A Survey on Interdependent Privacy <s> Non-cooperative Approaches. <s> The growing interest in Structured Equation Modeling (SEM) techniques and recognition of their importance in IS research suggests the need to compare and contrast different types of SEM techniques so that research designs can be selected appropriately. After assessing the extent to which these techniques are currently being used in IS research, the article presents a running example which analyzes the same dataset via three very different statistical techniques. It then compares two classes of SEM: covariance-based SEM and partial-least-squaresbased SEM. Finally, the article discusses linear regression models and offers guidelines as to when SEM techniques and when regression techniques should be used. The article concludes with heuristics and rule of thumb thresholds to guide practice, and a discussion of the extent to which practice is in accord with these guidelines. <s> BIB001 </s> A Survey on Interdependent Privacy <s> Non-cooperative Approaches. <s> This paper presents a model of local network effects in which agents connected in a social network each value the adoption of a product by a heterogeneous subset of other agents in their neighborhood, and have incomplete information about the structure and strength of adoption complementarities between all other agents. I show that the symmetric Bayes-Nash equilibria of this network game are in monotone strategies, can be strictly Pareto-ranked based on a scalar neighbor-adoption probability value, and that the greatest such equilibrium is uniquely coalition-proof. Each Bayes-Nash equilibrium has a corresponding fulfilled-expectations equilibrium under which agents form local adoption expectations. Examples illustrate cases in which the social network is an instance of a Poisson random graph, when it is a complete graph, a standard model of network effects, and when it is a generalized random graph. A generating function describing the structure of networks of adopting agents is characterized as a function of the Bayes-Nash equilibrium they play, and empirical implications of this characterization are discussed. <s> BIB002 </s> A Survey on Interdependent Privacy <s> Non-cooperative Approaches. <s> Social Networking is one of the major technological phenomena of the Web 2.0, with hundreds of millions of people participating. Social networks enable a form of self expression for users, and help them to socialize and share content with other users. In spite of the fact that content sharing represents one of the prominent features of existing Social Network sites, Social Networks yet do not support any mechanism for collaborative management of privacy settings for shared content. In this paper, we model the problem of collaborative enforcement of privacy policies on shared data by using game theory. In particular, we propose a solution that offers automated ways to share images based on an extended notion of content ownership. Building upon the Clarke-Tax mechanism, we describe a simple mechanism that promotes truthfulness, and that rewards users who promote co-ownership. We integrate our design with inference techniques that free the users from the burden of manually selecting privacy preferences for each picture. To the best of our knowledge this is the first time such a protection mechanism for Social Networking has been proposed. In the paper, we also show a proof-of-concept application, which we implemented in the context of Facebook, one of today's most popular social networks. We show that supporting these type of solutions is not also feasible, but can be implemented through a minimal increase in overhead to end-users. <s> BIB003 </s> A Survey on Interdependent Privacy <s> Non-cooperative Approaches. <s> Measuring privacy risk in online social networks is a challenging task. One of the fundamental difficulties is quantifying the amount of information revealed unintentionally. We present PrivAware, a tool to detect and report unintended information loss in online social networks. Our goal is to provide a rudimentary framework to identify privacy risk and provide solutions to reduce information loss. The first instance of the software is focused on information loss attributed to social circles. In subsequent releases we intend to incorporate additional capabilities to capture ancillary threat models. From our initial results, we quantify the privacy risk attributed to friend relationships in Facebook. We show that for each user in our study a majority of their personal attributes can be derived from social contacts. Moreover, we present results denoting the number of friends contributing to a correctly inferred attribute. We also provide similar results for different demographics of users. The intent of PrivAware is to not only report information loss but to recommend user actions to mitigate privacy risk. The actions provide users with the steps necessary to improve their overall privacy measurement. One obvious, but not ideal, solution is to remove risky friends. Another approach is to group risky friends and apply access controls to the group to limit visibility. In summary, our goal is to provide a unique tool to quantify information loss and provide features to reduce privacy risk. <s> BIB004 </s> A Survey on Interdependent Privacy <s> Non-cooperative Approaches. <s> This article investigates selfish behavior in games where players are embedded in a social context. A