Collaborative Research: DASS: Co-design of law and computer science for privacy in sociotechnical software systems

软件系统在社会中被深度整合。然而，除了这些系统带来的诸多好处外，这些系统使用个人数据也给使用它们的人和组织带来了风险。过去几十年为遏制这些风险而制定的法律和技术数据保护措施以不同的方式演变。这使得人们很难推断此类系统中个人数据的收集、分析和共享是否符合法律隐私标准。当技术措施在开发技术措施的社区之外没有得到很好的理解时，这也会增加监管机构的工作难度。为了弥合这一差距，该项目将开发方法，在此类社会技术软件系统的设计中整合隐私的技术和法律方法。通过汇集这些专业知识，项目组将根据法律和数学上合理的原则制定问责框架，提高我们开发系统的能力，为人们的数据提供合法合规和有意义的保护。该项目将开发新的方法来翻译和共同开发相互关联的技术和法律概念。一种主要方法将是建立对法律概念的技术解释，这些法律概念可纳入负责制度的设计、分析和核查。另一个是制定范例，将隐私技术研究中的概念转化为促进在法律分析和政策制定中理解和采用的方式。第三种是开发可由法律和技术专家同时定义和评估的新的“混合”概念的方法。项目团队将利用这项工作开发一个实用的法律-技术工具包，用于设计健壮、负责的正式软件系统和法规，尽管最初的工作将主要围绕隐私法规进行实例化，但方法工具包的设计将支持法规满足软件的其他领域的类似对齐和翻译。该奖项反映了NSF的法定使命，并通过使用基金会的智力优势和更广泛的影响审查标准进行评估，被认为值得支持。

Software systems are deeply integrated in society. Alongside their many benefits, however, the use of personal data by these systems carries risks to the people and organizations that use them. Legal and technical data protection measures developed over the last few decades to curb these risks have evolved in diverging ways. This makes it hard to reason about whether the collection, analysis, and sharing of personal data in such systems complies with legal privacy standards. It also makes regulators’ jobs harder when technical measures are not well-understood outside of the communities that develop them. To bridge this gap, the project will develop ways to integrate technical and legal approaches to privacy in the design of such sociotechnical software systems. Through bringing together this expertise, the project team will develop accountability frameworks based on legally- and mathematically-sound principles, increasing our ability to develop systems that provide both legal compliance and meaningful protection of people’s data. The project will develop new methods for translating and co-developing technical and legal concepts that map well onto each other. One main approach will be to establish technical interpretations of legal concepts that can be incorporated in the design, analysis, and verification of accountable systems. Another is to develop paradigms for translating concepts from the technical study of privacy in ways that promote their understanding and adoption in legal analysis and policymaking. The third is methods for the development of new “hybrid” concepts that are simultaneously definable and evaluable by legal and technical experts. The project team will use this work to develop a practical legal-technological toolkit for designing robust accountable formal software systems and regulations, and although the initial work will be instantiated primarily around privacy regulations, the toolkit of methods will be designed to support similar alignment and translation in other domains where regulation meets software.This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.