Tools for Achieving Usable Ex Post Transparency: A Survey <s> b: CONTEXT-SPECIFIC VISUALISATION <s> A number of mobile applications have emerged that allow users to locate one another. However, people have expressed concerns about the privacy implications associated with this class of software, suggesting that broad adoption may only happen to the extent that these concerns are adequately addressed. In this article, we report on our work on PeopleFinder, an application that enables cell phone and laptop users to selectively share their locations with others (e.g. friends, family, and colleagues). The objective of our work has been to better understand people's attitudes and behaviors towards privacy as they interact with such an application, and to explore technologies that empower users to more effectively and efficiently specify their privacy preferences (or "policies"). These technologies include user interfaces for specifying rules and auditing disclosures, as well as machine learning techniques to refine user policies based on their feedback. We present evaluations of these technologies in the context of one laboratory study and three field studies. <s> BIB001 </s> Tools for Achieving Usable Ex Post Transparency: A Survey <s> b: CONTEXT-SPECIFIC VISUALISATION <s> The rapid adoption of location tracking and mobile social networking technologies raises significant privacy challenges. Today our understanding of people's location sharing privacy preferences remains very limited, including how these preferences are impacted by the type of location tracking device or the nature of the locations visited. To address this gap, we deployed Locaccino, a mobile location sharing system, in a four week long field study, where we examined the behavior of study participants (n=28) who shared their location with their acquaintances (n=373.) Our results show that users appear more comfortable sharing their presence at locations visited by a large and diverse set of people. Our study also indicates that people who visit a wider number of places tend to also be the subject of a greater number of requests for their locations. Over time these same people tend to also evolve more sophisticated privacy preferences, reflected by an increase in time- and location-based restrictions. We conclude by discussing the implications our findings. <s> BIB002 </s> Tools for Achieving Usable Ex Post Transparency: A Survey <s> b: CONTEXT-SPECIFIC VISUALISATION <s> Personal and contextual information are increasingly shared via mobile social networks. Users' locations, activities and their co-presence can be shared easily with online "friends", as their smartphones already access such information from embedded sensors and storage. Yet, people usually exhibit selective sharing behavior depending on contextual attributes, thus showing that privacy, utility, and usability are paramount to the success of such online services. In this paper, we present SPISM, a novel information-sharing system that decides (semi-)automatically whether to share information with others, whenever they request it, and at what granularity. Based on active machine learning and context, SPISM adapts to each user's behavior and it predicts the level of detail for each sharing decision, without revealing any personal information to a third-party. Based on a personalized survey about information sharing involving 70 participants, our results provide insight into the most influential features behind a sharing decision. Moreover, we investigate the reasons for the users' decisions and their confidence in them. We show that SPISM outperforms other kinds of global and individual policies, by achieving up to 90% of correct decisions. <s> BIB003 </s> Tools for Achieving Usable Ex Post Transparency: A Survey <s> b: CONTEXT-SPECIFIC VISUALISATION <s> The ever increasing popularity of apps stems from their ability to provide highly customized services to the user. The flip side is that in order to provide such services, apps need access to very sensitive private information about the user. This leads to malicious apps that collect personal user information in the background and exploit it in various ways. Studies have shown that current app vetting processes which are mainly restricted to install time verification mechanisms are incapable of detecting and preventing such attacks. We argue that the missing fundamental aspect here is a comprehensive and usable mobile privacy solution, one that not only protects the user's location information, but also other equally sensitive user data such as the user's contacts and documents. A solution that is usable by the average user who does not understand or care about the low level technical details. To bridge this gap, we propose privacy metrics that quantify low-level app accesses in terms of privacy impact and transforms them to high-level user understandable ratings. We also provide the design and architecture of our Privacy Panel app that represents the computed ratings in a graphical user-friendly format and allows the user to define policies based on them. Finally, experimental results are given to validate the scalability of the proposed solution. <s> BIB004 </s> Tools for Achieving Usable Ex Post Transparency: A Survey <s> b: CONTEXT-SPECIFIC VISUALISATION <s> Location-Based Mobile Service (LBMS) is one of the most popular smartphone services. LBMS enables people to more easily connect with each other and analyze the aspects of their lives. However, sharing location data can leak people's privacy. We present PDVLoc, a controlled location data-sharing framework based on selectively sharing data through a Personal Data Vault (PDV). A PDV is