Keywords: Prejudice, Islam, Attitudes, Racism, Discrimination, Contact Prejudice, Islam, Contact, Anxiety, Discrimination, Muslim

Numerous studies have reported an increase in prejudice against Muslims in recent years. Less research has investigated how this increase might be stemmed and relations between non-Muslims and Muslims improved. In this article, we address prejudice against Muslims from the perspective of intergroup contact theory. We conducted two cross-sectional studies to examine the relationship between non-Muslims' experiences of contact with Muslims and their intergroup anxiety, outgroup attitudes, perceptions of outgroup variability and intergroup behavioural intentions. Study 1 (N = 58) showed that frequent high-quality contact with Muslims predicted more positive outgroup attitudes, more perceived outgroup variability and more positive behavioural intentions. These associations were mediated by intergroup anxiety. Study 2 (N = 60) replicated these effects and additionally showed that anxiety mediates the influence of extended contact on the same outcome measures. Discussion focuses on the implications of the results for strategies aimed at improving relations between non-Muslims and Muslims.

3 "The prosecution case is that both these defendants…were terrorists motivated by their belief in a fundamental form of Islam. It is essential that the jury that is to try them makes its decisions based solely on the evidence it hears and it is given in this court and not based on any prejudices, beliefs or personal opinions the members of the jury may have."

Mr Justice Mackay -Addressing potential jurors at the trial of Bilal Abdulla and Mohammed Asha 8 th [START_REF] Baron | The moderator-mediator variable distinction in social psychological research: Conceptual, strategic, and statistical considerations[END_REF] On the 29 th June 2007, two car bombs were discovered in London's west end.

Fortunately, attempts to detonate the bombs were unsuccessful. The following day, there was a related unsuccessful suicide bomb attack on Glasgow Airport. While one of the attempted suicide bombers, Kafeel Ahmed, died from injuries sustained during the attack, Bilal Abdulla and Mohammed Asha were charged with conspiracy to murder and to cause explosions with the intent of endangering life. Asha was later found not guilty and acquitted, whereas Abdulla was jailed for a minimum of 32 years for his part in the attempted terrorist attacks. All men were Muslim, and as such, the attacks have been linked to Al Qaeda influenced terrorism (BBC Online 2008).

With the attempted London and Glasgow bombings just two of a number of planned terrorist acts to be linked to violent extremist interpretations of Islam, Muslims worldwide face prejudice in the current climate (as stressed by Mr Justice Mackay). 1 In the USA, following the events of September 11 th , 2001, hate crimes against Arabs 2 and Muslims increased by 1700% (Federal Bureau of Investigation crime statistics, cited in Sheridan and Gillett 2005). In Europe, significant increases we broadened our investigation to additionally examine extended contact [START_REF] Wright | The extended contact effect: Knowledge of cross-group friendships and prejudice[END_REF].

Intergroup contact hypothesis

The intergroup contact hypothesis [START_REF] Allport | The nature of prejudice[END_REF] proposes that contact with individual members of an outgroup can improve intergroup attitudes and reduce prejudice. [START_REF] Allport | The nature of prejudice[END_REF] argued that for contact to be effective in reducing prejudice at least four situational conditions must be met. First, the contact must occur in a situation of equal status. Second, the groups must have shared goals. Third, attainment of such goals must involve intergroup cooperation. Finally, the initiative must have the support of relevant institutions and authorities. [START_REF] Pettigrew | Intergroup contact: Theory, research and new perspectives[END_REF] later proposed an additional key condition, arguing that the contact situation must allow the opportunity for friendships to develop.

Since its original formulation, a considerable amount of research has investigated whether the proposed prerequisite conditions are sufficient, or indeed necessary, for contact to reduce prejudice. In a meta-analysis of 515 laboratory and field studies, [START_REF] Pettigrew | A meta-analytic test of intergroup contact theory[END_REF] demonstrated that even when the proposed prerequisite conditions are not in place, contact reduces prejudice. However, in those studies with optimal contact conditions, even lower levels of prejudice were reported.

The majority of studies in the intergroup contact framework have investigated the effects of contact on attitudes or other affective/evaluative outcome measures.

This has been extended in recent years to additionally examine perceived group variability, which refers to the extent to which individual group members are seen as similar or distinct from one another [START_REF] Park | Measures and models of perceived group variability[END_REF]. Research suggests that people often perceive outgroups as more homogenous and undifferentiated than their ingroup (e.g., [START_REF] Quattrone | The perception of variability within in-groups and out-groups: Implications for the law of small numbers[END_REF][START_REF] Ostrom | Out-group homogeneity effects in natural and minimal groups[END_REF]. Although there is evidence to suggest that perceived homogeneity may, in certain situations, be valued (Hutchison et al. 2006), perceiving the outgroup as homogeneous is more often associated with negative stereotypes and unfavourable attitudes [START_REF] Allport | The nature of prejudice[END_REF].

Several studies have demonstrated that frequent high-quality contact with outgroup members can increase the perception of outgroup variability. [START_REF] Islam | Dimension of contact as predictors of intergroup anxiety, perceived outgroup variability and outgroup attitudes: An integrative model[END_REF] investigated contact between Muslims and Hindus in Bangladesh and found that the more positive contact with outgroup members that respondents experienced, the more favourable their attitudes and the greater their perceptions of outgroup variability. [START_REF] Paolini | Effects of direct and indirect cross-group friendships on judgements of Catholics and Protestants in Northern Ireland: The mediating role of an anxiety-reduction mechanism[END_REF] investigated contact between Catholics and Protestants in Northern Ireland and found that contact was negatively associated with prejudice and positively associated with perceived outgroup variability. Along similar lines, [START_REF] Voci | Intergroup contact and prejudice toward immigrants in Italy: The meditational role of anxiety and the moderational role of group salience[END_REF] investigated contact between Italian students and African immigrants and found that contact was positively associated with more positive outgroup attitudes and more perceived outgroup variability. As Voci and Hewstone argued, while an increase in perceived outgroup variability does not represent a decrease in actual prejudice, it may act as a step towards reducing negative outgroup stereotypes and improving intergroup relations.

As well as outgroup attitudes and perceived outgroup variability, in the present studies we also investigated the relationship between contact and intergroup behavioural intentions. Research has consistently demonstrated that behavioural intentions are a stronger predictor of a range of behaviours than are general attitudes (e.g., [START_REF] Albarracin | Theories of reasoned action and planned behavior as models of condom use: A meta-analysis[END_REF]. A meta-analysis conducted by [START_REF] Sutton | Predicting and explaining intentions and behavior: How well are we doing?[END_REF] confirmed that behavioural intentions generally predict between 19 and 38 per cent of the variance in actual behaviour, leading the author to conclude that intentions to engage in a particular behaviour are both the immediate antecedent and single best predictor In one study, [START_REF] Viki | Race and willingness to cooperate with the police: The role of quality of contact, attitudes towards the behaviour and subjective norms[END_REF] investigated contact with the police among a sample of students in the UK and found that the better the quality of contact that Black respondents experienced with the police, the more positive their attitudes towards assisting the police and the greater their intentions to cooperate with police investigations. Along similar lines, [START_REF] Tam | Intergroup trust in Northern Ireland[END_REF] investigated contact between Catholics and Protestants in Northern Ireland and found that frequent high-quality contact predicted greater intergroup trust, more favourable outgroup attitudes and more positive intergroup behavioural "tendencies" (e.g., the intention to find out more about the outgroup). The present research extends this previous work by investigating the role of intergroup anxiety as a mediator between non-Muslim respondents' experiences of contact with Muslims and their behavioural intentions towards Muslims.

Intergroup anxiety as a mediator of contact effects

Having confirmed that intergroup contact can reduce prejudice, recent research has attempted to establish mediators of the contact effect. One mediator receiving considerable attention is intergroup anxiety, which refers to the negative affective feeling often experienced during actual or anticipated intergroup contact [START_REF] Stephan | Intergroup anxiety[END_REF]. According to [START_REF] Stephan | Intergroup anxiety[END_REF], intergroup anxiety can result from negative outcome expectancies -e.g., expectations that intergroup interactions will lead to embarrassment or rejection or that one's behaviour will come across as prejudiced [START_REF] Plant | The antecedents and implications of interracial anxiety[END_REF]. Situations especially likely to generate intergroup anxiety include those where there has been little or no previous [START_REF] Stephan | Intergroup anxiety[END_REF]Stephan and Renfro 2002).

