IAC22 Safe Tech Audit Presentation Noreen Whysel.pptx
•
0 recomendaciones•61 vistas
Your Personal Information is none of anyone’s Business. Information Architecture can help keep it that way. Are you creating products that respect the needs and autonomy of your users? Would you like to learn how to evaluate your digital products for respectful behavior? It’s possible to measure ethical behavior of technology and Information Architecture is a key component. Join Noreen Whysel and you will Learn: -How can IA inform the design of safe and respectful apps and websites? -What is the Me2B Safe Technology Specification? -How can you get involved?
Recomendados
Recomendados
Más contenido relacionado
Similar a IAC22 Safe Tech Audit Presentation Noreen Whysel.pptx
Similar a IAC22 Safe Tech Audit Presentation Noreen Whysel.pptx (20)
Más de Noreen Whysel
Más de Noreen Whysel (20)
Último
Último (20)
IAC22 Safe Tech Audit Presentation Noreen Whysel.pptx
- 1. Safe Tech Audit: IA as a Framework forRespectful Design NoreenWhysel Director ofValidation Research Me2B Alliance/Internet Safety Labs
- 2. Agenda 01 02 03 04 05 06 Introduction IAHeuristics Me2BA Safe Technology Specification User Experience Audit –Applied IAHeuristics How toGet Involved IAPerimeter ofInfluence
- 3. Introduction
- 4. Curiosity
- 6. Introducing the Me2B Alliance We are a non-profit internet product testing organization, unrelentingly on the side of consumers and their safety.
- 7. Circle of Competence “…[S]tick within…your circle of competence…. “It's not terribly important how big the circle is. But it is terribly important that you know where the perimeter is.”— Rolf Dobelli
- 8. Perimeter of Competence Source: Sinclair, A. 2016 The Intellectual Base of Archaeological Research 2004-2013: a visualisation and analysis of its disciplinary links, networks of authors and conceptual language, Internet Archaeology 42. https://doi.org/10.11141/ia.42.8
- 10. We measure the safety of websites, mobile apps, any connected technology.
- 11. Like Restaurant Scores. But for Technology.
- 12. 1 Define Define "Safe" technology. Operate as an Internet Safety Lab.
- 13. Research Perform industry benchmarks. Validate safety spec with Me-s. 2
- 14. Test Conduct independent product testing of websites and mobile apps (and more). 3
- 15. Educate Helping all stakeholders know how to build safe products 4
- 16. Advocate Keep Me-s safe in the digital world. 5
- 17. EU - GDPR California - CCPA/CP RA Virginia Colorado …more coming • California specifically calls out “Dark Patterns” which impair user autonomy, decision-making and choice
- 18. IAHeuristics
- 19. National Strategy forTrusted Identity in Cyberspace (2011) How might we? • Help “Individuals and organizations” … “utilize secure, efficient, easy-to-use, and interoperable identity solutions” • So they can “access online services in a manner that promotes confidence, privacy, choice, and innovation.” Source: https://obamawhitehouse.archives.gov/sites/default/files/rss_viewer/NSTICstrategy_041511.pdf
- 20. Identity Ecosystem Framework Registry The Identity Ecosystem Steering Group • Privacy • Security • Interoperability • Usability UX Committee • User Experience Guidelines and Metrics Source: https://idefregistry.edufoundation.kantarainitiative.org/
- 22. Nielsen/ Mack Usability Inspection Methods (1994) Source: Heuristic Evaluation – A System Checklist. https://stcsig.org/heuristic-evaluation-a-system-checklist/
- 23. Identity Ecosystem FrameworkRegistry For the IDEF Website, we found that many of the requirements in the Nielsen/Mack heuristics identified functions and processes of a system that are specific to standalone software and other technical systems and somewhat irrelevant to websites, which rely on command language and functionality of the browser and device used to access them.
- 24. Abby Covert’s 10 Heuristic IA Principles (2012) Source: Abby Covert. Information Architecture Heuristics. https://www.slideshare.net/AbbyCovert/information-architecture-heuristics
- 25. 1 Identify What tasks does your audience value the most? What channels will the user path connect to?
- 26. Prioritize List taks in orderof imoprtance 2 List the IA Principles in order of importance Assign a pre-test score for each principle
- 27. Analyze Review and evaluate problems Rate the impact of the entire experience 3
- 29. Did YouKnow?
