Everybody wants to achieve privacy by design? But how do you do that? This slideshare will show you how. What is privacy? What thought processes will bring about understanding of the security measures to take in order to ensure your users privacy?

1. LESSONS IN PRIVACY ENGINEERING
FROM A NATION-SCALE IDENTITY SYSTEM
A DAVID KELTS
DIRECTOR | ARCHITECT | PROOFING | MOBILE IDENTITY
DIGITAL LABS
@DAVIDKELTS

2. WHAT IS IDENTITY?
 A provisioned account from which SSO can happen
 Confirmation of the physical user at transaction time
 A large set of attributes that resolve to a single entity
 The individual behind the resolved attributes

3. THE LAWS OF IDENTITY SYSTEMS
PUBLISHED IN 2005 BY KIM CAMERON, MICROSOFT DIRECTOR OF IDENTITY,
TO SUCCEED, UNIFYING IDENTITY SYSTEMS MUST…
1.User Control and Consent
2.Minimal Disclosure for Limited Use
3.Law of Fewest Justifiable Parties
4.Directed Identity: don’t release correlation handles
5.Pluralism of Operators and Technologies
6.Integrated, Unambiguous Machine to Human Communication
7.Consistent Experience Across Contexts
Systems that violate any
of these laws will
eventually fail since they
fail their users and their
own original intent
https://msdn.microsoft.com/en-us/library/ms996456.aspx

4. WHAT IS PRIVACY?
 Giving our User a solid sense of control over their identifying information
that is consistent with our systems’ actual functioning
 Safeguarding all the identifying info that our systems collect
 Covering our legal exposure against users who have a problem with the way that our
systems use their PII
 Reducing the “creepy” feeling users get when we use their identity attributes and
identifying information

5. FOUNDATIONAL PRINCIPLES OF PRIVACY
CAPTURED IN 1995 BY ANN CAVOUKIAN, PH.D. INFORMATION & PRIVACY COMMISSIONER, ONTARIO, CANADA
AND NETHERLANDS DATA PROTECTION AUTHORITY
1. Proactive not Reactive; Preventative not Remedial
2. Privacy as the Default Setting
3. Privacy Embedded into Design
4. Full Functionality — Positive-Sum, not Zero-Sum
5. End-to-End Security — Full Lifecycle Protection
6. Visibility and Transparency — Keep it Open
7. Respect for User Privacy — Keep it User-Centric
So how can I take
action to actualize
these Principles?
https://www.ryerson.ca/pbdce/certification/seven-foundational-principles-of-privacy-by-design/

6. INFORMATION HANDLING PRINCIPLES
• Collection Limitation
• Data Quality & Integrity
• Purpose Specification
• Use Limitation
Lifecycle: DestroyRetainDiscloseUseValidateCollect
• Security Safeguards
• Openness, Transparency
• Individual Participation
• Accountability
http://www.oecd.org/sti/ieconomy/informationsecurityandprivacy.htm
http://laws-lois.justice.gc.ca/eng/acts/P-8.6/index.html
Assumption that data is an asset… and to be handled

7. ACTUALLY… DATA IS A LIABILITY
• Total Cost of Ownership is Very High
• Absence of Data means an Absence of Leaks
• To date, our mechanism to Collect has terrible usability

8. INTERACTIVE INFORMATION PRIVACY
Lifecycle: DestroyRespectLog
• At LOA1
UseAsk
• Individual Participation
• Purposeful, Consent Driven, User-Managed
• Supports Self-Sovereign Identity
Wouldn’t a user grant
persistent consent to an
IIP System?
©⓴⓯ @davidkelts

9. CONCEPTUALIZATION OF IIP
INTERACTIVE INFORMATION PRIVACY
User Knowledge
and Control
Over…
Personal
Info
Retained
Entities
Shared
With
Core &
Presented
Attributes
Behavior
& Usage
Data
Purpose
for
Collecting
or
Sharing
• An individual owns their identity
• Return control and management to the
owner of the identity
• Be appropriate for transaction use cases
• Establish Limits, Let User Establish Limits
©⓴⓯ @davidkelts
Score your system on how close to center
your implementation actually functions

10. HOW DO I GET THERE?
HOW TO DESIGN FOR INTERACTIVE INFORMATION PRIVACY, PBD
1) START WITH YOUR FIRST PRINCIPLES
https://en.wikipedia.org/wiki/First_principle

11. 2) ANALYZE YOUR
APPLICATION DATA FLOWS
Look at each step where you …collect, validate, use, disclose,
retain, destroy… in your data flows with empathy for your user
There isn’t really a shortcut to the art in this process until we
make it a science within our industry

12. 3) CONCEPTUALIZE WHAT YOUR APP DATA
FLOWS CAN DO TO YOUR USER?
Potential
Harms
Power
Imbalance
Discrimination Stigmatization
Loss Self
Determination
Loss of
Autonomy
Exclusion
Lack of
Liberty
Confusion
Loss of
Trust
Economic
Loss
Physical
Harm
When you think of Potential
Harm to your user, you can
begin to find your Problematic
Data Actions
http://www.nist.gov/itl/csd/upload/nist_privacy_engr_objectives_risk_model_discussion_deck.pdf