Research suggests that anxiety of this type can suppress the potential beneficial effect of contact in reducing prejudice. It can also lead to hostility and avoidance of contact situations [START_REF] Plant | The antecedents and implications of interracial anxiety[END_REF]Hutchison et al. in press) and an increased reliance on stereotypes [START_REF] Stephan | Intergroup anxiety[END_REF][START_REF] Wilder | Effects of anxiety on impression formation in a group context: An anxiety-assimilation hypothesis[END_REF].

Following positive contact, however, anxiety about future intergroup interactions is often reduced (e.g., [START_REF] Islam | Dimension of contact as predictors of intergroup anxiety, perceived outgroup variability and outgroup attitudes: An integrative model[END_REF]Bousfield and Hutchison, 2010).

Although we are aware of no research that has investigated whether intergroup anxiety mediates between contact and behavioural intentions, anxiety has previously been established as a mediator of the effect of contact on outgroup attitudes and perceived outgroup variability. [START_REF] Voci | Intergroup contact and prejudice toward immigrants in Italy: The meditational role of anxiety and the moderational role of group salience[END_REF] found that anxiety mediated the positive effect of contact on Italians' attitudes towards African immigrants. In their study of contact between Muslims and Hindus, [START_REF] Islam | Dimension of contact as predictors of intergroup anxiety, perceived outgroup variability and outgroup attitudes: An integrative model[END_REF] found that anxiety mediated the positive effect of contact on outgroup attitudes and perceived outgroup variability. Similarly, in their study of contact between White schoolchildren and South Asians in the UK, [START_REF] Turner | Reducing explicit and implicit outgroup prejudice via direct and extended contact: The mediating role of self-disclosure and intergroup anxiety[END_REF] showed that anxiety, along with self-disclosure, mediated the positive association between contact and outgroup attitudes. 2001 and claims that it is sustained by (often media-generated) anxieties about issues related to national security, asylum seekers, and the potential for further 'homegrown' terrorist attacks [START_REF] Phillips | Parallel lives? Challenging discourses of British Muslim selfsegregation[END_REF][START_REF] Sheridan | Islamophobia pre-and post-September 11th, 2001[END_REF]).

In the present research, we investigate whether different types of contact with Muslims are associated with non-Muslim respondents' anxiety about interacting with Muslims and whether this anxiety in turn influences their outgroup attitudes, perceptions of outgroup variability and intergroup behavioural intentions.

The current research

We conducted two studies with samples of non-Muslims in London to investigate the relationship between their experiences of contact with Muslims and their intergroup anxiety, outgroup attitudes, perceptions of outgroup variability and intergroup behavioural intentions. Study 1 investigated the effects on these variables of contact quantity and contact quality. In Study 2, we broadened our investigation to additionally examine extended contact. The extended contact hypothesis [START_REF] Wright | The extended contact effect: Knowledge of cross-group friendships and prejudice[END_REF] proposes that knowing an ingroup member has an outgroup friend can lead to more favourable outgroup attitudes, and several studies have illustrated the effectiveness of extended contact in improving intergroup attitudes and increasing perceptions of variability among outgroup members [START_REF] Wright | The extended contact effect: Knowledge of cross-group friendships and prejudice[END_REF][START_REF] Liebkind | Extended contact through peer modelling to promote tolerance in Finland[END_REF][START_REF] Paolini | Effects of direct and indirect cross-group friendships on judgements of Catholics and Protestants in Northern Ireland: The mediating role of an anxiety-reduction mechanism[END_REF]Turner et al. 2007;[START_REF] Turner | A test of the extended contact hypothesis: The mediating role of intergroup anxiety, perceived ingroup and outgroup norms, and inclusion of the outgroup in the self[END_REF]. In Study 2, as well as outgroup attitudes and perceived outgroup variability, we also investigated the relationship between extended contact and non-Muslims' behavioural intentions towards Muslims.

Study 1

Page 9 of 37 URL: http://mc.manuscriptcentral.com/rers ethnic@surrey.ac.uk Study 1 examined the relationship between non-Muslim respondents' experiences of contact with Muslims and their perceptions of and attitudes and behavioural intentions towards Muslims. We examined the effects on these variables of contact quantity and contact quality. Drawing on the lines of research described above, it was predicted that more frequent high-quality contact with Muslims would be associated with more positive outgroup attitudes, more perceived outgroup variability and more positive behavioural intentions towards Muslims. Additionally, it was predicted that the positive effect of contact on each of these outcome variables would be mediated by variations in intergroup anxiety.

Method

Participants

Fifty-eight students at a London university participated on a voluntary basis. None of the participants were Muslim. Twenty-seven were male and thirty-one were female.

Ages ranged from 19 to 62 with a mean age of 28.35 years (SD = 9.88). As neither gender nor age had an effect in the analyses reported below, these variables are not considered further. 3

Materials and procedure

Participants were approached on a university campus and asked to participate in a study investigating how people form impressions of others. 4 Those who agreed were handed a questionnaire containing all instructions and measures, which were presented in the same order as described below. Unless stated otherwise, responses to all items were recorded on a scale ranging from 1 (strongly disagree) to 5 (strongly agree). After they had completed the questionnaire, participants were thanked and debriefed.

Results and Discussion

Correlation analyses

Table 1 depicts the means, standard deviations and correlations among the measures.

As indicated in this table, contact quantity, contact quality and the multiplicative intergroup contact index (referred to from this point on as intergroup contact) were all related to the outcome measures in ways predicted by contact theory [START_REF] Allport | The nature of prejudice[END_REF]. All three contact measures were positively associated with outgroup attitudes, perceived outgroup variability and intergroup behavioural intentions, and were negatively associated with intergroup anxiety. Additionally, intergroup anxiety was negatively related to outgroup attitudes, perceived outgroup variability and intergroup behavioural intentions.

_ _ _ _ _ _ _ _ _ _ _ _ Table 1 about here _ _ _ _ _ _ _ _ _ _ _ _

Mediation analyses

We conducted mediation analyses to assess whether the associations between intergroup contact and the outcome measures were mediated by variations in [START_REF] Baron | The moderator-mediator variable distinction in social psychological research: Conceptual, strategic, and statistical considerations[END_REF], this involved (1) regressing each of the outcome measures on the predictor variable (intergroup contact), (2) regressing the mediator (intergroup anxiety) on the predictor variable, and (3) regressing each of the outcome measures in turn on the predictor variable and the mediator. For mediation to be present there must be a significant relationship between the mediator and the predictor variable, and when the outcome measure is regressed on both the mediator and the predictor variable, a previously significant relationship between the predictor and outcome measure should be significantly reduced (partial mediation) or rendered non-significant (full mediation).

_ _ _ _ _ _ _ _ _ _ _ _ Table 2 about here _ _ _ _ _ _ _ _ _ _ _ _
The regression analyses confirmed the direct associations between the variables reported in Table 1. Indirect associations between the predictor and outcome measures (entered with the mediator) and between the mediator and the outcome measures (entered with the predictor) are presented in Table 2. As this table indicates, previously significant relationships between intergroup contact and each of the outcome measures were reduced to a non-significant level (perceived outgroup variability, intergroup behavioural intentions) or significantly reduced (outgroup attitudes) when intergroup anxiety was also included as a predictor in the analysis.

Sobel tests [START_REF] Preacher | Calculation for the Sobel test: An interactive calculation tool for mediation tests[END_REF] confirmed that these reductions were significant (outgroup attitudes: z = 2.54, p = .011; perceived outgroup variability: z = 2.69, p = .007; intergroup behavioural intentions: z = 3.53, p < .001). In all cases, intergroup anxiety remained a significant predictor when intergroup contact was also included as a predictor in the analysis. [START_REF] Pettigrew | How does intergroup contact reduce prejudice? Meta-analytic tests of three mediators[END_REF]. In addition, the findings extend the role of anxiety as a mediator of contact effects on outgroup attitudes and perceived outgroup variability, to also include intergroup behavioural intentions. We conducted a second study to test the robustness of these effects and also to investigate whether extended contact [START_REF] Wright | The extended contact effect: Knowledge of cross-group friendships and prejudice[END_REF] with Muslims might have similar positive effects on non-Muslim respondents' perceptions of and attitudes and behavioural intentions towards Muslims.

Study 2

Despite the obvious benefits of contact in reducing prejudice, a limitation with the contact hypothesis in its original formation [START_REF] Allport | The nature of prejudice[END_REF] is the requirement that members of opposing groups must have the opportunity for positive contact in the first place. In some situations, this may be impractical or even impossible. [START_REF] Wright | The extended contact effect: Knowledge of cross-group friendships and prejudice[END_REF]).

