̽��ֱ�� of Cambridge - data protection

̽��ֱ��Internet of Stings: research will probe privacy and legal concerns of smart devices

sc604 — Fri, 22 Oct 2021 08:43:11 +0000

These questions have been worrying researchers at the ̽��ֱ�� of Cambridge Department of Computer Science and Technology. Now they are launching a year-long investigation into the ways our information is being collected and whether or not these always comply with regulations and the law.

Working in collaboration with colleagues at Imperial College London, they will probe the data that flows from the Internet of Things – the networked consumer devices, such as smart printers, doorbells and toys, that are an increasing presence in our homes.

Backed by a grant from the Information Commissioner’s Office, the UK’s data protection regulator, they will be investigating what Dr Jat Singh describes as ‘the Internet of Stings’.

Research shows that information from our devices often finds its way to a range of third parties, such as user-tracking and advertising networks that may mine it for valuable information about consumer behaviour. He’s also worried about the occasions when data is transmitted from one country to another where there may be different rules, rights and restrictions around data and its use.

So Singh and the research team want to investigate the transmission of data from our devices to find out if it is in line with relevant law – and to inform consumers about the potential of what we can do to have better control over our information.

“We see ‘smart’ devices increasingly being worn on people's bodies and used in people's homes,” said Singh. “However, it’s often unclear what happens with the data these devices collect: where that data goes and how it is used. This is concerning, given these devices can often collect highly personal, private and sensitive information about ourselves and our lives.

“This project seeks to shed light on the state of current commercial data practices by analysing the nature of data flows from both a technical and a data rights, perspective. We aim to show if there are any data protection implications and concerns in the consumer smart device landscape so that we can empower policymakers, regulators, and individuals alike.”

Dr Singh leads the Compliant & Accountable Systems Research group, a team of researchers working at the intersection of technology and law. They consider ways in which technology could be better designed and deployed to meet legal and regulatory concerns and work to inform policymakers and regulators about the technical realities of new and emerging technologies.

Technical network-monitoring mechanisms have been used to establish the ways in which data is transmitted, the patterns of transmissions, and the destinations it ended up in. “This showed that potentially problematic data-flow appears to be rife in the Internet of Things,” said Singh.

Over the next year, they’ll be taking a detailed look at whether devices actually transmit data in accordance with the privacy policies and other legal obligations of the companies that sell them.

They will also explore the implications of mitigations that consumers might use, such as the implications of blocking particular data flows.

They want to establish the nature and scale of any problems and see if vendor companies are being honest and fully transparent with their consumers and compliant with data protection and other laws. They also want to better inform not only device owners but also regulators and policy-makers about the suspected issues, which may help inform future interventions.

“Problems with the data practices of the consumer smart devices have been suspected for some time, but not fully examined – from both a technical and legal perspective,” said Singh. “We need to do so if we want a better, fairer and more compliant Internet of Things.”

Originally published on the Computer Science and Technology website.

What happens to all the sensitive personal information our smart devices collect from us? Where does the data picked up by our smart watches, speakers and TVs go, who has access to it and how is it used?

It’s often unclear what happens with the data these devices collect: where that data goes and how it is used. This is concerning, given these devices can often collect highly personal, private and sensitive information about ourselves and our lives

Jat Singh

Howard Bouchevereau via Unsplash

Smart speaker

̽��ֱ��text in this work is licensed under a Creative Commons Attribution 4.0 International License. Images, including our videos, are Copyright © ̽��ֱ�� of Cambridge and licensors/contributors as identified. All rights reserved. We make our image and video content available in a number of ways – as here, on our main website under its Terms and conditions, and on a range of channels including social media that permit your use and sharing of our content under their respective Terms.

Yes

In tech we trust?

lw355 — Fri, 23 Feb 2018 09:30:00 +0000

Dr Jat Singh is familiar with breaking new ground and working across disciplines. Even so, he and colleagues were pleasantly surprised by how much enthusiasm has greeted their new Strategic Research Initiative on Trustworthy Technologies, which brings together science, technology and humanities researchers from across the ̽��ֱ��.

