ARI: Hello, I'm Ari. [CLAUDINE: And I'm Claudine] Welcome to Proving the Negative.
ARI: We're a podcast all about exploring the different sides of cybersecurity,
from political to computer science, international relations to mathematics.
Join us as we talk to our friends about the work they do.
ARI: Would you like to start with yours?
CLAUDINE: Why don't we start with yours? ARI: OK.
We're doing something a bit different - this podcast is all about engagement,
and it's all about being easy for people to understand.
We've got key words here and there that might throw you for a loop.
These intros are to chat about why we're talking about what we're talking about.
Today we're talking about my research. CLAUDINE: since we are... what is it?
ARI: I lived in the US for a while. Before I went, I needed my immunisation record.
(the jabs I'd had) I went to the doctors and they didn't have any records for me.
The people who were meant to look after my information didn't have it.
This happened ages ago, I'm still salty! It's affected how I think about privacy.
How can I share data? How can I hide it from people who don't need to see it?
Power to the people, really.
The way that we try and control how data is used doesn't really work.
Part of the reason is - it's inflexible. Paper forms don't translate to online spaces.
CLAUDINE: Power to the people is always good. Any terms you want to define?
ARI: Privacy is controlling what is known about you, in a reasonable way.
You can get a bit paranoid. Back in the day, US lawyers (Warren and Brandeis)
were part of an elite group who got annoyed by the paparazzi taking photos.
They wrote about the right to privacy, the right to control what is known.
There's a history of different takes people have on it. I like to think about choice.
I talk about informed consent. Cookie [notices] online are really annoying...
Apparently these are consent notices and it's all about having informed consent.
CLAUDINE: We rarely think about what it means to be informed before agreeing.
ARI: Yeah, informed consent is meant to help people keep safe.
The way we do it, it gets in the way. We need to do better, make it a conversation.
What we'll talk about is part of a much wider conversation about data use.
CLAUDINE: Let's go ahead and get into the interview that you and I recorded.
Welcome, Ari. [ARI: Hello]. Would you give me and our listeners your overview?
ARI: There are some misconceptions that we have about people, in security.
You may hear 'users are the problem/weakest link'.
This places blame on the people who have the least power to do anything.
This is something I'm trying to find evidence either for or against.
I've been looking at how we architect choice - how we offer people options.
I've been collaborating with a medical online research platform and I've been
looking at how they architect choice for the people who take part in their study.
This is important - in research, informed consent is used to protect people.
You offer a description of the work you want to do to a potential participant.
They say yes or no. [If] they say yes, you can then collect data for your research.
Now, what I did in my work, there were three parts to it.
1. I interviewed people taking part in, and the research team behind, a research study.
It's an online platform. They collect data on rare genetic conditions.
And what I found was that the research team was excellent, very engaged,
they had participant interests at heart and wanted to protect, help and support.
They had a group they asked for advice... Participants didn't know what was going on,
they had a lot of assumptions around how researchers would use their data.
They said, 'yes, I'll take part', but they didn't expect to hear anything back.
2. I asked participants what they wanted to hear [back]. And they told me.
3. I worked with software developers and the research team to improve feedback.
We looked at whether this changed how people shared data.
We measured the number of questionnaires that the study asked
people to fill out, against the number of questionnaires they received back.
Drop off in participation was reduced which suggests that if you listen to people,
if you respond to what they want, they're more likely to stick with you,
which is important when you're talking about how you share data,
how you operate online, how you build systems and how you architect choice.
CLAUDINE: Could you expand on what it means for consent to be informed?
ARI: Informed consent practices are data protection practices. After World War II,
(terrible things had happened to people in the name of medical research)
There was a series of trials in which war criminals were held to account.
Informed consent was how medical researchers could show agreement to
potential risks, what's involved. That participants have knowingly agreed.
[Consent] is freely given so you're not coercing people; informed and voluntary.
It's important you haven't forced the decision. Informed consent has problems.
Sometimes, once you give your consent, you can't actually change it.
People are overloaded with technical information. When you look online...
pre-existing problems are compounded. People unfamiliar with digital technology
will find it hard to use. It adds up. If you look at consent online - cookie notices.
I come across them every day on every website and they're really annoying.
They overload me with information, I've never once been able to revisit a choice.
