| |
|
|
| Privacy-Preserving Surveillance |
Keywords: homeland
security, privacy-
preserving surveillance, immutable audit Citation:
Abstract
Following the events of September 11, 2001, many in the American
public falsely believe they must choose between safety and privacy.
This paper proposes an approach to technology (termed "Selective
Revelation") that allows data to be shared for surveillance purposes
such that shared data have provable assurances of privacy protection
while remaining practically useful. Data are provided to a
surveillance system with a sliding scale of identifiability, where the
level of anonymity matches scientific and evidentiary need. During
normal operation, surveillance is conducted on sufficiently anonymous
data that is provably useful. When sufficient and necessary
scientific evidence merits, the system drills down increasingly more
identifiable data. This is a computational model of the "probable
cause predicate" performed in American jurisprudence. Under Selective
Revelation, human judges, who make decisions as to whether information
will be shared with law-enforcement, are replaced with technology that
makes these decisions for broader surveillance purposes.
The joined scales
match the identifiability of the data (left) to the operational status
of the algorithm used in the investigation (right). Under normal
operation, sufficiently anonymous data is used. As suspicious
behavior is detected, the investigation status lowers, releasing more
identifiable data. Click on the image above for improved viewing of
the selective revelation scale.
L.
Sweeney. Privacy-Preserving Surveillance Using Selective
Revelation. IEEE Intelligent Systems Sept-Oct 2005. (PDF)].
[Earlier version: Carnegie Mellon University, LIDAP Working Paper
15, February 2005. (PDF)].
Related Publications
In the News
Related Links