In fact, Singh, a researcher in Cambridge’s Department of Computer Science and Technology, has been collaborating with lawyers for several years: “A legal perspective is paramount when you’re researching the technical dimensions to compliance, accountability and trust in emerging ICT; although the Computer Lab is not the usual home for lawyers, we have two joining soon.”

Governance and public trust present some of the greatest challenges in technology today. ̽��ֱ��European General Data Protection Regulation (GDPR), which comes into force this year, has brought forward debates such as whether individuals have a ‘right to an explanation’ regarding decisions made by machines, and introduces stiff penalties for breaching data protection rules. “With penalties including fines of up to 4% of global turnover or €20 million, people are realising that they need to take data protection much more seriously,” he says.

Singh is particularly interested in how data-driven systems and algorithms – including machine learning – will soon underpin and automate everything from transport networks to council services.

As we work, shop and travel, computers and mobile phones already collect, transmit and process much data about us; as the ‘Internet of Things’ continues to instrument the physical world, machines will increasingly mediate and influence our lives.

It’s a future that raises profound issues of privacy, security, safety and ultimately trust, says Singh, whose research is funded by an Engineering and Physical Sciences Research Council Fellowship: “We work on mechanisms for better transparency, control and agency in systems, so that, for instance, if I give data to someone or something, there are means for ensuring they’re doing the right things with it. We are also active in policy discussions to help better align the worlds of technology and law.”

What it means to trust machine learning systems also concerns Dr Adrian Weller. Before becoming a senior research fellow in the Department of Engineering and a Turing Fellow at ̽��ֱ��Alan Turing Institute, he spent many years working in trading for leading investment banks and hedge funds, and has seen first-hand how machine learning is changing the way we live and work.

“Not long ago, many markets were traded on exchanges by people in pits screaming and yelling,” Weller recalls. “Today, most market making and order matching is handled by computers. Automated algorithms can typically provide tighter, more responsive markets – and liquid markets are good for society.”

But cutting humans out of the loop can have unintended consequences, as the flash crash of 2010 shows. During 36 minutes on 6 May, nearly one trillion dollars were wiped off US stock markets as an unusually large sell order produced an emergent coordinated response from automated algorithms. “ ̽��ֱ��flash crash was an important example illustrating that over time, as we have more AI agents operating in the real world, they may interact in ways that are hard to predict,” he says.

Algorithms are also beginning to be involved in critical decisions about our lives and liberty. In medicine, machine learning is helping diagnose diseases such as cancer and diabetic retinopathy; in US courts, algorithms are used to inform decisions about bail, sentencing and parole; and on social media and the web, our personal data and browsing history shape the news stories and advertisements we see.

How much we trust the ‘black box’ of machine learning systems, both as individuals and society, is clearly important. “There are settings, such as criminal justice, where we need to be able to ask why a system arrived at its conclusion – to check that appropriate process was followed, and to enable meaningful challenge,” says Weller. “Equally, to have effective real-world deployment of algorithmic systems, people will have to trust them.”

But even if we can lift the lid on these black boxes, how do we interpret what’s going on inside? “There are many kinds of transparency,” he explains. “A user contesting a decision needs a different kind of transparency to a developer who wants to debug a system. And a third form of transparency might be needed to ensure a system is accountable if something goes wrong, for example an accident involving a driverless car.”

If we can make them trustworthy and transparent, how can we ensure that algorithms do not discriminate unfairly against particular groups? While it might be useful for Google to advertise products it ‘thinks’ we are most likely to buy, it is more disquieting to discover the assumptions it makes based on our name or postcode.

When Latanya Sweeney, Professor of Government and Technology in Residence at Harvard ̽��ֱ��, tried to track down one of her academic papers by Googling her name, she was shocked to be presented with ads suggesting that she had been arrested. After much research, she discovered that “black-sounding” names were 25% more likely to result in the delivery of this kind of advertising.

