Yannis C Stamatiou
email: stamatiu@ceid.upatras.gr

Privacy Respecting ICT Innovations in Education: Electronic Course Evaluations in Higher Education and Beyond

des établissements d'enseignement et de recherche français ou étrangers, des laboratoires publics ou privés.

Introduction

The widespread use of personalized services, i.e. services that ask for personal information about users and then process this information or tailor themselves according to users' characteristics has increased, considerably, over the past few years. Such services are, most often, e-Commerce services that address individuals' needs for products based on their buying history as well as the personal information that they voluntarily provide in web forms. Beyond e-Commerce, social media applications, where revealing personal (even sensitive) information is exactly what they all are about, are gaining increasing popularity, especially among young people.

As a consequence, personalized services, along with their corresponding security and privacy issues, have attracted much attention from researchers in the ICT security domain. Numerous research and survey papers have appeared over the last few years studying various aspects of privacy and privacy preserving authentication mechanisms (see, especially, the publications and work programme of the Digital Enlightenment Forum). The discussed aspects include the design of privacy preserving authentication cryptographic primitives, methodologies for verifying, formally, security properties of systems, legislation related to privacy and personal information handling by services as well as the development of new, attractive services whose behavior is determined by personal information items provided by users. Two seminal works (among other similar ones) that, in our opinion, provide an excellent, condensed perspective on the Personal Data Ecosystem and its facets are [START_REF] Cavoukian | Privacy by Design and the Emerging Personal Data Ecosystem[END_REF] and [START_REF] Hildebrandt | The Dawn of a Critical Transparency Right for the Profiling Era. Digital Enlightenment Yearbook[END_REF]. Ann Cavoukian in [START_REF] Cavoukian | Privacy by Design and the Emerging Personal Data Ecosystem[END_REF] stresses the role of the individual in handling own personal information and builds the framework for empowering people to handle their own electronic identities in the Web. In [START_REF] Hildebrandt | The Dawn of a Critical Transparency Right for the Profiling Era. Digital Enlightenment Yearbook[END_REF] Mireille Hildebrandt considers the role of the (digital) environment of the individuals in profiling their habits and actions in order to offer them better personalized services and adjust itself according to their needs. The author discusses the privacy issues arising from this profiling as well as the pros and cons. On the lower level of the PDE, that of cryptographic primitives on which one may build the services and functionalities as described in [START_REF] Cavoukian | Privacy by Design and the Emerging Personal Data Ecosystem[END_REF][START_REF] Hildebrandt | The Dawn of a Critical Transparency Right for the Profiling Era. Digital Enlightenment Yearbook[END_REF], Florian Kerschbaum in [START_REF] Kerschbaum | Privacy-Preserving Computation[END_REF] discusses the main cryptographic tools that need to be considered for future privacy preserving and secure Web services.

Privacy Attribute-Based Credentials or Privacy-ABCs, which are described briefly in Section 3, is a technology that enables privacy preserving, partial authentication of users. Privacy-ABCs are issued just like normal electronic credentials from a PKI using a secret signature key owned by the credential issuer. However, the distinguishing feature of this technology is that the user can transform his/her credentials into a special presentation token that reveals only the personal information which is required by the service policy and nothing else. The verification of this token is performed with the issuer's public key. The ABC4Trust project aims at eliminating the gap between theory and practice in Privacy-ABCs technologies in order to pave the way towards their deployment in applications requiring partial user authentication. In particular, the project's two main goals are the following: (i) to propose an architectural framework for Privacy-ABC technologies that allows their co-existence and interchangeability, and (ii) to provide a reference implementation of those ABC components for potential adopters who wish to incorporate them into their own systems and services. One of the key features of the project is the provision for two pilots, as proofs of concept for Privacy-ABCs: one pilot that involves pupils of a primary school in Sweden and one pilot than involves students of a University in Greece.

In Section 4 we will present, in some detail, the key elements of the pilot, after giving a brief profile of our institute in 2, and will discuss how it served the ABC4Trust project's goals. However, our paper is not limited to only this discussion. Our aim is to present our plans about future extensions of the pilot scenarios and system in order to support safe and privacy preserving services in the educational community in Greece, through the Greek School Network that CTI operates and controls, which we describe in 5. Then, taking as a starting point our experiences from running the pilot with a focus on maximizing acceptance of Privacy-ABCs among the pilot participants and beyond, we make an attempt towards generalization: we propose in 6 a generic strategy for introducing Privacy ABCs as well as similar innovation to large user targets by implementing, in a step-wise manner, pilots that involve increasingly larger number of users and provides increasingly complex services. We believe that his innovation diffusion strategy may be more effective and efficient in convincing potential users of the usefulness and privacy properties of a service than an abrupt, maybe even by law-enforcement, attempt to introduce the service within large and unrelated user groups right from the start, as it was attempted before by other innovations such as eVoting, with the well-known negative consequences for the innovations. Finally, we conclude in Section 7 with a summary of our findings and pointers to issues for further investigation.

The Computer Technology Institute and Press -"Diophantus"

The Computer Technology Institute and Press-"Diophantus" is a research and technology organization focusing on research and development in Information and Communication Technologies (ICT). Particular emphasis is placed on education, by developing and deploying conventional and digital media in education and lifelong learning; publishing printed and electronic educational materials; administrating and managing the Greek School Network; and supporting the organization and operation of the electronic infrastructure of the Greek Ministry of Education, Lifelong Learning and Religious Affairs and all educational units. Since its establishment in 1985, and in the past decades of rapid technological development, CTI has actively contributed to many of the advances that today are taken for granted. The Information Society Sectors are the organization's conveying mechanisms of know-how, in turn supporting the Hellenic State's devolvement into the Information Society. CTI is, today, in the strong position of combining two important elements which are of great importance in realizing the proposed pilot activities: (i) it administers the Greek School Network, and (ii) it participates in a prominent European project, called ABC4Trust, whose aim is to provide a technical and legal framework for privacy preserving, eIdentity management. The Greek School Network (GSN) is the educational intranet of the Greek Ministry of Education, Life Long Learning and Religious Affairs (abbreviated MoE) that interconnects all schools and a large number of educational administrative units and organizations. It is the biggest public network in the country, having the largest number of users, and has been recognized internationally as a remarkable educational network that promotes the introduction and exploitation of Information and Communication Technologies (ICT) in the Greek educational system. Because of its sensitive educational character and the need to protect pupils while accessing the Internet, GSN needs to adopt strong, privacy preserving authentication mechanisms for its users as well as enhance its services towards the educational community based on these mechanisms.

