Search

Data reusability has become a distinct characteristic of scientific, commercial, and administrative practices nowadays. However, an unlimited and careless reuse of data may lead to privacy breaches and unfair impacts on individuals and vulnerable groups. Data content adaption is a key aspect of preserving data privacy and fairness. Often, such content adaption affects data utility adversely. Further, the interaction between privacy protection and fairness protection can be subject to making trade-offs because mitigating privacy risks may adversely affect detecting unfairness and vice versa. Therefore, there is a need for research on understanding the interactions between data utility, privacy and fairness. To this end, in this contribution, we use concepts from causal reasoning and argue for adopting an integrated view on data content adaption for data driven decision support systems. This asks for considering the operation context wholistically. By means of two cases, we illustrate that, in some situations, local data content adaption may lead to low data quality and utility. An integrated wholistic approach, however, may result in reuse of the original data (i.e., without content adaption, thus in higher data utilization) without adversely affecting privacy and fairness. We discuss some implications of this approach and sketch a few directions for future research.

Privacy is a comprehensive notion which is hard to grasp for the layman. To make the privacy notion tangible, creating transparency about privacy practices is an important necessity. Transparency about privacy practices is traditionally (sought to be) established via providing privacy policies and privacy seals. These traditional transparency mechanisms have resulted in limited success in society, where digital transformation takes place with a fast pace. To address these challenges, privacy visualization via a label representation, like energy and food labels, is considered a promising solution direction. Visualizing privacy, in general, and using privacy labels, in particular, are not straightforward in practice due to, among others, the subjectivity and context dependency of privacy and the adverse (side) impacts of privacy violations. This practicality issue is more evident for Small and Medium-sized Enterprises (SME's) because, compared to large enterprises, they have limited resources for protecting and managing the personal data they process. In this contribution, we investigate the capabilities and limitations of a privacy label and its labeling tool for use by SMEs in three business domains. Accordingly, and within SME settings, we identify the following directions for future research: Enhancing trust in privacy labels, dealing with network aspects, adopting privacy labels and labeling tools, using the labeling process and outcome for auditing own privacy practice, and improving the current privacy labels and labeling tools.

Background To determine the frequency of, and factors associated with, death in hospital following ICU discharge to the ward. Methods The Large observational study to UNderstand the Global impact of Severe Acute respiratory FailurE study was an international, multicenter, prospective cohort study of patients with severe respiratory failure, conducted across 459 ICUs from 50 countries globally. This study aimed to understand the frequency and factors associated with death in hospital in patients who survived their ICU stay. We examined outcomes in the subpopulation discharged with no limitations of life sustaining treatments (‘treatment limitations’), and the subpopulations with treatment limitations. Results 2186 (94%) patients with no treatment limitations discharged from ICU survived, while 142 (6%) died in hospital. 118 (61%) of patients with treatment limitations survived while 77 (39%) patients died in hospital. Patients without treatment limitations that died in hospital after ICU discharge were older, more likely to have COPD, immunocompromise or chronic renal failure, less likely to have trauma as a risk factor for ARDS. Patients that died post ICU discharge were less likely to receive neuromuscular blockade, or to receive any adjunctive measure, and had a higher pre- ICU discharge non-pulmonary SOFA score. A similar pattern was seen in patients with treatment limitations that died in hospital following ICU discharge. Conclusions A significant proportion of patients die in hospital following discharge from ICU, with higher mortality in patients with limitations of life-sustaining treatments in place. Non-survivors had higher systemic illness severity scores at ICU discharge than survivors. Trial Registration: ClinicalTrials.gov NCT02010073.

Today, our environment and the objects therein are equipped with an increasing number of devices such as cameras, sensors, and actuators, which all together produce a huge amount of data. Furthermore, we observe that citizens generate data via social media applications running on their personal devices. Smart cities and societies are seeking for ways to exploit these vast amounts of data. In this paper, we argue that to take full advantage of these data, it is necessary to set up data governance properly, which includes defining, assigning, and allocating responsibilities. A proper setting up of data governance appears to be a challenging task since the data may be used irresponsibly, thoughtlessly and maliciously, resulting in many (un)wanted side effects such as violation of rules and regulations, human rights, ethical principles as well as privacy and security requirements. We elaborate on the key functionalities that should be included in the governance of a data ecosystem within smart cites, namely provisioning the required data quality and establishing trust, as well as a few organizational aspects that are necessary to support such a data governance. Realizing these data governance functionalities, among others, asks for making trade-offs among contending values. We provide a few solution directions for realizing these data governance functionalities and making trade-offs among them.

Often collected data sets contain more personal information than needed for a certain purpose. According to privacy laws and regulations the personal data in a data set should be minimized only to the data that are required and allowed for a chosen (legitimate) data usage. Statistical Disclosure Control (SDC) is one of the main data minimization technologies. Applying minimization technologies, particularly the SDC technology, into practice and embedding them within organizational settings can be a complex and demanding task for non-experts (i.e., those without prior experience and affinity with those technologies). In case of the SDC technology, for example, this challenge stems from its complexity, its context-dependency, its multi-disciplinarity, and its liability and accountability burdens. In this contribution we explain why personal data minimization is necessary, review the types of technologies for personal data minimization, present a framework we envision for embedding SDC technology in organizations, and mention the artifacts that, based on technology adoption theories, we have developed for embedding SDC technology within organizations. The envisioned framework comprises a structural model for deploying SDC technology and an iterative process for evolutionary organizational learning. At the end, we discuss the results obtained so far and mention some future research directions.

