Introduction to privacy feedback research @ DesRes2016

What, why, how
Introduction to feedback privacy sensitive runtime data
leaked by smartphone applications
Alessandro Carelli Ph.D. student
Supervisors
Dr M. Sinclair and Dr D. J. Southee
DesRes 2016
13/04/2016

Alessandro Carelli Ph.D student | Loughborough Design School | DesRes 2016 | 13/04/2016

What
Tinder’s Android permissions and privacy policy
Tinder’s Android permissions [n=18]
https://play.google.com/store/apps/details?id=com.tinder
Privacy policy [word count = 2867]
https://www.gotinder.com/privacy

What
Some personal information leaked by Tinder

What
Personal information most frequently leaked by apps
PII Address; birthday; email;
gender; name; password; phone
info; phone number; zip code.
Behaviour Employment; friend; medical
info; post; search; username
Location Location{Source:
Zang, J. et al., 2015. Who Knows What About Me? A Survey of Behind the Scenes Personal Data Sharing to Third ParOes by Mobile
Apps. Technology Science. Available at: hRp://techscience.org/a/2015103001/

How can runtime privacy-sensitive data leaked by smartphone
devices be visualised in order to rise users’ awareness and
control over unintended information disclosure?
Froehlich, J. et al., 2012. The Design and EvaluaOon of Prototype Eco-
feedback Displays for Fixture-level Water Usage Data. In Proceedings of the
SIGCHI Conference on Human Factors in Compu<ng Systems. CHI ’12. New
York, NY, USA: ACM, pp. 2367–2376.
From eco-feedback To privacy feedback

Why
Research aim, gap, originality
Research aim The aim of this research is to find novel and effective solutions to feeding back
privacy-sensitive runtime data to users in order to
•  improve awareness and understanding of personal data leakage taking
place on their smartphones;
•  allow users to have more control over the data disclosure.
Research gap While there are many available methods to collect and analyse runtime data
leaked from smartphone devices, there is currently a lack in understanding how
smartphone users might benefits from this information. This, therefore,
represents the gap in knowledge this research strives to fill.
Research
originality
The original aspects of this research are twofold:
•  Extending the knowledge from previous works on gap in users’ expectation
about apps behaviour, with a focus on personal feelings and behavioural
reaction;
•  Conducting empirical work on designing and evaluating novel ways to feed
back leaked personal information to users that has not been done before.

Source:
1 hRp://www.pewglobal.org/2016/02/22/smartphone-ownership-rates-skyrocket-in-many-emerging-economies-but-digital-divide-remains/
2 hRp://www.pewinternet.org/2015/10/29/technology-device-ownership-2015/
3 hRp://stakeholders.ofcom.org.uk/binaries/research/cmr/cmr15/UK_0.pdf
4 hRp://www.economist.com/news/leaders/21645180-smartphone-ubiquitous-addicOve-and-transformaOve-planet-phones
5 hRp://stakeholders.ofcom.org.uk/binaries/research/cmr/cmr15/UK_0.pdf
6 hRp://www.iab.com/wp-content/uploads/2015/10/IAB_Internet_AdverOsing_Revenue_Report_HY_2015.pdf
Why
Smartphones
Extensive worldwide smartphone ownership
•  72% american and 60% european adults own a smartphone 1;
•  86% of americans ages 18-29 have a smartphone 2;
•  In UK smartphones are now the most widely-owned internet-enabled
device (66%), on a par with laptops (65% of households) 3;
Smartphones have penetrated every aspect of daily life
•  The average American is buried in one for over two hours every day 4;
•  Three in ten UK adults (29%) said they checked their phones within
ﬁve minutes of waking up, increasing to about half of 18-24 year olds
(48%) 5.
AD revenues continue to increase
•  In North America, which represent the largest mobile advertising
market, mobile continued its increase in revenue share in Q2 2015
($4.4billion 31% of total internet advertising revenue)6
{

