

\documentclass[letterpaper]{article}

\usepackage{times,epsfig,url}
\usepackage{helvet}
\usepackage{courier}

\pdfinfo{
/Title (Access Control is an Inadequate Framework for Privacy Protection)
/Subject ()
/Author (Lalana Kagal and Hal Abelson)}

\setcounter{secnumdepth}{0}  

\long\def\comment#1{\relax}

\begin{document}

\title{Access Control is an Inadequate Framework for Privacy Protection}

\author{Lalana Kagal and Hal Abelson\\
MIT Computer Science and Artificial Intelligence Lab\\
32 Vassar Street Cambridge MA 02139\\
\{lkagal, hal\}@csail.mit.edu}

\date{}
\maketitle

\section{Introduction}

As Web architects, we might all agree on the need to protect privacy.
{\it But what is it that we want to protect?}  In Brandeis and
Warren's classic legal study~\cite{brandeis1890privacy}, privacy is
defined as the ``right to be let alone''.  In Alan Westin's seminal
work~\cite{westin68privacy}, privacy is the ability for people to
determine for themselves ``when, how, and to what extent, information
about them is communicated to others''.  The UN Declaration of Human
Rights~\cite{udhr} stipulates that ``No one shall be subjected to
arbitrary interference with his privacy, family, home or
correspondence, nor to attacks upon his honour and reputation''.

There are important differences among these definitions.  One central
definition is that Westin focuses on {\bf information access}: how
information comes to be known.  In contrast, the UN Declaration, and
Brandeis and Warren, focus on what happens to people as a result of
{\bf how information is used}.

Present discussions of Internet privacy, both policy and technology,
tend to assume Westin's perspective.  The focus on access control
sometimes regards privacy as a kind of "currency of the digital
age"\footnote{As described by Yamini Kagal, June 2010} that people
need to exchange in return for better search results, more
personalization, customized services, more targeted advertising, and
better communication with friends, family, and
colleagues. ``Protecting privacy'' is often equated with letting users
make these tradeoffs by defining detailed rules to govern access to
their personal information.  This year's technology press is filled
with announcements by social networking sites about their new privacy
controls, i.e. new ways for users to define access
rules~\cite{wsj10facebook, facebook10privacy}; followed by
embarrassment when the choices prove to be inadequate or too complex
for people to deal with~\cite{upi10waitress, 3news10pm,
  msnbc09twitter, starwarskid, thelocal09headmaster, beacon, buzz}.

Even when access control systems are successful in blocking out
unwanted viewers, they are ineffective as privacy protection for a
large, decentralized system like the World Wide Web, where it is easy
to {\em copy} or {\em aggregate} information. These days, it is
possible to infer sensitive information from publicly available
information. For example, social security numbers (SSN) have always
been closely guarded because they are used to identify individuals by
most government and financial institutions. Every use of SSN numbers
is usually viewed as risking identity theft.  However, CMU researchers
recently showed how SSN numbers can be reconstructed with a high
degree of accuracy from public sources including commercial databases
and government sources~\cite{cmu09ssn}. {\it If SSN numbers can be
  inferred easily how does restricting access to them help our privacy
  ?} Social networking data can also be used to infer sensitive and
possibly secret information about you. You may increase your privacy
settings on a social networking site to prevent access to most of your
data, however your friends or the groups you belong to may
inadvertently say more about you than you'd like. Experiments have
shown that it is possible to predict sexual
orientation~\cite{mit09gaydar} and political
affiliations~\cite{lindamood09inferring} of users by simply looking at
their social networks.

Another problem with using access control systems is that it is the
responsibility of users to clearly define their privacy
policies. \comment{Restricting access to sensitive data requires users
  to know their privacy rules and be able to specify them using the
  controls provided by the system.}  Unfortunately users are often
unable to comprehend the inherent consequences of their privacy
policy.  {\it Should you allow the friends of your friends to view
  your pictures ? What if your friend adds your boss as his friend,
  will your boss be able to see your party pictures ?} Studies show
that most security failures can be contributed to user
errors~\cite{alma99why} caused by clumsy user interfaces for
security. The same will be true about privacy failures if it is solely
the user's responsibility to define privacy. \comment{If we expect
  users to take charge of their sensitive data and specify who can use
  this data and how, and understand how to do this, privacy controls
  must be easy to use, understand and be ambiguous.} Even if the
privacy controls are simplified~\cite{facebook10privacy}, it is
infeasible to expect users to correctly define their policy or even
understand what their policy should be. Users would also need to set
these preferences for each of their sites/services, which would most
probably use different terminology and controls making it even more
complicated. Forcing users to make decisions about their privacy and
expecting them to correctly specify and manage these policies across
several systems is impractical.