Organizations collect a vast amount of data of different types, from various sources, and through different channels. Primarily, these data are used by these organizations to facilitate their core business processes. However, today we witness a growing tendency to use these data for other purposes than that they are collected for. To this end, the data from one information system are combined with those of other information systems. Subsequently, the combined data are analyzed with advanced data analytics tools. Although there is a strong and practical need to apply such findings of data analytics to improve, among others, organizations’ (social) services, it is often not straightforward how to apply these findings in practice. This is due to many challenges arising from legal, ethical, and data quality concerns. In this chapter, we discuss the main reasons that hamper the application of data analytics findings, particularly pertaining to data collection processes and data analysis processes (like data mining and statistics). These reasons include inadequate transformations of statistical truths to individual cases, chances to fall into the trap of system realities, and required efforts to deal with the evolving semantics of data over time. The latter is due to the fact that our (social) environment is subjected to constant changes. We discuss two strategies to harvest data analytics findings in a responsible way. By means of some real-life examples in the field of social services we illustrate the applications of the strategies in practice. Furthermore, we argue that the findings from data-driven analytics may augment real-world ecosystems if they are applied with caution and responsibly.

In the current era of data driven governance and businesses, data sharing and opening become an essential growth factor. Data intensive organizations are eager to share their data with the public, research institutions and private enterprises. However, data sharing must adhere to data protection laws and regulations, particularly respect the principle of personal data minimization. Statistical Disclosure Control (SDC) is a major technology that aims at minimizing personal information in a data set while retaining the data utility at an acceptable level for data consumers. Despite having many tools developed to automate the process of applying SDC technology, still the majority of organizations are struggling to adapt it. In this contribution, first, we mention the common challenges that data intensive organizations are facing for employing existing SDC tools. Then, we propose a SDC tool set-up, whereby organizations can outsource the anonymization of their microdata sets to a central party safely (i.e., without sharing their raw data). Finally, we present the current status of the study together with a few questions for future research.

The profiles from data-driven profiling applications are a model of the reality. The interpretability of these profiles for end users, e.g. policymakers, is often far from trivial. How and why these models are obtained by the applications are often regarded as a black box. In recent years several profiling applications used by public organizations have led to wrong interpretations of the obtained models and impacted individuals and society adversely. Hence, the research focus has increasingly shifted towards dealing with the trust and interpretability issues of the models. In support of a more careful and proper interpretation of these models, several scholars have advocated a glass box approach that aims at making these models more transparent to end users. In this paper, we operationalize the glass box approach for a Genetic Algorithm (GA) based profiling application. To enhance the interpretability of the models provided by the application, we aim at facilitating the interaction of domain experts with the models. Hereby domain experts can gain insight to the evolvement of the profiles and what happens to the profiles if we change or add a new pieces of information. Adding such an interactive visualization provides more transparency about the derived models, making them more understandable for end users and policymakers. As a result, they can better assess and explain the consequences of those models when they apply to practice.

A promising vehicle for a smart government is the exploitation of the large amount of heterogeneous data that becomes available increasingly. The field of Big Data (BD) responds to this promise by leveraging the potentials of such data. In this paper, a systematic approach is adopted to argue why the use of BD, particularly for policymaking within smart government, is challenging. Wrongly interpreting BD-based models may impact individuals adversely and affect society negatively. Therefore, it is important to take care of a proper interpretation of BD models and their appropriate practical application. To this end, it is advocated adopting a glass box approach. The major building blocks of this glass box approach correspond to the data as the input for analyses, the algorithms to analyze the input data, and the models as the output of the analyses. Depending on the application at hand, each of these building blocks should be made transparent to an appropriate extent. The overall transparency (i.e., the outcome of the transparencies of these building blocks) should aim at making the output models understandable for policymakers so that they can assess the consequences of those models adequately when used for policy development. Further, policymakers should adopt well-thought-out strategies for using uncertain BD models responsibly. A framework is suggested to systematically specify (and address) the issues of achieving the glass box objectives and discuss the strategies needed for dealing with uncertain BD models.

In the operational systems of the Dutch Public Prosecution Service, data about criminal cases are registered. This information is used to generate crime statistics or other management information as input for policymaking. A key element for these statistics is the crime type of a case, which is normally deduced from the registered law articles of each case. However the quality of these registered law articles has shortcomings. Additional data describing the crime could be useful to enhance the equality of these law articles. In this paper we investigate the possibility to map additional descriptions of the crime to the formal notations of law articles using a deep learning neural network approach called sequence-to-sequence learning. We describe the characteristics of the data and carry out a number of experiments on these data. Subsequently, we compare two approaches: a) one-hot encoding for the words in a sentence and b) pre-trained word embeddings. The results show that the mapping of the crime description to law articles works reasonably well: a measured accuracy of 91% is reached, and when some issues in the dataset would be resolved the performance could be even higher.

