PETs and their users: a critical review of the potentials and limitations of the privacy as confidentiality paradigm

Abstract“Privacy as confidentiality” has been the dominant paradigm in computer science privacy research. Privacy Enhancing Technologies (PETs) that guarantee confidentiality of personal data or anonymous communication have resulted from such research. The objective of this paper is to show that such PETs are indispensable but are short of being the privacy solutions they sometimes claim to be given current day circumstances. Using perspectives from surveillance studies we will argue that the computer scientists’ conception of privacy through data or communication confidentiality is techno-centric and displaces end-user perspectives and needs in surveillance societies. We will further show that the perspectives from surveillance studies also demand a critical review for their human-centric conception of information systems. Last, we rethink the position of PETs in a surveillance society and argue for the necessity of multiple paradigms for addressing privacy concerns in information systems design.

[1]  Elizabeth D. Mynatt,et al.  Privacy Mirrors: Understanding and Shaping Socio-technical Ubiquitous Computing Systems , 2002 .

[2]  Josep Domingo-Ferrer,et al.  A Critique of k-Anonymity and Some of Its Enhancements , 2008, 2008 Third International Conference on Availability, Reliability and Security.

[3]  W. Orlikowski.  Sociomaterial Practices: Exploring Technology at Work , 2007 .

[4]  Antoinette Rouvroy,et al.  Technology, Virtuality and Utopia. , 2009 .

[5]  J. D. Babcock.  A brief description of privacy measures in the RUSH time-sharing system , 1967, AFIPS '67 (Spring).

[6]  Sandra Braman,et al.  Tactical memory: The politics of openness in the construction of memory , 2006, First Monday.

[7]  Cornelius E. Gallagher,et al.  The computer and the invasion of privacy , 1967, SIGCPR '67.

[8]  S. Graham.  Software-sorted geographies , 2005 .

[9]  Lise Getoor,et al.  To join or not to join: the illusion of privacy in social networks with mixed public and private user profiles , 2009, WWW '09.

[10]  Herman T. Tavani,et al.  Privacy protection, control of information, and privacy-enhancing technologies , 2001, CSOC.

[11]  Ashwin Machanavajjhala,et al.  l-Diversity: Privacy Beyond k-Anonymity , 2006, ICDE.

[12]  D. Zwick,et al.  Whose Identity Is It Anyway? Consumer Representation in the Age of Database Marketing , 2004 .

[13]  Vitaly Shmatikov,et al.  Myths and fallacies of "Personally Identifiable Information" , 2010, Commun. ACM.

[14]  Willis H. Ware,et al.  Security and privacy: similarities and differences , 1967, AFIPS '67 (Spring).

[15]  David Chaum,et al.  Security without identification: transaction systems to make big brother obsolete , 1985, CACM.

[16]  Daniel J. Solove.  A Taxonomy of Privacy , 2006 .

[17]  M. Angela Sasse,et al.  Not seeing the crime for the cameras? , 2010, Commun. ACM.

[18]  Serge Gutwirth,et al.  Privacy and the Information Age , 2001 .

[19]  John Leubsdorf,et al.  Privacy and Freedom , 1968 .

[20]  Jack Rosenberger.  CS and technology leaders honored , 2010, Commun. ACM.

[21]  Nick Mathewson,et al.  Reputation in privacy enhancing technologies , 2002, CFP '02.

[22]  J. Doug Tygar,et al.  Why Johnny Can't Encrypt: A Usability Evaluation of PGP 5.0 , 1999, USENIX Security Symposium.

[23]  H. Nissenbaum.  Privacy as contextual integrity , 2004 .

[24]  Benjamin Fabian,et al.  Emerging Markets for RFID Traces , 2006, ArXiv.

[25]  Alessandro Acquisti,et al.  Information revelation and privacy in online social networks , 2005, WPES '05.

[26]  Latanya Sweeney,et al.  k-Anonymity: A Model for Protecting Privacy , 2002, Int. J. Uncertain. Fuzziness Knowl. Based Syst..

[27]  H. E. Petersen,et al.  System implications of information privacy , 1899, AFIPS '67 (Spring).

[28]  Nicola Zannone,et al.  Towards the development of privacy-aware systems , 2009, Inf. Softw. Technol..

[29]  Stuart Reeves,et al.  Facebook as a political weapon: Information in social networks , 2009 .

[30]  James A. Landay,et al.  Personal privacy through understanding and action: five pitfalls for designers , 2004, Personal and Ubiquitous Computing.

[31]  Raj Sharman,et al.  Handbook of Research on Social and Organizational Liabilities in Information Security , 2008 .

[32]  David Lyon,et al.  Surveillance Studies: understanding visibility, mobility and the phenetic fix. , 2002 .

[33]  Edward L. Glaser,et al.  A brief description of privacy measures in the multics operating system , 1967, AFIPS '67 (Spring).

[34]  Paul Ohm.  Broken Promises of Privacy: Responding to the Surprising Failure of Anonymization , 2009 .

[35]  Willis H. Ware,et al.  Security and privacy in computer systems , 1899, AFIPS '67 (Spring).

[36]  Paul Dourish,et al.  Unpacking "privacy" for a networked world , 2003, CHI '03.

[37]  Oliver Günther,et al.  Privacy in e-commerce: stated preferences vs. actual behavior , 2005, CACM.

[38]  Cynthia Dwork,et al.  Differential Privacy , 2006, ICALP.

[39]  David Lyon,et al.  Surveillance as Social Sorting : Privacy, Risk and Automated Discrimination , 2005 .

[40]  Josep Domingo-Ferrer,et al.  From t-Closeness to PRAM and Noise Addition Via Information Theory , 2008, Privacy in Statistical Databases.

[41]  Hugo Liu,et al.  Unraveling the Taste Fabric of Social Networks , 2006, Int. J. Semantic Web Inf. Syst..

[42]  John E. McGrath,et al.  Loving Big Brother: Performance, Privacy and Surveillance Space , 2004 .

[43]  David J. Phillips.  Privacy policy and PETs , 2001, New Media Soc..

[44]  James P. Titus,et al.  Security and Privacy , 1967, 2022 IEEE Future Networks World Forum (FNWF).

[45]  Ninghui Li,et al.  t-Closeness: Privacy Beyond k-Anonymity and l-Diversity , 2007, 2007 IEEE 23rd International Conference on Data Engineering.