a privacy architecture in which individuals retain ownership of their data. Data are routinely filtered before being shared with content-service providers, and users or data custodian services can participate in making controlled data-sharing decisions. Introducing PDVLoc gives users flexible and granular access control over their location data. We have implemented a prototype of PDVLoc and evaluated it using real location-sharing social networking applications, Google Latitude and Foursquare. Our user study of 19 participants over 20 days shows that most users find that PDVLoc is useful to manage and control their location data, and are willing to continue using PDVLoc. <s> BIB005 </s> Tools for Achieving Usable Ex Post Transparency: A Survey <s> b: CONTEXT-SPECIFIC VISUALISATION <s> While mobile sensing applications are booming, the sensor management mechanisms in current smartphone operating systems are left behind -- they are incomprehensive and coarse-grained, exposing a huge attack surface for malicious or aggressive third party apps to steal user's private information through mobile sensors. In this paper, we propose a privacy-aware sensor management framework, called SemaDroid, which extends the existing sensor management framework on Android to provide comprehensive and fine-grained access control over onboard sensors. SemaDroid allows the user to monitor the sensor usage of installed apps, and to control the disclosure of sensing information while not affecting the app's usability. Furthermore, SemaDroid supports context-aware and quality-of-sensing based access control policies. The enforcement and update of the policies are in real-time. Detailed design and implementation of SemaDroid on Android are presented to show that SemaDroid works compatible with the existing Android security framework. Demonstrations are also given to show the capability of SemaDroid on sensor management and on defeating emerging sensor-based attacks. Finally, we show the high efficiency and security of SemaDroid. <s> BIB006 </s> Tools for Achieving Usable Ex Post Transparency: A Survey <s> b: CONTEXT-SPECIFIC VISUALISATION <s> The ubiquitous availability of location data to smartphone apps and online social networks has caused the collection of such information to grow at an unprecedented rate. However, the discriminative power and potential uses of this data collection is not always clear to the end user. In this work, we present FindYou, a web-based application that gives users the ability to perform a location data privacy audit. FindYou lets users import and visualize the location data collected by popular web services in order to understand what these companies know or can easily infer about them. Additionally, FindYou gives users the option to donate their data to the scientific community, creating new mobile datasets linked to user properties that will be open to use by academic institutions. We hope that FindYou will increase awareness of the privacy issues surrounding the collection and use of location data, the potential problem of "digital red-lining", and also create valuable new datasets with the full informed consent of interested users. <s> BIB007
In many cases, the specific usage context of TETs suggests a form of graphical representation that is contextually related to the underlying functionality. Table 5 lists publications keyed by the visual representation chosen for the respective implementation. Section V-E.3 discusses TETs that employ multiple forms of representation. Chronological views, sometimes called timelines, display distinctive events in chronological order ( Figure 11 ). Data items are singular atomic items of personal data. Group views comprise semantically related items, such as groups of users that are contextually related. Hierarchical views visualise hierarchical one-to-many relationships between superordinate and subordinate items (Figure 7) . If multiple levels are displayed simultaneously, such views are sometimes referred to as 'tree views'  . Home screen refers to displaying data prominently on the home screen of a device. Maps visualise coordinates in a geographical representation (Figure 8 ). Notification denotes messages used to notify users about events at the time of the incident. Service refers to a view based on individual services or service providers to whom users have disclosed personal data. For example, a considerable amount of the TETs reviewed were designed to enhance the transparency of location-based services. The majority of such TETs employ established webbased services, such as Google Maps  BIB003 , BIB005 , BIB007 or OpenStreetMap 18  . Some TETs overlay the standard map views of these services with additional, contextually enriched  https://maps.google.com/ 18 https://www.openstreetmap.org/ FIGURE 8. Geographical boundaries by a) Mun et al. BIB005 , and b) Sadeh et al. BIB001 . information, such as blurry areas in which a particular person can be found without revealing that person's exact location. Four reviewed TETs use semi-transparent shapes to signify the respective areas of interest. Mun et al. BIB005 and Toch et al. BIB002 use circular boundaries to visualise contiguous shapes (Figure 8a ), whereas Xu et al. BIB006 use polygonal shapes, and Sadeh et al. BIB001 circumscribe such areas with rectangular lines (Figure 8b ). Biswas et al. BIB004 and Toch et al. BIB002 use heat maps to symbolise fuzzy areas based on geographic coordinates (Figure 9 ). By including coloured nuances in the visualisation, heat maps add an additional dimension to the location data, which Toch et al. BIB002 use to signify the entropy of individual geographic measuring points (Figure 8b ).