Price Of Privacy Research Articles

The Price of Privacy Control in Mobility Sharing

ABSTRACT One of the main features in mobility sharing applications is the exposure of personal data provided to the system. Transportation and location data can reveal personal habits, preferences, and behaviors, and riders could be keen not to share the exact location of their origin and/or destination. But what is the price of privacy in terms of decreased efficiency of a mobility sharing system? In this paper we address the privacy issues under this point of view, and show how location privacy-preserving techniques could affect the performance of mobility-sharing applications, in terms of both system efficiency and quality of service. To this extent, we first apply different data-masking techniques to anonymize geographical information, and then compare the performance of shareability network-based trip-matching algorithms for ride-sharing, applied to real data and to privacy-preserving data. The goal of the paper is to evaluate the performance of mobility-sharing, privacy-preserving systems, and to shed light on the trade-off between data privacy and its costs. The results show that the total traveled distance increase due to the introduction of data privacy could be bounded if users are willing to spend (or “pay”) for more time in order to share a trip, meaning that data location privacy affects both efficiency and quality of service.

Together or Alone: The Price of Privacy in Collaborative Learning

Abstract Machine learning algorithms have reached mainstream status and are widely deployed in many applications. The accuracy of such algorithms depends significantly on the size of the underlying training dataset; in reality a small or medium sized organization often does not have the necessary data to train a reasonably accurate model. For such organizations, a realistic solution is to train their machine learning models based on their joint dataset (which is a union of the individual ones). Unfortunately, privacy concerns prevent them from straightforwardly doing so. While a number of privacy-preserving solutions exist for collaborating organizations to securely aggregate the parameters in the process of training the models, we are not aware of any work that provides a rational framework for the participants to precisely balance the privacy loss and accuracy gain in their collaboration. In this paper, by focusing on a two-player setting, we model the collaborative training process as a two-player game where each player aims to achieve higher accuracy while preserving the privacy of its own dataset. We introduce the notion of Price of Privacy, a novel approach for measuring the impact of privacy protection on the accuracy in the proposed framework. Furthermore, we develop a game-theoretical model for different player types, and then either find or prove the existence of a Nash Equilibrium with regard to the strength of privacy protection for each player. Using recommendation systems as our main use case, we demonstrate how two players can make practical use of the proposed theoretical framework, including setting up the parameters and approximating the non-trivial Nash Equilibrium.

Dynamic Privacy Pricing For Timely Rewards

Dynamic Privacy Pricing For Timely Rewards

The Price of Privacy

The analysis of clickstream data facilitates the understanding and prediction of customer behavior in e-commerce. Companies can leverage such data to increase revenue. For customers and website users, on the other hand, the collection of behavioral data entails privacy invasion. The objective of the paper is to shed light on the trade-off between privacy and the business value of customer information. To that end, the authors review approaches to convert clickstream data into behavioral traits, which we call clickstream features, and propose a categorization of these features according to the potential threat they pose to user privacy. The authors then examine the extent to which different categories of clickstream features facilitate predictions of online user shopping patterns and approximate the marginal utility of using more privacy adverse information in behavioral prediction models. Thus, the paper links the literature on user privacy to that on e-commerce analytics and takes a step toward an economic analysis of privacy costs and benefits. In particular, the results of empirical experimentation with large real-world e-commerce data suggest that the inclusion of short-term customer behavior based on session-related information leads to large gains in predictive accuracy and business performance, while storing and aggregating usage behavior over longer horizons has comparably less value.

Privacy Preserving Implementation of the Max-Sum Algorithm and its Variants

One of the basic motivations for solving DCOPs is maintaining agents' privacy. Thus, researchers have evaluated the privacy loss of DCOP algorithms and defined corresponding notions of privacy preservation for secured DCOP algorithms. However, no secured protocol was proposed for Max-Sum, which is among the most studied DCOP algorithms. As part of the ongoing effort of designing secure DCOP algorithms, we propose P-Max-Sum, the first private algorithm that is based on Max-Sum. The proposed algorithm has multiple agents preforming the role of each node in the factor graph, on which the Max-Sum algorithm operates. P-Max-Sum preserves three types of privacy: topology privacy, constraint privacy, and assignment/decision privacy. By allowing a single call to a trusted coordinator, P-Max-Sum also preserves agent privacy. The two main cryptographic means that enable this privacy preservation are secret sharing and homomorphic encryption. In addition, we design privacy-preserving implementations of four variants of Max-Sum. We conclude by analyzing the price of privacy in terns of runtime overhead, both theoretically and by extensive experimentation.

