Collaborative Research: DASS: Developer Implementation of Privacy in Software Systems

近年来，地球仪的隐私法规激增。这些法规的主要目的是通过提供组织应遵循的准则来保护用户数据和用户权利。我们的假设是，这些准则将为开发人员提供一个清晰简洁的框架，用于编写具有隐私意识的代码。然而，即使在引入这些监管框架之后，软件也经常无法保护用户隐私。这种情况经常发生，因为开发人员负责确保法律的框架在代码中正确实现，但编写具有隐私意识的代码需要开发人员对法规要求有全面而细致的理解。为了进一步理解并开发解决方案，该项目探讨了新的隐私法规与负责遵守这些法规的软件开发人员之间的互动。项目团队将研究开发人员如何应对隐私法规，分析开发人员在面对新隐私法规时的讨论，他们为应对不断变化的监管框架或解释现有法规的新判例法而做出的代码更改，以及开发人员对广泛宣传的隐私违规行为的反应。在确定这些相互作用后，本项目旨在提出软件开发工具和方法，以支持监管约束和开发实践的有效结合。该项目汇集了安全、隐私和可用性方面的计算机科学家专家，以及在隐私法、算法公平性、网络共识机制和计算语言学方面具有专长的法律的和组织行为学者。该团队将通过检查开发人员之间在公共代码存储库、错误跟踪系统和在线论坛中进行的讨论，研究新隐私法如何影响软件系统。这些讨论和公共存储库中的相关代码更新将与法律和法规本身使用的隐私语言，围绕法律的公众评论以及更广泛的隐私公开对话进行比较，以了解引起特定混淆，关注和错误的隐私法规。这些比较将导致对新的隐私法规对软件开发的影响进行严格的分析，并为法规和软件开发方面的改进提供建议。该奖项反映了NSF的法定使命，并通过使用基金会的知识价值和更广泛的影响审查标准进行评估，被认为值得支持。

Recent years have seen a surge in privacy regulations across the globe. The main objective of these regulations is to protect user data and users’ rights by providing guidelines for organizations to follow. The assumption is that such guidelines will provide developers with a clear and concise framework for writing privacy-conscious code. However, even after the introduction of these regulatory frameworks, software regularly fails to protect user privacy. This often happens because the developer is responsible for ensuring that the legal framework is implemented correctly in the code, but writing privacy-conscious code requires developers to develop a thorough and nuanced understanding of the regulatory demands. To further such an understanding and develop solutions, this project explores the interaction between new privacy regulations and the software developers tasked with complying with them. The project team will look at how developers react to privacy regulations, analyzing discussions among developers in the face of new privacy regulations, code changes they make in response to shifting regulatory frameworks or new case laws interpreting existing regulations, and developer reactions to widely publicized privacy breaches. After identifying these interactions, this project aims to propose software development tools and methodologies to support the effective alignment of regulatory constraints and development practice. The project brings together computer scientists experts in security, privacy, and usability, and legal and organizational behavior scholars with expertise in privacy law, algorithmic fairness, network consensus mechanisms, and computational linguistics. The team will study how new privacy laws are impacting software systems by examining the discussions developers are having among themselves, in public code repositories, bug tracking systems, and online fora. These discussions and related code updates in public repositories will be compared with the language of privacy used in the laws and regulations themselves, the public comments around the laws, and the broader public conversation on privacy, in order to understand privacy regulations that raise particular confusion, concerns, and errors. These comparisons will lead to a rigorous analysis of the impacts of new privacy regulations on software development and offer recommendations for improvements in terms of both regulation and software development.This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.