13. HOW WOULD YOU REDESIGN AGAINST?
• Stigmatization
• Loss of Self-
Determination
• Physical Harm
• Loss of Trust
• Morality aside… this is the poster child for use
case of Anonymity and Pseudonymity
• Breaks down when you “need” name to collect
monthly payment using payment processors who
don’t trust identity… w/o holding attributes

14. 4) IDENTIFY YOUR PROBLEMATIC DATA ACTIONS
WHEN YOUR SYSTEM DOES NOT PUT YOUR USER IN CONTROL OF
THEIR PII… WHEN YOU “HANDLE” PII FOR THEM, YOU CAN CAUSE:
http://www.nist.gov/itl/csd/upload/nist_privacy_engr_objectives_risk_model_discussion_deck.pdf
Induced Disclosure
Insecurity
Distortion
Surveillance
Unanticipated
Revelation
Unwarranted
RestrictionAppropriation
©⓴⓯ @davidkelts

15. HOW DO YOU FEEL ABOUT?
Name
Cell phone number
Date of Birth
Marital Status
Mother’s Maiden Name…
Web sites you visit
Where you were at 9pm?
• Surveillance
• Unanticipated Revelation?
Induced Disclosure
Appropriation
Unanticipated Revelation
Privacy as the Default Setting

16. HOW WOULD YOU DESIGN FOR US SOCIETY?
• Lack of Liberty
• Stigmatization
• Loss of Trust
• Surveillance
• Economic Loss
Follow law of Directed Identity: Prevent unnecessary release of correlation handles
• US Citizens - 240 year old distrust of Big Government… grown stronger
• eGov SSO breaks down if correlated or can trace citizen daily life
• Cannot leak identifying info about FNS beneficiaries
• Medical situation can’t stigmatize user from services or privs
• Would citizen stop carrying phone if they feel surveillance?

17. Ownership
Purpose
for Use
Consent
User
Experience
IIP, Privacy gets DESIGNED into a System as the Default
Data
Security
Redress &
Support
Happy
Consumer
(Sales)
Principles, Policy Design Operational
Mechanisms
Enforcement

18. TOP PRIVACY CONCERNS OF THE USER OF MDL
A. Correlating/Tracking my ID usage across RPs
1. State Gov’t Tracking Across Commercial RPs
2. My IDP Tracking Across State Gov’t sites
B. People will steal my official verified data from my
phone (Wi-Fi, Bluetooth) without me knowing
C. Now my real DL is in cloud for hackers to steal
D. My IDP will share or resell my data with entities I don’t
specifically authorize
E. I hate reading legal privacy notices, they’re going to
grab and use my data no matter what I do
F. State (or My IDP) will track my location using identity
G. Help desk access to my PII -resells, misuses it
PNF
RegLoc
Bar
CloudDL
Biom
GvTrack
MTTrack
RPs
DataTrvl
StigFNSSelfie
LoseBiom
StolenPh
UsgLoc
PhDataHack
HelpDsk
MTResell
DataSync
Accurate
ChPolicy
0
5
10
15
20
25
30
35
40
45
50
0 2 4 6 8 10
Impact
Likelihood
Problem Prioritization Heat Map
NISTIR 8062 Privacy Risk Assessment Methodology (PRAM)

19. PAIRWISE PSEUDONYMOUS (NON-
CORRELATABLE) USER IDENTIFIERS
A/K/A PRIVACY PROTECTING USER IDENTIFIERS (PPUID)
Unique identifiers to each different service the user accesses
Support added to open source and Gluu Server
Service Providers who utilize pair-wise cannot correlate usage
Coordinating all of a User’s state-level services could be
seen as a benefit of using an online SSO system
Who does the User believe she has a relationship with?
1
2 3
A Correlating/Tracking my ID usage across RPs

20. PRIVACY AND LEGAL NOTIFICATIONS
WHAT THE APP WILL DO WITH MY PII
Citizen Managed Identity App
User Managed Access
Policies for Attribute Sharing – Scopes that have LOA
attached to them within the IDP software itself.
You can always access our privacy policy through the
menu on the top right of the App.
D My IDP will share or resell my data with entities I don’t authorize
E I hate reading legal privacy notices, they’re going to grab and use
my data no matter what I do
Your data will not be shared
with any Entity by our IDP
without your explicit approval
using a card like this one.
AgreeCancel

21. IT IS IMPERATIVE THAT WE GET PRIVACY RIGHT SOON…
• Imagine IoT devices sensing & posting
• And turning data loose to fast Analytics
algorithms across grid computing
In just 5 years we have already seen
the buildup of negative reaction
from consented posting of personal
actions, data, life events, and
relationships (even with untagging)
Consumers will figure this out and
redress the impact to their life, they
will make purchase decisions in their
best interest, which is privacy.
IIP –
Interactive
Information
Privacy
@DavidKelts