The extended contact hypothesis [START_REF] Wright | The extended contact effect: Knowledge of cross-group friendships and prejudice[END_REF] proposes that knowing that an ingroup member has a positive relationship with an outgroup member can improve attitudes towards the outgroup as a whole and set the grounds for more positive intergroup relations. The benefits of extended contact in improving intergroup attitudes and increasing the perception of outgroup variability are now well established [START_REF] Wright | The extended contact effect: Knowledge of cross-group friendships and prejudice[END_REF][START_REF] Liebkind | Extended contact through peer modelling to promote tolerance in Finland[END_REF][START_REF] Paolini | Effects of direct and indirect cross-group friendships on judgements of Catholics and Protestants in Northern Ireland: The mediating role of an anxiety-reduction mechanism[END_REF]Turner et al. 2007;[START_REF] Turner | A test of the extended contact hypothesis: The mediating role of intergroup anxiety, perceived ingroup and outgroup norms, and inclusion of the outgroup in the self[END_REF]

Materials and procedure

Participants were recruited on a university campus. 6 All participants were handed a questionnaire containing the instructions and measures, which were presented in the same order as described below. Unless stated otherwise, responses to all items were recorded on 5-point Likert-type scales. A debriefing information sheet was handed to each participant at the end of the study. Outgroup attitudes. Participants rated Muslims using six pairs of bipolar adjectives, which were separated by a 5-point scale. The adjective pairs were the same as those used by [START_REF] Wright | The extended contact effect: Knowledge of cross-group friendships and prejudice[END_REF] in their research on extended contact: warm-cold, negative-positive, friendly-hostile, respect-contempt, suspicious-trusting and admiration-disgust. Responses were scored such that a higher score indicates a more positive outgroup attitude. The items were then combined to form a single outgroup attitude score (α = .90). We used this measure rather than the one in Study 1 because the items in the previous measure may be more susceptible to socially desirable responding. Intergroup anxiety. Four items measured the extent to which participants felt anxious about coming into contact with Muslims. Two items were the same as those used in Study 1. The two additional items were: "I feel relaxed when I come into contact with Muslims," (reversed) and "I feel threatened when I come into contact with Muslims". All four items were combined to form a single intergroup anxiety score (α = .95). A higher score indicates more intergroup anxiety.

Results and Discussion

Correlation analyses

Table 3 depicts the means, standard deviations and correlations among the measures.

As shown in this table, the contact measures were all associated with the outcome measures in expected directions. Contact quantity, contact quality, the intergroup contact index and extended contact were all positively associated with outgroup attitudes, perceived outgroup variability and intergroup behavioural intentions, and were all negatively associated with intergroup anxiety. Additionally, intergroup

_ _ _ _ _ _ _ _ _ _ _ Table 3 about here _ _ _ _ _ _ _ _ _ _ _ _

Mediation analyses

As in Study 1, a series of regression analyses were computed to examine the role that intergroup anxiety played in mediating between different types of intergroup contact and the various outcome measures [START_REF] Baron | The moderator-mediator variable distinction in social psychological research: Conceptual, strategic, and statistical considerations[END_REF]. 5 The regression analyses confirmed the direct associations between the variables reported in Table 1.

Indirect associations between the predictor and outcome measures (entered with the mediator) and between the mediator and the outcome measures (entered with the predictor) are presented in Table 4. As this table indicates, previously significant relationships between intergroup contact and the outcome measures were reduced to a non-significant level (perceived outgroup variability, intergroup behavioural intention) or significantly reduced (outgroup attitudes) when intergroup anxiety was included as a predictor in the analyses. Sobel tests [START_REF] Preacher | Calculation for the Sobel test: An interactive calculation tool for mediation tests[END_REF] confirmed that these reductions were significant (outgroup attitudes: z = 2.46, p = .02; perceived outgroup variability: z = 2.15, p = .03; intergroup behavioural intentions: z = 2.17, p = .03). In all cases, intergroup anxiety remained a significant predictor when intergroup contact was also included in the analysis.

A similar pattern emerged for the extended contact measure. The previously significant associations between extended contact and the outcome measures were reduced to a non-significant level when intergroup anxiety was also included as a 2.52, p = .01; intergroup behavioural intentions: z = 2.54, p = .01). In all cases, the association between intergroup anxiety and the outcome measure in question remained significant when extended contact was also included as a predictor.

_ _ _ _ _ _ _ _ _ _ _ _ Table 4 about here _ _ _ _ _ _ _ _ _ _ _ _
In sum, the results from Study 2 replicated the findings of Study 1, showing that anxiety about interacting with Muslims mediates the positive relationship between non-Muslim respondents' previous experiences of contact with Muslims and their perceptions of and attitudes and behavioural intentions towards Muslims.

Moreover, replicating the direct contact effects obtained in both studies, the results confirm that intergroup anxiety also mediates the effect of non-Muslim respondents' experiences of extended contact with Muslims on the various outcome measures. To our knowledge, this is the first study to demonstrate that variations in intergroup anxiety mediate the association between extended contact and intergroup behavioural intentions.

General Discussion

Numerous studies point to a widespread increase in prejudice against Muslims in recent years. Relatively less empirical research has considered how this apparent increase may be stemmed and relations between non-Muslims and Muslims improved. The present research addressed prejudice against Muslims from the perspective of intergroup contact theory [START_REF] Allport | The nature of prejudice[END_REF]. We conducted two studies with non-Muslim respondents to examine the relationship between their previous experiences of contact with Muslims and their perceptions of and attitudes and behavioural intentions towards Muslims. Results supported our predictions. In both Intergroup anxiety, in turn, was examined as a mediator between contact (both direct and extended) and outgroup attitudes, perceived outgroup variability and intergroup behavioural intentions. Greater anxiety about coming into contact with Muslims was associated with a lower amount of quality contact with Muslims and a lower amount of extended contact with Muslims. Greater intergroup anxiety was also associated with more negative attitudes toward Muslims, lower perceived variability among Muslims, and less positive behavioural intentions toward Muslims. Further analysis revealed that variations in intergroup anxiety mediated the relationship between contact (direct and extended) and outgroup attitudes, perceived outgroup variability and intergroup behavioural intentions.

Our results are consistent with previous studies that have demonstrated that anxiety mediates the positive effect of contact (quantity and quality) on outgroup attitudes (for a review, see [START_REF] Pettigrew | How does intergroup contact reduce prejudice? Meta-analytic tests of three mediators[END_REF]. In addition, Study 2 adds further support to the recent extension of this finding in terms of extended contact [START_REF] Turner | A test of the extended contact hypothesis: The mediating role of intergroup anxiety, perceived ingroup and outgroup norms, and inclusion of the outgroup in the self[END_REF], by establishing that non-Muslims respondents' anxiety about interacting with Muslims mediates between their experiences of extended contact with Muslims and their attitudes towards Muslims generally.

The studies have also confirmed that the level of anxiety experienced by non- in the perception of Muslims as more variable, and that anxiety mediated this effect, is in line with [START_REF] Paolini | Effects of direct and indirect cross-group friendships on judgements of Catholics and Protestants in Northern Ireland: The mediating role of an anxiety-reduction mechanism[END_REF], who examined direct and indirect cross-group friendships between different religious groups in Northern Ireland, finding that intergroup anxiety mediated the relationship between direct and indirect friendship and perceived group variability. Finding that contact with Muslims is associated with more perceived variability among Muslims is especially important in the current climate, given that the image of Muslims generated and sustained in the media and much political discourse [START_REF] Merskin | The construction of Arabs as enemies: Post-September 11 discourse of George W. Bush[END_REF]) is of a homogenous community aspiring towards a single political aim [START_REF] Afshar | Feminisms, Islamophobia and identities[END_REF]. The results from the present studies suggest that frequent positive contact and extended contact with Muslims may go some way towards changing this perception of homogeneity held by many non-Muslims, which in turn may pave the way for more positive and constructive relations between non-Muslims and Muslims generally.

