Privacy Interfaces for Location Sharing: when is too much transparency

a bad thing?

Blaine Price

The PRiMMA Team...

Bashar NuseibehYvonne RogersArosha BandaraClara ManciniLukasz JedrzejczykKeerthi Thomas

Morris SlowmanAlessandra RussoEmil LupuNaranker DulayDomenico CorapiRyan Wishart

Adam Joinson

Outline

• Methods for understanding mobile privacy• Some experiments on Methodology• A Location Tracking User Study with Families• A Privacy Feedback Interface User Study• Some Lessons Learned, Future Directions• Questions/Discussion/Watch Videos...

The Problem With Asking People About Privacy is...

But it is (largely) not their fault•People are bad at judging the future value of their privacy•People are bad at judging how they will react to using new systems they have never used before

New Methods for Studying Mobile Privacy Behaviour

•Privacy Practices of Mobile Facebook Users

•Experience Sampling with Memory Phrase

•Found Mobile Contexts were multi-faceted, including individual perceptions, and different physical/virtual world interconnections

•Places, defined by emerging social cultural knowledge, are a major determinant of privacy needs, so effort at defining rules for automation can be based on a location/context pairing

Studying Privacy Behaviour with Future Technologies

• People find it difficult to imagine privacy risks in a technology they have never used

• Video (and written scenarios) can be powerful tools to allow participants to immerse themselves in unfamiliar tech and vicariously experience it

• Corporate Concept Videos• Videos• Apple Knowledge Navigator 1988• Microsoft Future Healthcare 2008

Contravision

• Semi-Professional video of a 6 scene story shot twice with subtle difference between versions

• In one version, protagonist has positive attitude and everything works perfectly

• Alternative verison, protagonist has negative attitude, technology has problems

• Participants watch one version without being told which one

• Wider range of privacy concerns elicited

User Study 1: Tracking in Families

tracking and relationshipswww.vanityfair.com/culture/features/2009/12/addams-family-200912

Why Familes?

Some implicit assumptions

close knit tracking is safernews.bbc.co.uk/cbbcnews/hi/newsid_6540000/

newsid_6549400/6549495.stm

Assumptions...

the tracked is the vulnerable oneimgfave.com/search/someone%20deleted%20my%20tag

Assumptions...

Enough controls will set you freeen.wikipedia.org/wiki/File:STSCPanel.jpg

Study Design

F1 F2

Mother & fatherDaughter1 & partnerDaughter2 & boyfriendDaughter3

Mother & fatherSon & friendDaughter

3 weeks, 1092 unique tracking events

Interface examples

Conditions and Questions

complete visibility run/chase?

jordanhoffman.com/2007/03/08/das-

experiment-2001-oliver-hirschbiegel-b

Findings

“I don’t think it makes me a better person checking up on people…so I try to stay out of it as I possibly can as it’s none of my business, but this technology makes it a little bit too easy, you are only human”

www.essex.police.uk/news_features/other_stories/victim_of_a_stalker.aspx

Conditions and Questions

tracking tasks uneasy/keen?

Findings

“It was easier to [check on others] when I was asked to do so…I didn’t feel like it was my responsibility…it wasn’t me doing it, I was just carrying out a task”

delegating responsibility

Conditions and Questions

real-time feedback reassured/deterred?

Findings

“I would prefer not to know, or I would have to start asking myself why they are checking on me…have I done something wrong…are they after something?”

questioning others’ motives

Unexpectedness and destabilisation

“I looked him up…he was last tracked four hours ago…I thought oh did he turn his phone off…or did he turn the tracker off and why did he do that… why didn’t he tell me? Who is he with? And why is he there?”

F1-Daughter2 F1-Boyfriend

Closeness and control

“At times I’d rather she didn’t track

me…but I wouldn’t use privacy

preferences [as] I know that would

hurt her feelings”

F2-Mother F2-Son

Breach and predation

“I feel because [they] have shown in the past that [they] are not trustworthy, that kind of [they] started it…it means I can check up on [them] and not feel too bad…[they] are unlikely to do what [they] say the do, so anything you see [on the tracker] is probably just going to confirm that”

Close knit tracking is not safer

Tracking affects both parties

The closer the less in control

Conclusions

Inspiration for Study 2

• Pervasive systems allow collection of data about individuals– Increasing proliferation and dependence on these systems– Threats to privacy

Users informed and manually manage privacy settings– Impractical ! Too many controls..

