Johanna Johansen
+4773592322
+4741367313
Ametyst-bygget, Gjøvik
Research
Highlights
My work has been published in highly ranked venues such as the IFIP series AICT on Advances in Information and Communication Technology, prestigious journals such as AI & Society, or as a book chapter in the book called "Human Factors in Privacy Research" published by Springer. My work is interdisciplinary, combining among others, aspects of privacy, usability, HCI, qualitative and quantitative methods, and psychology. Notable examples include:
- My work with Simone Fischer-Hübner on "Making GDPR usable" has attracted interest from communities as diverse as the SOUPS (the USENIX Symposium on Usable Privacy and Security) and PETS (Privacy Enhancing Technologies Symposium), and has been invited for a Springer book chapter where we present a substantial validation process and novel method. This work uses extensively qualitative research methods for analysing legal texts as well as experts' opinions.
- My work in the SCOTT European project on "Privacy Labelling" has attracted considerable interest from Europe, with many people attending our workshops and afterwards some contributing as coauthors to the position paper that I edited, now published in the journal Information & Computer Security. This developed a multidisciplinary definition of privacy labels, including business, legal, regulatory, educational, technological, and lay-person perspectives (the latter being the main target stakeholder).
- My work with Tore Pedersen on "Biases in AI" published in Springer's AI & Society, took more than two years, involving tedious quantitative studies with more than 300 participants and multiple validation methods including eye-tracking. This proved the existence of a new (maybe disturbing) source of biases in AI, i.e., the transference of human biases into the software artifact. The biases stem from more long-term strong social, cultural, or educational influences, as well as more short- term weak influences such as (dis-)misinformation in the media or from working cultures. This work has attracted citations from renowned authors such as Baeza-Yates or in top venues such as Communications of ACM.
Topics
In research it is important to make connections between research areas, especially when working in interdisciplinary or broad fields such as Privacy or Artificial Intelligence. Multi-disciplinary synergies need the involvement of different institutions and people, promoting novel ideas and unexpected solutions. A positive outcome of doing such research is the many fruitful collaborations that are created, and a diverse network of partners. During my work I have interacted with diverse people from different fields of study such as privacy, law, psychology, interaction design, or software, having various backgrounds, from students and developers to professors and CTOs. Some of the topics I have worked on are detailed below.
- USABILITY OF PRIVACY
I have worked during my PhD on studying the GDPR and privacy in general with the focus on making privacy regulations more usable (see publications tab). Usability as a concept has been traditionally developed for expert systems, i.e., complicated systems that are having complicated interfaces and require non-trivial interaction processes usually done by experts (e.g., plane pilot’s interactions with a flight control panel). Privacy is a very complex concept as well, which is one of the reasons that people usually give up thinking about privacy, especially when it is exacerbated by the complicated technology and data traces. Even more so, privacy is a concept that has relevance for common users, not only experts, as it is a human right (appearing in the Universal Declaration of Human Rights). It is then clear that usability is paramount for making privacy accessible to common people, thus allowing them to understand and exert their rights, as well as participate in the modern data economy and not just be passively subjected to it.
Examples:
- My Usable Privacy Cube model from the paper "Making GDPR Usable: A Model to Support Usability Evaluations of Privacy" has been well received by the EuroPriSe organization from Germany who is the most advanced GDPR certification scheme in Europe (who started from Germany in the early 2000s). The future can include taking up some of the usable privacy criteria that I have developed into the next version of their certification process.
I have prepared a short video presentation of the Usable Privacy Cube model (see the Knowledge Transfer tab). This was also presented at the SOUPS – Symposium on Usable Privacy and Security, which is the major publication venue in this field. - The Privacy Labels concept from the paper "A multidisciplinary definition of privacy labels" has attracted wide interest from both academia and industry, e.g., the many partners in the SCOTT and IoTSec projects where I have presented a couple of times.
- My Usable Privacy Cube model from the paper "Making GDPR Usable: A Model to Support Usability Evaluations of Privacy" has been well received by the EuroPriSe organization from Germany who is the most advanced GDPR certification scheme in Europe (who started from Germany in the early 2000s). The future can include taking up some of the usable privacy criteria that I have developed into the next version of their certification process.
- BIASES TRANSFERENCE FROM HUMANS TO AI AND AUTOMATED DECISION SYSTEMS
I have worked extensively with all aspects of this comprehensive empirical study for more than 2 years, now published in the Springer's main journal on this topic, namely AI & Society as the paper "Studying human-to-computer bias transference". Since the hypothesis that we have proposed and studied goes beyond the tradition in the field, which is that biases in AI and decission support systems come from the data on which these algorithms are trained, we had to provide strong evidence in our study. Therefore, we had multiple cohorts of subjects, taken from different platforms (both Amazon's Mechanical Turk and SurveyMonkey; as well as “on-the-street” respondents), and do thorough analyses of the data and our coding. We had included several control questions. We have used several techniques for devising our instruments, including eye-tracking technology in the lab at Karlstad University, and pilot testing to improve preliminary versions of our surveys.
