Partnership with the Privacy Identity and Innovation Conference

We are pleased to announce that at this year’s Privacy Identity Innovation Conference in Silicon Valley there will be one day dedicated to a Privacy Camp.

The Privacy Identity Innovation is one of the leading events in Silicon Valley that:

brings together key stakeholders and decision makers from various communities to examine critical technological, ethical and legal issues, and to highlight new opportunities.

This year  Privacy Identity Innovation will host a special edition of PrivacyCamp at pii2011 where you can propose your own topic and host a discussion with fellow participants.

Admission to PrivacyCamp is included at no additional cost when you register for pii2011.

This year’s event promises to be very good.

More from the Privacy Identity Innovation website:

As Ontario’s information and privacy commissioner Ann Cavoukian often says, it doesn’t have to be a zero-sum game where you sacrifice privacy for usability, functionality or security. Smart policies and practices for managing data and protecting your users’ personal information are good for business. Find out how to better understand users’ evolving expectations and earn their trust without coming under fire from regulators, the media or the court of public opinion.

Through a series of keynotes, roundtable discussions, demos and workshop sessions, pii2011 will help you navigate the quickly-changing landscape so you can avoid the pitfalls and chart a course that is “win-win” for you and your users. Sign up now to secure your spot.

The pii2011 program will feature thought leaders and innovators who will share best practices and look at the latest developments in areas like:

• Mobile apps
• Geo-location services
• Big data
• Cloud computing
• Social networking
• Digital advertising…and more

Filed under: Events, Identity, Innovation, privacy, Privacy Camp, Ann Cavoukian, Information and Privacy Commissioner (Ontario), Personally identifiable information, privacy, Silicon Valley

Notes and Photos from PrivacyAppCamp

Here’s notes from our PrivacyCamp in Mt. View! Check out the CDT flickr account for pictures.

Learnings

Morning Sessions

• User expectation / responsibility
  • Privacy responsibility lies with the platform because that’s what the user expects
  • User privacy expectations change with context
  • Should have control over privacy on the fly instead of a single setting that applies to everything
• Identity
  • Data minimization vs. identifiers = co-mingling of authentication, authorization, tracking, id
    • Authentication proves the truth of a claim of identity, authorization is a permission for an action
    • ID is not always necessary to prove permission, but is used as such constantly
    • If ID is always tied to permission, then all actions permitted can be tied to identity (i.e., behavioral tracking)
    • Is there a way to mitigate this tracking? Can ID be separated from permission and still allow the ease of use users want?
• Location
  • Location notice and use or storage challenges
    • Communicating to the user about their location privacy is difficult to do when it matters (when it’s being used)
    • You might auth your app for location and then forget about it
  • Children
    • How do you handle parents that want to track location of their child?
    • This might accidentally allow tracking of spouse, others
    • Age identification is hard
  • Apps to trace or log data path
  • Ad-networks make collecting location data easy
    • Ad apps (iApp, etc) make it easy to get location data even if it isn’t needed for the user’s experience
  • Many SDKs default to sharing
  • Location retention isn’t generally addressed
    • There might be location correlation made over time without the user knowing it’s used more than spuriously

Afternoon Sessions

• Responsibility
  • Platforms manage relationship w/consumers
    • So they bear a lot of the responsibility for managing privacy on behalf of the user
  • Need for government clarification
    • By law or precedent that identifies free speech / intermediary vs. negligence
  • Transparency in Data profit
    • Would be good to show user how the company is using user data for profit
• Privacy by design / Privacy Apps
  • If you had a formal list of criteria for an app, what would it be?
    • Feedback and control – a stronger voice for users as a part of the development process
    • Data Access
      • Users should have constant access to their information no matter how much the product evolves
      • Right to deletion
    • Privacy fixing SDKs / library
      • One could create an SDK / library for app developers that would generate a privacy subset (location settings, data settings, etc).  Like a privacy framework to jump-start your app with good initial privacy settings.
• User Experience
  • User as admin
    • The user shouldn’t always have to be administering their user experience
  • Iconography challenge
    • No great standards to represent privacy ideas
  • No negotiations
    • It’s really hard for users to negotiate with corporations
    • How to pool negotiation for good consumer <-> vendor conversation

Filed under: Uncategorized

Guest Post: Alternative Idea for a “Privacy API”

This post was contributed by Sandy Klausner of CoreTalk

The idea of “The Privacy API” was raised at last May’s PrivacyCamp event.  The idea is premised on numerous social websites publishing closed APIs, with no assurance that a high profile privacy mishap could not occur.  Perhaps, event participants can consider an alternative idea?

