Philip Schütz
email: philip.schuetz@isi.fraunhofer.de

Assessing formal independence of data protection authorities in a comparative perspective

Data protection authorities (DPAs) represent one of the key actors, not only when it comes to the execution of privacy and data protection policies, but also in terms of awareness raising, consultancy and networking. Since they comprise the spearhead of regulators in the field of privacy and data protection regulation, their independence from the private as well as political domain becomes of the utmost importance. However, independence turns out to be a multifaceted concept. That is why this contribution discusses ways of assessing DPAs' independence, drawing on research about independent regulatory agencies (IRAs). Three country case studies are finally presented.

Introduction

Embedded in a dissertation project that is dedicated to a comparative analysis of data protection authorities (DPAs), 1 this paper aims to shed light on a central feature of DPAs, namely their independence. Since there is little systematic and long-term research on DPAs from a political science perspective, the theoretical foundations of and methodological approaches to independent regulatory agencies (IRAs) can help to serve as a template model providing a framework for the analysis of DPAs.

IRAs represent a crucial instrument of the regulatory state, which is characterized by ongoing deregulation, increased delegation and reregulation processes [START_REF] Majone | The rise of the regulatory state in Europe[END_REF][START_REF] Majone | Regulating Europe[END_REF][START_REF] Majone | From the positive to the regulatory state: Causes and consequences of changes in the mode of governance[END_REF]. They comprise a relatively new attempt to cope with societal challenges that elude traditional models of governance. The EU Data Protection Directive makes use of this instrument, stipulating mandatory supervisory authorities, which have to fulfil a variety of different functions. DPAs are not only expected to serve as ombudsmen, auditors, consultants, educators, policy advisers and negotiators, but they should also be able to enforce changes in behaviour, when private or public actors violate data protection legislation [4, p. 135].

Most importantly, as opposed to most IRAs, DPAs are not only tasked with the supervision of private entities, such as companies in various business sectors, but they are also expected to watch over public authorities, i.e. executive, legislative and judicial institutions and bodies. 2 Despite the traditional checks and balances in a democratic and constitutional state, the monitoring of governmental bodies by an authority closely linked to the government is particularly new in the theoretical framework of the regulatory state and IRAs. Since "[w]e are not normally accustomed to think of government as 'regulating' itself" [5, pp. 3], the setting up of DPAs by political actors in order to exercise control over the same presents an interesting and new aspect in the theory of regulation. Thus, the concept of independence in this context seems to require special attention.

As a final remark, the author wants to emphasize that this work displays the starting point of the above mentioned dissertation project. The text should therefore be considered as exploratory and tentative, reflecting new ideas to examine the role of DPAs in society.

2 The concept of the regulatory state and independent regulatory agencies Whereas strategies of stabilization and consolidation, which included centralised administration, state ownership and planning, mainly shaped the political programs of the 50s and 60s in most West European countries, privatisation and deregulation dominated the policies in the 70s and 80s, strongly influenced by the American model [1, p. 77]. Today's regulatory state represents, in many ways, a mélange between the dirigiste and the neoliberal state of the preceding decades. On the one hand the state continued, throughout the 90s, to retreat from sectors which were once publicly owned. On the other hand, the state "reregulates the now-liberalized markets [and sectors] with less intrusive instruments" [6, p. 873]. Rather than direct state intervention, reregulation ideally implies the idea of improving "the efficiency of the economy by correcting specific forms of market failure such as monopoly, imperfect information, and negative externalities" [1, p. 79]. Yet, imposing rules on highly dynamic and innovative sectors has turned out to be highly problematic and extremely difficult.

Eventually, the evolution of the regulatory state in Europe was closely linked to the growing importance of the European Union. Since the EU neither represents a federal state nor a confederation but rather made it necessary to redefine the term "union" as a new form of federation sui generis, based on the idea of a multilevel governance [START_REF] Hooghe | Multi-level governance and European integration[END_REF], EU legislation was designed to be regulatory rather than redistributive [8, p. 39].

However, whether or not the EU can thus be considered a regulatory state remains a controversial debate; also because it is highly contested as to which political level is actually responsible for most of the regulations, as well as the most important ones [START_REF] Eberlein | Beyond delegation: transnational regulatory regimes and the EU regulatory state[END_REF].

A distinguishing attribute of the regulatory state is reflected in the concept of delegation, which, contrary to privatisation, describes the transfer of authority and responsibility from the state to another private or public organisation without being completely exempt from accountability. Delegation of sector specific regulation assignments to IRAs is an essential and prevalent tool of the regulatory state. Yet, the historical origins of IRAs in Europe date back to the early postwar years, when Britain and Germany introduced independent competition authorities [START_REF] Wilks | The unanticipated consequences of creating independent competition agencies[END_REF]. Even prior to that, IRAs in the United States had become an integral part of the governmental agency landscape, typically operating outside the federal executive departments. Today, the model of independent central banks, which has been rapidly spreading throughout Europe and the rest of the world, is considered as one of the main archetypes of IRAs [11, p. 267].

IRAs can be defined as "a body with its own powers and responsibilities given under public law, which is organizationally separated from ministries and is neither directly elected nor managed by elected officials." [12, p. 956] As the name already suggests, independence from governmental influence plays an essential role in the conception of IRAs.

Yet, it seems surprising that the state is willing to accept a loss or at least a reduction of control and power in certain regulatory sectors. Gilardi identifies several reasons for this transfer of competencies to IRAs [13, pp. 102]. One of the most important causes involves the objective of governments to reduce their decision-making costs by e.g. taking advantage of IRAs' specialised expertise in the relevant field of regulation. "Faith in the power of expertise as an engine of social improvement -technical expertise which neither legislators, courts nor bureaucratic generalists presumably possess -has always been an important source of legitimisation for regulators." [3, p. 152] Moreover, due to their independence IRAs are not only more flexible in adjusting regulations to changing conditions, but they also work more effectively and efficiently, presenting better regulatory outputs than traditional bureaucracies. They tend additionally to organise their decision-making processes in a more open and transparent way and eventually policy makers are able to profit from shifting blame to IRAs when regulation fails to succeed.

However, the most convincing argument as to why governments delegate power to IRAs is offered by the credibility hypothesis. Since "politicians have few incentives to develop policies whose success, if at all, will come after the next election [...], it is difficult for political executives to credibly commit themselves to a long-term strategy." [3, p. 153] Being exempt from elections and the associated political short-term thinking, IRAs are able to fill this credibility vacuum. They can provide a certain time consistency in their policies leading to a more "stable and predictable regulatory environment" [13, p. 102]. Fearing rapid changes in popular support, governments have, after all, an interest in preserving their policy achievements through IRAs, in order to prevent future parties in power from altering them too easily.

Independence of IRAs

Even though the concept of IRAs' independence seems to be rather straight forward, it is in fact highly complex, implying different nuances and dimensions. In order to exemplify the challenges in trying to assess the independence of IRAs, two empirical studies are briefly discussed.

