Arthur Tatnall
email: athur.tatnall@vu.edu.au

Bill Davey
email: bill.davey@rmit.edu.au

History of the Use of Computers and Information Technology in Education in Universities and Schools in Victoria

Keywords: History, Computers in Education, History of University Computing, History of School Computing, Victoria

This paper investigates the development of courses in computing and use of computers in education in universities (from the 1930s) and schools (from the 1970s) in Victoria, Australia. The paper describes the significant events of the era and investigates the relationship between the development of courses in the universities and the more vocationally oriented Colleges of Advanced Education (CAE): did one follow from the other? It also investigates the extent of the influence of the universities and CAEs on school computing.

Introduction: Early Use of Computers in Australia

In this paper we investigate the history of computers and education in both universities and schools in Victoria, Australia over the period from the 1930s to the 1990s. Primary and High School use of computers did not commence until the 1970s but prior to this there is a considerable and interesting history associated with the development of higher education courses relating to computing.

All of Australia's early computers were based in the universities with CSIRAC, Australia's first computer 1 that was operational in 1949, in general use at the University of Sydney from 1951-1956 and later at the University of Melbourne until 1964, and SILLIAC in Sydney from 1954 [START_REF] Mccann | The Last of the First -CSIRAC: Australia's First Computer[END_REF]. From the mid-1950s a number of these computers were opened to general use and practical training in programming was introduced at the Universities of Melbourne, Sydney, and New South Wales (NSW). Early training courses, each of a few weeks duration, were offered in the programming techniques appropriate to each machine [START_REF] Bennett | Computing in Australia. The Development of a Profession[END_REF]. This was the beginning of the use of computers in education in Australia.

Prior to the late 1980s Australia had a two-tiered system of higher education: 'Universities' and 'Colleges of Advanced Education' (CAE). After 1990, a series of mergers saw the end of the CAEs and the creation of a number of new universities. Naming of these institutions is, however, a little more complex as in the 1950s and 1960s many of the future CAEs were called 'Technical Colleges', and in the 1970s and 1980s some became 'Institutes of Technology'. It should be noted that in this paper Technical College, Institute of Technology and College of Advanced Education can all be taken to apply to institutions of essentially the same nature. This paper will investigate the relationship between the development of courses in the universities and the CAEs: did one type follow from the other?

Significant educational computing in primary schools and high schools dates from the 1970s and came in two forms: teaching about computing and the use of computers to enhance learning in other subject areas. The paper will investigate the effect that the universities and CAEs had, or did not have, on each form of school computing, and how these forms of school computing related to each other.

The research described in this paper was qualitative in nature with data collected from published sources, interviews and personal observation.

Computers in Education -Universities and Schools

In Australia a number of distinct periods can be identified in the evolution of higher education and school courses in computing towards those we see today [START_REF] Tatnall | Curriculum Cycles in the History of Information Systems in Australia[END_REF]  1990 to the present Each of these periods will now be described in detail.

The Period from 1930s-1950

From about 1935, several courses began to be offered in Victorian Technical Colleges in the use of punched-card operated accounting/tabulating machines. These courses were very much business-oriented in outlook and whilst not what we would now call computing courses, did lay some ground work for future courses in business computing [START_REF] Tatnall | A Curriculum History of Business Computing in Victorian Tertiary Institutions from 1960 -1985[END_REF].

The first courses in Theory of Computation, Computing Practices and Theory of Programming, what we might now call aspects of Computer Science, were introduced in 1947 by Trevor Pearcey (the principal designer of CSIRAC) in the Department of Mathematics at the University of Sydney. At this point, computing was very much a mathematical study. At that time, of course, to use a computer at all required knowledge of programming, and it was several years before computing was seen anywhere other than Statistics and Mathematics Departments [START_REF] Pearcey | A History of Australian Computing[END_REF][START_REF] Tatnall | The Growth of Educational Computing in Australia, in History, Context, and Qualitative Methods in the Study of Education[END_REF].

Although Australia at that time, along with the UK and USA, was in the forefront, the situation in other countries was similar and much has been written on this [START_REF] Bonfanti | Information Technology in Italy: The Origins and the Early Years (1954 -1965[END_REF][START_REF] Kovacs | Hungarian Scientists in Information Technology[END_REF][START_REF] Fet | From the History of Russian Computer Science[END_REF][START_REF] Sanders | A Possible First Use of CAM/CAD[END_REF][START_REF] Deane | Australia's WREDACit was Rocket Science[END_REF][START_REF] Lawson | Experiences and Reflections[END_REF].

The Period from 1950-1959

In 1956 CSIRAC moved from Sydney and was re-located at the University of Melbourne. Programming courses were given regularly in Melbourne from 1956, and in 1959 a subject in Numerical Methods and Computing was developed (delivered by Pearcey) in the BA course in Pure Mathematics. During this period several university computer systems were opened to general use and courses involving practical training in programming and the application of computers were introduced in the universities of Melbourne, Sydney and NSW. In 1959 the first post-graduate diploma in Numerical Analysis and Automatic Computing was offered by the University of Sydney [START_REF] Pearcey | The Origins of Modern Computers, in Computing in Australia. The Development of a Profession[END_REF].

The Period from 1960-1969

In the early 1960s most educational institutions, and particularly the Technical Colleges, were still teaching about punched-card operated accounting machines. During this period, however, a great deal happened in relation to computing in higher education, perhaps the most important being the decision (taken in the late 1950s) by the Australian Commonwealth Government to computerise the operation of the Department of Defence and the Post Master General's Department (PMG), so creating a massive requirement for trained computing personnel [START_REF] Maynard | Interview on the History of Business Computing[END_REF].

At this time the universities were only just starting to come to grips with the issue of whether computing was a part of mathematics or should be considered as a new discipline [START_REF] Tatnall | Curriculum Cycles in the History of Information Systems in Australia[END_REF]. With courses which were quite theoretical in nature, relatively few staff and sparse facilities, the universities were largely unprepared for the demands of the Commonwealth which needed courses with a substantial component that was vocational in nature. The universities had little interest in providing such courses [START_REF] Tatnall | A Curriculum History of Business Computing in Victorian Tertiary Institutions from 1960 -1985[END_REF] so in 1960 the Australian Government's Commonwealth Public Service Board set up the Programmers in Training (PIT) scheme initially of twelve weeks duration as a temporary measure to alleviate the severe shortage of programmers and other computer professionals in Commonwealth Government departments. The PIT courses were oriented towards training staff for the establishment and running of commercial and administrative computing applications.

