
\documentclass[letterpaper]{article}
\usepackage{aaai}

\usepackage{times,epsfig,url}
\usepackage{helvet}
\usepackage{courier}
\usepackage[labelfont=it,textfont=it]{caption}

\renewcommand{\captionfont}{\small}
\renewcommand{\captionlabelfont}{\small \bf}


\pdfinfo{
/Title (Enabling Privacy-awareness in Social Networks)
/Subject (AAAI Spring Symposium 2010 http://codex.stanford.edu/privacy2010.html)
/Author (Ted Kang and Lalana Kagal)}
\setcounter{secnumdepth}{0}  

\long\def\comment#1{\relax}

 \begin{document}

\title{Enabling Privacy-awareness in Social Networks}
\author{Ted Kang and Lalana Kagal\\
MIT Computer Science and Artificial Intelligence Lab\\
32 Vassar Street 
Cambridge MA 02139\\
Email: \{tkang, lkagal\}@csail.mit.edu\\
}
\maketitle

\begin{abstract}
Most social networks have implemented extensive and complex controls
in order to battle the host of privacy concerns that initially plagued
their online communities. These controls have taken the form of
a-priori access control, which allow users to construct barriers
preventing unwanted users from viewing their personal information.
However, in cases in which the access restriction mechanisms are
bypassed or when the access restrictions are met but the data is later
misused, this system leaves users unprotected.  Our framework, Respect
My Privacy, proposes an alternative approach to the protection of
privacy.  Our strategy is similar to how legal and social rules work
in our societies where the vast majority of these rules \comment{that
  form the fabric of our societies} are not enforced perfectly or
automatically, yet most of us follow the majority of the rules because
social systems built up over thousands of years encourage us to do so
and often make compliance easier than violation. Our project aims to
support similar functionality in social networks. \comment{ by
  allowing users to clearly declare usage policies for their data and
  implementing mechanisms that make people who use this data aware of
  the policies.} Instead of focusing on enforcing privacy policies
through restricted access, we focus on helping users conform to
existing policies by making them aware of the usage restrictions
associated with the data. \comment{We have defined a simple and easily
  extensible vocabulary for specifying restrictions on the use of data
  in social networks and developed applications for policy and license
  awareness in different platforms.} The framework has two main
functions - generating privacy or usage control policies for social
networks, and visualizing these policies while exploring social
networks. We have implemented this functionality across three
platforms: Facebook, OpenSocial and Tabulator, a Semantic Web
browser. These applications enable users to specify privacy
preferences for their data and then display this privacy-annotated
data prominently enabling other users to easily recognize and conform
to these preferences.  \comment{We have Facebook and OpenSocial
  applications that enable users to specify their privacy
  preferences. These preferences then appear on their profiles as
  icons alerting viewers to the privacy policy. We also have FOAF
  applications that export these privacy-annotated social profiles as
  Friend Of A Friend profiles in RDF. In Tabulator, we've modified the
  pane that displays social networking data to also display RMP
  settings and a sidebar that uses colors as subtle warnings that the
  explored data can or cannot be used for certain purposes.}

\end{abstract}

\section{Introduction}								
\label{sec:intro}

\indent From their inception, social networks have suffered from a
host of privacy issues.  When social networks were first gaining in
popularity, privacy mechanisms were sparse with most profiles being
publicly available to all members.  As social networks like Facebook
and MySpace exploded in popularity, however, many users were shocked
to find that the information that they had posted on their profiles
were coming back to have unintended consequences in their real life:
employers were reported to be using Facebook as a way to vet possible
employees; universities were using Facebook pictures to identify
people that had attended illegal functions; and children were being
preyed on by sexual offenders on MySpace. Social networks responded to
these highly publicized privacy concerns by implementing complex
privacy controls that allowed users to construct barriers preventing
unwanted users from looking at private information.  This method of
privacy protection, called access control, seeks to close off and hide
information from those that are not explicitly given access to it.  It
is a binary system in which those that obtain access to the data,
legitimately or not, have full reign over the use of that data while
those without access cannot view anything.