Information sharing vs. privacy: A game theoretic analysis

A game model for deciding on level of information sharing when privacy is a concern.Finding threshold in which gain of information sharing outweighs the privacy risk.Two mechanisms for encouraging the firms to reach socially optimal outcome. Sharing cyber security information helps firms to decrease cyber security risks, prevent attacks, and increase their overall resilience. Hence it affects reducing the social security cost. Although previously cyber security information sharing was being performed in an informal and ad hoc manner, nowadays through development of information sharing and analysis centers (ISACs), cyber security information sharing has become more structured, regular, and frequent. This is while, the privacy risk and information disclosure concerns are still major challenges faced by ISACs that act as barriers in activating the potential impacts of ISACs.This paper provides insights on decisions about security investments and information sharing in consideration of privacy risk and security knowledge growth. By the latest concept i.e. security knowledge growth, we mean fusing the collected security information, adding prior knowledge, and performing extra analyses to enrich the shared information. The impact of this concept on increasing the motivation of firms for voluntarily sharing their sensitive information to authorities such as ISACs has been analytically studied for the first time in this paper. We propose a differential game model in which a linear fusion model for characterizing the process of knowledge growth via the ISAC is employed. The Nash equilibrium of the proposed game including the optimized values of security investment, and the thresholds of data sharing with the price of privacy are highlighted. We analytically find the threshold in which the gain achieved by sharing sensitive information outweighs the privacy risks and hence the firms have natural incentive to share their security information. Moreover, since in this case the threshold of data sharing and the security investment levels chosen in Nash equilibrium may be lower than social optimum, accordingly we design mechanisms which would encourage the firms and lead to a socially optimal outcome. The direct impact of the achieved results is on analyzing the way ISACs can convince firms to share their security information with them.

Dynamic Privacy Pricing: A Multi-Armed Bandit Approach With Time-Variant Rewards

Recently, the conflict between exploiting the value of personal data and protecting individuals’ privacy has attracted much attention. Personal data market provides a promising solution to this conflict, while determining the price of privacy is a tough issue. In this paper, we study the pricing problem in a setting where a data collector sequentially buys data from multiple data owners whose valuations of privacy are randomly drawn from an unknown distribution. To maximize the total payoff, the collector needs to dynamically adjust the prices offered to owners. We model the sequential decision-making problem of the collector as a multi-armed bandit problem with each arm representing a candidate price. Specifically, the privacy protection technique adopted by the collector is taken into account. Protecting privacy generally causes a negative effect on the value of data, and this effect is embodied by the time-variant distributions of the rewards associated with arms. Based on the classic upper confidence bound policy, we propose two learning policies for the bandit problem. The first policy estimates the expected reward of a price by counting how many times the price has been accepted by data owners. The second policy treats the time-variant data value as a context and uses ridge regression to estimate the rewards in different contexts. Simulation results on real-world data demonstrate that by applying the proposed policies, the collector can get a payoff which is close to that he can get by setting a fixed price, which is the best in hindsight, for all data owners.

Price of privacy

The article proposes a logical framework for reasoning about agents' ability to protect their privacy by hiding certain information from a privacy intruder. It is assumed that the knowledge of the intruder is derived from the observation of pieces of evidence and that there is a cost associated with the elimination of the evidence. The logical framework contains a modal operator labeled by a group of agents and a total budget available to this group. The key contribution of this work is the proposed incorporation of the cost factor into privacy protection reasoning within the standard modal logic framework. The main technical result are the soundness and completeness theorems for the introduced logical system with respect to a formally defined semantics.