Though being confronted with operationalisation and quantification problems, Gilardi has developed an independence index concentrating on formal, i.e. legally stipulated, independence [START_REF] Gilardi | Policy credibility and delegation to independent regulatory agencies: A comparative empirical analysis[END_REF]. The comparative analysis embraces 33 IRAs from five different regulatory sectors in seven European countries. Originally developed by Cukierman et al. in a comprehensive study focused on measuring the independence of central banks [START_REF] Cukierman | Measuring the independence of central banks and its effect on policy outcomes[END_REF], the index involves five groups of indicators: The agency's head status, the management board members' status, the general frame of the relationships with the government and the parliament, financial and organizational autonomy, and the extent of delegated regulatory competencies [6, pp. 880]. Whereas the first two groups comprise indicators such as the term of office as well as procedures of appointment and dismissal of the agency's head/board members, the other three contain, inter alia, accountability arrangements towards the government and parliament, sources of the agency's budget and the degree of exclusive regulatory power by the agency. In order to avoid subjective valuation, he attributes the same weight to each of his 21 indicators. 3Although Gilardi succeeds in providing a systematic overview of variables that supposedly affect the autonomy of IRAs, the index has several shortcomings such as equating breadth of powers with degree of independence as well as the absence of provisions prohibiting an action with the permissibility of that action [15, pp.5]. Most importantly, the analysis ignores sources of influence beyond legal provisions. These informal aspects, however, are decisive in determining the de facto independence of IRAs [START_REF] Maggetti | De facto independence after delegation: A fuzzy-set analysis[END_REF]. Thus, it is crucial to bear in mind that "some regulators can be independent in practice without being independent on paper." [17, p. 2] Thatcher, in contrast, includes variables that reflect informal sources of influence into his comparative study of 23 IRAs from eight different sectors in four countries. 4 He not only examines politicization of regulators, but also expands his analysis to possible dependencies on regulatees from the private sector, operationalised by the percentage of IRA members formerly or subsequently active in regulated business and industry (revolving doors). Moreover, the influence of IRAs on decision-making processes is scrutinised. Thatcher concludes: "Having created IRAs, governments do not use their most visible formal powers to control them, with the exception of limiting IRA's resources (and the partial exception of politicization in Italy)." [12, p. 966] Nonetheless, sharp conflicts are frequently carried out between IRAs and the private sector, including legal action. IRAs, eventually, appear to be separated from business by and large, meaning that the revolving door phenomenon occurs rather seldom except in Great Britain.

Despite taking a broader range of variables into account, Thatcher's analysis raises the question of whether quantitative methods alone are capable of assessing a multifaceted concept such as independence in its full complexity. Quantifying independence, particularly in the form of an index, is vulnerable to oversimplification, most notably in the process of operationalisation. Besides, there is the risk of failing to consider less tangible variables that are decisive in determining de facto independence. In order to enhance the significance of research on IRAs' independence, the integration of qualitative research tools would be expedient.

However, both of the studies not only identify, discuss and systematise factors influencing formal independence, they also pave the way for further research drawing attention to the importance and complexity of IRAs' independence. Seemingly simple questions such as "Who is independent (the agency or single officials)?" and "Independence from whom (public or private actors)?" turn out to be difficult to answer.

In this context, the relationship between de jure and de facto independence deserves further attention. As opposed to what one might assume, the logical link between the two is apparently subject to scientific debate. Whereas Maggetti and Gilardi, in later studies, find out that "formal independence is neither a necessary nor a sufficient condition for regulators' de facto independence from political decision-makers and from the regulated industries" [START_REF] Maggetti | De facto independence after delegation: A fuzzy-set analysis[END_REF][17, p. 1], Hanretty, Hayo and Voigt's research suggests a high degree of correlation [START_REF] Hanretty | Explaining the de facto independence of public broadcasters[END_REF][START_REF] Hayo | Explaining de facto judicial independence[END_REF].

Although the role of IRAs, and later DPAs, can not be sufficiently understood by restricting the analysis only to their formal independence, legal provisions represent a good starting point, enabling political scientists to compare expectations and reality.

The EU Data Protection Directive and the role of DPAs

Directive 95/46/EC represents the most comprehensive and influential legislative framework regarding the protection of personal data. From the start of the Directive's development it became clear that "data protection had ceased to be merely a human rights issue; it was also intrinsically linked to the operation of international trade [4, p. 93].

Aiming to create a more homogenous legal and economic sphere to guarantee the free flow of data across European borders, the Directive, which took over five years of tough negotiations from first draft to adoption, was therefore mainly developed in the Internal Market portfolio of the EU Commission [20, p. 91]. Furthermore, the economic argument not only helped to persuade stakeholders of the Directive's benefits, but also provided a legal basis, namely Article 100a of the EC Treaty, which seeks, inter alia, "to ensure the establishment and functioning of the Internal Market".

Since then, the Directive has not only facilitated the transborder flow of personal data within the EU, but has also contributed to higher minimum standards of data protection in quite a few Member States. Due to the fact that EU directives are supposed to be binding, each Member State has, at least formally, implemented comprehensive data protection provisions. Although these provisions have not been able to keep pace with the technological developments and new emerging threats to privacy, the Directive, which is currently under revision, still constitutes one of the most advanced legal frameworks in the field of data protection worldwide.

The European Data Protection Directive also stipulates the mandatory set up of data protection authorities, the so-called supervisory authorities [21, art. 28]. This has mainly been done to harmonise the responsibilities of DPAs, which were quite different in data protection provisions of the Member States developed prior to the EU Directive. Sweden, for example, relied on a licensing model, whereas the French government chose a more selective approach and Germany provided for subsequent monitoring as well as recommendations rather than binding decisions [22, pp. 134].

As mentioned earlier, one of the most distinctive features of DPAs is eventually their assignment to watch over private as well as public actors. This is contrary to the work of most IRAs, monitoring (financial) markets or the utilities sector. Here, DPAs comprise an interesting aspect, namely the idea of an authority that was created by the state in order to control the same. Hood et al. deal with this new facet of regulation, identifying huge deficits in the actual transposition of the concept [5, p. 223]. Hence, the issue of independence especially from governmental influence requires extra attention. 5

Independence of DPAs

Although the majority of IRAs face similar conflicts concerning their continuous struggle for independence, DPAs are particularly under threat of being held in check by public authorities. Since the state not only delegates power to DPAs, but could additionally be subject to harsh criticism and potentially strict regulations itself, public actors have an increased interest in manipulating the output and outcome of DPAs' actions. Maybe that is why the Directive has specifically stated that DPAs "shall act with complete independence in exercising the functions entrusted to them" [21, art. 28, para. 1]. 6 Nonetheless, the legal and political reality in EU countries shows that extremely diverse interpretations of the term "complete independence" are prevalent. Even though the goals stipulated in the Directive are supposed to be binding, Member States are granted some latitude in working out the details of the finally implemented national legislation [START_REF] Simitis | From the market to the polis: The EU Directive on the protection of personal data[END_REF]. That is why the legal set up and status of DPAs varies from country to country or in a federal state like Germany even from Land to Land. These legal details, however, can determine what kind of powers and tasks are delegated as well as whether or not DPAs are able to work independently and hence effectively. 7

Case selection

In the following section Germany, Poland and Sweden have been chosen to serve as an example to demonstrate how much room for interpretation of the term "complete independence" sometimes remains.

Aiming at a comparative analysis of DPAs in EU Member States, the thesis comprises a so-called most similar systems design. Yet, European countries differ, sometimes immensely, in their national policy styles, deriving from their distinct historical 5 Dealing with formal independence features, this work will mainly neglect the relationships between private businesses and DPAs, which are usually of a rather informal nature. 6 Even though "complete independence" is the term used in the EU Directive, there is no institution, organisation or individual who can claim to be complete independent. However, the wording refers to the increased relevance the European Union put into the autonomous status of DPAs. 7 Despite initial leaning towards transposing and applying Gilardi's independence index to the analysis of DPAs, the author has refrained from attributing a numerical value to the formal independence status of DPAs due to the early stage of research and insufficient robustness of such an index.

experiences and culture. Assuming that these policy styles have an influence on the set up of DPAs, it seems expedient to choose a rather heterogeneous sample. Here, Castles' classification of Western democracies into families of nations offers an approach to start from [START_REF] Castles | Families of nations: Patterns of public policy in Western democracies[END_REF].

