SaTC: CORE: Medium: Collaborative: Contextual Integrity: From Theory to Practice

当前面向用户的计算机系统采用“通知和同意”的方法来管理用户隐私：向用户呈现隐私通知，然后必须同意其条款。几十年的先前研究表明，这种方法是无法管理的：政策含糊其辞、模棱两可，而且经常包含使其非常难以理解的法律术语，如果它们甚至被阅读的话。这些问题在物联网(IoT)设备上被放大，这些设备可能不包括显示隐私信息的显示器，并且可能在环境中变得如此普遍，以至于用户不可能确定他们的数据实际被捕获的时间。该项目旨在通过设计新的隐私管理系统来解决这些问题，该系统可以自动推断用户特定于上下文的隐私预期，然后使用它们来管理用户环境中移动设备和物联网设备的数据捕获和数据共享行为。这项研究的目标是更好地了解隐私期望，设计需要最少用户干预的隐私控制，并演示如何设计新兴技术来使用户能够最好地管理他们的隐私。“隐私作为上下文完整性”(CI)的理论假设隐私期望基于上下文规范，当数据以违反这些规范的方式流动时，就会发生侵犯隐私的行为。该框架可以通过根据数据类型、发送方、接收方以及特定的上下文(即共享数据的目的)对数据流进行建模来应用。虽然这个模型有直观的意义，但有几个公开的研究问题阻碍了它在计算机系统中的应用。具体地说，该项目通过使用调查、访谈和行为研究来调查隐私预期如何在不同的背景下变化，并设计系统自动推断背景信息，以便可以自动确定数据流是否可能违背用户预期的过程。研究人员开发了新型隐私控制的原型，并通过迭代的实验室和现场实验验证了它们的可用性和隐私保护特性。这一奖项反映了NSF的法定使命，并通过使用基金会的智力优势和更广泛的影响审查标准进行评估，被认为值得支持。

Current user-facing computer systems apply a "notice and consent" approach to managing user privacy: the user is presented with a privacy notice and then must consent to its terms. Decades of prior research show that this approach is unmanageable: policies are vague, ambiguous, and often include legal terms that make them very difficult to understand, if they are even read at all. These problems are magnified across Internet of Things (IoT) devices, which may not include displays to present privacy information, and may become so ubiquitous in the environment that users cannot possibly determine when their data is actually being captured. This project aims to solve these problems by designing new privacy management systems that automatically infer users' context-specific privacy expectations and then use them to manage the data-capture and data-sharing behaviors of mobile and IoT devices in users' environments. The goals of this research are to better understand privacy expectations, design privacy controls that require minimal user intervention, and demonstrate how emergent technologies can be designed to empower users to best manage their privacy.The theory of "Privacy as Contextual Integrity" (CI) postulates that privacy expectations are based on contextual norms, and that privacy violations occur when data flows in ways that defy these norms. The framework can be applied by modeling data flows in terms of the data type, sender, recipient, as well as the specific context (i.e., the purpose for which data is being shared). While this model makes intuitive sense, there are several open research questions that have prevented it from being applied in computer systems. Specifically, the project investigates how privacy expectations change across varying contexts through the use of surveys, interviews, and behavioral studies, and designs systems to automatically infer contextual information so that the process of determining whether or not a data flow is likely to defy user expectations can be automated. The investigators develop a prototype of the novel privacy controls and validate their usability and privacy-preserving properties through iterative laboratory and field experiments.This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.