Protecting privacy in system design: The electronic voting case

Transforming Government: People, Process and Policy

Volumn 1, Issue 4, 2007, Pages 307-332

  Kavakli, Evangelia ^a   Gritzalis, Stefanos ^a   Christos, Kalloniatis ^a  

^a UNIVERSITY OF THE AEGEAN   (Greece)

Author keywords

Automation; Data security; Privacy

Indexed keywords

EID: 84992927367     PISSN: 17506166     EISSN: None     Source Type: Journal    
DOI: 10.1108/17506160710839150     Document Type: Article

References (39)

1. Anderson, P. and Dempsey, J. (2003), “Privacy and e-government: privacy impact assessments and privacy commissioners – two mechanisms for protecting privacy to promote citizen trust online”, memo available at: www.internetpolicy.net/practices/030501pia.pdf.
2. Antón, I. (1996), “Goal-based requirements analysis”, Proceedings of the ICRE '96 IEEE Colorado Springs, Colorado USA, pp. 136-144.
3. Antón, I.A. and Earp, B. (2000), “Strategies for developing policies and requirements for secure electronic commerce systems”, Proceedings of the 1st ACM Workshop on Security and Privacy in E-Commerce (in Conjunction with ACM CCS 2000), 1-4 November, pp. 1-10.
4. Bellotti, V. and Sellen, A. (1993), “Design for privacy in ubiquitous computing environments”, in Ed. Michelis, G., Ed. Simone, C. and Ed. Schmidt, K. (Eds), Proceedings of the Third European Conference on Computer Supported Cooperative Work – ECSCW 93, pp. 93-108.
5. Bennett, K. and Grothoff, C. (2003), “GAP-practical anonymous networking”, Proceeding of the Workshop on PET2003 Privacy Enhancing Technologies, available at: http://citeseer.nj.nec.com/bennett02gap.html.
6. Boyan, J. (1997), “The Anonymizer: protecting user privacy on the web”, Computer-Mediated Communication Magazine, Vol. 4 No. 9, pp. 7-13, available at: www.anonymizer.com.
7. Cannon, J.C. (2004), Privacy, What Developers and IT Professionals Should Know, Addison-Wesley, Reading, MA.
8. Chaum, D. (1981), “Untraceable electronic mail, return addresses, and digital pseudonyms”, Communications of the ACM, Vol. 24 No. 2, pp. 84-88.
9. Chaum, D. (1985), “Security without identification: transactions systems to make big brother obsolete”, Communications of the ACM, Vol. 28 No. 10, pp. 1030-44.
10. Chaum, D. (1988), “The dining cryptographers problem: unconditional sender and recipient untraceability”, Journal of Cryptology, Vol. 1 No. 1, pp. 65-75.
11. Chung, L. (1993), “Dealing with security requirements during the development of information systems”, Proceedings of the CaiSE '93 5th International Conference of Advanced Information Systems Engineering, Paris, France, pp. 234-251.
12. (The) Code of Fair Information Practices (1973), US Department of Health, Education and Welfare, Washington, DC.
13. Dingledine, R., Mathewson, N. and Syverson, P. (2004), “Tor: the second-generator onion router”, Proceedings of the 13th USENIX Security Symposium, San Diego, CA, USA.
14. EU-Information Society DG, IST Programme 2000#29518 (2000), E-vote: An Internet-based Electronic Voting System, Project Deliverable D 7.6, Quality and Reliability SA – University of the Aegean, Greece.
15. Fischer-Hübner, S. (2001), “IT-security and privacy, design and use of privacy enhancing security mechanisms”, Lecture Notes in Computer Science, Vol. 1958, Springer-Verlag, Berlin.
16. Goldschlag, D., Syverson, P. and Reed, M. (1999), “Onion routing for anonymous and private internet connections”, Communications of the ACM, Vol. 42 No. 2, pp. 39-41.
17. Gritzalis, S. (2004), “Enhancing web privacy and anonymity in the digital era”, Information Management & Computer Security, Vol. 12 No. 3, pp. 255-288.
18. He, Q. and Antón, I.A. (2003), “A framework for modelling privacy requirements in role engineering”, paper presented at International Workshop on Requirements Engineering for Software Quality (REFSQ), Austria Klagenfurt/Velden, 16-17 June, pp. 115-124.
19. Hong, J.I., Ng, J., Lederer, S. and Landay, J.A. (2004), Privacy Risk Models for Designing Privacy-sensitive Ubiquitous Computing Systems, Designing Interactive Systems, Boston, MA.
20. Jensen, C., Tullio, J., Potts, C. and Mynatt, D. (2005), “STRAP: a structured analysis framework for privacy”, GVU Technical Report.
