This work was supported by the Engineering and Physical Sciences Research Council [grant number EP/G002606/1].Location-Based Services (LBSes) are increasing in popularity, but create many privacy concerns for users. LBSes usually rely on the same default privacy settings for all users. In this position paper, we claim that such settings are inappropriate for location sharing and that settings should instead rely on contextual information to recommend personalised privacy settings for users. We present results of an initial user study (n=80) to corroborate this position, and suggest avenues for further research.PostprintPeer reviewe

Abdesslem, Fehmi Ben

Brostoff, Sacha

Henderson, Tristan

Sasse, M. Angela

English

Location-Based Services (LBSes) are increasing in popularity, but create many privacy concerns for users. LBSes usually rely on the same default privacy settings for all users. In this position paper, we claim that such settings are inappropriatefor location sharing and that settings should instead rely on contextual information to recommend personalised privacy settings for users. We present results of an initial user study (n=80) to corroborate this position, and suggest avenues for further research

University of St. Andrews - Pure

Context-based personalised settings for mobile location sharing

Location-Based Services (LBSes) are increasing in popularity, but create many privacy concerns for users. LBSes usually rely on the same default privacy settings for all users. In this position paper, we claim that such settings are inappropriate for location sharing and that settings should instead rely on contextual information to recommend personalised privacy settings for users. We present results of an initial user study (n=80) to corroborate this position, and suggest avenues for further research

