Collaborative Research: DASS: Developer Implementation of Privacy in Software Systems

近年来，全球范围内的隐私法规激增。这些法规的主要目的是通过为组织提供遵循的指导方针来保护用户数据和用户权利。我们的假设是，这样的指导方针将为开发人员编写具有隐私意识的代码提供一个清晰而简洁的框架。然而，即使在引入这些监管框架之后，软件通常也无法保护用户隐私。这种情况经常发生，因为开发人员有责任确保在代码中正确实现法律框架，但是编写具有隐私意识的代码需要开发人员对监管要求进行彻底和细致的理解。为了进一步理解和开发解决方案，本项目探讨了新的隐私法规与负责遵守这些法规的软件开发人员之间的相互作用。项目团队将研究开发人员对隐私法规的反应，分析开发人员在面对新的隐私法规时的讨论，他们为响应不断变化的监管框架或解释现有法规的新判例法而进行的代码更改，以及开发人员对广泛公布的隐私泄露的反应。在确定了这些相互作用之后，这个项目的目标是提出软件开发工具和方法，以支持监管约束和开发实践的有效结合。该项目汇集了安全、隐私和可用性方面的计算机科学家专家，以及在隐私法、算法公平、网络共识机制和计算语言学方面具有专业知识的法律和组织行为学者。该团队将通过检查开发人员之间、公共代码库、bug跟踪系统和在线论坛的讨论，研究新的隐私法如何影响软件系统。这些讨论和公共存储库中的相关代码更新将与法律和法规本身中使用的隐私语言、围绕法律的公众评论以及更广泛的关于隐私的公众对话进行比较，以便了解引起特定混淆、关注和错误的隐私法规。这些比较将导致对新的隐私法规对软件开发的影响进行严格的分析，并就监管和软件开发方面的改进提出建议。该奖项反映了美国国家科学基金会的法定使命，并通过使用基金会的知识价值和更广泛的影响审查标准进行评估，被认为值得支持。

Recent years have seen a surge in privacy regulations across the globe. The main objective of these regulations is to protect user data and users’ rights by providing guidelines for organizations to follow. The assumption is that such guidelines will provide developers with a clear and concise framework for writing privacy-conscious code. However, even after the introduction of these regulatory frameworks, software regularly fails to protect user privacy. This often happens because the developer is responsible for ensuring that the legal framework is implemented correctly in the code, but writing privacy-conscious code requires developers to develop a thorough and nuanced understanding of the regulatory demands. To further such an understanding and develop solutions, this project explores the interaction between new privacy regulations and the software developers tasked with complying with them. The project team will look at how developers react to privacy regulations, analyzing discussions among developers in the face of new privacy regulations, code changes they make in response to shifting regulatory frameworks or new case laws interpreting existing regulations, and developer reactions to widely publicized privacy breaches. After identifying these interactions, this project aims to propose software development tools and methodologies to support the effective alignment of regulatory constraints and development practice.The project brings together computer scientists experts in security, privacy, and usability, and legal and organizational behavior scholars with expertise in privacy law, algorithmic fairness, network consensus mechanisms, and computational linguistics. The team will study how new privacy laws are impacting software systems by examining the discussions developers are having among themselves, in public code repositories, bug tracking systems, and online fora. These discussions and related code updates in public repositories will be compared with the language of privacy used in the laws and regulations themselves, the public comments around the laws, and the broader public conversation on privacy, in order to understand privacy regulations that raise particular confusion, concerns, and errors. These comparisons will lead to a rigorous analysis of the impacts of new privacy regulations on software development and offer recommendations for improvements in terms of both regulation and software development.This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.