Basic concepts of Privacy-ABCs

Commonly used user authentication methods (e.g. PKI-based) that are employed today for controlling access to Internet services most often fall short, with regard to respecting users' privacy. In general this situation arises in services in which only a subset of a user's full identity profile is necessary to allow access to a service. Such services range from accessing online libraries, where there is no need to give full identity profile to access books but only a proof that you are subscribed to the library, to online borrowing of movies, where you may have to prove that you are of appropriate age (e.g. older than 18) in order to watch particular films. In such types of applications there is, clearly, a need for a partial, and not complete, revelation of the user's identity. Privacy Attribute-Based Credentials or Privacy-ABCs, for short, is a technology that enables privacy preserving, partial authentication of users. Privacy-ABCs are issued just like normal electronic credentials (e.g. those based on currently employed PKIs) using a secret signature key owned by the credential issuer. However, and this is a key feature of this technology, the user is in position to transform the credentials into a new form, called presentation token, that reveals only the information about him which is really necessary in order to access a service. This new token can be verified with the issuer's public key.

Research has resulted in a number of different proposals of how to realize anonymous credentials [START_REF] Brands | Rethinking Public Key Infrastructures and Digital Certificates: Building in Privacy[END_REF][START_REF] Camenisch | Efficient non-transferable anonymous multi-show credential system with optional anonymity revocation[END_REF][START_REF] Camenisch | Signature Schemes and Anonymous Credentials from Bilinear Maps[END_REF] which are based on different number-theoretic problems and also differ somewhat in the functionality that they offer. There are two leading anonymous credentials systems: Idemix (see, e.g., [START_REF] Camenisch | Protecting (Anonymous) Credentials with the Trusted Computing Group's TPM V1.2[END_REF][START_REF] Camenisch | Design and Implementation of the Idemix Anonymous Credential System[END_REF][START_REF] Camenisch | Efficient attributes for anonymous credentials[END_REF]) of IBM and U-prove of Microsoft (see, e.g., [START_REF] Brands | A Practical System for Globally Revoking the Unlinkable Pseudonyms of Unknown Users[END_REF]). These two systems provide nearly the same functionality, using different cryptographic primitives. With regard to Idemix, it relies, mostly, on the hardness of the strong RSA problem while Uprove relies, mostly, on the difficulty of discrete logarithms. Also, credentials are represented in different formats. The ABC4Trust project is an attempt to unify these two credential formats into one, focusing on interoperability and operation efficiency. Some of the outcomes of this project may be found in [START_REF] Bjones | Integrating Anonymous Credentials with eIDs for Privacy-respecting Online Authentication[END_REF] (reference architecture and implementation) and [START_REF] Liagkou | Privacy preserving course evaluations in Greek higher education institutes: an e-Participation case study with the empowerment of Attribute Based Credentials[END_REF] (the University pilot system and scenarios).

The course evaluation pilot within the ABC4Trust project

The purpose of the course evaluation pilot was to demonstrate some of the basic functionalities of Privacy-ABCs, to prove their applicability in a real-life scenario and to provide early feedback to the project.

According to the scenarios what where defined within the context of the ABC4Trust project, a number of volunteer students attending a class of the Computer Engineering and Informatics Department of the University of Patras had, first, to collect on the smart cards that were given to them credentials in the form of Privacy-ABCs. These credentials were capable of proving, anonymously, that they are indeed students of the University of Patras and that they were registered to the course under evaluation. In some sense, the students obtained a certificate, but one whose presentation does not reveal identifying information, that could prove their studentship as well as enrollment in the course that will be evaluated in the end of the semester.

During the semester, the students attended the course lectures normally. The additional element (as dictated by the pilot scenarios) was that upon entering the lecture room, they received one attendance credit or certificate of their attendance at that day. This unit was recorded, securely, in their smart cards.

In the end of the semester, they had to anonymously evaluate the course using an online, Privacy-ABCs based, course evaluation system. The entities that were involved in the first round of the pilot and their corresponding ABC roles were the following: (i) University Registration System (ABC Issuer & Verifier), (ii) Class Attendance System (No ABC role), (iii) Course Evaluation System (ABC Verifier), and (iv) Students (ABC User).