Like Sweeney, Weller is both disturbed and intrigued by examples of machine-learned discrimination. “It’s a worry,” he acknowledges. “And people sometimes stop there – they assume it’s a case of garbage in, garbage out, end of story. In fact, it’s just the beginning, because we’re developing techniques that can automatically detect and remove some forms of bias.”

Transparency, reliability and trustworthiness are at the core of Weller’s work at the Leverhulme Centre for the Future of Intelligence and ̽��ֱ��Alan Turing Institute. His project grapples with how to make machine-learning decisions interpretable, develop new ways to ensure that AI systems perform well in real-world settings, and examine whether empathy is possible – or desirable – in AI.

Machine learning systems are here to stay. Whether they are a force for good rather than a source of division and discrimination depends partly on researchers such as Singh and Weller. ̽��ֱ��stakes are high, but so are the opportunities. Universities have a vital role to play, both as critic and conscience of society. Academics can help society imagine what lies ahead and decide what we want from machine learning – and what it would be wise to guard against.

Weller believes the future of work is a huge issue: “Many jobs will be substantially altered if not replaced by machines in coming decades. We need to think about how to deal with these big changes.”And academics must keep talking as well as thinking. “We’re grappling with pressing and important issues,” he concludes. “As technical experts we need to engage with society and talk about what we’re doing so that policy makers can try to work towards policy that’s technically and legally sensible.”

Inset image: read more about our AI research in the ̽��ֱ��'s research magazine; download a pdf; view on Issuu.

Fairness, trust and transparency are qualities we usually associate with organisations or individuals. Today, these attributes might also apply to algorithms. As machine learning systems become more complex and pervasive, Cambridge researchers believe it’s time for new thinking about new technology.

With penalties including fines of up to €20 million, people are realising that they need to take data protection much more seriously

Jat Singh

Daniel Werbrouck

Want to hear more?

Join us at the Cambridge Science Festival to hear Adrian Weller discuss how we can ensure AI systems are transparent, reliable and trustworthy.

Thursday 15 March 2018, 7:30pm - 8:30pm

Mill Lane Lecture Rooms, 8 Mill Lane, Cambridge, UK, CB2 1RW

BOOK HERE

̽��ֱ��text in this work is licensed under a Creative Commons Attribution 4.0 International License. For image use please see separate credits above.

Yes

Protecting our data and identity: how should the law respond?

ts657 — Fri, 28 Oct 2016 13:35:03 +0000

̽��ֱ��freedom of expression and the need for privacy may be strange bedfellows today – but could full-blown estrangement beckon in a digital future that makes the leap from user-controlled content to unfiltered, online sharing of, well, everything?

A future where streaming your life online becomes the norm is not unthinkable, according to Dr David Erdos, whose research in the Faculty of Law explores the nature of data protection. “Take something like Snapchat Spectacles or Google Glass,” he says. “Such technology could very quickly take off, and all of a sudden it becomes ‘normal’ that everyone is recording everything, both audibly and visually, and the data is going everywhere and being used for all sorts of purposes – some individual, some organisational.”

This makes questions about what control we have over our digital footprint rather urgent.

“You can see that we need to get some grip on how the right to privacy can be enforced as technologies continue to develop that can pose serious threats to individuals’ sense of dignity, reputation, privacy and safety,” he adds.

One enforcement Erdos refers to is Google Spain, a ruling made in 2014 by the Court of Justice of the European Union (CJEU) that examined search engines’ responsibilities when sharing content about us on the world wide web.

̽��ֱ��CJEU ruled that people across all of the 28 EU Member States have a ‘right to be forgotten’ online, giving them an ability to prohibit search engines indexing inadequate, irrelevant or other illegal information about them against their name. This right to be forgotten is based on Europe’s data protection laws and applies to all online information about a living person.

