Hartzog Stutzman Obscurity by Design Fpfv7
Total Page:16
File Type:pdf, Size:1020Kb
OBSCURITY BY DESIGN Frederic Stutzman Postdoctoral Fellow H. John Heinz III College Carnegie Mellon University [email protected] Woodrow Hartzog Assistant Professor of Law Cumberland School of Law at Samford University Affiliate Scholar Center for Internet and Society at Stanford Law School [email protected] Design-based solutions to confront technological privacy threats are becoming popular with regulators. But these promising solutions have left the full potential of design untapped. With respect to online communication technologies, design-based solutions for privacy remain incomplete because they have yet to tackle the trickiest aspect of the Internet—social interaction. This essay posits that privacy-protection strategies such as “privacy by design” are hobbled with respect to social interaction due to a lack of focus on collaborative aspects of social software use. This essay proposes that design solutions for social technologies require increased attention to user interfaces, with a focus on “obscurity” rather than the expansive and vague concept of “privacy.” The main thesis of this essay is that obscurity is the natural state for most online social interaction and, as such, should be the locus for design-based privacy solutions for social technologies. The purpose of this essay is to develop a model for “obscurity by design” as a means to address the privacy problems inherent in social technologies. 7/20/12 1:01 PM 1 Obscurity by Design (Draft) [2012 Obscurity by Design Frederic Stutzman* and Woodrow Hartzog** TABLE OF CONTENTS Introduction ................................................................................................. 2 I. Privacy by Design ...................................................................................... 4 1. The History of Privacy by Design .................................................... 5 2. Challenges to Privacy by Design ...................................................... 7 II. Better Living Through Obscurity .......................................................... 10 1. The Concept of Obscurity ............................................................... 11 2. The Four Principles of Online Obscurity ........................................ 13 a. Search Visibility ........................................................................... 13 b. Unprotected Access ...................................................................... 15 c. Identification ............................................................................... 16 d. Clarity ........................................................................................... 17 III. Implementing Obscurity by Design ...................................................... 18 1. Technologies .................................................................................. 20 a. Smart Hyperlinks and Access Walls ........................................... 20 b. “Privacy” Settings ......................................................................... 21 c. Search Blockers ........................................................................... 22 d. De-Identifying Tools ................................................................... 23 e. Passwords and Encryption ......................................................... 24 2. Policies ........................................................................................... 24 a. Behavioral Restrictions ............................................................... 25 b. Community Guidelines ............................................................... 27 3. Behavioral Interventions ............................................................... 29 a. Defaults ....................................................................................... 29 b. Feedback ..................................................................................... 30 c. Content, Ordering, and Placement of Signals ............................ 33 d. Carefully Crafted Language ........................................................ 34 Conclusion .................................................................................................. 35 * Postdoctoral Fellow, H. John Heinz III College, Carnegie Mellon University. ** Assistant Professor of Law, Cumberland School of Law at Samford University; Affiliate Scholar, Center for Internet and Society at Stanford Law School. 