Behind the scenes of Carnegie Mellon’s heated privacy dispute

Researchers at Carnegie Mellon University set out to create advanced smart sensors called Mites. The sensors were supposed to collect 12 types of environmental data, including motion, temperature and garbled audio, in a safer and more privacy-friendly way than the existing Internet of Things infrastructure. But after installing hundreds of sensors around a new building on campus, the project took an ironic turn when some students and faculty members accused the researchers of invading their privacy by not asking for their consent. prior.

The ensuing debate within the Social Software and Systems department became heated and complicated, and it highlighted just how nuanced privacy and technology issues can be. These are issues we all have to deal with as a dazzling amount of data is collected about us – inside our homes, on our streets, in our cars, in our workplaces and in most other places. spaces. As we write in the article, if the technologists whose research sets the agenda can’t come to a consensus on privacy, where does that leave us?

The story took us over a year to report. We have tried to present different perspectives on privacy, consent, and the future of IoT technology while acknowledging the very real roles that power, process, and communication play in how technologies are deployed.

One truth became clear in the report: privacy is subjective – there is no clear set of criteria for defining what constitutes privacy-protecting technology, even in academic research. In the case of CMU, people on all sides of the debate were trying to argue for a better future according to their own understanding of privacy. David Widder, a PhD student who focuses on tech ethics and a central character in our story, told us, “I’m not ready to accept the premise of a future where there are all these types of sensors everywhere. ”

But the very researchers he criticized were also trying to build a better future. Department chairman James Herbsleb encouraged people to support mite research. “I want to reiterate that this is a very important project…if you want to avoid a future where surveillance is routine and inevitable!” he wrote in an email to members of the department.

The big questions about the future were at the heart of the UMC debate, and they reflect the same questions we all face. Is a world full of IoT devices inevitable? Should we spend our time and effort trying to make our new world technologically safer and more secure? Or should we reject technology altogether? Under what circumstances should one choose which option, and what mechanisms are needed to make these decisions collectively and individually?

Questions around consent and how to communicate about data collection have become flashpoints in debate at CMU, and they are also key issues at the heart of technology regulation discussions today. In Europe, for example, regulators are debating rules around informed consent and data collection in response to pop-ups that have cluttered the internet since the adoption of the General Data Protection Regulation, the European Union’s Data Protection Act. data confidentiality. Companies use pop-ups to comply with the law, but the messages have been criticized for being useless when it comes to actually informing users about data collection and terms of use.

In the story, we also focus on the differences between technical approaches to privacy and social norms around things like notification and consent. Cutting-edge techniques like edge computing can help maintain privacy, but they can’t necessarily replace asking people if they want to participate in data collection in the first place. We also consistently encountered some confusion about the nature of the project and the data collected, and the communications about data collection we reviewed were often opaque and incomplete.