Designing for Privacy

1
Designing for Privacy

• Carlos Jensen

2
Overview

• What is privacy?
• Why is privacy important?
• Whats the big deal anyway?
• Why is this HCI...?
• What does it mean to design for privacy?
• How to design for privacy
• Privacy research at Gatech

3
What is Privacy?

• Definitions of privacy
• The right to be left alone (1890)
• Control of personal information (1967)
• Encrypted data and communications (1997)
• Other? Most everyone has their own definition
• A word on privacy and security
• Related, but not the same

4
Privacy and Security

• Security is a often a prerequisite to privacy
• Privacy is difficult to enforce when system/data
  is not secure
• You can have in place all the privacy safeguards
  in the world, but if someone hacks the server and
  steals the information (Ferst Center, U Texas)
• Privacy invasions happen all the time in secure
  systems
• The db may be secure, but the system is designed
  to allow everyone access to all SSN
  (Registration)

5
Why is privacy important?

• Survey shows 69 of people agree with the
  following statement
• I am concerned about privacy invasions online
  and try to take action to prevent them from
  happening to me
• 1 reason for not shopping online is fear of
  fraud/privacy violations
• Privacy is good business, ask EarthLink
• It is the ethical thing to do! Protect your
  users!!!

6
Whats the big deal?

• Is there really cause for concern?
• 91 of U.S. Web sites collect personal
  information
• 90 collect personal identifying information.
• Spy-ware is becoming increasingly common
• ID theft 1 growing crime 1billion last year

7
Whats the big deal?
8
Whats the big deal?

• To me, its an issue of user empowerment
• Companies hide behind privacy policies
• The average policy requires a postgraduate
  reading proficiency to be deciphered
• These policies do not address user concerns
• Difference between Europe and the US
• Americans shielded from the government, but not
  from companies
• Should it be the other way around?

9
Why is this HCI?

• Yeah, ok, but why is this an HCI problem?
• Because I say so
• Why not?
• Because if not I wouldnt be giving this talk
• All of the above
• None of the above

10
Why is this HCI?

• Critical that users make informed decisions
• Informed consent protects both you and the user.
  You both have legal rights protections
• Hinges on the user actually making an informed
  decision
• Burden is on you to provide sufficient and
  adequate information
• One of many classic HCI problems!

11
Why is this HCI?

• No, but really?
• BECAUSE I SAY SO!!!
• Stop making trouble
• or Ill fail you!
• Well, not really
• but I know people who can!
• Maybe
• Elaine!!!

12
Designing for Privacy

• Privacy in design
• Making privacy visible
• Transparency
• Making privacy understandable
• Giving users control

13
Designing for Privacy Privacy in design

• Privacy as a first class object
• Dont address privacy in the implementation
  phase, privacy issues (most often) cannot be
  fixed like bugs
• Include privacy concerns in the initial design
  phase, cost-benefit analysis

14
Designing for Privacy Making privacy visible

• Most often users are not aware of what
  information is being collected about them
• Classic problem in Ubicom and online
• If you collect information, notify the user,
  preferably before doing so
• Remind the user! Promote self-awareness
• Dont blackbox indiscriminately!

15
Designing for Privacy Transparency

• What are you using this information for anyway,
  and how?
• Who has access to it?
• What does it tell you?
• Is this information combined with other sources?
• Making applications transparent
• Show queries
• Show end results

16
Designing for PrivacyMaking privacy
understandable

• Explain privacy what you are doing, why you are
  doing it, and what impact it has on the user in
  terms they understand
• Leverage users mental models
• Use terms and metaphors users understand and use,
  use them correctly (from the users perspective)
• Dont use techno-centric explanations

17
Designing for PrivacyGiving users control

• Dont nag the user into compliance!
• Level the playing field
• Allow users easy access to control mechanisms
• Make setting privacy preferences easy
• Again, use terms and metaphors familiar to users
• Scenarios are most effective, present users with
  use-cases, and let the user evaluate them
• For every allow-all question, ask the inverse!

18
Privacy research at Gatech

• Ubicomp
• Beth Gregory
• Software Engineering
• Colin
• HCI
• Colin me

19
A cry for help!

• Seeking undergraduate UROCS!!!
• Please come talk to me
• Or
• Email carlosj_at_cc.gatech.edu