The central claim of this paper is that access control in itself is
inherently inadequate as a framework for addressing privacy on the
Internet.  We need to give more emphasis to Brandeis and Warren, and
UN Declaration frameworks, and focus on how data is used, even more so
than how data is accessed.  There, in fact, may be little choice
here. In a pure access restriction system, those who obtain access to
the data, legitimately or not, can use the data without restriction.

\comment{

Historically privacy has meant "what we want to keep private".  If we
wanted to protect our privacy, we kept our our social security numbers
safe, avoided showing strangers embarrassing childhood pictures, and
refrained from discussing our sexual orientation or health problems at
work. However, as technology keeps evolving, our expectations of
privacy evolve along with it. Privacy has now become the currency for
the digital age\footnote{As described by Yamini Kagal during a
  discussion on privacy on June 1st, 2010} - where you need to give
some up in order to get better search results, more personalization,
customized services, more targeted advertising, and better
communication with friends, family and colleagues.

In last few years there have been several blatant breaches with
respect to misuse of personally identifying and sensitive data on the
Web.  Though social networking sites feature prominently in privacy
discussions and are the cause of several privacy
violations~\cite{starwarskid, beacon, buzz, wsj10facebook}, these
problems are not limited to social networks. All collectors and
aggregators of personal data are cause for concern including the
government~\cite{Sweeney01computationaldisclosure}, advertising
companies that monitor web use, credit card companies, online movie
rental companies~\cite{narayanan06netflix}, search
engines~\cite{ny06aol}, and even retailers~\cite{tjmaxx}. These
violations range from disclosing recent purchases made on a related
site to identifying a individual from an anonymized dataset.

These problems with privacy have led to the development of security
systems that prevent access to certain sensitive or personally
identifying data. Users can now define detailed rules preventing
unwanted users from viewing their personal information. This method of
protection, called access control, seeks to close off and hide
information from those that are not explicitly given access to it. It
is a system in which those that obtain access to the data,
legitimately or not, have full reign over the use of that data while
those without access cannot view anything.

These access restriction systems, while useful in blocking out
unwanted viewers, are ineffective for a large, decentralized system
like the World Wide Web, where it is easy to copy or aggregate
information. These days, it is also possible to infer sensitive
information from publicly available information. For example, SSN
numbers have always been closely guarded because they are used to
identify individuals by most government and financial
institutions. Every use of SSN numbers is usually viewed as risking
identity theft.  However, CMU researchers recently showed how SSN
numbers can be reconstructed with a high degree of accuracy from
public sources including commercial databases and government
sources~\cite{cmu09ssn}. {\it If SSN numbers can be inferred easily
  how does restricting access to them help our privacy ?} Social
networking data can also be used to infer sensitive and possibly
secret information about you. You may increase your privacy settings
on a social networking site to prevent access to most of your data,
however your friends or the groups you belong to may inadvertently say
more about you than you'd like. Experiments have shown that it is
possible to predict sexual orientation~\cite{mit09gaydar} or political
affiliations~\cite{lindamood09inferring} of users by simply looking at
their social networks.

Another problem with access control systems is that there are always
human factors that a technical access restriction system will have
trouble handling. For example, Facebook's access restriction systems
did not prevent users from unwillingly publicizing their purchases
when Facebook introduced Beacon, a controversial advertising
program. Only a mass protest from users caused Facebook to readjust
their privacy controls~\cite{nytimefbeacon}.

