June 20, 2018

How the Contextual Integrity Framework Helps Explain Children’s Understanding of Privacy and Security Online

This post discusses a new paper that will be presented at the 2018 ACM Conference on Computer Supported Cooperative Work and Social Computing (CSCW). I wrote this paper with co-authors Shalmali Naik, Utkarsha Devkar, Marshini Chetty, Tammy Clegg, and Jessica Vitak.

Watching YouTube during breakfast. Playing Animal Jam after school. Asking Google about snakes. Checking points on Class Dojo. Posting a lip-synching video on Musical.ly. These online activities are interspersed in the daily lives of today’s children. They also involve logging into an account, disclosing information, or exchanging messages with others—actions that can raise privacy and security concerns.

How do elementary school-age children conceptualize privacy and security online? What strategies do they and their parents use to help address such concerns? In interviews with 18 families, we found that children ages 5-11 understand some aspects of how privacy and security apply to online activities. And while children look to their parents for support, parents feel that privacy and security are largely a concern for the future, when their children are older, have their own smartphones, and spend more time on activities like social media. (For a summary of the paper, see this Princeton HCI post.)

Privacy scholar Helen Nissenbaum’s contextual integrity framework was developed to help identify what privacy concerns emerge through the use of new technology and what types of solutions can address those concerns. We found that the framework is also useful to explain what children know (and don’t know) about privacy online and what types of educational materials can enhance that knowledge.

What is contextual integrity? The contextual integrity framework considers privacy from the perspective of how information flows. People expect information to flow in a certain way in a given situation. When it does not, privacy concerns may arise. For example, the norms of a parent-teacher conference dictate that a teacher can reveal information about the parent’s child to the parent, but not about other children. Four parameters influence these norms:

  • Context: This relates to the backdrop against which a given situation occurs.  A parent-teacher conference occurs within an educational context.
  • Attributes: This refers to the types of information involved in a particular context. The parent-teacher conference involves information about a child’s academic performance and behavioral patterns, but not necessarily the child’s medical history.
  • Actors: This concerns the parties involved in a given situation. In a parent-teacher conference, the teacher (sender) discloses information about the student (subject) to the parent (recipient).
  • Transmission Principles: This involves constraints that affect the flow of information. For example, information shared during a parent-teacher conference is unidirectional (i.e. teachers don’t share information about their own children with parents) and confidential (i.e. social norms and legal restrictions prevent teachers from sharing such information with the entire school).

How does the contextual integrity framework help us understand what children know about privacy and security online? In our interviews, we found that children largely understood how attributes and actors could affect privacy and security online. They knew that certain types of information, such as a password, deserved more protection than others. They also recognized that it was more appropriate to share information with known parties, such as parents and teachers, rather than strangers or unknown people online.

But children under age 10 struggled to grasp how interacting online could violate transmission principles by, for example, enabling unintended actors to see information. Only one child recognized that someone could take information shared in a chat message and repost it elsewhere, potentially spreading it far beyond its intended audience. Children also struggled to understand how the context of a situation could inform decisions about how to appropriately share information. They largely used the heuristic of “Could I get in trouble for this?” to guide behavior.

How do children and parents navigate privacy and security online? While a few children understood that restricting access to information or providing false information online could help them protect their privacy, most relied on their parents for support in navigating potentially concerning situations. Parents primarily used passive strategies to manage their children’s technology use. They maintained a general awareness of what their children were doing, primarily by telling children to use devices only when parents were around. They minimized the chances that their children would download additional apps or spend money by withholding the passwords for app stores.

Most parents felt their children were too young to face privacy or security risks online. But elementary school-age children already engage in a variety of activities online, and our results show they can absorb lessons related to privacy and security. Childrens’ willingness to rely on parents suggests that parents have an opportunity to usher their children’s knowledge to the next level. And parents may have an easier time doing so before their children reach adolescence and lose interest in listening to parents.