- 30. 60% ofschool apps leakstudent informationto Big Tech • Second level • Third level • Fourth level • Fifth level
- 31. People are uninformed about their data rights • Morethanhalfof USadultsdon’tknowthatagreeing toTerms of Use createsalegally binding contractthatmayallow personaldata sharing • In ourfocusgroups,peoplesaytheylooktothe Privacy Policytounderstandtheir datarights.Tothem, theTermsof Usearejust “TheRules” • But…aPrivacyPolicyis just that—apolicy.It is requiredas anoticetoconsumers,butit is notalegally binding contract • The real,binding termsarein theTermsof Use
- 33. Source: Flash Guide #3: Me2B Rules of Engagement https://me2ba.org/flash-guide-3-the- me2b-rules-of-engagement-our-ethical-foundation/ The Me2B Rules of Engageme nt 1. Freedom | We agree not to coerce or manipulate each other. 2. Respect of Boundaries | We agree to respect each other’s personal boundaries. 3. Respectful Defaults | In the absence of stated preferences, we default to the most conservative behavior. 4. Fairness & Non-exploitation | We agree to treat each other fairly and not exploit things that are shared. 5. Good Communication | We agree to be forthright, honest and clear in our communication. 6. Promise-Keeping | We keep our promises. 7. Non-Harming | We agree not to willfully harm one another. 8. Respectful Dispute Resolution | We agree to respectful, collaborative and fair dispute resolution methods.
- 37. Data Flows:Not a Trickle. A Firehose.
- 38. Apple and Google have changed their privacy settings, but… • Most mobile appsandwebsitescreatepersistentchannelstothirdparty databrokerswhocan shareyourdatafarandwide • Wecanpointtochanges in the privacysettingsforAppledevices (2022) andupcoming privacylabeling onappsin theGooglePlay store(2023) thatarestepsin therightdirection • ButBigTech will continuetofindwaystocollect, useand sharetheir customer’spersonaldata,andthirdpartieswill continuetodevelop andshareyourdataprofilein new ways.
- 39. No Gossip No Eavesdropping No Stalking No Manipulation No Coercion Progressive Consent All Touch Points Should Be Respectful Respectful Relationships
- 40. Respectful Relationships No Gossip No Eavesdropping No Stalking No Manipulation No Coercion Progressive Consent All Touch Points Should Be Respectful Data minimization Individual control and autonomy Respectful defaults
- 41. Safe Relationships ● Data minimization ● Individual control and autonomy ● Respectful defaults
- 42. User Experience Audit: Applied IA Heuristics
- 43. Attributes of Respectful Commitments 1. Clear Data Processing Notice 2. Viable Permission (Data Controllers and All Data Processors) 3. Identification Minimization 4. Data Collection Minimization 5. Private by Default 6. Reasonable Data Use & Sharing Behavior 7. Data Processing Complies with Data Subject's Privacy Preferences & Permissions 8. Data Processing Complies with Policies 9. Reasonable Commitment Duration 10. Commitment Termination or Change Behavior
- 44. Abby Covert’s 10 Heuristic IA Principles (2012) Source: Abby Covert. Information Architecture Heuristics. https://www.slideshare.net/AbbyCovert/information-architecture-heuristics
- 45. 1 Identify Identify user flows and actions to evaluate in websites and apps • First-Open/No Commitment • Local Storage Commitment • Location Commitment • Promotional Commitment • Contact Us Commitment • One-Off Transaction Commitment • Loyalty Commitment • Me2B Marriage Commitment
- 46. Prioritize List taks in orderof imoprtance 2 Prioritize the IA Principles. Provide a score.
- 47. Findable • Is there a data processing notice available to the user? • Is the data processing notice present/available on the same screen as the commitment? 1. Clear Data Processing Notice
- 48. Accessible • Is the data processing notice/information accessible and rendered by assistive services and other machine-readable processes? 1. Clear Data Processing Notice
- 49. Clear (understandable) • Is the copy for the website notice for clear and easy to understand by the general population. • Readable privacy policy: Grade level 6 or lower as measured by the Flesch- Kincaid Readability Index 1. Clear Data Processing Notice
- 50. Communicative • Is the data processing notice that the data subject receives on the website complete? 1. Clear Data Processing Notice
- 51. Controllable • Does the data subject freely give permission for this commitment? • No dark patterns detected in the UX • Is there a discrete, intentional permission UX for the commitment? • Does the consent flow to all downstream data processors and co- controllers? 2. Viable Permission
- 52. Give up yet? How ‘bout now?