Muslim respondents about interacting with Muslims mediates the link between their

Perhaps the most important finding of the studies reported here is the link between contact and intergroup behavioural intentions. A behavioural intention can be defined as the motivational factor behind a particular behaviour, which dictates whether the behaviour will be performed or not [START_REF] Ajzen | The theory of planned behavior[END_REF]. As such, linking contact to behavioural intentions can be seen as a step closer towards linking contact to actual behaviour. Recent research has begun to examine this link [START_REF] Viki | Race and willingness to cooperate with the police: The role of quality of contact, attitudes towards the behaviour and subjective norms[END_REF][START_REF] Tam | Intergroup trust in Northern Ireland[END_REF]Bousfield and Hutchison 2010;Hutchison et al., in press), and the studies reported here add further support to the claim that increased contact with outgroup members is associated with an intention to behave positively towards that outgroup. Finding that intergroup anxiety mediated this relationship offers further Another limitation of the current research is that both studies used a crosssectional design, making it difficult to infer causality. It is theoretically possible that those respondents in our research with more favourable attitudes and intentions towards Muslims were more likely to seek out and engage in positive contact with Muslims. Indeed, previous research has demonstrated that negative outgroup attitudes restrict intergroup contact at the same time contact improves attitudes (e.g., [START_REF] Binder | Does contact reduce prejudice or does prejudice reduce contact? A longitudinal test of the contact hypothesis in three European countries[END_REF]. It is important, therefore, for future research to use longitudinal and experimental designs in order that more conclusive inferences about causality may be established.

Future research should also investigate whether other variables mediate the relationship between contact and intergroup behavioural intentions. Our research focused on the mediational role of intergroup anxiety, whereas previous research has shown that there are many additional mediators of the relationship between contact and prejudice, such as self-disclosure (Turner et al., 2007), empathy and perspective taking [START_REF] Tam | Intergroup contact and grandparent-grandchild communication: The effects of self-disclosure on implicit and explicit biases against older people[END_REF], trust [START_REF] Tam | Intergroup trust in Northern Ireland[END_REF], and knowledge of the outgroup (Stephan and Renfro 2002). In their meta-analysis of mediators of the contact effect, [START_REF] Pettigrew | How does intergroup contact reduce prejudice? Meta-analytic tests of three mediators[END_REF] Despite these limitations, our study is important for establishing that although prejudice against Muslims (or Islamophobia) is often perceived as different from other types of prejudice (e.g., Cole, 2009), it can be reduced in the same ways that other types of prejudice can. Finding that extended contact is associated with the same positive outcomes as direct contact suggests that actual contact between non-Muslims and Muslims may not be necessary to reduce prejudice. Instead, our results suggest that anti-Muslim prejudice could be reduced by emphasising Muslim friendships held by other non-Muslims. Along these lines, Cameron and colleagues (Cameron, Rutland and Brown, 2007) found that schoolchildren's attitudes towards refugees in the UK improved following an intervention which involved reading stories about cross-group friendships. Likewise, Turner and colleagues [START_REF] Turner | Imagining intergroup contact can improve intergroup attitudes[END_REF] Muslims, individuals and groups who are not Muslim but who are wrongly identified as such (e.g., through perceptions of ethnicity, national heritage or language) are also increasingly becoming the recipients of prejudiced attitudes and behaviour.

2 The term 'Arab' is distinct from the religious identity of 'Muslim'. However, attacks on Arabs often reflect the assumption that they are Muslim (see Footnote 1). This is despite considerable religious diversity in many Arabic countries, and the far greater numbers of Muslims from non-Arabic ethnic and geographical areas. 3 We did not collect data on the participants' race, ethnicity or nationality in either study because previous research suggests that these variables have no influence on attitudes towards Muslims (e.g., Park et al. 2007). 4 Two of the data collectors were Black and two of the data collectors were White. Race of data collectors had no impact on any of the analyses. 5 We report results of mediation analysis for the multiplicative index of intergroup contact, although intergroup anxiety also mediated the associations between contact quantity and quality and the various outcome measures. 6 Two of the data collectors were White and one of the data collectors was Black. As in Study 1, race of data collectors had no impact on any of the analyses.

  . Despite this long-established link between behavioural intentions and actual behaviour, only a few studies have examined the link between intergroup contact and intergroup behavioural intentions.

  The present research extends this previous work by investigating whether variations in intergroup anxiety mediate not only the influence of intergroup contact on outgroup attitudes and perceived outgroup variability, but also the proposed positive effect of contact on behavioural intentions. Examining the role of intergroup anxiety in the context of relations between non-Muslims and Muslims is especially important in light of numerous reports suggesting that prejudice against Muslims has recent years, especially since the events of September 11 th

  . A single item was used to measure contact quantity. Participants were asked to write a number in the space provided to indicate, on average, how many Muslims they come into contact with in a typical week.Contact quality was assessed by asking participants to rate the quality of contact they have with Muslims on a scale ranging from 1 (very bad) to 5 (very good). Following the procedure adopted in previous contact studies (e.g.,[START_REF] Voci | Intergroup contact and prejudice toward immigrants in Italy: The meditational role of anxiety and the moderational role of group salience[END_REF], we calculated a multiplicative index of contact quantity and contact quality to obtain a single intergroup contact score. A higher score on this index indicates a higher frequency of high-quality intergroup contact.Outgroup attitudes. Participants indicated their attitudes towards Muslims using two items: "I like Muslims" and "I prefer to spend time with non-Muslims than Muslims". They were informed that responses should reflect their feelings about Muslims in general, not necessarily those with whom they have contact with. The second item was reverse-scored and combined (averaged) with the first item to form a single outgroup attitude score (r = .49). A higher score indicates a more positive attitude.Perceived outgroup variability. Two items measured the perception of variability among Muslims: "I feel that all Muslims are similar," and "I feel that there are different kinds of people among Muslims". The first item was reversescored and combined with the second item to form a single perceived outgroup variability score (r = .79). A higher score indicates more perceived outgroup variability.Intergroup behavioural intentions. Two items measured the extent to which participants would intentionally engage in positive behaviour towards Muslims: "I would help a Muslim if he or she was being discriminated against," and "I would organizations whose aim is to reduce prejudice against Muslims." These items were combined to form a single intergroup behavioural intentions score (r = .78). A higher score indicates more positive intergroup behaviour intentions.Intergroup anxiety. Two items measured the extent to which participants felt anxious about coming into contact with Muslims: "I feel anxious when I come into contact with Muslims," and "I feel nervous when I come into contact with Muslims."These items were combined to form a single intergroup anxiety score (r = .83). A higher score indicates more intergroup anxiety.

  the results confirm that the association between non-Muslim respondents' experiences of contact with Muslims and their perceptions of and attitudes and behavioural intentions towards Muslims was mediated by their anxiety about interacting with Muslims. The results are consistent with previous research which has shown that intergroup anxiety mediates the positive association between contact and outgroup attitudes and between contact and perceived outgroup variability (see

  There are numerous examples of groups with little or no opportunities to engage in meaningful high-quality contact: for example, Israelis and Palestinians in the Middle East and Catholics and Protestants in parts of Northern Ireland. Likewise, despite being one of the most multicultural cities worldwide, some reports suggest that parts of London (especially East London where the research was conducted) are becoming increasingly segregated along religious and ethnic lines (Community Cohesion Review Team 2001; BBC Online 2006; Phillips 2006). Although this assumption has (e.g., Finney and Simpson 2009), it is nonetheless worthwhile exploring whether direct contact is actually necessary to reduce prejudice, or whether more vicarious forms of intergroup relationships might have a similar positive effect on relations between non-Muslims and Muslims. Therefore, in Study 2, along contact quantity and contact quality, we additionally included a measure of extended contact

  . As well as attitudes towards Muslims and perceived outgroup variability, in Study 2 we also examined the effects of extended contact on non-Muslims' behavioural intentions towards Muslims. Few studies have investigated the link between intergroup contact (direct or extended) and intergroup behavioural intentions, and to our knowledge, none have examined whether intergroup anxiety mediates the extended contact-behavioural intention relationship. We tested this prediction in Study 2 along with seeking to replicate the effects obtained in Study 1. Method Participants Sixty non-Muslim students at a London university participated on a voluntary basis.None had participated in Study 1. Twenty-seven were male and thirty-three were female. The age range was from 18 to 65, with a mean of 25.5 years (SD = 8.44). As age had an effect in the analyses, we do not discuss these variables further.