Google responded by publishing a form you can submit to have such links to content (not the actual content) removed. I put it to the test – Google refuses on the basis that web links to my long-closed business are ‟justified” as they ‟may be of interest to potential or current consumers”.

Erdos explains that data protection doesn’t always work as it was originally intended to. “On paper, the law is in favour of privacy and the protection of individuals – there are stringent rules around data export, data transparency and sensitive data, for example.

“But that law was in essence developed in the 1970s, when there were few computers. Now we have billions of computers, and the ease of connectivity of smartphones and the internet. Also, sharing online is not practically constrained by EU boundaries.

“That means the framework is profoundly challenged. There needs to be a more contextual legal approach, where the duties and possibly also the scope take into account risk as well as the other rights and interests that are engaged. That law must then be effectively enforced.”

In fact, the EU data protection law currently extends surprisingly far. “By default, the law regulates anyone who alone, or jointly with others, does anything with computerised information that mentions a living person,” Erdos explains. “That could include many individuals on social networking sites. If you’re disseminating information about a third party to an indeterminate number of people, you’re (in theory at least) responsible for adherence to this law.”

Tweeters, for instance, may have to respond to requests for data (Tweets) to be rectified for inaccuracy or even removed entirely, and field ‘subject access requests’ for full lists of everything they’ve Tweeted about someone. And under the new General Data Protection Regulation that comes into effect in 2018, the maximum penalty for an infringement is €20 million (or, in the case of companies, up to 4% of annual global turnover).

When it comes to search engines or social media, Erdos admits that a strict application of the law is “not very realistic”. He adds: “There’s a systemic problem in the gap between the law on the books and the law in reality, and the restrictions are not desperately enforced.”

Erdos believes inconsistencies in the law could be exploited online by the ruthless. “ ̽��ֱ��very danger of all-encompassing, stringent laws is that it seems as if responsible organisations and individuals who take them seriously are hamstrung while the irresponsible do whatever they want.”

This also applies to ‘derogations’ – areas where the law instructs a balance must be struck between data protection and the rights to freedom of journalistic, literary and artistic expression.

“Member states have done radically different things in their formal law here – from nothing at all through to providing a blanket exception – neither of which was the intention of the EU scheme.”

As the new law in 2018 will empower regulators to hand out fines of up to hundreds of millions of euros to large multinational companies, Erdos is passionate about the urgency of Europe getting a coordinated and clear approach on how its citizens can exercise their data protection rights.

“We are giving these regulators quite enormous powers to enforce these rules and yet do we have a good understanding of what we want the outcome to be and what we’re expecting individuals and organisations to do?” Erdos ponders.

“To me, this means that the enforcement will become more and more important. Data protection is not just a technical phrase – people really do need protection. ̽��ֱ��substance of the law needs to be hauled into something that’s more reasonable. That protection needs to be made real.”

Erdos’ research also explores the nature of data protection and academic freedom, and he successfully argued for academic expression to be added to the list of free speech derogations in the 2018 legislation. “I have come across the most egregious examples of research guidance stipulating alleged data protection requirements, including claims that published research can’t include any identifiable personal data at all,” says Erdos.

“In a survey of EU data protection authorities, I asked whether a journalist’s undercover investigation into extremist political beliefs and tactics and an academic’s undercover research into widespread claims of police racism could be legal under data protection. Not one regulator said the activity of the journalist would in principle be illegal, but almost half said the academic’s activity would be unlawful.

“Academics aim to write something of public importance, and make it rigorous. ̽��ֱ��old law was seen to prioritise even tittle-tattle in a newspaper over academic research; one hopes this will largely be removed by the new law.”

For many, the greatest concern remains the potential threats to their privacy. In order for consumers to feel safe with emerging technology, law makers may have to legislate for potential breaches now, rather than react after the damage is done.

“We don’t want to respond in a panic of registering or documenting everything, but the alternative of collapse into an ‘anything goes’ situation is equally dangerous.