- 53. Analyze Review and evaluate problems Rate the impact of the entire experience 3
- 54. Findable 1. Clear Data Processing Notice 0 == Data processing notice exists -2 == Data processing notice is not on the same screen. -3 == Data processing notice is missing
- 55. Accessible 1. Clear Data Processing Notice 0 == The assistive screen reader can read the notice. -1 == The assistive screen reader is unable to read part of the notice. -2 == The assistive screen reader is unable to read most of the notice. -3 == The assistive screen reader is unable to read any of the notice.
- 56. Clear (understandable) 1. Clear Data Processing Notice 0 == Reading comprehension score is at or below Flesch Kincaid 6th grade reading level -1 == Reading comprehension score is above Flesch Kincaid 6th grade reading level -3 == Reading comprehension score is above Flesch Kincaid 8th grade reading level
- 57. Communicative 1. Clear Data Processing Notice 0 == Data processing notice explains the data process per Me2B Commitment. -3 == Data processing notice does not explain data process per Me2B Commitment.
- 58. Controllable No Dark Patterns • -1 to -3 == Harmful patterns detected in UX. • -3 == Data subject is required to agree to terms of service prior to account creation. Appropriate Level of Control • -3 == Data subject controls are are inadequate/insufficient/too coarse-grained. • -1 == Data subject controls are somewhat inadequate/sub-optimal. 2. Viable Permission
- 59. How to Get Involved
- 60. Get Involved with Safe and Respectful Technology • Me2B Alliance (Me2ba.org) • Respectful Technology Specification WG • PaLS: Policy and Legal WG • Kantara Initiative (Kantarainitiative.org) • FIRE WG (Federated Identity) • ANCR WG (Advanced Notice & Consent Receipt) • PEMC WG (Privacy Enhanced Mobile Credentials) • UMA WG (User Managed Access) • Project VRM, (cyber.harvard.edu/projectvrm/) • IEEE P7012 Machine Readable Personal Privacy • W3C • Information Architecture Community Group
- 61. Thank you! Noreen Whysel Director of Validation Research Me2B Alliance Noreen.whysel@me2ba.org Follow @nwhysel and @me2balliance on Twitter
Notas del editor
- Hi I’m Noreen Whysel and I’m sitting in my 2BR apartment in Brooklyn. Describe myself and the room, black wall, colorful art, new lamp. From what I’m telling you, you might say that I have rather Quirky taste in art, but relatively simple, plain style of dress. You may know me because I’ve been a fixture of past IACs and Summits or maybe I’m new to you so you looked me up on LinkedIn and read my Twitter feed to get a sense of my background. You know these things about me because I choose to show you and tell you. Or because you knew where to find information about me and whom to ask. But there are things I didn’t tell you that you may notice. You see boxes so you might surmise that I moved recently. There are things you might see that I may not want you to notice, like the small speck on one of my teeth that I got from a Spin brush abrasion and that I’ve been avoiding the dentist. You don’t expect your devices and technology relationships to know these things about you, but they do have a very rich picture of where you are now, who you are with and what you are doing. They map that picture to others like you who share your habits, preferences and background. They use this information to predict and influence your behavior. And they share it with other networks (through adtech SDKs)
- I will be talking about one tool, IA heuristics and how I am applying it in the development of a safe technology specification at the Me2B Alliance. But you should think about your interests and field of expertise and how you might practice Applied IA.
- To give you a little background, here’s an overview of what we do at the Me2B Alliance.
- Hi I’m Noreen Whysel. I’m a researcher, an information architect and increasingly, an expert on developing technology standards. If there is one thing that defines me it is Curiosity.
- I am driven to explore things that happen on the edges. It is where a lot of the most interesting things happen. And it is a place that is ideal for people who practice information architecture.