Pervasive systems need automated mechanisms for governing privacy behaviours that,– Reflect user preferences,– Adapt to changes in circumstances, context and user behaviours

24

Goals

Develop automated mechanisms for governing privacy behaviours– Reflect user preferences,– Adapt to changes in circumstances, context and user behaviours– Use Social Translucence as Privacy Interface mechanism

•Example:Privacy Management for Location Based Applications– Share location information with appropriate precision to

the appropriate people, at the appropriate times– Provide awareness of information access.

How can we learn policies from user behaviours?

25

Challenge

26

Build a system capable of learning mobile privacy policies enforceable on mobile devices to reduce intervention in privacy management.

User Agent

…

Phone call

Current credit

Current location

Requirements:User should be able to understand and modify the learned rules.Existing structured information and constraints should be used. Rules should be learned incrementally.Learned rules should be revisable (minimally) depending on changing conditions.

Scenario: Real-time Feedback for LBS

27

Context,Constraints

New /RevisedRules

E+

E+

E+

E+

E-

E+

“Show location lookup using {mode} if {context}”

Co-location Location(GPS, name)

Social Network

In meeting, Alice requests

Driving, Bob requests

Web browsing, Alice requests

We can learn sets of policy rules: Concept invention Recursion Inter-related

concepts Tailor the search

(customised search heuristics)

Use probabilities to handle noise in the data

User Study 2: Automatic Privacy Feedback Preference Detection

• Surveys, Interviews and Focus groups to find range of Privacy Feedback interfaces:– Dialog Box, Toast, Notification Bar, Vibration, LED,

Sound, Flashlight, Natural Language• New version of Buddy Track pre-seeded with

context sensitive rules on which methods to use

• Feedback interface using experience sampling to teach engine which policies are correct

How it works: Example

1

2

Scenario: Real-time Feedback for LBS

30

At homeH H H

07:00

Lookup fromAt location

Day 1 07:30

Learning new user behavior rules….

Context: in_group(alice, home). in_group(bob, home). happens(gps(57,10),07:00). at_location(home, W, N) ← Conditions,….phone_position(in_hand) ← Conditions,….

Examples: not do(rtf_toast(alice), 07:00). do(rtf_toast(bob), 07:30). do(rtf_toast(bob), 11:00).New policy:

do(rtf_toast(Call_Id, From), T ) ← phone_position(in_hand) ∧ T ≥ 07:30

Scenario: Real-time Feedback for LBS

31

At home At homeAt ImperialNear desktop

H C C H F CF H H07:30

Lookup fromAt locationNear device

Day 2

…. and revising existing rules incrementally

Context: ……….. do(rtf_toast(Call_Id, From), T ) ← phone_position(in_hand) ∧T ≥ 07:30

Revised policy: do(rtf_toast(Req_Id, From), T ) ← phone_position(in_hand) ∧ T ≥ 07:30

∧ in_group(From, college) do(rtf_toast(Req_Id, From), T ) ← phone_position(in_hand) ∧ T ≥ 07:30

∧ ¬holdsAt(location(Imperial)), T )

Using privacy policies

32

Privacy policies; do(rtf_toast(Call_Id, From), T ) ← phone_position(in_hand) T ≥ 07:30 ∧ ∧ in_group(From, college). do(rtf_toast(CallId, From), T ) ← phone_position(in_hand) T ≥ 07:30 ∧ ∧

¬holdsAt(status(bluetooth_near(desktop)), T ).

Context…in_group(charles, college).….

1) Location request made2) do(rtf_toast(charles),T) ? YES

3) Toast notification of location lookup

Querying rules….

User Study & Findings

• 15 participants, loosely knit groups, 3 weeks• 2 phases (learning, evaluation)• Predefined rules used in the phase 1• Interviews

• Increased accuracy (appropriateness of notifications).• Greater Trust and Comfort.• Awareness of notifications contributes towards the

acceptance of the technology.• “Invisibility” of the interface.

Summary

34

• State-of-the-art learning system able to learn– Properties about the data, even if not directly

observed– Recursive and inter-dependent policies– (Revised) policies from negative and positive examples– Incrementally– Minimal revisions of existing policies

• Demonstrated utility of learning for adaptive awareness for privacy management.

Future Directions

• Domain-specific heuristics– Apply to other lifelogging domains

• Application to (large) real data sets• Scalability and efficiency• Privacy Interface Controls too complicated– Apply learning to data from groups of users to

derive ‘default’ privacy configurations– Learn privacy threats and requirements

35