Android dominates the mobile OS market
•  82.8% share in 2015 Q21 ;
Google play is the biggest content provider for mobile applications
•  one billion active users in the 2015 2;
•  approximately 2 million apps 3;
Android is an OS for the next wave of technologies
•  “from phones and tablets to watches, TV, cars and more to come”4.
Why
Android
Source:
1 hRp://www.idc.com/prodserv/smartphone-os-market-share.jsp
2 hRp://social.techcrunch.com/2015/05/27/google-io-2015-keynote-live-blogsee
3 hRp://mashable.com/2015/01/15/google-play-more-apps-than-ios/#qqY5LYTJAOql
4 hRp://www.android.com/
{

Why
Feedback
{
Privacy is part of UX
•  90% of smartphone owners (N=461 Americans adults Ages 18+) say
that knowing how their personal data will be used is “very” or
“somewhat” important when choosing whether or not to install an
app1;
Current privacy information tools are largely ineﬀective
•  Similarly to EULA and privacy notices, users have been found to pay
low attention to the permission list as well as to do not understand in
full the meaning behind permissions (Shklovski et al. 2014; Balebako
et al. 2013; Felt et al. 2012a; Kelley et al. 2012);
Relevance of runtime data to users
•  Diﬀerent studies have empirically tested the relevance of privacy-
sensitive information held in runtime data to users as they may show
the real applications behaviour (Almuhimedi et al. 2015; Balebako et
al. 2013; Jung et al. 2012).
Source:
1 hRp://www.pewinternet.org/2015/11/10/apps-permissions-in-the-google-play-store/

Source:
AcquisO, A., Brandimarte, L. & Loewenstein, G., 2015. Privacy and human behavior in the age of informaOon. Science, 347(6221),
pp.509–514.
Palen, L. & Dourish, P., 2003. Unpacking “Privacy” for a Networked World. In Proceedings of the SIGCHI Conference on Human
Factors in CompuOng Systems. CHI ’03. New York, NY, USA: ACM, pp. 129–136. Available at:
hRp://doi.acm.org/10.1145/642611.642635
WesOn, A. F. (1967). Privacy and Freedom. New York: Atheneum

Why
Privacy
“[Privacy is] the ability of the individual to control the terms under which personal
information is acquired and used’’ (Westin 1967:7).
“As a [dynamic boundary regulation] process, privacy is understood to be under
continuous negotiation and management, with the boundary that distinguishes
privacy and publicity reﬁned according to circumstance” (Palen & Dourish
2003:129).
“[…] the problem of control over personal data has become inextricably linked to
problems of personal choice, autonomy, and socio-economic power” (Acquisti et al.
2015:509).

Why is to be in control of personal information so difficult?
Technological determinants
{
Data disclosed by smartphone devices allow re-identification of users
•  […]in a dataset where the location of an individual is specified hourly, and
with a spatial resolution equal to that given by the carrier’s antennas, four
spatio-temporal points are enough to uniquely identify 95% of the [half
million] individuals (de Montjoye et al. 2013).
•  […] previous research has shown that as of the year 2000, 63% of the US
population could be uniquely identified by gender, zip code, and date of
birth, without reference to other factors (Golle 2006 in Book 2015)
Source:
Book, T.R., 2015. Privacy Concerns in Android Adver<sing Libraries. Thesis. Available at: hRps://scholarship.rice.edu/handle/1911/87711
Golle, P., 2006. RevisiOng the Uniqueness of Simple Demographics in the US PopulaOon. In Proceedings of the 5th ACM Workshop on Privacy in Electronic
Society. WPES ’06. New York, NY, USA: ACM, pp. 77–80. Available at: hRp://doi.acm.org/10.1145/1179601.1179615
De Montjoye, Y.-A. et al., 2013. Unique in the Crowd: The privacy bounds of human mobility. Scien<fic Reports, 3. Available at: hRp://www.nature.com/
doifinder/10.1038/srep01376