The students accessed the University Registration System in order to obtain their credentials, proving their studentship and their registration to the course. The Class Attendance System is the system operated in the lecture room through which the students obtained attendance credits on their smart cards. The Course Evaluation System was the system which the students used in order to evaluate, anonymously, the course they had attended. Also, the students had to install an ABC User Client (User Service + GUI) on their computers in order to be able to interact with the pilot system components. As soon as the pilot started, we provided the students with an envelope containing a properly initialized smart card and the card's PIN and PUK values. We also gave to each of them a contact smart card reader and a slip of paper containing a one-time-password for the initial logging in the University Registration System. The first step for the students was to log in the University Registration System using their matriculation numbers as usernames and their one-time passwords. Then, they were able to register their smart cards so that the University System could link their smart cards with the students' information residing in the system database. After a student had registered his smart card, he was able to obtain the University and Course credentials from the University Registration System. The University credential proves the studentship of the participants and includes, as attributes, his first and last names, the name of the University (Patras University), the Department name (Computer Engineering & Informatics Department) and finally his matriculation number. The Course credential proves that the student is registered to the course under evaluation. In order to be able to evaluate the course in the end of the semester, the students had to collect a minimum amount of attendance credits at the lecture room during the semester. This was accomplished through their interaction with the Class Attendance System. This system, which was operated and supervised by senior personnel of CTI, was located on desk, near the entrance of the lecture room. The students, upon entering the lecture room, had to wave their smart card in front of the contactless SC reader of the Class Attendance System. This action would trigger the execution of a secure protocol between the smart card and the Class Attendance System at the end of which the attendance credit counter residing in the SC was increased by 1. If the student attempted to obtain, illegally, one more attendance credit by waving the SC once more, during the lecture (or, in general, during the same day), then the SC soft-ware would block the increase operation. In the end of the semester, the students could access the Course Evaluation System in order to evaluate, anonymously, the course they had attended. The presentation policy of the Course Evaluation System asked from the users to prove the possession of a Course credential as well as present a scope-exclusive pseudonym bound to the same secret as the Course credential. The student's SC permitted the participation in such a proof, only if the attendance credit counter in the card was above the preset attendance threshold. Finally, the User Client module (ABC User + GUI) installed on the students' computers offered some additional SC related capabilities. With them, the users could browse the credentials stored on their SCs, change their SC PIN number or unlock it using the PUK value. Moreover, the students could backup and restore the contents of their SCs. This functionality was useful in cases of SC loss or damage so that the user would not lose his attendance credits.

Beyond the ABC4Trust pilot: the Greek School Network and the envisaged pilot extensions

The Greek School Network, or GSN for short, is the educational intranet of the Greek Ministry of Education and Religious Affairs that interconnects all schools as well as numerous educational administrative agencies and organizations. It is the largest public network in Greece, with the largest number of users, and has been recognized internationally as a remarkable educational network that promotes the introduction and exploitation of Information and Communication Technologies (ICT) in the Greek educational system. Because of its crucial educational role and the need to protect students when they access outside sites, the GSN applies strong use site and user certification methods. Depending on their access rights and roles, the GSN entities and users belong to one of the the following groups: (i) School units, which are provided with multiple accounts to access the network and the GSN services. (ii) Administrative offices, which are also given one or more accounts. (iii) Teachers who are offered personalized services. The identification process for teachers is provided through an automated environment. (iv) Students, who are given access mainly through the school laboratories, but are also provided with personalized services. The identification of the students is performed directly from their schools, with the collaboration of school administration software and GSNs LDAP service. (v) Administrative personnel, who have access through their schools or offices, and are also provided with personalized services.

The number of connected units is, currently, 16.620 schools and 925 administration units. Broadband penetration exceeds 93% for secondary schools, 73% for primary schools and 30% for kindergartens. The number of teachers that have a personal account with GSN is, approximately, 77.000 while the number of students is about 51.000. There is, also, a particularly high demand for telematic services, especially email, emailing lists, websites, blogs, educational video streaming, as well as of social networking and e-class services. In particular, the number of active email boxes exceeds 135.000, while more than 9.000 educational websites are hosted in GSNs servers. Also, 3.515 digital courses have been developed by 890 schools (current school year). More than 10.000 educational blogs and 100 educational communities are provided by GSN, and are visited by more than 150.000 unique visitors per month. Finally, the GSN portal is the most highly visited educational portal in Greece, with more than 220.000 unique visitors in a typical month. All the above data have been recorded as of 23 May 2011.

In all the scenarios that follow the underlying principles that will be implemented are: (i) pupils retain their anonymity (unless it is not permitted by specific service policies, e.g. issuance of an attendance credit) while proving other characteristics of themselves (only the elements required by services, nothing else), (ii) pupils and parents are notified (depending on previous agreement between parents and authorities) when and how pupil information is used by authorities with explanation of the reason for this, and (iii) there is provision for using the pupil information discretely, especially health information which should be accessible by authorities in order to extract useful demographic as well as health aggregate information, which implies the implementation of secure storage and querying mechanisms.

Scenario 1

1. The pupils are equipped with smart cards with ABC credentials that certify that they are pupils as well as other personal information such as matriculation number, age, grade etc. 2. Pupils are registered at the school they are attending in the beginning of the school year by the school registrar. This process is paper based up to now and even in cases of electronic support, the information remains local and out of reach by education authorities. 3. Special credentials are issued to pupils that certify that they have passed the required health exams or at which health aspects they fail. These health certificates are now paper based and their contents are not transformed in electronic format. Thus, the authorities fail to obtain a global view of the health status of the Greek pupil community while, at the same time, severe privacy problems arise.

4. The pupils can order their books at the beginning of the school year using their credentials. Moreover they can download electronic books, which are available by publishers online to certified users, their credentials. 5. Wherever attendance is required, their smart cards can collect it. In this way, the school principal can keep track, for each pupil, the number of times he/she is absent from school and take appropriate measures when needed. 6. Pupils can order and pay their lunch using their smart cards. The smart card contains information about health problems caused by specific foods and, thus, pupils are restrained from consuming specific types of food which danger of unhealthy for them. 7. They can have access to school premises (indoor gym, library, craft classes) after school hours. Their use of the premises can be certified by their personal information will not be revealed if not necessary. 8. The pupils can, also, evaluate (evaluations are totally absent in Greek schools) informally and in an anonymous way the following:

-School lessons.

-Teacher notes.

-Course books.

9. Pupils can certify themselves and watch supporting online courses and classes. 10. Pupils, teachers, and parents will be given the opportunity to discuss and communicate through a special public area offered by the GSN. Today they use, possibly dangerous, online tools, social networking sites, and discussion blogs that may severely compromise their privacy. Privacy preserving technologies can assure, also, that only eligible (according to age, profession, sex etc.) participate in the various chat areas.

In the envisaged scenarios parents are, also, equipped with SCs that verify that they are, indeed, parents of pupils as well as some other personal information of interest to the educational system. Eligible parents can be informed (either automatically or by the school principal) about absences from classes of their children, school activities their children participate in, possibly inappropriate behavior of their children as well as pupils' grades and progress.