I just want to look at kitten videos. Calling this informed consent doesn't fit.
It doesn't work. Informed consent is broken online.
I'm thinking of how we can do better. There's a theory called Dynamic Consent.
It's flexible and you can change your mind over time. It's a theory.
There's not a lot of work that supports it or refutes it.
The people I work with have implemented Dynamic Consent.
I tried to do a service evaluation. I wanted to explore something new.
The system we have isn't working. Consent is a safeguard, there's room to improve.
CLAUDINE: What drew you to that topic specifically?
ARI: We have a right to privacy in the home. What does the home look like online?
Where do the boundaries sit? Solove, Nissenbaum...
There are people figuring out how to model privacy when building technology.
I'm someone who works with computers a lot,
I'm frustrated by [having] to give someone my email just to get a receipt.
That shouldn't be the case. CLAUDINE: Based on the interviews you conducted,
go into what people thought about privacy and eroding digital privacy.
ARI: It's not like we ever had total privacy, and we've had less and less of it
and now we have no privacy. It's more like we've normalised a lack of privacy.
There's a great quote that talks about how (in the early Internet),
had browsers in 1995 declined cookies as a default option, then most
websites would have responded with designs that didn't seek personal data.
The way we've [built] has led to this point. It's going to take energy to change.
Once you've done theoretical, academic work, you need some kind of output.
I've got something I could give a researcher building an online study,
they could use that to think about what data they want from participants and
how they demonstrate that data is being used for the purposes of research.
Currently in a research study, I can use a template that has 'share' or 'not share',
[If someone agrees to share] I don't have to tell them anything after that point.
There are other options. There are various choices you can offer people.
E.g., are you happy for me to share your data with colleagues/pharma companies?
There are different levels that people would like to have choice over.
People trusted researchers, saying they'd revoke consent if a researcher did a bad
thing or if they felt that what they had contributed towards was of no benefit.
Two conditions under which someone might take back consent, but none did.
There's implicit trust in researchers as experts - if we can do better, we should.
CLAUDINE: It is a little bit frightening that there is such implicit trust,
given that the research world has not been immune from ethical scandals.
What has the biggest surprise been in conducting your research?
ARI: The people I interviewed thought they also had duties: to be truthful,
to be accurate, to provide 'perfect' information to support research.
It's not that people don't take this seriously, or they don't want to engage.
There are so many underlying assumptions or decisions being made.
We don't see them. Privacy is a way for people to express choices.
We researchers, and experts in other fields (people who make software,
people who make policy decisions), seem to assume that people are stupid.
We do not take time to communicate in terms people can understand.
People have jobs, they have time restrictions, energy constraints,
it's the expert's (i.e., MY job) to communicate what I want to do,
so it's a truly informed choice.
People expected so much, but they never voiced that.
CLAUDINE: What I'm hearing from you is that the notion
of transparency is hand-in-hand with the notion of privacy? ARI: Exactly.
One of the duties that people thought researchers had - to protect data,
people thought researchers should make them feel safe.
Combining safety and security when protecting their personal information.
They talked about confidentiality and anonymity - security was important.
Most of all, it was that the researchers had been considerate,
the consideration and protection of data includes security measures (access ctrl).
It was also about the researcher as a person that they were honest/reliable.
In ~2015, a hospital made an agreement with a big tech company.
For anyone who knows it, it's the Royal Free and Google...
What happened was they decided to work on an application together.
It would look at symptoms and predict serious conditions requiring treatment.
They didn't have a data agreement in place. What a data agreement is, it says
'as a hospital we'll provide this', 'as a tech company...'
'we'll do that', we have everything agreed before anything (bad) happens.
What [developers] generally do is test on information that is not live,
not being used for something critical, like care in an emergency ward.
The app that they made was tested on live patient data (no consent).
The UK Information Commissioner's Office, an office that looks at situations
and makes a ruling on whether or not the way that data was used was legal.
And they said, 'no, this is bad'.
Doctors have a duty of care to patients. I think about duty of care in security.
I have a duty to care for data that people entrust to me,
if I damage that trust, it's on me to show that I am trustworthy.
It's not on people giving me data to do anything, placing trust is up to them.
I've seen ethics processes, they can take a while, they can be frustrating.