}

\comment{Given these problems with trying to use access control systems for
privacy, we propose a more social approach to privacy. Instead of
focusing on what the data is and {\it how to prevent access to it}, we
should concentrate on {\it ensuring that data is used responsibly}.}

We propose alternate strategies to access control, ones that are
similar to how legal and social rules work in our societies. Vast
majority of these rules are not enforced perfectly or automatically,
yet most of us follow the majority of the rules because social systems
built up over thousands of years encourage us to do so and often make
compliance easier than violation.  For example, when trying to find
parking on the street even if there is no traffic police around to
give me a fine or a ticket, I will still obey the parking signs
because of the way social and legal norms have been built into our
societies. They've made it easier to meet the norms than violate them,
risk getting caught and getting punished. The set of legal or social
norms govern what we can or cannot do, and they have been ingrained
into our way of thinking such that most people go through life without
any problems. When problems occur, there are mechanisms that ensure
that violators are reprimanded. Instead of enforcing privacy policies
through restricted access, we suggest focusing on helping users
conform to policies by making them aware of the usage restrictions
associated with the data and helping them understand the implications
of their actions and of violating the policy, and encouraging
transparency and accountability in how user data is collected and
used.

In order to support the responsible use of private data, we believe
information systems should be engineered to have the characteristics
described below

\begin{itemize}

\item{Give users due notice: } Both in the case of collecting their
  data and using it, information systems must give users due
  notice. This will give users the opportunity to respond
  appropriately - to either take action to protect their privacy or
  voluntarily give it up in exchange for better service. Google
  AdSense provides a form of due notice by putting a hyperlink "Ads by
  Google" on all its advertisement. When clicked, the user gets
  general information about why these ads were displayed and is able
  to slightly modify how further targeting is performed. However, a
  better approach would be one that informs the user about exactly
  which information collected from her was used to choose the
  particular ad~\cite{nyt09icon}. The Google
  dashboard~\cite{google09dashboard} is another way that Google gives
  notice. The dashboard lets users know what data is being collected
  about them. Though it is a step in the right direction it does not
  inform users what the data is used for or what the consequences of
  misuse are. 

\comment{
  These approaches are related to our framework in that they attempt
  to make policy explicit but they focus on the use of
  search/clickstream data for targeted advertisements versus the use
  of personal data available in social networks.
}

\item{Don't rely just on upfront authorization, also support
  accountability: } A-priori authorization provides a way to restrict
  access to sensitive data but has several problems as outlined in the
  section above. A supporting approach is to provide post-facto
  accountability, which requires the system to have mechanisms in
  place to identify misuse of data. 
  
\begin{itemize}

\item{Provenance: } It must be possible to track the data as it
  follows through the system and to maintain detailed provenance
  information. This information should be in a machine-understandable
  format so software tools can automatically reason over them to
  identify violations.

\item{Machine-understandable policies: } When systems give users due
  notice they provide policies outlining appropriate use of users'
  data. These policies can either be negotiated between the system and
  the user or be an interpretation of some laws that describe
  appropriate use of data such as HIPAA or the Privacy Act. Providing
  policies in a machine-understandable manner serves two
  purposes. They can be used by tools at the users' end to figure out
  if they meet the users' personal policies for data usage. They can
  also be used by mechanisms trying to identify inappropriate use in
  provenance trails kept by the system.

\item{Policy tools: } Systems should include policy tools that not
  only reason over policies and provenance to identify violations but
  also support day to day operations by answering questions about use
  of data such as {\it Can this data be used for a given purpose ?
    What are the consequences of misusing this data ?}

\end{itemize}

\item{Privacy-enabling interface design: } As we want to encourage
  appropriate use not only by information systems but also by users,
  system interfaces should provide hints or signs describing optimal
  behavior for users with respect to data.

\begin{itemize}

\item{Policy-awareness: } Policy-awareness is a property of
  information systems that provides all participants with accessible
  and understandable views of the policies associated with information
  resources including the consequences of misuse. Creative Commons is
  a good example of providing useful policy-awareness~\cite{cc}. It
  gives content creators the ability to specify different kinds of
  licenses and has created easy to recognize icons that encourage the
  proper re-use of content. Following the Creative Commons model,
  RespectMyPrivacy is a Facebook application that allows users to
  select their usage restrictions and displays it using icons on their
  Facebook profile~\cite{kang10rmp}. \comment{A related application is
    the Creative Commons Facebook application~\cite{ccfbookapp}. It
    allows users to choose from the six Creative Commons licenses and
    apply them over their entire profiles. } Another MIT project
  extracts Creative Commons licenses associated with media and
  automatically provides appropriate attribution when content is
  re-used~\cite{oshani09pacr}.