Designing privacy-protecting Information Systems (ISs), i.e., realizing the Privacy by Design (PbD) principle, is a challenging task. This challenge stems from having many stakeholders and design trade-offs involved, which cause uncertainty in defining the problem, eliciting soft requirements, and making design trade-offs among many contending objectives. As creating a formal model of such settings is often infeasible, applying a conventional engineering design method alone may not result in elucidating users' needs and/or devising a viable design that is acceptable for all parties (e.g., end-users and data subjects). This contribution aims at enriching engineering approaches for privacy-protecting ISs with the so-called design-thinking approach. Design-thinking, initially used for product and service design, has been applied to the areas where there are interactions among people, organizations and technologies, in order to elucidate user needs and concerns that are insufficiently formulated and/or hidden in tacit knowledge. In this contribution, we elaborate on three main PbD components, namely problem space, solution space and mapping space. We, further, analyze the shortcomings of traditional engineering approaches for privacy protection as well as the potentials and shortcomings of design-thinking in general. Finally, we present our practical experience with applying the design-thinking approach to the problem of PbD for ISs. We foresee the applicability of design-thinking for elucidating the problem space as well as for making design trade-off among contending values in order to come up with a viable design option.

This paper presents a framework to provide a unified view towards the visions of smart and open justice. The framework, coined as Legal Logistics, aims at unifying and embodying different data-centric services that exploit available and relevant data for supporting and enhancing the legitimacy and efficiency of legal systems. As such, the framework specifies the scope of data-centric services in legal systems. Such a unified view of data-centric services, enables the authors to relate these services to each other and to their operational context, and better streamline data-centric based innovations in legal systems. Two data-centric services realized for the Dutch criminal justice system will be discussed. These services innovatively integrate different datasets in order to give some insights about the well-functioning and budgetary needs of the Dutch legal system. These use cases primarily illustrate the typical challenges and benefits of realizing the vision of smart justice. Secondarily, they illustrate the relevancy and usefulness of the embodying Legal Logistics framework.

Purpose Information dissemination has become a means of transparency for governments to enable the visions of e-government and smart government, and eventually gain, among others, the trust of various stakeholders such as citizens and enterprises. Information dissemination, on the other hand, may increase the chance of privacy breaches, which can undermine those stakeholders’ trust and thus the objectives of transparency. Moreover, fear of potential privacy breaches compels information disseminators to share minimum or no information. The purpose of this study is to address these contending issues of information disseminations, i.e. privacy versus transparency, when disseminating judicial information to gain (public) trust. Specifically, the main research questions are: What is the nature of the aforementioned “privacy–transparency” problem and how can we approach and address this class of problems? Design/methodology/approach To address these questions, the authors have carried out an explorative case study by reconsidering and analyzing a number of information dissemination cases within their research center for the past 10 years, reflecting upon the whole design research process, consulting peers through publishing a preliminary version of this contribution and embedding the work in an in-depth literature study on research methodologies, wicked problems and e-government topics. Findings The authors show that preserving privacy while disseminating information for transparency purposes is a typical wicked problem, propose an innovative designerly model called transitional action design research (TADR) to address the class of such wicked problems and describe three artifacts which are designed, intervened and evaluated according to the TADR model in a judicial research organization. Originality/value Classifying the privacy transparency problem in the judicial settings as wicked is new, the proposed designerly model is innovative and the realized artifacts are deployed and still operational in a real setting.

Judiciary systems comprise various partner organizations (e.g., police, public prosecutor, courts, and rehabilitation centres) that collaboratively resolve criminal cases. These partner organizations have their own data administration and management systems, which are setup/operated separately and integrated barely. This chapter explains the approach of the authors' organization for integrating the data sets of the Dutch judiciary systems, and for opening the data integration outcomes to the public and/or to specific groups. These outcomes (e.g., data sets and reports) are meant to provide useful insights into (the performances of) the partner organizations individually and collectively. Such data opening efforts do not comply with all Open Data requirements, mainly due to the quality, (privacy) sensitivity and interoperability issues of the raw data. Nevertheless, since these initiatives aim at delivering some benefits of Open Data, the chapter introduces the new paradigm of Semi-Open Data for acknowledging such data opening initiatives.

Some public organisations, despite being committed to attain the ideals of Open Data, struggle to meet the Open Data requirements fully. Often this is the case when their data are of low quality, have (potentially) sensitive information, or have non-interoperable format and semantics. These restrictions, for example, apply quite often to the datasets of justice domain. In practice, nevertheless, many of such public organisations do share their data in a way that partially satisfies the Open Data Requirements in order to be, e.g., transparent. To acknowledge such data opening initiatives, we advocate and describe a method to assess the degree of data openness, as a first step for recognizing such so-called Semi-Open Data initiatives. The proposed method relies on a multi-dimensional method to quantify these initiatives in terms of their adherence, i.e., distance, to the Open Data requirements. We carry out eight case studies and present the results in a way that it shows how to construct and fine-tune the parameters of the proposed method incrementally in a sense making way (i.e., based on consensus among stakeholders involved in a given domain). We report on the feasibility and applicability of the proposed model in practice and the encountered challenges.

To enhance the transparency, accountability and efficiency of the Dutch Ministry of Justice and Security, the ministry has set up an open data program to proactively stimulate sharing its (publicly funded) data sets with the public. Disclosure of personal data is considered as one of the main threats for data opening. In this contribution we argue that, according to Dutch laws, the criminal data within the Dutch justice domain are sensitive data in GDPR terms and that the criminal data can only be opened if these sensitive data are transformed to have no personal information. Subsequently, having no personal information in data sets is related to two GDPR concepts: the data being anonymous in its GDPR sense or the data being pseudonymized in its GDPR sense. These two GDPR concepts, i.e., being anonymous data or pseudonymized data in a GDPR sense, can be distinguished in our setting based on whether the data controller cannot or can revert the data protection process, respectively. (Note that the terms anonymous and pseudonymized are interpreted differently in the technical domain.) We examine realizing these GDPR concepts with the Statistical Disclosure Control (SDC) technology and subsequently argue that pseudonymized data in a GDPR sense delivers a better data utility than the other. At the end, we present a number of the consequences of adopting either of these concepts, which can inform legislators and policymakers to define their strategy for opening privacy sensitive microdata sets, like those pertaining to the Dutch criminal justice domain.