- I work for the Me2B Alliance as the Director of Validation Research. We developing a safety spec for the internet. Our work encompasses new terrain that includes ethics, psychology, philosophy, anthropology, sociology, technology, law, regulation. It’s a complex world to work in. Consumers and businesses speak different languages and the people creating technology standards speak yet another language. IA can help to draw these worlds together so that everyone speaks the same language.
- I recently found this quote from Rolf Dobelli, the one who gave us the adage about how if you have a hammer everything looks like a nail. Read slide.
- As IAs we are uniquely skilled to work on the edges. We don’t just see the hammer and nail. We look at the spaces where disciplines meet, break down the mental models and through a combination of curiosity and expertise we can build taxonomies and wayfinding to get everyone to speak the same language and find what they need..
- One of the areas where I am IA is Safe Technology. To give you a little background, here’s an overview of what we do at the Me2B Alliance.
- We measure the safety of connected technology. Where “safety” means the ability to exercise privacy, and live freely in the digital world. There are many cybersecurity standards; we're not doing that. We're talking about human privacy and human safety.
- Think of it as Restaurant Scores for technology.
- We are creating a safe technology specification and operate as an Internet Safety testing Lab, similar to Underwriters Lab or Consumer Reports.
- We also do a lot of validation research to ensure that the our safe technology specification makes sense to developers and to ensure that they are addressing a recognizable problem faced by consumers. This is mostly what I do.
- We are also conducting independent product testing. These tests include product behaviors such as data capture and sharing that happens behind the curtain, as well as user experience tests to ensure that product users are informed of these behaviors and how what they can do to permit or deny them.
- We want to be sure all stakeholders know how to build safe products and publish Spotlight reports and flash guides on Me2B topics.
- We also advocate for safe product behavior at the government level to ensure the most people possible are safe. (Many states in the US have begun to adopt data privacy laws that are similar to GDPR (General Data Protection Regulation), which specifies how and whether technologies can collect, use and share personal information.)
- These laws and several state level privacy bills give consumers more control over the data that gets collected, used and shared with third parties. California’s law is particularly important since most companies doing business in the US are going to have users in California. CPRA specifically calls out “Dark Patterns” which are Uis that impair user autonomy, decision-making and choice.
- So where does IA come in? I discovered a way for Information Architecture Heuristics to inform a data privacy standards. But first, we will go back a few years to a project I was developing for the Identity Ecosystem Steering Group back in 2013.
- The IDESG was formed in 2011 in response to the White House National Strategy for Trusted Identity in Cyberspace. Their vision statement conveniently phrased as a HMW question: How might we help “Individuals and organizations” … “utilize secure, efficient, easy-to-use, and interoperable identity solutions” so they can “access online services in a manner that promotes confidence, privacy, choice, and innovation.”
- The IDESG created an Identity Ecosystem Framework and Registry with requirements for Privacy, Security, Interoperability and Usability of identity solutions. I was a vice chair on the UX committee where we developed the Usability requirements and a set of User Experience Guidelines and Metrics for ensuring usability of those identity solutions.
- For identity software, The IDEF User Experience Guidelines and Metrics (2016) recommend usability inspection method based on the industry standard “Heuristic Evaluation – A System Checklist,” which incorporates heuristics developed by Elaine Weiss (1993) and Jakob Nielsen and Robert Mack (1994).
- These heuristics are an exhaustive evaluation of the ten usability heuristics developed by Neilson (1994)
- Nielsen/Mack’s checklist was great for evaluating identity software, but for the IDEF Website, we found that many of the requirements in the Nielsen/Mack heuristics identified functions and processes that were somewhat irrelevant to websites, which rely on command language and functionality of the browser and device used to access them.
- So we adopted Abby Covert’s IA Heuristics, which she had developed in 2012. Abby Covert’s Ten Information Architecture Heuristic Principles is a more relevant checklist. And are based on Neilsen/Mack as well as a number of more recently developed guidelines from Rosenfeld (2004), Morville (2004) and Resmini and Rosati (2011). Covert’s heuristics address relevant issues in the system checklist as well as additional concerns specific to a web-based application.