Although regarding this training as successful in providing a 'crash computing course' the Public Service Board recognised a need to set up longer courses and began designing a full-year long Programmer-in-Training (PIT) course. The first of these PIT courses ran in 1965 and initially drew upon the Defence and PMG staff experience with both computerised, and existing non-computerised administrative systems. Maynard, who was then an O&M 2 Inspector with the PMG, (1990) describes this course as a "double-decker sandwich course of one year duration combining periods of formal classroom education with on-the-job training" [START_REF] Tatnall | A Curriculum History of Business Computing in Victorian Tertiary Institutions from 1960 -1985[END_REF]. The PIT courses took over 20 hours/week of formal class time for a year and operated initially in Canberra and Melbourne [START_REF] Maynard | Interview on the History of Business Computing[END_REF][START_REF] Pearcey | A History of Australian Computing[END_REF]. The 46 week course covered the topics: introduction to the course and the service; computer equipment and techniques, computer mathematics (statistics), programming, systems analysis and design.

One of the first educational institutions in Australia to adopt business computing as a priority was Caulfield Technical College3 offering, in 1961, a Certificate of Accounting (DP) course and by 1967 a Diploma of Business Studies (Data Processing). Maynard, now a lecturer at PIT, [START_REF] Maynard | Interview on the History of Business Computing[END_REF] suggests that these courses were the forerunner of many of today's courses in Information Systems [START_REF] Tatnall | Curriculum Cycles in the History of Information Systems in Australia[END_REF]. From this period on, university and other higher education computing courses were seen to become 'respectable' and were soon widely available. In 1962 Royal Melbourne Institute of Technology (RMIT) got its first computeran Elliot 803, and in 1963 short evening post-diploma courses were offered at Caulfield Institute of Technology (formerly Caulfield Technical College) on Punched-Card Systems, Accounting Machine Applications, Commercial Electronic Data Processing and Principles of Analogue Computing. Surprisingly, in that same year, a survey suggested that businesses in Victoria believed that they would need only ten programmers in the next ten years [START_REF] Pearcey | A History of Australian Computing[END_REF] perhaps there would be no need for all these new computer professionals! Other courses were introduced at this time at Caulfield Institute of Technology, Bendigo Institute of Technology and Footscray Institute of Technology. These courses had titles like: Diploma of Information Processing, Post Diploma of Electronic Computing and Associate Diploma in Accountancy (Data Processing), Certificate in Electronic Data Processing (Operating and Coding), Diploma of Business Studies (Data Processing), Information Processing Diploma and an Electronic Computing Post Diploma [START_REF] Juliff | Interview on Business Computing Curriculum[END_REF][START_REF] Juliff | Interview on Business Computing Curriculum[END_REF].

In the university sector, the University of Melbourne established a Department of Information Science [START_REF] Pearcey | A History of Australian Computing[END_REF] and offered courses in the Theory of Computation, and Monash University set up a Department of Information Science in the Science Faculty and offered Computer Science in its science degree. Monash's first computer was a 7,000 word Sirius with two sets of Ferranti/Creed model 75 tape editing equipment [START_REF] Davey | Turning Points in Computer Education[END_REF][START_REF] Lukaitis | The Birth of Information Systems[END_REF][START_REF] Ainsworth | University's First Computer[END_REF]. Changes in technology then meant that such courses typically moved from delivery on an institution's mainframe to one of its new mini-computers producing a fundamental change in the content and availability of computing courses.

The Period from 1970-1979

In 1970 the Commonwealth Public Service Board decided to hand over the running of PIT courses to Caulfield Institute, Bendigo Institute, Canberra CAE and NSW Institute of Technology [START_REF] Maynard | Interview on the History of Business Computing[END_REF]). According to Greig & Levin [START_REF] Greig | Computing at Chisholm: The First Twenty Five Years, 1965-1989[END_REF]:

"The Public Service Board believed that the increasing use of sophisticated computer equipment at the colleges and their need for increasing numbers of trained 'computer personnel' made such a development desirable." [20 :7] The 'new' PIT scheme commenced operation at the CAEs in 1971. This was very important as it could be seen as the beginning of higher education courses of business computing and information systems.

University and CAE Computing Courses

From the early 1970s computing courses began to proliferate in Universities and CAEs, but at this time Chisholm Institute of Technology (the former Caulfield Technical College), like most other universities and CAEs, was still using punched-cards for students to enter their programs. It was not until the end of this decade that microcomputers began to enter higher education institutions [START_REF] Maynard | Interview on the History of Business Computing[END_REF].

In 1971 the 'new' Programmer-in-Training programme supported 235 trainees Australia-wide [START_REF] Philcox | The Commonwealth Public Service Board and the Introduction of Computer Technology, Early Australian Computer Systems[END_REF]. This new scheme had the wider objective of providing trained computer personnel to industry as well as the Commonwealth and State Public Service [START_REF] Pearcey | A History of Australian Computing[END_REF] and comprised both full-time classes and on-the-job training.

Although teaching in Computer Science began in Australia's universities of the 1950s, CAEs courses in Business Computing only commenced in the 1960s. The growth in CAE courses owed a great deal to the Commonwealth Programmer-in-Training (PIT) scheme which became the model for many future courses in Business Computing. The reluctance of the universities to become involved in what they saw as little more than vocational training opened the way for the CAEs to develop this curriculum area. Juliff, an academic at Caulfield Institute of Technology and later Victoria College, [START_REF] Juliff | Interview on Business Computing Curriculum[END_REF] suggests that university Computer Science was, at this time, taught mostly by people whose primary love was mathematics and that was the flavour they gave to their courses. They saw no need for courses to be relevant to the real world. The PIT scheme, on the other hand, was very business-oriented in design. It is thus clear that courses in Business Computing in the CAEs did not diverge from university Computer Science courses, but developed from those of the PIT scheme.

Computing in Schools

It was in the early 1970s that school computing began when a small number of computers started to appear in Australian schools, typically resulting from the exposure of particular teachers to computing during their university studies. In 1972, for example, Burwood High School was loaned a PDP-8 computer by Digital Equipment [START_REF] Salvas | [END_REF] and the following year McKinnon High School received an Innovations Grant to enable the purchase of an 8k Wang computer also used by Teletype terminal access by Box Hill High School. These early computers were used by mathematics departments almost exclusively for the teaching of programming [START_REF] Salvas | [END_REF].

The biggest impact on schools at this time was introduction of the Monash Educational Computer System (MONECS). Before the advent of the PC it was impossible for an average school to have hands-on access to a computer. In 1974 a group at Monash University produced a system using mark-sense cards that allowed a class of 30 students to each get two program runs in a one-hour period [START_REF]MONECS Deamon Educational Computer system[END_REF]. The MONECS system was used to teach programming in FORTRAN or BASIC. At this stage schools saw computing as a branch of mathematics concerned with algorithm design.