He identifies an Anglo-Saxon, Scandinavian, Continental and South European country group, which are each characterised by distinctive policy traditions [START_REF] Castles | Comparative public policy: Patterns of post-war transformation[END_REF]. 8 Thus, the sample should include four EU Member States, one out of each country group. Since the EU enlargement after the Cold War has changed the composition significantly, East European countries should be considered as a separate country group as well.

That is why DPAs of Great Britain, Sweden, Germany, Spain and Poland have been selected as case studies within the dissertation project. Due to the early stage of the empirical analysis, this paper will only discuss three cases, of which Germany represents the most elaborated and assessed one.

The German case

In Germany, where DPAs have a long tradition at the national (since 1978) as well as regional levels (in Hesse since 1970), independence has always been an essential element of data protection institutions [START_REF]Hessian Data Protection Act[END_REF]. Supporting this point, German DPAs even served as a role model in the process of developing the EU Data Protection Directive.

Lately, however, the governmental interpretation of independence in Germany has come under closer scrutiny. Because Germany is a federal state, regulatory powers were given to the national DPA, i.e. the Federal Commissioner for Data Protection and Freedom of Information (FfDF) as well as to his regional equivalents on the Länder level. 9Over the years, a differentiation process has been taking place between the two levels. Today, the FfDF is responsible for data protection issues concerning federal public institutions and their policies, whereas DPAs of the Länder monitor the public sector on the regional level as well as, most remarkably, non-public bodies, inter alia private enterprises, within their territory.

Consequently, some Länder governments launched specific governmental agencies, which were put in charge of supervising non-public corporations in regards to their compliance with data protection law. The close ties between the government and the regulating agencies especially, caused the EU Commission as well as the European Data Protection Supervisor (EDPS) to file a suit against the Federal Republic of Germany for infringement of the "complete independence" principle.

In March 2010 the European Court of Justice (ECJ) ruled that Germany "failed to fulfil its obligations under the second subparagraph of Article 28(1) of Directive 95/46/EC", i.e. the assurance of "complete independence" [START_REF]C%252C%252C%252C%252C% 252C%252C%252Ctrue%252Cfalse%252Cfalse&num=C[END_REF]. And indeed, the ECJ confirmed that some governments of the German Länder had appointed specific "authorities [to be] responsible for monitoring the processing of personal data by nonpublic bodies and undertakings governed by public law which compete on the market (öffentlich-rechtliche Wettbewerbsunternehmen)" [27, para. 56].

Furthermore, the court devoted much attention to the clarification of the meaning of "complete independence". The ECJ stated "that a supervising authority must be free from any influence, whether that influence is exercised by other authorities or outside the administration. The fact that these DPAs are subject to State scrutiny in Germany constitutes an infringement of that requirement." [27, para. 15] Apparently, some Länder governments had a narrower interpretation of "complete independence" in mind, proposing the concept of "functional independence" in the sense that DPAs must be primarily independent of regulatees from the private sector [27, para. 16].

And despite the judicial decision of the ECJ, also the independence of Germany's FfDF seems jeopardised, since there is a significant number of gateways and possibilities of governmental influence.

The Federal Commissioner in Germany represents not only the head of the national DPA but also the DPA as an institution itself. Though being civil servants, DPA officials are actually working directly for him/her. While the FfDF's basic number of staff amounts to 90 [28, p. 1055], the annual budget, which is a part of the Federal Government Budget and therefore determined by both chambers of the legislature, totals around 8.8 million Euros [29, pp.36].

Although being elected by the German Bundestag following an amendment to the Federal Data Protection Act in 1990, the Commissioner is, in fact, appointed at the suggestion of the Federal Government [28, p. 1053] [30, sec. 22, para. 1]. Moreover, he/she can only be dismissed due to a charge of serious misdemeanour equivalent to that which would justify the dismissal of a judge with tenure [30, sec. 23, para. 1].

Most remarkably however, the FfDF is organizationally attached to the Federal Ministry of the Interior, which has several problematic consequences to it. Even though the commissioner remains, in general, independent from any instructions or orders (functional supervision) by the government, which is specifically stipulated in the national data protection act [30, sec. 22, para. 4], he/she is exposed to the administrative supervision by the ministry.

According to Dammann, a legal scholar and former top official working for the FfDF, the administrative supervision could not only offer ways to seriously hamper DPA's work, but also result in a so-called "anticipatory obedience" by the commissioner [28, p.1057]. Dammann, furthermore, points to the fact that the national DPA is actually a way station for civil servants of the Ministry of the Interior, where they will normally continue their career later on [28, p.1058]. This is highly problematic in terms of the staffs' de facto commitment, orientation and willingness-to-comply.

Additionally, the FfDF is not in a position to decide on his/her personnel policy independently [30, sec. 22, para. 5, cl. 5], since the ministry has a say in it, as well. In cases of a promotion or "voluntary" transfer of an employee, the authority even lies exclusively with the ministry [28, pp.1057]. Finally, the commissioner is subject to legal supervision by the government [30, sec. 22, para. 4, cl. 3], which constitutes another potential source of governmental influence. All of this is particularly critical, since the Ministry of the Interior is traditionally in charge of often privacy-invasive national security policies, comprising a classical field with the need of privacy regulations by the FfDF.

The Polish DPA

Poland does not have a long history in data protection legislation. The Act on the Protection of Personal Data is relatively new and came into force in 1997, seven years prior to the accession to the European Union, with important amendments in 2002 and 2004 [START_REF]Act on the Protection on Personal Data[END_REF]. Since Poland is, unlike Germany, a unitary state, the Inspector General for Personal Data Protection represents the key regulatory authority. An office, the so-called Bureau, which has a budget of 13.7 million zloty, approximately 3.3m Euros, assists his work [START_REF]Budget of the Bureau of the Inspector General for personal data protection 2009[END_REF]. The Inspector General (IG) is, moreover, elected and can only be dismissed by the Polish Diet with the concent of the Senate [31, art. 8, para. 2/8].

Although independence is not specifically stated in the data protection legislation, the Polish DPA has far-reaching discretion in influential domains such as personnel policy and budget control. Contrary to the non-existent formal independence in personnel policy decisions of the German FfDF, the Polish IG is "vested with the powers and obligations as an employer in relation to the people employed in the Bureau." [33, art. 2, para. 2, cl. 2]10 That way, on the one hand, any kind of financial control over the staff of the IG by the government is being avoided. On the other hand, not being civil servants, employees of the Polish DPA might suffer from lower quality social security and pension schemes.

Within the annual Budget Act the parliament provides the Bureau with financial resources which are then managed and controlled by an independent Chief Accountant within the DPA [34, art. 9]. The presentation of an annual report to the parliament about the DPA's activities, "including conclusions with respect to observance of the provisions on personal data protection" [31, art. 20], underpins the special ties of the IG to the parliament.

All in all, the Polish DPA appears to be formally independent from governmental influence mainly due to the absence of a ministry that supervises his/her actions. Contrary to initial assumptions, the relative newness of and little experience with data protection legislation in Poland has not had a negative effect on the formal independence of the DPA. Also relevant is, of course, the country's communist past, which will be taken into further consideration within the thesis.

The Swedish Data Inspection Board

Sweden was the first country that not only institutionally dealt with the political topic of data protection in setting up a Royal Commission on Publicity and Secrecy in 1969, but also developed the first national data protection legislation worldwide in 1973 [35, p. 59/63].

Since then, the Swedish Data Inspection Board (DIB) has represented the central national regulatory body in the field of data protection. In 2007, however, the Commission on Security and Integrity Protection was established as an additional sectoral supervisory authority, being assigned to monitor the compliance with data protection legislation of law enforcement agencies [START_REF]Act on supervision of certain crime-fighting activities[END_REF]. Despite the activities of the Commission, even the government itself is able to issue regulations e.g. for exemptions to prohibitions regarding the transfer of personal data to third countries or notification of certain types of data [37, sec. 35/36]. This is why the DIB seems to lack exclusive regulatory power in the field of data protection.