framework is presented which allows us to measure the Windfall of Friendship, i.e., how much players benefit (compared to purely selfish environments) if they care about the welfare of their friends in the social network. As a case study, a virus inoculation game is examined. We analyze the Nash equilibria and show that the Windfall of Friendship can never be negative. However, we find that if the valuation of a friend is independent of the total number of friends, the social welfare may not increase monotonically with the extent to which players care for each other; intriguingly, in the corresponding scenario where the relative importance of a friend declines, the Windfall is monotonic again. This article also studies convergence of best-response sequences. It turns out that in social networks, convergence times are typically higher and hence constitute a price of friendship. While such phenomena may be known on an anecdotal level, our framework allows us to quantify these effects analytically. Our formal insights on the worst case equilibria are complemented by simulations on larger social graphs, shedding light on robustness and fairness aspects, as well as on the structure of other equilibria. <s> BIB005 </s> A Survey on Interdependent Privacy <s> Non-cooperative Approaches. <s> As (one's) social network expands, a user's privacy protection goes beyond his privacy settings and becomes a social networking problem. In this research, we aim to address some critical issues related to privacy protection: Would the highest privacy settings guarantee a secure protection? Given the open nature of social networking sites, is it possible to manage one's privacy protection? With the diversity of one's social media friends, how can one figure out an effective approach to balance between vulnerability and privacy? We present a novel way to define a vulnerable friend from an individual user's perspective is dependent on whether or not the user's friends' privacy settings protect the friend and the individual's network of friends (which includes the user). As a single vulnerable friend in a user's social network might place all friends at risk, we resort to experiments and observe how much security an individual user can improve by unfriending a vulnerable friend. We also show how privacy weakens if newly accepted friends are unguarded or unprotected. This work provides a large-scale evaluation of new security and privacy indexes using a Facebook dataset. We present and discuss a new perspective for reasoning about social networking security. When a user accepts a new friend, the user should ensure that the new friend is not an increased security risk with the potential of negatively impacting the entire friend network. Additionally, by leveraging the indexes proposed and employing new strategies for unfriending vulnerable friends, it is possible to further improve security and privacy without changing the social networking site's existing architecture. <s> BIB006 </s> A Survey on Interdependent Privacy <s> Non-cooperative Approaches. <s> This survey provides a structured and comprehensive overview of research on security and privacy in computer and communication networks that use game-theoretic approaches. We present a selected set of works to highlight the application of game theory in addressing different forms of security and privacy problems in computer networks and mobile applications. We organize the presented works in six main categories: security of the physical and MAC layers, security of self-organizing networks, intrusion detection systems, anonymity and privacy, economics of network security, and cryptography. In each category, we identify security problems, players, and game models. We summarize the main results of selected works, such as equilibrium analysis and security mechanism designs. In addition, we provide a discussion on the advantages, drawbacks, and future direction of using game theory in this field. In this survey, our goal is to instill in the reader an enhanced understanding of different research approaches in applying game-theoretic methods to network security. This survey can also help researchers from various fields develop game-theoretic solutions to current and emerging security problems in computer networking. <s> BIB007 </s> A Survey on Interdependent Privacy <s> Non-cooperative Approaches. <s> Users share massive amounts of personal information and opinion with each other and different service providers every day. In such an interconnected setting, the privacy of individual users is bound to be affected by the decisions of others, giving rise to the phenomenon which we term as interdependent privacy. In this paper we define online privacy interdependence, show its existence through a study of Facebook application permissions, and model its impact through an Interdependent Privacy Game (IPG). We show that the arising negative externalities can steer the system into equilibria which are inefficient for both users and platform vendor. We also discuss how the underlying incentive misalignment, the absence of risk signals and low user awareness contribute to unfavorable outcomes. <s> BIB008 </s> A Survey on Interdependent Privacy <s> Non-cooperative Approaches. <s> The rapid progress in human-genome sequencing is leading to a high availability of genomic data. This data is notoriously very sensitive and stable in time. It is also highly correlated among relatives. A growing