Another development at this time was experimentation by the Victorian Technical Schools with use of Control Data's 'PLATO System' [START_REF]History of Plato Learning[END_REF] for computer-assisted instruction, mainly for the training of apprentices. The system was, however, very expensive and its use did not proceed.

The arrival of the Apple II in 1977 saw the end of this period and the beginning of real advances in the use of computers in schools. Watsonia High School (where we were both teaching at the time) was one of the first high schools in Australia to obtain an Apple II computer [START_REF] Tatnall | Making History relevant Through the Provision of Education, Stories and Interactive Experiences[END_REF]. At around $2,000 for a 16k Apple II that used a tape drive (not suppliedyou simply used your own cassette recorder) and a television (also not supplied) as a monitor the Apple II was (almost) affordable for schools. This was before the days of the ascendancy of the IBM PC, MS-DOS and the Apple Macintosh and schools made use of the Apple II and a variety of other micro-computers.

In 1978-1979 the Victorian Education Ministry [START_REF] Salvas | [END_REF][START_REF] Tatnall | The Role of the State Computer Education Centre of Victoria, in MA[END_REF] produced a plan for the introduction of computers to schools and it was not long before several different streams of computer education emerged:

 Computers across the curriculumcomputer use in different subject areas  Computer Science  Programming in mathematics  Use of word processors by secretarial studies students  Logo  Computer industry/business training in Technical Schools [START_REF] Tatnall | Streams in the History of Computer Education in Australia[END_REF].

In the late 1970s the Education Department's Secondary Mathematics Committee recognised the potential of computers in mathematics and other aspects of education and set up a Computer Travelling Road Show consisting of teachers with some knowledge of computing who travelled around the state in groups of two or three, normally bringing a 16k Apple II with tape drive. Visits to schools around the State were used to promote the use of computers all subject areas. Each demonstration by the 'Road Show' was typically to an entire teaching staff, with students being sent home for the day. Another important school curriculum support mechanism used by the Victorian Ministry of Education in the late 1970s and early 1980s was the Regional Subject Consultants who were practicing school teachers seconded from their schools, usually on a part-time basis [START_REF] Tatnall | Schools, Students and Curriculum in Victoria in the 1970s and 1980s[END_REF]. They rarely had any interaction with school students, working instead to support the work of teachers and school principals in using computers.

The Period from 1980-1989

In 1980 Chisholm Institute (like most other tertiary institutions) was still using a minicomputer, with terminals for students to enter their programs. Around this time, however, traditional Business Computing (later Information Systems) curricula were beginning to develop in the CAEs and most courses had a core of similar topics which were typically based around subjects related to systems analysis and design, database design, business programming (which was typically done using third generation such as BASIC, COBOL or Pascal) and systems implementation. Many of these courses also had an introductory computer networking unit which was probably the most technical and close to the discipline of Science. Subjects handling computer architecture probably delved well into the realm of Computer Science and were often electives. By 1985 micro-computer adoption in tertiary institutions was widespread [START_REF] Tatnall | Innovation and Change in the Information Systems Curriculum of an Australian University: a Socio-Technical Perspective[END_REF].

Computer Awareness Courses in Schools

In 1980 the Secondary Computer Education Curriculum Committee was formed with a brief for the production of Computer Awareness course guidelines, the investigation of Computer Science as a discipline, the publication of computer education articles, the collection, propagation of public domain software and the provision of in-service education [START_REF] Tatnall | The Growth of Educational Computing in Australia, in History, Context, and Qualitative Methods in the Study of Education[END_REF].

Although in developed countries around the world today secondary school students are very 'aware' of information technology and its many use, this was not the case in the early to mid-1980s and Computer Awareness courses sought to address the twin problems of poorly prepared teachers and a mystical understanding of the nature of computers. Such a course would typically cover the following topics:

 How a computer works, computer programming, history of computing  Business and commercial uses of information technology  The social implications of increased use of computers. Interestingly, although teachers of Mathematics were the prime movers in these early days, mathematics classes did not embrace computers into the later 1980s. What appears to have happened is that programmable calculators were seen as more relevant to teaching mathematics. In many cases the Mathematics teachers interested in school computing moved over to the teaching of computing: Computer Awareness or Computer Science, and gave up any attempt to use computers in mathematics, which today would be one of the subject areas making least use of computers.

The role of mathematics in the adoption of computers in schools appears to be a common phenomenon around the world as one article from The Netherlands notes:

In addition in the participating schools mainly math teachers appeared to be the early adopters of the new subject, because of their knowledge, experience and interest in information technology [START_REF] Voogt | Information Literacy in the Netherlands: Rise, Fall and Revival, in Reflections on the History of Computing in Education: Early Use of Computers and Teaching about Computing in Schools[END_REF]. Authors from many countries including UK [START_REF] Demant | Don't Put the Computer Room near the Maths Department! or, I was an Early Adopter, an Enthusiastic Disseminator, but Now[END_REF][START_REF] Millwood | Reflections on the History of Computing in Education: Early Use of Computers and Teaching about Computing in Schools[END_REF][START_REF] Passey | Reflections on the History of Computing in Education: Early Use of Computers and Teaching about Computing in Schools[END_REF], Ireland [START_REF] Leahy | Reflections on the History of Computing in Education: Early Use of Computers and Teaching about Computing in Schools[END_REF], Israel [START_REF] Barta | Reflections on the History of Computing in Education: Early Use of Computers and Teaching about Computing in Schools[END_REF], The Netherlands [START_REF] Voogt | Information Literacy in the Netherlands: Rise, Fall and Revival, in Reflections on the History of Computing in Education: Early Use of Computers and Teaching about Computing in Schools[END_REF][START_REF] Zwaneveld | Reflections on the History of Computing in Education: Early Use of Computers and Teaching about Computing in Schools[END_REF], USA [START_REF] Parker | Reflections on the History of Computing in Education: Early Use of Computers and Teaching about Computing in Schools[END_REF], Finland [START_REF] Koivisto | Reflections on the History of Computing in Education: Early Use of Computers and Teaching about Computing in Schools[END_REF] and Poland [START_REF] Sysło | The First 25 Years of Computers in Education in Poland: 1965 -1990[END_REF] make similar comments. This is just a small sample of many articles by authors that remark on the role and future of mathematics and mathematics teachers in the early adoption of computers in schools in their own countries.