Economic determinants
{
Abundance of free available contents (no up-front costs)
•  Rougly 90% of android applications on the Google Play Store are free;
Developers need to ﬁnd alternative revenue-model (mostly by
advertisement)
•  Targeted advertising uses users’ personal data to increase the odds that an
advertisement presented to the user will result in a return (perhaps as a result
of a sale) to the advertiser (Evans 2014)
Source:
Evans, D.S., 2014. Rivals for ACen<on: How Compe<<on for Scarce Time Drove the Web Revolu<on, What it Means for the Mobile Revolu<on, and the Future
of Adver<sing, Rochester, NY: Social Science Research Network. Available at: hRp://papers.ssrn.com/abstract=2391833 [Accessed February 8, 2016].

Enomic determinants
0
500000
1000000
1500000
2000000
2500000
March 19 2011
July 6 2011
August 27 2011
September 23 2011
October 16 2011
November 23 2011
December 24 2011
January 23 2012
February 25 2012
March 16 2012
April 7 2012
May 16 2012
June 28 2012
August 16 2012
September 24 2012
October 28 2012
January 22 2013
April 15 2013
June 25 2013
September 15 2013
October 21 2013
January 22 2014
July 6 2014
October 6 2014
February 14 2015
March 31 2015
April 30 2015
August12 2015
September 5 2015
December 23 2015
February 18 2016
n° of apps
Reference period
The growth of applica5ons in the Google Play Store from 2011 to 2016
paid
free
Source:
ElaboraOon using data from Appbrain.com

Enomic determinants
0%
10%
20%
30%
40%
50%
60%
70%
80%
90%
100%
Composi5on of the marketplace
Reference period
The distribu5on of free and paid apps in the Google Play Store from 2011 to 2016
paid
free
Source:
ElaboraOon using data from Appbrain.com

Enomic determinants
Source:
hRp://www.lumapartners.com/lumascapes/mobile-lumascape
hRps://www.linkedin.com/pulse/20140616180457-72245968-mobile-ad-lingo-dsp-ssp-dmp-rtb-and-programmaOc-all-explained

The mobile marketing
ecosystem (MME) is the network
of interconnected operators and
subsidiaries platforms which
collaborate and compete for the
delivery of targeted ads.

Enomic determinants
Source:
www.amobee.com
Book, T.R., 2015. Privacy Concerns in Android Adver<sing Libraries. Thesis. Available at:
hRps://scholarship.rice.edu/handle/1911/87711
“[…] it is "clear that the privacy impact of mobile ads extends well beyond the
realm of mobile ad targeting” (Book 2015: 99)

Political determinants
Conflicting interests between govs and citizens
NSA slide on the agency's 'perfect scenario' for
obtaining data from mobile apps.
Conflicting interests between users and
platform owner
Google is both the owner of the Google Play
Store, the official Android’s applications
marketplace and ADMob, the largest AD
network for mobile devices.
Source: http://www.theguardian.com/world/2014/jan/27/nsa-gchq-
smartphone-app-angry-birds-personal-data

Why is to be in in control of personal information so diﬃcult?
Behavioural determinants
{
Unawareness
•  Users have limited level of awareness about the collection of personal
information;
•  Leakage of personal data is invisible and information often incomplete;
•  EULA and privacy policy fail to inform users about relevant threats for
privacy;
•  Privacy permissions do not help users to understand implications for privacy.
Secondary concern
•  App’s functionalities and the desire to own it for free are often more relevant
to users than their implications for privacy;
•  Outcomes of the data disclosure are often unknown;
•  The desire to share is a powerful motivator than possible privacy threats;
Limited rationality
•  Privacy paradox;
•  Control Paradox;
•  Personalisation paradox

Why
Wicked problem
Source:
Buchanan, R., 1992. Wicked Problems in Design Thinking. Design Issues, 8(2), pp.5–21.
[in design thinking, wicked problems are] "class of social system problems which are
ill-formulated, where the information is confusing, where there are many clients and
decision makers with conﬂicting values, and where the ramiﬁcations in the whole
system are thoroughly confusing” (Buchanan 1992:15).