Disclosure of personal data is considered as one of the main threats for data opening. In this contribution we consider the data that are sensitive in GDPR terms (for example, criminal justice data within the Dutch justice domain) and discuss how they can be opened. According to Dutch laws, such data can be opened if they are without personal information. Subsequently, we distinguish two cases for having no personal information in data sets based on whether the data controller cannot or can revert the data protection process. These two cases are related to two GDPR concepts of data being anonymous or pseudonymized in its GDPR sense, respectively. In this contribution we highlight the need for deciding on which GDPR concept should be adopted for opening sensitive data sets (i.e., whether the opened data should be protected against data controllers or not). For making this decision, we recommend policymakers to consider also the impacts of realizing the prevalent concept on, e.g., data utility.

Institutions such as governmental and scientific organizations share information to gain the public trust. Information sharing, on the other hand, may cause privacy breaches and undermine the stakeholders' trust in such information sharing institutions. Thus, information sharing may work against the purpose of gaining trust through transparency. Moreover, fear of potential privacy breaches compels information disseminators to share minimum or no information. In this contribution, we present two procedures – the so-called restricted access procedure and open access procedure – to disseminate information for the contending purposes of transparency and privacy preservation. These procedures enable sharing of data with data requesters directly or via a trusted third party, respectively, in the context of our public judiciary organization. We have developed and operationalized these design artifacts in an organizational context and the resulting procedures have emerged from operational interactions within our organization. As such, our inquiry of knowledge thereto can be considered as an action design research. This contribution describes our approach and reflects upon our practice inspired research, where we share the gained insights and present some design guidelines – like providing usage control through implicit and explicit feedback, sharing data with scientists and for scientific purposes, and adopting a pre-commitment strategy – for the information systems that aim at sharing information in a real setting and in a privacy preserving way.

In this paper we present a data-driven profiling approach that we have adopted and implemented for a municipality. Our aim was to make profiles transparent and meaningful for citizens, policymakers and authorities so that they can validate, scrutinize and challenge the profiles. Our approach relies on a Genetic Algorithm (GA) that searches for useful and human understandable group profiles. Furthermore, we discuss some of the challenges encountered, show a selection of the profiles that were found by the GA, and discuss the necessity and a number of ways of validating these profiles in accordance with, e.g., privacy and non-discrimination laws and guidelines before using them in practice.

The Internet of Things (IoT) is rapidly growing, and offers many economical and societal potentials and benefits. Nevertheless, the IoT also introduces new threats to our Security, Privacy and Safety (SPS). The existing work on mitigating these SPS threats often fails to address the fundamental challenges behind the mitigation measures proposed, and fails to make the relations between different mitigation measures explicit. This paper, therefore, offers a conceptual framework for understanding and approaching the challenges and obstacles that arise in addressing the SPS threats of the IoT. This contribution aims to help policymakers in adopting policies and strategies that stimulate others to develop, deploy and use IoT devices, applications and services in secure, privacy-friendly and safe ways.

Legitimately collected and accessed data must also be used appropriately according to laws, guidelines, policies or the (current) preferences of data subjects. For example, inconsistency between the data collection purpose and the data usage purpose may conflict with some privacy principles. In this contribution we motivate adopting the usage control model when joining vertically-separated relational datasets and characterize it as obligations within the Usage Control (UCON) model. Such obligations are defined by the state of the object (i.e., a dataset) in the UCON model with respect to the state of another object/dataset. In case of the join operation, dependency on two UCON objects (i.e., two datasets) results in a new type of UCON obligations. We describe also a number of mechanisms to realize the identified concept in database management systems. To this end, we also provide some example methods for determining whether two given datasets can be joined.

The collection and analysis of relevant data for evaluating public policies is not a straightforward task. An important type of such studies is the so-called ex-post evaluation. The main objective of ex-post evaluations is to determine to what extent a realized intervention is successful in tackling a societal challenge, e.g., youth unemployment. At a first glance an obvious method is to collect some baseline measurements for a set of relevant variables, apply the intervention for a while and collect the new measurement values for the same set of variables. Then, comparing the measurement values of the variables before and after the intervention provides an insight into the extent of successfulness of the intervention. This, however, is only true if the "ceteris paribus" condition holds. In practice it is infeasible to enforce this condition for societal challenges. Often, after having the baseline measurements, several phenomena emerge that may impact the new measurements without being taken into account. This makes it difficult to determine how much of the measured differences between the values of the variables before and after the intervention should be attributed to the emerging phenomena (or the so-called counterfactuals) and how much of the differences can be attributed to the applied intervention. This paper discusses how exploiting big data may contribute to the task of elucidating the influences of counterfactuals (and interventions) in ex-post evaluation studies. The paper proposes a framework to utilize big data for accounting for the impact of emerging phenomena in ex-post evaluation studies.

