Collaborative Research: DASS: Co-design of law and computer science for privacy in sociotechnical software systems

软件系统与社会紧密结合。然而，除了诸多好处之外，这些系统对个人数据的使用也给使用这些数据的个人和组织带来了风险。过去几十年来为遏制这些风险而制定的法律和技术数据保护措施以不同的方式发展。这使得很难推断在此类系统中收集、分析和共享个人数据是否符合法律隐私标准。当技术措施在制定这些措施的社区之外没有得到很好的理解时，这也使监管机构的工作变得更加困难。为了弥补这一差距，该项目将开发方法，在设计此类社会技术软件系统时整合技术和法律方法来保护隐私。通过汇集这些专业知识，项目团队将根据法律和数学上合理的原则制定问责框架，提高我们开发既符合法律规定又能有效保护个人数据的系统的能力。该项目将开发翻译和共同开发技术和法律概念的新方法，这些概念可以很好地相互关联。一个主要办法将是对法律概念作出技术解释，这些解释可以纳入问责制的设计、分析和核查。另一个是发展范式，从隐私的技术研究中翻译概念，以促进他们在法律分析和政策制定中的理解和采用。第三是开发新的“混合”概念的方法，这些概念可以同时由法律和技术专家定义和评估。项目团队将利用这项工作开发一个实用的法律技术工具包，用于设计可靠的可问责的正式软件系统和法规，尽管最初的工作将主要围绕隐私法规进行实例化，但该方法工具包将被设计为支持在法规与软件相结合的其他领域进行类似的校准和翻译。该奖项反映了美国国家科学基金会的法定使命，并通过使用基金会的知识价值和更广泛的影响审查标准进行评估，被认为值得支持。

Software systems are deeply integrated in society. Alongside their many benefits, however, the use of personal data by these systems carries risks to the people and organizations that use them. Legal and technical data protection measures developed over the last few decades to curb these risks have evolved in diverging ways. This makes it hard to reason about whether the collection, analysis, and sharing of personal data in such systems complies with legal privacy standards. It also makes regulators’ jobs harder when technical measures are not well-understood outside of the communities that develop them. To bridge this gap, the project will develop ways to integrate technical and legal approaches to privacy in the design of such sociotechnical software systems. Through bringing together this expertise, the project team will develop accountability frameworks based on legally- and mathematically-sound principles, increasing our ability to develop systems that provide both legal compliance and meaningful protection of people’s data. The project will develop new methods for translating and co-developing technical and legal concepts that map well onto each other. One main approach will be to establish technical interpretations of legal concepts that can be incorporated in the design, analysis, and verification of accountable systems. Another is to develop paradigms for translating concepts from the technical study of privacy in ways that promote their understanding and adoption in legal analysis and policymaking. The third is methods for the development of new “hybrid” concepts that are simultaneously definable and evaluable by legal and technical experts. The project team will use this work to develop a practical legal-technological toolkit for designing robust accountable formal software systems and regulations, and although the initial work will be instantiated primarily around privacy regulations, the toolkit of methods will be designed to support similar alignment and translation in other domains where regulation meets software.This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.