These access restriction systems, while useful in blocking out
unwanted viewers, are ineffective for a large, decentralized system
like the World Wide Web.  It is easy to copy or aggregate information,
and it is often possible to infer "private" information without
actually having explicit access to the information itself.  In
addition, there are always human factors that a technical access
restriction system will have trouble handling.  For example,
Facebook's access restriction systems did not prevent users from
unwillingly publicizing their purchases when Facebook introduced
Beacon, a controversial advertising program.  Only a mass protest from
users caused Facebook to readjust their privacy
controls~\cite{nytimefbeacon}. Given all these ways for data to escape
from behind access restriction systems, we propose a more social
approach to privacy. \comment{it is troubling that access restriction
  mechanisms are powerless in cases where information is compromised.
  An apt analogy from \emph{Information
    Accountability}~\cite{weitzner08info} compares sole reliance on
  access restriction to "focusing all one's attention on closing the
  barn door and ignoring what might happen to the horses after they've
  escaped."}

The Respect My Privacy (RMP) framework offers an alternative approach
to protecting privacy in social networks. It is based on Information
Accountability~\cite{weitzner08info}, which argues that in addition to
access control, there need to be ways of ensuring that people know
exactly what they can and cannot do with personal or sensitive
information.  \comment{In addition, Information Accountability also
  argues for mechanisms that notify users of misuse of their data
  after the fact.} This approach is similar to the system in place for
legal and social rules in society.  In society, a set of legal or
social norms govern what we can or cannot do, and they have been
ingrained into our way of thinking such that most people go through
life without any problems.  When problems occur, there are mechanisms
that ensure that those who broke the set of legal or social norms are
reprimanded.  Likewise, social networks should be policy-aware and
have mechanisms in place that allow users who violate privacy or usage
policies within the network to be identified and held accountable.
However, an accountable system cannot be adequately implemented on
social networks without assistance from the social network itself
(such as in ~\cite{nytimefbeacon}), without detailed provenance trails
to identify violators, and without regulation, which causes violators
to be adequately punished. Though our long term vision includes a full
accountable system, the RMP framework concentrates on technical
soluctions for making social networks aware of privacy policies.

\comment{Information Accountability calls for further mechanisms that
  will assist users in detecting misuse of their information.}

\comment{We are looking into technical mechanisms to assist users in
  detecting when their private information is misused.}


Our framework uses Semantic Web~\cite{bl05n3primer} technologies for
defining different kinds of privacy/usage restrictions and declaring
restrictions associated with data. Through the use of these
technologies, the RMP framework is able to support dynamic definition,
extension, and re-use of meta-data describing privacy policy, intended
purpose or use of data, mechanisms to attach this meta-data to any
Semantic Web data to indicate its policy, and interoperability between
different meta-data definitions.

The implementation of the RMP framework consists of four main parts:
an ontology that defines classes of privacy restrictions and
properties for attaching them to Semantic Web data, applications in
Facebook and OpenSocial that allow users to create RMP restrictions
and display them on their profile pages, a converter that translates a
Facebook/OpenSocial profile into a widely used Semantic Web social
ontology, Friend of a Friend (FOAF), and extensions to
Tabulator~\cite{tab} for adding restrictions to data and viewing
restricted data in different colors to make it easier to responsibly
browse and re-use social data.

\comment{The first part of the framework is the RMP ontology.  This ontology
represents the five restrictions that are currently offered in RMP:
\emph{no-commercial}, \emph{no-depiction}, \emph{no-employment},
\emph{no-financial}, and \emph{no-medical}.  Users can apply these
restrictions over their social network profiles to declare that they
do not want their personal information used in certain ways.  The
ontology allows users to apply these restrictions to any RDF data
including their Friend of a Friend (FOAF) documents.

The second part of the framework is the RMP applications in Facebook
and OpenSocial that allow users to create RMP restrictions and display
them on their profile pages.  The aim of the RMP applications on the
mainstream social networks is to gain a wider acceptance for the RMP
restrictions with which users can declare their personal information.

The third part of the framework is the FOAF converter.  Initially
developed by Matthew Rowe, the FOAF converter takes Facebook profiles
and converts all the information to RDF in the format of FOAF
files~\cite{foafgen}. This FOAF converter was altered to include the
RMP restrictions that a user has declared for his Facebook/OpenSocial
profiles.  This will hopefully increase the number of FOAF users and
offer initial privacy protections to members of a decentralized FOAF
network.

