Librarians as Advocates for Social Media Privacy

Librarians must continue their traditional roles as privacy rights activists and intellectual freedom upholders into the digital age, and across electronic information sources, including social media fora. Social media is quickly becoming a major source of information and center for information seeking, and librarians have an opportunity to promote and help shape social media policies that protect users’ privacy and assure that users can seek information without inhibition. One way librarians can be involved in the promotion of online privacy is by joining the social media user rights movement and advocating terms of use agreements that protect information seekers that follow the "Privacy by Design" model created by Ann Cavoukian, Ph.D.

Online information seeking by patients with bipolar disorder:results from an international multisite survey

Background: Information seeking is an important coping mechanism for dealing with chronic illness. Despite a growing number of mental health websites, there is little understanding of how patients with bipolar disorder use the Internet to seek information. Methods: A 39 question, paper-based, anonymous survey, translated into 12 languages, was completed by 1222 patients in 17 countries as a convenience sample between March 2014 and January 2016. All patients had a diagnosis of bipolar disorder from a psychiatrist. Data were analyzed using descriptive statistics and generalized estimating equations to account for correlated data. Results: 976 (81 % of 1212 valid responses) of the patients used the Internet, and of these 750 (77 %) looked for information on bipolar disorder. When looking online for information, 89 % used a computer rather than a smartphone, and 79 % started with a general search engine. The primary reasons for searching were drug side effects (51 %), to learn anonymously (43 %), and for help coping (39 %). About 1/3 rated their search skills as expert, and 2/3 as basic or intermediate. 59 % preferred a website on mental illness and 33 % preferred Wikipedia. Only 20 % read or participated in online support groups. Most patients (62 %) searched a couple times a year. Online information seeking helped about 2/3 to cope (41 % of the entire sample). About 2/3 did not discuss Internet findings with their doctor. Conclusion: Online information seeking helps many patients to cope although alternative information sources remain important. Most patients do not discuss Internet findings with their doctor, and concern remains about the quality of online information especially related to prescription drugs. Patients may not rate search skills accurately, and may not understand limitations of online privacy. More patient education about online information searching is needed and physicians should recommend a few high quality websites.

Detecting and resolving redundancies in EP3P policies

Current regulatory requirements on data privacy make it increasingly important for enterprises to be able to verify and audit their compliance with their privacy policies. Traditionally, a privacy policy is written in a natural language. Such policies inherit the potential ambiguity, inconsistency and mis-interpretation of natural text. Hence, formal languages are emerging to allow a precise specification of enforceable privacy policies that can be verified. The EP3P language is one such formal language. An EP3P privacy policy of an enterprise consists of many rules. Given the semantics of the language, there may exist some rules in the ruleset which can never be used, these rules are referred to as redundant rules. Redundancies adversely affect privacy policies in several ways. Firstly, redundant rules reduce the efficiency of operations on privacy policies. Secondly, they may misdirect the policy auditor when determining the outcome of a policy. Therefore, in order to address these deficiencies it is important to identify and resolve redundancies. This thesis introduces the concept of minimal privacy policy - a policy that is free of redundancy. The essential component for maintaining the minimality of privacy policies is to determine the effects of the rules on each other. Hence, redundancy detection and resolution frameworks are proposed. Pair-wise redundancy detection is the central concept in these frameworks and it suggests a pair-wise comparison of the rules in order to detect redundancies. In addition, the thesis introduces a policy management tool that assists policy auditors in performing several operations on an EP3P privacy policy while maintaining its minimality. Formal results comparing alternative notions of redundancy, and how this would affect the tool, are also presented.

Enforcing P3P policies using a digital rights management system

The protection of privacy has gained considerable attention recently. In response to this, new privacy protection systems are being introduced. SITDRM is one such system that protects private data through the enforcement of licenses provided by consumers. Prior to supplying data, data owners are expected to construct a detailed license for the potential data users. A license specifies whom, under what conditions, may have what type of access to the protected data. The specification of a license by a data owner binds the enterprise data handling to the consumer’s privacy preferences. However, licenses are very detailed, may reveal the internal structure of the enterprise and need to be kept synchronous with the enterprise privacy policy. To deal with this, we employ the Platform for Privacy Preferences Language (P3P) to communicate enterprise privacy policies to consumers and enable them to easily construct data licenses. A P3P policy is more abstract than a license, allows data owners to specify the purposes for which data are being collected and directly reflects the privacy policy of an enterprise.

