The Developer Factor in Software Privacy
Total Page:16
File Type:pdf, Size:1020Kb
The Developer Factor in Software Privacy Mohammad Tahaei Doctor of Philosophy School of Informatics University of Edinburgh 2021 Abstract Computer programming operates and controls our personal devices, cars, and infrastructures. These programs are written by software developers who use tools, software development platforms, and online resources to build systems used by billions of people. As we move towards societies that rely on computer programs, the need for private and secure systems increases. Developers, the workforce behind the data economy, impact these systems’ privacy, and consequently, the users and society. Therefore, understanding the developer factor in software privacy provides invaluable inputs to software companies, regulators, and tool builders. This thesis includes six research papers that look at the developer factor in software privacy. We find that developers impact software privacy and are also influenced by external entities such as tools, platforms, academia, and regulators. For example, changes in regulations create challenges and hurdles for developers, such as creating privacy policies, managing permissions, and keeping user data private and secure. Developers interactions with tools and software development platforms, shape their understanding of what privacy means, such as consent and access control. Presentation of privacy information and options on platforms also heavily impact developers’ decisions for their users’ privacy, and platforms may sometimes nudge developers into sharing more of their users’ data by using design (dark) patterns. Other places developers learn about privacy include universities, though they may not learn how to include privacy in software. Some organisations are making efforts to champion privacy as a concept inside development teams, and we find that this direction shows promise as it gives developers direct access to a champion who cares about privacy. However, we also find that their organisation or the wider community may not always support these privacy champions. Privacy champions face an uphill battle to counter many of the same privacy misconceptions seen in the general population, such as the ‘I’ve got nothing to hide’ attitude. Overall, I find that research in developer-centred privacy is improving and that many of the approaches tried show promise. However, future work is still needed to understand how to best present privacy concepts to developers in ways that support their existing workflows. To my parents Acknowledgements I would like to express by gratitude to my supervisor Dr Kami Vaniea for giving me the freedom to explore my ideas while mentoring me; my collaborators Dr Alisa Frik, Dr Naomi Saphra, and Dr Maria Wolters, for their contributions; my host supervisor at the University of British Columbia, Professor Konstantin Beznosov, for giving an opportunity to experience a different working environment and lab, and his contributions to my research; the committee members of my annual reviews Dr Markulf Kohlweiss and Dr Chris Lucas for their feedback; and the thesis committee Professor Sascha Fahl and Professor John Vines, for reading my thesis and their feedback. I would like to also thank my labmates and friends, Sara Albakry, Kholoud Althobaiti, Lucy Havens, Adam Jenkins, Dilara Kekulluoglu, Florian Mathis, and Nicole Meng, for their feedback, support, and fruitful discussions; Microsoft Research and the School of Informatics at the University of Edinburgh for funding my PhD; and my parents and sisters whose support and encouragement have always driven me forward. Thank you all. Declaration of Authorship and Publications I declare that this thesis was composed by myself, that the work contained herein is my own except where explicitly stated otherwise in the text, and that this work has not been submitted for any other degree or professional qualification except as specified. All chapters except for Chapter1: Introduction and Chapter8: Final Thoughts, are published in peer-reviewed venues. I declare that I substantially contributed to all papers and was involved in all phases of the research process, including study conceptualisation, data collection, data analysis and interpretation, and writing of the papers. All included contributions here are confirmed by the co-authors. I Mohammad Tahaei, Alisa Frik, and Kami Vaniea. 2021. Deciding on Person- alized Ads: Nudging Developers About User Privacy. Symposium on Usable Privacy and Security (SOUPS) 2021. Contributions: MT proposed the initial idea, designed the study, conducted the quantitative analysis, and wrote the first draft of the paper. AF assisted in study design and qualitative analysis. KV provided feedback throughout the project. All authors contributed in the writing. I Mohammad Tahaei and Kami Vaniea. 