Tools for Achieving Usable Ex Post Transparency: A Survey <s> a: JUDGMENTAL STATEMENT <s> Studies have shown that users have great difficulty specifying their security and privacy policies in a variety of application domains. While machine learning techniques have successfully been used to refine models of user preferences, such as in recommender systems, they are generally configured as "black boxes" that take control over the entire policy and severely restrict the ways in which the user can manipulate it. This article presents an alternative approach, referred to as user-controllable policy learning. It involves the incremental manipulation of policies in a context where system and user refine a common policy model. The user regularly provides feedback on decisions made based on the current policy. This feedback is used to identify (learn) incremental policy improvements which are presented as suggestions to the user. The user, in turn, can review these suggestions and decide which, if any, to accept. The incremental nature of the suggestions enhances usability, and because the user and the system manipulate a common policy representation, the user retains control and can still make policy modifications by hand. Results obtained using a neighborhood search implementation of this approach are presented in the context of data derived from the deployment of a friend finder application, where users can share their locations with others, subject to privacy policies they refine over time. We present results showing policy accuracy, which averages 60% upon initial definition by our users climbing as high as 90% using our technique. <s> BIB001 </s> Tools for Achieving Usable Ex Post Transparency: A Survey <s> a: JUDGMENTAL STATEMENT <s> A number of mobile applications have emerged that allow users to locate one another. However, people have expressed concerns about the privacy implications associated with this class of software, suggesting that broad adoption may only happen to the extent that these concerns are adequately addressed. In this article, we report on our work on PeopleFinder, an application that enables cell phone and laptop users to selectively share their locations with others (e.g. friends, family, and colleagues). The objective of our work has been to better understand people's attitudes and behaviors towards privacy as they interact with such an application, and to explore technologies that empower users to more effectively and efficiently specify their privacy preferences (or "policies"). These technologies include user interfaces for specifying rules and auditing disclosures, as well as machine learning techniques to refine user policies based on their feedback. We present evaluations of these technologies in the context of one laboratory study and three field studies. <s> BIB002 </s> Tools for Achieving Usable Ex Post Transparency: A Survey <s> a: JUDGMENTAL STATEMENT <s> Today's smartphone applications expect users to make decisions about what information they are willing to share, but fail to provide sufficient feedback about which privacy-sensitive information is leaving the phone, as well as how frequently and with which entities it is being shared. Such feedback can improve users' understanding of potential privacy leakages through apps that collect information about them in an unexpected way. Through a qualitative lab study with 19 participants, we first discuss misconceptions that smartphone users currently have with respect to two popular game applications that frequently collect the phone's current location and share it with multiple third parties. To measure the gap between users' understanding and actual privacy leakages, we use two types of interfaces that we developed: just-in-time notifications that appear the moment data is shared and a visualization that summarizes the shared data. We then report on participants' perceived benefits and concerns regarding data sharing with smartphone applications after experiencing notifications and having viewed the visualization. We conclude with a discussion on how heightened awareness of users and usable controls can mitigate some of these concerns. <s> BIB003 </s> Tools for Achieving Usable Ex Post Transparency: A Survey <s> a: JUDGMENTAL STATEMENT <s> The ever increasing popularity of apps stems from their ability to provide highly customized services to the user. The flip side is that in order to provide such services, apps need access to very sensitive private information about the user. This leads to malicious apps that collect personal user information in the background and exploit it in various ways. Studies have shown that current app vetting processes which are mainly restricted to install time verification mechanisms are incapable of detecting and preventing such attacks. We argue that the missing fundamental aspect here is a comprehensive and usable mobile privacy solution, one that not only protects the user's location information, but also other equally sensitive user data such as the user's contacts and documents. A solution that is usable by the average user who does not understand or care about the low level technical details. To bridge this gap, we propose privacy metrics that quantify low-level app accesses in terms of privacy impact and transforms them to high-level user understandable ratings. We also provide the design and architecture of our Privacy Panel app that represents the computed ratings in a graphical user-friendly format and allows the user to define policies based on them. Finally, experimental results are given to validate the scalability of the proposed solution. <s> BIB004 </s> Tools for Achieving Usable Ex Post Transparency: A Survey <s> a: JUDGMENTAL STATEMENT <s> Personal and contextual information are increasingly shared via mobile social networks. Users' locations, activities and their co-presence can be shared easily with online "friends", as their smartphones already access such information from embedded sensors and storage. Yet, people usually exhibit selective sharing behavior depending on contextual attributes, thus showing that privacy, utility, and usability are paramount to the success of such online services. In this paper, we present SPISM, a novel information-sharing system that decides (semi-)automatically whether to share information with others, whenever they request it, and at what granularity. Based on active machine learning and context, SPISM adapts to each user's behavior and it predicts the level of detail for each sharing decision, without revealing any personal information to a third-party. Based on a personalized survey about information sharing involving 70 participants, our results provide insight into the most influential features behind a sharing decision. Moreover, we investigate the reasons for the users' decisions and their confidence in them. We show that SPISM outperforms other kinds of global and individual policies, by achieving up to 90% of correct decisions. <s> BIB005
Some TETs take a judgmental stance in terms of displaying information. Such visualisations aim to hint at consequences that might arise for a data subject who disclosed her data. Respective implementations rely on thresholds that, once exceeded or fallen short of, result in changing the characteristics of the visualisation. For example, some TETs rely on a change of colour, size or shape of the visualisation to signify the level of impact of the disclosure on the user's privacy (Section V-E.1). Depending on the effect the designers of the TET intended to induce in the user, such alterations reside in the continuous range between subliminal and eye-catching. Changes of characteristics can be used to indicate the severity of the circumstances more clearly, or even to nudge a user towards action. By making judgmental statements, such tools may, for example, stimulate a certain behaviour in the user, which may not be achievable by solely relying on neutral facts. However, a judgmental view is not mutually exclusive to a neutral stance. In fact, TETs that assume both stances by providing both types of data might satisfy scrutinising users better than the ones that provide just a singular view. On the one hand, judgement or attempts to nudge a user into acting or reacting in a certain way might aid inexperienced users in getting a clearer picture of the privacy issues underlying their online activities. For example, the TET presented by Balebako et al. BIB003 changes the colour of their display, if the total amount of disclosures of a trait exceeds a certain threshold (Figure 6a ), while Hsieh et al.  use a change of colour of the taskbar icon to indicate the fact that the user's personal data have been queried. On the other hand, judgement on the part of an algorithm might be misleading in that it does not necessarily reflect the actual view of a particular user, let alone all possible users. Different users have different conceptions as regards the severity of disclosing particular data items, and many algorithms will not be able to satisfyingly take each user's preferences into account. The algorithm that determines whether the disclosure is acceptable, marginal or critical in a specific scenario is often not transparent to users, nor are the hardcoded settings of respective threshold values (Figure 6b ). Many TETs reviewed do not seem to allow users to customise these values in order to accommodate their individual requirements for particular types of data. The TET presented by Biswas et al. BIB004 allows users to set individual ratings for the monitored modalities that serve as thresholds for judgmental statements made by the TET. A few other TETs handle individualisation by employing machine learning to learn the user's preferences by analysing the decisions she made in past BIB001 , BIB002 , BIB005 . Some of these implementations predict contextually related future decisions with high accuracy, or even allow trained classifiers to make decisions autonomously. Decisions made in lieu of a user of such TETs can be reviewed at any time. However, the fundamental functionality of automated decision-making processes may not be transparent to the majority of users.