I recently authored two blog entries on the Science Enhanced Networked Domains and Secure Social Spaces (SENDS) website that address the framework challenge to aid application developers across all platforms in designing privacy for their apps.  The second entry premises that scalable solutions to the identity and privacy challenges require holistic policy-aware software architecture where a user’s identity is fused to a legal entity.  Anything created by a user is traceable to the entity, allowing apps to share personal data that can expand into a rich contextualized cyberspace presence.

The first A Vision for Personal Information Management entry reflects on the current effort to redefine cyber-security and what the opportunities to empower individuals to manage their identity and privacy might look like.  The second entry, A Context-aware Internet, describes a vision for a new Internet architecture that is context-aware, a key requirement to automate and secure online transactions, as well as provide trusted identities and enhanced privacy.  This entry suggests a mechanism to provide users with fine-grained control over their data from a simple user interface, while supporting the rapid development of a broad range of high-value commercial applications.

Such architecture could provide an efficient and resilient information and communications infrastructure for generations to come.  The Cubicon team has done extensive work in exploring the practical deployment of such architecture and warmly invites dialog on the associated opportunities and implications.

 

Filed under: Uncategorized

PrivacyCamp SF and the Privacy API

Last week, CDT organized the first West Coast PrivacyCamp, focused on privacy in social networks. The turnout was great – with representatives attending from Twitter, Google, EFF, ACLU, Rapleaf and many other Silicon Valley standouts. Following the agenda-setting process of previous camps, we convened twice during the day to determine the morning and afternoon break-out discussions.  The crowd was very active on Twitter, and lunch was accompanied by some great remarks on the future of Web identity by Craigslist founder, Craig Newmark.

Not unexpectedly, many of the conversations focused on Facebook’s recent privacy changes and the impact not only on user expectations, but on user loyalty. Conversations also raised interesting questions about how to avoid the various consequences of oft-changing privacy policies, either through add-ons or migrating to alternative social networks. Unfortunately, many of the attendees agreed that there was very little incentive for social media networks monetizing user information to change the trend of current practices.

What can the privacy community and users do to keep social networks free of charge and still a profitable business? How can user information continue to be a viable good without jeopardizing the implicit promise to users to preserve their privacy?

A fresh idea was raised at PrivacyCamp: The Privacy API. This would be code, released by the social network, which would allow application developers access to users’ privacy settings.  However, one high profile privacy mishap linked to the use of this technology and user trust is out the window.  Instead, a “closed” API could be offered to developers from trusted organizations, academic institutions and advocacy groups.

Based on the trusted developers’ discretion, applications could be created to build a “one-button” app that would appropriately reset users’ privacy settings. These settings could be described in detail on the application download page; they would be easy to read and understandable. This idea would save users time, hassle and concern, and the applications could be updated to adapt to new privacy changes by the social network.

This approach offers a way for social networks to leverage the strong reputations of third parties while simultaneously illustrating their commitment to user privacy. If you attended PrivacyCamp, what were some of theother cool ideas you heard?

—

Originally posted on http://www.cdt.org.