The final part of the framework are the extensions to
Tabulator~\cite{tab}. Tabulator, a Firefox extension, acts as a
framework upon which a decentralized social network can be
built\cite{decent}. The social pane, which allows users to view FOAF
files in a format similar to a social network profile page was
extended to include RMP settings.  The RMP adds to the Tabulator by
ausers to declare or modify restrictions using the RMP
ontology over their FOAF files.  In addition, a privacy aware pane
highlights restricted data with different colors to notify users of
those restrictions and makes it easier to responsibly browse Semantic
social data.}



%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%% Design

\comment{
\section{Design}					
\label{sec:design}

\indent The RMP framework enhances privacy protections in social
networks by establishing a set of 'social norms' that the users will
hopefully adopt and embrace.  This requires offering users a simple
but clear way to declare how they want their private information
handled.  In addition, it requires that enough members are
knowledgeable about this vocabulary such that they can easily realize
the limitations on using a certain piece of data.

To achieve this goal of widespread adoption, we aimed to create a
simple and recognizable brand.  To create this brand, we looked to the
Creative Commons project that has been successful in creating a brand
that is now fairly well known across the Internet.  Creative Commons
is a nonprofit corporation founded by Lawrence Lessig that is
"dedicated to making it easier for people to share and build upon the
work of other, consistent with the rules of copyright."~\cite{hal08cc}
One of the main reasons that Creative Commons has reached its level of
widespread acceptance is its ease of use and easily recognizable
icons.  } \comment{To receive a free Creative Commons license, users
  merely have to log onto the Creative Commons website and choose one
  of their six licenses.  The user choose whether they want to allow
  commercial uses of their work and if they want to allow modification
  of their work.  Once the user makes two choices, the user is given a
  small, simple icon that notifies users about the type of license
  that is placed on piece of work.  The icon is a simple rectangle
  with the common "CC" logon on the left and smaller intuitive icons
  that represent the type of restrictions on the license.  By clicking
  on the icon, users are redirected to a page that gives additional
  details about the license.}  

\comment{In addition, the RMP application needs to establish a brand
  by offering a simple, recognizable icon that links to a page that
  offers additional information.  As with the Creative Commons
  licenses, we hope that as more and more people view the RMP icons
  attached to profile pages, it will gain widespread traction and
  acceptance.  This also means that we need to have the first
  implementations of the RMP application in well established social
  networks.

In the future, we would also like to provide technical mechanisms that
could reason about how a piece of data is used and automatically
notify users when it finds that personal information has been misused.
This implies that a certain amount of control is needed over the
actual personal information itself as it would need to be machine
readable. This goal is more difficult to accomplish as all large
social networks are currently centralized.  Facebook, MySpace, and the
other major social networks "own" the personal information that is
placed on their sites and are very protective of
it~\cite{tcrunchfbook}. Without more control over one's personal
information, it is difficult to apply technical mechanisms that could
detect misuse.  For instance, Information Accountability argues for
attaching semantic data with provenance, or a trace, such that
reasoners would be able to trace a data's history of usage and ensure
that data has been appropriately used at each step.  This attaching of
provenance data is impossible in a centralized social network unless
social networks like Facebook and MySpace become actively involved in
the project.  Until that occurs, another aim of the RMP framework is
to use Semantic Web technologies to represent the restrictions.

Thus, our main design goals are two fold.  The first concentrates on
creating a simple user experience in already established social
networks in order to gain acceptance of the RMP restrictions.  The
second concentrates on also applying the RMP framework to Semantic Web
technologies such that as the RMP framework begins to gain traction,
we can offer more extensive accountability mechanisms that take
advantage of Semantic Web technologies.
}

\comment{ RMP SCHEMA

:restricts a rdfs:Property;
        rdfs:comment "Applies a restriction";
        rdfs:label "restricts";
        rdfs:range :Restriction.

:Restriction a rdfs:Class;
        rdfs:comment "A privacy restriction";
        rdfs:label "Privacy Restriction".