Scenario 2

This scenario includes the basic characteristics of the previous one. In addition, it can include some safety and privacy properties like using ABC technology for authenticating pupils and proving some of their attributes in order to have access to specific web sites and applications:

We can develop an application tuned for use on pupils' laptops and on school lab computers. This application can verify the users through Privacy-ABCs based authentication according to their roles but without requiring identifying information, such as surname. The basic roles are the following:

1. Pupils: No access to web pages with illegal content but access to school services such as like school chat rooms, School forums, the educational material which is uploaded on the Greek School Network etc. 2. Teachers: They can access various GSN services such as discussion fora for teachers only or for parents and pupils, public educational discussion forums, the educational material which is uploaded on the Greek School Network by all other teachers (e.g. supplementary material or solutions to homework assignments) etc. 3. Parents: They can access a variety of GSN services, such as discussion forums where teachers can, also, participate and exchange views with them, parents only discussion forums, the educational material which is uploaded on the Greek School Network etc.

What can, potentially, inhibit (or advance) the widespread use of technological innovations such as Privacy-ABCs?

Over the last decade, we have witnessed unprecedented advances in software as well as hardware design and implementation. Especially in the field of security, the advances in theoretical cryptography as well as the construction of highly secure, tamper-resistant hardware devices such as TPMs and smart cards are impressive. Consequently, any security threat, such as the ones our team dealt with during the design and the implementation of our pilot system, could be tackled at a satisfactory level with the appropriate amount of care and effort. Moreover, this should be sufficient to enable the widespread adoption of the Privacy-ABCs innovation by people and organizations alike.

At this point, we should clearly state our view that the other pillar, beyond technology and theory, for adoption of security innovations is users' trust towards the innovation. While strong ICT security is a necessary condition for successful security systems, as described in the previous sections, it is by no means (unfortunately) sufficient. In what follows we present the components of a step-wise, trust-driven approach towards the adoption of Privacy-ABCs by people, based on our experiences from the pilot.

The approach involves all stakeholders at the same time and is targeted at convincing them of the usefulness and security of the target system. The principal axes of the approach are the following: (i) Proven technological excellence of the system components. The system should use strong technologies and theoretical primitives. This aspect may be approached using the latest technological advances in ICT security and cryptography. (ii) Use of open source software technologies and publicly available information for maximum transparency and scrutiny. (iii) In field user assessment. After using the system, the users should be asked to evaluate it and provide feedback on its various aspects, such as userfriendliness, efficiency and perceived security. This feedback should be taken into account for improving the system. (iv) Organization of information days before and after system deployment and use. Holding information days before using a system improves users' understanding of its capabilities and operation while information days after the uses have actually used the system help involved people (developers and users alike) understand each other's views and propose improvements on the usability and functionality of the system. These information days should include technical people, normal users, law experts etc.

We will, now, turn to the important role that social interactions among users can play in diffusing innovations, such as Privacy-ABCs. As we argued, the lack of trust from potential users can be a major inhibiting factor in making a technologically perfect technology a success. Then one faces the problem of how to convince people to adopt and use this technology. A promising approach is to let them try the technology and see for themselves how good it is, thus removing the trust obstacle. Our belief is that one of the, potentially, most effective ways of introducing the Privacy-ABCs to potential users is to introduce them, initially, to a small group of closely related individuals and then try to introduce them to large numbers of groups of, progressively, larger number of members.

A mathematical result that appears to support this belief is that proved by Young in [START_REF] Young | The Diffusion of Innovations in Social Network[END_REF] within the context of innovation diffusion. It is reasonable to regard Privacy-ABCs and their implementation as an innovation, supported by strong mathematical foundations and a carefully implemented, bug-free (to the extend this is possible) reference implementation, to be diffused over a target user population. Within this context, the mathematical results of Young may be applicable. In what follows, we give a brief overview of these results and discuss their connection with our problem achieving widespread adoption of Privacy-ABCs.

Young described in [START_REF] Young | The Diffusion of Innovations in Social Network[END_REF] a parameter of social networks (graphs, in general) that characterizes the "closeness" of individuals belonging to a social group. According to this parameter, we characterize a set of individuals as close-knitted if the following condition holds for every subset of individuals S in the social group: min

S ′ ⊆S d(S ′ , S) ∑ i∈S ′ d i ≥ r.
where d(S ′ , S) denotes the number of links between individuals in the sets S ′ and S and d i the number of social links that individual i has in total.

This parameter captures, at the same time, two major "closeness" factors for subgroups of the social graph: (i) internal connections (reflected in the numerator of the fraction), and (ii) external connections (reflected in the denominator of the fraction). Then for a social graph to be r-close-knitted, we require the ratio of these two factors to be at least r, i.e. loosely speaking to have strong internal connections and weak external connections.

What Young proved for families of social graphs which have the r-knittedness property is that the time requited for all community members to adopt the innovation, given that a subset of them, whose members we call initiators, does accept it initially, is bounded and independent from the size of the community. That is, if all the subsets of the community members have strong pairwise links and, at the same time, are weakly connected to outsiders (who may even be negative towards adopting the innovation), then a group of initiators will manage, in the end, to convince all population members to adopt the innovation. We should note, here, that the definition of close-knittedness is a little more complex for graph families, to which the result of Young applies, than the definition for a single graph but it is along the lines of the definition given above.

This mathematical result suggests a way to, successfully, introduce the Privacy-ABCs innovation to large target populations (e.g. citizens of a city or a country). The central idea behind the proposed approach is to introduce the innovation in a gradual, step-wise manner that involves increasingly larger individual user groups, as potential initiators, that are closely knitted, for some parameter r. For example, the Privacy-ABCs system in hand should be deployed, initially, with users forming small groups of closely related individuals, We would like these users to play the role of the innovation initiators. Consequently, in an ideal situation, they should all adopt the innovation in the end after using it. It follows that in order to convince them to adopt the innovation, we should carefully design the use cases and the supporting ICT system so as to avoid any pitfalls that may cause negative feelings and attitude towards the innovation. To this end, it is preferable to deploy the innovation in the least, possible, risky set-up. For instance, we may use simple use cases, avoiding critical or complex scenarios that may either intimidate users or raise (unnecessary) suspicions over the innovation (e.g. financial applications).

