RePriCo: Resolving Multi-party Privacy Conflicts in Social Media

Hundreds of billions of items that are uploaded to Social Media are co-owned by multiple users, yet only the user that uploads the item is allowed to set its privacy settings (i.e., who can access the item). This is a massive and serious problem as users' privacy preferences for co-owned items usually conflict, so applying the preferences of only one party leads to privacy violations with severe consequences (e.g., users losing their jobs, being cyberstalked, etc.). A solution to this problem is most timely as it has been highlighted as one of the most important problems to be addressed for an appropriate online privacy management. An example of this problem is a photo in which Alice and Bob are depicted together: how can they agree on the third parties they will share the photo with? Mainstream Social Media would only allow Alice (assuming she uploads the item) to set the privacy settings for the photo, but what if Bob would not like to share with some of Alice's friends? Some initial approaches have been proposed in the past few years, but these have a number of limitations that make them unsuitable in practice. Users are forced to try to resolve such conflicts manually (by e-mail, phone calls, etc.), which is exhausting because social networks are very dynamic and huge in scale. Even more importantly, the process of resolving conflicts manually starts too late, when one user has already posted the item and the privacy violation has occurred.

RePriCo's most exciting, novel, and ground-breaking part will be the automated conflict detection and resolution mechanism based on new automated negotiation technologies. In particular, RePriCo's main challenge will be to automatically suggest solutions to the conflicts in such a way that these solutions are accepted by users most of the time and they do not need to resolve the conflicts manually. This is both ambitious and adventurous, as it requires understanding how users would actually reach an agreement if they were to solve the conflicts themselves manually. RePriCo's hypothesis is that users' negotiation behaviour is significantly influenced by users' relationships and their strength (as existing evidences seem to support), and that a computational negotiation mechanism should be based on this in order to produce acceptable outcomes. One of the main contributions of RePriCo will be a strong empirical base about how users' relationships influence negotiation behaviour. RePriCo will be highly transformative in many aspects: (i) it will empower users to manage their privacy for multi-party co-owned items; (ii) it will consider what is actually acceptable for users and the factors that contribute to that, which no previous approach to solve multi-party privacy conflicts has considered before; and (iii), the empirical base it will develop will not only influence RePriCo's automated conflict detection and resolution mechanisms but also help push research on the topic forward.

The project will run a programme with a view to maximising the impact of the project's results to deliver four key impact objectives: 1) sustainable economic impact; 2) influencing policy; 3) raising public awareness and improving quality of life in the cyberspace; 4) developing project team's skills.

Sustainable economic impact will be delivered by means of a two-staged approach. In the first stage, a series of dissemination activities (magazine article, business videos, business event, attendance to and presentation at Industry conferences) will run to engage with potentially interested businesses. We have already secured interest, support and collaboration from Microsoft, SBL and Egress which will also participate in these events. In the second stage, activities with these already secured partners and possibly other selected partners from stage one will run. The commercial exploitation of the Social Media app to be developed will be explored (following Lancaster University's IP protection policy) with SBL, which will provide consultancies and access to partner companies and customers to facilitate this. We will also explore the applicability of RePriCo's results to other social domains with Egress, which has a secure collaboration tool for online data sharing that induces social networks among its users and faces the problem of multi-party privacy management. Finally, Microsoft has committed to provide a researcher to collaborate in the project to push research in this topic forward and establish a long-term mutually-benefiting collaboration base. RePriCo will utilise internal (IAA, CASE) and external (KTP) grant mechanisms for follow-up collaborations with these businesses.

The PI will also leverage his previous experience in engaging with policy makers (see Track Record) to raise awareness about multi-party privacy management, to update them with project findings, and explore possible areas of impact in current and prospective regulations. To this aim, the PI will: (i) meet his policy contacts as member of the Policy Fellows Network at Centre for Science and Policy (a network of academics and policy professionals the PI is member of), and Security Lancaster's policy contacts (Academic Centre of Excellence in Cyber Security research the PI is member of); and (ii) contact regulation bodies like ICO,ENISA and EDPS. The information above will also be encapsulated as a whitepaper to share with policy stakeholders and the general public.

Raising Public Awareness and improving quality of life in the cyberspace will be delivered by means of a highly active Social Media and Press Releases strategy to disseminate educational videos and blog entries about the problem of multi-privacy management and hints to improve this as well as to disseminate project results. The project will also leverage Lancaster University's links with schools (South Lakes Teaching School Alliance), the MSc in CyberSecurity (in which the PI teaches) and Security Lancaster's bespoke programmes for national and international organisations, contacts with relevant professional bodies (IAPP,DPF,NADPO), and an invited slot on the IA practitioner's event (organised by SBL), as well as an invited article in SBL's CyberTalk Magazine.

The project's team will enhance their knowledge transfer skills via regular meetings with department's Knowledge Business Centre and Security Lancaster's Partnership Manager, and participation in knowledge transfer activities (Business education event, etc.). The RA will be given the opportunity to pursue research objectives more independently and gain academic network experience by organising together with the PI an academic workshop, and the PhD student (funded by LU) will gain research skills towards her/his PhD by working with the PI and other project researchers. The team will also learn new skills by participating in the activities described above to influence policy.