The Price of Privacy in Untrusted Recommender Systems

Recent increase in online privacy concerns prompts the following question: can a recommender system be accurate if users do not entrust it with their private data? To answer this, we study the problem of learning item-clusters under local differential privacy, a powerful, formal notion of data privacy. We develop bounds on the sample-complexity of learning item-clusters from privatized user inputs. Significantly, our results identify a sample-complexity separation between learning in an information-rich and an information-scarce regime, thereby highlighting the interaction between privacy and the amount of information (ratings) available to each user. In the information-rich regime, where each user rates at least a constant fraction of items, a spectral clustering approach is shown to achieve a sample-complexity lower bound derived from a simple information-theoretic argument based on Fano's inequality. However, the information-scarce regime, where each user rates only a vanishing fraction of items, is found to require a fundamentally different approach both for lower bounds and algorithms. To this end, we develop new techniques for bounding mutual information under a notion of channel-mismatch. These techniques may be of broader interest, and we illustrate this by applying them to (i) learning based on 1-bit sketches, and (ii) adaptive learning. Finally, we propose a new algorithm, MaxSense, and show that it achieves optimal sample-complexity in the information-scarce regime.

Management Insights

Management Insights

The Price of Privacy, 1973 to the Present

The legal academy has not been kind to the privacy rationale set forth in Roe v. Wade. Roe is seen to have promoted a single-issue agenda based on the importance of privacy and choice. Because Roe so quickly became vulnerable, its defense became a priority, and activists speaking out in favor of the opinion felt encouraged to defend it on its own terms. If the abortion issue were a matter of ordinary politics rather than constitutional law, the argument goes, activists would be free to develop more compelling arguments for reproductive rights and to pursue a broader reproductive-health program. Other scholars have studied the social movement activists and attorneys who helped to shape pre-Roe advocacy and to influence the Court’s decision. This project is unique, however, in offering the first explanation of the emergence, ascendancy, and persistence of crucial post-Roe choice-based claims that have defined the law and politics of abortion in the past several decades. This history suggests that Roe alone was not responsible for the emergence or the staying power of the choice framework. Since 1973, abortion-rights activists prioritized choice arguments not only because of Roe but also because of the need to respond to antiabortion tactics and to changing political opportunities. Ordinary politics reinforced rather than undermined the choice framework.Based on this history, the Article argues that de-constitutionalizing the abortion issue would do little to dismantle the choice-based frame. At a minimum, the abortion-rights movement will have to do more to make abortion, and the women who benefit from it, more visible and sympathetic to the public. Removing the Constitution from the equation will do little to change this basic dynamic.

The Price of Privacy

Simply declaring privacy to be a legal right doesn't provide any resources to enforce it. If privacy was an economic transaction, meaning that people pay for it, then their payments would provide resources to protect it. Would we have better privacy if people were paying for it directly rather than trying to get it via political campaigns?

Alleviating the Patient's Price of Privacy Through a Partially Observable Waiting List

In the United States, end-stage liver disease patients join a waiting list and then make accept/reject decisions for transplantation as deceased-donor organs are offered to them over time. These decisions are largely influenced by the patient's prospect for future offers, which can be ascertained most accurately by knowing the entire composition of the waiting list. Under the current transplantation system, however, the United Network for Organ Sharing (UNOS), in an effort to strike a balance between privacy and transparency, only publishes an aggregated version of the waiting list. However, it is not clear whether the published information is good enough (compared with perfect information) to help patients make optimal decisions that maximize their individual life expectancies. We provide a novel model of this accept/reject problem from an individual patient's perspective using a partially observed Markov decision process (POMDP) framework, which incorporates the imperfect waiting list information as published currently into the patient's decision making. We analyze structural properties of this model. In particular, we establish conditions that guarantee a monotone value function and a threshold-type optimal policy with respect to the partially observable rank state that captures the imperfect waiting list information. Furthermore, we develop an improved solution methodology to solve a generic POMDP model. This solution method guarantees, for any fixed grid, the best possible approximation to the optimal value function by solving linear programs to compute the optimal weights used for the approximation. Finally, we compare, in a clinically driven numerical study, the results of this model with those of an existing Markov decision process model that differs from our model in assuming the availability of perfect waiting list information. This comparison allows us to assess the quality of the published imperfect information as measured by a patient's so-called price of privacy (i.e., the opportunity loss in expected life days due to a lack of perfect waiting list information). Previous work estimates a significant loss in a patient's life expectancy, on average, when the patient has no waiting list information compared with full information. In this paper, we find that the currently published partial information is nearly sufficient to eliminate this loss, resulting in a negligible price of privacy and supporting current UNOS practice. This paper was accepted by Assaf Zeevi, stochastic models and simulation.