Computer Science Courses

In 1981, as a result of several years of effort by a group of CAE and university academics, Computer Science was first offered as a Year-12 Higher School Certificate (HSC) subject in Victoria, although personnel from the Education Department had little involvement in determining the nature and content of this subject [START_REF] Tatnall | The Life and Growth of Year 12 Computing in Victoria: An Ecological Model[END_REF].

It is interesting to look at reactions to this new subject from tertiary institutions, schools and the general public. Melbourne and Monash universities, which saw themselves as guardians of academic standards, rejected the subject, not allowing its inclusion in admission scores for their courses. Their stated reason for this was that the component of assessment allotted to formal examination was only 35% (rather than the more typical 50%). When pressed, some academics from these institutions admitted that they considered the subject of little serious academic worth, and 'not an appropriate subject to study at a secondary school level'. The newer universities (Deakin and La Trobe) and the CAEs did accept it as a valid study. Parents, students and employers also readily accepted the value of HSC Computer Science [START_REF] Tatnall | The Life and Growth of Year 12 Computing in Victoria: An Ecological Model[END_REF].

Teachers, however, were not universally in favour of the new subject with some claiming it to be an elitist academic subject, too difficult for some students. Others noted that the ratio of girls to boys taking Computer Science was low and suggested that it was becoming a boys' subject. Perhaps the most damaging criticism though came from those teachers who claimed that the presence of a specialist subject detracted from the use of computers across the curriculum as it put too great a strain on school computing facilities.

Support for School Computing from the Commonwealth Government

In April 1983, the Federal Minister for Education and Youth Affairs announced that the Government would set up a National Advisory Committee on Computers in Schools. In its report Teaching Learning and Computers in Schools [START_REF]Report of the National Advisory Committee on Computers in Schools[END_REF] the Committee made comprehensive recommendations covering curriculum development, professional development, support services, software/courseware, hardware and organisation. The Commonwealth also provided $18.7m in funds to support these activities.

In the early 1980s the Victorian Education Department created the State Computer Education Centre (SCEC) to support and control school computing. Financed through the Commonwealth and State Computer Education Programs, SCEC was set up in 1985 with twenty-seven full-time professional positions. SCEC played a significant role in setting the direction of educational computing in Victoria for the next three years: it developed policy, produced curriculum documents, evaluated and distributed educational software, evaluated computer hardware and produced the 'recommended list' of computer systems for use in schools, facilitated interstate contacts and the sharing of resources, conducted professional development activities and generally coordinated computer education in the state [START_REF] Tatnall | The Role of the State Computer Education Centre of Victoria, in MA[END_REF].

The Period from 1990 to the present

In relation to senior secondary school curriculum, a review in the early 1990s replaced the Higher School Certificate by the Victorian Certificate of Education (VCE) that extended over Years 11 and 12. This also saw the demise of Year 12 Computer Science and its replacement by three new subjects: Information Processing and Man-agement, Information Systems and Information Technology in Society. An additional new subject: Information Technology was offered only at Year 11.

In the 1990s computing curriculum continued to grow in the universities and at the start of this period 1,400 students were studying computing related subjects in Victorian universities. What happened in universities and schools after this time with the advent of the Internet, Web, on-line learning, laptops and smart phones is beyond the scope of this paper.

Conclusion

In this paper the three strata of the Victorian education system have been traced in the decades from 1930 to the early 1990s. It can be readily seen from this analysis that universities were the original users of electronic computers but that they had little influence on the vocationally based CAE sector. It can also be seen that the forces shaping school computing were again largely divorced from the influence of the tertiary sector. Schools in Victoria embraced the freedom afforded by the relatively low cost micro-computers and early work of pioneers within schools and the Ministry of Education had the effect of broadening the use of computers in schools beyond the rather restricted initial uses in universities.

Of course this is a little simplistic. Teachers mostly became enthused due to initial contact with computers in their university pre-service education and we have not mentioned the significant in-service education provided by Faculties of Education in the 1980s. Within these limitations it can be said that the decentralisation of school based curriculum development in the 1970s and 1980s in Victoria had a marked effect on the direction of school computing. It can also be concluded that the divergent origins of computing in CAEs and Universities lead to a distinct divergence between Computer Science at Universities and Information Systems in CAEs.

  Rapid increase in the use of micro-computers in schools.

	 1970-1979
	o Growth of CAE courses, typically using mini-computers and punched-
	cards.
	o Beginnings of school computing using mark-sense cards on mini-
	computers located at local universities.
	 1980-1989
	o 1980-1990: Introduction of the micro-computer.
	o Courses at universities and CAEs move increasingly to the use of micro-
	computers.
	o

.  1930s-1950 o From 1935: Courses in Technical Colleges on the use of punched-card Accounting/Tabulating Machines  1950-1959 o From the early 1950s: University first generation computing using mainframes with punched-cards. o Computing courses were typically offered in Departments of Mathematics and had a considerable mathematical influence.  1960-1969 o 1965: The Commonwealth Government Programmers-in-Training scheme. Beginnings of mini-computer based computing courses in the CAEs.

CSIRAC (or CSIR Mk1 as it was then called) was arguably the world's fourth of fifth digital electronic stored-program computer.

Organisation and Methods

After a series of amalgamations Caulfield Technical College became Caulfield Institute of Technology and then went on to become a part of Monash University.


Anne Gerdes
email: gerdes@sdu.dk

A Privacy preserving Design Framework in relation to an Environmental Scanning System for Fighting Organized Crime

Keywords: Privacy preserving design, engineering ethics, environmental scanning, open source intelligence, organized crime fighting

This paper represents preliminary recommendations regarding the development of a privacy preserving system design framework related to the EU project, ePOOLICE, which aims at developing an environmental scanning system for fighting organized crime by providing law enforcement agencies opportunities for strategic proactive planning in response to emerging organized crime threats. The environmental scanning is carried out on a variety of sources, focusing on early warning and the disclosure of crime trends, not on individuals. Consequently, personal data are not relevant in the information context of ePOOLICE, and therefore the system will not make use of any kind of sensitive information. Particular attention are paid to the environmental scanning of data streams from social networking sites; based on the assumption that ethical and privacy issues with regard to social media scanning represent a significant challenging scenario to meet in developing a privacy preserving framework for ePOOLICE.