number of genomes are becoming accessible online (e.g., because of leakage, or after their posting on genome-sharing websites). What are then the implications for kin genomic privacy? We formalize the problem and detail an efficient reconstruction attack based on graphical models and belief propagation. With this approach, an attacker can infer the genomes of the relatives of an individual whose genome is observed, relying notably on Mendel's Laws and statistical relationships between the nucleotides (on the DNA sequence). Then, to quantify the level of genomic privacy as a result of the proposed inference attack, we discuss possible definitions of genomic privacy metrics. Genomic data reveals Mendelian diseases and the likelihood of developing degenerative diseases such as Alzheimer's. We also introduce the quantification of health privacy, specifically the measure of how well the predisposition to a disease is concealed from an attacker. We evaluate our approach on actual genomic data from a pedigree and show the threat extent by combining data gathered from a genome-sharing website and from an online social network. <s> BIB009 </s> A Survey on Interdependent Privacy <s> Non-cooperative Approaches. <s> Risks faced by information system operators and users are not only determined by their own security posture, but are also heavily affected by the security-related decisions of others. This interdependence between information system operators and users is a fundamental property that shapes the efficiency of security defense solutions. Game theory is the most appropriate method to model the strategic interactions between these participants. In this survey, we summarize game-theoretic interdependence models, characterize the emerging security inefficiencies, and present mechanisms to improve the security decisions of the participants. We focus our attention on games with interdependent defenders and do not discuss two-player attacker-defender games. Our goal is to distill the main insights from the state of the art and to identify the areas that need more attention from the research community. <s> BIB010 </s> A Survey on Interdependent Privacy <s> Non-cooperative Approaches. <s> The popularity of third-party apps on social network sites and mobile networks emphasizes the problem of the interdependency of privacy. It is caused by users installing apps that often collect and potentially misuse the personal information of users’ friends who are typically not involved in the decision-making process. In this paper, we provide an economic model and simulation results addressing this problem space. We study the adoption of social apps in a network where privacy consequences are interdependent. Motivated by research in behavioral economics, we extend the model to account for users’ other-regarding preferences; that is, users care about privacy harms they inflict on their peers. <s> BIB011 </s> A Survey on Interdependent Privacy <s> Non-cooperative Approaches. <s> Existing online social networks (OSNs) only allow a single user to restrict access to her/his data but cannot provide any mechanism to enforce privacy concerns over data associated with multiple users. This situation leaves privacy conflicts largely unresolved and leads to the potential disclosure of users' sensitive information. To address such an issue, a MultiParty Access Control (MPAC) model was recently proposed, including a systematic approach to identify and resolve privacy conflicts for collaborative data sharing in OSNs. In this paper, we take another step to further study the problem of analyzing the strategic behavior of rational controllers in multiparty access control, where each controller aims to maximize her/his own benefit by adjusting her/his privacy setting in collaborative data sharing in OSNs. We first formulate this problem as a multiparty control game and show the existence of unique Nash Equilibrium (NE) which is critical because at an NE, no controller has any incentive to change her/his privacy setting. We then present algorithms to compute the NE and prove that the system can converge to the NE in only a few iterations. A numerical analysis is also provided for different scenarios that illustrate the interplay of controllers in the multiparty control game. In addition, we conduct user studies of the multiparty control game to explore the gap between game theoretic approaches and real human behaviors. <s> BIB012 </s> A Survey on Interdependent Privacy <s> Non-cooperative Approaches. <s> Privacy and security are major concerns for many users of social media. When users share information (e.g., data and photos) with friends, they can make their friends vulnerable to security and privacy breaches with dire consequences. With the continuous expansion of a user’s social network, privacy settings alone are often inadequate to protect a user’s profile. In this research, we aim to address some critical issues related to privacy protection: (1) How can we measure and assess individual users’ vulnerabilityq (2) With the diversity of one’s social network friends, how can one figure out an effective approach to maintaining balance between vulnerability and social utilityq In this work, first we present a novel way to define vulnerable friends from an individual user’s perspective. User vulnerability is dependent on whether or not the user’s friends’ privacy settings protect the friend and the individual’s network of friends (which