Ben Abdesslem, F

Henderson, T

Brostoff, S

Sasse, MA

UCL Discovery

Context-based Personalised Settingsfor Mobile Location SharingFehmi Ben Abdesslemand Tristan HendersonSchool of Computer ScienceUniversity of St AndrewsSt Andrews, Fife, United Kingdom{fba,tnhh}@st-andrews.ac.ukSacha Brostoffand M. Angela SasseDepartment of Computer ScienceUniversity College LondonLondon, United Kingdom{s.brostoff,a.sasse}@cs.ucl.ac.ukABSTRACTLocation-Based Services (LBSes) are increasing in popular-ity, but create many privacy concerns for users. LBSes usu-ally rely on the same default privacy settings for all users. Inthis position paper, we claim that such settings are inappro-priate for location sharing and that settings should insteadrely on contextual information to recommend personalisedprivacy settings for users. We present results of an initialuser study (n=80) to corroborate this position, and suggestavenues for further research.1. INTRODUCTIONLocation-Based Services (LBSes) have become increas-ingly popular and, coupled with recent growth in smartphoneusage, provide an interesting platform for the deploymentof recommendation and personalisation technologies. Theseservices, however, introduce many potential privacy prob-lems: a recent survey reveals that 84% of users are con-cerned about potential losses of privacy when using LBSes,and 49% would be more comfortable if they could easily andclearly manage who sees their location information.1 Man-aging who can see one’s personal information is currentlydone through static settings for most popular Social NetworkSites (SNSes) such as Facebook, Twitter or Google+; usersare asked to adjust their settings and these are typically ap-plied to all interactions with a given member or set of mem-bers on the site. Such static settings might be appropriate forsharing static information: a user’s birthday does not changevery often, and so the set of users with whom a user mightwish to share their birthday might also not change. But thismight not be true when sharing varying information such aslocation, as privacy preferences may depend on the particu-lar context in which a location is visited, and not only on theperson with whom it would be shared.Nonetheless, LBS settings are usually static, not only forFacebook or Google+’s location-sharing features, but alsofor SNSes dedicated to location sharing such as Gowalla orFoursquare. This may be due to the disruption that would be1Microsoft Research Data Privacy Day 2011, http://www.microsoft.com/privacy/dpd/caused by asking a user about their sharing choices for everylocation. Alternatives to such a disruptive solution wouldbe to automatically predict a user’s sharing choices, or torecommend privacy settings to the user.In this position paper, we propose that before we attemptto provide personalisation and recommendation technolo-gies to mobile users, we should first develop personalisedprivacy settings that can better cope with users’ actual shar-ing preferences than static settings. Using data collectedfrom a mobile location-sharing study with 80 participants,we investigate whether the personalisation of settings canleverage contextual and self-reported information.The remainder of this paper is organised as follows. In thenext section, we demonstrate how static settings are not ap-propriate. Section 3 defines what context could be exploitedby LBS settings and how it could help predicting users’ lo-cation sharing choices. We then review related work in Sec-tion 4 and discuss our position in Section 5.2. STATIC PRIVACY SETTINGSStatic settings for LBSes would be appropriate if usersactually had static privacy preferences while sharing theirlocations with other people. To determine just how constantusers’ behaviours are, we conducted an experiment with 80student participants, each carrying a mobile phone for sevendays and sharing their locations with their social network.Our methodology [2] is divided into three consecutive phases:• Pre-briefing. Participants install a Facebook applica-tion on their personal Facebook account and fill in aquestionnaire.• LBS usage. Over the course of seven days, partici-pants use LocShare, a custom mobile application al-lowing them to share their location with their socialnetwork on Facebook. Using the Experience SamplingMethod, they also reply to automatically generated ques-tions about their experience and sharing choices, sentto them on the mobile phone.• Debriefing. Participants were interviewed and askedfor more explanation about their sharing choices.1Participants were periodically asked to share their currentlocation, or a picture of their current location. Upon receiv-ing a sharing request, a participant had the choice of reply-ing or ignoring the request.2 In addition to these promptedevents, LocShare allowed participants to share their location(described with text comments or a photo) of their own ac-cord without being prompted.In total, 4,334 sharing requests were sent to participants,which led to 2,064 replies (a 47.6% response rate). Partici-pants also shared 531 locations without prompting. We referto any of these 2,595 events as a sharing event. At eachsharing event, participants had the choice of sharing theirlocation with: everyone on Facebook, only their Facebookfriends, only a subset of their Facebook friends, or no-one.In the latter case, the location was still uploaded on Face-book but remained only visible to the participant.3 We fur-ther refer to any of these choices as a sharing choice.Looking at each of the 80 participants, we see that none ofthem made the same sharing choice at each of their sharingevents. In other words, not a single participant would havebeen satisfied with static privacy settings for their location-sharing application. To verify this assumption, we askedparticipants in the pre-briefing to choose a default sharingchoice for the experiment, that would be used when the sys-tem decided to share their location without prompting. Fig-ure 1 shows the Empirical Cumulative Distribution Functionof the sharing choices made by the participants. 