Introduction

The ePOOLICE project 1 aims at developing an efficient and effective environmental scanning system as part of an early warning system for the detection of emerging organized crime threats and changes in modus operandi, focusing on e.g., illegal immigration, cocaine trafficking, human trafficking and cybercrime. In the ePOOLICE system the environmental scanning is carried out on data streams from a variety of sources, counting both open sources (e.g.; Web resources, news, statistics, libraries, research reports, and social media) and restricted sources (e.g.; hospital statistics, border traffic statistics, financial transaction statistics, narratives from police districts). Consequently, different kinds of public online data streams, including social media data streams, feeds into the system's knowledge repository that provides a rich taxonomy of domain knowledge. Moreover, data processing is facilitated by means of data analysis techniques, enabling the extraction of descriptive and predicative meanings used for inferring hidden states, i.e.; weak signals or indicators of organized crime activities. For example, one type of indicator may be an indicator of another type of organized crime; hence organized cannabis growing also indicates human trafficking (manpower for cannabis farming). ePOOLICE operates at the strategic level of open source intelligence and takes into account modus operandi and crime trends. Consequently, personal data are not relevant in the information context of ePOOLICE, and therefore the system will not intend to make use of or aggregate personal data or maintain a database for storing or managing personal data or other kinds of sensitive information.

The environmental scanning in ePOOLICE is conducted via a broad-spectrum scan of open sources; the system functions as a tool for tactical planning focusing on modus operandi, hotspot locations, crime patterns and (mega-) trends. Hence, the use context of ePOOLICE is situated at the strategic level, implying that the system does not support the operational level at all, but serves a pure preventive purpose in scaffolding sense-making activities carried out by law enforcement agents and analysts engaged in countering threats and acting proactively in dealing with upcoming trends in organized crime.

In this paper, particular focus is on threats to privacy occurring through the use of open source material from social networks; followed by an outline of preconditions for a privacy preserving design framework to be implemented in dealing with privacy issues raised by system functionalities. The reason for paying special attention to social media scanning is motivated by the fact that social networking platforms contain a vast amount of personal and or sensitive information and are typically conceived of as trusted personal networks among friends. As such, social media scanning represents a particular challenging topic to deal with in developing a privacy preserving framework for ePOOLICE. Hence, it is assumed that the type of potential ethical and privacy issues that may occur in relation to social media scanning are likely to occur in a weaker version in the scanning of other sources (e.g.; news, statistics, university research reports, demographic data). It is important to stress that all though the focus of this report is on social media scanning, this position does not entail the negligence of potential different types of privacy issues related to the scanning of other types of sources, which may require different means or techniques to solve.2

Purpose and Scope

With the above mentioned in mind, the purpose of this paper is to clarify and outline:

─ ethical and privacy issues in relation to environmental scanning of open source data streams in the shape of social networking sites. ─ an overview of privacy preserving data mining techniques, which may be applied in ePOOLICE in order to deal proactively with privacy protection in the context of environmental scanning of open source documents from social networking platforms. ─ a preliminary privacy preserving system development design framework, which meets the threats of privacy infringements or violations without hindering the knowledge discovery opportunities of the system and the end user.

Paper Structure

Section 2 represents an overview of ethical and privacy issues related to the environmental scanning of open source data streams, specifically emphasizing data streams from social networking sites. Section 3 presents an overview of the Privacy by Design paradigm and privacy enhancing methods of relevance for the development of a preliminary privacy preserving design framework. As the project progresses, this framework will be refined continuously in order to be able to balance data privacy and data utility by carrying out privacy impact assessments of tools, processes and methodologies developed. Section 4 summarizes the current findings.

Ethical and Privacy Issues in Relation to Environmental Scanning of Data Streams from Social Networking Sites

Advancements in data mining techniques used on social networking platforms have exacerbated privacy concerns. Gradually, individual citizens have become more and more transparent to a variety of actors and at the same time they have experienced a reduction in transparency with right to knowledge of what is being known about them, where and by whom. On top of this, as Web users, we contribute to our own potential de-privatization by spreading information about ourselves on the Web, i.e., by being present at social networking platforms, or by enjoying the convenience of seamless internet transactions based on personalized services in exchange for personal data. Needless to say, that this might raise privacy concerns associated with the lack of autonomy in controlling the flow of information about oneself across different contexts, as well as lack of confidentiality and trust in relying on that intended or unintended information-based harm will not occur. From a legal point of view, personal information in social networking platforms is protected by the EU Data Protection Directive (Directive 95/46/EC). The requirements of this directive with right to the anonymity of the data subject is meet in the design intentions behind ePOOLICE, since the environmental scanning of social networking sites provides a systematic approach for exploring and mapping patterns of communication and relationships among networks at a general level without singling out actors, i.e. unique data subjects. Consequently, within the overall framework of the ePOOLICE project no data subject is identified or under surveillance, and no per-sonal and intimate information per se is involved in the identification of relevant data and interpretation of relevant patterns of information and knowledge. But since personal (and often also sensitive) information is highly accessible online, the inherent risk of unintentionally identifying data-subjects during the raw data scanning process of social media is fairly high. Here, we have to bear in mind, that personal data includes information, which may identify an individual indirectly by means of different fragments of sources. Furthermore, the environmental scanning may come up with patterns of information and point to indicators that hold the potential to sort groups by race, belief, gender or sexual orientation, etc. Still, when based on objective statistical analysis, the use of criminal profiling by law enforcement agencies is legal. Nevertheless, following the precautionary principle, we need to stress the importance of avoiding potential discrimination, which affords categorization of people into damaging stereotypes.

Even though environmental scanning may slip under the radar of legal privacy restrictions, social media scanning may still imply privacy discomfort among people, due to privacy concerns regarding information traffic across contexts representing distinctive spheres in life. Users on social networking platforms are typically aware that data shared on social media (such as Facebook and Twitter) resides in a public or semi-public sphere. Applying privacy settings may well decrease the group of people with access to your data, but still not hinder that data are spread to others. But we cannot per default presume that people, when engaging in producing and sharing online content on social media platforms (Facebook, Twitter or blogs) do not have any expectations of privacy. All though users are aware that data are to some extent public it is reasonable to assume that they probably do not expect their online content to be made available as raw data set for environmental scanning. Consequently we may refer to informational privacy as individuals' ability to control the flow of personal information, including how information is exchanged and transferred [START_REF] Tavani | Informational privacy, data mining, and the internet[END_REF].

A justificatory conceptual framework, for the systematic exploration of people's reactions to technology can be found in Nissenbaum [START_REF] Nissenbaum | Privacy in Context -Technology, Policy and the Integrity of Social Life[END_REF], who has coined the term "contextual integrity" in order to explain for and tie adequate protection against informational moral wrongdoing. According to Nissenbaum, information flows always have to be seen in relation to context-sensitive norms, representing a function of: (1) the types of information in case, (2) the respectively roles of communicators, and (3) principles for information distribution between the parties. Consequently, contextual integrity is defined, not as a right to control over information, but as a right to appropriate flows of personal information in contexts with right to two norms [9: 127 ff]: Norms of "appropriateness" and norms of "distribution", i.e., the moment of transfer of information from part X toY 1…n. Violations of one of these norms represent a privacy infringement [START_REF] Nissenbaum | Privacy in Context -Technology, Policy and the Integrity of Social Life[END_REF].