Data quality management is a great challenge in today’s world due to increasing proliferation of abundant and heterogeneous datasets. All organizations that realize and maintain data intensive advanced applications should deal with data quality related problems on a daily basis. In these organization data quality related problems are registered in natural languages and subsequently the organizations rely on ad-hoc, non-systematic, and expensive solutions to categorize and resolve registered problems. In this contribution we present a formal description of an innovative data quality resolving architecture to semantically and dynamically map the descriptions of data quality related problems to data quality attributes. Through this mapping, we reduce complexity – as the dimensionality of data quality attributes is far smaller than that of the natural language space – and enable data analysts to directly use the methods and tools proposed in literature. Another challenge in data quality management is to choose appropriate solutions for addressing data quality problems due to lack of insight in the long-term or broader effects of candidate solutions. This difficulty becomes particularly prominent in flexible architectures where loosely linked data are integrated (e.g., data spaces or in open data settings). We present also a decision support framework for the solution choosing process to evaluate cost-benefit values of candidate solutions. The paper reports on a proof of concept tool of the proposed architecture and its evaluation.

When datasets are collected and accessed legitimately, they must still be used appropriately according to policies, guidelines, rules, laws, and/or the (current) preferences of data subjects. Any inconsistency between the data collection and data usage processes can conflict with many principles of privacy like the transparency principle, no secondary use principle, or intended purpose usage principle. In this contribution we show how the usage control for the inner join operation in vertically separated relational datasets can be characterized as pre and post obligations of the Usage Control (UCON) model. This type of obligations is defined not only by the state of the UCON object (i.e., a dataset) itself, but also with respect to the state of another dataset. Such dependency on two datasets/objects provides a new insight in UCON obligation constructs when applied to the join operation. We describe also a mechanism to realize the identified obligation in a database management system.

While in business and private settings the disruptive impact of advanced information communication technology (ICT) have already been felt, the legal sector is now starting to face great disruptions due to such ICTs. Bits and pieces of innovations in the legal sector have been emerging for some time, affecting the performance of core functions and the legitimacy of public institutions. In this paper, we present our framework for enabling the smart government vision, particularly for the case of criminal justice systems, by unifying different isolated ICT-based solutions. Our framework, coined as Legal Logistics, supports the well-functioning of a legal system in order to streamline the innovations in these legal systems. The framework targets the exploitation of all relevant data generated by the ICT-based solutions. As will be illustrated for the Dutch criminal justice system, the framework may be used to integrate different ICT-based innovations and to gain insights about the well-functioning of the system. Furthermore, Legal Logistics can be regarded as a roadmap towards a smart and open justice.

The storage of large amounts of network data is a challenging problem, in particular if it still needs to be actively consulted as for example in the case of network forensics. Here we propose a method to compress NetFlow data while simultaneously adding domain knowledge. Our method is based on a pattern classification scheme by considering all flows from a single source IP address simultaneously. Each pattern can be described by at most 19 attributes that give a good statistical description of the original NetFlow data, while minimising information loss. We estimate that on average a factor of about 300 in storage space can be gained. The process is explained using a real world dataset from a large, high-speed, network, and a formal rationale is provided.

Some organizations have faced serious obstacles for disseminating their data according to the Open Data requirements and characteristics, e.g., for everybody and any use. Often this is the case when the data is of low quality, has (potentially) sensitive information, or has non-interoperable data format and semantics. Not being able to (completely) satisfy the Open Data requirements may have made such organizations to appear incompliant with the ideals and objectives of Open Data, despite their full commitments and efforts for data opening. In this contribution we propose a new paradigm -- called Semi-Open Data paradigm -- in order to frame, acknowledge, and encourage such initiatives and efforts that strive along the Open Data objectives but do not comply with Open Data requirements completely due to some practical constraints. For the proposed Semi-Open Data paradigm we further present an assessment method to measure and categorize Semi-Open Data initiatives objectively. This method offers a better way to assess and reward the extent of organizations' efforts to meet the Open Data characteristics than the current method that checks whether all Open Data requirements are met or not (i.e., by making a binary decision).

This article discusses the challenges for methodological innovation on the basis of experiences in an experimental Living Lab setting: a context-aware Coffee Corner in a research institute. A context-aware infrastructure collects sensory information on users while they move and interact. People getting coffee can use a variety of services offered in the intelligent environment at the Coffee Corner's site; for example, a colleague-radar application allows users to see the current positions of their colleagues in the building. At the same time, it identifies and authenticates users using proximity-aware and context-aware security features. Apart from proximity and context awareness, the analysis of contextual data allows the construction of a behavioral model of users that can be used to customize the services offered at the Coffee Corner. We explain how the Living Lab allows us to measure behavior in context in an unobtrusive and trustworthy way (e.g., by respecting a user's right to privacy).