:No-Commercial a :Restriction;
        rdfs:comment "The no-commercial restriction states that the
        owner of this profile does not want the information on this
        profile used for commercial purposes.";
        rdfs:label "No-Commercial".

:No-Depiction a :Restriction;
        rdfs:comment "The no-depiction restriction states that the
        owner of this profile does not want this profile associated
        with any pictures.";
        rdfs:label "No-Depiction".

:No-Employment a :Restriction;
        rdfs:comment "The no-employment restriction states that the
        owner of this profile does not want the information on this
        profile used for employment purposes.";
        rdfs:label "No-Employment".

:No-Financial a :Restriction;
        rdfs:comment "The no-financial restriction states that the
        owner of this profile does not want the information on this
        profile used for financial decisions.";
        rdfs:label "No-Financial".

:No-Medical a :Restriction;
        rdfs:comment "The no-medical restriction states that the owner
        of this profile does not want the information on this profile
        used for decisions related to medicine or medical care";
        rdfs:label "No-Medical".

}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%% Implementation Details

\begin{figure}[b]
  \centerline{\epsfig{file=images/rmprestrictions.jpg, height=.75in}}
  \caption{The images for the five restrictions we've defined:
    no-commercial, no-depiction, no-employment, no-financial, and
    no-medical. }
  \label{fig-cc-deed-box}
\end{figure}

\begin{figure}[t]
  \centerline{\epsfig{file=images/rmpicons.jpg, height=1.2in}}
  \caption{RMP icons that can be placed on a social network profile
    page to indicate a certain privacy policy. Each policy is composed
    of several individual RMP restrictions and the icon link to a page
    containing additional information about the specific policy.}
  \label{fig-cc-rmp-box}
\end{figure}



\section{Implementation}	\label{sec:architecture}

\indent The current architecture of the RMP framework consists of two
distinct parts.  The first is RMP applications on mainstream social
networks such as Facebook and OpenSocial.  These applications are
aimed at introducing RMP restrictions and attempt to spread some
familiarity with the restrictions.  The second is the Semantic Web
aspect, which is aimed at supporting privacy/license/usage-aware
browsing of data ultimately leading to decentralized social
networks~\cite{decent}. \comment{consisting of FOAF files that can be
  navigated through the Tabulator extension.  The Tabulator extension
also offers the door for future work on accountability systems as
users have greater control and flexibility over their personal
information.}

Connecting these two parts is the FOAF converter, originally developed
by Matthew Rowe, that was extended to support the RMP restrictons. The
FOAF converter takes the personal information stored in Facebook along
with associated RMP restrictions and creates a FOAF file that is
stored on a Web server.  This, in effect, becomes a profile in a
decentralized social network if navigated through the Tabulator
Extension.  \comment{The hope is that this pane will encourage the
  adoption of decentralized social networks and show the benefits of
  privacy protections based on Information Accountability offer.}


\subsection{RMP Restrictions and Ontology}

\indent Following the Creative Commons model, the RMP application aims
to offer an easy user experience that allows users quickly declare the
restrictions they wish to place on their data.  However, unlike
Creative Commons that provides a standard set of licenses, communities
of users can easily generate their own privacy/usage ontologies to be
used with our RMP framework.

\indent RMP offers simple privacy/usage restrictions for users through
an
ontology\footnote{http://dig.csail.mit.edu/2008/02/rmp/rmp-schema.n3}. \comment{Offering
  predetermined restrictions will ensure a better user experience and
  allow the creation of simple and recognizable icons that will assist
  in the widespread adoption of RMP.}  There are currently five
restrictions that are implemented on RMP: \emph{no-commercial},
\emph{no-depiction}, \emph{no-employment}, \emph{no-financial}, and
\emph{no-medical}. Each of these restrictions has a corresponding
picture as seen in Figure~\ref{fig-cc-deed-box}.  For combinations of
restrictions, these pictures are combined in different ways to create
simple icons that can be placed on social network pages and link to
additional information.  A sample of these icons is shown in
Figure~\ref{fig-cc-rmp-box}.  When associated with a Facebook or
OpenSocial profile, these icons link to a page that offers additional
information about each of the restrictions that has been
applied. Users may choose to apply one or any combination of the five
restrictions on their social network profiles and related pages.  The
lack of any of these restrictions on a profile page implies that the
use is allowed.  For example, not including the no-financial
restriction would imply that you are willing to allow your personal
information to be used for financial purposes.