The strategy outlined above has a number of positive features, besides convincing potential users of the innovation quality and usefulness. First, it offers the possibility for in-depth testing of the technology and its implementation since the system is used by a small number of people, each time, and with a simple scenario. As the system testing progresses and modifications are done in the system to correct bugs or enhance functionalities, the next innovation diffusion phase may take place using a group with a number of individuals and, potentially, a more complex scenario. Then, having controllable individual groups (due to their small numbers and coherence) offers the possibility to organize and conduct a thorough evaluation of the pilot set-up and the implementation of the pilot set-up giving the opportunity to improve them before the next pilot trial. As a positive side effect, possible negative findings or mishaps during the pilot, stay within a small number of people and gives the opportunity for subsequent improvements without much bad publicity spreading to outsiders. The approach outlined above is similar to the approach we adopted for our pilot within the ABC4Trust project as well as the one we followed in the pilot of another project of CTI, the PNYKA eVoting project (see [START_REF] Manolopoulos | A Framework for Pro-Voters Privacy In Electronic Voting Procedures[END_REF]). More specifically, in the ABC4Trust case (as in the PNYKA project) we targeted a relatively small group of university students (about 50) in order to ascertain "closeness" among them (close-knittedness) due the fact that they both move about within the same location and discuss with each other daily, strengthening their pairwise social links. Due to the "closeness" among them and from the mathematical result about diffusion of innovation among individuals forming such social graphs, our hope was that in the end, after the pilot, the majority of students would be convinced of the value of Privacy-ABCs and their potential applications, unless of course something went terribly wrong during the pilot operation, which was not the case. This group of students would serve as initiators to diffuse, further, the Privacy-ABCs to other students. Indeed, the overall impression of the participants was, in general, positive (see [START_REF] Benenson | Understanding and Using Anonymous Credentials. 9th Symposium on Usable Privacy and Security[END_REF]) the received feedback was taken under consideration for further improvements and enhancements.

Given this successful operation, our future plan is to follow the gradual innovation diffusion approach discussed above to introduce Privacy-ABCs related services into the GSN. As we explained, this undertaking should be performed with care running, first, small scale pilots within one school, then to more schools within a small geographical region, continuing in this way until we reach larger numbers of GSN users. Before the next step, the participants' feedback will be taken into account in order to prepare for the next, larger scale, pilot. We believe that through this process Privacy-ABCs will be, eventually, adopted by the majority of the educational community members in Greece, an accomplishment that could not be achieved (as indicated by failures of other, initially promising innovations) if one attempted to diffuse, all of a sudden, the Privacy-ABCs technology in, say, eIdentity cards to the whole user population of the GSN. To put this view in perspective, we will end our discussion with one example of a notable failure of a very promising innovation: eVoting. Our belief is that eVoting has failed to gain much popularity in the various countries that it has been introduced because attempts to introduce it were rather abrupt (even enforced by law) and were targeted to extremely large, virtually unrelated groups of individuals, even whole country populations. In other words, eVoting was introduced to groups of individuals that were not close-knitted and it was, thus, difficult or impossible to adopt and further diffuse the eVoting innovation given, in addition, the misconduct and system failures due to careless design and implementations. The negative discussions of these failures by large numbers of users then created an avalanche effect which actually resulted in the spread of the negative attitude over the whole population which used the eVoting technology.

Discussion

We would like to conclude with some lessons learnt from our pilot operation within the ABC4Trust project: a) Modern cryptography and ICT security offer all the necessary tools for building trustworthy Privacy-ABCs systems. b) Security sensitive services and systems should be built using formal design methodologies. c) Privacy preserving services and systems should be designed and built with the end-user in mind. All design steps should be thoroughly documented and explained for later scrutiny by experts as well as non-experts. d) In order to gain wider acceptance, privacy enhancing systems (as any other security sensitive system) should be introduced, gradually, to scenarios of gradually increasing criticality, involving gradually increasing numbers of people over a long time span. e) Finally, a positive attitude towards privacy and Privacy-ABCs can be, potentially, shaped early in the educational system by raising awareness in privacy issues through courses that acquaint pupils with the basics of the Internet, its services as well as its dangers and the protection of their privacy.

  The principal activity sectors of CTI are the following:-Educational Technology Sector. -Networking Technologies Sector. -E-Government Sector. -Center of Telematics & Applications for regional development. -Further Education & Training Sector. -Strategic & Development Policy Sector. -Computing & Networking Systems Security Sector.

Acknowledgement

The research leading to these results has received funding from the European Community's Seventh Framework Programme (FP7/2007-2013) under Grant Agreement no. 257782 for the project Attribute Based Credentials for Trust (ABC4Trust).


Bas Van Schoonhoven
email: bas.vanschoonhoven@tno.nl

Arnold Roosendaal
email: arnold.roosendaal@tno.nl

Noor Huijboom
email: noor.huijboom@tno.nl

Privacy versus Collective Security Drivers and Barriers behind a Trade-off

Keywords: Privacy, security, trade-off, drivers, barriers

Many decisions concerning technological development and related policies in the field of protecting the privacy of individuals and security at the societal level include a perceived trade-off between these two interests. Sometimes, this trade-off is made explicitly, but often it is an implicit choice, driven by external factors. This paper assesses a set of factors acting as drivers or barriers towards the development of technologies for privacy and/or societal security. While some of the individual drivers and barriers do not show a clear bias towards security or privacy technology development, the overview gives a clear indication that some powerful factors are biased towards developing and using security technologies, and some other factors are biased towards hindering the development and use of privacy technologies. This bias may threaten the privacy of individuals on the long run and may obscure potential solutions that enhance both security and privacy.