We propose trust to enhance security in adaptive and non-intrusive user authentication in controlled and pervasive environments. In addition to who a user is (e.g., via biometrics) and what a user knows (e.g., a password, a PIN), recent authentication solutions evaluate what a user has. The user's identity is then derived from what detectable accredited items (e.g., badges, RFIDs) and personal devices (e.g., smart-phones, PDAs) the user shows when authenticating. The level of security of the access is set consequently. Position information is also considered in authentication; only those users carrying authorised items in proximity of certain places can benefit from available resources at those places. Unfortunately, items such as badges, mobile phones, smart phones, RFID-ed cards can be stolen, forgotten, or lost with a consequent risk of identity theft and intrusion. In controlled environment like buildings, where sensors can detect a wide range of different types of items, the security of authentication can be improved by evaluating the amount of trust that can be reposed on the user standing in the area from where he tries to access a resource. This piece of information can be calculated from the positions of all the items linkable to the requester as sensed along time by the different sensors available. Sensors are seen as recommenders that give opinions on a user being in a requested position depending on what they have perceived in the environment. We apply Subjective Logics to model recommendations that originate from different types of location detectors and to combine them into a trust value. Our solution has been tested to improve authentication in an intelligent coffee corner of our research institute. A user at the coffee corner can see, displayed on a wall screen, the position of his colleagues depending on the level of authentication he obtains. The user authentication level depends on the number and on the quality of tokens he provides when authenticating. We comment how the use of a location-based trust (on the requester standing at the coffee corner) improves the adaptability, the non-intrusiveness, and the security of the authentication process. We validate our proposal with a simulation that shows how location-based trust changes when a user device moves away from the coffee corner.

The question of how to make a city or government better by exploiting information and communication infrastructures, referred to as smart city, entails an emerging field of research. Large quantities of data are generated from these infrastructures and infusing these data into the physical infrastructure of a city or government may lead to better services to citizens. Collecting and processing of such data, however, may result in privacy and security issues that should be faced appropriately to create a sustainable approach for smart cities and governments. In this chapter, we focus on data collection through crowdsourcing with smart devices and identify the corresponding security and privacy issues in the context of enabling smart cities and governments. We categorize these issues in four classes. For each class, we identify a number of threats as well as solution directions for these threats.

Cyber criminals use phishing emails in high-volume and spear phishing emails in low volume to achieve their malicious objectives. Hereby they inflict financial, reputational, and emotional damages on individuals and organizations. These (spear) phishing attacks get steadily more sophisticated as cyber criminals use social engineering tricks that combine psychological and technical deceptions to make malicious emails as trustworthy as possible. Such sophisticated (spear) phishing emails are hard for email protection systems to detect. Security researchers have studied users' ability to perceive, identify and react upon email (spear) phishing attacks. In this study we have surveyed recent works on understanding how to prevent end-users from falling for email (spear) phishing attacks. Based on the survey we design and propose a novice method that combines interaction methods of reporting, blocking, warning, and embedded education to harness the intelligence of expert and novice users in a corporate environment in detecting email (spear) phishing attacks. We evaluate the design based on a qualitative study, in three experimental steps, by using a mockup prototype, and with 24 participants. We report on the insights gained, indicating that the proposed combination of the interaction methods is promising, and on future research directions.

Information sharing has become a means of gaining public trust for institutions such as governmental and scientific organizations. The transparency sought through information sharing contributes to the trust of various stakeholders such as citizens, other organizations and enterprises in such institutions. Information sharing, on the other hand, may increase the chance of privacy breaches due to, for example, information leakage and information fusion. Such privacy breaches can undermine stakeholders' trust and thus work against the purpose of gaining trust through transparency. Moreover, fear of potential privacy breaches compels information disseminators to share minimum or no information. In this contribution we show that creating transparency through sharing information in the context of our public judiciary organization is a typical wicked problem. Subsequently we explain (the outcomes of) our designerly approach to design and intervene three artifacts within our organization. These artifacts are aimed at disseminating our judiciary data in a privacy preserving way, as privacy preservation contributes positively to the information sharing. Through addressing the privacy problem we try to address the transparency problem.

Service platform functions are enablers of adaptive communication services and applications that hide the heterogeneity of the infrastructure, manage personal reachability, manage implicit context, and adapt modality to the context. Furthermore, they can offer a diversity of services, whereby an optimal tradeoff can be made for end users in comfort, cost, security, and mobility. We consider the enablers of context-aware services in distributed environments and present a context management framework that is generic through its hierarchic ordering of context sources and extensible with multiple reasoning realizations. The article focuses on the architectural principles and reasoning methods of the framework

Undergraduate students who seek a bachelor degree in Dutch universities of applied sciences are supposed to learn also research skills so that they can provide innovative solutions to real problems of the society and businesses in their future careers. Current education and textbooks on research skills are not tuned well to software engineering disciplines. This paper describes our vision about the scope and model of the research suitable for software engineering disciplines in Dutch universities of applied sciences. Based on literature study we identify a number of research models that are commonly used in computer science. Through reviewing a number of graduation reports in our university, we further identify which of the research models are most suitable for the (graduation) projects of software engineering disciplines and also investigate their shortcomings with respect to the desired research skills. Our study reveals that the approach of most graduation works is close to the implementation-based (also called build-based or proof by example based) research model. In order to be considered as a realization of sound applied research, however, most of theses graduation works need to be improved on a number of aspects such as problem context definition, system/prototype evaluation, and critical literature study.

Legal persons (i.e., entities such as corporations, companies, partnerships, firms, associations, and foundations) may commit financial crimes or employ fraudulent activities like money laundering, tax fraud, or bankruptcy fraud. Therefore, in the Netherlands legal persons are automatically screened for misuse based on a set of so called risk indicators. These indicators, which are based on the data obtained from, among others, the Netherlands Chamber of Commerce, the Dutch police, and the Dutch tax authority, encompass information about certain suspicious behaviours and past insolvencies or convictions (criminal records). In order to determine whether there is an increased risk of fraud, we have devised a number of scoring functions to give a legal person a score on each risk indicator based on the registered information about the legal person and its representatives. These individual scores are subsequently combined and weighed into a total risk score that indicates whether a legal person is likely to commit fraud based on all risk indicators. This contribution reports on our two ranking approaches: one based on the empirical probabilities of the indicators and the other based on the information entropy rate of the empirical probabilities.