Alleviating the Patient’S Price of Privacy Through a Partially Observable Waiting List

In the United States, end-stage liver disease patients join a waiting list and then make accept/reject decisions for transplantation as deceased-donor organs are offered to them over time. These decisions are largely influenced by the patient’s prospect for future offers, which can be ascertained most accurately by knowing the entire composition of the waiting list. Under the current transplantation system, however, UNOS (United Network for Organ Sharing), in an effort to strike a balance between privacy and transparency, only publishes an aggregated version of the waiting list. However, it is not clear whether the published information is good enough (compared to perfect information) to help patients make optimal decisions that maximize their individual life expectancies. We model and analyze this accept/reject problem from an individual patient’s perspective using a partially observed Markov decision process (POMDP) framework, which incorporates the imperfect waiting list information as currently published into patient’s decision-making. In addition to analyzing structural properties of this model, we compare, in a clinically driven numerical study, the results of this model to those of an existing MDP model that differs from our model in assuming the availability of perfect waiting list information. This comparison allows us to assess the quality of the published imperfect information as measured by a patient’s so-called price of privacy (i.e., the opportunity loss in expected life days due to a lack of perfect waiting list information). Previous work estimates a percent loss of about 5%, on average, when a patient has no waiting list information compared to full information. In this paper, we find that the currently published partial information is nearly sufficient to eliminate this loss, resulting in a negligible price of privacy and supporting current UNOS practice.

Estimating the Patient's Price of Privacy in Liver Transplantation

In the United States, patients with end-stage liver disease must join a waiting list to be eligible for cadaveric liver transplantation. Due to privacy concerns, the details of the composition of this waiting list are not publicly available. This paper considers the benefits associated with creating a more transparent waiting list. We study these benefits by modeling the organ accept/reject decision faced by these patients as a Markov decision process in which the state of the process is described by patient health, quality of the offered liver, and a measure of the rank of the patient in the waiting list. We prove conditions under which there exist structured optimal solutions, such as monotone value functions and control-limit optimal policies. We define the concept of the patient's price of privacy, namely, the number of expected life days lost due to the lack of complete waiting list information. We conduct extensive numerical studies based on clinical data, which indicate that this price of privacy is typically on the order of 5% of the optimal solution value.

The Price of Privacy

The Price of Privacy

Price of privacy: Selling consumer databases in bankruptcy

This article analyzes whether bankrupt Internet companies can sell consumer database information in their attempts to pay off creditors as mandated by Chapter 7 and Chapter 11 bankruptcy protection law and provides guidance to solvent e-commerce companies in regard to their privacy policies. Database sales in bankruptcy are in conflict with most companies’ own posted privacy policies and, therefore, have been contested. The question pits the commercial interests of creditors, which have as their advocates bankruptcy court judges, against the privacy interests of consumers, who have found allies in state attorneys general, privacy groups and foundations, and the Federal Trade Commission (FTC). With no clear law preventing them, bankruptcy trustees have attempted to sell the databases. Ultimately they agreed not to sell by settling claims filed by the FTC and attorneys general. There is no law specifically prohibiting such sales, and until specific legislation is passed, bankruptcy court judges will continue to be left to rule on a case-by-case, even a motion-by-motion basis, interpreting the United States Code to the best of their ability. Their options are outlined and discussed.

Constitutional Issues in Information Privacy

The U.S. Constitution has been largely ignored in the recent flurry of privacy laws and regulations designed to protect personal information from incursion by the private sector, despite the fact that many of these enactments and efforts to enforce them significantly implicate the First Amendment. Questions about the role of the Constitution have assumed new importance in the aftermath of the September 11 terrorist attacks on the World Trade Center and the Pentagon. Efforts to identify and bring to justice the perpetrators and to protect against future terrorist attacks, while threatening to weaken constitutional protections against government intrusions into personal privacy, demonstrate vividly the value of information collected in the marketplace and the need for such information in the future. While there is some suggestion that the First Amendment may be a source of privacy rights applicable to the collection and use of personal information by the private sector, it is clear that the First Amendment restrains the power of the government to enact and enforce privacy laws that curtail expression. The precise extent of that restraint depends on a number of factors, not all of which have been clearly resolved by the Supreme Court. But, as the events of September 11 starkly remind us, the price of privacy may be very high indeed. Legislators, regulators, and prosecutors who ignore the First Amendment when considering privacy laws do so at their - and our - peril.