Headed by the Director General (DG), the DIB employs 40 people [38, p. 5] and allocates 37 million SEK [START_REF]Government Decision for the Budget 2011 of the Data Inspection Board[END_REF], round about 4m Euros, annually. Whereas DPAs in Germany and Poland clearly orientate themselves towards the commissioner model, Sweden follows the commission model, in which the head of the DPA does not represent the institution itself [START_REF] Stewart | A comparative survey of data protection authorities -Part 1: Form and structure[END_REF].

Nonetheless, the DG plays a significant role in the agenda-setting and policy-making processes of the authority. That is why it is astonishing that he/she is not only appointed but also directly employed by the government [START_REF]Swedish Statute Book -Governments regualtions[END_REF], which, of course, implies varied and significant leverage in cases of the government's disagreement with decisions of the DIB. However, dismissal procedures can only be initiated due to serious neglect of duties towards the employer [42]. In practice, a specific board consisting of five members, of which the chair and vice chair shall be lawyers and have experience as court judges, decide upon the actual dismissal of the DG [START_REF]Response to an information request, Data Inspection Board[END_REF].

According to Flaherty, one of the most significant sources of governmental influence in the past involved the Minister of Justice's capability to "wield [influence] in negotiations over the DIB's budget with the Minister of Finance" [44, p. 114]. 11 This still seems to be the case since the DIB is financed through allocations from the State budget, which are based on a so-called regeringsbeslut determined by the Ministry of Justice [START_REF]Government Decision for the Budget 2011 of the Data Inspection Board[END_REF].

The strong ties between the Ministry and the DIB also make autonomous personnel policy decisions more difficult, although, officially, the Swedish DPA is supposed to employ its own staff [46, para. 9] [47] [41, para. 25].Furthermore, there are a variety of accountability relationships towards the Ministry, such as the obligation to ensure efficiency, which could be used to exercise control over the DIB [41, para. 3/28/29].

However, most importantly, neither the discussed procedural provisions concerning the appointment, term of office and dismissal of the DG, nor the financial and personnel policy issues are part of the Personal Data Act. Most of it can be found in specific ordinances which, contrary to acts, may be changed at will by the government.

Summing up, it does not appear to be appropriate to use the attribute "formally independent" in relation to the Swedish DPA. The provisions of the researched legal documents do not even get close to the "complete independence" requirement of the EU Data Protection Directive and its interpretation of the ECJ. However, what this 11 That way, even a new self-financing model of the DIB was introduced in an amendment of 1982, which was aimed at cost recovery through licensing fees [44, p. 114]. However, the license and permit system was abolished when the Swedish Data Act was replaced by the Personal Data Act in 1998 [45, p. 7/26].

finding means to the de facto independence of the Swedish DPA is not yet clarified and will be subject to further research.

Conclusion

This paper presents an exploratory perspective on DPAs in the EU, drawing on theories of regulation such as the concept of the regulatory state and IRAs. Since there is no clear framework for a political science analysis of DPAs, theoretical and methodological approaches to IRAs have proven to be useful in identifying, assessing and systematically comparing central features of DPAs such as their independence.

For example, Gilardi and Thatcher have demonstrated interesting ideas as to how to measure independence using quantitative methods. Whereas Gilardi set up an independence index that aims to measure the formal independence of IRAs from governmental actors, Thatcher expands his analysis to include informal sources of influence such as politicization and revolving doors. Despite the shortcomings of the approaches, both researchers help to identify key determinants of formal and de facto independence.

Independence of DPAs is particularly threatened, since privacy regulators face two fronts of regulatees, i.e. business and political actors. Although the EU Data Protection Directive specifically stipulates that DPAs shall act with "complete independence", Member States are given a certain degree of latitude in transposing the provisions into national legislation. That is why this paper examines the legally stipulated independence status of DPAs in three EU Member States, each state representing a particular tradition of policy-making within the European Union.

We can conclude that Germany, Poland and Sweden are taking advantage of the possibility to flexibly apply the "complete independence" requirement of the Directive. However, there are huge differences to the degree to which the notion of independence is (over-) strechted in national data protection legislations. Whereas the Polish DPA seems to fulfil most formal independence requirements, the FfDF in Germany and particularly the DIB in Sweden clearly lack the same.

Most importantly, the traditionally close link between DPAs and certain ministries in Sweden and Germany appears to have resulted in a rather one-dimensional accountability relationship with the government. At the same time, accountability and control are often confused, as the "functional independence" approach, presented during the discussed ECJ trial by German representatives, obviously demonstrates.

Thus, not only the exclusive right to nominate and appoint the head of the DPA, but also the opportunity to veto against personnel policy decisions lies with the government. While this is the case in Germany and Sweden, the Polish DPA has no attachment whatsoever to any ministry or governmental agency. Being appointed by and only accountable to both chambers of parliament, the Polish Inspector General has far-reaching discretion in managerial and financial domains within the authority. As the German data protection commissioner, the Inspector General is financed by a parliamentary act; unlike in Sweden, where the DIB has to rely on the Ministry of Justice's negotiations with the treasury.

All in all, there is significant variation in the legally stipulated form of governmental influence on DPAs. Even though these findings do not necessarily mean that DPAs lacking formal independence are not independent in practice, research on IRAs suggests that causal and statistical linkages between de jure and de facto independence exist. In order to corroborate or falsify the findings on the formal independence of DPAs, the collection of primary data with regards to their de facto independence is absolutely essential. That is why interviews with DPA officials will represent a central part of further research within the mentioned dissertation project.

Data protection authority refers in the following text to the term of supervisory authority, stipulated in the Directive 95/46/EC, art.

[21]. This contribution solely deals with DPAs on the national level, although the regional and international, particularly the EU level, would be interesting to look at as well.

Of course, there are additionally numerous data protection commissioners and officers in private companies and governmental organisations working together with DPAs on the international, national and regional level. However, they will not be part of the analysis in this paper.

As an example, the indicator "term of office" (of the agency's head) can have six different parameters: "Over 8 years", "6 to 8 years", "5 years", "4 years", "fixed term under

years or at the discretion of the appointer", and eventually "no fixed term". Each parameter is assigned a value evenly spread between 1 (= complete independence) and 0 (= no independence). Since there are six parameters, the assigned values are accordingly: 1, 0.8, 0.6, 0.4, 0.2, 0. Here, the basic assumption is that the longer the term of office lasts, the more independent the agency's head becomes.[START_REF] Bennett | The Governance of Privacy: Policy Instruments in Global Perspective[END_REF] His analysis is based on five groups of indicators: Party politicization of regulators, departures of IRA members before the end of their term, official tenure of IRA members, financial and staffing resources as well as the use of powers by elected politicians to overturn IRA decisions[12, p. 959].

The categorisation is mainly based on differences in the division of labour between the state and the market resulting in different regulation cultures, traditions and strategies. Although Castles' families of nations have not yet been applied to the policy field of data protection and DPAs, the concept seems to be promising with regard to delivering a rather heterogeneous set of country samples.

Although specific DPAs of the Länder will be scrutinised more thoroughly within the dissertation project, this paper will not deal with the regional level in more detail.

The statute that stipulates the principles of organisation and functioning of the Bureau is, however, granted by a regulation (ordinance) of the President of the Republic of Poland[31, art. 13, para. 3].