  Intergroup contact measures. Participants completed the same measures of contact quantity and contact quality from Study 1. As in Study 1, we computed a multiplicative index of contact quantity and contact quality to provide a single intergroup contact score. Extended contact was measured by asking participants to write a number in the space provided to indicate how many of their close friends or relatives have Muslim friends, with a higher number indicating more extended contact.

  of variability among Muslims (α = .71). A higher score indicates more perceived outgroup variability. Intergroup behavioural intentions. Four items measured participants' behavioural intentions towards Muslims. The first two items were the same as in Study 1. The other two items were: "I want to learn more about Muslim culture," and "I would like to visit a Muslim country." We included these additional items to reflect the different ways that pro-social attitudes towards Muslims might be expressed. These four items were combined to form a single intergroup behavioural intentions score (α = .66). A higher score indicates more positive intergroup behaviour intentions.

  predictor (outgroup attitudes: z = 2.70, p = .007; perceived outgroup variability: z =

  greater amount of high-quality contact with Muslims was associated with more positive attitudes towards Muslims, the perception of Muslims as distinct individuals rather than a homogeneous entity, greater intentions to behave positively towards Muslims, and less anxiety about coming into contact with Muslims. In Study 2, these findings were additionally replicated for non-Muslims' extended contact with Muslims.

  contact with Muslims (direct and extended) and their perceptions of variability among Muslims. The finding that extended contact resulted

  role of intergroup anxiety as a mediator in the contact literature, extending this to include intergroup behavioural intentions. Given the established link between behavioural intentions and actual behaviour, this finding has real implications for predicting actual behaviour towards Muslims. Future research is needed to address this point further, examining whether strategies aimed at promoting different types of contact between non-Muslims and Muslims can affect actual pro-social behaviour towards Muslims, for instance, helping Muslims experiencing discrimination or pledging support for concrete policies or interventions designed to accomplish racial, ethnic and religious integration (see also Dixon, Durrheim and Tredoux 2005). Although our research provides consistent support for our hypotheses, there are limitations with the current studies that future research should seek to address. Both studies were conducted with students from the same university campus in East London. The university has one of the lowest ratios of non-Muslim to Muslim students in the UK and is located in the borough of Tower Hamlets, which has the highest proportion of Muslims of all local authority districts in the UK at 36 per cent (2001 Census statistics, cited in Greater London Authority 2006, p. 11). It is likely that non-Muslim students at this university have more contact with Muslims than non-Muslims at other UK universities and these different experiences may result in different attitudes, perceptions, and behavioural intentions than for non-Muslim students at other universities. The current research should therefore be extended to include non-Muslim students at more 'typical' UK universities and in addition further research using non-student samples would be desirable. It is possible that non-Muslim students in general have different experiences with Muslims than non-students and, therefore, different expectations and attitudes. Indeed, the variability of quality and extended contact of students is likely to be lower for students than for non-students, especially considering the students at the current university are likely to have a high level of contact with Muslims. Therefore the external validity of our findings may be limited.

  suggested a causal sequence whereby initial intergroup anxiety must first be reduced via intergroup contact before other such additional variables can effectively contribute to prejudice reduction. Future research should examine whether this proposed causal sequence exists in the context of relations between non-Muslims and Muslims.

Footnotes1

  demonstrated that simply imagining contact with members of an outgroup can improve intergroup attitudes and reduce prejudice. Together, these findings should be of interest to those involved in the design of strategies and interventions aimed at improving relations between non-Muslims and Muslims. intentions towards the elderly', Educational Gerontology BROWN, R. and HEWSTONE, M. 2005 'An integrative theory of intergroup contact', in M. Zanna (ed), Advances in experimental social psychology, vol. 37, San Diego, CA: Academic Press, pp. 255-343. CAMERON, L., RUTLAND, A. and BROWN, R. 2007 'Promoting children's positive intergroup attitudes towards stigmatized groups: Extended contact and multiple classification skills training', International Journal of Behavioral Development, vol. 31, no. 5, 454-466 COLE, M. 2009 'A Plethora of 'suitable enemies': British racism at the dawn of the twenty-first century', Ethnic and Racial Studies, vol. 32, 1671-1685 COMMUNITY COHESION REVEIW TEAM 2001 'Community cohesion: A report of the independent review team'. Home Office, London DIXON, J., DURRHEIM, K. and TREDOUX, C. 2005 'Beyond the optimal strategy: A 'reality check' for the contact hypothesis', American Psychologist, vol. 60, no 7, 697-711 ECHEBARRIA-ECHABE, A. and FERNANDEZ-GUEDE, E. 2006 'Effects of terrorism on attitudes and ideological orientation', European Journal of Social Psychology, vol. 36, no. 2, 259-65 FINNEY, N. and SIMPSON, L. 2009 'Sleepwalking into segregation? Challenging the myths about race and migration', Bristol: Polity Press GREATER LONDON AUTHORITY 2006 'Muslims in London', Although the present research is framed in terms of prejudice against

7

  As in Study 1, intergroup anxiety also mediated the associations between contact quantity and quality on the various outcome measures.

Page 7 of 37 URL: http://mc.manuscriptcentral.com/rers ethnic@surrey.ac.uk Ethnic and Racial Studies

	8
	contact, where negative stereotypes are prevalent, or where there is a sense of threat
	or danger from the outgroup
	F o r
	P
	e
	e r
	R
	e
	v i e
	w
	O n l
	y

Page 12 of 37 URL: http://mc.manuscriptcentral.com/rers ethnic@surrey.ac.uk Ethnic and Racial Studies

	13
	intergroup anxiety. 5 Following procedures outlined by
	F o r
	P
	e
	e r
	R
	e
	v i e
	w
	O n l
	y

Page 17 of 37 URL: http://mc.manuscriptcentral.com/rers ethnic@surrey.ac.uk Ethnic and Racial Studies

	18
	anxiety was negatively associated with outgroup attitudes, perceived outgroup
	variability and intergroup behavioural intentions.
	_
	F o r
	P
	e
	e r
	R
	e
	v i e
	w
	O n l
	y

Table 1

 1 Means, standard deviations, and correlations among the variables (Study 1) p < .05, ** p < .01, *** p < .001Note. All measures used 5-point scales except contact quantity, which required respondents to write a number to indicate how much contact and extended contact they had with Muslims.

	Variable

*

URL: http://mc.manuscriptcentral.com/rers ethnic@surrey.ac.uk

Table 2

 2 Results of mediation analyses (Study 1) * p < .05, ** p <. 01, *** p <.001 Note. Figures are standardized beta coefficients. p < .05, ** p < .01, *** p < .001, † p = .06 Note. All measures used 5-point scales except contact quantity and extended contact, which required respondents to write a number to indicate how much contact and extended contact they had with Muslims. Note. Figures are standardized beta coefficients. Senior Lecturer in the School of Psychology at London Metropolitan University. ADDRESS: School of Psychology, London Metropolitan University, Calcutta House, Old Castle Street, London, E1 7NY, UK. Email: p.hutchison@londonmet.ac.uk HARRIET ROSENTHAL is a Lecturer in the Psychology Department at the University of Durham. ADDRESS: Department of Psychology, Durham University, Science Site, South Road, Durham, DH1 3LE, UK.Email: h.e.s.rosenthal@durham.ac.uk

		Ethnic and Racial Studies	Page 34 of 37
		Intergroup contact	Intergroup anxiety
		(entered with intergroup	(entered with intergroup
		anxiety)	contact)
	Dependent variable
	Outgroup attitudes	.28*	-.39**
	Perceived outgroup variability	.16	-.43**
	Intergroup behavioural intentions	.17	-.65***

URL: http://mc.manuscriptcentral.com/rers ethnic@surrey.ac.uk * URL: http://mc.manuscriptcentral.com/rers ethnic@surrey.ac.uk * p < .05, ** p <. 001, † p = .054.

URL: http://mc.manuscriptcentral.com/rers ethnic@surrey.ac.uk

Acknowledgements

The authors are grateful to Martin Bulmer and two anonymous reviewers for feedback on an earlier version of this article.


Serge Abiteboul
email: serge.abiteboul@inria.fr

Alban Galland
email: alban.galland@inria.fr

Neoklis Polyzotis

Web information management with access control *

We investigate the problem of sharing private information on the Web, where the information is hosted on different machines that may use different access control and distribution schemes. We introduce a distributed knowledge-base model, termed WebdamExchange, that comprises logical statements for specifying data, access control, distribution and knowledge about other peers. The statements can be communicated, replicated, queried, and updated, while keeping track of time and provenance. This unified base allows applications to reason declaratively about what data is accessible, where it resides, and how to retrieve it securely.