1 7/20/12 1:01 PM 2 Obscurity by Design (Draft) [2012 INTRODUCTION Privacy by design, that is, “the philosophy and approach of embedding privacy into the design specifications of various technologies,” can help change the law’s largely reactive approach to privacy threats.1 Government and industry are gradually embracing privacy by design and other design-based strategies to protect Internet users.2 But these solutions have thus far not embraced the full potential of design. These design-based strategies for online communication technologies have yet to articulate principles for the design of the most complex aspect of the Internet—social interaction. Simply put, privacy by design has yet to address the social aspect of an inherently social medium. Currently, privacy by design focuses on the collection and use of data in compliance with fair information practices.3 There are numerous and significant problems with “big data,” but the organizations that deal in this data are not the only threat to privacy on the Internet. The ascent of the social web has made it clear that online relationships present their own privacy challenges as millions regularly disclose vast amounts of personal information for the purpose of socializing.4 1 Ann Cavoukian, Privacy by Design, Info. & Privacy Comm’r, 1 (2009), http://www.ipc.on.ca/images/Resources/privacybydesign.pdf; Ann Cavoukian, Privacy by Design: The Seven Foundational Principles, Info. & Privacy Comm’r (2009), http://www.privacybydesign.ca/content/uploads/2009/08/7foundationalprinciples.pdf; 2 Federal Trade Commission, Protecting Consumer Privacy in an Era of Rapid Change: Recommendations for Businesses and Policymakers, FTC REPORT (March 2012), http://ftc.gov/os/2012/03/120326privacyreport.pdf; Directive 95/46/EC, 1995 O.J. (L 281) 31 (Nov. 23, 1995); Art. 29 Data Protection Working Party, 02356/09/EN, WP 168, The Future of Privacy (2009), http://ec.europa.eu/justice/policies/privacy/docs/wpdocs/2009/wp168_en.pdf. 3 Id. 4 See, e.g., DANIEL SOLOVE, THE FUTURE OF REPUTATION (2007); danah boyd, Why Youth (Heart) Social Network Sites: The Role of Networked Publics in Teenage Social Life, in YOUTH, IDENTITY, AND DIGITAL MEDIA 119, 133 (David Buckingham ed., 2008), http://www.mitpressjournals.org/doi/pdf/10.1162/dmal.9780262524834.119; James Grimmelmann, Saving Facebook, 94 IOWA L. REV. 1137 (2009); Lauren Gelman, Privacy, Free Speech and Blurry-Edged Social Networks, 50 B.C. L. REV. 1315 (2009). 2 7/20/12 1:01 PM 3 Obscurity by Design (Draft) [2012 Addressing the vexing privacy problems of the social web is a challenging task. Few can agree on a conceptualization of privacy,5 much less how to protect privacy in our social interactions by design.6 There are a number of practical reasons why privacy by design has avoided the social side of the user interface. The translation of regulation to implementation is a complex process and may be more efficient when applied to formal technologies (e.g., databases).7 Additionally, there is little guidance regarding how designers should approach the implementation of privacy by design in a contextually variant, interactional space. Many substantive protections entailed in privacy by design are effectuated on the “back end” of technologies, such as data security through encryption, data minimization techniques, anonymity, and structural protection though organizational prioritization of privacy. However, the design of social technologies also involves “front facing” concerns such as privacy settings, search visibility, password protections, and the ability to use pseudonyms. The answer to these challenges might lie in refining the goal for the design of social systems. The current goal of design solutions is “privacy,” which is too broad and opaque to provide meaningful guidance in designing social technologies. Indeed, one conceptualization of privacy, secrecy, can be seen as antithetical to the notion of social interaction. This essay recommends looking to the related concept of obscurity. Empirical evidence demonstrates that Internet users aim to produce and rely upon obscurity to protect their social interaction.8 The concept of online obscurity, defined here as a context missing one or more key factors that are essential to discovery or comprehension, is a much more defined and attainable goal for social technology designers. Obscurity is more flexible than some conceptualizations of privacy and also more feasible to 5 See, e.g., DANIEL SOLOVE, UNDERSTANDING PRIVACY (2008); ALAN WESTIN, PRIVACY AND FREEDOM (1967); Stephen Margulis, On the Status and Contribution of Westin's and Altman's Theories of Privacy. 59(2) JOUR. OF SOCIAL ISSUES 411 (2003). 6 See, Ira Rubinstein, 26 BERKELEY TECH L.J. 1409, 1421 (2011) (“Privacy by design is an amorphous concept.”). 7 Seda Gürses, Carmela Troncoso, & Claudia Diaz, Engineering Privacy by Design, CPDP 2011, Belgium, 2011. 8 See, e.g., Woodrow Hartzog & Frederic Stutzman, The Case for Online Obscurity, 101 CALIF. L. REV. (forthcoming 2013). 3 7/20/12 1:01 PM 4 Obscurity by Design (Draft) [2012 implement. Moreover, obscurity involves more than prohibitions on conduct;