SaTC: CORE: Small: Managing Privacy and Environment for Used and End-of-Life Electronic Devices

2019冠状病毒病大流行加速了向远程工作和移动工作的过渡。这意味着个人设备和家庭网络已经从偶尔使用转变为普遍的专业使用，现在可以归类为关键基础设施。因此，管理这些网络的安全是国家的首要任务。物联网的发展使消费者拥有越来越多的设备，这些设备可以访问个人视频、音频和其他信息。如果废弃设备仍然包含敏感数据并最终落入坏人之手，那么报废设备将带来巨大的安全风险。数据安全对于可持续性也很重要：关心隐私的消费者可能会存储或回收设备，而不是将其出售以供重复使用。许多被回收的设备没有被重用，因为设备和数据不能轻易地为新用户清除。减少再利用会对经济、社会和环境产生影响。因此，数据安全和最终使用从根本上是交织在一起的，但目前对它们的理解和管理都很差。该项目包括综合研究和推广活动，以更好地了解和管理家庭设备上的数据隐私。对于一组物联网和其他家用消费电子产品，调查消费者的隐私和最终使用行为。存储在不同设备上的个人身份信息被评估和分析隐私风险。对数据清除协议的可用性进行评估，以阐明从不同设备中删除个人数据是多么容易和有效。这些活动的结果导致构建一个模型，预测不同消费者群体的安全性和最终使用行为。该模型用于建议有效的干预措施，以改善隐私和可持续性结果，例如提高擦除协议的可用性或教育消费者。开展外展活动以支持决策，例如将研究成果带给参与标准制定的行业利益相关者和消费者团体。我们编制了一份有关保安和最终用途的消费者指南，并通过iFixit网站广泛分发。K-12夏令营是为来自弱势群体的高中生举办的。本科生和研究生将参与隐私评估和可用性评估。一年一度的“想象RIT”活动吸引了成千上万的罗切斯特居民来到校园，为该活动举办了一个关于安全和终端使用的展览。该奖项反映了美国国家科学基金会的法定使命，并通过使用基金会的知识价值和更广泛的影响审查标准进行评估，被认为值得支持。

The COVID-19 pandemic accelerated the transition towards increased telework and mobile working. This implies that personal devices and home networks have moved from occasional to pervasive professional use, and can now be classified as critical infrastructure. Managing the security of these networks is thus a national priority. Progress towards the Internet-of-Things leads to consumers owning an expanding array of devices privy to personal video, audio and other information. End-of-life poses a large security risk if disposed-of devices still contain sensitive data and end up in the wrong hands. Data security is also important for sustainability: A consumer concerned about privacy may store a device or recycle it, instead of selling for reuse. Many devices turned in for recycling are not reused because the device and data cannot readily be cleared for a new user. Decreased reuse has economic, social and environmental impacts. Data security and end-of-use are thus fundamentally intertwined, but currently poorly understood and managed. This project involves integrated research and outreach activities to better understand and manage the privacy of data on home devices. For a set of Internet-of-Things and other home consumer electronics, consumers are surveyed on privacy and end-of-use behaviors. Personally Identifiable Information stored on different devices is assessed and analyzed for privacy risk. The usability of data wiping protocols is evaluated to clarify how easy and effective it is to remove personal data from different devices. The results from these activities leads to construction of a model predicting security and end-of-use behaviors for different consumer groups. This model is used to suggest effective interventions to improve privacy and sustainability outcomes, e.g. improving the usability of wiping protocols or educating consumers. Outreach is done to support decision-making, for example research results are brough to stakeholders in industry and consumer groups engaged in standard development. A consumer guide to security and end-of-use is developed and distributed widely, e.g. through the iFixit website. K-12 summer camps are held for high school students from under-represented groups. Undergraduate and graduate students will be engaged in the privacy assessment and usability evaluations. An exhibit on security and end-of-use is developed for Imagine RIT, an annual event that brings tens of thousands of Rochester residents to campus.This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.