In the case of ePOOLICE, new flows of information are established and may cause a potential violation of contextual integrity, since information gathering via environmental scanning of communication streams on social networking sites may possibly be judged inappropriate to that context and violate the ordinary governing norms of distribution within it. Likewise, the width spread scope of the scanning may raise concern among citizens. Here, we have to strike a balance, which can ensure that the infringement of privacy is minimally invasive for human rights without obstructing the opportunities for the intended aim of open source intelligence.

In ePOOLICE, social media data streams feed into the system's knowledge repository that provides a rich taxonomy of domain knowledge and facilitates data processing through fusion techniques 3 , which enable the extraction of descriptive and predicative meanings used for inferring hidden states, i.e.; weak signals or indicators of organized crime activities. All though a human analyst evaluates all system output, a risk still exist that the knowledge discovery techniques to disclose emergent trends in social network data streams may deduce patterns that could be sensitive. Also, the aggregation power and scope of ePOOLICE facilitates analysts' reasoning, but at the same time requires that the analyst is particular careful in the evaluation of possible emergent patterns and predictive meanings in order not to get "carried away" by the knowledge discovery power of the system.

To summarize, in the development phase of ePOOLICE, the privacy preserving framework of ePOOLICE must balance data privacy and data utility in addressing:

1. the risk of unintended identification of individuals (data subjects) during the social media scanning. 2. the risk of disclosure of sensitive patterns due to the data analysis techniques applied. 3. citizens' surveillance concerns raised by social media scanning.

Points 1 and 2 are situated at the level of technical system development, whereas point 3 resides at the societal level. Also, but beyond the scope of this paper, the institutional and organizational level have to be dealt with in order to address ethical and privacy issues, which may arise in the use context of ePOOLICE. The abovementioned list will be extended during the project life time with the aim of systematically identifying and meeting future challenges as the development of ePOOLICE progresses (see www.ePOOLICE.eu).

Overview of the Privacy by Design Paradigm and Privacy Preserving Methods

The concept Privacy by design (PbD) was coined by the Canadian information and privacy commissioner Ann Cavoukian [START_REF] Cavoukian | /privacybydesign.ca[END_REF]. The philosophy behind PbD stresses the importance of pro-actively building privacy into the design, operation and management of information processing technologies and systems. To accomplish this, the following 7 fundamental principles are listed [START_REF] Cavoukian | /privacybydesign.ca[END_REF]: These principles, taken together with the legal requirements, will form the basis of the privacy preserving framework of ePOOLICE.

 "Proactive
As such, ePOOLICE has to be developed in legal compliance with EU member states privacy legislation. At the international level, the European Convention for the Protection of Human Rights and Fundamental Freedom (ECHR), which the European charter of Human Rights is based feeds into the local laws of EU member states and stresses the importance of the citizens' right to privacy and protection of personal data. Likewise, the Code of Fair Information Practices (which dates back to the 1973 report from the US Secretary's Advisory Committee on Automated Personal Data Systems, the U.S. Department of Health, Education and Welfare) expresses five fundamental principles of data management and record keeping, which still encapsulate the core of subsequent privacy guidelines. Hence, the Convention for the Protection of Individuals with right to Automatic processing of Personal Data (Council of Europe, 1981) positions data protection as a fundamental right, subsequently backed up by the Data Protection Directive (Directive 95/46/EC), to which member states national legislations are aligned. This directive is currently undergoing transformation and the status of the new directive is not yet settled. Also, the non-binding OECD Guidelines of Protection of Privacy and Transborder Flows of Personal Data (1980, revised in 1999) codifies eight internationally agreed upon principles related to fair information practices. Main elements in these FIPs guidelines and regulations are:

 The principle of fair and lawfulnessthe processing must be legitimate and pursue specified purposes; data must be adequate, relevant, not excessive; accurate and up to date, and not stored for longer than necessary  The principle of processing legitimacy: stresses the necessity to obtain the data subject's consentsome exceptions do exist (exhaustively listed)  The principle of prohibition to process sensitive data (unless exceptions exhaustively listed: explicit consent of the data subject, if the data have been made public by the data subject)  The principle of the rights of the data subject: including rights of access, rectification, erasure; to opt out, to not be subject to a decision based on some automatic processing)  The principle of confidentiality and security of the data processed  The principle of obligation to notify the supervisory authority (declaration or authorization)  The principle of accountability of the data controller  The principle of adequate level of protection in case of data transfer to third countries

In combination with legislation of member states, Principles of fair information practices (FIPs) and the PbD principles provide a useful guide for the development of a privacy preserving framework, which may be achieved by building the FIPs and the PbD-principles into all relevant phases of the ePOOLICE system's life cycle.

Preliminary outline of a privacy preserving framework and privacy preserving methods

A privacy preserving framework must be set up for in order to inscribe privacy in all design and developmental phases of of ePOOLICE. In what follows, I intend to elaborate on how to meet privacy challenges relevant in the context of social media scanning by addressing the above mentioned 3 points summarising privacy risks (section 2) and by briefly pointing to the PIA methodology.

Addressing the risk of unintended identification of data subjects during the raw social media scanning