Julio Angulo
email: julio.angulo@kau.se

Erik Wästlund
email: erik.wastlund@kau.se

Exploring Touch-screen Biometrics for User Identification on Smart Phones

Keywords: Mobile user experience, biometrics, smart mobile devices, mobile identity management, mobile authentication, privacy, lock patterns

The use of mobile smart devices for storing sensitive information and accessing online services is increasing. At the same time, methods for authenticating users into their devices and online services that are not only secure, but also privacy and user-friendly are needed. In this paper, we present our initial explorations of the use of lock pattern dynamics as a secure and user-friendly two-factor authentication method. We developed an application for the Android mobile platform to collect data on the way individuals draw lock patterns on a touchscreen. Using a Random Forest machine learning classifier this method achieves an average Equal Error Rate (EER) of approximately 10.39%, meaning that lock patterns biometrics can be used for identifying users towards their device, but could also pose a threat to privacy if the users' biometric information is handled outside their control.

Introduction

Smart mobile devices have become essential tools in many people's daily lives. Not only are we using these devices as the means to communicate with others, as sources of entertainment and as ways of expressing ourselves, but we also use them to store sensitive personal information and access different online services. Despite all the information contained in a device and the transactions that can be performed with it, many users choose not to protect their devices [START_REF] Clarke | Authentication of users on mobile telephones -a survey of attitudes and practices[END_REF], and at the same time they tend to be perpetually logged into some of the services provided by mobile third party applications. Thus, an attack on the mobile device, or the loss of it, can have negative consequences, such as the intrusion of privacy, the opportunity to impersonate users, and even severe financial loss.

Currently, most of the solutions for authenticating users into their devices and other mobile services are based on the same solutions offered when using desktop computers, which usually involve the use of a PIN, a strong password, or some sort of extra external security token device. These techniques become cumbersome when applied to mobile devices and do not always provide a satisfactory user experience. Besides, they are not a sustainable approach for the future of mobile interactions, in which people would carry only one secure trustable device to perform most of their tasks and would preferably use only one hand to operate such device [START_REF] Karlson | Understanding Single-Handed Mobile Device Interaction[END_REF].

Fig. 1. An Android lock pattern

As a proposed solution to these issues we are investigating how screen lock patterns can be enhanced with the use of biometric features. By lock patterns we refer to the option contained in the Android mobile platform 1 for locking the phone's screen (Figure 1). Lock patterns are one type of recall-based graphical password [START_REF] Biddle | Graphical passwords: Learning from the first twelve years[END_REF]. They have been criticized because of their vulnerabilities to smudge attacks (i.e., recognizing the fingers' grease on the screen) [START_REF] Aviv | Smudge attacks on smartphone touch screens[END_REF], shoulder-surfing attacks [START_REF] Wiedenbeck | Design and evaluation of a shoulder-surfing resistant graphical password scheme[END_REF] (i.e., observing or recording with a video camera the moment of authentication), and others. We hypothesize that adding biometric analysis to lock patterns can enhance the security of this type of graphical passwords by becoming a two-factor authentication mechanism. This method would also be privacyfriendly if used to protect the users' sensitive information stored locally, since the users' biometric features would be kept securely inside the device and under the users' control. However, if used for remote authentication, it could pose a threat to the anonymity of users.

In this paper we first present in Section 2 work related to the study of graphical passwords and biometrics methods employed in modern mobile devices. Section 3 presents the identified requirements and research questions. Section 4 describes our experimental approach and collection of data. Section 6 describes the implications of our results and other reflections. Finally, Section 7 presents our plans for future investigations and conclusions. thus their experiment does not portray real mobile situations neither does it consider typing PIN codes on touch-screens. To the best of our knowledge, only one of the mentioned studies, [START_REF] Zahid | Keystroke-based user identification on smart phones[END_REF], partially considers the use of on-screen keyboards. The approach taken in this study, however, has the disadvantage that the system has to be trained with a minimum of 250 keystrokes in order to achieve a low Equal Error Rate of approximately 2%, which is not suitable for applications that do not require a lot of typing, neither for detecting short passwords or PIN intrusions. From the literature, it is still uncertain that enhancing 4-digit PIN inputs with biometrics on touch-screens would provide higher levels of security for protecting sensitive information stored on mobile devices.

At the same time, imposing the use of alphanumeric passwords on mobile devices creates the problem that users tend to choose simpler, weaker or repetitive passwords [START_REF] Nauman | TOKEN: Trustable Keystroke-Based Authentication for Web-Based Applications on Smartphones[END_REF], since complicated strong passwords are harder to type on smaller on-screen keyboards. Therefore, suggestions for more unobtrusive methods for authentication on mobile smart phones have emerged as an alternative to typed passwords, such as gait biometrics (achieving an EER of 20.1%) [START_REF] Derawi | Unobtrusive user-authentication on mobile phones using biometric gait recognition[END_REF] [26], or the unique movement users perform when answering or placing a phone call (EER being between 4.5% and 9.5%) [START_REF] Conti | Mind how you answer me!: transparently authenticating the user of a smartphone when answering or placing a call[END_REF]. Although these methods seem to be a promising approach towards enhancing the user experience, they require users to take the explicit actions of walking or answering phone calls in order to be effective. Therefore, they are not fully suitable for scenarios when a user needs to interact or look at the phone in order to login to a mobile application or online service. Besides, these methods only provide a one-factor authentication mechanism.

Researchers have also suggested the use of graphical passwords as an easier alternative to written passwords, based on the idea that people have a better ability to recall images than texts. A good overview of popular graphical password schemes has been reported in [START_REF] Biddle | Graphical passwords: Learning from the first twelve years[END_REF]. Different usability studies have outlined the advantages of graphical passwords, such as their reasonable login and creation times, acceptable error rates, good general perception and reduced interference compared to text passwords, but also their vulnerabilities [START_REF] Van Oorschot | Purely automated attacks on passpoints-style graphical passwords[END_REF] [START_REF] Salehi-Abari | On purely automated attacks and click-based graphical passwords[END_REF]. As mentioned earlier, lock patterns are one type of recall-based graphical password [START_REF] Biddle | Graphical passwords: Learning from the first twelve years[END_REF]. To the best of our knowledge, the enhancement of lock patterns with biometric information has not been explored so far.

Regarding issues to users' anonymity, a recent study has demonstrated that pseudonyms chosen by users at different websites can be linked to deduce their real identity [START_REF] Perito | How unique and traceable are usernames?[END_REF]. This probability of linking and profiling users could increase if users' pseudonyms can be identified based on their lock pattern behavior when authenticating into different services. Yet another study has shown that users' identities can be reconstructed from their typing patterns while browsing online [START_REF] Chairunnanda | Privacy: Gone with the Typing! Identifying Web Users by Their Typing Pattern[END_REF]. In our paper, we consider if similar issues can arise when employing the biometrics of lock patterns for authentication.

The initial motivation for our research arose from the need to provide secure and unobtrusive methods for authenticating users of mobile devices. We chose to explore the use of lock patterns for authentication since it has the benefits of not involving additional physical gadgets (such as secure external digital tokens) and not demanding the users' attention for a long period of time, but at the same time making users aware of their momentary intent. Also, lock patterns are less prone to repetitive errors compared to typing strong passwords on a touch-screen, and allow users to login while on the move in a more seamless manner. Besides the usability advantages, enhancing lock patterns with biometrics would improve this method's security by becoming a two-factor authentication method.

Although 4-digit PIN codes, which are currently the most common way of granting access to information stored on the device, provide similar benefits in terms of usability, it seems unlikely that their security could be enhanced with keystroke dynamics analyses on touch-screen devices, given that the size of a PIN code is too small and that previous studies have shown that large training sets are required to achieve good performances on touch-screens [START_REF] Zahid | Keystroke-based user identification on smart phones[END_REF]. Furthermore, other studies have shown that it is more difficult for users to remember different PINs over extended periods of time than graphical passwords [START_REF] Moncur | Pictures at the ATM: exploring the usability of multiple graphical passwords[END_REF].

