FEDERAL CYBERSECURITY RESEARCH AND DEVELOPMENT STRATEGIC PLAN (2019) decision support, risk modeling, incident response, and/or threat scoring. Nevertheless, cybersecurity research must consider privacy management as a fundamental aspect of the design of secure systems. The following challenges need to be overcome to ensure that individuals’ privacy is protected in an open, highly digitized economy, and to ensure that U.S. Government agencies, commercial entities, and social networks can access and use personal data in authorized ways without putting individuals’ personal privacy at risk. Challenges • The difficulty of designing privacy-protecting systems. People value privacy differently, perceive • • • • privacy-related harms differently, and vary their privacy requirements with circumstances. To develop systems that are more respectful of peoples’ privacy choices, system designers and developers need to better understand what people value regarding privacy, what people’s privacy desires and expectations are, and the ways privacy might be infringed upon. The lack of appropriate tools for designing systems. System designers need tools that incorporate effective privacy requirements and controls. Even when designers do consider privacy at the beginning of the design process, they lack a systematic approach for understanding and assessing the risks that a system might pose to privacy, for identifying and expressing privacy requirements for a system, and for designing controls that can achieve those goals. Individuals’ needs not only to understand the rules that govern the use of personal data, but also to have confidence that the rules are observed in practice. Techniques are needed that will facilitate people’s expression and implementation of privacy preferences. Furthermore, advances are needed in technologies that can assure that personal data are linked with the rules appropriate for the context in which they are collected and that operations applied to those data are governed by those rules. Privacy concerns deriving from the growing interest in publishing statistics, analyses, and raw data that involves people. Existing approaches for protecting privacy, such as the removal of personally identifiable information, have not been able to address the privacy risks of large-scale data collection, analytics, and release. As more information about individuals is stored and made available, data analytics can often be used to link sensitive information back to individuals, despite efforts to anonymize the data. Techniques are needed to measure and balance reidentification risks against the benefits of data use and storage. Requirements for effective solutions for recovery from privacy violations. Existing recovery mechanisms are limited and are inconsistent in their efficacy. New approaches for recovering from privacy violations need to be developed that are fast, predictable, and easy to implement. R&D Goals • Develop research methods that can reliably and validly sample, measure, and represent people’s privacy desires, expectations, attitudes, beliefs, and interests. Develop methods and technologies that can identify privacy violations and privacy harms effectively and efficiently, with the capability to assess privacy harms. • Devise frameworks that integrate safety, security, and privacy requirements, allowing system designers and developers to reason across all three domains concurrently. Develop privacy trust models that encompass a broad range of authorized data disseminations and uses. Develop languages and reasoners to formally specify, compose, and enforce targeted privacy requirements, including translation from natural-language privacy statements or informationsharing agreements. Advance system design tools for managing privacy risk, i.e., standardized frameworks, libraries, and interfaces; tools to verify designs against privacy requirements; and – 18 –