Travis D. Breaux

Carnegie Mellon University

Author Statistics

Papers

Citation

H-Index

i-10 index

Research Trends

Author Order

Document Type

Co-Authors

Annie I. Antón

Georgia Institute of Technology

Mitra Bokaei Hosseini

The University of Texas at San Antonio

Jaspreet Bhatia

Carnegie Mellon University

Jianwei Niu

The University of Texas at San Antonio

Rocky Slavin

The University of Texas at San Antonio

Hanan Hibshi

Carnegie Mellon University

David Gordon

University of Michigan–Ann Arbor

Xiaoyin Wang

East China Normal University

Thomas Norton

Fordham University

Sepideh Ghanavati

University of Maine

Cooperative Institutions

Carnegie Mellon University

The University of Texas at San Antonio

North Carolina State University

University of Trento

University of Toronto

Fordham University

University of Lisbon

Instituto de Engenharia de Sistemas e Computadores Investigação e Desenvolvimento

Lusíada University of Lisbon

University of Michigan–Ann Arbor

Author Statistics

Papers

Citation

H-Index

i-10 index

Research Field

Mobile Application Privacy Risk Assessments from User-authored Scenarios

Zenodo (CERN European Organization for Nuclear Research) (2023)

Tianjian Huang Vaishnavi Kaulagi Mitra Bokaei Hosseini Travis D. Breaux

Mobile applications (apps) provide users valuable benefits at the risk of exposing users to privacy harms. Improving privacy in mobile apps faces several challenges, in particular, that many apps are developed by low resourced software development teams, such as end-user programmers or in startups. In addition, privacy risks are primarily known to users, which can make it difficult for developers to prioritize privacy for sensitive data. In this paper, we introduce a novel, lightweight method that allows app developers to elicit scenarios and privacy risk scores from users directly using only an app screenshot. The technique relies on named entity recognition (NER) to identify information types in user-authored scenarios, which are then fed in real-time to a privacy risk survey that users complete. The best-performing NER model predicts information types with a weighted average precision of 0.70 and recall of 0.72, after post-processing to remove false positives. The model was trained on a labeled 300-scenario corpus, and evaluated in an end-to-end evaluation using an additional 203 scenarios yielding 2,338 user-provided privacy risk scores. Finally, we discuss how developers can use the risk scores to prioritize, select and apply privacy design strategies in
the context of four user-authored scenarios.

10.5281/zenodo.8061495

Cite

Citations (0)

Crowdsourcing privacy policy analysis: Potential, challenges and best practices

it - Information Technology (2016)

Florian Schaub Travis D. Breaux Norman Sadeh

Abstract Privacy policies are supposed to provide transparency about a service's data practices and help consumers make informed choices about which services to entrust with their personal information. In practice, those privacy policies are typically long and complex documents that are largely ignored by consumers. Even for regulators and data protection authorities privacy policies are difficult to assess at scale. Crowdsourcing offers the potential to scale the analysis of privacy policies with microtasks, for instance by assessing how specific data practices are addressed in privacy policies or extracting information about data practices of interest, which can then facilitate further analysis or be provided to users in more effective notice formats. Crowdsourcing the analysis of complex privacy policy documents to non-expert crowdworkers poses particular challenges. We discuss best practices, lessons learned and research challenges for crowdsourcing privacy policy analysis.

Crowdsourcing

Best practice

Privacy software

10.1515/itit-2016-0009

Cite

Citations (10)

Identifying vulnerabilities and critical requirements using criminal court proceedings

Travis D. Breaux Jonathan Lewis Paul N. Otto Annie I. Antón

Information systems governed by laws and regulations are subject to civil and criminal violations. In the United States, these violations are documented in court records, such as complaints, indictments, plea agreements, and verdicts, which thus constitute a source of real-world software vulnerabilities. This paper reports on an exploratory case study to identify legal vulnerabilities and provides guidance to practitioners in the analysis of court documents. As legal violations occur after system deployment, court records reveal vulnerabilities that were likely overlooked during software development. We evaluate established requirements engineering techniques, including sequence and misuse case diagrams and goal models, as applied to criminal court records to identify mitigating requirements that improve privacy protections. These techniques, when properly applied, can help organizations focus their risk-management efforts on emerging legal vulnerabilities. We illustrate our analysis using criminal indictments involving the U.S. Health Insurance Portability and Accountability Act (HIPAA).

Criminal investigation

10.1145/1529282.1529360

Cite

Citations (3)

Ensuring Privacy in Clouds

Travis D. Breaux Siani Pearson

This chapter introduces privacy in relationship to cloud computing architecture. Cloud architecture consists of one or more service offerings that enable data processing over a telecommunications network while the responsibility for the data primarily resides with, or is at least shared with, the cloud consumer. To ensure privacy in the cloud, cloud consumers and providers rely on a combination of contracts and software controls that restrict how personal information is collected, used, retained, transferred and destroyed. Information technology professionals must thus map requirements from privacy laws and standards to their information practices in a transparent and accountable manner. In this chapter, we begin by examining the philosophical foundations of privacy before connecting these broader concerns to specific privacy principles commonly referred to in privacy laws and standards. We then review privacy risks particular to the cloud, before discussing IT best practices for addressing those risks and emerging research in privacy relevant to cloud-based systems.

