CSC 495 - Privacy
Course Description
This course introduces data privacy in a broad sense, with the aim of providing students interested in pursuing privacy research an overview of challenging research areas and problems regarding privacy. This course will expose students to many of the issues that privacy engineers, program managers, researchers and designers deal with in industry.
There is no textbook for this course. We will use research papers as the main source of information. In each lecture, we will look at an interesting problem, its application areas, and possible solutions. Moreover, we will have case studies to investigate privacy incidents in more detail. Specifically, we will study the following privacy areas:
-
Web/Online Social Networks Privacy: We will look at growing privacy concerns in online social networks, sharing behaviors of users, common violations and regret scenarios, methods for targeted advertising and how to mitigate those, and k-anonymity for privacy of datasets.
-
AI for Privacy: We will look at privacy aware autonomous systems, investigate the design and maintenance of such systems using AI techniques such as negotiation and argumentation. We will investigate frameworks for elicitation, modeling, and verification of privacy requirements. We will look at privacy norms and investigate privacy breaches as norm violations.
-
Usable Privacy: We will look at various designs for usable privacy interfaces, privacy nudges for warning users of potential privacy risks, and semantic analysis of privacy policies.
-
Privacy Perceptions: We will look at studies and surveys regarding human mental models about privacy concerns, differences among cultures, and longitudinal studies about changes in privacy perceptions.
-
Misc Topics: We will look at additional topics such as crowdsourcing privacy policies, mobile application privacy, and privacy measurement.
Learning Outcomes: Students who complete this course will be able to
-
Understand personal identifiable information in databases and techniques to anonymize and protect such information
-
Describe attacks against anonymized datasets
-
Understand privacy risks when sharing personal data online and design mechanisms for mitigating such risks
-
Describe privacy requirements and AI techniques for designing privacy-aware autonomous systems
-
Design usable privacy interfaces and tools that balance privacy preserving and user functionality
-
Identify and describe important elements of privacy policies and regulations
-
Understand human attitudes to and perceptions of privacy
Fall 2017
Hours: MW 11:45AM-1:00PM
Location: EB2 1226
Grading
Assignments for this course include homeworks, case studies analyzed and presented in class, and a group project. There are no midterms or final exam.
30% - Individual homework assignments (4 best grades out of 5 assignments)
20% - One group case study (data collection, analysis, and in class presentation)
50% - One group project (project report and in class presentation)
Lectures
Course Introduction
Lecture 1: Introduction to Privacy (8/16/17)
Slides
References:
- Kieron O’Hara. The Seven Veils of Privacy. IEEE Internet Computing, 20(2):86-91, 2016
- Seda Gürses and Jose M. del Alamo. Privacy Engineering: Shaping an Emerging Field of Research and Practice. IEEE Security & Privacy, 14(2):40-46, 2016
Web/Online Social Networks Privacy
Lecture 2: Inference (8/21/17)
Slides
Incident - News Article
Incident - Report
References:
- Alan Mislove, Bimal Viswanath, Krishna P. Gummadi, and Peter Druschel. You Are Who You Know: Inferring User Profiles in Online Social Networks. Conference on Web Search and Data Mining, pages 251–260, 2010
Projects (8/23/17)
Project descriptions
Slides
Lecture 3: Sharing and Disclosure (8/28/17)
Slides
Incident - News Article
Incident - Report
References:
- Maritza Johnson, Serge Egelman, and Steven M. Bellovin. Facebook and Privacy: It’s Complicated. Symposium on Usable Privacy and Security (SOUPS), pages 9:1-9:15, 2012