23 partic-ipants (28.8%) never used their default sharing choice fortheir sharing events. The participant who most used thedefault sharing choice used it for 97.6% of their sharingevents. Hence, all of the participants made at least one shar-ing choice that differed from their static default sharing choice.From Figure 1 we also see that the median participant usedtheir default settings for just 9.5% of sharing events.In the pre-briefing, participants were asked whether theyhad changed their Facebook privacy settings from their de-fault values. Interestingly, Figure 1 shows that those par-ticipants who use the default Facebook privacy settings (23participants) were more likely to use their default settingsduring the experiment: the median participant in this groupused their default settings for 33.3% of their sharing events.On the other hand, the median participant from the groupthat used personalised Facebook privacy settings used theirdefault settings for only 7% of their sharing events.Not only are static privacy settings inappropriate, theymay lead to unintended information disclosure. Of the 1,889sharing events where participants did not use their defaultsharing settings, 455 of the events (24.1%) used settings less2Ignoring a request was not always deliberate. Participants mayhave not heard the mobile phone ringing, or were temporarily notcovered by the cellular network. The sharing request would thentimeout and no longer be displayed on the phone.3To test a different hypothesis [8], half the participants were allo-cated to a simulated sharing group, where locations were not ac-tually shared, but participants were asked to act as if they were.Results from the two groups are merged in this paper.0 20 40 60 80 1000.00.20.40.60.81.0Proportion of sharing events where a participant shared their location using their default settings (%)Proportion of participantsParticipants using default Facebook privacy settingsAll participantsParticipants using custom Facebook privacy settingsFigure 1: Empirical CDF of the proportion of sharingevents where a participant shared their location usingtheir default settings. No participant made the samesharing choice at every sharing event.permissive than the defaults. In other words, if participantswere unable to personalise their default privacy settings, us-ing their static default privacy settings would have incurred455 privacy leaks, by sharing their location to people withwhom they were not willing to share. We therefore believethat LBSes should provide personalisable privacy settingsthat reflect users’ personal needs.3. TOWARDS CONTEXT-BASED SETTINGSWe have seen that location privacy settings are not staticin practice. We believe that this is because they depend on auser’s current context, e.g., where the user is, who they arewith, what is nearby, and so forth [9]. Indeed, personalisedLBSes are a good example of the context-aware applicationas defined by Schilit et al. [9], as they may involve AutomaticContextual Reconfiguration, as the LBS is reconfigured ac-cording to the context, and Context-Triggered Actions, as thecontext might trigger an action from the LBS (e.g., recom-mending new privacy settings for users).We can imagine a multitude of simple examples wherecontext might influence Alice’s decision to share her loca-tion. In a first scenario, Alice does not mind sharing herlocation to her friends and family wherever she goes, butsome evenings, she is tired and does not want them to pop-up when she is at home. She would then hide her locationfor the evening. In another scenario, Alice does not want herfamily to know that she is with Bob at night. Since she hasno control over Bob’s sharing choices, she wants to hide herlocation to her family in the evening when she is with Bob,as otherwise Alice and Bob would both share the same loca-tion and therefore disclose that they are seeing each other.While Alice’s desired privacy settings are not static, ask-ing for her location-sharing preferences at every new loca-2 0 10 20 30 40 50Leisure Academic Retail Food&DrinkResidential LibraryPrivate and public ratesfor each location type (%) Location typePrivate ratePublic rateFigure 2: Private and public rates for different types oflocations. Participants were less likely to share their lo-cation in Library and Residential areas.tion would be highly disruptive. An alternative solution isthen for the LBS to infer Alice’s privacy settings accordingto the current context. To do so, the system needs to sensecontext, and then determine which contextual informationmight influence Alice’s sharing choices.Recent research has shown that automatically sensing con-text is possible, for instance by sensing activity using theaccelerometer and microphone [6], location using GPS/Wi-Fi/GSM but also compasses and accelerometers [3], and co-located people using Bluetooth [7]. Hence we believe thatcontext can be used by LBSes. But using this sensed con-text to determine what information influences users’ sharingchoices introduces new challenges. The particular informa-tion may vary for each user and may be based on complexsocial considerations.So if context can be used to recommend and personaliseprivacy settings, what contextual information should be used?We now investigate the contextual and self-reported infor-mation that influence our participants’ location sharing choices.We study two extreme behaviours: sharing with nobody, andsharing with everyone on Facebook. We define the privaterate as the proportion of events where locations were sharedto no-one, and the public rate as the proportion of eventswhere locations were shared to everyone.Location itself is the first obvious piece of contextual in-formation that may influence user behaviour. Figure 2 showsthat both private and public rates depend on the type of lo-cation. Participants have higher private rates in the Libraryand Residential areas, and thus share their location less thanin other types of places. On the other hand, public rates arehigher in Leisure, Academic and Retail places. During thedebriefing interviews, some of the reasons provided for notsharing were that participants did not want people to joinwhen they were at the Library, and did not want them toknow that they were staying home on a Saturday night. 0 10 20 30 40 50No-one Friends StrangersPrivate and public rates dependingon presence of other people (%) Co-located peoplePrivate ratePublic rateFigure 3: Private and public rates when the participantsare alone, with friends, and with strangers. Participantswere less likely to share their location when alone. 