How can the contextual integrity framework inform children’s learning about privacy and security online? The contextual integrity framework can guide the development of relevant materials that parents and others can use to scaffold their children’s learning. For example, the development of a child-friendly ad blocker could help show children that other actors, such as companies and trackers, can “see” what people do online. Videos or games that explain, in an age-appropriate manner, how the Internet works, can help children understand how the Internet can challenge transmission principles such as confidentiality. Integrating privacy and security-related lessons into apps and websites that children already use can help refine their understanding of how contexts and norms shape decisions to disclose information. For example, the website for the public broadcasting channel PBS Kids instructs children to avoid using personal information, such as their last name or address, in a username.

As the boundaries between offline and online life continue to fade, privacy and security knowledge remains critical for people of all ages. Theoretical frameworks like contextual integrity help us understand how to to evaluate and enhance that knowledge.

For more information, read the full paper.

No boundaries: Exfiltration of personal data by session-replay scripts

This is the first post in our “No Boundaries” series, in which we reveal how third-party scripts on websites have been extracting personal information in increasingly intrusive ways. [0]
by Steven Englehardt, Gunes Acar, and Arvind Narayanan

Update: we’ve released our data — the list of sites with session-replay scripts, and the sites where we’ve confirmed recording by third parties.

You may know that most websites have third-party analytics scripts that record which pages you visit and the searches you make.  But lately, more and more sites use “session replay” scripts. These scripts record your keystrokes, mouse movements, and scrolling behavior, along with the entire contents of the pages you visit, and send them to third-party servers. Unlike typical analytics services that provide aggregate statistics, these scripts are intended for the recording and playback of individual browsing sessions, as if someone is looking over your shoulder.

[Read more…]

I never signed up for this! Privacy implications of email tracking

In this post I discuss a new paper that will appear at PETS 2018, authored by myself, Jeffrey Han, and Arvind Narayanan.

What happens when you open an email and allow it to display embedded images and pixels? You may expect the sender to learn that you’ve read the email, and which device you used to read it. But in a new paper we find that privacy risks of email tracking extend far beyond senders knowing when emails are viewed. Opening an email can trigger requests to tens of third parties, and many of these requests contain your email address. This allows those third parties to track you across the web and connect your online activities to your email address, rather than just to a pseudonymous cookie.

Illustrative example. Consider an email from the deals website LivingSocial (see details of the example email). When the email is opened, client will make requests to 24 third parties across 29 third-party domains.[1] A total of 10 third parties receive an MD5 hash of the user’s email address, including major data brokers Datalogix and Acxiom. Nearly all of the third parties (22 of the 24) set or receive cookies with their requests. In a webmail client the cookies are the same browser cookies used to track users on the web, and indeed many major web trackers (including domains belonging to Google, comScore, Adobe, and AOL) are loaded when the email is opened. While this example email has a large number of trackers relative to the average email in our corpus, the majority of emails (70%) embed at least one tracker.

How it works. Email tracking is possible because modern graphical email clients allow rendering a subset of HTML. JavaScript is invariably stripped, but embedded images and stylesheets are allowed. These are downloaded and rendered by the email client when the user views the email.[2] Crucially, many email clients, and almost all web browsers, in the case of webmail, send third-party cookies with these requests. The email address is leaked by being encoded as a parameter into these third-party URLs.

Diagram showing the process of tracking with email address

When the user opens the email, a tracking pixel from “tracker.com” is loaded. The user’s email address is included as a parameter within the pixel’s URL. The email client here is a web browser, so it automatically sends the tracking cookies for “tracker.com” along with the request. This allows the tracker to create a link between the user’s cookie and her email address. Later, when the user browses a news website, the browser sends the same cookie, and thus the new activity can be connected back to the email address. Email addresses are generally unique and persistent identifiers. So email-based tracking can be used for targeting online ads based on offline activity (say, to shoppers who used a loyalty card linked to an email address) and for linking different devices belonging to the same user.

[Read more…]