The environmental scanning system moves across and filters all potentially relevant information sources and maintains and "learns" which patterns to look for, where to look and how reliable the source is, and mark the credibility of the information. In order to focus the scanning process, the environmental knowledge repository (EKR) represents a dynamic ontology of domain knowledge. Hence, in the EKR, domain knowledge is going to be stored temporary with the risk that data fragments might facilitate identification of data subjects. Therefore, use of filter techniques for hiding data or knowledge patterns, which disclose data subjects must be in place. The scanning is further facilitated by fusion techniques (a fusion tool box) used for knowledge discovery with the purpose of forming hypotheses about patterns of weak signals suggesting emergent trends in organized crime. ePOOLICE does not collect intelligence to be used at an operational level for finding or monitoring individual suspects. Still, issues of potential misuse have to be dealt with, especially in the case of social media scanning, since it is unavoidable that the raw data streams from social media scanning will include personal data about both direct (i.e. name, address) and indirectly identifiable individuals (i.e. photos). Here an attack model representing a scenario of the aim of a malicious individual or party may inform system design with the aim of protecting data from any kind of misuse -such as "mission creep", implying that data are used for other purposes than the purpose for which they were collected, or privacy breaches violating individuals' privacy. Therefore, the system developers must define categories of disproportionate analytical queries, from which alert-systems may be designed such as to automatically block processing in case of attempt of illegal processing. Also, system functionalities must be in place in order to permit management of different user-levels of authorization. Consequently, logging of system access and processes applied may ensure tracking of possible unauthorized use of data and further support control procedures by internal data controllers as well as by independent authorities. Anonymization techniques have to be brought to play to ensure that no personal or sensitive data are available in the data material from social media scanning [START_REF] Vimercati | Data Privacy: Definitions and Techniques[END_REF]. According to the EU data directive 1995/46/EC, all means likely reasonable to be used either by the data controller or by any other person to identify a said person should be taken into account in order to determine if a person is identifiable. Hence, to minimize the risk of identifying a person, anonymization techniques may be applied to obtain individual privacy, but this is not a trivial task. As such, simply removing direct identifiers is not sufficient to yield anonymity. For instance k-anonymity hides a unique individual among k-1 others, thereby disclosing the real data by transforming them in a way which makes impossible the re-identification under a fixed anonymity threshold. But this technique does not provide privacy in cases where sensitive values in an equivalence-class lack diversity [START_REF] Machanavajjhala | ℓ-Diversity: Privacy Beyond k-Anonymity[END_REF] for instance data regarding age, health and zipcode may for a given class be equivalent and thereby unintentionally support reidentification. Hence, examples of re-identification from seemingly anonymous data have been described. As an example, Sweeney managed to re-identify the medical record of the governor of Massachusetts [START_REF] Sweeney | K-anonymity: a model for protecting privacy[END_REF]. Also, the AOL search record of a user linked to a photo re-identified the person [START_REF] Barboro | A Face Is Exposed for AOL Searcher NO. 4417749[END_REF].

Obviously, anonymization in the context of ePOOLICE is challenging. However, to safeguard the system against misuse, which may reveal the identity of individuals, ePOOLICE must take steps to apply a privacy preserving framework, which allows for the anonymization of data and the build in of alert and blocking systems, which restrain potential misuse of data.

Addressing the risk of disclosure of sensitive patterns due to the data analysis techniques applied

Fusion techniques in ePOOLICE are used for inferring hidden states with the purpose of predicting emerging trends in organized crime (OC). Hence, in applying the knowledge discovery technique referred to as formal concept analyses, the aim is to discover as many signals of indicators as possible for new OC treats. Also, the idea of primary and secondary indicators will be qualified by the notion of temporal proximity, i.e. by paying attention to primary indicators as those associated with emerging or ongoing OC, considered short range radar detection, which equals detection monitoring. On the other hand, secondary indicators are associated with the opportunity for OC before it occurs, i.e. facilitators for new OC threats and part of a long radar detection system, which equals situation monitoring.

In order to enhance the recognition of weak signals and predictive meanings, the fusion tool box in ePOOLICE employs "soft fusion" techniques, which combine automated fusion and human fusion processes, thereby enabling utilization of experts abilities to interpret signals and identify complex patterns. Furthermore, decentralized fusion is introduced to support modular solutions, whereby complex fusion systems can be build and distributed over multiple devices. Environmental scanning, facilitated by such fusion products, provides the system with the kind of knowledge discovery power, which enables it to spot emergent patterns and weak signals of OC. As such, the system extracts predictive meanings, which exceed the scope of the original data set. These findings are subsequently presented to and evaluated by the analyst in order to scaffold further analysis and the forming of hypotheses.

Issues related to the use of fusion to infer hidden states raise serious concerns regarding surveillance since the linking of different forms of data from the scanning of social network interactions may possible be invasive to the privacy of individuals or groups. Moreover, social networking data are semantically rich, which makes anonymization a demanding task in the first place, since the extra semantics facilitates linking such data to background knowledge with the risk of disclosing sensitive data. Hence, knowledge discovery tools, i.e.; fusion techniques for linking data, infringe upon individuals and groups control of how information relating to them, their interactions and their networks are represented, and subsequently what patterns of predictive meanings can be inferred from such fused information.

With the development of advanced fusion techniques in ePOOLCE, the inference problem increases, i.e., the problem known from challenges in securing databases from having users to pose queries and deduce unauthorized information from the legitimate responses they get from the database [15]. Taking into account the concept of contextual integrity, we may find parallels between the inference problem and the possible treats to privacy from social media scanning and applied fusion techniques in ePOOLICE. For example, analysts may infer sensitive hypotheses, implying the potential identification of an individual. Consequently, to ensure that sensitive hypotheses cannot be deduced from social media scanning, methods of inference control must be taken into consideration.

To sum up, the development of the system must take proper steps to ensure that every phase in the data processingall way through from the handling of raw social media data to the final extraction of predictive patterns -avoid identification of data subjects. Likewise, the challenge that reverse engineering techniques could disclose data subjects must be addressed in a way that balance privacy and traceability, since, in some situations, tracking is necessary in order to evaluate the credibility of system output. Hence, to a restricted group of users (data controllers) this option must be available even at the risk of disclosing fragmented data, which may identify data subjects.

Addressing citizens' surveillance concerns raised by social media scanning

Privacy issues in ePOOLICE may be adequately dealt with from a legal perspective and still yield privacy concerns due to the fact that alterations in flows of information may lead to violation of contextual integrity (see above, section 2). As mentioned above, users on social network sites may feel intimidated from learning that their online interactions serve as raw material for social media scanning. Hence, the overall judgment of ethical implications related to ePOOLICE goes beyond the scope of a standalone privacy evaluation of the system, implying that the context-sensitive tradeoff between privacy and security and citizens' right has to be taken into consideration as well.

From a public point of view, an example of European citizens' opinion on privacy and security issues can be found in a participatory technology assessment, which con-cludes that citizens are open to legitimate security measures for crime prevention, whereas reference to terror treats does not justify privacy limitations for most citizens [12: 26 ff]. Consequently, it seems to be the case that people are prepared to value security over legitimate restrictions of informational privacy in specific contexts reflecting individual dimensions of security. To elaborate on this from a legal point of view, any limitation to fundamental rights of privacy and personal data protection has to respect some basic principles in order to be legitimate and ensure that privacy is not violated. As such, limitations have to rest on a legal basis and must be formulated with such a degree of precision that it enables citizens to understand how their navigation and conduct in society are affected by the given limitation. Moreover, a restriction must pursue a legitimate aim, i.e., be in accordance with listed legitimate aims, formulated within each article of rights in the ECHR, as aims that justify interference. Furthermore, any limitation must correspond to a real need of society and must be seen as an efficient instrument (for instance in relation to crime reduction and security). Finally, the principle of proportionality seeks to guarantee that the limitation is balanced to the aim pursued. In order to minimize the infringement of privacy rights and to assess the proportionality of a restriction, the main issues to settle are whether the overall effect of the constraint is reasonable and whether it is the least intrusive mean available. Here, to ensure that privacy is not violated, the ePOOLICE project must see to that the requirement of proportionality of the privacy restriction is satisfied. Given these circumstances, the ePOOLICE project strives to enhance both privacy and security by introducing pro-active privacy preserving design principles throughout all stages of the development process. In this way, the project seeks to develop technological solutions that support privacy compliant use.

