Surveillance: Selective revelation
Problem Statement: Given person-specific data captured from the daily lives of people, develop a method for sharing data for surveillance purposes while providing provable assurances of privacy protection.
Description: An architectural solution is Selective Revelation. A surveillance system receives person-specific data on a sliding scale of identifiability. The level of anonymity matches scientific and evidentiary need (a). During normal operation, surveillance is conducted on sufficiently anonymous data that is provably useful. When sufficient and necessary scientific evidence merits, the system drills down providing increasingly more identifiable data (b). This is a computational model of the "probable cause predicate" performed in American jurisprudence. The role of human judges, who make decisions as to whether information will be shared with law-enforcement, are replaced with technology that makes these decisions for broader surveillance purposes. The system was demonstrated on a real-world bioterrorism surveillance system [cite] and was instrumental in launching the notion of privacy-preserving surveillance.
Scientific Influence and Impact: Selective-revelation was part of congressional and media discussions regarding surveillance of Americans through secondary uses of data they leave behind. Robert Popp, then Deputy Director at DARPA for the Total Information Awareness Project (TIA), described it in response to privacy concerns. In January 2003, Senator Feingold introduced legislation to place a moratorium on data mining research and deployment efforts at DARPA. Senator Wyden introduced a similar anti-data mining bill, but limited to TIA. Public interest groups wanted action, and Congress responded, but in doing so, data mining research was spared what could have been a horrible blow to computer science funding beyond TIA.
Other Achievements: 12