CAREER: Privacy-Accountable Mobile Software Supply Chain

About This Grant

Data protection regulations specify how personal data must be protected when used by others. Tracking and accounting for protections of data privacy has emerged as a pivotal requirement in contemporary data protection regulations. As a result, those who are responsible for using personal data, so-called data controllers, must actively enhance the privacy safeguards they provide. This project addresses the intricate challenges surrounding privacy accountability within the mobile software ecosystem, characterized by the opacity of third-party code modules, particularly third-party libraries. Existing methods for achieving privacy accountability primarily emphasize data transparency, often overlooking essential principles like data minimization and purpose limitation and facing integration challenges within mobile software development lifecycles. This research project seeks to address these limitations by presenting innovative approaches to enforce privacy accountability throughout the mobile software development process. The goal is to establish a more privacy-conscious and accountable mobile ecosystem, benefiting both users and data controllers. The outcomes of the research will contribute to educational curriculum and training to help developers achieve privacy goals plus additional outreach through workshop and bootcamp venues. The project's technical objectives are divided into three research thrusts: (1) understanding privacy accountability challenges in the mobile third-party code modules; (2) designing a privacy-accountable disclosure framework; (3) continuously enforcing privacy accountability properties in mobile software development lifecycle. The technical contribution of this research lies in advancing the socio-technical understanding of privacy non-compliance risks and accountability challenges within the mobile software supply chain. Additionally, it involves designing novel technical foundations that seamlessly integrate various methodologies and disciplines. This includes program analysis, formal methods, natural language processing, and human subject research, culminating in a privacy-accountable disclosure framework and continuous privacy accountability enforcement mechanism. These innovations are designed to be easily adoptable within the mobile software supply chain. The research will foster a holistic approach to enhancing privacy protection and accountability in mobile software development lifecycle and contribute to the creation of a safer and more privacy-conscious mobile ecosystem. This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.