This study examined people's location privacy preferences through a location sharing application called Locaccino. The study found that location entropy, which measures how many unique visitors a place has, best predicted privacy preferences, with participants more comfortable sharing locations visited by many people. Highly mobile users who visited more unique daily locations had more expressive privacy policies, updated them more often, and found the privacy controls more useful. The type of place also impacted privacy preferences, with more willingness to share public places than private ones, especially among distant social relations.
Tampa BSides - Chef's Tour of Microsoft Security Adoption Framework (SAF)
Empirical Models of Privacy in Location Sharing, at Ubicomp2010
1. Empirical Models of
Privacy in Location
Sharing
Eran Toch, Justin Cranshaw, Paul Hankes-Drielsma, Janice Y. Tsai,
Patrick Gage Kelley, James Springfield, Lorrie Cranor, Jason Hong,
Norman Sadeh
Carnegie
Mellon
4. 4Ubicomp 2010
Carnegie
Mellon
Privacy
‣ Location sharing applications can reveal sensitive
locations (e.g., home,) the activity of the user, social
encounters etc...
‣ Privacy is a major concern that may limit adoption (Tsai
et al. 2009.)
by Frank Groeneveld, Barry Borsboom and Boy van Amstel.
5. Ubicomp 2010
Carnegie
Mellon
Background
‣ Privacy
‣ Khalil and Connelly
(2006)
‣ Anthony et al. (2007)
‣ Benisch et al. (2010)
Location and Mobility
‣ Eagle et al. (2006)
‣ Gonz´alez et al. (2008)
‣ Mancini et al. (2009)
‣ Cranshaw et al., 2010
6. Our question: What are the privacy
preferences associated with
locations and mobility patterns?
10. 10Ubicomp 2010
Carnegie
Mellon
Locators
‣ Background location reporting every 2-10 minutes,
depending on movement
‣ On laptops: Location WiFi positioning by Skyhook
‣ On smartphones: WiFi positioning + GPS
For Mac and Windows
14. Ubicomp 2010
Carnegie
Mellon
Study
‣ 28 primary participants were recruited using flyers scattered
around the Carnegie Mellon Campus and mailing list
posting. They were compensated at $30 + data plan.
‣ 373 secondary participants had joined by invitation of
primary participants. They were not compensated.
‣ 230 of them installed a locator, and were requested by
other participants.
1. Answering
Entrance
Survey
3. Installing locator
4. Setting up privacy
policy
5. Inviting friends
3. Using
Locaccino
4. Answering
Place Survey +
Exit Survey
2. Randomly
assigned a
locator
15. Ubicomp 2010
Carnegie
Mellon
Population and Limitation
‣ All participants are from the university
community.
‣ 17 graduate students, 9 undergraduate
students and 2 staff members.
‣ The study was conducted in a single
city (Pittsburgh.)
‣ And in the course of a single summer
month.
17. Ubicomp 2010
Carnegie
Mellon
Location Entropy
‣ Entropy is a measure for the
diversity of visitors to a place
(Cranshaw et al., 2010)
‣ Borrowed from bio-diversity,
it assigns high values to places
visited by many users in equal
proportions.
‣ Let p(u,l) be the observations
of a user u in a location l.
Entropy is defined as:
High entropy (5+)
Medium entropy (1-5)
Low entropy (1)
Locations are defined based a 100m radius
19. Ubicomp 2010
Carnegie
Mellon
Entropy vs. Comfort in sharing locations
Users were more
comfortable sharing
high entropy
locations.
ANOVA, friends: F=5.46
p=0.02, distant relations:
F = 15.57 p=0.001
The correlation is
stronger for distant
social relations than
with close social
relations
21. Ubicomp 2010
Carnegie
Mellon
Privacy and Mobility
• Visible mobility is
correlated with the
number of request for the
user (ANOVA: F = 14.713
p = 0.00079)
‣ High mobility users were
requested twice as much
as low mobility users.
‣ Number of friends and the
users’ activity are non
significant.
High
mobility
users
Low
mobility
users
Visible mobility
Number of unique daily locations
Median: 3.4
23. Ubicomp 2010
Carnegie
Mellon
Privacy and Mobility
Item ANOVA F ANOVA P-value
Expressiveness (number of
policy restrictions)
5.63 0.025
Number of privacy policy
updates
10.75 0.0028
Correlation between visible mobility and privacy properties
High mobility users were 4 times as likely to use location
restrictions and 7 times more likely to use time restrictions
27. Ubicomp 2010
Carnegie
Mellon
Conclusions
‣ Some privacy preferences can be predicted
by location entropy and mobility.
‣ Enhancing location sharing: by suggesting helpful
defaults, checking-in in high entropy places etc.
‣ Establishing privacy sensitive location reporting for
location aware systems.
‣ Other fields? Is entropy related to other phenomena?
Check Session VII
‣ Lots of future work...
28. Thank you
More info: http://www.cs.cmu.edu/~eran/
Carnegie
Mellon
Locaccino demo - tomorrow’s lunch
29. Ubicomp 2010
Carnegie
Mellon
Location Privacy Preferences
‣Which measure best predicts the location privacy
preferences?
ANOVA p-value
Measure friends and
family
distant relations
Number of unique visitors 0.48 0.3
Number of observations 0.17 0.001
User’s visits to the location 0.98 0.22
Location entropy 0.02 0.001