Introduction

Many decisions concerning technological development and related policies in the field of protecting the privacy of individuals and security at the societal level include a perceived trade-off between these two interests. Security technologies that are developed and deployed to secure society against crime, terrorism or other threats often violate the privacy of individuals. Similarly some privacy technologies hinder security surveillance practices. Sometimes, this trade-off is made explicitly, but often it is an implicit choice, driven by external factors. An important question concerns what these factors are. The phenomenon of the perceived privacy-security trade-off has been recognised in literature before [START_REF] Solove | Nothing to Hide: The False Tradeoff between Privacy and Security[END_REF]. This research adds to the knowledge concerning this phenomenon by identifying drivers and barriers for the development of privacy and security technologies in order to explain why the trade-off turns out in a certain way.

How exactly the drivers and barriers identified in this paper work out in practice, depends on the specific technology used, the situation in which it is applied, and the perceptions of the actors involved. This is not part of this paper, but is developed further in a number of case studies1 in the PRISMS2 project. In this paper, first a brief description of security and privacy will be presented. Then, drivers and barriers for development of security and privacy technologies will be discussed. Finally, some conclusions with regard to the impact of these drivers and barriers on the perceived trade-off between security and privacy technology development will be drawn.

Security and Privacy

Privacy and security technologies aim at enhancing privacy and security. To understand what these technologies do, it is necessary to have an idea of what security and privacy are. The European Committee on Standardisations working group 161 provides a mainstream definition of security: "security is the condition (perceived or confirmed) of an individual, a community, and organisation, a societal institution, a state, and their assets (such as goods, infrastructure), to be protected against danger or threats such as criminal activity, terrorism or other deliberate or hostile acts, disasters (natural and man-made)" [START_REF] Sempere | The European Security Industry: A Research Agenda[END_REF] Security as a concept is multidimensional, and generally defined in a very broad sense. It relates to many different scales: international security, national security, corporate security, societal security, and individual security [START_REF] Friedewald | Central Concepts and Implementation Plan[END_REF].

The concept of privacy has a long history in European and American cultures and it has been defined in many ways. Back in 1890, Warren and Brandeis defined it as "the right to be let alone" [START_REF] Warren | Right to Privacy[END_REF]. In 1967, the influential privacy researcher Alan Westin described it as "an instrument for achieving individual goals of self-realisation" and "the claim of individuals, groups or institutions to determine for themselves when, how and to what extent information about them is communicated to others" [START_REF] Westin | Privacy and Freedom[END_REF].

More recently, researchers have recognised that privacy is a concept that is impossible to fully define in a single definition, and that there are multiple dimensions to privacy, for example as argued by Daniel Solove in his book "Understanding Privacy" [START_REF] Solove | Understanding Privacy[END_REF]. Solove differentiates between different dimensions of privacy according to the type of privacy invasions, e.g. surveillance, aggregation, or intrusion. However, the outlining of privacy problems or intrusions does little to provide an overarching framework that would ensure that individuals rights are proactively protected.

Rights to privacy, such as those enshrined in the European Charter of Fundamental Rights, require a forward-looking privacy framework that positively outlines the parameters of privacy in order to prevent intrusions, infringements and problems. For our analysis, we use the recent conceptualisation of privacy as seven types of privacy, as identified by Finn, Wright, and Friedewald. These types of privacy are: Privacy of the body, Privacy of behaviour, Privacy of communication, Privacy of data and image, Privacy of thoughts and feelings, Privacy of location and space, and Privacy of association [START_REF] Finn | Seven Types of Privacy[END_REF].

The concepts of privacy and security partially overlap at the individuals' scale. This is especially visible in the field of information security which is also concerned with data protection. There is no such overlap, however, when comparing security at the societal scale with privacy at the individuals' scale. 3

Collective Security versus Individual Privacy

Decisions concerning technological development and related policies in the field of protecting privacy and security are made within a certain policy context. The actors involved in the policy arena highly determine the definition of the notions privacy and security and develop certain story lines of the relation between the two notions. To understand the meaning given to the notions and their interrelationship, an extensive discourse analysis has been carried out within the PRISMS project. The discourse analysis shows that actors often perceive the balance between privacy and security as a trade-off; the one issue being at the expense of the other and vice versa. One of the many examples can be found in the Communication of the European Commission on the Stockholm Programme (a five-year plan with guidelines for justice and home affairs) in which it states that "it must also foresee and regulate the circumstances in which public authorities might need to restrict the application of these rules [regarding privacy] in the exercise of their lawful duties [security]" [START_REF]Action Plan Implementing the Stockholm Programme[END_REF]. In other words, it is contended that in some instances privacy has to be restricted in order to enhance security. This perceived trade-off may as well be fed by the rather polarised policy field in which there is a clear distinction between actors who advocate increased privacy and actors who promote more security. Only few actors point to (e.g. technological) possibilities to strengthen both privacy and security at the same time. In addition, privacy and security policies are being developed by distinct policy bodies with their own specific focus (e.g. separate bodies within DG Justice and DG Home Affairs). This rather dispersed policy field and polarised discourse may explain certain technological developments in which the trade-off is visible.

The Trade-off: Drivers and Barriers

In technological developments, a trade-off between security at the societal scale and privacy of individuals is visible. Security technologies are developed and deployed that violate privacy, and similarly some privacy technologies hinder security surveillance practices. For example, advanced surveillance technologies applied in digital and physical environments make it increasingly possible to track and profile individual behavioural patterns, reducing the privacy of these individuals. On the other hand, some privacy enhancing technologies such as communication encryption and onion routing networks hinder online security surveillance practices. To gain a better understanding of how decisions based on this perceived trade-off play out we performed a preliminary analysis of the drivers and barriers that respectively drive security and privacy technological developments, or act as barriers to these developments. The drivers and barriers outlined here are based on a literature study of policy documents, technology roadmaps, foresight studies and impact assessments performed in the PRISMS project. Most drivers and barriers that were identified apply to both security and privacy technology developments, although to a varying extent. We identified the following drivers and barriers.