- Abby recommends beginning by identifying user tasks that you expect your audience to value over others. When you have identified these tasks, also note the channels that the user’s path will put them in contact with and what the context is. IDEF tasks included completing a product Attestation or looking up products in a registry that meet your needs as a business consumer
- The second step is to prioritize each of the ten information architecture principles in order of importance based on the coverage of the outlined tasks and organizational priorities. This step provides notes on the tasks that make each principle essential and list any expectations you anticipate from users. Then you can assign a pre-test score against each principle to note how well the website performs in the current implementation. Findable and Clear were important principles for IDEF. It wasn’t always clear exactly how to go through the product listing process and he way the information was presented to consumers needed to be clear and findable.
- The third step is to have a group of 3 to 5 experts review and evaluate any problems discovered and rate the impact on the entire experience. These ratings helped our developers prioritize user needs and create better visualizations of the product details.
- Abby’s framework worked very well for the ID Ecosystem Framework. But this was a straight application of a web interface. My next opportunity to apply IA to standards came at the Me2B Alliance and their Me2B Safe Technology Specification and it was a little different.
- Let’s look at some background on what the Me2BA is trying to change and how Applied IA helped.
- We do a lot of product research to demonstrate the value of our safe tech spec. Research on school apps in the San Diego Promise Zone last Fall found that 60% apps leak student information to third party data integrators in violation of COPPA. (Children’s Online Privacy Protection Act).
- Even something as simple and obvious as protecting our children’s data is not so easy to understand. Part of this has to do with the fact that we don’t understand our basic data rights. And we don’t know where to look for them or what we agreed to. This is an example of findings from research I did last summer on legal policies.
- The Me2B ethical orientation aligns with interpersonal relationship behavioral norms experienced in the physical world. (Refer also to Flash Guides #2-10 for a deeper treatment). It's important to have a grasp of the Me2B relationship framework and vocabulary in order to fully appreciate what “safe" means in the digital world. There is a longer description of this slide, but basically it shows a layered relationship between the product user, the business that makes it and the technology itself. Already as an IA you are probably drawn to the complex relationships and points of view in a diagram like this, which includes consumers, product design, lawyers, developers, third party software and data integrators. —- To begin, we view the relationship we have with technology as a dynamic relationship, that changes over time. We call this the Me2B Relationship, and there are several layers to the Me2B Relationship, including the legal layer with the business entity (Me2B Legal Relationship), the experiential relationship we have with a piece of technology itself (Me2P, or Me-to-Product Relationship), and the Hidden B2B Relationships the business has with third party Data Processors (or Co-Data Controllers), that have a quasi-relationship with the Me (or Data Subject)--"quasi" because the Me has little awareness or choice in these relationships. Which hints at one of the fundamental social norms of relationships in the physical world: which are mostly voluntary. We have distilled the characteristics of healthy human relationships and translated specifically for Me2B Relationships into a list of ethical principles called the Me2B Rules of Engagement (add link).
- We have distilled the characteristics of healthy human relationships and translated specifically for Me2B Relationships into a list of ethical principles called the Me2B Rules of Engagement (add link).
- TMe2B Relationship between the Me and the technology changes over time--like all the relationships we have. The full arc of the Me2B Relationship over time is called the Me2B Lifecycle (see Figure 2 below). And like our personal relationships, the Me2B relationship lifecycle is shaped by the two-way interaction experienced between the two parties. In particular in digital Me2B relationships, there are key transactions in the interaction that reflect Me2B Commitments--inflection points in the relationship trajectory that either deepen or lessen the intensity of the relationship. Each star in Figure 2 reflects these Me2B Commitments. At each such point, the Me is faced with a decision on whether or not to accept the offered Me2B Deal, which outlines what the Me gives (typically in the form of information) and what the Me gets in return.
- Which we imagine looks somewhat like this with a very small amount of data at the beginning of a relationship, gradually tapering off after the relationship is terminated.
- But it’s really like this. A major culprit in the tsunami of unwitting information sharing is the digital advertising infrastructure, (described in Flash Guide # 5) . This infrastructure systematically, and at massive scale shares personal data with multiple third parties (known as Data Processors). So long as this infrastructure exists, the personal data floodgates are open.ii
- Our personal data flows do not start light and increase with time and trust. Instead, a firehose of personal information is released – and shared with a host of unseen third parties – as soon as we open an app or website. Me2BA’s Respectful Tech Specification V.1 is largely focused on testing for these invisible parallel dataverse data flows.