Why
Research methodology
Methodology
(or research
approach)
philosophical
framework and the
fundamental
assumptions of
research*
Research through design (RtD)
•  RtD is a research approach based on the assumption that designing often
lead to generalizable knowledge which employs methods and processes
from design practice as a legitimate method of inquiry (third wave of HCI)
(Zimmerman et al. 2010; Steppers 2006);
•  In RtD prototypes can play a number of roles and are the core means by
which the designer builds the connection between ﬁelds of knowledge, and
iterates toward a product (Sanders & Stappers 2014; Steppers 2006);
•  RtD is the results of the shift of the HCI community from actual problem
and usability to Wicked Problems (Zimmerman et al. 2010; Steppers
2006);
Research
design
plan of action that links
the philosophical
assumptions to speciﬁc
methods*
Mixed methods
•  “As a method, it focuses on collecting, analyzing, and mixing both
quantitative and qualitative data in a single study or series of studies”
Creswell & Plano Clark (2011:5);
•  Mixed method research is common in HCI (van Turnhout et al. 2014).
Source:
*Creswell, J.W. & Plano Clark, V.L., 2011. Designing and conducting mixed methods research 2nd ed.., Los Angeles: SAGE
Publications.

Why
Research design | Validating solution design research pattern
{
•  Starting point for this approach can be an
unsolved problem, deficiencies in existing
solutions, or the need to illustrate a novel vision
or idea with concrete examples;
•  [it] is an effective way to further the state of
the art and to ‘push’ new ideas and
interaction techniques;
•  It can efficiently bridge rigor and relevance,
although some lab studies fail to touch the ‘real’
application domain if this is not clearly defined
upfront.
Source:
Van Turnhout, K. et al., 2014. Design Patterns for Mixed-method Research in HCI. In Proceedings of the 8th Nordic
Conference on Human-Computer Interaction: Fun, Fast, Foundational. NordiCHI ’14. New York, NY, USA: ACM, pp. 361–370.
Available at: http://doi.acm.org/10.1145/2639189.2639220

Why
Research design
Source:
Elaboration from van Turnhout et al. (2014)

How
Studies
1 | Collecting and
analysing
application’s data leakage
(longitudinal, MITM approach)
Res. design: Quan.
Methods:
•  Dynamic analysis
2 | Understanding
and ranking
users’ opinion, mental model,
expectation gap
Res. design: QUAN+Qual
Methods:
•  Large-scale online survey;
•  Semi-structured interviews.
3 | Designing and
evaluating
novel visualisation
solutions
Res. design: QUAN+Qual;
Methods:
•  Design diary;
•  Online survey;

How
Collecting and analysing
Objective •  to build a dataset of personal information
shared by applications in order to be used
in the following phase of the research.
Research
questions
•  What are the typologies of personal
information that can be collected and
shared by the applications installed on
the phone without users awareness?
Methods •  Systematic literature review of studies
concerning data leakage from
smartphone applications using dynamic
analysis approach;
•  Collecting and analysing applications
data leakage from 65 Android
applications using the MITM approach;
{

How
Privacy feed
{
Privacy Feed is a platform for dynamically
surveying data shared by mobile apps.
It uses the Man-in-the-Middle (MITM)
approach to collect and store all the
outgoing traﬃc using http and https
protocol, also allowing to manually add
metadata information to any piece of
information contained by logs.
Privacy Feed is being developed in collaboration with Saverio Rizza

How
Privacy feed
1 Traﬃc interception
Outgoing traﬃc, GET / POST requests by applications
and third-party libraries, to external servers is being
intercepted using MITM proxy server.
{

How
Privacy feed - Traﬃc interception architecture

How
Privacy feed
Outgoing traﬃc, GET / POST requests by applications
and third-party libraries, to external servers is being
intercepted using MITM proxy server.
2 Log collection, normalisation and storage
The diﬀerent components of the logs (e.g. url,
parameters, values) are stored in the relational DB
{