0 10 20 30 40 50Night time Day timePrivate and public ratesdepending on time of the day (%) Time of dayPrivate ratePublic rateFigure 4: Private and public rates during day time (be-tween 0800 and 2000) and night time. There was littledifference in sharing behaviour over time.The presence of other co-located people is another ex-ample of contextual information that can influence locationsharing. At each sharing event, participants were asked ifthey were with no-one, with friends, or with strangers. Fig-ure 3 shows that the private rate is higher when the partici-pants are alone than when they are with strangers.That said, not every aspect of the context appears to influ-ence sharing choices. For example, Figure 4 shows no cleardifference between day time (0800-2000) and night time.Nonetheless, we believe that these initial results indicatethat gathering more empirical data about users’ choices andcorresponding contexts can provide a better insight on whatcontextual information could be used to recommend person-alised privacy settings to LBS users.34. RELATED WORKContext is key in the development of new services thatwill impact social inclusion for the emerging information so-ciety [4]. It has already been used for various purposes, suchas predicting users’ interests for websites [11]. Anthony etal. [1] show experimentally that privacy preferences varywith place and social context. Fang et al. [5] exploits thisobservation by proposing a privacy recommendation wizardfor Facebook settings. By asking limited questions to usersabout what they would disclose to some of their friends, theygenerate personalised privacy settings. Toch et al. [10] usethe same concept for Locaccino, an LBS that allows theusers to set their default privacy settings by defining who,where, and when they want their location to be disclosed.5. WHAT NEXT?The rise of location-based services will enable the appli-cation of personalisation and recommendation technologiesin people’s everyday lives. But if people are to use theseservices, their requirements need to be respected. Static de-fault privacy settings provided by current location-based ser-vices are inappropriate as they do not meet these require-ments, where the privacy settings for a particular event maybe determined by the context in which the event takes place.We have outlined these user requirements by collecting datathrough a user study, and conducted some initial analysis toshow how we might build LBS systems that can recommendpersonalised privacy settings.Building a usable LBS with personalised privacy settingspresents many interesting challenges. One approach is tobootstrap the system by asking the users for their privacysettings when a new context is detected, and then use thesesame settings when the same context is later encountered.This solution is highly disruptive at the beginning, but shouldeventually become less disruptive when no new contexts areencountered. A second approach is to use data collectedfrom other users with a similar profile who have experiencedsimilar contexts. This requires collecting a large amountof empirical data, however, and either determining how tomatch similar profiles and contexts, or how to choose one de-fault per context. Self-reported data are also a useful sourceof information about the users’ behaviour. For instance, weobserved that the participants who reported using Facebookdefault privacy settings were using default settings more of-ten in our experiment than participants who reported usingcustom privacy settings on Facebook.Using a combination of all these approaches, a systemcould start applying a user’s chosen default setting, and thenuse machine learning techniques to recommend personalisedsettings, based on the context sensed by the mobile device,on behavioural data collected from other users, and on self-reported information about the user.Thus, in this paper we argue that before we can apply per-sonalisation to the services themselves, we should apply per-sonalisation to the privacy settings for these services. Suchpersonalised settings are not only necessary for meeting userrequirements, but they should also be considered as a prereq-uisite for offering personalised services to LBS users: per-sonalised services should not exploit locations that users donot want to share.6. ACKNOWLEDGEMENTSThis work was supported by the Engineering and PhysicalSciences Research Council [grant number EP/G002606/1].7. REFERENCES[1] D. Anthony, T. Henderson, and D. Kotz. Privacy inLocation-Aware computing environments. IEEEPervasive Computing, 6(4):64–72, Oct. 2007.[2] F. Ben Abdesslem, I. Parris, and T. Henderson. Mobileexperience sampling: Reaching the parts of Facebookother methods cannot reach. In Proc. Privacy andUsability Methods Pow-Wow (PUMP), Sept. 2010.[3] I. Constandache, R. Choudhury, and I. Rhee. Towardsmobile phone localization without war-driving. InProc. IEEE INFOCOM, Mar. 2010.[4] J. Coutaz, J. L. Crowley, S. Dobson, and D. Garlan.Context is key. Communications of the ACM,48(3):49–53, Mar. 2005.[5] L. Fang, H. Kim, K. LeFevre, and A. Tami. A privacyrecommendation wizard for users of social networkingsites. In Proc. CCS ’10.[6] G. B. Gil, A. Berlanga, and J. M. Molina. Physicalactions architecture: Context-aware activityrecognition in mobile devices. In Proc. Workshop onUser-Centric Technologies and Applications, pages19–27, Apr. 2011.[7] V. Kostakos, E. O’Neill, A. Penn, G. Roussos, andD. Papadongonas. Brief encounters: Sensing,modeling and visualizing urban mobility andcopresence networks. ACM Transactions onComputer-Human Interaction, 17(1):1–38, Mar. 2010.[8] I. Parris, F. Ben Abdesslem, and T. Henderson.Facebook or Fakebook?: The effect of simulation onconferencelocation privacy user studies. In Proc.Privacy and Usability Methods Pow-Wow (PUMP),Sept. 2010.[9] B. Schilit, N. Adams, and R. Want. Context-Awarecomputing applications. In First Workshop on MobileComputing Systems and Applications (WMCSA),pages 85–90, Dec. 1994.[10] E. Toch, J. Cranshaw, P. H. Drielsma, J. Y. Tsai, P. G.Kelley, J. Springfield, L. Cranor, J. Hong, andN. Sadeh. Empirical models of privacy inconferencelocation sharing. In Proc. Ubicomp 2010,pages 129–138, Sept. 2010.[11] R. W. White, P. Bailey, and L. Chen. Predicting userinterests from contextual information. In Proc. SIGIR’09, pages 363–370, 2009.4