INTRODUCTION

With the Web, notably social networks and Web 2.0 applications, the sharing of information is generalizing. Users bring data to the network and are willing to share with others, but also wish to control what portions of the data can be viewed or updated by others. Users would also like to access and update information if desired and entitled to. This is the setting of the present paper, namely the specification and sharing of information with access control in a distributed environment. We wish to do so with a similar level of security as in centralized systems, but we also want to leverage and accommodate the wide variety of systems already available on the Web.

Several studies have investigated the problem of distributed information management with access control [START_REF] Mazieres | Separating key management from file system security[END_REF][START_REF] Rhea | Pond: the OceanStore prototype[END_REF][START_REF] Rowstron | Storage management and caching in PAST, a large-scale, persistent peer-to-peer storage utility[END_REF][START_REF] Wobber | Authentication in the Taos operating system[END_REF]. Similar to some of the previous studies, our approach, which we term WebdamExchange, employs a distributed knowledge base as its foundation. However, the originality of WebdamExchange is that the knowledge base unifies all information relevant to data management with access rights. Specifically, the knowledge base contains logical statements and rules to encode:

1. data (as in databases), 2. access rights, and credentials (e.g., cryptographic keys 4. rules describing the policy of each peer, [START_REF] Buneman | Provenance in databases[END_REF]. the provenance of the information using time and trace of communication, and 6. possibly other kinds of information that we will not consider here such as ontologies, ontology mappings, beliefs, trust, etc.

The approach allows reasoning holistically about pieces of data, from where they can be retrieved and who has some particular access right on them. Moreover, the "logic" of participants may be described declaratively using rules, which facilitates the development of distributed Web applications. We illustrate these ideas with an example. Suppose that user Alice is organizing a rock-climbing outing in Fontainebleau, and wishes to put together an application for the event that she will share with the members of her rockclimbing group, Roc14. Part of the data she needs is the list of the group members, which is stored on Facebook. To promote the event, she also wants to use pictures from previous outings, which the group members store on public sites, such as Picasa or Flickr, private Web sites and in an untrusted DHT that group member Bob set up. Finally, some information she will need comes from public Web services, e.g., she might use Google maps to obtain location information for bouldering areas in Fontainebleau. Using existing technology, Alice will have to use several different tools and APIs in order to check what data is available and from which Web services, whether she has access to it and finally determine how to retrieve it. In contrast, the same task can be performed in WebdamExchange by issuing a declarative query that requests the needed data. WebdamExchange will process the query over the unified knowledge base, thus dealing under the covers with the thorny issues of distribution and access rights. Specifically, the knowledge base provides all information about obtaining (from Facebook) the list of group members, finding where each of them stores outing pictures and getting the data using proper credentials. Note that WebdamExchange has to perform this reasoning in an extremely heterogeneous setting, where systems, access controls and ontologies (data organization) may vary across members of the group.

Overall, our thesis is that with all this information managed in a distributed knowledge base, and with reasoning, we can automate the retrieval of information with access rights.

From a formal viewpoint, the system consists of a set of peers, each with its own database and its own logic. The database contains logical facts capturing information such as documents, access control, credentials, localization, but also replicas of other peers' information. The peer logic is expressed in datalog-style rules. We build on the webdamlog language [START_REF] Abiteboul | A rule-based language for web data management[END_REF] that supports the exchange of facts and rules between peers. We extend the language in a number of ways, notably by introducing the notion of principal (e.g., the group Roc14 ) which is common in security.

The holistic approach advanced by WebdamExchange brings several distinct advantages:

Large spectrum Because the model is general, it can capture very different scenarios ranging from centralized systems (such as central servers) to massively distributed systems, with peers ranging from fully trusted to totally untrusted, providing encrypted or clear information. Furthermore, it can capture scenarios combining the previous cases, which are the reality of today's Web, in arbitrarily rich ways.

Formal model Because the model is formally defined, we can prove (or disprove) desirable properties for a system described with our model, such as soundness (data is only acquired legitimately) and completeness (all legitimate data may be acquired). This is in the spirit of [START_REF] Abadi | Logic in Access Control (Tutorial Notes)[END_REF] that uses logic to describe access control protocols. Also, peers may perform automatic reasoning using the knowledge base to obtain information on data, localization and access control.

Quality control Because our model addresses provenance and time, we can better control the quality of data. This is in-line with recent works on data provenance, e.g., [START_REF] Buneman | Provenance in databases[END_REF]. We view time and provenance not as gadgets but as essential components of a solution for properly supporting access control in a distributed setting. In particular, this will enable us to detect who is responsible for misuses of the system.

Given the limited space, our focus in this paper is on distribution and access control, two essential aspects of the scenarios targeted by WebdamExchange. We show how these aspects can be specified in the model, and briefly discuss how the model captures existing methods for managing distribution and access control. Of course, there are several other interesting questions, e.g., related to data integration or the use of ontologies, which we plan to investigate in our future work. The paper is organized as follows. In Section 2, we briefly present the general WebdamExchange model. Section 3 deals with access control, and Section 4 with distribution. In Section 5, we highlight the main features of the system we are implementing. We conclude in Section 6 with perspectives on future work.

THE MODEL

We consider autonomous peers exchanging data using messages. For this, we use a formally defined datalog-style language recently introduced for distributed data management, namely webdamlog [START_REF] Abiteboul | A rule-based language for web data management[END_REF]. The language is very influenced by Active XML [START_REF] Abiteboul | The active xml project: an overview[END_REF] and Dedalus [START_REF] Hellerstein | The declarative imperative: experiences and conjectures in distributed logic[END_REF].

The main novel feature of webdamlog is delegation, that is, the possibility of installing a rule at another peer. Specifically, webdamlog has two main concepts: facts, which capture both local tuples and messages between peers, and rules, which are datalog-like rules. As in deductive databases, the model distinguishes between extensional relations that are defined by a finite set of ground facts and intentional relations that are defined by rules. Moreover, the relation names are explicitly localized on a peer. For example, r@p means the relation r of peer p. One can use variables for both relation names and peers, and they can appear as data in relations.

The semantics of the global system is defined based on local semantics and the exchange of messages and rules. Intuitively, a given peer chooses how to move to another state based on its local state (a set of local facts and messages received from other peers) and its program. A move consists in (1) consuming the local facts, (2) deriving new local facts, which defines the next state, (3) deriving nonlocal facts, i.e., messages sent to other peers, and (4) modifying their programs via delegations, i.e., the action of installing a rule at some other peer.

We illustrate the main notions of the model using an example. Consider the following two facts in webdamlog: calendar@Alice-iPhone(rockclimbing, 06/12/2011, Fontainebleau, Alice-iPhone). roc14members@Alice-iPhone(Bob, Bob-laptop).

The first one is a calendar entry that Alice entered from her iPhone. The second one captures the information that Bob is a member of the group and that he keeps his calendar in his laptop. The following rule is used to include rockclimbing entries from Alice's agenda into the agendas of other members of the group, and in particular into Bob's agenda: calendar@$peer(rockclimbing, $date, $place, Alice-iPhone) :calendar@Alice-iPhone(rockclimbing, $date, $place, Alice-iPhone), roc14members@Alice-iPhone($name, $peer) A name such as Alice-iPhone or Bob-laptop has to be understood as a physical address in the network, e.g., a URL. It identifies a peer with storage and processing resources. Observe that variable $peer is valuated to a peer when the program is activated, and the new fact or rule is sent to the corresponding peer. In this particular case, this notably results in pushing to Bob's laptop the following new fact: calendar@Bob-laptop(rockclimbing, 06/12/2011, Fontainebleau, Alice-iPhone).

Even more interestingly, the following rule on Bob's laptop: confirm@$peer(rockclimbing, $date, $place,Bob) :calendar@Bob-laptop(rockclimbing, $date, $place, $peer), checkAvailability@Bob-iPhone($date);

delegates to Bob's iPhone the rule: confirm@$peer(rockclimbing,06/12/2011, Fontainebleau,Bob) :-checkAvailability@Bob-iPhone(06/12/2011);

So, Bob's iPhone can directly send a confirmation message to Alice if Bob is available that day.

The complete details of webdamlog can be found in [START_REF] Abiteboul | A rule-based language for web data management[END_REF]. Here, we introduce two extensions that are essential for WebdamExchange, namely virtual principals and semistructured data.

