This project proposes to inform computer users of the privacy that they receive in practice. To do so, the project will record network and system measurements of laptop and desktop computers as they are used. It will then analyze those measurements to discover what personal information is exposed to whom and by which applications. This will be done as real users undertake real tasks to produce individual privacy assessments. The project will develop visual representations to convey measured information exposure to users as answers to specific privacy questions, e.g., "What does Starbucks know about me?" User studies will be run to evaluate whether representations of measured information exposure are an effective way to convey privacy risks and how they affect user behavior. This research is motivated by the fact that people who use personal computers have little idea of how the applications they run spread their personal information over the Internet. Users must simply assume that reputable applications safeguard their privacy interests; they have no basis on which to make informed privacy decisions. The research seeks to provide users with the visibility that they lack. It will show them how their personal information is actually spread by measuring application behavior and reporting the results with simple representations. The intent is to provide non-technical users with a powerful tool to help them balance their privacy needs with the available applications. The long-term impact of this research is intended to encourage new privacy-enhancing technologies by highlighting real-world privacy problems and opportunities.
TC: Small: Informing Users of Their Privacy in Practice