Embedding Privacy Into Design Through Software Developers: Challenges and Solutions

Tahaei, Mohammad; Vaniea, Kami; Rashid, Awais

doi:10.1109/msec.2022.3204364

Cited by 11 publications

(3 citation statements)

References 11 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Introducing software developers to privacy and legal concepts in the context of software development early in their studies might sensitize future software developers to potential privacy threats. With many CS curricula showing little focus on privacy, educating CS students on privacyrelevant topics might be a good starting point to sensitize future developers to privacy issues [88]. Future research should explore the role of privacy education.…”

Section: Recommendations For Academiamentioning

confidence: 99%

“Those things are written by lawyers, and programmers are reading that.” Mapping the Communication Gap Between Software Developers and Privacy Experts

Horstmann,

Domiks,

Gutfleisch

et al. 2024

PoPETs

View full text Add to dashboard Cite

To ensure data-privacy compliance, it is common for companies to consult privacy experts for the identification and communication of privacy requirements to software developers. However, developers often fail to fulfill those requirements resulting in companies regularly being fined for violations due to non-compliance with privacy data regulations. To investigate why software developers struggle with the implementation of privacy requirements and explore their communication modality, we conducted a qualitative semi-structured interview study with 30 participants involving 10 software developers, 10 privacy experts, and 10 team coordinators with an average experience of nine years in the privacy communication and implementation process within a company context. We found a communication gap between software developers and privacy experts, suggesting a lack of proper procedural steps during the software development process to guarantee that the privacy requirements have been adequately addressed. We also uncovered that since privacy requirements were mostly communicated in a uni-directional manner, they were often perceived as a hindrance during software development, thus fostering an adversarial relationship between privacy experts and developers. Therefore, in order to fulfill the experts' requirements, software developers requested concrete steps to take during the software development process, as observed in the security field. However, privacy experts often lacked the technical knowledge to provide such instructions. This work contributes an explanatory theory on the communication gap between software developers and privacy experts. We discuss common obstacles in the communication of privacy experts and software developers and provide guidance on how to address them.

show abstract

Section: Recommendations For Academiamentioning

confidence: 99%

“Those things are written by lawyers, and programmers are reading that.” Mapping the Communication Gap Between Software Developers and Privacy Experts

Horstmann,

Domiks,

Gutfleisch

et al. 2024

PoPETs

View full text Add to dashboard Cite

show abstract

“…A strand of empirical software engineering research has studied the support developers need to build privacy-friendly apps and perform privacy-related tasks [82,87], such as finding privacy issues in code [46], deciding on personalizing ads [79], and building apps that are compliant with privacy laws [3,81]. In the case of making child-directed apps compliant with privacy laws like the California Consumer Privacy Act (CCPA) [29], developers often try to satisfy app store requirements instead of laws, and they often rely on app stores and operating systems to detect privacy-related issues [3,87].…”

Section: Empirical Privacy Studies With Developersmentioning

confidence: 99%

Stuck in the Permissions With You: Developer & End-User Perspectives on App Permissions & Their Privacy Ramifications

Tahaei,

Abu-Salma,

Rashid

2023

Preprint

View full text Add to dashboard Cite

While the literature on permissions from the end-user perspective is rich, there is a lack of empirical research on why developers request permissions, their conceptualization of permissions, and how their perspectives compare with end-users' perspectives. Our study aims to address these gaps using a mixed-methods approach.Through interviews with 19 app developers and a survey of 309 Android and iOS end-users, we found that both groups shared similar concerns about unnecessary permissions breaking trust, damaging the app's reputation, and potentially allowing access to sensitive data. We also found that developer participants sometimes requested multiple permissions due to confusion about the scope of certain permissions or third-party library requirements. Additionally, most end-user participants believed they were responsible for granting a permission request, and it was their choice to do so, a belief shared by many developer participants. Our findings have implications for improving the permission ecosystem for both developers and end-users. CCS CONCEPTS• Security and privacy → Software and application security;Human and societal aspects of security and privacy; Usability in security and privacy; • Human-centered computing → Human computer interaction (HCI); HCI design and evaluation methods; • Software and its engineering;

show abstract

“…The conclusion of the privacy compliance analysis of mobile apps investigated in the literature is the prevalence of questionable privacy policies, inconsistencies, lack of transparency and non-compliance with regulatory requirements. A challenge that developers face is that developers must comply with privacy laws and there is no real methodology that exists to assist in the development of a privacy policy thus developers are trying to comply with regulations without the necessary knowledge of what language and explicit terms of language are needed to implement dangerous android permission-policy declarations (DAPD) [23]. This has resulted in many mobile application developers seeking guidance on Stack Overflow for the creation of compliant privacy policies [24][25][26].…”

mentioning

confidence: 99%

Runtime and Design Time Completeness Checking of Dangerous Android App Permissions Against GDPR

Mcconkey,

Olukoya

2024

IEEE Access

View full text Add to dashboard Cite

Data and privacy laws, such as the GDPR, require mobile apps that collect and process the personal data of their citizens to have a legally-compliant policy. Since these mobile apps are hosted on app distribution platforms such as Google Play Store and App Store, the app publishers also require the app developers who wish to submit a new app or make changes to an existing app to be transparent about their app privacy practices regarding handling sensitive user data that requires sensitive permissions such as calendar, camera, microphone. To verify compliance with privacy regulators and app distribution platforms, the app privacy policies and permissions are investigated for consistency. However, little has been done to investigate GDPR completeness checking within the Android permission ecosystem. In this paper, we investigate the design and runtime approaches towards completeness checking of sensitive ('dangerous') Android permission policy declarations against GDPR. In this paper, we investigate the design and runtime approaches towards completeness checking of dangerous Android permission policy declarations against GDPR. Leveraging the MPP-270 annotated corpus that describes permission declarations in application privacy policies, six natural language processing and language modelling algorithms are developed to measure permission completeness during runtime while a proof of concept Class Unified Modeling Language Diagram (UML) tool is developed to generate GDPR-compliant permission policy declarations using UML diagrams during design time. This paper makes a significant contribution to the identification of appropriate permission policy declaration methodologies that a developer can use to target particular GDPR laws, increasing GDPR compliance by 12% in cases during runtime using BERT word embedding, measuring GDPR compliance in permission policy sentences, and a UML-driven tool to generate compliant permission declarations.

show abstract

Embedding Privacy Into Design Through Software Developers: Challenges and Solutions

Cited by 11 publications

References 11 publications

“Those things are written by lawyers, and programmers are reading that.” Mapping the Communication Gap Between Software Developers and Privacy Experts

“Those things are written by lawyers, and programmers are reading that.” Mapping the Communication Gap Between Software Developers and Privacy Experts

Stuck in the Permissions With You: Developer & End-User Perspectives on App Permissions & Their Privacy Ramifications

Runtime and Design Time Completeness Checking of Dangerous Android App Permissions Against GDPR

Contact Info

Product

Resources

About