Our idea of using lock patterns biometrics for authentication raised the following research questions:

1. Do lock patterns provide a set of distinguishing features that are unique to each individual? Is it possible to verify the identity of individuals by the way they draw a pattern on the screen? 2. What are the privacy challenges that need to be considered when using this authentication method? If users can be uniquely identified by the biometrics of lock patterns, what are the privacy issues to be tackled before this method can be used in practice?

Experimental setup

Using Google's platform for mobile devices, Android [START_REF]Google: Android: Android -open source project[END_REF], we have developed a mobile application to collect data from different individuals on the way they draw lock patterns, their experience while doing so and other contextual factors.

To find the answer to our first research question, test participants were asked to draw three different lock patterns correctly a certain number of times (n=50 trials for each pattern), with each pattern consisting of six dots, as shown in Figure 2. More specifically, during a test session test participants were first shown an animation on how to draw the first lock pattern (see Figure 2(a)), once they had learnt it they were asked to draw that pattern correctly 50 times. They were then shown the second pattern (Figure 2(b)) and were also asked to draw it 50 times, and the same was done for the third pattern (Figure 2(c)). A static approach was used in which all participants drew the same three patterns, i.e., the input was identical for all tests [START_REF] Clarke | Authenticating mobile phone users using keystroke analysis[END_REF]. Analogous to earlier keystroke studies (in which different distinguishing features are used, such as key holding time and digraphs [START_REF] Zahid | Keystroke-based user identification on smart phones[END_REF]), two main features were captured for each successful trial: the finger-in-dot time, which is the time in milliseconds from the moment the participant's finger touches a dot to the moment the finger is dragged outside the dot area, and the finger-in-between-dots time, representing the speed at which the finger moves from one dot to the next. All erroneous trials were disregarded.

Data collection and analysis

A total of 32 different participants completed the test successfully using the mobile application. This is comparable to the amount of test participants used in similar studies (e.g., [START_REF] Clarke | Authenticating mobile phone users using keystroke analysis[END_REF], [START_REF] Conti | Mind how you answer me!: transparently authenticating the user of a smartphone when answering or placing a call[END_REF], [START_REF] Zahid | Keystroke-based user identification on smart phones[END_REF], [START_REF] Zhang | Analyzing Key-Click Patterns of PIN Input for Recognizing VoIP Users[END_REF]). Participants were 12 women and 20 men, coming from different age groups (from 19 to 56 years old), cultural and educational backgrounds, and having different levels of experience interacting with touch-screen smart phones. The tests were performed with different Android phones: Samsung Galaxy SII [START_REF] Kekre | Ageing adaptation for multimodal biometrics using adaptive feature set update algorithm[END_REF], Nexus S (8), HTC Legend (4) and HTC Vision [START_REF] Biddle | Graphical passwords: Learning from the first twelve years[END_REF]. The data collected on the participants' finger movement times were used to calculate the common standard metrics used to assess biometric systems, the False Acceptance Rate (FAR) which indicates the probability that the system will erroneously grant access to an intruder, and the False Rejection Rate (FRR) which is the probability that the system will wrongly deny access to a legitimate user. The point at which both FAR and FFR are equal is denoted the Equal Error Rate (ERR). The EER makes it easier to compare the performance of various biometric systems or classifiers, and the lower its value the better the classifier. The Random Forest classifier, for instance, has been previously used to analyze the keystroke dynamics of users entering PIN codes on computer keyboards [22] [34]. Since the lock patterns presented here are composed of a 3x3 grid, which resembles the layout of a keypad, we trusted this algorithm to provide us with a good estimate for ERR. The Random Forest has the advantage of being useful for clustering and detecting outliers, as well as being robust against noise and having a fast learning process for large datasets. We used the implementation of the Random Forest algorithm from the R package v4.6-2 [START_REF] Breiman | Random forests[END_REF]. In order to compare performance, we present the results from other five classifiers previously used in keystroke analysis studies, also obtained with the R statistical program (v2.13.1). The Supportive Vector Machine (SVM) and Recursive Partitioning (RPart) classifiers are used in [START_REF] Zhang | Analyzing Key-Click Patterns of PIN Input for Recognizing VoIP Users[END_REF], whereas the Manhattan, the Nearest Neighbor (Mahalanobis) and Eucledian detectors are provided in [START_REF] Killourhy | Why did my detector do that?!: Predicting keystrokedynamics error rates[END_REF] and [START_REF] Killourhy | Comparing anomaly-detection algorithms for keystroke dynamics[END_REF] 3 . We refer the reader to the corresponding publications for detailed explanations of these different algorithms.

From the collected data, we were left with six finger-in-dot variables and five finger-in-between-dots variables for each trial, making a total of eleven variables to feed the classifiers. As mentioned earlier, participants were asked to draw each of the three patterns, shown in Figures 2(a), 2(b) and 2(c), 50 times, leaving us with 150 trials in total. During our initial analysis of the data we decided to disregard the first 10 trials out of the 50, since we considered that each participant used those initial trials for their own practice (i.e., human learning trials). Then, with no further analysis of the data, we selected the next 25 trials for training the classifiers (i.e., machine learning or training trials) and the remaining 15 trials were used for testing (i.e., testing trials). Table 1 shows the obtained mean EER with their corresponding standard deviations for all six classifiers. As expected, the Random Forest classifier provided the best result, giving an average EER of 10.39% with a standard deviation of 3.0%. More in-depth analysis of the data showed that there is a negative linear tendency between the number of training trials and the EER value obtained using the Random Forest classifier. Also, we observed that disregarding more of the initial trials (as human trials) up to a certain amount (25 trials) results in a better EER value (8.87%); indicating that the more comfortable or experienced users become when drawing a pattern, the better chances of correctly identifying them. Table 2 shows the EER values obtained using the Random Forest classifier when using different configurations for a varying number of trials, such as increasing the number of training trials while keeping the testing trials constant, or keeping the number of training trials constant while increasing the human trials and decreasing the testing trials. The highlighted row on the table indicates the initial selected configuration, which is the configuration we have chosen to present in this paper. This configuration was selected since it represents a balanced number of trials that gives a relatively good EER estimate. Choosing a greater number of training trials would have an impact on usability, while decreasing it would result in a greater EER value.

Fig. 3. Fitted ROC curve

Figure 3 shows the fitted Receiver Operating Characteristic (ROC) curve for all participants using the above mentioned configuration. This curve "allows the evaluation of different machine learning algorithms by measuring the rate of false positives and true positives against a varying threshold level" [START_REF] Nauman | Using trusted computing for privacy preserving keystroke-based authentication in smartphones[END_REF]. The ROC curve in this case provides us with the formula y = x (0.051±0.002) , from where we can infer that having a FAR of 5% would give us a probability of correctly admitting a legitimate user (a True Acceptance Rate or TAR) between 85.32% and 86.35% (y = 0.05 (0.051±0.002) ). Therefore the value for FRR (F RR = 100% -T AR) lies between 13.65% and 14.68%. Table 3 shows some other possible obtained values of FRR given predetermined values of FAR with the use of the ROC curve formula. This depicts the clear tradeoff between the usability (FRR) and the security (FAR) of the system. Note that the values presented in Table 1, Table 2, and Table 3 are based on a binary classification of one subject drawing all of the three different patterns and for all 11 variables. However, analyzing each lock pattern separately the values shown in Table 4 are obtained. In order to investigate if there is any systematic difference between the Equal Error Rates obtained from three patterns, a repeated measure ANOVA was run. The results show that there is no significant main effect for the three patterns, F (2, 62) = 0.021 (ρ = 0.979). To exclude the possibility of this result being a Type II Error, a Power Analysis was performed with the use of R statistical software, which showed that, for a medium sized effect (f = 0.25) and sample of n = 96 (3 patterns for each 32 participants), the obtained power is .96 to find a significant effect at the σ = .05 level. In other words, the results show that individual error seems to be consistent over the tree patterns used in the study, implying that users can be identified regardless of the pattern they draw.