The Florence project develops a robot for elderly that provides multiple Ambient Assisted Living (AAL) and Lifestyle services with a consistent user-interface. The project success is measured by the acceptance of these services by the user group. Enabling such service robotics in (smart) homes requires a robust and flexible platform to collect, enhance and distribute sensory information; and to manipulate the actuators in the environment. A key characteristic of such an environment is that sensors and actuators are not always available, are distributed, and are mobile (due to e.g. the robot and phone mobility). This dynamicity requires a loose coupling between services and sensors/actuators. The paper describes the design principles and high level architecture of the Florence platform that hides the distribution, availability and mobility aspects from the services, and sketches some challenges that lie ahead.

Emerging healthcare applications rely on personal mobile devices to monitor and transmit patient vital signs to hospital-backend servers for further analysis. However, these devices have limited resources that must be used optimally in order to meet the application user requirements (e.g. safety, usability, reliability, performance). This paper reports on a case study of a Chronic Obstructive Pulmonary Disease telemonitoring application delivered by the mobihealth system. This system relies on a commercial mobile device with multiple (wireless) Network Interfaces (NI). Our study focuses on how NI activation strategies affect the application end-to-end data delay (important in case of an emergency situation) and the energy consumption of the device (important for device sustainability while a patient is mobile). Our results show the trade-off between end-to-end delay and battery life-time achieved by various NI activation strategies, in combination with application-data flow adaptation for realtime and near real-time data transmission. For a given mobile device, our study shows an increase in battery life-time of 40- 90 %, traded against higher end-to-end data delay. The insights of our studies can be used for application-data flow adaptation aiming to increase battery life-time and device sustainability for mobile patients; which effectively increases the healthcare application usability.

Location is considered as the most important and relevant context information. Bluetooth technology, being a common feature of commercial mobile devices, is a (or the) key technology that is pervasively available nowadays. There has been not much success in using Bluetooth technology for indoor localization, mainly due to the limitation of the technology. Using the Context Management Frame (CMF) infrastructure deployed in our office building, we have designed, implemented and evaluated a Bluetooth based indoor localization solution that determines the locations of stationary mobile users at a room level. The solution is based on the inquiry response rate of Bluetooth technology. This approach does not require establishing any connectivity between Bluetooth devices. Further, since the solution is infrastructure- and network-based, it does not require mobile devices to be upgraded in any way in order to be localized. The results of experiments show that our solution has 98% accuracy in rooms with full Bluetooth sensor coverage, when the target device being stationary for 3 minutes.

We exploit the ability to sense and use context information to augment or replace the traditional static security measures by making them more adaptable to a given context and thereby less intrusive. We demonstrate that by fusing location information obtained from various sources that are associated to the user and are available over time, the confidence in the identity of the user can be increased considerably. In fact, the level of confidence in the identity of the user is related to the probability that the user is at a certain location. This probability is used as a measure to parameterize the authentication level of the user making it thereby much more adaptive to changing situational circumstances. In this paper we describe the theoretical background for a context-sensitive adaptation of authentication and the design and validation of the system that we have developed to adaptively authenticate a user on the basis of the location of his sensed identity tokens.

Often in wireless communications the cryptographic algorithm is con-sidered as ‘the security solution’ but actually it is only the nucleus. The means for using the cryptographic algorithm is the ‘key’ used by the algorithm. Thus man-agement of keys and security there-of is an important issue. The security of the key management solution should not impede mobility of devices by adding undue delays. Thus, secure and fast key management during mobility is an important is-sue for the third generation partnership project (3GPP) activity on system architec-ture evolution / long-term evolution (SAE/LTE). In this paper we review mobility and security issues with the focus of key management in SAE/LTE and present possible existing solutions together with their analysis.

We investigate the practical feasibility of using context information for controlling access to services. Based solely on situational context, we show that users can be transparently provided anonymous access to services and that service providers can still impose various security levels. Thereto, we propose context-sensitive verification methods that allow checking the user's claimed authenticity in various ways and to various degrees. More precisely, conventional information management approaches are used to compare historic contextual (service usage) data of an individual user or group. The result is a relatively strong, less intrusive and more flexible access control process that mimics our natural way of authentication and authorization in the physical world.

Provisioning of mobile services that are tailored to the needs, capabilities and (network) environment of users, and are available and maintained in a seamless manner when users are roaming (or changing terminal), is an ambition that requires advanced support functions. We studied such support functions for seamless mobility and tailored IP-connectivity by a federated service platform approach: interoperability issues between the various (network) technologies and administrative domains are solved through cooperation of distributed software components in the service control layer that can run on different hardware (in networks and on terminals) operating in different administrative domains. We have built Service Platform components for the server and client-side to facilitate mobile users equipped with terminals with multi-mode interfaces. Federation between various Service Platform operators and forwarding user credentials enables user or terminal to authenticate on various access networks. This ensures that consistent and coherent service access is provided, independent of the current network domain. The current chapter describes (conceptual and validated) solutions for access network selection, seamless handovers, and authentication in a WLAN/GPRS/Ethernet environment with focus on the federated Service Platform, the client-side, and privacy and trust relationships.

