Tools for Achieving Usable Ex Post Transparency: A Survey <s> D. AWARENESS AND TRUST <s> This paper provides a short survey on transparency tools for privacy purposes. It defines the term transparency tools, argues why they are important and gives examples for transparency tools. A classification of transparency tools is suggested and some example tools are analyzed with the help of the classification. <s> BIB001 </s> Tools for Achieving Usable Ex Post Transparency: A Survey <s> D. AWARENESS AND TRUST <s> The work presented in this paper introduces the concept of On-line Interactive (OI) privacy feature which is defined as any on-line interactive tool, component or user-interface that creates privacy awareness and supports users in understanding their on-line privacy risks. These features have been developed as an interactive social translucence map that discloses the flow of personal information, a privacy enquiry for a direct chat about users' privacy concerns and a discussion forum presenting users' privacy concerns using their language in an interactive FAQ format. The paper presents an evaluation of a prototype of this set of embedded OI privacy features. The field study presented evaluates the prototype's usability and its effect on users' privacy awareness, understanding and attitude. 100 participants took part in the study and were drawn from groups of experienced and less experienced users. Both quantitative and qualitative data collection methods were used. Findings suggest that OI privacy features increase users' privacy awareness and encourage users to find out more about the uses of their personal data. However, users' ICT skills and Internet experience significantly influence whether a feature is favoured or otherwise. In general, it is concluded that privacy features are very much welcomed and necessary to empower users to manage their privacy concerns but some groups need to be further supported by social and institutional privacy management processes. <s> BIB002 </s> Tools for Achieving Usable Ex Post Transparency: A Survey <s> D. AWARENESS AND TRUST <s> A large body of research has focused on disclosure policies for controlling information release in social sharing (e.g., location-based) applications. However, less work has considered how exposed these policies actually leave users; i.e., to what extent are disclosures in compliance with these policies actually being made? For instance, consider a disclosure policy granting Alice's coworkers access to her location during work hours. Alice might feel that this policy appropriately controls her exposure, but may feel differently if she learned that her boss was accessing her location every 5 minutes. In addition to specifying who has access to personal information, users need a way to quantify, interpret, and control the extent to which this data is shared. We propose and evaluate an intuitive mechanism for summarizing and controlling a user's exposure on smartphone-based platforms. Our approach uses the visual metaphor of eyes appearing and growing in size on the home screen; the rate at which these eyes grow depends on the number of accesses granted for a user's location, and the type of person (e.g., family vs. friend) making these accesses. This approach gives users an accurate and ambient sense of their exposure and helps them take actions to limit their exposure, all without explicitly identifying the social contacts making requests. Through two systematic user studies (N = 43,41) we show that our interface is indeed effective at summarizing complex exposure information and provides comparable information to a more cumbersome interface presenting more detailed information. <s> BIB003 </s> Tools for Achieving Usable Ex Post Transparency: A Survey <s> D. AWARENESS AND TRUST <s> One of the main security concerns related to the cloud hosting and virtualization, is the lack of Trust in the infrastructure. This lack of trust is due to the absence of transparency concerning the data handling and storage conditions. There are no concrete technical guarantees that can convince a potential cloud customer that he is fully controlling his data. In this paper we propose a security service (called SPACE) in the cloud that provides all the tools to data owner to impose his privacy preferences during the virtualization phase. SPACE is based on the sticky policy technology and offers access and usage control functionalities to the data anywhere in the cloud. In addition to the main security features offered by SPACE, new visualization and control functionalities are proposed to make the user fully aware on the storage condition of his private information. <s> BIB004 </s> Tools for Achieving Usable Ex Post Transparency: A Survey <s> D. AWARENESS AND TRUST <s> Today's smartphone applications expect users to make decisions about what information they are willing to share, but fail to provide sufficient feedback about which privacy-sensitive information is leaving the phone, as well as how frequently and with which entities it is being shared. Such feedback can improve users' understanding of potential privacy leakages through apps that collect information about them in an unexpected way. Through a qualitative lab study with 19 participants, we first discuss misconceptions that smartphone users currently have with respect to two popular game applications that frequently collect the phone's current location and share it with multiple third parties. To measure the gap between users' understanding and actual privacy leakages, we use two types of interfaces that we developed: just-in-time notifications that appear the moment data is shared and a visualization that summarizes the shared data. We then report on participants' perceived benefits and concerns regarding data sharing with smartphone applications after experiencing notifications and having viewed the visualization. We conclude with a discussion on how heightened awareness of users and usable controls can mitigate some of these concerns. <s> BIB005 </s> Tools for Achieving Usable Ex Post Transparency: A Survey <s> D. AWARENESS AND TRUST <s> As the amount of users' information collected and exchanged on the Internet is growing, so are, consequently, the users' concerns that their privacy might be violated. Some studies have shown that a large number of users avoid engaging in online services due to privacy concerns. It has been suggested that increased transparency of privacy related mechanisms may promote users' trust. This paper reviews the relationship between users' privacy concerns, transparency enhancing and privacy enhancing mechanisms on the one hand, and users' trust on the other, based on the existing literature. Our literature review demonstrates that previous studies have produced inconsistent results, implying this relationship should be re-examined in future work. Impact of higher transparency on users' trust has been insufficiently