Building Divvi Up, a system for privacy-respecting statistics at scale.

Research Question

1. How can we enforce the promises made in a privacy policy through technology that is ubiquitous and affordable?

Why Is This Research Important?

Applications generate valuable metrics about their users that are the basis for insights into users’ behaviour. Users must trust that application owners will respect their stated privacy and security policies. Stated policies, however, are insufficient as privacy safeguards. Once an app owner has user data, privacy policies can be violated, and the mere possibility of privacy violations can erode trust in applications, making users less likely to want to engage. Moving metrics collection to more privacy-respecting systems would be transformational for peoples’ privacy because of the sheer amount of data that applications collect. By ensuring privacy, trust in the Internet and applications that rely upon the Web can be built. 

This research is applied at an Internet-wide scale to realign application privacy practices with what people expect, making the trust they put in applications well-placed instead of reliant on simple promises made in a privacy policy. The research contains properties that will be beneficial to securing privacy not only on the Internet but also valuable in repressive and otherwise difficult operating environments. 

The research seeks to serve the public around the world, not just those organizations who can afford to adopt the technology. By answering the research questions, an Internet that is more secure and privacy-respecting can be built, one that is more trustworthy than it is today. 

Methodology

The research gathers and analyzes data by testing the Divvi Up system in its own experimental implementation and in collaboration with Cloudflare, Mozilla, and others. In addition to test implementations, the research gathers and analyzes input through collaboration with the Internet Engineering Task Force (IETF) community, which is open to the public. Finally, in a collaborative environment, a set of questions are asked about what app owners and users need from the Divvi Up system and to members of the open-source community to gather feedback and input. 

Media and Publications

• Divvi Up Distributed Aggregation Protocol (DAP) specification This document describes a multi-party Distributed Aggregation Protocol (DAP) for privacy preserving measurement which can be used to collect aggregate data without revealing any individual contributor’s data.
• Verifiable Distributed Aggregation Functions Specification This document describes Verifiable Distributed Aggregation Functions (VDAFs), a family of multi-party protocols for computing aggregate statistics over user measurements.
• IETF Contributions 
• User onboarding portal 
• API A production-ready API for privacy-respecting metrics that is compliant with IETF specification
• Scheme for peer aggregator discovery 
• Divvi Up Task Synchronization API Design The purpose of this API is to allow the Divvi Up Control Plane (aka the Divvi Up subscriber website software) to modify the state of the aggregators operated by Divvi Up & Divvi Up’s partners in response to requests from authorized clients, for example by creating or removing DAP tasks for aggregation.
  
• Storage of aggregates for Subscribers janus_collector is a self-contained implementation of the Distributed Aggregation Protocol’s collector role.
• API for Subscribers to retrieve aggregates 
• Productionisation of libprio-rs Pure Rust implementation of Prio, a system for Private, Robust, and Scalable Computation of Aggregate Statistics.
• Productionisation of ISRG’s service 
• A software client library that can be used by Android developer An Android client library for the Distributed Aggregation Protocol.
• Automated/self-service onboarding for ISRG Subscribers 

*Please note that the image in this summary is for illustrative purposes only and does not depict the described project.

Credit: Shutterstock