Filed under: Uncategorized

Key takeways from Privacy Camp

Here’s everybody takeaways from the closing session — apologies in advance to anybody I missed:

• international privacy law
• how complex hybrid objects are
• acceptance of Facebook hegemony
• user expectation tradeoff of giving up privacy to get free things
• you’ll never get a roomful of people to agree what kinds of permissions are necessary to transfer information to third parties
• even if i were god of social networks i’m not sure just what’s right on privacy
• there’s a big disparity between the privacy people want, what they get, and what they perceive they’re getting
• different levels of privacy people get and how hard it is to synthesize to one-click
• conflicts between wanting to innovate and wanting to innovate intelligently
• challenges and complexity of testing good privacy practices that are easy to understand
• there’s a lot of people who i agree with that i disagree with
• tension between wanting people to share info and privacy
• a lot of opportunity for products that protect people’s privacy
• tensions between privacy and identity
• looking at what your friends reveal about your privacy via facebook — use social networks to defend privacy
• very daunted by the identity challenge. very much believe in the approach of multiple identities of different strengths for different purposes but see
• the drive to the stronger aggregated identity.  is there a way to reverse that?
• importance of maintaining user promise and not breaking user expectation — bad behavior by some actors has poisoned the well for others
• opportunities in so many different areas.  how to harness energy?
• human relationships are a lot more complicated than we thought they were.  not sure what we want, but it’s not what we have right now
• we’ve gone from using a service to being the product.  so i’m going to think about what it means to be a product
• we all agree that privacy has some value.  the value we put on it in this room may be different than others.  over the next few years, what monetary value will we put on it?
• if you put 10 people in a room, you get 12 different definitions of privacy.  the online environment is increasingly concerned with what info Facebook gets about you from other people
• from an activism perspective, focus on the community on one or two things — rallying cry, win a victory
• in our group this morning, we couldn’t even agree on what a profile is, let alone what i could take with me.  we need some working groups to clarify
• the difference between Faceook and Google is that FB has the assumption of personal investment and your personal life.  so even though there’s possibly more data in Google, FB feels more violating
• notion of “guest developers”, trusted people like EFF getting special access to an API
• i feel very strongly that you should be able to control your data, and move it … but what’s your data, and what’s your friends’ data?  it’s a two-edged sword, don’t know how to square the circle
• thinking about data portability
• the gap is widening between our ability to manage and control this as a society and the amazingly fast business and technical innovation.  consumers who are willing and able to understand will have better outcomes.  education, starting in the elementary schools
  negative discussion about anonymity, especially from privacy folks, was very intereting
• craig’s comments gave me a real sense of the openness of the future and the potential for change
• there’s a great potential for privacy and security products still to be built out there
• interesting apps and platform ideas on how to protect privacy (however it might be defined).  start promoting those things and let users choose.  maybe next year we’ll be talking about privacy apps
• tremendous interest in looking at privacy solutions — and it seems to be tremendously difficult
• language around data portability is confused and incoherent
• people believe what people say more than what they do
• still confusion around identity and reputation, no surprise there.  what did surprise me was the real concern about Facebook’s hegemony and moving the goal posts.  consumer eduction will move the center
• want to echo craig’s comments: i really want to do something about this
• now’s the time — people care about it, and there are lots of promising opportunities
• the people at privacy camp are the right people.  seeing the ideas that came out today and the way it moved in a progressive way

Filed under: Uncategorized

Sessions for today’s Privacy Camp

Here’s the list of sessions:

11:00

• Social media and privacy activism,  organizing social change with social networks (room 640)
• data ownership (portability/who owns it), right to leave (room ARC1)
• enhancing privacy through technology (room ARC2)

12:30: lunch and speaker, Craig Newmark

2:00

• Privacy Bill of Rights/Policies/What’s privacy (ARC1)
• Managing your identity online (ARC2)
• Privacy by Design/Business Models/UI (640)

3:30: closing comments

The #privacy2010 hashtag has the latest info; and Jon Pincus has been liveblogging on Computers, Freedom, and Privacy.

Filed under: Uncategorized

Initial Topics for Privacy Camp SF

With PrivacyCamp SF just over a week away, I’m really getting excited about the event. Here are a few ideas and questions for the sessions to address next week, all in keeping with our social networking theme:

•    Privacy by Design: Where in the design process should privacy be addressed? How far have we come and in what direction are we heading? What are the biggest obstacles to designing a private network, and what are some ways to overcome them?
•    All Out in the Open: How can privacy exist on a public network? In an age that seemingly embraces oversharing, are privacy controls a futile exercise? What are users’ expectations and how can they be addressed?
•    The Money Question: Does privacy work against the very tenets of social networking monetization? Can networks emphasize privacy and still be profitable? Is it possible to compete on privacy?
•    Too Much Control: Are granular controls the answer to privacy? How detailed can controls get before they become too complicated? How sophisticated is the “average user” and how can sites encourage users to educate themselves about the full functionality of privacy controls?
•   Update Headaches: What works when you change your site’s privacy controls? What doesn’t?