- Fred Stutzman, Ralph Gross, and Alessandro Acquisti. Silent Listeners: The Evolution of Privacy and Disclosure on Facebook. Journal of Privacy and Confidentiality, 4(2):7-41, 2012
Homework 1 (8/30/17)
Homework description
Slides
Lecture 4: Violations and Regret (8/30/17, 9/6/17)
Slides
Incident - News Article
Incident - Report
References:
- Özgür Kafalı, Akın Günay, and Pınar Yolum. Detecting and Predicting Privacy Violations in Online Social Networks. Distributed and Parallel Databases, 32(1):161-190, 2014
- Yang Wang, Gregory Norcie, Saranga Komanduri, Alessandro Acquisti, Pedro Giovanni Leon, and Lorrie Faith Cranor. I regretted the minute I pressed share: A Qualitative Study of Regrets on Facebook. Symposium on Usable Privacy and Security (SOUPS), pages 10:1-10:16, 2011
Lecture 5: Targeted Advertising (9/11/17)
Slides
Incident - News Article (Facebook)
Incident - News Article (Verizon)
Incident - News Article (Google)
References:
- Vincent Toubiana, Arvind Narayanan, Dan Boneh, Helen Nissenbaum, and Solon Barocas. Adnostic: Privacy Preserving Targeted Advertising. Network and Distributed System Security Symposium, 2010
- Pedro Leon, Blase Ur, Richard Shay, Yang Wang, Rebecca Balebako, and Lorrie Cranor. Why Johnny Can’t Opt Out: A Usability Evaluation of Tools to Limit Online Behavioral Advertising. Conference on Human Factors in Computing Systems, pages 589-598, 2012
Homework 2 (9/12/17)
Homework description
Latex template for Overleaf
Lecture 6: K-anonymity (9/13/17, 9/18/17)
Slides
Incident - News Article (Hulu)
Incident - News Article (Quora)
References:
- Latanya Sweeney. K-anonymity: A model for Protecting Privacy. International Journal of Uncertainty, Fuzziness and Knowledge-Based Systems, 10(5):557-570, 2002
- Ashwin Machanavajjhala, Daniel Kifer, Johannes Gehrke, and Muthuramakrishnan Venkitasubramaniam. L-diversity: Privacy beyond k-anonymity. ACM Transactions on Knowledge Discovery from Data, 1(1):1556-4681, 2007
- Ninghui Li, Tiancheng Li, and Suresh Venkatasubramanian. T-closeness: Privacy beyond k-anonymity and l-diversity. International Conference on Data Engineering, pages 106-115, 2007
- Arvind Narayanan and Vitaly Shmatikov. Robust De-anonymization of Large Sparse Datasets. IEEE Symposium on Security and Privacy, pages 111-125, 2008
Artificial Intelligence for Privacy
Lecture 7: Privacy Requirements (9/20/17, 9/25/17)
Slides
References:
- Mohamad Gharib, Mattia Salnitri, Elda Paja, Paolo Giorgini, Haralambos Mouratidis, Michalis Pavlidis, Jose F. Ruiz, Sandra Fernandez, and Andrea Della Siria. Privacy Requirements: Findings and Lessons Learned in Developing a Privacy Platform. Requirements Engineering Conference, pages 256-265, 2016
- Lin Liu, Eric Yu, and John Mylopoulos. Security and privacy requirements analysis within a social setting. Requirements Engineering Conference, pages 151-161, 2003
- Travis Breaux, Hanan Hibshi, and Ashwini Rao. Eddy, a Formal Language for Specifying and Analyzing Data Flow Specifications for Conflicting Privacy Requirements. Requirements Engineering, 19(3):281-307, 2014
Lecture 8: Agents and Reasoning (9/27/17)
Slides
References:
- Monica Tentori, Jesus Favela, and Marcela D. Rodriguez. Privacy-Aware Autonomous Agents for Pervasive Healthcare. IEEE Intelligent Systems, 21(6):55-62, 2006
- Ricard L. Fogues, Pradeep K. Murukannaiah, Jose M. Such, and Munindar P. Singh. Sharing Policies in Multiuser Privacy Scenarios: Incorporating Context, Preferences, and Arguments in Decision Making. ACM Transactions on Computer-Human Interaction, 24(1):5:1-5:29, 2017
- Yang Gao, Francesca Toni, Hao Wang, and Fanjiang Xu. Argumentation-Based Multi-Agent Decision Making with Privacy Preserved. Autonomous Agents and MultiAgent Systems Conference (AAMAS), pages 1153-1161, 2016
- Nadin Kökciyan, Nefise Yağlıkçı, and Pınar Yolum. PriGuard: An Argumentation Approach for Resolving Privacy Disputes in Online Social Networks. ACM Transactions on Internet Technology, 17(3): 27:1-27:22, 2017