includes the user). We show that it is feasible to measure and assess user vulnerability and reduce one’s vulnerability without changing the structure of a social networking site. The approach is to unfriend one’s most vulnerable friends. However, when such a vulnerable friend is also socially important, unfriending him or her would significantly reduce one’s own social status. We formulate this novel problem as vulnerability minimization with social utility constraints. We formally define the optimization problem and provide an approximation algorithm with a proven bound. Finally, we conduct a large-scale evaluation of a new framework using a Facebook dataset. We resort to experiments and observe how much vulnerability an individual user can be decreased by unfriending a vulnerable friend. We compare performance of different unfriending strategies and discuss the security risk of new friend requests. Additionally, by employing different forms of social utility, we confirm that the balance between user vulnerability and social utility can be practically achieved. <s> BIB013 </s> A Survey on Interdependent Privacy <s> Non-cooperative Approaches. <s> Over the last few years, the vast progress in genome sequencing has highly increased the availability of genomic data. Today, individuals can obtain their digital genomic sequences at reasonable prices from many online service providers. Individuals can store their data on personal devices, reveal it on public online databases, or share it with third parties. Yet, it has been shown that genomic data is very privacy-sensitive and highly correlated between relatives. Therefore, individuals’ decisions about how to manage and secure their genomic data are crucial. People of the same family might have very different opinions about (i) how to protect and (ii) whether or not to reveal their genome. We study this tension by using a game-theoretic approach. First, we model the interplay between two purely-selfish family members. We also analyze how the game evolves when relatives behave altruistically. We define closed-form Nash equilibria in different settings. We then extend the game to N players by means of multi-agent influence diagrams that enable us to efficiently compute Nash equilibria. Our results notably demonstrate that altruism does not always lead to a more efficient outcome in genomic-privacy games. They also show that, if the discrepancy between the genome-sharing benefits that players perceive is too high, they will follow opposite sharing strategies, which has a negative impact on the familial utility. <s> BIB014 </s> A Survey on Interdependent Privacy <s> Non-cooperative Approaches. <s> Applying a conjoint study approach, we conduct the first research to quantify the monetary value which users place on their friends’ personal information. Utilizing the scenario of social app adoption, we further investigate the impact of the comprehensiveness of shared profile information on valuation, and vary the data collection context, i.e., friends’ information is not relevant (T1), or is relevant (T2) to app functionality. The monetary value (measured in US$) which individuals associate with friends’ full profile information in T1 ($1.56) differs significantly from the valuation in T2 ($0.98). However, the difference across data collection context is not significant for friends’ less sensitive basic profile information (valued at $0.23 in T1, and $0.07 in T2). When considering the self-reported number of online friends, the average valuation for a single friend’s profile information is not higher than three cents and as low as a mere fraction of a cent. <s> BIB015 </s> A Survey on Interdependent Privacy <s> Non-cooperative Approaches. <s> Abstract In the context of third-party social apps, the problem of interdependency of privacy refers to users making app adoption decisions which cause the collection and utilization of personal information of users’ friends. In contrast, users’ friends have typically little or no direct influence over these decision-making processes. We conduct a conjoint analysis study with two treatment conditions which vary the app data collection context (i.e., to which degree the functionality of the app makes it necessary for the app developer to collect friends’ information). Analyzing the data, we are able to quantify the monetary value which app users place on their friends’ and their own personal information in each context. Combining these valuations with the responses to a comprehensive survey, we apply structural equation modeling (SEM) analysis to investigate the roles of privacy concern, its antecedents, as well as app data collection context to work towards a model of interdependent privacy for the scenario of third-party social app adoption. We find that individuals’ past experiences regarding privacy invasions are negatively associated with their trust for third-party social apps’ proper handling of their personal information, which in turn influences their concerns for their own privacy associated with third-party social apps. In addition, positive effects of users’ privacy knowledge on concerns for their own privacy and concerns for friends’ privacy regarding app adoption are partially supported. These privacy concerns are further found to affect how users value their own and their friends’ personal information. However, we are unable to support an association between users’ online social capital and their concerns