Privacy software

10.1002/9781118821930.ch21

Cite

Citations (1)

Improving the Specification and Analysis of Privacy Policies: The RSLingo4Privacy Approach

Enterprise Information Systems (2016)

Alberto Rodrigues da Silva João Caramujo Shaghayegh Monfared Pável Calado Travis D. Breaux

Source

Cite

Citations (3)

Towards a framework to measure security expertise in requirements analysis

Hanan Hibshi Travis D. Breaux Maria Riaz Laurie Williams

Research shows that commonly accepted security requirements are not generally applied in practice. Instead of relying on requirements checklists, security experts rely on their expertise and background knowledge to identify security vulnerabilities. To understand the gap between available checklists and practice, we conducted a series of interviews to encode the decision-making process of security experts and novices during security requirements analysis. Participants were asked to analyze two types of artifacts: source code, and network diagrams for vulnerabilities and to apply a requirements checklist to mitigate some of those vulnerabilities. We framed our study using Situation Awareness-a cognitive theory from psychology-to elicit responses that we later analyzed using coding theory and grounded analysis. We report our preliminary results of analyzing two interviews that reveal possible decision-making patterns that could characterize how analysts perceive, comprehend and project future threats which leads them to decide upon requirements and their specifications, in addition, to how experts use assumptions to overcome ambiguity in specifications. Our goal is to build a model that researchers can use to evaluate their security requirements methods against how experts transition through different situation awareness levels in their decision-making process.

Security Awareness

10.1109/espre.2014.6890522

Cite

Citations (5)

Automated Comparisons of Ambiguity in Privacy Policies and the Impact of Regulation

SSRN Electronic Journal (2016)

Joël R. Reidenberg Jaspreet Bhatia Travis D. Breaux Thomas Norton

Website privacy policies often contain ambiguous language that undermines the purpose and value of privacy notices for site users. This paper compares the impact of different regulatory models on the ambiguity of privacy policies in multiple online sectors. First, the paper develops a theory of vague and ambiguous terms. Next, the paper develops a scoring method to compare the relative vagueness of different privacy policies. Then, the theory and scoring are applied using natural language processing to rate a set of policies. The ratings are compared against two benchmarks to show whether government-mandated privacy disclosures result in notices less ambiguous than those emerging from the market. The methodology and technical tools can provide companies with mechanisms to improve drafting, enable regulators to easily identify poor privacy policies and empower regulators to more effectively target enforcement actions.

10.2139/ssrn.2715164

Cite

Citations (10)

Toward Regulatory Compliance: A few-shot Learning Approach to Extract Processing Activities

arXiv (Cornell University) (2024)

K C Pragyan Rambod Ghandiparsi Rocky Slavin Sepideh Ghanavati Travis D. Breaux

The widespread use of mobile applications has driven the growth of the industry, with companies relying heavily on user data for services like targeted advertising and personalized offerings. In this context, privacy regulations such as the General Data Protection Regulation (GDPR) play a crucial role. One of the GDPR requirements is the maintenance of a Record of Processing Activities (RoPA) by companies. RoPA encompasses various details, including the description of data processing activities, their purposes, types of data involved, and other relevant external entities. Small app-developing companies face challenges in meeting such compliance requirements due to resource limitations and tight timelines. To aid these developers and prevent fines, we propose a method to generate segments of RoPA from user-authored usage scenarios using large language models (LLMs). Our method employs few-shot learning with GPT-3.5 Turbo to summarize usage scenarios and generate RoPA segments. We evaluate different factors that can affect few-shot learning performance consistency for our summarization task, including the number of examples in few-shot learning prompts, repetition, and order permutation of examples in the prompts. Our findings highlight the significant influence of the number of examples in prompts on summarization F1 scores, while demonstrating negligible variability in F1 scores across multiple prompt repetitions. Our prompts achieve successful summarization of processing activities with an average 70% ROUGE-L F1 score. Finally, we discuss avenues for improving results through manual evaluation of the generated summaries.

10.48550/arxiv.2407.09592

Cite

Citations (0)

Toward benchmarks to assess advancement in legal requirements modeling

Ivan Jureta Travis D. Breaux Alberto Siena David Gordon

As software engineers create and evolve information systems to support business practices, these engineers need to address constraints imposed by laws, regulations and policies that govern those business practices. Requirements modeling can be used to extract important legal constraints from laws, and decide how, and evaluate if an information system design complies to applicable laws. To advance research on evaluating requirements modeling formalisms for the representation of legal information, we propose several benchmarks that we believe represent important challenges in modeling laws and requirements governing information systems, and evaluating the compliance of these requirements with laws. While incomplete, the proposed set of benchmarks covers a range of challenges in modeling laws and requirements that we observed in privacy and security law: from the possibility to trace model fragments to law fragments, to the ability to distinguish modalities in law, and to model relations between requirements and law fragments, needed when evaluating compliance. Benchmarks can be used as a checklist when designing and discussing requirements formalisms that support legal requirements modeling. Each benchmark is motivated by related work, a brief legal excerpt, and our experience in modeling regulations.

10.1109/relaw.2013.6671343

Cite

Citations (7)

Early Studies in Acquiring Evidentiary, Reusable Business Process Models for Legal Compliance

Travis D. Breaux Calvin Powers

Government laws and regulations impose legal requirements on information practices in healthcare and finance. These requirements govern the use and disclosure of information across organizations and their business practices. To comply with the law, organizations must demonstrate that they have verifiable procedures in-place to implement these requirements. This paper surveys our experiences acquiring business process models expressed in the business process model notation (BPMN) using a systematic method. The method requires business process owners to classify regulatory statements using a legal ontology to identify legal requirements. The itemized requirements can then be used to specify elements in a business process model to demonstrate due diligence under the law. The contributions of this paper include lessons learned while acquiring the model with attention to traceability, distinguishing between legally expressed and implied activities and implementing legally imposed deadlines and suspensions. We discuss the lessons learned with examples from the U.S. Health Insurance Portability and Accountability Act (HIPAA).

Due diligence

Traceability

10.1109/itng.2009.72

Cite

Citations (7)