\begin{figure}[t]
  \centerline{\epsfig{file=images/rmp-ontology, height=3.4in}}
  \caption{Part of the RMP ontology in N3 that defines possible types of privacy restrictions.}
  \label{fig-rmp-ont}
\end{figure}


\emph{no-commercial}: The no-commercial restriction is similar to its
counterpart in the Creative Commons.  At the time when the RMP
restrictions were being developed, there was no way to apply Creative
Commons restrictions on the content that one posted to a social
network.  This restriction states that the user does not want anything
on his profile or related pages to be used for a commercial purpose.

\emph{no-depiction}: The no-depiction restriction implies that the
user does not want her picture used for any reason and does not want
her private information used to identify her in an image.  This
restriction was meant to specifically protect the pictures that users
often post on social network sites.  These posted pictures have been
the most troubling with universities using student photos as evidence
for infractions and employers using Facebook pictures to prove that
employees were not doing what they claimed to be doing.

\emph{no-employment}: The no-employment restriction declares that the user
does not want any personal information used for the purposes of any
kind of employment decision.  For example, this would make companies
aware that the user does not want them using their social network page
as a way to vet them for a job.  In addition, this would imply that an
employer could not use personal information from a social network as
justification for a firing.  This restriction was meant again as a
response to common incidents of users not being hired or being fired
from a job owing to something they posted on a social network.

\emph{no-financial}: The no-financial restriction declares that the user does
not want any personal information used for any financial purposes.
For example, the user would not want banks using personal information
from the social network to influence a loan or credit decision, or
have any influence in divorce proceedings.

\emph{no-medical}: The no-medical restriction declares that the user
does not want any personal information used for any medical purposes.
For example, the user would not want hospitals or insurance providers
using personal information from the social network to research into
her lifestyle habits or more.


\comment{This set of restrictions is currently aimed primarily at protecting
individuals not organizations as organizations have a vested interest
in protecting privacy interests.  This can be seen by the current
trend of appointing CPOs, or Chief Privacy Officers, who ensure that
companies are aware of and protect privacy interests.  There is a
market place for privacy that is being created and surveys report that
consumers prefer organizations that respect privacy interests to those
that do not~\cite{harris}.  The hope is that the competition between
organizations to protect privacy will make them respect privacy
declarations, fearing bad public relations, more so than individuals
would.}

The restrictions are represented as ontological information in
N3~\cite{bl01n3} as illustrated in Figure~\ref{fig-rmp-ont}. This
ontology can be easily modified or extended to meet different
requirements. A restriction for a data item such a FOAF profile is
declared using the \emph{restricts} property from the ontology. For
example, to specify that Ted's profile is restricted to
\emph{no-commercial}, Ted would include the following in his FOAF
profile (where $< >$ refers to his profile)

%%%%%%%%%%%%%%%%%%%%%%%%

\begin{verbatim}
<> a foaf:PersonalProfileDocument;
     rmp:restricts rmp:No-Commercial.
\end{verbatim}

It is possible to combine multiple restrictions such as in
Figure~\ref{fig-foaf}, which is a sample FOAF file where the user has
selected to apply both the \emph{no-commercial} and \emph{no-medical}
restrictions on his FOAF profile. RMP restrictions can be attached to
any resource including images, projects, and clinical trials. The
example below is a description of a clinical trial that has
\emph{no-commercial} and \emph{no-financial} restrictions associated
with it.

\begin{verbatim}
@prefix ex: <http://example.cancer.gov#> .
@prefix ma: <http://example.ma.gov#> .