for friends’ privacy. Nor do we have enough evidence to show that treatment conditions moderate the association between the concern for friends’ personal information and the value of such information in app adoption contexts. <s> BIB016 </s> A Survey on Interdependent Privacy <s> Non-cooperative Approaches. <s> Most popular location-based social networks, such as Facebook and Foursquare, let their users post location and co-location information (with other users). Such posts bring social benefits to the users who post them but also to their friends, who view them. Yet, they represent a severe threat to the users’ (location) privacy, as co-location information introduces interdependence between users. In this paper, we propose a game theoretical framework for analyzing and predicting the strategic behaviours of users of social networks regarding (co)-location information sharing. In addition, in order to design parametric utility functions as representative as possible of the users’ actual preferences, we conduct a survey targeted at Facebook users and rely on conjoint analysis for quantifying the users benefits of sharing vs. viewing (co)-location information and their preference for privacy vs. benefits.We evaluate our framework through data-driven numerical simulations. We show how users’ individual preferences influence each others’ decisions and identify several factors that significantly impact these decisions, specifically the considered adversary and the preference for privacy vs. benefits. <s> BIB017
We consider here situations with interdependent privacy risks in which rational 26 individuals singlehandedly choose to adopt certain strategies to optimize their own risks and benefits. Due to the interdependent nature of the considered situations, the risks and benefits of the individuals also depend on the strategies adopted by the other individuals involved. As such, these individuals interact with each other (through a so-called game) but do not cooperate. This type of setting is generally studied by relying on game theory (see Section 3.2) and, more specifically, on so-called non-cooperative games. Note that, orthogonal to this work, there are interdependent security games that have also been extensively studied; Laszka et al. wrote a comprehensive survey on the topic BIB010 ]. Prior to that, Manshaei et al. wrote a comprehensive survey on the use of game theory for studying security and privacy BIB007 . BIB003 generic Clarke tax mechanism N BIB008 profile (OSN) simultaneous 2 BIB011 profile (OSN) network N BIB012 generic repeated N BIB014 genomic simultaneous N BIB017 (co-)location sequential 2 Squicciarini et al. were the first to address the problem of privacy management on generic shared (co-owned) data with a game-theoretic model BIB003 ]. They rely on mechanism design and in particular the Clarke-Tax mechanism  ] to derive the privacy policy that maximizes the social utility of the individuals co-owning the data. The Clarke-Tax mechanism is a simple voting scheme for social choice on a common good (i.e., co-owned data) and has a notable advantage of being not manipulable by individuals and to ensure truthfulness. To free the individuals from the burden of setting these preferences for each of the co-owned item, Squicciarini et al. further propose an inference algorithm based on previous sharing decisions. As discussed in Section 4.1, third-party applications on OSNs can, in some cases, access the data of the friends of the user who installed them, thus creating interdependent privacy risks. Biczók and Chia investigate such risks with third-party FB app permissions BIB008 . They define a non-cooperative game between two FB users (choosing between install and not install an app), and analyze how positive and negative externalities (including privacy) influence the adoption of an application. They show that negative externalities can lead to equilibrium outcomes that are inefficient for both users and for the service provider. Finally, they discuss the possible causes of inefficient outcome, such as misaligned incentives, the absence of risk signals, and the low user awareness of interdependent privacy risks. One limitation of this first approach is that, as it is limited to two users, it does not take entirely into account the dynamics of application adoption in today's OSNs and mobile networks. Pu and Grossklags fill this gap by simulating the application adoption process on scale-free networks BIB011 . They build upon Sundararajan's local network effects model BIB002 ] to define a payoff function that takes into account (i) the direct value of using the application, (ii) the positive network effects, (iii) the privacy harm inflicted on friends when installing an application (this falls in the scope of altruism as defined by BIB005 ), and (iv) other installation costs. Their results show that decreasing the installation cost or the interdependent privacy harm increases the early application adoption. They also indicate that app adoption increases as the network size increases. To quantify the (monetary) value of interdependent privacy, Pu and Grossklags rely on conjoint analysis, i.e., to measure users' preferences in a trade-off setting BIB015 . The results of their user study (based on N = 400 MTurk users) and analysis first show that friends' privacy is the third most important application feature, after the price and the user's own privacy. However, when quantifying the monetary