Implications and discussions

The following sections present some of the security, privacy and usability implications of the results obtained by our experiments as well as other related discussions.

Improving the security of biometrically enhanced lock patterns. The results above suggest that lock pattern biometrics have the potential to be employed as an authentication method and that individuals can be identified by the way they draw a lock pattern on a touch-screen. We consider this result to be a good beginning on the exploration of touch-screen dynamics given that the moderately low EER (10.39%) was obtained without applying any other analytical enhancements to the data (such as handling outliers, differentiating distances between dots, optimizing the human learning effect, grouping data by device, etc.).

Applying dynamic optimizers to the data set could be a way to greatly improve the obtained EER value. For example, when looking at keystroke biometrics on mobile devices, the work presented in [START_REF] Zahid | Keystroke-based user identification on smart phones[END_REF] initially reports an EER value greater than 26.5% using a RBFN (Radial Basis Function Neural network) classifier [START_REF] Hwang | An efficient method to construct a radial basis function neural network classifier[END_REF]. However, using fuzzy classifiers the researchers were able to lower the EER value to around 18.6%. Then they applied a hybrid version of the Particle Swarm Optimizer (PSO) [START_REF] Kennedy | Particle swarm optimization[END_REF] and Genetic Algorithm (GA) [START_REF] Goldberg | Genetic Algorithms in Search, Optimization and Machine Learning[END_REF] to further lower their claimed EER value to less than 2.07%. We believe that applying similar optimizers to our data could similarly reduce our obtained EER value.

Moreover, the security of the lock pattern method is very dependent on the number of available pattern combinations. As it is currently implemented, the Android lock pattern mechanism consist of a 3x3 grid, not allowing repetition of dots and always including dots that lie in-between two other dots. However, since our data shows that users can be identified regardless of the pattern they draw on the screen, the existing lock pattern mechanism could be improved by removing the imposed constrains and considering a bigger grid, thus increasing the password space.

As part of our future work, we are also planning to explore if the security of such a system could be improved by measuring the pressure of the users' fingers on the touch-screen and the tilting angle in which a user holds a device, which can be used as additional biometric features to feed the machine learning classifiers.

Two-and three-factor authentication method. Note that the obtained EER (10.39%) was calculated on the assumption that an imposter already knows the user's secret pattern, thus working as a one-factor authentication. However, supposing that the pattern is only known to the legitimate user, the chances for an imposter to successfully authenticate into the system are further reduced. For example, given that there are 16,032 combinations of six-dotted patterns in the current implementation of the Android lock patterns, let the probability of an imposter entering the correct lock pattern on the first attempt to be Pr(P atternGuessing) = 1/16, 032 = 0.00006. Similarly, let the probability of the lock pattern biometric system to authenticate an imposter that knows the legitimate lock pattern, which is given by the value of the False Acceptance Rate (FAR), be Pr(F AR) = 0.05. Thus, the probability of these two mutually independent events happening is given by Pr(P atternGuessing ∩ F AR) = (0.00006) * (0.05) = 0.000003

In other words, this solution provides a two-factor authentication in which the probability that an attacker with an unknown pattern would be let into a system enhanced with biometrics is about 0.0003%, thus providing a much more secure solution than one-factor 4-digit and 5-digit PIN codes (0.01% and 0.001%). This probability can be further adjusted depending on the level of security required by a system.

What is more, this method could even provide three-factor authentication assuming that the mobile device has in place a Trusted Execution Environment (TEE) -or Mobile Trusted Module (MTM) -as described in [START_REF]Mobile trusted module 2.0 -Use cases[END_REF] and considered in [START_REF] Ekberg | Trust in a small package: minimized MRTM software implementation for mobile secure environments[END_REF], [START_REF] Ekberg | Mobile trusted computing based on MTM[END_REF] and [START_REF] Nauman | Using trusted computing for privacy preserving keystroke-based authentication in smartphones[END_REF]. Such TEE would basically guarantee that the reported state of a mobile device can be trusted by shielding dedicated pieces of its engine, thus providing one more level of security.

Therefore, the three security factors would be something the user has (a trusted mobile device), something the user knows (a secret lock pattern) and something the user is (the user's lock patterns biometrics). A three-factor authentication method could greatly reduce the chances of successful smudge attacks, shoulder-surfing and other common attacks.

Impact of training trials on performance.

As with all biometric systems a number of training trials have to be input in order to accurately detect the identity of an individual. In the case of lock pattern biometrics, our analyses of the data presented in Table 2 shows that a set of 25 training trials tested against 15 testing trials provide a reasonably good EER value (10.39%). This implies that, if used in practice, a user would have to draw a pattern (or number of different patterns) 25 times on average for the system to achieve this level of efficiency, which has a possible impact on the usability of such system. However, this problem is solved by letting the user train the classifier with a reasonable amount of trials at the beginning (5 training trials gives an EER of 14.81%, as shown in the last row of Table 2) and use every subsequent authentication attempt that results in a successful login as an extra training trial. After having a robust set of training trials, an aging factor, as considered in [START_REF] Kekre | Ageing adaptation for multimodal biometrics using adaptive feature set update algorithm[END_REF], can also be introduced in which the oldest trials are weighted less and every new successful authentication attempt is taken as a new training trial. Thus the system would be adapting to the constant changes of the users and their environment.

Also, since our results show that users can be identified regardless of the way they drag their finger around the screen, the users' general interaction with the mobile device while dragging their finger can presumably be used to increase the original training set. However, this might have an impact on the processing power of the device.

Privacy friendliness. Now that we know that the security of lock patterns can be enhanced with biometrics, this mechanism can be employed for a number of security and privacy enhancing purposes, such as granting users access to some sensitive parts of a mobile application (e.g., a mobile banking application with different layers of security), authenticating users towards their locally stored sensitive private information, authorizing the use of encryption keys and (anonymous) credentials stored on the device, and so on.

In particular, this method could improve the way users give consent when, for example, engaging in online banking or mobile e-commerce transactions. Under these scenarios lock pattern biometrics could not only be employed to authenticate users towards their device, but also when the user is required to sign a transaction. Further explorations, such as the ones carried out as part of the U-PrIM project 4 , are needed on incorporating the use of lock pattern biometrics with user-friendly mobile interfaces that make users aware of the actions they are taking depending on the context of a transaction.

Privacy unfriendliness.

The findings presented here also raise some privacy concerns when interacting with touch-screen mobile devices, which bring us to our second research question, "what are the privacy challenges that need to be considered when using this authentication method? " For one, third party applications could already be taking advantage of the fact that there is some degree of uniqueness in the way users drag their fingers across a touch-screen, thus being able to profile users and collect information as long as they are connected to a network and keep interacting with the application installed on their device. All of this happening in the application's background, without the users' awareness or consent.