Ultimately, the reason we do this is so that we don't cause harm.
We shouldn't be wanting to take shortcuts.
I make ethical work easier for researchers by giving them a roadmap.
You don't need to be an expert in ethics. What do you want from participants?
Research data? They also have perspectives of their own.
They might be able to help or provide ideas. Look for input and filter it later.
Once you've done inclusive work, you need responsive work (give feedback),
show that you're worth the trust that people have put in you as a researcher.
Which is a bit touchy-feely, but very important.
I would like to make it easier for others to demonstrate trustworthiness as well.
CLAUDINE: Developing that roadmap, did you did you hit any speed bumps?
ARI: Oh, yeah, totally. It was going to be a long, very involved experiment.
We didn't have time, so we just did it all at once. The work lacks granularity.
Then the pandemic hit - there's lots of different ways this work can branch out.
I did what I could and hopefully other people will take it on.
The lessons I've learnt from this I will take on to whatever I do next.
CLAUDINE: What do you think the most important lessons are? ARI: Listen.
I as the expert researcher build a study for people to take part in.
I have to think about how I'm including people, how I'm listening and feed back.
Weave informed consent into the process for a relationship over time.
That can be quite intensive as well, resource-wise. But, if this isn't in place,
people can never express what they want to, something that might help.
My collaborators have this patient forum. People came up to them:
'Have you ever thought about mental health, not just the physical parts?'
My collaborators learned from participants as well as doing their work.
[It] makes your data collection much more valuable, having that context.
Not only do you receive the information about symptoms,
you also get information about people's lives and living conditions.
CLAUDINE: It's easy to get bogged down in technical minutiae,
and forget that a lot of the research we're doing is for people, for users,
and we need to listen to them and pay attention to their needs as opposed to,
'THIS is what you need'. ARI: It can be a lot, but I've been a software developer,
I know you can apply this to that kind of work.
E.g., when you build something, do user testing. Identify who's going to use this,
invite a few people in to have a go. You can troubleshoot, identify issues earlier,
that would be more expensive to fix later. CLAUDINE: Yeah, everybody wins.
It's [potentially] more laborious, but benefits everyone in the long run.
If you had infinite resources, whatever resources might mean,
what is the one big question you would like to investigate or solve?
ARI: It's all about culture. How do we build cultures in which people
feel comfortable bringing ideas, bringing mistakes, their experiences?
It's very much about leadership. As a cyber security person. I have to lead
the work that I do because I'm not an expert in lots of different subjects,
but what my job is, is to bring people who are experts into the group.
The expert that so many of us miss out is the user.
They have such a wealth of information and knowledge and experience.
My collaborators leveraged that experience and it worked out for them.
It was valuable. If I had all the resources, I would scale that up.
How do we communicate effectively? How do we build those relationships?
I don't expect every person in a study I'm running to call me every evening.
It's just about having that architecture in place, having that system in place,
where people can tell you information or they feel that you value them.
As a result, they're more likely to come forward with helpful information.
That's pretty abstract, I realise. In terms of cybersecurity experts, it's about
fostering leadership and knowing who to include as part of initial conversations
For people who are not cyber security experts - how do you equip them
to be a bit braver? How do you equip them with tools they can then use?
It's about advocacy. What do people need to be security advocates, elsewhere?
Bit of a step away from my research - it's not about me being 'the expert'.
It's about helping other people figure out how security is relevant and useful.
And then, weaving that into the work they do.
CLAUDINE: What cyber security resources would you recommend?
ARI: I only have Twitter, so I'm @schulite.
I get to see people's thoughts who I wouldn't normally have access to.
If you are not someone who likes to use social media,
The Register is really good. (https://www.theregister.com/security)
You can keep up to date with tech news, and you can branch out from there.
CLAUDINE: In case you missed it, Ari's twitter handle is @schulite, follow her,
she posts very interesting things. ARI: I do. CLAUDINE: Yes, you do. *laughter*
In the meantime, you can tweet at us @HelloPTNPod
and you can subscribe on Apple Podcasts or wherever you listen to podcasts.
The title there is PTNPod. See you next week. [ARI: Bye!]
This has been a podcast from the Centre for Doctoral Training in Cybersecurity, University of Oxford.
Funded by the Engineering and Physical Sciences Research Council.