Cumulative Revelations of Personal Data *

Cumulative Revelations in Personal Data takes a multidisciplinary approach to investigating how small, apparently innocuous pieces of employees' personal information, which are generated through interactions with/in networked systems over time, collectively pose significant yet unanticipated risk to personal reputation and employers' operational security. Such cumulative revelations come from personal data that are shared intentionally by an individual, from data shared about an individual by others, from recognition software that identifies and tags people and places automatically, and from common cross-authentication practices that favour convenience over security (e.g. signing into AirBnB via Facebook). Brought together, these data can provide unintended insights to others into (for example) an individual's personal habits, work patterns, personality, emotion, and social influence. Collectively these data thus have the potential to create adverse consequences for that individual (e.g. through reputational damage), their employer (e.g. by creating opportunities for cybercrime), and even for national security.

The research brings together multidisciplinary expertise in Socio-Digital Interaction, Co-design, Interactive Information Retrieval, and Computational Legal Theory, all working in collaboration with a key industry partner, the Royal Bank of Scotland, which employs more than 92,000 staff across 12 national, international and private banks and for which security concerns are paramount, as well as UK Government security agencies, via the Government Office for Science and the Centre for Research and Evidence on Security Threats.

The research will examine the potential adverse revelations delivered by an individual employee's holistic digital footprint through the development of a prototype software tool that maps out a portrait of a user's digital footprint and reflects it back to them. This tool will enable individuals to understand the cumulative nature of their personal data, and better comprehend the associated vulnerabilities and risks. Responding to employers' concerns over organisational security risks created by cumulative revelations of their employees' data, the research will also identify conflicts and ambiguities in security service design and implementation when the motivations and actions of individual employees are balanced against organisational security philosophy, enabling mitigation against the attendant risks, issues and consequences of cumulative revelations from organisational and individual perspectives.

The research will achieve impact in a range of ways. Here we outline them using the EPSRC categories for impact.

Knowledge - techniques. We will develop prototype software tools that map out a holistic portrait of an individual user's digital footprint, and reflect it back to them. These tools will enable individuals to understand their cumulative digital footprints, and to comprehend associated vulnerabilities and risks of cumulative revelations.

Society - Policy. Stakeholder workshops will involve policymakers, who we will access via the Government Office for Science and through CREST. Workshops will use the Picture Book approach that we have used previously with policymakers, law enforcement agencies and industry. This approach maximises opportunities to share research insights in ways that enable them to be operationalised by stakeholders. Further, the involvement of legal experts as project partners (Bristows) and as colaborators (Schafer, co-I) means that our research insights are framed in current and predicted legislation - adding further utility for policy.

Society - Quality of Life. The tools that we develop will increase digital literacy and personal agency over UK citizens' digital footprints. This in turn will assist them in protecting their privacy, reducing risk to reputation, and the potential to be victims of cybercrimes.

People - Skills. Cyber security is an area where there are not sufficient skilled people to fill available posts. We have attracted funding for two PhD studentships and one postdoctoral intern from our project partners - all of whom will emerge from the project with cutting edge cyber security skills. Further, the project team, through interdisciplinary working, will extend their own skills far beyond the traditional borders of their disciplines. The stakeholder workshops, and our deep engagement with project partners, will foster cross-fertilisation of skills across academia, industry and UK security agencies.

Economy - Products and Procedures: Working in partnership with RBS and UK Security Agencies (via GO-Science) we will develop prototype software tools that reduce the risk to organisations of cumulative revelations linked to personal data. The risks that will be reduced include cyber crime and insider threats. These risks are significant, and increasing. An average large organisation can expect 81 million security events over the course of the year, with 55% of security breaches caused by individuals with legitimate access to an organisation's system.