Social Workshop And Trip Reports Issues A whole picture is worth a thousand words by Anne Adams My security research, particularly into privacy, has meant effectively communicating my findings to a wide variety of people: from security experts to social scientists. I usually manage to bridge the discipline divides because my findings relate to real situations with relevant solutions. However, recently a security expert became agitated by my presentation because, as he argued, he'd been expecting me to talk about HCI not social issues. Quite worried by his relegating of HCI to only interface issues I suggested that, from my experience, identifying both successful and unsuccessful 'human computer interaction' often lies in the complexity of the whole picture. This article, therefore, highlights how, with regard to privacy, the whole picture is vital in system design. The complex relationship between data, information and privacy invasion has not yet been fully identified. However, it is important to understand the complexity of this issue and the trade-offs that people make against their privacy. These trade-offs usually relate to three users' perceptions: 1. how sensitive the information is, 2. who will be receiving it, and 3. what it will be used for. Many computer privacy mechanisms and relevant policies rely on a simplistic distinction of privacy into personal and non-personal information. Privacy trade-offs we make don't always fit information into these categories. Supermarket loyalty cards can identify how many bars of chocolate a shopper has bought so as, for instance, to send them money-off tokens for chocolate. Many people consider this an acceptable trade-off of privacy since the information is not personal and the benefits are considered higher than potential privacy risks. However, if all the people who bought more than 5 bars of chocolate a week were sent marketing details under the label of 'chocolate-freaks', and identified by this term at the checkout, would it be the information that was potentially invasive or the way they were being perceived by others? For us to be private there must be a public environment to be private from and being private can only be reviewed within that public context. There are privacy trade-offs that occur between our own best interests and those of society as a whole. The balance between ensuring a community's security and invading an individual's privacy is sometimes a fine line. CCTV (closed circuit television) is one of the fastest growing technologies. Although it provides little or no means of control by those being observed many users accept the potential risks to their privacy in a trade-off with perceived benefits for the greater social good (e.g. catching criminals). Such trade-offs are usually made within an environment where the perceived individual risks are low (i.e. I'm doing nothing wrong, so they won't be looking at me) and/or the perceived benefits are high. If such a risk assessment however turns out to be inaccurate, the implications for privacy are far-reaching. Management using security cameras to evaluate their workforce breaches expected privacy risks because non-security personnel are viewing the information for reasons other than security. Furthermore, if CCTV footage within a department store were used to identify and track customers for potential makeovers this would be invading customers' anonymity and privacy. We must view security as a whole in its context. For securing access to information can ensure privacy and yet some forms of authentication in-turn have privacy implications. For example biometrics data (e.g. finger-prints, retinal scans) is one form of authentication, which could be perceived as invasive in the wrong hands. Who would you be happy to have copies of your fingerprints? Matt Jones, Editor chi-bulletin-social@acm.org SIGCHI Bulletin May/June 2003 12

/lp/association-for-computing-machinery/a-whole-picture-is-worth-a-thousand-words-m0i2INxVOs