“Apps like Snapchat show many people value being able to upload certain pictures and information that soon disappear. We don’t want people forgetting what they’re sharing today, and then worrying far too late how third parties are using that information.”

Would Erdos himself ever use Snapchat Spectacles or Google Glass (he does own a smartphone)? He laughs. “Let’s face it, email, the internet, Google search… people ended up having to use them. So, never say never!”

Many of us see our privacy as a basic right. But in the digital world of app-addiction, geolocation tracking and social oversharing, some may have cause to wonder if that right is steadily and sometimes willingly being eroded away.

You can see that we need to get some grip on how the right to privacy can be enforced as technologies continue to develop that can pose serious threats to individuals’ sense of dignity, reputation, privacy and safety

David Erdos

nolifebeforecoffee

Banksy stencil

̽��ֱ��text in this work is licensed under a Creative Commons Attribution 4.0 International License. For image use please see separate credits above.

Yes

Licence type:

Attribution-ShareAlike

Talkin' 'bout a revolution: how to make the digital world work for us

Anonymous — Mon, 03 Oct 2016 13:45:18 +0000

New information and communication technologies are having a profound impact on many aspects of social, political and economic life, raising important new issues of social and public policy. Surveillance, privacy, data protection, advanced robotics and artificial intelligence are only a few of the many fundamental issues that are now forcing themselves onto the public agenda in many countries around the world.

There have been other great technological revolutions in the past but the digital revolution is unprecedented in its speed, scope and pervasiveness. Today, less than a decade after smartphones were first introduced, around half the adult population in the world owns one – and by 2020, according to some estimates, 80% will.

Smartphones are, of course, much more than phones: they are powerful computers that we carry around in our pockets and handbags and that give us permanent mobile connectivity. While they enable us to do an enormous range of things, from checking and sending emails to ordering a taxi, using a map and paying for a purchase, they also know a lot about us – who we are, where we are, which websites we visit, what transactions we’ve made, whom we’re communicating with, and so on. They are great enablers but also powerful generators of data about us, some of which may be very personal. Do we know who has access to this data? Do we know what they do with it? Do we care?

̽��ֱ��rapid rise and global spread of the smartphone is just one manifestation of a technological revolution that is a defining feature of our time. No one in the world today is beyond its reach: the everyday act of making a phone call or using a credit card immediately inserts you into complex global networks of digital communication and information flow.

In fact the digital revolution is often misunderstood because it is equated with the internet and yet is much more than this. It involves several interconnected developments: the pervasive digital codification of information; the dramatic expansion of computing power; the integration of information technologies with communication systems; and digital automation or robotics.

Taken together, these developments are spurring profound changes in all spheres of life, from industry and finance to politics, from the nature of public debate to the character of personal relationships, disrupting established institutions and practices, opening up new opportunities and creating new risks.

In Cambridge, an ambitious new interdisciplinary collaboration around ‘digital society’ is being forged to bring together social scientists and computer scientists to tackle some of the big questions raised by the digital revolution.

̽��ֱ��key idea underlying the collaboration is that some of the most important intellectual challenges in this emerging area require both a firm grasp of technology and a deep understanding of processes that are fundamentally social and political in character.

Cambridge is uniquely well-placed to tackle these challenges. As a world-leading university in computer science and technology, the ̽��ֱ�� has been at the forefront of some of the most important developments in this field. Cambridge is also a leading research and development centre for the IT industry. Several significant technology companies are based here, including Microsoft Research, ARM and a sizable number of smaller companies and start-ups. There is also a large group of scholars and researchers in Cambridge in the social sciences and law who are working on aspects of the digital revolution.

By bringing together social scientists and computer scientists on specific research projects, we are forging a new form of interdisciplinary collaboration that will enable us to grapple with some of the big challenges posed by the digital revolution (see panel).

