INTRODUCTION: WHAT IS LARPP?
Lifestyles of the Attribute Rich and Privacy Preserved (LARPP) is a project funded by the National Strategies for Trusted Identities in Cyberspace (NSTIC) contracted with Internet2 (I2) and under the leadership of its principal investigator, Ken Klingenstein. This projects sponsors pilot schools to implement software, provisionally called the “privacy manager,” to provide users with information and choices that allow them to exercise active, informed consent about the release of personal information, or “attributes,” in course of authentication to web sites and on-line services.
As a part of the NSTIC grant, LARPP aims to contribute to a variety of efforts, both public and privately funded, to cohere the “identity ecosystem,” or the vast array of user credentials and authentication systems that people currently use to access Internet services. More specifically, LARPP, through the “privacy manager” software, tests one of the privacy principles active in the legal frameworks of most other developed countries: informed consent of the user to release personally identifiable attributes about themselves to a service provider.
How does it work? When a user initiates an authentication process, for example when one logs in to, say, Google or Facebook, the very act of initiating the process would automatically produce a drop down box that breaks down personally identifiable pieces of information into specific attributes, for example: the user name (for example, a user ID, rshuey); the real name of the user (for example, Renee Shuey); or the affiliation of the user to the entity that supplied the identifier (for example, The Nittany Lion Chair of Information Systems), together with a on-off swipe capability to control whether or not the user wants to release that information to the service provider. Question about what each attribute signifies can be answered by the link associated with the an icon that provides the user with more information. In a nutshell, that process is what constitutes “informed consent.”
Why does it matter? First, because privacy matters increasingly to individual users, and there are myriad ways in which Internet technological process, unbeknownst to the user because of their opaque nature, have the potential to compromise or abuse the individual’s privacy. Second, because the privacy laws of other developed nations of the world increasingly require informed consent and other fair information practices in a variety of areas, including authentication processes. The United States, to date, is an outlier among developed countries, but as institutions within the country, and among higher education institutions in particular, seek to participate in international activities, such processes will be expected and required by service providers from around the world. In other words, it is a process passport to participation in global higher education teaching, research and outreach. Finally, privacy principles and fair information practices overlap into important other areas of social concern, such as accessibility and veteran’s affairs. The “privacy manager” software provides such users with anonymity regarding their disability or veteran status (to name just a few classifications), preserving the user’s privacy and reducing the potential for bias.
CURRENT PARTICIPATING INSTITUTIONS
Carnegie Mellon University
Penn State University
University of Washington
University of Maryland Baltimore County
Colby College
University of Albany, State University of New York
Lafayette College
Duke University
Harvard University
University of Chicago
Swarthmore
UC Berkeley
RESOURCES
Lujo Bauer, Associate Research Professor, CyLab and ECE, Carnegie Mellon University presentation webinar on functionality of the privacy manager software: http://lbauer.ece.cmu.edu/2014-04-04-privacy-manager-demo.mp4
Ken Klingenstein, Principle Investigator, NSTIC for I2, introduction to LARPP Webinar: [to be provided] Slide Deck for Reference: LARPP call 1.pptx