How
Privacy feed - Log collection, normalisation and storage

How
Privacy feed
Any outgoing traﬃc such as GET / POST requests by
applications and third-party libraries to external servers
are being intercepted using MITM proxy server.
3 Adding metadata information (tagging)
Labels (e.g. privacy-sensitiveness, data typology, data
category, privacy rank) can be manually added to each
parameter contained in the logs.
{

How
Adding metadata information – tagging interfaces

How
Adding metadata information – ranking interface

How
Privacy feed
Any outgoing traﬃc such as GET / POST requests by
applications and third-party libraries to external servers
are being intercepted using MITM proxy server.
3 Adding metadata information (tagging)
Labels (e.g. privacy-sensitiveness, data typology, data
category, privacy rank) can be manually added to each
parameter contained in the logs.
4 Metadata restitution
{

How
Privacy feed – Metadata restitution

How
Study 1 – Longitudinal analysis of 65 free and paid
Android’s Apps
{
Longitudinal study with 65 popular Androids applications (25 free,
20 freemium, 20 preemium) from 8 Google play categories.
n" Objectives"
01" Privacy2sensitive"data"typologies"leaked"by"applications"
02" Frequency"of"the"data"leakage"
03" Destination"of"the"data"leakage"(third2parties"typologies)"
04" To"rank"leaked"privacy2sensitive"data"according"to"their"privacy2sensitiveness"
05" Overview"of"the"data"leakage"per"application"categories"
06" Data"leaked"while"using"the"application"vs"data"leaked"in"background"
07" Data"leaked"by"freemium"(free)"vs"premium"(paid)"apps"
"

How
Understanding and ranking
Objective To understand people’s opinion and feelings about
privacy-sensitive information leaked by
applications.
Research
question
What type of information are smart phone users
most concerned about being leaked from their
phones?What would they feel in case such
information have been shared by applications?
What would they do if this happened?
Methods •  Online large-scale survey;
{

How
Understanding and ranking
Objective To design and evaluate visualisation solutions using
runtime data that can improve users’ awareness and
control over data disclosed by applications installed on
the smartphone.
Research
question
How does runtime data collected from applications
can be provided to users in order to improve their
awareness about information disclosure as well as to
support them in the decision-making?
Methods •  Design diary;
•  Online survey;
•  Semi-structured interviews;
{

Summary and conclusions
What, why, how
What The aim of this research is to find novel and effective solutions to
feeding back privacy-sensitive runtime data to users in order to
raise their awareness and improve their control over unintended
data disclosure.
Why While smartphone privacy-sensitive runtime data has been proved
to be effective in order to raise users’ awareness and understanding
about the apps’ behaviour, there is a gap in knowledge on how such
information can be visualised and fed back;
How Using the research through design (RtD) approach and mixed
method research design to develop and assess novel data
visualisation interfaces.

Summary and conclusions
Limitations and future work
Limitations In this research the feedback visualisations will be
evaluated through lab study.
However, a ﬁeld study is recommended in order to
understand how users behave while being exposed to
privacy feedback information in the real world setting.
Future work Future work on the privacy feedback should focus on ﬁeld
study.

How
Privacy feed – next step

Thank you
Alessandro Carelli, Ph.D student
Loughborough Design School, LDS 1.23
Loughborough University, LE11 3TU, UK
A.Carelli@lboro.ac.uk
@inf_overload

Introduction to privacy feedback research @ DesRes2016

Recommended

Recommended

More Related Content

What's hot

What's hot (20)

Similar to Introduction to privacy feedback research @ DesRes2016

Similar to Introduction to privacy feedback research @ DesRes2016 (20)

More from Alessandro Carelli

More from Alessandro Carelli (8)

Recently uploaded

Recently uploaded (20)

Introduction to privacy feedback research @ DesRes2016