- Tim Baarslag, Alper T. Alan, Richard Gomer, Muddasser Alam, Charith Perera, Enrico H. Gerding, and M.C. Schraefel. An Automated Negotiation Agent for Permission Management. Autonomous Agents and MultiAgent Systems Conference (AAMAS), pages 380-390, 2017
Lecture 9: Privacy Norms (9/27/17, 10/2/17)
Slides
Incident - News Article
References:
- Adam Barth, Anupam Datta, John C. Mitchell, and Helen Nissenbaum. Privacy and Contextual Integrity: Framework and Applications. IEEE Symposium on Security and Privacy, pages 184-198, 2006
- Özgür Kafalı, Nirav Ajmeri, and Munindar P. Singh. Revani: Revising and Verifying Normative Specifications for Privacy. IEEE Intelligent Systems, 31(5):8-15, 2016
Homework 3 (9/27/17)
Homework description
Lecture 10: Privacy Breaches (10/4/17)
Slides
Incident - News Article (NHS)
Incident - News Article (WHSmith)
References:
- Özgür Kafalı, Jasmine Jones, Megan Petruso, Laurie Williams, and Munindar P. Singh. How Good is a Security Policy against Real Breaches? A HIPAA Case Study. International Conference on Software Engineering (ICSE), pages 530–540, 2017
Usable Privacy
Lecture 11: Decision Making and Warnings (10/9/17, 10/11/17)
Slides
Incident - News Article
References:
- Alessandro Acquisti and Jens Grossklags. Privacy and rationality in individual decision making. IEEE Security & Privacy, 3(1):26-33, 2005
- Cristian Bravo-Lillo, Saranga Komanduri, Lorrie Faith Cranor, Robert W. Reeder, Manya Sleeper, Julie Downs, Stuart Schechter. Your attention please: Designing security-decision UIs to make genuine risks harder to ignore. Symposium on Usable Privacy and Security, 2013
- Yang Wang, Pedro Giovanni Leon, Alessandro Acquisti, Lorrie Faith Cranor, Alain Forget, Norman Sadeh. A Field Trial of Privacy Nudges for Facebook. Conference on Human Factors in Computing Systems, pages 2367-2376, 2014
Homework 4 (10/11/17)
Homework description
Lecture 12: Privacy Policies and Notices (10/16/17, 10/30/17)
Slides
References:
- Patrick Gage Kelley, Lucian Cesca, Joanna Bresee, and Lorrie Faith Cranor. Standardizing Privacy Notices: An Online Study of the Nutrition Label Approach. Conference on Human Factors in Computing Systems, pages 1573-1582, 2010
- Florian Schaub, Rebecca Balebako, Adam L. Durity, and Lorrie Faith Cranor. A Design Space for Effective Privacy Notices. Symposium On Usable Privacy and Security (SOUPS), 2015
- Lorrie Faith Cranor, Pedro Giovanni Leon, and Blase Ur. A Large-Scale Evaluation of U.S. Financial Institutions’ Standardized Privacy Notices. ACM Transactions on the Web, 10(3):17:1-17:33, 2016
- Joel R. Reidenberg, Travis Breaux, Lorrie Faith Cranor, Brian French, Amanda Grannis, James T. Graves, Fei Liu, Aleecia McDonald, Thomas B. Norton, Rohan Ramanath, N. Cameron Russell, Norman Sadeh, and Florian Schaub. Disagreeable Privacy Policies: Mismatches between Meaning and Users’ Understanding. Research Conference on Communication, Information and Internet Policy, 2014
Case Study (10/16/17)
Case study description
Slides
Survey questions
Breach descriptions
Guest Lecture (10/25/17)
Karthik Sheshadri
Title: No (Privacy) News is Good News: An Analysis of New York Times and Guardian Privacy News from 2010–2016
Abstract: Privacy news influences end-user attitudes and behaviors as well as product and policy development, and so is an important data source for understanding privacy perceptions. We provide a largescale text mining of privacy news, focusing on patterns in sentiment and keywords. This is a challenging task given the lack of a privacy news repository and a ground truth for sentiment. Using high-precision data sets from two popular news sources in the US and UK, the New York Times and the Guardian, we find negative privacy news is far more common than positive. In addition, in the NYT, privacy news is more prominently reported than many world events involving significant human suffering. Our analysis provides a rich snapshot of this driver of privacy perceptions and demonstrates that news facilitates the systematization of privacy knowledge.