:C123 a ex:ClinicalTrial;
   ex:phase ex:PhaseIII;
   ex:type ex:HealthServiceResearch;
   ex:Status ex:Active;
   ex:sponsor ma:MGH;
   ex:protocolID ex:116892-193;
   rmp:restricts rmp:No-Commercial, 
                 rmp:No-Financial.
\end{verbatim}


\begin{figure}[t]
  \centerline{\epsfig{file=images/alice-tabulator, height=1.5in}}
  \caption{A sample FOAF file of a user that has applied the
    no-financial restrictions on her FOAF file as viewed in the Tabulator.}
  \label{fig-foaf}
\end{figure}

\subsection{RMP on Facebook and OpenSocial}

\indent The RMP application on Facebook is a MySQL/PHP driven Web
application that uses the Facebook Application
API\footnote{http://www.facebook.com/apps/application.php?id=10637134047}.
In order to mimic the ease of use for Creative Commons, the creation
of a RMP setting is simple, taking mere minutes.  When a user decides
to add the RMP application, they are directed to a page that explains
the philosophy behind RMP.  This page is very important as RMP on
Facebook is currently a project entirely dependent on its members.  As
more users create the RMP restrictions and expect their restrictions
to be respected, organizations will feel more pressure to actually
respect those restrictions.  Thus, the introductory text attempts to
instill the idea that the user is part of a movement that will improve
everyone's social network experience the more the user respects others
restrictions.  The user is then directed to a page that lists the five
restrictions with descriptions of each.  Each restriction has an
accompanying checkbox, which allows the user to decide whether they
want to apply that restriction or not.  Once they have chosen the
restrictions, they are done.  The restrictions are saved into the
MySQL database and the appropriate icon is pushed to the profile page
so that everyone who visits a user's profile page can clearly see the
restrictions that the user has placed on his personal information.

Once a user has created a set of RMP restrictions, there are several
features that become available to them.  First, the user's RMP icon is
pushed onto their profile page along with some informative text in the
following context: ``The information on this profile may not be used
for ... purposes.''  Now anyone who visits that profile page will be
able to view the RMP icon.  A sample Facebook page with the RMP icon
visible in the lower-left is shown in Figure~\ref{fig-fb}.

If any visitor clicks on the RMP icon they will be directed to a page
that lists the restrictions that the user has decided to apply and a
paragraph giving more information on the restrictions chosen.  The
users are then invited to join the RMP movement on Facebook by
creating their own set of licenses.

The RMP application on OpenSocial is driven primarily by Javascript.
OpenSocial's API and data storage is fairly different from that of
Facebook, relying heavily on Javascript and not an actual database,
but the OpenSocial application was designed to be exactly like its
counterpart on Facebook.

\begin{figure}[t]
  \centerline{\epsfig{file=images/fbook-prof.png, height=3in}}
  \caption{A user's Facebook profile with the RMP icon in the lower
    left.  Any Facebook user who clicks on that icon is directed to a
    page, which offers additional information on the applied
    restrictions.}
  \label{fig-fb}
\end{figure}


\subsection{The FOAF Converter}

\indent The RMP application on Facebook allows users to port their
Facebook profiles to FOAF files.  This acts as a bridge between the
RMP applications in Facebook and the corresponding extensions on the
Tabulator.  Users can download the FOAF file generated from their
Facebook profile and host it on a Web server.

\begin{figure}[!t]
  \centerline{\epsfig{file=images/tab-edit.png, height=2.2in}}
  \caption{The social pane on the Tabulator offers a social network
    profile like view of FOAF information and also allows users to
    create and edit RMP restrictions.}
  \label{fig-tab}
\end{figure}


This will hopefully introduce members of mainstream social networks to
the idea of decentralized social networks.  With further work on
Tabulator, users might be able to see the advantages of having
complete control of their data especially as methods of attaching
provenance and more sophisticated accountability mechanisms are
developed.

\subsection{Social pane and RMP sidebar for Tabulator}


\indent Tabulator is a generic Semantic Web data browser and editor
for RDF data, similar to how a web browser is used to navigate HTML
pages.  Tabulator is currently implemented as a Firefox extension.
When a user installs the extension and uses Firefox to go to a URI
that contains RDF triples, Tabulator offers an easy interface with
which to view the RDF data and allows users to easily explore triple
relationships to obtain more data.  Tabulator recently implemented a
social pane that becomes available when users browse FOAF data.  The
social pane displays the FOAF data in a format similar to social
network profiles, allowing the typical social network experience in a
decentralized setting.