21. Kalloniatis, C., Kavakli, E. and Gritzalis, S. (2007), “Using privacy process patterns for incorporating privacy requirements into the system design process”, Proceedings of the Workshop on Secure Software Engineering (SecSe 2007), in Conjunction with the ARES 2007 International Conference on Availability, Reliability and Security, Vienna, Austria, April, pp. 1009-16.
22. Kavakli, E., Kalloniatis, C. and Gritzalis, S. (2005), “Addressing privacy: matching user requirements with implementation techniques”, Proceedings of the 7th Hellenic European Conference on Computer Mathematics and its Applications, Athens, Greece, September, LEA Publications, Hillsdale, NJ, pp. 1-8.
23. Kavakli, E., Kalloniatis, C., Loucopoulos, P. and Gritzalis, S. (2006), “Incorporating privacy requirements into the system design process: the PriS conceptual framework”, Internet Research, Vol. 16 No. 2, pp. 140-158.
24. Koorn, R., van Gils, H., ter Hart, J., Overbeek, P. and Tellegen, R. (2004), “Privacy enhancing technologies”, White paper for Decision Makers. Ministry of the Interior and Kingdom Relations, The Hague, December.
25. Liu, L., Yu, E. and Mylopoulos, J. (2002), “Analyzing security requirements as relationships among strategic actors”, Proceedings of the SREIS'02, Raleigh, NC, available at: www.sreis.org/old/2002/finalpaper9.pdf.
26. Liu, L., Yu, E. and Mylopoulos, J. (2003), “Security and privacy requirements analysis within a social setting”, Proceedings of the RE'03 11th IEEE International Requirements Engineering Conference, Monterey Bay, CA, USA, pp. 151-161.
27. Loucopoulos, P. (2000), “From information modelling to enterprise modelling”, Information Systems Engineering: State of the Art and Research Themes, Springer-Verlag, Berlin, pp. 67-78.
28. Loucopoulos, P. and Kavakli, V. (1999), “Enterprise knowledge management and conceptual modelling”, LNCS, Vol. 1565, pp. 123-143.
29. Moffett, D.J. and Nuseibeh, A.B. (2003), “A framework for security requirements engineering”, Report YCS 368, Department of Computer Science, University of York, Heslington.
30. Mouratidis, H., Giorgini, P. and Manson, G. (2003a), “An ontology for modelling security: the Tropos project”, in Ed. Palade, V., Ed. Howlett, R.J. and Ed. Jain, L. (Eds), Proceedings of the KES 2003, Session: Ontology and Multi-agent Systems Design, UK, University of Oxford, Lecture Notes in Artificial Intelligence 2773, Springer-Verlag, Berlin, pp. 1387-94.
31. Mouratidis, H., Giorgini, P. and Manson, G. (2003b), “Integrating security and systems engineering: towards the modelling of secure information systems”, Proceedings of the CAiSE '03, LNCS 2681, Springer-Verlag, Berlin and Heidelberg, pp. 63-78.
32. Mylopoulos, J., Chung, L. and Nixon, B. (1992), “Representing and using non-functional requirements a process oriented approach”, IEEE Transactions on Software Engineering, Vol. 18, pp. 483-497.
33. Pfitzmann, A. and Waidner, M. (1987), “Networks without user observability”, Computers & Security, Vol. 6 No. 2, pp. 158-166.
34. Reed, M., Syverson, P. and Goldschlag, D. (1998), “Anonymous connections and onion routing”, IEEE Journal on Selected Areas in Communications, Vol. 16 No. 4, pp. 482-494.
35. Reiter, K.M. and Rubin, D.A. (1998), “Crowds: anonymity for web transactions”, ACM Transactions of Information and Systems Security, Vol. 1 No. 1, pp. 66-92.
36. Reiter, K.M. and Rubin, D.A. (1999), “Anonymous web transactions with crowds”, Communications of the ACM, Vol. 42 No. 2, pp. 32-38.
37. Shields, C. and Levine, N.B. (2000), “A protocol for anonymous communication over the internet”, in Ed. Samarati, P. and Ed. Jajodia, S. (Eds), Proceedings of the 7th ACM Conference on Computer and Communications Security, ACM Press, New York, NY, pp. 33-42.
38. van Lamsweerde, A. and Letier, E. (2000), “Handling obstacles in goal-oriented requirements engineering”, IEEE Transactions on Software Engineering, Vol. 26, pp. 978-1005.
39. European Parliament and the Council (1995), Directive 95/46/EC on the Protection of Individuals with Regard to the Processing of Personal Data and of the Free Movement of Such Data, European Parliament and the Council, Brussels, October.