- Most mobile apps create persistent channels to third party data brokers who can share your data far and wide, and while there are promising changes in some of the big browsers and app stores due to government regulations like CCPA and GDPR, these channels innovate quickly while government moves at the speed of, well government.
- So back to the power of IA to educate stakeholders on the effects of these violations of safe and respectful design. …. Our research shows that deceptive UI patterns have a lot in common with harms that we sometimes experience in our personal relationships. They can affect our confidence, our sense of control and our emotional and physical well-being. People use these words and they sound very much like the words we use in a relationship.
- Our rules of engagement with human to human relationships map nicely to rules of engagement for technology relationships.
- And translate to safe relationships.
- The framework for the Safe technology audit is a series of tests against ten attributes of Respectful commitments. Each of these attributes we look at relevant information and notifications, data collection, use and sharing behavior and UX behavior. For my part I focus on behaviors that are perceivable to the product user through the product content and interactive elements to ensure the technology rules of engagement are respected.
- We return to Abby Covert’s IA Principles and her framework for evaluating product architecture applied via the safe tech spec.
- We identified and evaluated user flows that correspond to the commitment states in the technology relationship arc. These are: First-Open/No Commitment Local Storage Commitment Location Commitment Promotional Commitment Contact Us Commitment One-Off Transaction Commitment Loyalty Commitment Me2B Marriage Commitment Of these states, local storage is the only one that isn’t necessarily visible in the UX Audit.
- Next, we prioritized the IA Principles which are scored based on how well the product performs against the requirements in the Me2B Safe Technology Specification.
- Example of how it works for the first attribute: Clear Data Processing Notice
- This would involve looking for things like ALT and ARIA attributes and anything that isn’t relatively clear on the page.
- Which brings us to the next principle, Clear.
- This can include a lot of things that connect those different POVs from legal to content to development teams: (1) the Me2B Deal Terms(quid pro quo) including data subsidization and monetization; (2) list of information collected (covering volunteered, observed and derived information); and (3) for each item of information, (a) legal basis for collection, (b) purpose for collecting the information including how it's used, (c) all data processors & co-controllers who receive it, and (d) how long the information is retained (by all data controllers and co-processors).
- We also look at Controllable, which is an important aspect of safe and respectful tech. Does the subject give their explicit, intentional permission? Is it discreet or are the consent options all or nothing?
- The third step of Abby Covert’s IA Heuristic Evaluation is to have a group of 3 to 5 experts review and evaluate any problems discovered and rate the impact on the entire experience. Each major finding is listed in detail along with severity ratings indicating the level of impact each issue has on the user’s ability to complete a task. Severity ratings range from Critical, where the ability to complete a task is impaired, to Medium, which may affect brand reputation or the perception of the experience to Low, which are non-impacting or cosmetic issues that do not affect the experience greatly but would be nice to correct.
- Example of how it works for the first attribute: Clear Data Processing Notice -3 == Processing notice is missing a section from the list in 9E.
- This would involve looking for things like ALT and ARIA attributes and anything that isn’t relatively clear on the page.
- Which brings us to the next principle, Clear.
- This can include a lot of things that connect those different POVs from legal to content to development teams: (1) the Me2B Deal Terms(quid pro quo) including data subsidization and monetization; (2) list of information collected (covering volunteered, observed and derived information); and (3) for each item of information, (a) legal basis for collection, (b) purpose for collecting the information including how it's used, (c) all data processors & co-controllers who receive it, and (d) how long the information is retained (by all data controllers and co-processors).
- We also look at Controllable, which is an important aspect of safe and respectful tech. Does the subject give their explicit, intentional permission? Is it discreet or are the consent options all or nothing?
- This talk introduced an IA framework for testing for dark patterns and data privacy compliance. You may have other interests or work in other areas, but this happens to be the world I’m working in now. I’ve also applied IA heuristics in other areas, such as mobile authentication, EHR and patient choice The heuristic analysis is just one toolsThere are many other ia tools - taxonomies, content management/strategy, Search— and many other areas to apply them. Ive applied some of these tools in emergency management and vulnerable population research. I’ve even gone super meta and applied IA thinking to avian taxonomy research at the AMNH. So I’d like to encourage you to view these example of Applied IA in my field and think about how you might apply IA in other fields where you have interests.
- But if you are interested in this work, here are some ways to get involved