We modified the social pane to enable users to attach CC licenses and
RMP restrictions to their FOAF files.  Users with editable FOAF files
can use Tabulator to identify a FOAF files as their identity.  Once an
identity has been established, users can host their editable FOAF
files on WebDAV~\cite{webdav} servers and use SPARQL~\cite{sparql}
updates to create or edit the restrictions they place over their FOAF
profiles.  The social pane also displays the RMP icons if restrictions
are detected, similar to the RMP applications on the mainstream
networks.  An example social pane that would occur when browsing upon
a FOAF file with Tabulator is shown in Fig~\ref{fig-tab}.

\begin{figure}[!t]
  \centerline{\epsfig{file=images/sidebar-example.jpg, height=3.1in}}
  \caption{The license/restriction highlighting sidebar detects CC
    licenses and RMP restrictions and highlights the protected
    data. Different licenses/restrictions are assigned different
    random colors that the user can customize.}
  \label{fig-sidebar}
\end{figure}

In addition, we've implemented a license/restriction aware
sidebar. This sidebar makes it easy to recognize protected data while
browsing semantic information using Tabulator.  The sidebar detects
the presence of RMP restrictions or Creative Commons licenses as data
is browsed, and prominently displays this protected data in different
colors. Users can customize colors for each restriction or license
identified and any data that is protected by a restriction or license
will be highlighted in the chosen color, allowing users to instantly
recognize the information that is protected under certain policies.
An example of the the policy aware sidebar with the highlighting
functionality is shown in Figure~\ref{fig-sidebar}. The figure shows
Bob's FOAF file in pink because his profile has a \emph{no-medical}
restriction associated with it. Bob works on the Social Web Privacy
project, which appears in yellow as it is restricted by the \emph{CC
  Attribution Non Commercial Non Derivative} license. Carol is a
developer on the project and her privacy preference is the \emph{CC
  Attribution Non Commercial} license that causes her information to
appear in lavender.




%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%% Related Work
\section{Related Work}						
\label{sec:relatedwork}

\indent Shortly after our Facebook application was developed, the
Creative Commons released a Facebook application~\cite{ccfbookapp}. In
this application, users are able to choose from the six Creative
Commons licenses and apply them over their entire profiles. Users are
given the recognizable Creative Commons icon and are able to publish
it on their profiles linking to a page with more information.  This
application is definitely a step in the right direction as it does not
solely rely on access control to prevent unwanted users from viewing
data but declares to all viewing users certain restrictions on how
they want their licensed information used.  However, it restricts
users to selecting one of the existing CC licenses whereas with the
RMP framework, users and communities are free to define and use their
own privacy/usage ontologies or extend and reuse ontologies defined by
others.


A second example of users proactively being able to control how their
personal information is used is with an extension proposed to Google
AdSense ads.  Google AdSense includes a notion of policy-awareness by
putting a hyperlink ``Ads by Google'' on all its
advertisements~\cite{nytimesgoog}. When clicked, the user gets general
information about why these ads were displayed and is able to slightly
modify how further targeting is performed. Turow proposes an extension
in which each ad will have an icon that when clicked displays exactly
what information was used in order to choose that
ad~\footnote{http://www.asc.upenn.edu/ascfaculty/FacultyBio.aspx?id=128}. These
approaches are related to our framework in that they attempt to make
policy explicit but they focus on the use of search/clickstream data
for targeted advertisements versus the use of personal data available
in social networks.

Another example, the Platform for Privacy Preferences (P3P) relies on
server-side policy markup to describe how user information collected
by servers is utilized~\cite{p3p02}. The main goal is to allow users
to understand how servers use their data. Unfortunately enforcement is
a problem because it is difficult for users to verify whether servers
actually conform to their own policies. In our approach, anyone can
markup their own data and our goal is awareness of these privacy
annotations and is not so much about enforcement.


%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%% Future Work
\section{Future Work}

\indent The RMP project still has areas that require significant
work. First, the applications in the framework expect privacy
annotations to be associated with resources such as documents or FOAF
profiles and are unable to handle more finely grained annotations such
as privacy restrictions on a user's participation in a specific
clinical trial. We would like to use N3Logic~\cite{n3logic} or
POWDER~\cite{powder} to allow any RDF sub-graphs within a document to
be annotated with RMP privacy restrictions and support this in our
Facebook, Open Social applications as well as in Tabulator.