value OSN users associate with their own profiles and their friends' profiles, it can be observed that the value of an average friend's information is a tiny fraction of the value of a user's personal information. In a follow-up work, the authors evaluate the influence of users' past privacy invasion experiences, privacy knowledge, trust on applications' data practices, online social capital, and privacy concerns related to the adoption of an application BIB016 . They make use of structural equation modeling (SEM) analysis BIB001 ] to evaluate the effect of these factors on users' valuations of their own privacy and of their friends'. Pu and Grossklags further improve upon their prior work BIB016 by making use of choice-based conjoint analysis  . Moreover, they consider four novel treatment conditions in two different dimensions: sharing anonymity (Are friends' shared data anonymous or not?) and context relevance (Are the requested friends' data useful to application functionality or not?). Their survey (based on N = 931 MTurk users) shows that treatment conditions affect the valuation of interdependent privacy: (i) Users tend to value significantly less their friends' data if they believe it is anonymous, and (ii) they also tend to value their friends' data less if they believe this data is useful for the application functionality. Several works propose unfriending (i.e., removing a previously declared social tie on an OSN) as a solution for addressing interdependent privacy risks related to OSN profile information inference and leaks (discussed in Section 4.1) BIB004 BIB006 BIB013 . For instance, Gundecha et al. propose a solution for identifying friends who compromise the most a users' privacy on an OSN. We do not survey these works, because unfriending offers only limited protection (even though the information is removed, the social network operator can retain and exploit it anyways), and because none of these works study the interplay between users when users unfriend. As discussed in Section 4.2, genomic data is also subject to interdependent privacy risks because of the correlation between the genomes of relatives BIB009 . Humbert et al. analyze the interplay between members of the same family when making decisions related to genomicdata sharing and storage security BIB014 . The authors first consider a two-player setting and, by relying on a Markov chain model, derive a closed-form expression of genomic privacy levels and of NE (see Section 3.2). They also take into account potential altruistic behavior between family members. Contrary to previous interdependent privacy or security games that rely on theoretical interdependence models; here the interdependent risks are given by the familial genetic correlations. The authors also extend their analysis to N players by relying on multi-agent influence diagrams (MAIDs), a graphical model that not only includes random variable nodes (like Bayesian networks) but also decision and utility variable nodes (see Section 3.2). Their results notably show that, unless the players coordinate, altruism can lead to suboptimal social outcome compared to the purely selfish setting due to players being too cautious to not put other players' privacy at risk. As discussed in Section 4.3, multimedia data shared on OSNs relates to more than one individual and to individuals who do not have any control over the shared content. To analyze the behavior of strategic OSN users, Hu et al. present a multiparty control game that encompasses N OSN users who collaboratively control the sharing of a data item in the OSN based on their privacy and sharing preferences BIB012 ]. The authors first show that their game converges to a unique NE in a few iterations. Then, they perform two user studies to evaluate to which extent real users behave as expected by the game-theoretic model. These studies demonstrate that users believe that everyone appearing in a photo should have the right to decide who can view it and that a user's privacy sensitivity is highly related to the content of the photo. Interestingly, the survey also shows that users may not adopt the best strategies when making decisions, essentially because of some altruistic behavior with respect to others. As discussed in Section 4.4, location data can lead to interdependent privacy risks when the individuals also share co-locations online, i.e., mention that they are with other individuals. To study the interplay between individuals with possibly different views on data sharing and privacy, Olteanu et al. develop a two-player game-theoretic model that takes into account the benefits and privacy implications of location and co-location sharing in OSNs BIB017 ]. The authors rely on conjoint analysis to quantify the various parameters of the game-theoretic model. More precisely, based on a user survey of N = 250 FB users (from MTurk), they evaluate users' preferences between (i) sharing and viewing posts, (ii) location and co-location information, and (iii) location privacy and sharing benefits. By embedding these values into the payoff functions, Olteanu et al. show a user can have a strong incentive to share their locations once a co-location has been shared by the other user with them, thus creating a vicious circle of location over-sharing. Table 3 summarizes the main literature covered here on game-theoretic models for interdependent privacy settings. We notice that there are various contexts and game types.