AAMAS-2017 8-12 May, 2017, Sao Paulo, Brazil

AAMAS-2017 8-12 May, 2017, Sao Paulo, Brazil

• 1.
  An Automated Negotiation Agentfor Permission Management Tim Baarslag, Centrum Wiskunde & Informatica (CWI) Alper T. Alan, University of Southampton Richard Gomer, University of Southampton Muddasser Alam, University of Oxford Charith Perera, The Open University Enrico H. Gerding, University of Southampton M.C. Schraefel, University of Southampton AAMAS, Sao Paolo, May 2017
• 3.
  Meaningless consent Despite beingasked to "agree" constantly to terms of service, consent is not currently "meaningful.” • It is impossible to read all the terms and conditions • Even if we read them, they are clouded in legal language and difficult to understand what it means in practice for most people • Privacy policies are often high level and do not specify exactly who receives our personal data how it is being used • There is often no real choice: it is a take-it-or-leave-it proposition
• 4.
  Why is thisimportant? • Increasing amount information is being collected • Browsing • Social media • Mobile devices • Internet of Things • Potential privacy issues • Many apps collect personally identifiable information (PII) such as voice, contacts, browsing history, text messages, location, etc • Information is in some cases sold to third parties • Leads to mistrust and loss of revenue, and e.g. ad blockers
• 5.
  Current Legal Solutions •EU Cookie Law, adopted May 2011 • The goal was to `make consumers aware of how information about them is collected and used online, and give them a choice to allow it or not' http://www.cookielaw.org/the-cookie-law/ • Issues: • Not many people understand what cookies are • Still not clear how information is being used • Often there is no choice
• 6.
  Opportunities for Agent-BasedResearch In the age of big data and the Internet of Things, one can no longer rely on making all decisions manually. Agents can: • Elicit privacy preferences • Make privacy setting recommendations • Automate privacy decisions • Negotiate privacy agreements
• 7.
  Negotiating App Permissions •We developed an Android App with no intrinsic functionality • Negotiate access to data in return for “points” • Represents level of service obtained • Mined from users’ smartphones: access to all • Contacts • Messages • Apps • Photos • Browsing history
• 8.
  Why app permissions? •Access to very privacy sensitive content • Permissions give no understanding of how information is used • Clearly defined domain (compared to terms and conditions) • Users are already familiar with this domain • Easy to do controlled experiments
• 9.
  Pre-Study Questionnaire Users areasked demographics questions and 3 questions for deriving of a user’s privacy type using Weston’s Privacy Segmentation Index: • Fundamentalists (15%): most protective of privacy • Pragmatists (79%): weigh the potential pros and cons • Unconcerned (6%)
• 10.
  Negotiation Process • Usergets a “default” setting with a given set of permission and number of points • Users can choose what permissions to share and press “quote” to receive an offer in terms of points • Each quote has a small quoting cost, representing effort when users do this in real settings • The user can then accept, press a new quote, or revisit a previous offer. They can also turn all permissions off and receive no points.
• 11.
  The Negotiation Agent •The agent learns the preferences of the user (more about it on the next slide) • Agent negotiates behind the scene by requesting quotes • Uses Pandora’s algorithm to find optimal negotiation strategy • Shows the result through as the default setting • User can accept or continue to negotiation manually (users are not aware of the agent) • Treatment 2: randomly chosen default settings.
• 12.
  Learning User Preferences •Results from previous experiments are used to derive preferences for each privacy type • Each negotiation interaction results in a set of linear constraints: e.g. • If user agrees to share Contacts and Messages for 28 points, we know that: 𝑈 𝐶𝑜𝑛𝑡𝑎𝑐𝑡𝑠 + 𝑀𝑒𝑠𝑠𝑎𝑔𝑒𝑠 ≤ 28 • If users declined such an offer, we derive that: 𝑈 𝐶𝑜𝑛𝑡𝑎𝑐𝑡𝑠 + 𝑀𝑒𝑠𝑠𝑎𝑔𝑒𝑠 ≥ 28 • People of the same type (and even individuals) are not necessarily consistent, and so we find the utility function which maximises the number of constraints satisfied • A user’s privacy type in round 1 is based on “declared” privacy type (from pre-study questionnaire), and in subsequent rounds is updated based on how much users actually share
• 13.
  Review Screen • 3randomly-selected items of each category were “shared” • Users can see exactly what data was shared • Users can express whether they regret their sharing decision for each of the permissions
• 14.
  Evaluation 14 • Lab studyin which participants were asked to download the app on their own smartphones • Deception: any data they shared would be publicly accessible on a website • Users go through 8 different points scenario. • Logged user interactions, post-questionnaire and semi-structured interviews • In total 66 students took part in the study, and received cash between £5 and £10 depending on the overall points earned
• 15.
  Results: Accuracy
• 16.
  Results: sharing and sensitivity • Sharingpercentages and retrospective feelings are comparable • User behavior is aligned with their privacy preferences
• 17.
  Main Results • Ourresults show that the agent can accurately automate privacy decisions on user behalf in line with normal user behavior • However, the analysis of NASA TLX show that agent does not cause less overhead • However, regret is very similar (proportional with amount shared)
• 18.
  Conclusions and FutureWork • Privacy increasingly important in the era of Big Data and the Internet of Things • Negotiation allows for fine-grained agreements, as opposed to the current take-it-or-leave-it approaches • This work presents the initial steps towards achieving meaningful consent while minimising user bother • Future work: • Include the uses of data (the recipient, retention period, purpose, quality, and privacy risks) as part of the negotiation domain • Include more meaningful classification of data (location, time of day, and relation to other people) • Personalized preference models and incremental elicitation • Transfer between different applications/devices, e.g. IoT