Yet, a problem still resides in the fact that an assessment of proportionality is not easy to deal with in a precise manner. Judging whether the privacy interference caused by ePOOLICE is a suitable, necessary and adequate mean for fighting organized crime on a strategic level, implies, among other things, a measurement of security gains. But, security advantages are not easy to calculateneither ahead nor expost. Hence, from the fact that security technologies have proved to be effective, we cannot presuppose this outcome for ePOOLICE in advance. Also, if it turns out to be the case, ex-post, that we observe a decline in organized crime after the implementation of ePOOLICE, we still need to carry out a thorough evaluation to justify if and how ePOOLICE contributed to this outcome.

Nevertheless, in the case of ePOOLICE, and taking into consideration the recent focus on intelligence surveillance (the NSA surveillance case), we need to emphasis the importance of transparency. In general, when dealing with intelligence, citizens express concerns about the fact that they do not have insight in how information about them is used and for what purpose. During the system development phase, it is of outmost importance to find ways to enter into dialogue with European citizens in order to disseminate awareness about the ePOOLICE project.

General Recommendations for Setting up a Privacy Preserving Framework

In order to fully integrate privacy by design per default into the design process, the ePOOLICE project has established an ETHIC-TECH team consisting of consortium members (system developers and members with legal and ethical expertise) 4 . Accordingly, it is of outmost importance to make room for dialogue between engineers and experts in law and ethics in order to enact ethics during the system development process. Understanding the ethical impact of systems in context implies engaging in what Nissenbaum -who together with Friedman [START_REF] Friedman | Human Values, Ethics and Design[END_REF], is one of the leading figures in the field of value sensitive design (see for instance: [START_REF] Flanagan | Enbodying Values in Technology: Theory and Practice[END_REF], [START_REF] Nissenbaum | Values in technical design[END_REF]) -coins "engineering activism" [START_REF] Nissenbaum | How computer systems embody values[END_REF], and Van Hoven addresses as "front-loading ethics" [START_REF] Van Den Hoven | ICT and Value Sensitive Design[END_REF] in proposing a proactive approach to bring ethics to design. This ideal of activating ethical expertise in order to improve system development is encapsulated in the below mentioned quotation by Nissenbaum [START_REF] Nissenbaum | How computer systems embody values[END_REF]:

"Humanists and social scientists can no longer bracket technical details -leaving them to someone else -as they focus on the social effects of technology. Fastidious attention to the before-and-after picture, however richly painted, is not enough. Sometimes a fine-grained understanding of systems -even down to gritty details of architecture, algorithm, code, and possibly the underlying physical characteristics -plays an essential part in describing and explaining the social, ethical, and political dimensions of new information technologies."

Consequently, the overall objective of the ETHIC-TECH team is to scaffold activities within the privacy preserving design framework of ePOOLICE, with the purpose of striking a balance between data utility and data privacy. Hence, the privacy preserving framework is implemented in the scientific and technical coordination of the project to ensure that the project work flow of ePOOLICE incorporates a robust practice, which integrates ethical evaluation of tools, processes and techniques developed and or applied during the system development process. This is done with the aim of identifying and countering privacy threats without diminishing the knowledge discovery opportunities, which are essential to the project. Moreover, regular privacy assessments (PIAs) of potential privacy risks must be carried out in order to minimize negative privacy impacts in deliberation with relevant stakeholders [START_REF] Hert | Recommendations for a privacy impact assessment framework for the European Union, PIAF (Privacy Impact Assessment Framework) project[END_REF]. In ePOOLICE we will make use of the data protection impact assessment (DPIA), which has been defined by the European Commission as a tool for evaluating potential privacy risks in relation to data processing 5 . For the time being, there is no standard to carry out PIA or DPIA since different methodologies coexists. Hence, in order to build in specific methodologies for ePOOLICE, in addition to risk methodologies, we will take

Concluding Remarks

In this paper, special attention has been paid to ethical and privacy issues related to social media scanning due to the fact that this type of environmental scanning is taken to be particular demanding in connection to the ePOOLICE project. All though personal data are not relevant and no database are maintained for storing or mining personal and or sensitive data, privacy issues still arise. Hence, the risk of misuse, the risk of unintended identification of individuals and the risk of disclosure of sensitive patterns of information must be dealt with adequately by inscribing privacy preserving techniques into the design of ePOOLICE. Furthermore, due to citizens' general surveillance concerns related to intelligence, it is imperative to promote transparency about the ePOOLICE project. The implementation of privacy protection in the design is not a trivial task. Therefore, a privacy preserving framework shall incorporate ethical evaluation of tools, processes and techniques developed all through the system development process. In accordance with the Privacy by Design philosophy, it is important to balance data utility and data privacy in order to meet privacy threats without obstructing the knowledge discovery opportunities in ePOOLICE.

Project full title: "early Pursuit against Organized crime using envirOnmental scanning, the Law and IntelligenCE systems". Grant agreement no: 312651, THEME [SEC-2012.6.3-1]:[Developing an efficient and effective environmental scanning system as part of the early warning system for the detection of emerging organised crime threats -Capability Project].

For example, privacy preserving methods suitable for social networking data streams would not be suitable for trajectory data.

Fusion techniques use converted data from diverse sources, such as multi-source and multilingual information, which includes credibility assessment, with the purpose of disclosing patterns or correlations.

Also, an external ethical advisory board with European experts on legal and ethical issues is in place.

Commision recommendation, March, 9 th , 2012, regarding preparations for the rollout of smart meterings systems (2012/148/EU), §I, 3 (c.), See: http://eurlex.europa.eu/LexUriServ/LexUriServ.do?uri=OJ:L:2012:073:0009:0022:EN:PDF

Acknowledgments

The author would like to thank Estelle De Marco, Inthemis Managing Director, for fruitful collaboration on the ePOOLICE project as well as for valuable comments, which helped shape this article.

Research leading to these results has received funding from the European Union's Seventh Framework Programme (FP7/2007-2013) under grant agreement n° 312651.