Risk Analysis

Talk through risk analysis with the types of data being collect, shared, stored, and analyzed. What are the risks? How do we mitigate them? For the rest of this session, take a privacy-focused perspective.

A few lenses which might help:

Recent history

History predicts the future.

In 1990, the Internet was a pretty safe place. Usenets posts were viewed as ephemeral, since there was no way to find past content. Emails were openly shared, since spam was not yet common. Of course, all those posts are now indexed, and all those emails are now spammed.

Think through data collected and stored now, and how risk profiles might change if:

• Such data is compromised and ends up shared on darknets
• We have new means to correlate such data and to make infrences from it.

Historical perspectives

Think through how data collected under regimes like Nazi Germany and Soviet Republics. Think through how data collected about kids today, if archived, might be used in a few decades.

Past leaks

We have consistently seen released datasets re-identified, sometimes much later, including the AOL dataset, the Netflix challenge, and Massachusetts medical data.

Global perspectives

Think about the recent UN Rohigya data leak. Think about uses (misuses?) of data in China. Think about student targeted by and hiding from militant groups.

What kinds of data protections are needed to keep these students safe?

Corner cases

If an ed-tech system results in a single death, that’s a bad outcome. Think about high-risk individuals, such as:

• Individuals under witness protection / targetted by organized crie
• Individuals with stalkers
• Individuals targeted by state-level institutions (e.g. political asylum-seekers)
• People who might run for office decades later
• Cyberbullying
• Family issues (e.g. a closeted homosexual in a conservative family)
• Students with disabilities

All of these come up in data. Typing patterns, usage timestampes, or vocabulary frequency and grammatical structure form a unique fingerprint which we are increasingly good at identifying.

Your own risks

On your own, think about the worst-case here.