A Privacy Threat Model for The People of Seattle
[no description provided]Some of us in the Seattle Privacy Coalition [link to https://www.seattleprivacy.org/ no longer works] have been talking about creating a model of a day in the life of a citizen or resident in Seattle, and the way data is collected and used; that is the potential threats to their privacy. In a typical approach, we focus on a system that we're building, analyzing or testing. In this model, I think we need to focus on the people, the 'data subjects.'
I also want to get away from the one by one issues, and help us look at the problems we face more holistically.
The general approach I use to threat model is based on 4 questions:
- What are you working on? (building, deploying, breaking, etc)
- What can go wrong?
- What are you going to do about it?
- Did you do a good job?
I think that we can address the first by building a model of a day, and driving into specifics in each area. For example, get up, check the internet, go to work (by bus, by car, by bike, walking), have a meal out...
One question that we'll probably have to work on is how to address what can go wrong in a model this general? Usually I threat model specific systems or technologies where the answers are more crisp. Perhaps a way to break it out would be:
- What is a Seattlite's day?
- What data is collected, how, and by whom? What models can we create to help us understand? Is there a good balance between specificity and generality?
- What can go wrong? (There are interesting variations in the answer based on who the data is about)
- What could we do about it? (The answers here vary based on who's collecting the data.)
- Did we do a good job?
My main goal is to come away from the exercise with a useful model of the privacy threats to Seattleites. If we can, I'd also like to understand how well this "flipped" approach works.
[As I've discussed this, there's a lot of interest in what comes out and what it means, but I don't expect that to be the main focus of discussion on Saturday. For example,] There are also policy questions like, "as the city takes action to collect data, how does that interact with its official goal to be a welcoming city?" I suspect that the answer is 'not very well,' and that there's an opportunity for collaboration here across the political spectrum. Those who want to run a 'welcoming city' and those who distrust government data collection can all ask how Seattle's new privacy program will help us.
In any event, a bunch of us will be getting together at the Delridge Library this Saturday, May 13, at 1PM to discuss for about 2 hours, and anyone interested is welcome to join us. We'll just need two forms of ID and your consent to our outrageous terms of service. (Just kidding. We do not check ID, and I simply ask that you show up with a goal of respectful collaboration, and a belief that everyone else is there with the same good intent.)