Also, as mentioned previously, using this method to authenticate to remote online services could compromise the biometrics and privacy of users with a number of known attacks. Related to the work reported in [START_REF] Chairunnanda | Privacy: Gone with the Typing! Identifying Web Users by Their Typing Pattern[END_REF], our results imply that, regardless of the users' choices of patterns for authenticating to different service providers, attackers would have a bigger probability to uncover the identity of pseudonymous users based on the biometrics of their secret lock patterns drawn at different websites, assuming that a website can get a hold of users' biometric data. Therefore, using lock patterns as a remote authentication method could result in linkability attacks and user profiling even when using different pseudonyms and patterns as passwords at different services' sites. Nevertheless, architectures have been proposed for authenticating smart phone users to remote web services in a privacy-friendly manner with the use of the previously mentioned Trusted Executing Environment (TEE) [24] [25]. This approach is also being considered within the U-PrIM project, where the existence of such TEE running on the mobile device is assumed, keeping the biometrics data secured under the users' control.

What is more alarming is the fact that common web browsers installed on mobile devices, such as Android's Browser, Apple's Safari, Firefox and others, allow the monitoring of users' swiping gestures directly on the web browser by running JavaScript code with the inherited touch and gestures events5 (such as touchstart, touchmove, touchend, etc., as specified in [START_REF] Brubeck | Touch events version 1 -w3c working draft 13 september 2011[END_REF] and [START_REF]Safary Developer Library: Handling events[END_REF]). Although these events allow users to browse the Internet in a more user-friendly manner by dragging their finger around to pan a webpage or elements contained within a webpage, this implies that, by implementing these events, any common website could track the swiping movements of the users' fingers and collect the users' biometrics while they browse the Internet. However, this privacy threat can probably be diminished by using additional biometric features, such as the above mentioned pressure and orientation factors.

Conclusions and future work

The work presented here is our initial step towards finding user-friendlier methods for authentication into mobile smart devices. Our results show that adding biometric information to lock patterns can enhance the security of this method by providing two-factor authentication towards the smart device. A relatively low EER of 10.39% was achieved by analyzing the data from 32 individuals using a Random Forest classifier when combining the three different lock patterns and without any analytical enhancements to the data. This implies that users could be identified at this rate regardless of the pattern they draw. The levels of security and usability required by a system using lock pattern biometrics can be adjusted by varying the values of FFR and FAR over a threshold. Using this method, however, also raises some privacy issues that must be addressed before touch-screen dynamics can be used for authenticating remotely towards the services' sides. However, using a Trusted Executing Environment (also referred to as a Mobile Trusted Environment [START_REF]Mobile trusted module 2.0 -Use cases[END_REF]) implemented in the device that protects users' biometric data, many of the privacy issues are reduced.

Our plans for future work include the application of other machine learning classifiers and analytical enhancements to get a better EER. Also, we would like to expand this study to include aditional biometric features, such as pressure and the tilting angle of the hand as the user draws a lock pattern. Work is also planned for exploring the contexts in which the mobile authentication takes place, since we believe that different contextual factors can have a great influence on the way lock patterns are drawn, and identifying these factors can improve the recognition of a legitimate user. Therefore, we plan to collect situational data that can give us an idea of the effect that context could have on the mobile authentication user experience.

Fig. 2 .

 2 Fig. 2. The three lock patterns that participants were asked to draw

Table 1 .

 1 Obtained mean Equal Error Rates and standard deviations

		Eucledian Manhattan Mahalanobis RPart	SVM RandomForest
	Mean EER	0.2734767	0.2559011	0.2302509 0.2968256 0.1406362	0.1039453
	Standard deviation	0.098	0.094	0.097	0.096	0.057	0.03

Table 2 .

 2 EER obtained by different configuration of the number of trials

				EER (RandomForest)
	Human trials Training trials Testing trials	Mean	Std dev
	10	10	30	0.168590	0.062
	10	15	25	0.148422	0.056
	10	20	20	0.123632	0.037
	10	25	15	0.103945	0.030
	10	30	10	0.093223	0.032
	10	35	5	0.079075	0.040
	10	39	1	0.052462	0.069
	10	10	10	0.137028	0.065
	10	15	10	0.130543	0.065
	10	20	10	0.115598	0.053
	10	25	10	0.099589	0.033
	10	30	10	0.092505	0.032
	15	20	15	0.106840	0.033
	20	20	10	0.096232	0.039
	25	20	5	0.088665	0.043
	5	20	5	0.165284	0.075
	5	20	10	0.161635	0.062
	5	20	15	0.155483	0.060
	5	20	20	0.152889	0.056
	5	20	25	0.145395	0.054
	0	5	1	0.148098	0.113

Table 3 .

 3 Calculated FFRs by given FARs using the formula y = x (0.051±0.002)

	FAR (x)	TAR (y)	FRR (1.00 -y)
	0.05	[0.8532, 0.8635] [0.1365, 0.1468]
	0.10	[0.8851, 0.8933] [0.1067, 0.1149]
	0.15	[0.9043, 0.9112] [0.0888, 0.0957]
	0.20	[0.9182, 0.9242] [0.0758, 0.0818]
	0.25	[0.9292, 0.9343] [0.0657, 0.0708]
	0.30	[0.9382, 0.9427] [0.0573, 0.0618]

Table 4 .

 4 Mean Equal Error Rates and standard deviations for each lock pattern

	Lock		Eucledian Manhattan Mahalanobis RPart	SVM RandomForest
	pattern
	First	Mean EER	0.220685	0.198577	0.22637 0.303662 0.131384	0.099484
		Std dev	0.111	0.106	0.136	0.134	0.091	0.061
	Second	Mean EER	0.236102	0.210807	0.225255 0.343344 0.115054	0.100343
		Std dev	0.110	0.100	0.130	0.132	0.065	0.051
	Third	Mean EER	0.199664	0.179404	0.185995 0.290088 0.125538	0.102358
		Std dev	0.094	0.085	0.105	0.128	0.076	0.062

Related workResearch has been done in exploring different biometric approaches for providing an extra level of security for authenticating users into their mobile devices. Specifically, research done on the analysis of keystroke dynamics for identifying users as they type on a mobile phone can be found in[START_REF] Clarke | Authenticating mobile phone users using keystroke analysis[END_REF],[START_REF] Clarke | Flexible and transparent user authentication for mobile devices[END_REF],[START_REF] Karatzouni | Keystroke analysis for thumb-based keyboards on mobile devices[END_REF],[START_REF] Nauman | TOKEN: Trustable Keystroke-Based Authentication for Web-Based Applications on Smartphones[END_REF],[START_REF] Zahid | Keystroke-based user identification on smart phones[END_REF] and others. One of these studies,[START_REF] Clarke | Authenticating mobile phone users using keystroke analysis[END_REF], considers the dynamics of typed 4-digit PIN codes, in which the researchers achieved an average Equal Error Rate (ERR) 2 of 8.5%. However, the data for this experiment was collected using a "mobile phone handset (Nokia 5110), interfaced to a PC through the keyboard connection "[START_REF] Clarke | Authenticating mobile phone users using keystroke analysis[END_REF],1 http://developer.android.com/index.html[START_REF] Biddle | Graphical passwords: Learning from the first twelve years[END_REF] The Equal Error Rate (EER) is a measurement used to compare different biometric systems, and is explained more in detail in Section 5

A script for the R platform is provided by Carnegie Mellon University, available at http://www.cs.cmu.edu/ ∼ keystroke (Accessed 2011-07-25)

U-PrIM (Usable Privacy-enhancing Identity Management for smart applications) http://www.kau.se/en/computer-science/research/research-projects/u-prim

An example of the touch and drag events for Firefox on Android devices can be found at http://www.quirksmode.org/m/tests/drag.html (Accessed: 2011-10-27)

Acknowledgments

This work is partly funded by the Swedish Knowledge Foundation (KK-stiftelsen) as part of the U-PrIM research project. We would like to acknowledge the kind help of Ge Zhang for providing us with the scripts for classifying our data. Also, our thanks go to Simone Fischer-Hübner and to the anonymous reviewers of the IFIP Summer School 2011 for their useful comments and advise.