Driver 1: Technology and Industry Push

The military industrial complex has become a reality by the farewell speech of Dwight Eisenhower in 1961, ending his presidential career. Eisenhower first stipulates the emergence of the military industrial complex, new in the American experience, and in his view the result of the changing approach to arms and armaments after the three large wars in which the United Stated have been involved (the first and second world war, the Korean war). Eisenhower states: "Now this conjunction of an immense military establishment and a large arms industry is new in the American experience. The total influence -economic, political, even spiritual -is felt in every city, every Statehouse, every office of the Federal government [...] Only an alert and knowledgeable citizenry can compel the proper meshing of the huge industrial and military machinery of defence with our peaceful methods and goals, so that security and liberty may prosper together."

Eisenhower both addresses the emergence of a complex consisting of industries at arms length of military decision makers and the role and responsibilities of alert and knowledgeable citizenry in order that security and liberty may prosper together. Several authors indicate that this military-industrial complex meanwhile has experienced a transition into the direction of a security-industrial complex, since the revenues for military undertakings are under pressure. The securityindustrial complex is a significant phenomenon in Europe, and is developing at a rapid pace. The pace of these developments is to a large extent based on increasing demand [START_REF] Wright | Surveillance, Fighting Crime and Violence[END_REF]. However, a vested industry also has a significant interest in maintaining and increasing demand for its products and services. Industry, and to some extent research institutions, that are involved in researching and developing technologies for security and privacy provide a technology push, or solutions in search of a problem. Since the potential market for societal or national security is much larger than that of individual privacy, there is a strong financial incentive for companies in the security-industrial complex to invest in research and development of surveillance and other security technologies, even if this results in a negative outcome for the privacy of individuals. Companies dedicated to developing privacy protection solutions currently operate mostly in niche markets, and provide a technology push to a much lesser extent. In relation to the above, the level of organisation is much higher in the security industry field than in the privacy field. The establishment at the European level, supported by the EU government, of a Group of Personalities and the European Security Research Advisory Board (ESRAB), with a huge influence in the lobbying process, provided these bodies with a steady position. Moreover, these bodies have a strong relationship with industrial companies and are very well supported. On the privacy side, however, it often concerns voluntary associations [START_REF] Bennett | The Privacy Advocates; resisting the spread of surveillance[END_REF] without a clear overarching structure or a social movement with an identifiable base [START_REF] Bennett | The Privacy Advocates; resisting the spread of surveillance[END_REF].

Driver 2: Events with High Societal Impact

An analysis performed in the PRISMS project based on the use of keywords related to terrorism and organised crime in CORDIS project objective descriptions shows remarkable increase of projects in these fields from 2004 onwards. A possible explanation for this is that this is a delayed response to a number of high-profile attacks on the EU and its allies, resulting in an increased attention in fighting terrorism and organised crime. These attacks include the September 11 airplane hijack and subsequent attack in 2001 in New York and Washington, the July 7 2005 suicide bombings of the public transport system in London, and the March 11 2004 Madrid train bombings. All these events have had a high impact on the perception of societal security (or the lack thereof) of citizens in the EU, and as a consequence an increased call for security and protection against such terrorist attacks, even at the cost of losing privacy. The interplay between security and privacy as a consequence of high-profile societal events is seen as a possible driver of primarily development of security technologies. Historically, privacy-related incidents (e.g. leaks of large amounts of personal data) have had significantly less impact than the discussed security incidents, and as a consequence the drive for the development of privacy protection technologies because of incidents is much lower [START_REF] Van Lieshout | Stimulerende en remmende factoren van Privacy by Design in Nederland[END_REF]. The recent NSA revelations and increased government surveillance can be a driver for privacy technologies. However, any individual privacy enhancing technology that is too difficult for a State to decipher will face difficulties, as was seen with the US government fight against PGP in the 1990's. This can act as a barrier to new privacy technologies. One can also argue that legislation can act as a barrier to privacy technologies. Privacy is secondary to national security in all types of legislation (including Data protection and Human Rights). Generally States do not allow for the total privacy of an individual and this is manifested in legislative policy. Some States have specific legislation to combat certain privacy technologies in the interest of national security. For example the UK Regulation of Investigatory Powers Act 2000, allows authorities to compel a suspect in a criminal or terrorism related investigation to reveal his/her encryption key to enable the access to encrypted data.

Driver 3: National and EU-level Policy and regulation

Although national and EU-level regulation tend to be reactive and sometimes fragmented, legislation does act as a driver for organisations to implement certain privacy and security protections, to be compliant with the law [12] [11]. The strength of this driver depends amongst other things on the presence and actions of a supervising authority (e.g. data protection supervisor), and how well organisations understand what they have to do to be compliant, which is an issue especially with regards to privacy. A special case of this driver is the Charter of Fundamental Rights of individuals as argued in the 2010 EU Internal Security Strategy: "People in Europe expect to live in security and to enjoy their freedoms: security is in itself a basic right. The values and principles established in the Treaties of the Union and set out in the Charter of Fundamental Rights have inspired the EU's Internal Security Strategy: justice, freedom and security policies which are mutually reinforcing whilst respecting fundamental rights, international protection, the rule of law and privacy [...], transparency and accountability in security policies, so that they can be easily understood by citizens, and take account of their concerns and opinions [START_REF]The EU Internal Security Strategy in Action: Five steps towards a more secure Europe[END_REF]."