Virtual principal. The webdamlog language is tailored to physical peers such as Alice's iPhone or Bob's laptop, capturing data exchange between them. In WebdamExchange, we call principal an entity that owns data and has access right delegations on the data of other principals. A peer is such a physical principal. WebdamExchange also supports virtual principals, e.g., a user such as Alice, or a group such as Roc14. Contrary to a peer, a virtual principal has no storage or processing resources, relying on peers for that. The notion of virtual principal is primarily used to specify and manage access rights. Essential issues are who stores the data of a virtual principal, and who has read/write access to them. Typically, physical principals will store and process data for virtual principals. They may also temporarily create avatars of virtual principals. For instance, an avatar of Alice is created on her iPhone when she wants to access and update data from this device. A virtual principal may delegate its access rights to a physical principal who will manage its data.

Formally, the extension is as follows. Besides facts of the form r@p(u1, ..., un) where p is a peer, we have facts r@q(u1, ..., un) where q is a virtual principal. Such a fact is stored on a physical peer p as an external fact, i.e., external@p(r, q, u1, ..., un).

where external is a reserved relation name. When a relation about a virtual principal is used in a rule, the peer "resolves" it (using rules) to replace it by the external relations.

Note that the basic webdamlog model is strongly typed. On the other hand, an external relation needs to store tuples of arbitrary arity. We next turn the model into a semistructured data model, which fixes this typing issue.

Semistructured data model. Another problem we have to

face on the Web is that the data is naturally semistructured. For instance, a climbing area may be recorded in Roc14 as follows, using the standard syntax of JSON: climbingSite@Roc14:{"id":"&cuvier", "Name":"Cuvier", "ClimbingSiteType":"Bouldering area", "Circuit": [{"idref":"circuit@Roc14&cuvier-orange"}, {"idref":"circuit@Roc14&cuvier-blue"}, {"idref":"circuit@Roc14&cuvier-red"}] "GoogleMapsURL":"..." } This fact is representing the Cuvier bouldering area that includes 3 circuits, orange, blue and red. The number of circuits may depend on the size of the bouldering area. Brackets denote collections and ampersands denote references. Note that &cuvier-orange identifies a document within the domain of the circuit relation of Roc14.

To simplify data management, we extend webdamlog with the notions of a document and a collection. A document is a coherent, self-contained piece of data, modeled by an XML tree (We use the equivalent JSON syntax in the examples). For example, we may have the following document picture1@Bob containing a jpeg picture: picture1@Bob = {"Name":"picture1", "Type":"jpg", "byteStream":"..."} A document corresponds to a relation that contains the different versions of the document at different points in time.

A document update therefore corresponds to adding a new fact to the relation.

A collection consists of a set of independent references. Collections are also used for access control and localization (specifically, we employ collections of access control and where statements respectively, which we will define later). Collections are updated by adding or removing references. For example, pictures@Roc14 += picture1@Bob adds a reference to the previous document to the collection of pictures of Roc14.

The standard request to a document or a collection is to ask for its "current" version, i.e., the last version of the document or the consolidated list of references of the collection. These notions raise the issue of consistency that is particularly critical for collections of access rights. For instance, it is important to decide whether a peer requested an update to a document "before" or "after" it obtains the right to perform such an update. Distribution greatly complicates the issue, and the distributed systems literature provides a host of techniques for different consistency models. Clearly, these techniques can be considered in our setting.

Statements, instructions and external knowledge. In webdamlog, there is no difference between a fact and a message. More precisely, if a peer p derives a fact r@p(u1, ..., un), this is a fact to store; if p derives r@q(u1, ..., un), for q = p, this is a message to send to q. The message is automatically accepted by q as a new fact. However, in our current setting, we want to allow the peer to process the fact based on its own logic. In this fashion, q will see the message as a request to insert the fact, but it may decide to not actually insert it in its local knowledge base.

We next detail this important distinction between an insertion request and the (actual logical) statement that may result from it. The following statement may for instance be installed by Alice-iPhone:

Alice-iPhone states climbingSite@Roc14={"id":"&cuvier", ...} requester Alice;

In other words, Alice-iPhone created a fact of the relation climbingSite@Roc14 (and typically stored it in its database).

It is important to understand who the participants in such a fact are: Alice-iPhone performed the statement; Roc14 owns this piece of data; Alice requested this update. This last information is used to trace the provenance of the fact. Such a complicated fact model is necessary because it is very typical on the Web to have a principal (Alice) who has the right to state a fact of another principal (Roc14) but has to rely on another principal (Alice's iPhone) to perform this task.

How did we get there? Typically, Alice made the following request:

Alice requests climbingSite@Roc14 = {"id":"&cuvier", ...} to Alice-iPhone;

to her iPhone. Another example of a request is Bob-laptop requests get climbingSite@Roc14&cuvier to Alice-iPhone;

which is a request of Bob to Alice's iPhone for some data. If Alice's iPhone can prove that Bob is entitled to have this data, it can send it to him. So, a peer may want to exchange statements and messages previously exchanged with other peers.

It is important to clarify that statements are local data, stored by the principal who performs the statements. Similarly, the instructions are stored by the principal who receives them. To be able to exchange data and trace any related communication, we introduce another class of messages that can contain statements or instructions, and that are used in general to transfer knowledge. For example, Alice-iPhone may answer Bob's request using:

Alice-iPhone says Alice-iPhone states climbingSite@Roc14= {"id":"&cuvier", ...} requester Alice to Bob-laptop;

We also say that Alice-iPhone performed the communication and that Bob received it. This fact is stored by Bob-laptop. One may also want to exchange rules. For example:

Alice-iPhone says Alice-iPhone states climbingSite@Roc14:{...} :-climbingSite@Alice:{...} requester Alice to Bob-latop;

means that Alice-iPhone installed in the latop of Bob a view machinery to copy Alice's data to Roc14.

The model allows capturing provenance information. In short, we can follow the transmission of pieces of information since each message records who sends it and who receives it. We will see in the following section that this information is authenticated, so one can check the full trace of provenance. When we want to trace the communication, the peers must accept only instructions and well-formed chains of external knowledge from outside. Formally, the performer of an external knowledge has to be the performer of the contained statement or the receiver of the contained external knowledge or instruction.

We should also mention that timestamps are also attached to messages. It is shown in [START_REF] Abiteboul | A rule-based language for web data management[END_REF] that timestamps have an important impact on the expressive power of webdamlog. We timestamp knowledge as follows:

Alice-iPhone states climbingSite@Roc14={"id":"&cuvier", ...} requester Alice at 06/12/2011 14:00:00

In WebdamExchange, the timestamps are local to the performer, here Alice-iPhone. There is no global clock.

To support the claim that the WebdamExchange approach allows handling a wide variety of situations encountered on the Web, we consider in more detail access control and distribution. In both cases, we introduce generic statements and briefly discuss how they may be supported in different Web contexts.

ACCESS CONTROL

In WebdamExchange, the access control granularity is at the level of the principal. A principal may get some particular access right to all the data of another principal. For example, Alice may be in the write access control list of the Roc14 group. She may then delegate this right to Alice-iPhone and Alice-laptop. In general, the access control policies will not be able to prevent malicious principals to misbehave. But if enough information is recorded (notably provenance), the system will be able to identify malicious peers.

In a standard way, access control in WebdamExchange is based on access control lists and credentials. We consider first the different access rights. The own right is used for authentication of performers and for granting/revoking access rights. The own right also transmits the access rights of a principal: if p is owner of q and q has a right r on q', then p has also the right r on q'. The write right grants the right to edit basic documents and collections. The append and remove rights grant the right to append and remove elements of a basic collection respectively. The read right grants the right to read basic documents and collections. The readAcc right grants the right to read the list of access control. The readWhere and writeWhere rights will be introduced in the section on distribution.

The first way to grant rights is to use an access control list. For example, the following statement specifies that Alice-iPhone grants the write right to Bob on Roc14: Alice-iPhone states writer@Roc14+=Bob requester Alice We also use the notion of credentials, which consist of two abstract dual notions, namely hint and secret. Concretely, hints and secrets will depend on the particular means of enforcing access control. Based on these abstract notions, the model will be general enough to match a wide range of scenarios found on the Web.