studied. Current research seems to suggest that the increase of the understanding of privacy issues increases importance of privacy for trust. Use of privacy enhancing mechanisms by service provider also seems to promote the trust, but this may only hold when these mechanisms are understood by the user. A need for tools that would provide users with this kind of knowledge has also been repeatedly recognized. Additionally, this paper provides an overview and description of the currently available transparency enhancing tools. To the best of our knowledge, no such overview has been available to this end. We demonstrate that the majority of tools promote awareness. Most of them attempt to provide a better understanding of privacy policies, or provide insight in the third party tracking behavior. Two tools have been identified that provide some insight in the collected user's data. No tool providing specific information on, or access to, processing logic has been identified. <s> BIB006 </s> Tools for Achieving Usable Ex Post Transparency: A Survey <s> D. AWARENESS AND TRUST <s> Location-Based Mobile Service (LBMS) is one of the most popular smartphone services. LBMS enables people to more easily connect with each other and analyze the aspects of their lives. However, sharing location data can leak people's privacy. We present PDVLoc, a controlled location data-sharing framework based on selectively sharing data through a Personal Data Vault (PDV). A PDV is a privacy architecture in which individuals retain ownership of their data. Data are routinely filtered before being shared with content-service providers, and users or data custodian services can participate in making controlled data-sharing decisions. Introducing PDVLoc gives users flexible and granular access control over their location data. We have implemented a prototype of PDVLoc and evaluated it using real location-sharing social networking applications, Google Latitude and Foursquare. Our user study of 19 participants over 20 days shows that most users find that PDVLoc is useful to manage and control their location data, and are willing to continue using PDVLoc. <s> BIB007 </s> Tools for Achieving Usable Ex Post Transparency: A Survey <s> D. AWARENESS AND TRUST <s> While mobile sensing applications are booming, the sensor management mechanisms in current smartphone operating systems are left behind -- they are incomprehensive and coarse-grained, exposing a huge attack surface for malicious or aggressive third party apps to steal user's private information through mobile sensors. In this paper, we propose a privacy-aware sensor management framework, called SemaDroid, which extends the existing sensor management framework on Android to provide comprehensive and fine-grained access control over onboard sensors. SemaDroid allows the user to monitor the sensor usage of installed apps, and to control the disclosure of sensing information while not affecting the app's usability. Furthermore, SemaDroid supports context-aware and quality-of-sensing based access control policies. The enforcement and update of the policies are in real-time. Detailed design and implementation of SemaDroid on Android are presented to show that SemaDroid works compatible with the existing Android security framework. Demonstrations are also given to show the capability of SemaDroid on sensor management and on defeating emerging sensor-based attacks. Finally, we show the high efficiency and security of SemaDroid. <s> BIB008
Some user studies conducted in the publications reviewed in this survey indicate that, in general, test persons appreciate the service of the TETs, most notably because they allowed for an increased level of awareness of the circumstances under which their personal data were disclosed. On these grounds, TETs have achieved the goal of improving the transparency of the underlying process. Conversely, Balebako et al. BIB005 state that average users ''lack any consumer education'' and tend to be mostly unaware of the potential risks that arise from using technology that will or might disclose their personal data. On the one hand, this discrepancy between desired and actual awareness on the part of users encourages further research on TETs. On the other hand, it gives rise to the question as regards the general decisiveness of statements made by test persons who evaluate processes about which they may have little actual knowledge. Kani-Zabihi et al. BIB002 state that the majority of their test subjects (68%) considered the service provider of the TET trustworthy, whereas the rest either disagreed or were indifferent. Trabelsi et al. BIB004 and Zavou et al.  discuss the aspect of trust with regard to a remote entity, such as an online service provider. They describe TETs as potential enabler technologies that make transactions more transparent. The architecture designs presented by BIB007 , BIB003 , and  rely on a central trusted authority that either controls or stores personal data, and whose purpose is to protect the data from unauthorised access by potentially untrusted parties. In these scenarios, data subjects would have to trust a single centralised entity with a superset of their personal data that they may want to share with other parties. Xu et al. BIB008 describe a model of trust based on the various components of the system architecture on top of which their TET is built.  ,  , BIB003 , and BIB007 rely on the assumption that the TET as such is trustworthy. However, only Balebako et al. BIB005 and Kani-Zabihi et al. BIB002 explicitly address the aspect of trust with regard to the test subjects' perception of their evaluated TETs, that is, whether and why such users would trust a TET, while at the same time scrutinising the trustworthiness of a different stakeholder. At first glance, a data subject's lack of trust in a particular data controller suggests using a TET as an obvious means to verify and, if necessary, rectify disclosed personal data. However, reassigning personal trust from one party to another inevitably raises the question as to whether such a shift is reasonable or justified, if only because introducing an additional link complicates the chain of trust as a whole. Trust, or the absence thereof, in stakeholders relates to Hedbom's BIB001 categorisation of trust requirements as regards the entity that provides the privacy-enhancing functionality. Hedbom defines that entities, such as client, server or third party, be either trusted, or that ''no trust [is] needed.'' Conversely, Janic et al. BIB006 summarise that better understanding privacy issues ''increases the importance of privacy for trust.'' They state that at the time of their publication, no tools could be identified that enabled users to better understand scenarios that dealt with complex data processing scenarios. They conclude that classifying the appropriate type of visualisation required to promote trust is a major goal in future work.