This work has required good knowledge of quantitative methods for empirical studies and the adjacent theories and technologies, including statistics and data analysis. This has proven very fruitful because our results are ground-breaking, as we prove a second source of biases in AI, which not only that it has not been proven anywhere else before, but also very few people talk about such a possibility (we have found only two papers that mention the possibility that a human bias held by a person that designs a software system could be transferred to that software artifact).
Acceptance and Potential include:
- Eye-opener.
The few people that we have told about this work, before it got published, during the several years long process of study and publication, had expressed surprise to the possibilities that our results imply. Particularly, Simone sees great potential to extend this into privacy biases; whereas prominent researchers cite now this work in top venues such as Communications of ACM. - Applications in education.
One application is to evaluating Computer Science bachelor programs; i.e., we could evaluate the efficiency of these programs in removing programmer biases transfers by applying our instruments (or specifically devised variants) at the beginning of the study and at the end to compare the transference percentages. - Continuations into privacy biases such as “security=privacy” (as debunked in the book of Bruce Schneier) or “I have nothing to hide” (as debunked in the book of Daniel Solove).
- Eye-opener.
- SUSTAINABILITY IN SEEMINGLY UNRELATED FIELDS
An example of how technology can contribute to sustainability is my paper "InfoInternet for education in the Global South: A study of applications enabled by free information-only internet access in technologically disadvantaged areas". There we study how a form of Internet infrastructure, called InfoInternet, can be used in a mindful manner to enable educational applications in the Global South where this infrastructure is (meant to be) deployed. However, a large portion of the sustainability debate sees technology as affecting sustainability in a negative way; mainly through e-waste and energy consumption. One problem is that most technology people do not think of sustainability in their daily tasks because they do not see the direct relation of their work to “buzzwords” such as green energy or environmental destruction. Throughout my research and teaching I have seen quite often this misunderstanding. However, I have also seen how sustainability can be very much related to seemingly unrelated IT fields such as web development or graphic design. As a consequence, I have started in my teaching to at least try to reveal such “hidden” relationships and show how sustainability can be affected both positively and negatively by fields such as web, as well as digital media, regulations and legislation, or emerging technologies such as IoT or AI.
Efforts and Potential include:
- Sustainability in teaching.
I have developed and have been teaching one MSc course on how to program web applications in a sustainable way. Here sustainability has various aspects, and only some of them relate to energy consumption (e.g., how much processing your algorithms need to do). Other aspects relate to making the web app available to disadvantaged groups or to how to define business goals, choose third-party services/libraries, or enable interoperability.
However, sustainability can be taught in any course, definitely in all IT courses, even if teachers do not currently always see this. Sustainability can be one of the lectures or labs/seminar of a course. Metaphorically, one can see sustainability in IT as fire-escape in architecture, i.e., an architect dose many interesting things with a building, but she always needs to think of the fire-escape plan; the same an IT engineer can do many wonders with a software, but should always think of the sustainability plan. Sustainability can be even more important for digital records that new digital societies such as Norway abound of. Any form of improper manipulation (loss, change) of digital records can destabilize the society (one pillar of sustainability) or the economy (another of the three pillars). - Digital Sustainability.
The digitalization of society produces many digital resources that have to be preserved in a similar manner as physical resources. For example, much of the knowledge being produced nowadays is digital; be that research article, book, news/debate piece, or anything else from entertainment to health records or educational content. The modern society needs to learn how to sustainably handle these novel resources so that it minimizes double-spending, e.g., so that we do not “reinvent the wheel”. Just think of how libraries hold old newspaper editions; similarly we need to archive various digital resources (and considerable work is being done in this direction).
- Sustainability in teaching.
IoTSec -- Security in IoT for Smart Grids
IoTSec aims is to contribute to a secure and privacy-aware ecosystem for the Internet of Things.
SCOTT -- Secure COnnected Trustable Things
Horizon 2020 Joint Undertaking with budget ca. 34 Mil.Euro and consortium of 52+ partners from 12+ countries during 2017-2020.
Outreach
Privacy Labels in 90 s
Short intro in everyday language.
See article "A Multidisciplinary Definition of Privacy Labels: The Story of Princess Privacy and the Seven Helpers" on the ArXiV using story-telling for a more pleasant reading
https://arxiv.org/abs/2012.01813
Making GDPR Usable
A Methodology to Support Usability Evaluations of Privacy. Presented in simplified language. Published in "Privacy and Identity Management. Data for Better Living: AI and Privacy"
https://link.springer.com/chapter/10.1007/978-3-030-42504-3_18