Deanonymizing Users of the SafeWeb Anonymizing Service

The SafeWeb anonymizing system has been lauded by the press and loved by its users; self-described as "the most widely used online privacy service in the world," it served over 3,000,000 page views per day at its peak. SafeWeb was designed to defeat content blocking by firewalls and to defeat Web server attempts to identify users, all without degrading Web site behavior or requiring users to install specialized software. In this article we describe how these fundamentally incompatible requirements were realized in SafeWeb's architecture, resulting in spectacular failure modes under simple JavaScript attacks. These exploits allow adversaries to turn SafeWeb into a weapon against its users, inflicting more damage on them than would have been possible if they had never relied on SafeWeb technology. By bringing these problems to light, we hope to remind readers of the chasm that continues to separate popular and technical notions of security.

PROTECT_U: Un système communautaire pour la protection des usagers de Facebook

Article publié dans le journal « Journal of Information Security Research ». March 2012.

Filtros na rede: das relações entre discurso e tecnologia

A fim de refletirmos sobre as condições de produção na contemporaneidade, propomos discussões e análises em torno do funcionamento dos recursos de personalização de conteúdos na Internet que impõem filtros aos usuários. Para isso, mobilizamos a teoria de Análise do Discurso de linha francesa, sobretudo a partir dos trabalhos de Michel Pêcheux. Delimitamos a observação do funcionamento de tais recursos no mecanismo de busca do Google, uma vez que ele representa uma das maiores corporações na Internet e detém a maior parte do mercado de buscas. A partir dessa delimitação, selecionamos o corpus de análise oriundo da política de privacidade do buscador, de definições dadas pela empresa sobre o funcionamento de tais recursos e de relatos sobre esse funcionamento postados por usuários e disseminados na rede. Acreditamos que a análise do funcionamento dessas técnicas nos dizem sobre as condições de produção do discurso na contemporaneidade, bem como das materialidades discursivas que lhes são peculiares, compreendendo que é pela influência materialista que se chega, na Análise do Discurso, a noção de materialidade discursiva. Temos, dessa forma, contemplada uma discussão sobre história, sujeito e língua que fundamenta o funcionamento da ideologia. Ainda nesse ínterim, propomos pensar o discurso ressaltando o que concerne à memória, bem como as questões que decorrem ao considerarmos seu funcionamento perpassado pelas Tecnologias de Informação e Comunicação (TIC\'s), o que nos move a refletir sobre o discurso eletrônico e a memória metálica. Tudo isso nos mostra os efeitos discursivos dos filtros que giram em torno do controle na rede, característica que tem marcado as relações de poder no cenário atual.

Empresa privada y participación digital: modelo de negocio y derecho de petición en Change.org

Esta investigación pretende aproximarse al papel de Change.org como plataforma de petición electrónica en España, donde no existen alternativas administradas por los poderes públicos. Mediante un análisis de contenido cualitativo y una entrevista semi-estructurada, investigamos el modelo de negocio de la página, con el objetivo de conocer su política de protección de datos, su sistema de verificación de los usuarios y, de forma más general, el marco legislativo en el que opera. Los resultados obtenidos muestran al proyecto alejado del derecho de petición español, con un sistema de testeo laxo y que basa sus beneficios en el coste por adquisición.

Privacy invasive geo-mashups : privacy 2.0 and the limits of first generation information privacy laws

Online technological advances are pioneering the wider distribution of geospatial information for general mapping purposes. The use of popular web-based applications, such as Google Maps, is ensuring that mapping based applications are becoming commonplace amongst Internet users which has facilitated the rapid growth of geo-mashups. These user generated creations enable Internet users to aggregate and publish information over specific geographical points. This article identifies privacy invasive geo-mashups that involve the unauthorized use of personal information, the inadvertent disclosure of personal information and invasion of privacy issues. Building on Zittrain’s Privacy 2.0, the author contends that first generation information privacy laws, founded on the notions of fair information practices or information privacy principles, may have a limited impact regarding the resolution of privacy problems arising from privacy invasive geo-mashups. Principally because geo-mashups have different patterns of personal information provision, collection, storage and use that reflect fundamental changes in the Web 2.0 environment. The author concludes by recommending embedded technical and social solutions to minimize the risks arising from privacy invasive geo-mashups that could lead to the establishment of guidelines for the general protection of privacy in geo-mashups.