To illustrate these notions, we consider next a standard use of RSA-based cryptographic protocols. But it is important to keep in mind that the model is designed to support other situations as well. Indeed, we will mention some further. For this protocol, the credentials are a pair of asymmetric RSA cryptographic keys. Alice-iPhone may specify the creation of a pair of hint and secret for write right of Roc14 as follows:

Alice-iPhone states writeHint@Roc14{} requester Alice Alice-iPhone states writeSecret@Roc14{} requester Alice where writeHint and writeSecret are keywords of the language. This results in creating a public key to be used as the hint and a private one, the secret. The system uses such keys to control actions on data. The keys are used to authenticate and protect data. For authentication, the data is signed using the private key. Everyone can verify the signature with the public key. More precisely, a statement will carry the proof that the principal who performed the corresponding update was indeed entitled to do so. For instance, a statement about a document of Roc14 is signed with the write private key of Roc14, and carries as well provenance information that specifies who performed and requested the update. Symmetrically, one can use the credentials to protect the data and enforce read access control. For example, climbingSite@Roc14{...} protected for reader@Roc14 means that the content of the fact has been encrypted using the read public key of Roc14. Continuing with the RSA cryptographic protocol, in this case, the content is encrypted with a fresh DES symmetric key, that is in turn encrypted with the read RSA public key of Roc14. So only someone with the private key will be able to decrypt the data.

A principal who can create statements to enforce access policies (access control and credentials) essentially has delegation power. We choose to authorize this action with the strongest access right of our model, the own right. So, for instance, a statement giving Bob write access to Roc14 has to be authenticated with the own credential of the updated principal.

Authentication is also used to verify provenance for instruction and external knowledge. These messages are authenticated with the own secret of their performer. The receiver can check the identity of the performer and later prove that it indeed received the message. For example, let us recall the previous instruction and external knowledge: Bob requests get climbingSite@Roc14&cuvier to Alice-iPhone; Alice-iPhone says Alice-iPhone states climbingSite@Roc14= {"id"="&cuvier", ...} requester Alice to Bob;

The instruction is signed with Bob's own secret while the external knowledge is signed with the own secret of Alice-iPhone. The internal statement is signed with the write key of Roc14. Before answering, Alice-iPhone has to check that Bob has indeed the right to access the relations of Roc14, by looking for the corresponding read access control statement. Alice-iPhone also stores the instruction, so that it can later prove Bob indeed requested the data. We now discuss how to use credentials with totally different means of enforcing access control. More precisely, we consider the access control provided by standard Web sites. In WebdamExchange, an existing Web site is viewed as a peer identified by its URL. Some wrapping software is used to have the Web site behave as a WebdamExchange peer with typically degraded functionalities. For instance, the provenance information may not be recorded on the Web site. From an access control viewpoint, the authentication of an HTTP Web site may simply be based on trusting the DNS. (Recent hacks of DNS servers have shown limitations.) Access may be public, i.e., the hint is the URL and there is no secret. Access may be limited to principals who know of the URL, i.e., there is no hint and the secret is the URL. One may also consider more secure Web sites. For instance, the hint may correspond to the URL of the Web site together with a Web certificate, to provide more guarantees for authentication. To protect read/write access, the secret may also be based on an ssh private key or login/password, possibly relying on htaccess files.

Clearly, an interesting direction for future work is to investigate more complex access control schemes such as tripartite authentication of OpenID or Facebook (based on user, application and server) or majority voting for updates in P2P setting. But the main point is that the model already supports commonly found means of supporting access control.

DISTRIBUTION

In this section, we consider distribution. As we did for access control, we illustrate that a wide range of standard situations found on the Web, from very simple to very sophisticated, can be handled with the model.

Distribution is captured by a particular collection, namely where. Facts in this relation specify on which peers some particular data may be found. For example, to specify that the list of members of the group Roc14 may be found in the Facebook group of Roc14, one can use the fact: where@Roc14:{"docRef":"member"} += http://facebook.com/Roc14

(The URI http://facebook.com/Roc14 is understood by the "wrapper" of Facebook as a denotation for that Facebook group.) Localization collections are updated as other collections by appending or removing hosts. The language introduces new rights for controlling who can decide where such data may be kept and found, namely, readwhere and writewhere rights. The primary use of localization statements is to enable the localization of data to a principal. For instance, Bob typically has some basic information about Alice that states where to look for information about her, perhaps a Web page where she put some basic information. Starting from that, Bob is then able to learn that she keeps her list of friends on Facebook, her pictures on Picasa with a backup on her laptop, her music on her TV box at home with a copy on Bob's laptop, etc. So, just with an entry point (i.e., a kind of extended vCard electronic business card) Bob can find all the information he needs from her (and he has access to).

Again, the main advantage of our approach is that the system can handle the heterogeneity of the Web. In the same manner that hint/secret enabled using data protected by different access control protocols, the logical form of localization information abstracts away various communication protocols.

To conclude this section, we consider another extremely interesting aspect of the use of localization, i.e., the possibility to use complex and dynamic localization schemes such as gossiping or DHT. Consider first gossiping. This is a case where search cannot be separated from the actual management of data. To answer a particular query using gossiping, it is important to choose properly who to ask: who is more likely to have the information, to be the specialist, to be trustworthy, etc. By making localization a component of reasoning for answering queries, we simplify the task. Now consider the use of a DHT. It has been shown recently that a DHT can be modeled using distributed datalog [START_REF] Loo | Implementing declarative overlays[END_REF]. webdamlog could also be used. However, even if a standard DHT such as Pastry is used, one can naturally define the where predicate using standard DHT functions as in:

(where@Roc14:{"docRef":$r} += $p) :-relation@Roc14:{$r}, hash@DHT($r@Roc14, $p)

The rule specifies that $p is added to the list of hosts of the relation $r of Roc14 if hash@DHT($r@Roc14, $p) holds. The evaluation of the hash@DHT predicate is supported using a standard Web service of the DHT, i.e., the classical localization service of the DHT that takes a keyword as input and returns the address of a peer that has the desired information. This illustrates the versatility of WebdamExchange to describe very different kinds of systems. So, a unique setting allows expressing very different security policies, very different distribution policies, as well as other essential aspects for distributed data management ignored in this paper, such as translating from the ontology of one peer to that of another.

SYSTEM

We are currently implementing the WebdamExchange system. A prototype that supported a large portion of the described functionality was demonstrated at ICDE [START_REF] Antoine | Social networking on top of the webdamexchange system[END_REF]. The implementation is progressing towards the full support of all the WebdamExchange features described in this paper. In this section, we briefly mention aspects of the implementation. A WebdamExchange (full) peer is designed as follows. It has a communication module, with a Web-service interface, to communicate with other peers. The messages go through a security module. It is the responsibility of that module to verify the origin of incoming data (e.g., by checking the RSA signatures) and decrypt incoming data. It is also its responsibility to authenticate outgoing data (e.g., by signing them) and protect them if requested (by encrypting their content). All the reasoning is performed in the engine that is responsible for localizing data and piloting the security module. For example, the policy of the system may be to trust everything that is signed by a particular "very-trusted"' user, even in absence of other credentials. More generally, the policy of the manager determines (among other responsibilities) whether an instruction is accepted or not and whether an outgoing fact is encrypted or not. The facts are stored in an XML database.

These modules are implemented in Java. So, in particular, policies are still "hardwired" and very limited in terms of reasoning capabilities. We intend to replace the manager by a webdamlog engine, so that data exchange will be guided by reasoning in the distributed knowledge base.

As mentioned in the paper, we want also to manage data that is in other popular Web systems. To enable such interactions, we have incorporated in the communication and security modules, plug-ins to support for the protocols of such systems (wrappers in mediator's terminology). We have been developing wrappers for standard Web sites, for secure ones, for Facebook and for the Pastry DHT. Also, the security module includes plug-ins for access by login and password and for authentication based on Web certificates.

Finally, we develop a special communication module for hosting avatars. It gives a principal the means to create a virtual peer communicating directly with the peer the principal is logged on. This module is used for the communications of a Web GUI with the rest of the system. We have also implemented an iOS GUI that can be used to interact with the system, e.g., from an iPhone.

CONCLUSION

We presented a model for Web data management with access control and distribution that captures a variety of protocols found on the Web. The main on-going task is the development of the webdamlog engine. An open issue is whether standard datalog optimization techniques are adapted to such a setting or whether there is a need for novel ones. Perhaps more critical, we need to understand how the rules are specified for a particular participant. A human participant is very likely to be reluctant to write rules. So, we have to define ways of selecting some from existing libraries and perhaps customizing them.

Figure 1 :

 1 Figure 1: WebdamExchange Peer Architecture

* This work has been partially funded by the European Research Council under the European Community's Seventh Framework Programme (FP7/2007-2013) / ERC grant Webdam, agreement 226513. http:// webdam.inria.fr/ Fourteenth International Workshop on the Web and Databases (WebDB 2011) June 12, 2011 -Athens, Greece