I got started in privacy back in the
1990s when I was a graduate student at
Washington University in st. Louis I was
doing work on electronic voting and
became interested in a lot of other
internet policy issues and I went to the
computers freedom and privacy conference
and it was this amazing experience for
me and I learned about a lot of
different issues including privacy
issues and I came back to my University
and I said we should have a course on
computers and society and they said okay
and you can teach it and in order to
prepare to teach these this course to
undergraduates I did a lot of reading
and I learned a lot about privacy and
then after I graduated I went to work
for AT&T Labs and in the first few weeks
that I was there I heard that there was
a new web privacy standard that people
were trying to to get started with and
somebody said why don't you go to this
meeting and see what this is all about
and and maybe help out with it and so I
went to this internet privacy working
group meeting and was one of two
engineers in the room and all of these
lawyers and policy folks looked at us
and said can you build us this standard
and not knowing any better I said sure
and thought well this this will be a fun
project for a few weeks and I started
working on it it's what became the p3p
project and I ended up chairing the
working group and seven years later we
had a standard and I learned a lot about
privacy
we've been looking at finding the best
ways to communicate with people about
privacy so over a decade ago we started
looking at privacy policies and looking
at how long they were and how much time
it would take people to actually read
those privacy policies and we came up
with some ridiculously large numbers and
it was clear that the idea that you
could get people to read privacy
policies was was just ridiculous so we
started looking at what could we do to
simplify privacy policies and give
people important information from
privacy policies without having to read
through pages and pages of legalese so
we developed something called a privacy
nutrition label which was a tabular
format standard format for representing
website privacy policies and we did some
user testing on that and iterated and
came up with something that seemed
pretty usable and now we're looking in
an IOT world a similar problem only in
some ways it's worse so it's already
hard enough for people to read privacy
policies on websites but in an Internet
of Things world you walk into a room and
there might be 20 smart lightbulbs and
smart thermostats and cameras and it's
it's really implausible to think that
someone would walk up to all the light
bulbs and read the privacy policies on
them but all of these devices are
collecting their data and so we've been
developing prototypes of systems where
these smart devices can broadcast their
privacy policies in a format that can be
automatically received and interpreted
by your smart phone or your smart watch
and your your personal device can
collect these policies read them
automatically and let you know if
there's something that you need to know
about based on your personal privacy
preference
so these are some of the things that
we're working on another project we're
looking at is trying to understand how
people think about privacy and what are
what are the things that are on their
mind when people talk about privacy so
what we've done is we've started
collecting drawings from people in
response to the prompt
what does privacy mean to you and at
this point we've collected over 350
drawings and these come from old people
young people children adults
some of them come from privacy
professionals but most of them are from
everyday people and we've been going
through them and examining them and
coding them to see what are the
different types of concepts that come
out in these drawings and what can they
teach us about how people think about
privacy so my colleagues and I started
hearing from people in companies who
were looking to hire privacy engineers
and they came to us and said do you have
any privacy students that we might
interview and we had some students
interested in privacy but but not that
many and yet we had a number of courses
here on privacy and privacy engineering
and we thought well it would be nice to
put this all together into a coherent
graduate program and we looked around to
see what other schools were doing in
this area and there wasn't very much
there are law schools that have a
concentration on privacy but among the
schools that have Technology programs
computer science and engineering
there was really no sort of degree
program that a student could take if
they wanted to focus on privacy
engineering so we decided to put
together a program that would be
specifically for technology students and
would go into legal and policy issues
but also very deep on the privacy
technology privacy algorithms
and also teach them some
interdisciplinary skills and and teach
them about usability and and user
testing and things like that as well so
we put together this three semester
program including some practical
experience with a capstone project and
and now we have the privacy engineering
master's program now in its fifth year
at Carnegie Mellon I think privacy is a
great field for people to get started in
people often assume that in order to get
into the privacy field you need to be a
lawyer or have a lot of policy expertise
but we're seeing increasingly that there
is room for technologists and privacy
engineers are really being sought after
today so this is a great field for that
I also think it's important to keep in
mind that this is an interdisciplinary
field and that whether you are a lawyer
or a technologist or something else the
the work that you're doing actually
impacts people everyday people and so
it's important to think about how your
laws or how your technology is going to
impact people and to try to put yourself
in their shoes and think about it I also
think that it's important to keep
learning keep reading attend ia PP
events attend other types of seminars
and workshops and keep learning so that
you stay up-to-date with the new laws
and policies but also new technologies
that are going to have a big impact on
privacy
[Music]