\comment{As discussed in the introduction, an accountable system
  requires both transparency and mechanisms for appropriate use. The
  current implementations of RMP reside on Facebook, OpenSocial, and
  Tabulator extension mainly require significant improvements
  before a fully functional accountable system can be implemented for
  privacy in social networks.}


\comment{Second, there is the project of creating a decentralized
  social network.  All the technologies required to create a product
  similar to centralized social networks are present, but no one has
  yet combined them to create a fully functional decentralized social
  network.  Once a decentralized social network is in place, the RMP
  project has room to grow.  One large area of growth is in ways of
  attaching provenance information to data.  This is vital for
  producing systems that are able to scan through a data's history and
  ensuring that the policies governing that piece of data have been
  followed at each step of its use.}

As social networks move from being centralized hosted applications to
more decentralized applications~\cite{decent}, the role of RMP becomes
more important. In these decentralized networks, accessing, copying,
and reusing data inappropriately becomes even easier. Using RMP will
enable users to specify their privacy requirements and encourage third
party application developers to develop tools such as the RMP
Tabulator sidebar that clearly identifies the restrictions of social
data.

\comment{An advantage of using decentralized social networks and the
  Respect My Privacy ontolo is the ability to attach restrictions on
  individual pieces of data.  This is not possible with third party
  applications on the mainstream social networks as there is not
  enough control over the personal information.  There is currently
  work being done on the Tabulator extension to allow users to attach
  RMP restrictions to individual pieces of data rather that over the
  entire FOAF document.}

Another area of future work is in building accountable systems that
will be able to use the provenance attached to data to pinpoint cases
of misuse.  Systems that are able to model and implement policies have
been created and demonstrated in the case of data mining, but there
has been no clear conclusion on how to detect misuse in the context of
social networks.  One problem in this area is the difficulty in
pinpointing ``use'' in a social network.  In many contexts, such as an
employer doing a background check on a potential employee, merely
looking at unflattering data on the prospective employee's social
network profile might be enough to eliminate him from getting a job.
A possible solution is to allow users to create multiple FOAF files on
the decentralized social network, and have servers hosting the FOAF
files to query visitors for their intent in viewing the profile.
Based on the visitor's intent, the server can display one of the
user's more appropriate profiles.  This strategy is similar to those
taken by niche social networks, like LinkedIn, that are made
specifically for a certain purpose, such as networking.  Nonetheless,
determining what defines a ``use'' in the context of social network
information is a problem that requires future work.


%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%% Conclusion
\section{Summary}

The efforts of social networks in protecting privacy could be greatly
improved with the adoption of information accountability techniques.
One of the main tenets of accountable systems is transparency in
policy that the Respect My Privacy project follows by providing simple
mechanisms for defining privacy restrictions on social data and
encouraging responsible re-use of this data by making it
privacy-aware.

\comment{The efforts of social networks in protecting privacy could be
  greatly improved with the adoption of information accountability
  techniques.  One of the tenets of accountable systems is
  transparency in policy, and the Respect My Privacy project currently
  offers users a clear and simple way to define the restrictions they
  want to place on their data.  In addition, the current RMP
  implementations employ the model used by the Creative Commons to try
  to gain widespread acceptance of the defined restrictions.  This
  will hopefully lead to legal mechanisms to protect users from
  malicious misuse of their personal information and encourage
  adoption of a set of social norms online that depend on people
  responsibly helping each other protect their privacy. }
\comment{Finally the Respect My Privacy project's new direction in
  decentralized social networks offers a foundation upon which to
  build a fully accountable systems for social networks.}


\section*{Acknowledgements}

The authors wish to thank their group members for their contributions
to this project. This work was carried out with funding from  NSF Cybertrust award number CNS-0831442, IARPA award number
FA8750-07-2-0031 and AFOSR award number FA9550-09-1-0152.


\bibliographystyle{aaai}
\bibliography{paper}

\end{document}


