Collaborative Research: DASS: Co-design of law and computer science for privacy in sociotechnical software systems

软件系统与社会深度融合。然而，除了它们的许多好处之外，这些系统对个人数据的使用也给使用它们的人和组织带来了风险。过去几十年来，为遏制这些风险而制定的法律的和技术数据保护措施以不同的方式发展。这使得人们很难判断这些系统中个人数据的收集、分析和共享是否符合法律的隐私标准。当技术措施在开发这些措施的社区之外没有得到很好的理解时，这也使监管机构的工作更加困难。为了弥补这一差距，该项目将制定办法，在设计这种社会技术软件系统时，将技术和法律的隐私办法结合起来。通过汇集这些专业知识，项目小组将根据合法和无害的原则制定问责框架，提高我们开发系统的能力，为人们的数据提供法律的合规和有意义的保护。该项目将开发新的方法来翻译和共同开发相互映射的技术和法律的概念。一个主要的方法将是建立法律的概念的技术解释，可以纳入设计，分析和核查的问责制。另一个目标是制定范式，以促进在法律的分析和决策中理解和采纳隐私技术研究中的概念。第三是制定新的“混合”概念的方法，这些概念可由法律的和技术专家同时界定和评价。项目团队将利用这项工作开发一个实用的法律技术工具包，用于设计强大的可问责的正式软件系统和法规，尽管最初的工作将主要围绕隐私法规进行实例化，该方法的工具包将被设计用于支持在法规与软件相结合的其他领域中的类似的校准和翻译。该奖项反映了NSF的法定使命，并且被认为是值得支持的通过使用基金会的知识价值和更广泛的影响审查标准进行评估。

Software systems are deeply integrated in society. Alongside their many benefits, however, the use of personal data by these systems carries risks to the people and organizations that use them. Legal and technical data protection measures developed over the last few decades to curb these risks have evolved in diverging ways. This makes it hard to reason about whether the collection, analysis, and sharing of personal data in such systems complies with legal privacy standards. It also makes regulators’ jobs harder when technical measures are not well-understood outside of the communities that develop them. To bridge this gap, the project will develop ways to integrate technical and legal approaches to privacy in the design of such sociotechnical software systems. Through bringing together this expertise, the project team will develop accountability frameworks based on legally- and mathematically-sound principles, increasing our ability to develop systems that provide both legal compliance and meaningful protection of people’s data. The project will develop new methods for translating and co-developing technical and legal concepts that map well onto each other. One main approach will be to establish technical interpretations of legal concepts that can be incorporated in the design, analysis, and verification of accountable systems. Another is to develop paradigms for translating concepts from the technical study of privacy in ways that promote their understanding and adoption in legal analysis and policymaking. The third is methods for the development of new “hybrid” concepts that are simultaneously definable and evaluable by legal and technical experts. The project team will use this work to develop a practical legal-technological toolkit for designing robust accountable formal software systems and regulations, and although the initial work will be instantiated primarily around privacy regulations, the toolkit of methods will be designed to support similar alignment and translation in other domains where regulation meets software.This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.