Enacting Privacy in Internet Standards by Nicholas P Doty A

Enacting Privacy in Internet Standards By Nicholas P Doty A dissertation submitted in partial satisfaction of the requirements for the degree of Doctor of Philosophy in Information Management & Systems in the Graduate Division of the University of California, Berkeley Committee in charge: Professor Deirdre K. Mulligan, Chair Professor Kenneth A. Bamberger Professor Jenna Burrell Fall óþóþ Õ Abstract Enacting Privacy in Internet Standards by Nicholas P Doty Doctor of Philosophy in Information Management & Systems University of California, Berkeley Professor Deirdre K. Mulligan, Chair e functionality of the Internet and the Web are determined in large part by the design of technical standards that allow for interoperable implementations. ose design decisions are important both in terms of functionality and in main- taining basic public policy values including accessibility, freedom of expression, privacy and security. is is one instance of a phenomenon variously referred to as values-in-design or from another angle technological delegation: fundamental matters of public policy importance can be determined or regulated by soware architecture, in much the way that urban architecture has. Technical standard-setting bodies, like the Internet Engineering Task Force (IETF) and the World Wide Web Consortium (WìC), are multistakeholder organizations that host groups that dene Internet standards. In contrast to multilateral bodies (like the United Nations) or state bureaucracies or rms, participants are drawn from competing companies across dierent industry sectors, as well as gov- ernments and civil society groups, and make decisions based on rough consensus and working implementations. is represents a distinct form of new governance where collaborative development of technical and policy solutions can be enacted outside traditional legislative or administrative bodies. Standard-setting participants are most oen engineers; their discussions are technical and wide-ranging, distributed between in-person meetings, email lists, online chat and version-controlled text and soware. Web standards include HTML, the foundational markup language that denes Web pages, and Do Not Track, a syntax and system for communicating user privacy preferences about online behavioral tracking. Some standards, like HTML, have been widely adopted and support some of the world’s most used soware, while others, like DNT, have seen limited adoption and little direct eect. ó is work seeks to understand how privacy and other values get enacted in the technical standards and running soware that make up the Internet we use. At the highest level, it considers these two related research questions: Õ. What are the impacts of multistakeholder techno-policy standards-setting processes on resolving public policy disputes for the Internet? ó. How do the views of the designers of the Internet’s underlying protocols aect the privacy of Internet and Web users? To start to answer these, I have explored the community of standard-setting participants and their beliefs about privacy and security in their lives and work. And I have investigated the unusual consensus decision-making process used in technical standard-setting and perspectives, from newcomers and long-time participants, on its fairness and ecacy and how it applies to values such as privacy. Private interviews with participants working on Do Not Track and other standards provided candid and diverse perspectives on the concept of privacy, multistakeholder processes and the role of technical standards for interoperability and for policy-related areas. And the extensive documentation and technologically- mediated communication methods of these Internet standard-setting venues en- abled some supplementary quantitative analysis of the patterns of participation. Multistakeholder standard-setting processes bring together diverse participants from a wide variety of organizations with a wide variety of backgrounds and goals. Individuals navigate a tricky balance of being both experts collaborating and representatives negotiating. While this novel cross-boundary process provides real opportunity, it also provides real diculties of bad faith behavior, entrenchment and conict. And while access and transparency of processes may improve upon some alternatives, technical standard-setting continues to be Western-oriented, male-dominated and intensely time-consuming. Participants hold competing views of privacy and recognize that the priorities and concerns of Internet users may vary widely. While privileged community members may not have as much to risk when it comes to their own online privacy, the distinct wants and needs of their own children provide a compelling touchstone. Sometimes the work of privacy has been reduced to compliance with laws or best practices, but it remains an area where professionals actively pursue debate and development of policy. e social, legal and technical architecture of the Internet and the Web deter- mine so much about the lives of people around the world and deserve the attention of research on their impacts. Using consensus-based multistakeholder processes ì focused on interoperability for the Internet presents real, new opportunities to enact privacy by intentionally taking advantage of handos between social, technical and organizational factors. At the same time, this work highlights some of the challenges to convening for, equitably designing, agreeing on and implementing these techno-policy standards. Training people in intersecting disciplines, devel- oping systematic processes and building technical and decisional tools can all contribute to better support for privacy, security and the other fundamental but still contested values we want to see in the Internet. i Acknowledgments anks to my advisors, colleagues, friends and family. anks to colleagues and friends in the Doctoral Research and eory Work- shop and Berkeley writing groups over the last several years, both for sharing their own work so that I could learn from their practices and for reviewing several chapters of this dissertation and providing thorough, kind and constructive feedback. anks to colleagues at the World Wide Web Consortium (WìC) and Internet Engineering Task Force (IETF) and in the tech eld generally for encouraging me to learn and contribute. While I fear that these settings are not as accessible or welcoming as they could or should be, I know that I have beneted from being able to participate. anks to my interviewees for their trust in me, candor about their own experiences and generosity with their time and expertise. anks to my dissertation committee – Deirdre K. Mulligan, Jenna Burrell and Kenneth A. Bamberger – for their patience and insight; and to Paul Duguid for his useful advice, regarding my dissertation prospectus and in general. anks to faculty and students at UC Berkeley and the School of Information for introducing me to ideas and challenging the ones I had; in particular: Calvin Morrill for his seminar on the sociology of law and organizations; Jenna Burrell for her introduction to qualitative research methods; the Classics reading group for critical analysis of the history of technology; and Technology & Delegation for exploring many of the fundamental ideas of this work. anks to collaborators with whom I’ve had the pleasure to work on the following projects (incomplete lists, forgive me): • BigBang: Seb Benthall, Niels ten Oever and Corinne Cath; • privacy design patterns: Mohit Gupta and Jaap-Henk Hoepman; • essentially-contested concepts: Deirdre K. Mulligan and Colin Koopman; • handos: Deirdre K. Mulligan, Helen Nissenbaum and Richmond Wong; and, • the Center for Technology, Society & Policy: Galen Panger, Deirdre K. Mulligan, Steve Weber and Anno Saxenian. anks to the sta of the School of Information for keeping things running, in particular: Kevin Heard and Gary Lum for providing technical infrastructure and Inessa Gelfenboym Lee for helping me through writing and bureaucracy. ii anks to John MacFarlane for pandoc and for standardizing CommonMark; thanks to Kieran Healy for LaTeX templates and for popularizing plain text social science; and thanks to the many contributors who have built the SciPy ecosystem. anks to conveners and participants at the venues where I have had the opportunity to present work in progress, get essential feedback and learn from others, including: the International Workshop on Privacy Engineering, the Com- puting Community Consortium’s Privacy by Design Workshops, the Trustbusters Workshop at the Symposium on Usable Privacy and Security, TPRC, the Web ó.þ Security and Privacy Workshop, South By Southwest, the TRUST Center, the Human Rights Protocol Considerations Research Group, the Alan Turing Insti- tute’s Protocol Governance Group, and, most especially, the Privacy Law Scholars Conference. Funding Funding to support the research included in this dissertation and related work has been provided by: • the Berkeley Center for Law & Technology, through a grant from the Nokia Corporation; • the US Department of Homeland Security (DHS) under Grant Award no. óþþä-CS-þþÕ-þþþþþÕ, under the auspices of the Institute for Information Infrastructure Protection (IìP) research program managed by Dartmouth College; • the Team for Research in Ubiquitous Secure Technology (TRUST) Center, which receives support from the National Science Foundation (kþ¦ó¦¦óó); • INSPIRE: Value-Function Handos in Human-Machine Compositions, awarded by the National Science Foundation (kÕä¢þ¢É);

Load more