Security or Privacy: Can You Have Both?

20 C O M P U T E R P U B L I S H E D B Y T H E I E E E C O M P U T E R S O C I E T Y U.S. Government work not protected by U.S. Copyright. Since 1971, there have been more than 300 articles published in Computer on the topic of electronic privacy and about three times that number on cybersecurity, with many of these articles covering both topics. Roughly a third of all these articles appeared within the past five years, indicating that there is a lot of interest in security and privacy. These statistics are also telling in that Computer competes for content with other IEEE Computer Society publications, particularly IEEE Security and Privacy, which was first published in 2003. In their seminal article from 2004, Avižienis et al.1 treated security as one of the attributes of dependable systems, defining depend abi l it y as “the ability to deliver service that can justifiably be trusted.” They made no reference to privacy. Likewise, that same year, Voas2 mentioned security but not privacy as one of the many quality attributes of software. Looking back at these articles, one might ask, for instance, “Why wouldn’t we want both security and privacy, given our dependence on the navigation apps on our smartphones and that we need to not only trust in the integrity of the data these apps use to compute travel routes but also in the protection of the privacy of our location data? What are the tradeoffs among security, privacy, and other system attributes, such as testability?” In a systems context, it seems natural to think about the interplay between security and privacy requirements, policies, and mechanisms. Given the seemingly ever-growing impact of security and privacy on society, from electronic voting to computer-based contact tracing to automated driving, we thought the readers of Computer would benefit from a virtual roundtable in which a panel of experts provide its views on the relationship between security and privacy. To draw the attention of prospective panelists, we posed a highly charged teaser question. Is the relationship between the two terms best described as 1) security or privacy or 2) security and privacy; that is, can you have both? Our tactic had the intended effect. We received feedback on the title of the roundtable even before we made the questions available to the panelists. (See “Roundtable Digital Object Identifier 10.1109/MC.2020.3004606 Date of current version: 4 September 2020 Security or Privacy: Can You Have Both?