What would you like to see discussed at PrivacyCamp SF?

Filed under: Uncategorized

Thoughts from PrivacyCampDC 2010

Last weekend, we convened an “unconference” to bring together people in the DC area interested in discussing and debating ideas about privacy. An unconference has no agenda, no keynotes, no prescribed topics, and only one focus – ours was privacy. Bright and early Saturday morning, we met to create the schedule based on the interests and expertise of the attendees. From the opening pep talk by the White House’s deputy CTO Andrew McLaughlin to the closing session, this year’s DC PrivacyCamp was a success – many engaged privacy geeks braved barely-functional metro system in order to come downtown, talk about privacy, and drive the conversation around privacy innovations.

We had many return ‘campers’ from last year and picked up some conversations started there – but this time, we’re hoping that we can keep the discussion going year-round through a series of PrivacyCamps worldwide. We’ll be continuing the conversation in a few weeks at the next PrivacyCamp in San Francisco on May 7th, and we hope to see you there – whether it’s via the livestream, Twitter, or in person. If you are interested in seeing what we talked about, our Twitter archive is a good place to start. Though there were more fantastic sounding sessions on the schedule than I could actually go to in a single day, I left inspired by the discussion around the difficulty of “forgetting” online, reputation and privacy, identity, and Privacy Commons (a project initiated at last year’s Privacy Camp). Luckily, I’ll be able to continue the discussion in a few weeks – and hopefully at some of the following PrivacyCamps worldwide!

Another fantastic event coming up in San Francisco is the Internet Identity Workshop on May 17th, and we’re hoping to make sure that privacy advocates are part of the conversation (let me know if you’d like to register – we have a discount!). This workshop brings together those who are interested in using, transmitting, and protecting personal characteristics online. Creating and maintaining this identity information online is quickly becoming one of the central challenges of the digital age. These identity transactions create the backbone for many innovative online services – every time you log in online, you’re facilitating an identity transaction. Every time you buy something online or even are served with customized advertisements, you’re part of an identity transaction. These online assertions will continue to drive innovative online services – but we must ensure that privacy is a part of the discussion. CDT will be there – and spreading our identity principles far and wide.

It’s exciting to know the number of events in the works and the amount of energy that is growing around these events.  Be sure to check out CDT’s Flickr page for photos of the DC Privacy Camp.

This post originally appeared on http://www.cdt.org

Filed under: Uncategorized

Privacy Camp DC Schedule

	10th Large	10th Small	11th Large
10:30 – 11:30	Reputation management and the right to be forgotten		Social media for privacy advocacy
11:40 – 12:40	Risks of online identity		Workplace privacy
12:40 – 1:30	Lunch on the 10th floor
1:30 – 2:30	Privacy policies and the Privacy Commons	Measuring the effectiveness of privacy programs	Customer driven versus legal driven privacy
2:40 – 3:40	Cultural context of privacy	Privacy in digitally developing countries	Subpeonas and social networks
3:50 – 4:30	Closing session on the 10th floor
	Happy hour at Nirvana

Filed under: Uncategorized

DC Metro Delays

Unfortunate news: (taken from D.C. Emergency Alerts)

Customers can expect lengthy delays of up to 40 minutes this weekend (April 16-18) as old track components are replaced on the Red, Blue, Orange and Green lines, causing inbound and outbound trains to take turns sharing one track on portions of the rail system.

Riders planning to take the Red, Blue, Orange or Green lines to area sports events this weekend should add up to 40 minutes to their travel times. The Washington Nationals play at Nationals Park on April 16, 17, and 18, the Washington Capitals play at the Verizon Center on April 17, and the DC United play at RFK Stadium on April 17.

Still hope to see you there!

Filed under: Uncategorized