Privacy Distillation @ Best RESG Research 2014

I had the opportunity to present our research on Privacy Distillation for Mobile Applications at the British Computer Society Requirements Engineering Specialist Group's Best of RESG Research 2014 event.  The slides above are based on those originally presented by Keerthi Thomas at ICSE 2014.

Some interesting questions were discussed following my presentation, including:
  • How does the distillation process cope with the overall mobile software eco-system? At the moment we have only considered the peer-to-peer information flows between the end users of the mobile application.  However, it should be possible to use the Privacy Facets Framework to consider the information, information flows and actors in the overall mobile software eco-system.  Of course some extensions will be required, for example to capture factors such the legal and regulatory aspects of privacy associated with the places in which in the information, information flows and actors operate.
  • Can distillation also be used for other requirements of the application? We don't advocate using distillation for eliciting functional requirements because there are already well established methods for this.  Instead we see distillation as a complementary technique that can augment functional requirements elicitation by focussing on 'more tacit' types of requirements like privacy.
  • Does focussing on individual privacy sensitive contexts hide some of the 'bigger picture' of the system, based on the interactions between different contexts? This is a valid concern and is not currently addressed in the distillation process.  One way to deal with this problem might be to look at ways of using the information flow modelling to relate different privacy sensitive contexts to each other.  These relationships could be highlighted using a visualisation tool to help the analyst to explore the interactions and keep track of the 'big picture'.
  • What types of privacy requirements were discovered in real-world applications? We used the distillation process to analyse two types of mobile applications, Mobile Facebook and a mobile location sharing app.  When we carried out the empirical study of Mobile Facebook users in 2008/2009, Facebook did not have any functionality to group friends into lists and specify privacy preferences using these lists.  Our analysis highlighted the need for such functionality in order to address users' privacy concerns.

Comments

Post a Comment

Popular posts from this blog

Cloud Wedge - geek of the week

Image
CloudWedge: 'Geek of the Week' My colleague Yijun Yu recently wrote a opinion piece for The Conversation about how cloud computing could have made a difference to the search for Malayian Airlines MH370.  Essentially the question he poses is: why, in the age of global internet connectivity (including now onboard planes!), do we depend on the onboard flight data recorder for information about what happens on a plane? Of course there are numerous challenges with this - not least the cost of bandwidth for all the flight data (including cockpit audio) to be uploaded in real time and the security of the data.  Yijun's article addresses some aspects of the latter, and the former is not an insurmountable problem.  For example it should be possible to upload basic flight telemetry (e.g., GPS location, air speed, engine statistics and fuel data) without requiring significant bandwidth.  Indeed aero engine manufacturers such as Rolls-Royce deployed engine monitoring systems
Read more

Priming Code Club

Code Club Assembly Presentation from akbandara As part of my work with STEMnet, I recently signed up as a CodeClub volunteer at St. Bernadette's Catholic Primary School in Milton Keynes.  Working with Kate Clarke, the ICT leader at the school, I am going to be leading an after-school club that will introduce kids in Year 5 and Year 6 to the exciting world of programming.  CodeClub is a nationwide, volunteer driven, grass-roots movement to get kids learning about the fun that can be had programming computers, rather than simply using them. In order to give the kids some idea about what they might be letting themselves in for, last week I delivered the short presentation (embedded above) at the school.  I started out by getting the kids to identify different computers, and think about what a computer really does, i.e. follows a set of instructions to complete a task.  We then played with a neat little iPad game called 'Kodable' which allows the player to progr
Read more

Are we losing the Internet Security battle?

Image
I was recently invited by Heimdal Security to take part in an expert roundup, with the theme of "Is Internet Security a Losing Battle?".   The main thrust of my answer was to question our use of analogies of conflict in the context of Internet Security or cyber security.  As I said in my response: "... in this context the metaphors of conflict, such as ‘war’ and ‘battle’ are unhelpful because they suggest that internet security is the responsibility of the technologists who act our defensive force against attackers.   Instead, as has been argued by technology activists like Cory Doctorow  and others we might have more success by thinking of cyber security using the analogy of public health and communicable diseases.   By using this analogy, we make cyber security issues more relevant to people and spur them to gain a better understanding that, like diseases, any of us can be afflicted by a cyber security attack.  We can also adopt an analogous approach for han
Read more