm/Issues/Privac y.htm

19. C MU U sable P rivacy and S ecurity Laboratory http://cups.cs.cmu.edu/ 19 Discussion

20. C MU U sable P rivacy and S ecurity Laboratory http://cups.cs.cmu.edu/ 20 The Prada NYC dressing room  http://www.sggprivalit e.com/ http://www.sggprivalit e.com/  What aspects seem privacy invasive?  How could the design be changed to reduce privacy concerns?

21. C MU U sable P rivacy and S ecurity Laboratory http://cups.cs.cmu.edu/ 21 Discussion questions  Which technologies are privacy invasive?  Which technologies are privacy protective?  Can we turn one into the other?  How can we use the FIPs in our analysis?

22. C MU U sable P rivacy and S ecurity Laboratory http://cups.cs.cmu.edu/ 22 Applying the FIPs  Google Street View  Gmail advertising  Hillman Library Web Cam  Amazon.com book recommendations  Giant Eagle Advantage Card  Transportation Security Administration watch lists