Context-based Personalised Settings for Mobile Location Sharing

Location-Based Services (LBSes) are increasing in popular-ity, but create many privacy concerns for users. LBSes usu-ally rely on the same default privacy settings for all users. In this position paper, we claim that such settings are inappro-priate for location sharing and that settings should instead rely on contextual information to recommend personalised privacy settings for users. We present results of an initial user study (n=80) to corroborate this position, and suggest avenues for further research. 1

Fehmi Ben Abdesslem

Tristan Henderson

Sacha Brostoff

M. Angela Sasse

CiteSeerX

This work was supported by the Engineering and Physical Sciences Research Council [grant number EP/G002606/1].Location-Based Services (LBSes) are increasing in popularity, but create many privacy concerns for users. LBSes usually rely on the same default privacy settings for all users. In this position paper, we claim that such settings are inappropriate for location sharing and that settings should instead rely on contextual information to recommend personalised privacy settings for users. We present results of an initial user study (n=80) to corroborate this position, and suggest avenues for further research.Peer reviewe

St Andrews Research Repository

A privacy recommendation wizard for users of social networking sites.

Brief encounters: Sensing, modeling and visualizing urban mobility and copresence networks.

Context is key.

Context-Aware computing applications.

Empirical models of privacy in conferencelocation sharing.

Facebook or Fakebook?: The effect of simulation on conferencelocation privacy user studies.

Mobile experience sampling: Reaching the parts of Facebook other methods cannot reach.

Physical actions architecture: Context-aware activity recognition in mobile devices.

Predicting user interests from contextual information.

Privacy in Location-Aware computing environments.

Towards mobile phone localization without war-driving.

http://discovery.ucl.ac.uk/1366952/1/pema2011.pdf

Context-based personalised settings for mobile location sharing

Abstract

Similar works

Full text

Available Versions

University of St. Andrews - Pure

University of St. Andrews - Pure

UCL Discovery

CiteSeerX

St Andrews Research Repository