Understanding and Protecting Privacy: Formal Semantics and Principled Audit Mechanisms

Abstract

Abstract. Privacy has become a significant concern in modern society as personal information about individuals is increasingly collected, used, and shared, often using digital technologies, by a wide range of organizations. Certain information handling practices of organizations that monitor individuals' activities on the Web, data aggregation companies that compile massive databases of personal information, cell phone companies that collect and use location data about individuals, online social networks and search engines-while enabling useful services-have aroused much indignation and protest in the name of privacy. Similarly, as healthcare organizations are embracing electronic health record systems and patient portals to enable patients, employees, and business affiliates more efficient access to personal health information, there is trepidation that the privacy of patients may not be adequately protected if information handling practices are not carefully designed and enforced. Given this state of affairs, it is very important to arrive at a general understanding of (a) why certain information handling practices arouse moral indignation, what practices or policies are appropriate in a given setting, and (b) how to represent and enforce such policies using information processing systems. This article summarizes progress on a research program driven by goal (b). We describe a semantic model and logic of privacy that formalizes privacy as a right to appropriate flows of personal information-a position taken by contextual integrity, a philosphical theory of privacy for answering questions of the form identified in (a). The logic is designed with the goal of enabling specification and enforcement of practical privacy policies. It has been used to develop the first complete formalization of two US privacy laws-the HIPAA Privacy Rule that prescribes and proscribes flows of personal health information, and the Gramm-Leach-Bliley Act that similarly governs flows of personal financial information. Observing that preventive access control mechanisms are not sufficient to enforce such privacy policies, we develop two complementary audit mechanisms for policy enforcement. These mechanisms enable auditing of practical privacy policies, including the entire HIPAA Privacy Rule. The article concludes with a vision for further research in this area.

Correct Audit Logging: Theory and Practice

“…Previous work by DeYoung et al has studied audit policy specification for medical (HIPAA) and business (GLBA) processes [20,19].This work illustrates the effectiveness and generality of a temporal logic foundation for audit policy specification, which is well-founded in a general theory of privacy [18]. Their auditing system has also been implemented in a tool similar to an interactive theorem prover [24].…”

“…That is the focus of this paper. Other work has focused on formalisms for querying logs [39,18], however these works presuppose correctness of audit logs for true accountability.…”

“…Various approaches are taken to audit log generation and representation, including logical [18], database [1], and probabilistic approaches [43]. Information algebra is sufficiently general to contain relevant systems as instances, so our notions of soundness and completeness can apply broadly.…”

Privacy-respecting digital investigation

“…Their model overcomes traditional issues caused by separation of the rights and obligation notions that enables representing contracts with equal semantics in the same syntax. Datta et al, [26] proposed formal semantics and a model to represent privacy as a contextoriented right to appropriate flows of personal information and use it to model US Health and Human Services (HIPAA) [27].…”

Type Checking Privacy Policies in the π-calculus

“…To begin with, a number of languages have been proposed to express privacy policies [16,15] and can be used to verify the consistency of policies or to check whether a system complies with a certain policy via static techniques such as model checking [15,13], on-the-fly using monitoring, or through audit procedures [7,2].…”