Project Collaboration Requirements and Potential Case Study Research Questions (10/30/17)
Slides
Privacy Perceptions
Lecture 13: Westin Categories (11/1/17)
Slides
Incident - News Article
References:
- Ponnurangam Kumaraguru and Lorrie Faith Cranor. Privacy indexes: A survey of Westin’s studies. 2005
- Allison Woodruff, Vasyl Pihur, Sunny Consolvo, Lauren Schmidt, Laura Brandimarte, and Alessandro Acquisti. Would a Privacy Fundamentalist Sell Their DNA for $1000… If Nothing Bad Happened as a Result? The Westin Categories, Behavioral Intentions, and Consequences. Symposium on Usable Privacy and Security (SOUPS), pages 1-18, 2014
Homework 5 (11/1/17)
Homework description
Lecture 14: Privacy Attitudes (11/6/17, 11/13/17)
Slides
Incident - News Article
References:
- Alice E. Marwick and Danah Boyd. Networked privacy: How teenagers negotiate context in social media. New Media & Society, 16(7):1051-1067, 2014
- Swapneel Sheth, Gail Kaiser, and Walid Maalej. Us and Them: A Study of Privacy Requirements Across North America, Asia, and Europe. International Conference on Software Engineering (ICSE), pages 859-870, 2014
- Yang Wang, Gregory Norcie, and Lorrie Faith Cranor. Who is Concerned About What? A Study of American, Chinese and Indian Users’ Privacy Concerns on Social Network Sites. International Conference on Trust and Trustworthy Computing, pages 146-153, 2011
- Ruogu Kang, Stephanie Brown, Laura Dabbish, and Sara Kiesler. Privacy Attitudes of Mechanical Turk Workers and the U.S. Public. Symposium on Usable Privacy and Security (SOUPS), pages 37-49, 2014
- Ruogu Kang, Laura Dabbish, Nathaniel Fruchter, and Sara Kiesler. My Data Just Goes Everywhere: User Mental Models of the Internet and Implications for Privacy and Security. Symposium On Usable Privacy and Security (SOUPS), pages 39-52, 2015
Lecture 15: Misc Topics (11/15/17)
Slides
Incident - News Article
References:
- Alex Braunstein, Laura Granka, and Jessica Staddon. Indirect content privacy surveys: measuring privacy without asking about it. Symposium on Usable Privacy and Security (SOUPS), pages 15:1-15:14, 2011
- Adrienne P. Felt, Elizabeth Hay, Serge Egelman, Ariel Haneyy, Erika Chin, and David Wagner. Android Permissions: User Attention, Comprehension, and Behavior. Symposium on Usable Privacy and Security (SOUPS), pages 3:1-3:14, 2012
- Travis D. Breaux and Florian Schaub. Scaling requirements extraction to the crowd: Experiments with privacy policies. Requirements Engineering Conference (RE), pages 163-172, 2014