Driver 4: Citizen Demand for Security and Privacy

Another driver is related to some of the drivers we already mentioned: citizens demand a certain level of security and privacy, and as a consequence a market for products may arise, or governments may setup regulations. Citizen demand plays a role in the application of some surveillance technologies, such as CCTV cameras. A perception of public settings being insecure, e.g. being threatened by crime or violence in city centres, may increase the demand for technologies that are perceived to enhance security, such as surveillance systems. This does not necessarily mean that these solutions are effective in enhancing security [START_REF] Wright | Surveillance, Fighting Crime and Violence[END_REF]. With regard to privacy the same driver applies: citizens demand a certain level of privacy, for example while using internet services, and as a consequence new technologies get developed that fill in this demand. An example is the Do Not Track technology used in web browsers.

Barrier 1: Privacy and Security not Perceived as Unique Selling Points

Although citizen needs for security and privacy may increase demand for certain technologies that aim to enhance security or privacy, for many services and products security and privacy is not the primary focus, but rather a side issue. For example, for most of the transport sector, transporting goods and passengers is the primary activity, and security and privacy, while important, both do not act as positive selling features that companies advertise [14]. The same is true with regard to privacy: few companies see privacy as a unique selling point that allows them to sell products better or to compete better. Customers do currently not seem to find privacy a distinguishing feature of services, and are not overly willing to pay for enhanced privacy protection [START_REF] Van Lieshout | Stimulerende en remmende factoren van Privacy by Design in Nederland[END_REF]. Increasing awareness of the importance of privacy and security with customers may possibly change this barrier into a driver, however. In the EU Security Industrial Policy, aspects such as privacy are mentioned as having a "[...]very tangible effect for a company that wants to invest in security technologies. The security industry has to be sure that its products will be compatible with the general opinion of the public. The commercialisation of their new technologies would otherwise be impossible. The financial and human efforts that go into the development and production of a security product can therefore be easily wasted [START_REF]Action Plan for an innovative and competitive Security Industry[END_REF]"

Barrier 2: Lack of Standardisation

Another important barrier to development and use of both security-enhancing and privacy-enhancing technologies is a lack of standardisation [START_REF] Van Lieshout | Stimulerende en remmende factoren van Privacy by Design in Nederland[END_REF]. There are several related issues that act as barriers in this: the lack of a clear or commonly held definition of what security and privacy entails in practice; uncertainty about legal obligations and a fragmented regulatory landscape in the EU with regards to privacy and security; and incompatibility of different kinds of technological solutions with existing systems or other solutions. Some examples of where lack of standardisation hinders technology development and use are a lack of common technical and interoperability standards for automated border control systems, as well as standards for biometric identifiers, or a lack of standards for communication interoperability [START_REF]Action Plan for an innovative and competitive Security Industry[END_REF]. For privacy this issue is more pronounced than for security: as privacy is a relatively new issue many companies do not have extensive experience with best practices and reliable knowledge of what precisely to do to enhance privacy is hard to come by.

Barrier 3: Reactive, not Proactive Approach

Organisations tend to behave reactively and not proactively with regard to privacy protection and security. Similarly, governments tend to formulate regulations and mandatory requirements in response to issues that occur, and not in a proactive manner. Technologies may not be applied because little attention to security or privacy issues was given during the design stage of products and services. The alternatives to such reactive approaches are usually described as security by design and privacy by design, for example by Ann Cavoukian, the Information Commissioner of Ontario, Canada [START_REF] Cavoukian | Privacy by Design The 7 Foundational Principles[END_REF]. A reactive approach may still create a demand for technologies in order to patch up security or privacy vulnerabilities in systems and services, but overall we expect that a proactive approach would increase demand for privacy enhancing and security enhancing technologies [START_REF]Action Plan for an innovative and competitive Security Industry[END_REF].

Conclusion

In the previous sections we discussed a number of key drivers and barriers in the development and application of technologies for privacy and security. Some drivers and barriers have a more pronounced effect on the development of security technologies, for others the effect is stronger on privacy technologies. We argue that there is a clear bias towards developing technologies for societal security, even at the cost of individual privacy, in both the factors driving and hindering technology development. This argument is based on the preliminary assessment performed, which is summarised in the tables below: While some of the individual drivers and barriers do show a clear bias towards security or privacy technology development, the overview gives a clear indication that some powerful factors are biased towards developing and using security technologies, and some other factors are biased towards hindering the development and use of privacy technologies. The drivers and barriers identified here are subject to ongoing developments. For example, with rising privacy awareness in customers, privacy as a unique selling point may become a significant factor driving the development and use of these technologies. The Snowden revelations on the USA PRISM4 scandal may boost awareness. At this point in time, however, this analysis indicates that there is no level playing field for the development and use of security and privacy technologies: current technological developments tend towards security at the cost of privacy. This bias does not only pose a risk for the privacy of individuals on the long run, but the bias against the development and use of privacy protecting technologies compared to technologies for security at the societal scale and the perceived trade-off between the two may obscure potential solutions that may enhance both security and privacy.

Table 1 .

 1 Bias in factors driving technology development and use

	Driver	Biased towards driving ...
	Technology and industry push	Security
	Events with high societal impact	Security
	Government policy and regulation	-
	Consumer demand	-

Table 2 .

 2 Bias in factors hindering technology development and use

	Barrier	Biased towards hindering ...
	Lack of standardisation	-
	Not a unique selling point	Privacy
	Reactive approach	Privacy

These case studies concern biometrics, deep packet inspection (DPI) and internet monitoring, Automated Number Plate Recognition (ANPR), smart grids, and body scanners at airports.

PRISMS stands for "The PRIvacy and Security MirrorS" -Towards a European framework for integrated decision making. The project is part of the EU Seventh Framework Programme and analyses the traditional trade-off model between privacy and security and devises a more evidence-based perspective for reconciling privacy and security, trust and concern.

We acknowledge that there is a collective value of privacy as well. The research and use cases on which this paper is based, however, concern situations where collective security (e.g. fighting terrorism) counters individual privacy. For instance, the use of body scanners at air-ports concerns public/collective security, but each individual is affected in his privacy.

The USA PRISM program should not be confused with the EU FP7 PRISMS research project.