SHF:Small:Privacy Impact and Risk Assessment at Design-Time

要验证网络和移动应用程序将保护用户隐私，需要了解哪些类型的数据和数据做法对用户敏感。隐私影响评估是标准化的程序，公司和政府机构使用该程序来确定收集、使用哪些个人信息、用于什么目的、与谁共享以及采取了哪些步骤来保护这些信息。对应用程序进行隐私影响评估非常耗时，因为评估者通常对软件的行为了解有限，而且评估通常是在软件构建之后进行的，这一成本很高。由于开发人员承受着持续发布新应用程序版本的压力，他们几乎没有时间对其数据实践进行广泛的文档记录。如今，记录隐私的现状是隐私政策，监管机构越来越多地检查应用程序生命周期内的数据实践虚假陈述。该项目寻求开发方法和工具，以自动和快速地从称为用户故事的软件构件中进行隐私影响评估，这对开发人员来说更容易生成。根据哪些数据实践对用户最敏感的风险评估，开发人员可以确定在哪里引入用户想要的隐私控制的最好优先顺序。此外，通过从用户故事中进行风险评估，监管机构和开发人员将更有把握地确保评估准确反映当前的应用程序行为。最后，这些评估节省了开发人员的时间，因为用户描述的更改可能会触发自动重新评估，提醒开发人员隐私风险的更改。这项研究具有变革性，因为它允许软件开发人员在设计期间对隐私风险的变化做出反应，此时可以引入重要的保障措施，而不是等待更长的影响评估，这些影响评估在软件构建后更难整合。该项目调查敏捷需求、隐私风险和隐私政策之间的符号和统计关系。这项研究探索了对用户故事进行隐私风险评分的策略，并对哪些故事对用户隐私理解最重要进行了优先排序。该解决方案的组成部分将被调查如下：(1)将使用编码理论获取并标注以自然语言表达的用户故事和隐私策略的语料库；(2)将使用实体和关系提取从语料库中提取语义框架和以描述逻辑表达的本体；以及(3)将使用隐私风险调查来收集风险分数，该隐私风险调查将测量用户在从用户故事和缓解中获得的不同场景下对隐私风险的感知情况。对风险进行有效评分的一个关键障碍是自然语言中固有的歧义和含糊。使用语义框架和本体对场景中的歧义和模糊进行编码和消解。此外，调查结果将被用来模拟由于选定的缓解措施而导致的风险变化，因此，开发人员将能够围绕特定的用户故事和可用的缓解选择来探索本地设计空间。该奖项反映了NSF的法定使命，并通过使用基金会的智力优势和更广泛的影响审查标准进行评估，被认为值得支持。

Verifying that web and mobile applications will protect user privacy requires knowledge about what kinds of data and data practices are sensitive to users. Privacy impact assessments are standardized procedures that companies and government agencies use to identify what personal information is collected, used, and for what purpose, and shared with whom, as well as, what steps are taken to protect that information. Conducting privacy impact assessments on applications is time consuming, because evaluators often have limited knowledge of the software’s behavior, and the assessments are often done after the software has been constructed, which is costly. Because developers are under pressure to continuously release new application versions, they have little time for extensive documentation about their data practices. Today, the status quo in documenting privacy is the privacy policy, which regulators increasingly check for data practice misrepresentations during the application’s lifetime. This project seeks to develop methods and tools to automatically and quickly conduct privacy impact assessments from software artifacts, called user stories, that are easier for developers to produce. Based on a risk assessment informed by which data practices are most sensitive to users, developers can prioritize where best to introduce privacy controls that users want. Furthermore, by conducting risk assessments from user stories, regulators and developers would have greater assurance that assessments accurately reflect current app behavior. Finally, these assessments save developer time, because a change to a user story could trigger an automatic re-assessment that alerts the developer to changes in privacy risk. This research is transformative because it allows software developers to respond to changes in privacy risk during design time, when important safeguards can be introduced, as opposed to waiting for lengthier impact assessments that are harder to integrate after the software has been constructed.The project investigates the symbolic and statistical relationships between agile requirements, privacy risk and privacy policies. The research explores strategies for scoring user stories for privacy risk and prioritizing which stories are most important to user privacy comprehension. The components of the solution will be investigated as follows: (1) corpora of user stories and privacy policies expressed in natural language will be acquired and annotated using coding theory; (2) semantic frames and an ontology expressed in Description Logic will be extracted from the corpora using entity and relation extraction; and (3) the risk scores will be collected using privacy risk surveys that measure how users perceive privacy risk under different scenarios derived from user stories and mitigations. A key obstacle to effectively scoring risk is the inherent presence of ambiguity and vagueness in natural language. The semantic frames and ontology will be used to encode and resolve ambiguity and vagueness in the scenarios. Furthermore, the survey results will be used to model changes in risk due to selected mitigations, thus, developers will be able to explore the local design space around a specific user story and available mitigation choices.This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.