2021. “Developers Are Responsible”: What Ad Networks Tell Developers About Privacy. Proceedings of the 2021 CHI Conference on Human Factors in Computing Systems Extended Abstracts. ACM, New York, NY, USA, 1–12. DOI: 10.1145/3411763.3451805 Contributions: MT proposed the initial idea, conducted the experiment, and wrote the first draft of the paper. KV provided feedback throughout the project. Both authors contributed in the writing. A position paper was pub- lished in ‘What Can CHI Do About Dark Patterns?’ CHI ’21 workshop [328] based on this paper. I Mohammad Tahaei, Alisa Frik, and Kami Vaniea. 2021. Privacy Cham- pions in Software Teams: Understanding Their Motivations, Strategies, and Challenges. Proceedings of the 2021 CHI Conference on Human Factors in Computing Systems. ACM, New York, NY, USA, 1–15. DOI: 10.1145/3411764.3445768 Contributions: MT proposed the initial idea, designed the study, conducted the interviews, and wrote the first draft of the paper. AF was the second coder for the qualitative analysis, and assisted in study design and recruitment. KV provided feedback throughout the project. All authors contributed in the writing. I Mohammad Tahaei, Kami Vaniea, and Naomi Saphra. 2020. Understanding Privacy-Related Questions on Stack Overflow. Proceedings of the 2020 CHI Conference on Human Factors in Computing Systems. ACM, New York, NY, USA, 1–14. DOI: 10.1145/3313831.3376768 Contributions: MT proposed the initial idea, collected the data, and wrote the first draft of the paper. KV was the second coder for the qualitative analysis and provided feedback throughout the project, and NS did the programming for topic modelling. All authors contributed in the writing. I Mohammad Tahaei, Adam Jenkins, Kami Vaniea, and Maria K. Wolters. “I Don’t Know Too Much About It”: On the Security Mindsets of Com- puter Science Students. 9th International Workshop, STAST 2019, Luxem- bourg City, Luxembourg, September 26, 2019, Revised Selected Papers. In: Socio-Technical Aspects in Security and Trust. Ed. by Thomas Groß and Tryfonas Theo. First Edition. Springer International Publishing, June 2021. DOI: 10.1007/978-3-030-55958-8 Contributions: MT proposed the initial idea, designed and conducted the interviews, and wrote the first draft of the paper. AJ was the second coder for the qualitative analysis. KV closely supervised the project, and MW provided additional feedback throughout the project. All authors contributed in the writing. An early version of this paper was published as a Doctoral Consortium poster in ITiCSE ’19 [322]. I Mohammad Tahaei and Kami Vaniea. A Survey on Developer-Centred Security. 2019 IEEE European Symposium on Security and Privacy Work- shops (EuroS&PW), Stockholm, Sweden, 2019, 129–138, DOI: 10.1109/Eu- roSPW.2019.00021 Contributions: MT proposed the initial idea, collected and read the papers, and wrote the first draft of the paper. KV was the second coder for the qualitative analysis and provided feedback throughout the project. Both authors contributed in the writing. Mohammad Tahaei Contents Prologue1 1. Introduction3 1.1. A Survey On Developer-Centred Privacy and Security.......5 1.2. Understanding Privacy-Related Questions on Stack Overflow...6 1.3. Privacy Champions in Software Teams................6 1.4. On the Privacy and Security Mindsets of Computer Science Students 7 1.5. What Ad Networks Tell Developers About Privacy.........8 1.6. Nudging Developers About User Privacy...............9 1.7. Final Thoughts..............................9 1.8. Contributions.............................. 10 Research Papers 11 2. A Survey On Developer-Centred Privacy and Security 13 2.1. Introduction............................... 14 2.2. Systematisation Approach....................... 15 2.3. Methodology Results.......................... 19 2.4. Research Theme Results......................... 23 2.5. Discussion................................ 31 2.6. Conclusion................................ 34 3. Understanding Privacy-Related Questions on Stack Overflow 37 3.1. Introduction............................... 38 3.2. Related Work............................... 39 3.3. Method.................................. 42 3.4. LDA Findings.............................. 47 3.5. Coding Findings............................. 48 3.6. Privacy Aspect Thematic Analysis Findings............. 51 3.7. Discussion................................ 58 3.8. Limitations................................ 62 3.9. Future Work............................... 62 3.10. Conclusion................................ 63 4. Privacy Champions in Software Teams 67 4.1. Introduction............................... 68 4.2. Related Work............................... 69 4.3. Method.................................. 71 4.4. Results.................................