These endeavours dovetail well with research initiatives that are already under way in Cambridge, including the Leverhulme Centre for the Future of Intelligence, the Cambridge Cybercrime Centre and the ̽��ֱ��’s Strategic Research Initiatives and Networks on Big Data, Public Policy, Public Health and Digital Humanities. Cambridge is also a key partner in the UK’s national centre for data science, the Alan Turing Institute, and in the Horizon Digital Economy programme, which aims to tackle the challenge of harnessing the power of ubiquitous computing in a way that is acceptable to society.

While the collaborative work carried out in Cambridge is primarily research-oriented, it is also likely to have significant practical implications. Cambridge has a strong track record in producing world-leading research that feeds directly into real-world applications. As examples, software systems Docker and the Xen hypervisor developed in the Computer Laboratory now run much of the public cloud computing infrastructure, and Raspberry Pi is widely used in technology education in schools.

We are living through a time of enormous social, political and technological change. On the one hand, the digital revolution is enabling massive new powers to be exercised by states and corporations in ways that were largely unforeseen. And, on the other, it is giving rise to new forms of mobilisation and disruption from below by a variety of actors who have found new ways to organise and express themselves in an increasingly networked world. While these and other developments are occurring, the traditional institutions of democratic governance find themselves ill-equipped to understand and keep pace with the new social and technological landscapes that are rapidly emerging around them.

There is no better moment, in our view, to bring together social scientists and computer scientists to tackle the big questions raised by one of the most profound and far-reaching revolutions of our time.

Jon Crowcroft is the Marconi Professor of Communications Systems at Cambridge’s Computer Laboratory and Professor John Thompson is at the Department of Sociology.

̽��ֱ��digital revolution is one of the great social transformations of our time. How can we make the most of it, and also minimise and manage its risks? Jon Crowcroft and John Thompson discuss the challenges as we commence a month-long focus on ‘digital society’.

There is no better moment to bring together social scientists and computer scientists to tackle the big questions raised by one of the most profound and far-reaching revolutions of our time

Jon Crowcroft and John Thompson

Eric Fischer

World travel and communications recorded on Twitter

Key challenges for digital society

What are the consequences of permanent connectivity for the ways that individuals organise their day-to-day lives, interact with others, form social relationships and maintain them over time?
What implications do these transformations have for traditional forms of political organisation and communication? Are they fuelling alternative forms of social and political mobilisation, facilitating grass-root movements and eroding trust in established political institutions and leaders?
What are the implications for privacy of the increasing capacity for surveillance afforded by global networks of communication and information flow? Do individuals in different parts of the world value privacy in the same way, or is this a distinctively Western preoccupation?
How is censorship exercised on the internet? What forms does it assume and what kinds of material are censored? How do censorship practices vary from one country to another? To what extent are individuals aware of censorship and how do they cope with it?
Just as the internet creates new opportunities for states and other organisations to exercise surveillance and censorship, so too it enables individuals and other organisations to disclose information that was previously hidden from view and to hold governments and corporations to account: who are the digital whistleblowers, how effective are they and what are the consequences of the new forms of transparency and accountability that they, among others, are developing?
What techniques do criminals use to deceive users online, how widespread are their activities and what can users do to avoid getting caught in their traps?
What impact is the digital revolution – including developments in artificial intelligence and machine learning – having on traditional industries and forms of employment, and what impact is it likely to have in the coming years? Will it usher in a new era of mass unemployment in which professional occupations as well as manual jobs are displaced by automation, as some fear?
What are the implications of the pervasive digitisation of intellectual content for our traditional ways of thinking about intellectual property and our traditional legal mechanisms for regulating intellectual property rights?
How widespread are new forms of currency that exist only online – so-called cryptocurrencies like Bitcoin – and what impact are they likely to have on traditional financial practices and institutions?
How are new forms of data analysis and advanced robotics affecting the practice of medicine, the provision of healthcare and the detection and control of disease, and how might they affect them in the future?

̽��ֱ��text in this work is licensed under a Creative Commons Attribution 4.0 International License. For image use please see separate credits above.

Yes

Licence type:

Attribution-Noncommercial-ShareAlike