\item{Privacy implications: } Users also need help to understand the
  consequences of their actions on the Web, some of which will have
  privacy implications. Some examples of these mechanisms include
  'privacy nudges' and Google's Mail Goggles~\cite{google08mail}.  CMU
  researchers propose the notion of privacy
  nudges~\cite{cranor10nudges} where software agents monitor the
  users' keystrokes and inform them if they enter any personally
  identifying information on a Web form. Google's Mail Goggles
  attempts to prevent users from sending email they might later regret
  by asking them to solve a simple math problem before they can send
  an email.  Other possible mechanisms include showing thumbnails of
  everyone your email is being sent to including members of a mailing
  list\footnote{As suggested by Tim Berners-Lee} and displaying a
  social network with images of everyone who would see the message or
  photo you're about to post. These mechanisms, though simplistic,
  help users understand where their information is going. By analogy
  with provenance, which deals with tracking where data comes from or
  the source of the data, this ability to understand where the data is
  going can be thought of as ``abvenance''\footnote{abvenance - Latin
    "ab" prefix: "off", "away from"}.

\comment{these mechanisms that be thought of learning the source of
  the data can force users to reconsider their emails/posts and think
  about the consequences of sending/posting them. We need to answer
  the question about where this information is going - as related to
  provenance this can be thought of as vadenance.}

\end{itemize}

\end{itemize}

\comment{
\section{Privacy Do's}

\subsection{Do provide policy-awareness}

\subsection{Do think about data usage}

\subsection{Do make machine understandable and processable policies available}

\subsection{Do consider interoperability}

\subsection{Do enable users to understand the implications of their privacy settings}
\subsection{Do think about sticky policies and accountability}

\subsection{Do provide default opt-out}
}

%\begin{figure}[!h]
%  \centerline{\epsfig{file=images/usecase.jpg, height=2.4in}}
%  \caption{UseCase: Kurt of BigPharma wants to integrate data from the
%    secure SPARQL endpoints of BigCity Clinic and the University of
%    Pandora}
%  \label{fig-usecase}
%\end{figure}


\section{Discussion}

Many of us take the right to privacy for granted, but it is not
currently a part of the US Constitution. In some developed countries
there are in fact federal laws protecting users against inappropriate
data collection and use. However, in the U.S. we have a set of laws
covering different aspects of information privacy such as the ``do not
call list'' for telemarketing and HIPAA for medical record
privacy. Unfortunately as technology constantly changes, these laws do
not adequately protect users.

However, privacy cannot be solved by regulation alone. Education and
technological solutions will also play an important role. Users should
be educated on good privacy practices, be given mechanisms to
understand the privacy implications of their actions and be encouraged
to meet others privacy/usage restrictions. Technology will help
privacy but will not solve the problem entirely. Using technology to
decide fair use has shown similar limitations leading us to believe
that trying to develop a purely technical solution to privacy is also
prone to failure.

As most online businesses today leverage user data to provide more
customization, privacy can be seen as a tradeoff between value-added
services and loss of personal data. As preventing access to personal
data is no longer an option and as sensitive data can be easily
inferred from public sources, we believe the future of privacy
protection lies in ensuring the responsible use of data.

\comment{An ideal Privacy dashboard for the world - telling us what
  everyone knows about us, what they can do with it, what the
  implications of violating those uses it and what action can we take
  against them.

Privacy cannot be solved by regulation or technology alone. Education
and technological solutions will also play an important role.

Along with educating users about privacy, it is important to develop
technological solutions that help protect users privacy. However, just

Fair use analogy

A lot of work needs to be done - on the technical front, on
educational front and even in developing social norms and regulations
about privacy.

Education, social norms and regulations, and technology }



\bibliographystyle{abbrv}
\bibliography{paper}  

\end{document}