Improving authentication delay is a key issue for achieving seamless handovers across networks and domains. This paper presents an overview of fast authentication methods when roaming within or across IEEE 802.11 Wireless-LANs. Besides this overview, the paper analyses the applicability of IEEE 802.11f and Seamoby solutions to enable fast authentication for inter-domain handovers. The paper proposes a number of possible changes to these solutions (typically in terms of network architectures and/or required trust relationships) for inter-domain operation. In addition, the paper identifies the crucial research issues therein. Possible solutions and directions for future research include: update to security infrastructure, inter-layer communication and discovery of appropriate networks.

Many approaches exist today that address the issues that arise when a mobile node changes its point(s) of attachment to the Internet. Mobile IP takes care of host mobility at the IP layer; others at the transport layer (Mobile SCTP) or at the application layer (SIP with re-invite). In practice, most of these approaches rely on functionality residing on the mobile host that scans, detects and activates the networks available through one or more network interfaces.The mechanism proposed in this paper takes into account that multiple of these approaches may be applied at the same time. It provides the applications on the mobile host with information about the state of the lower-layer mobility management protocols (such as Mobile IP) as well as the state and characteristics of the available network resources. Applications may consecutively adapt their behavior depending on this mobility process information and thus accommodate to the changed network connectivity conditions, possibly in an application specific manner. In this paper, we present the architecture of our mobility management mechanism. We also describe the implementation of our prototype and the results of experiments with the mechanism, thereby addressing the complexities of an integrated application-aware mobility management system.

Service platforms are gradually becoming common functional entities in the next generation networks, i.e., in 4G-environments. By providing value-added capabilities to networks and end-users, and facilitating service provisioning for 3/sup rd/ party service providers, the service platforms will prove indispensable in the near future. However, with this increased importance, the need for cooperation between service platforms also increases. The use of the well-known concept of federation results in a structured framework to this cooperation. The proposed framework carefully defines the notion of service platform domain, applies the concepts of domain federation and service federation to these service platform domains, and prescribes the construction of federations between these domains. The benefits of the resulting service platform federation for all involved parties (end-user, network operator and service provider) are explained by the example of the home environment capability.

We present an access control architecture that restricts access of train and tourist office services to travelers that are really on the train. For this purpose location and velocity information are used as alternative authentication and authorization credentials. The ambient intelligence of our transparent access control mechanism manifests itself as a pool of verification methods of increasing strengths. These verification methods are based on the proximity principle and relational contextual history information about WLAN access points, fellow train travelers, the train itself and its conductor or driver.

A 4G-environment is based on the integration of 3G mobile and other wired and wireless technologies into an all-IP network environment. Central to such an environment is a 4G-service platform, which offers services such as AAA, mobility management and session control, and also mediates between the users and providers of these services. Each service platform and its associated users, service providers and access networks constitute a service platform domain. Extension of offered functionality and expansion of coverage is obtained by federation between multiple service platform domains. In the 4GPLUS project a conceptual framework is developed for 4G-environments, which specifies the functionality and structure of the 4G-service platform and the concept of federation. Several key aspects of this framework have been refined, implemented and prototyped within this project. This paper provides an overview of the 4G-concepts developed within the project and the main results achieved.

Beyond 3G (B3G) environments typically consist of multi-homed terminals and wireless overlay networks. This paper presents a categorization of IP-level mobility management solutions for B3G environments. Closely observing the mobility requirements of a wide range of possible applications, the paper also motivates the consideration of a new mobility management approach in B3G environments, whereby location management (i.e., reaching mobile end-users at the IP-level for session invitations) is decoupled from handover management (i.e., switching ongoing sessions, collectively or individually, to another access network whenever appropriate). For example, one can use cellular GPRS/UMTS networks for location management and Wi-Fi? or cellular networks for handover management. The paper elaborates upon the merits of such so-called context-aware mobility solutions, which are attained from an optimum use of the mobility management features embedded in the underlying infrastructure.

Beyond 3G-environments are typically defined as environments that integrate different wireless and fixed access network technologies. In this paper, we address IP based Mobility Management (MM) in beyond 3G-environments with a focus on wireless access networks, motivated by the current trend of WiFi, GPRS, and UMTS networks. The GPRS and UMTS networks provide countrywide network access, while the WiFi networks provide network access in local areas such as city centres and airports. As a result, mobile end-users can be always on-line and connected to their preferred network(s), these network preferences are typically stored in a user profile. For example, an end-user who wishes to be connected with highest bandwidth could be connected to a WiFi network when available and fall back to GPRS when moving outside the hotspot area. In this paper, we consider a combination of MM for legacy services (like web browsing, telnet, etc.) using Mobile IP and multimedia services using SIP. We assume that the end-user makes use of multi-interface terminals with the capability of selecting one or more types of access networks based on preferences. For multimedia sessions, like VoIP or streaming video, we distinguish between changes in network access when the end-user is in a session or not in a session. If the end-user is not in a session, he or she needs to be able to start new sessions and receive invitations for new sessions. If the end-user is in a session, the session needs to be handed over to the new access network as seamless as possible from the perspective of the end-user. We propose an integrated but flexible solution to these problems that facilitates MM with a customizable transparency to applications and end-users.