Internet and e-commerce law, business and policy

Over the last two decades, the internet and e-commerce have reshaped the way we communicate, interact and transact. In the converged environment enabled by high speed broadband, web 2.0, social media, virtual worlds, user-generated content, cloud computing, VoIP, open source software and open content have rapidly become established features of our online experience. Business and government alike are increasingly using the internet as the preferred platform for delivery of their goods and services and for effective engagement with their clients. New ways of doing things online and challenges to existing business, government and social activities have tested current laws and often demand new policies and laws, adapted to the new realities. The focus of this book is the regulation of social, cultural and commercial activity on the World Wide Web. It considers developments in the law that have been, and continue to be, brought about by the emergence of the internet and e-commerce. It analyses how the law is applied to define rights and obligations in relation to online infrastructure, content and practices.

Privacy concerns and the purchasing of travel services online

The travel industry has come to rely heavily on information and communication technologies to facilitate relations with consumers. Compiling consumer data profiles has become easier and it is generally thought that this has led to an increase in consumers' privacy concerns, which may have an adverse impact on their willingness to purchase online. Three specific aspects of privacy that have received attention from researchers are unauthorized secondary use of data, invasion of privacy, and errors. A study was undertaken to examine the effects of these factors on prior purchase of travel services via the Internet and future purchase probability. No evidence was found to indicate that such privacy concerns affect online purchase behavior within the travel industry. Managerial implications are discussed.

Privacy concerns and purchase of travel product online

The travel and tourism industry has come to rely heavily on information and communication technologies to facilitate relations with consumers. Compiling consumer data profiles has become easier and it is widely thought that consumers place great importance on how that data is handled by firms. Lack of trust may cause consumers to have privacy concerns and may, in turn, have an adverse impact on consumers’ willingness to purchase online. Three specific aspects of privacy that have received attention from researchers are unauthorized use of secondary data, invasion of privacy, and errors. A survey study was undertaken to examine the effects of these factors on both prior purchase of travel products via the Internet and future purchase probability. Surprisingly, no significant relationships were found to indicate that such privacy concerns affect online purchase behavior within the travel industry. Implications for managers are discussed.

An Online Distributed Algorithm for Inferring Policy Routing Configurations

We present an online distributed algorithm, the Causation Logging Algorithm (CLA), in which Autonomous Systems (ASes) in the Internet individually report route oscillations/flaps they experience to a central Internet Routing Registry (IRR). The IRR aggregates these reports and may observe what we call causation chains where each node on the chain caused a route flap at the next node along the chain. A chain may also have a causation cycle. The type of an observed causation chain/cycle allows the IRR to infer the underlying policy routing configuration (i.e., the system of economic relationships and constraints on route/path preferences). Our algorithm is based on a formal policy routing model that captures the propagation dynamics of route flaps under arbitrary changes in topology or path preferences. We derive invariant properties of causation chains/cycles for ASes which conform to economic relationships based on the popular Gao-Rexford model. The Gao-Rexford model is known to be safe in the sense that the system always converges to a stable set of paths under static conditions. Our CLA algorithm recovers the type/property of an observed causation chain of an underlying system and determines whether it conforms to the safe economic Gao-Rexford model. Causes for nonconformity can be diagnosed by comparing the properties of the causation chains with those predicted from different variants of the Gao-Rexford model.

Trust considerations on attitudes towards online purchasing: The moderating effect of privacy and security concerns

The research examines the relationships between three common trust considerations (vendor, Internet and third parties) and attitudes towards online purchasing. The study incorporates privacy and security concerns as a moderating variable and finds that these relationships vary depending on the level of concerns a consumer has when purchasing online. The study suggests that "fears" surrounding the Internet as a place to do business still hinder the use of it for e-commerce purposes, but that the presence of a reputable agent might in some manner mitigate this risk. In the context of business to consumer relationships trust in the vendor is important for the consumer to accept any risk associated with a transaction. Theoretical implications for online customer behavior theory are also discussed. © 2009 Elsevier Inc.