Computational Policies

Lalana Kagal

MIT 6.805/STS085: Ethics and Law on the Electronic Frontier

What do we mean by a policy ?

• Policies are norms of behavior
• Government
• Organizations
• Community
• ....
• They support dynamic adaptability of behaviour
• Policies provide high-level control of (software/human) agents in the environment

Example policy

• A robot may not injure a human being, or, through inaction, allow a human being to come to harm
• A robot must obey the orders given it by human beings except where such orders would conflict with the First Law
• A robot must protect its own existence as long as such protection does not conflict with the First or Second Law

Example policy: Three Laws of Robotics

Handbook of Robotics, 56th Edition, 2058 A.D.
http://en.wikipedia.org/wiki/Three_Laws_of_Robotics

On policies, rules, and laws

• Defined at a high level and do not talk about specific actions or persons
• Defined in terms of one other and talk about conflict
• The interesting thing about Asimov's laws were that robots did not always strictly follow them
• This is a point of departure from more traditional "hard coded" rules like DB access control, and OS file permissions
• Policies increase autonomy
  • They describe "norms of behavior" that agents should follow to be "good citizens"

Use of policies

• To govern the behavior of agents in a certain domain
  • E.g. eBay policy: Rules about feedback, using profanity, spam, bidding, listing, selling, etc. Includes descriptions of penalties for violation
    http://pages.ebay.com/help/policies/overview.html
• Prevent or identify misbehavior of agents and specify penalties associated with these violations
• Enable organization to achieve some goal
• Enable agents to understand and expect certain behavior from others
• Used for flexible and adaptive management

Applications of policy

• Security or access control
• Privacy
• Network configuration and management
• Trust management
• ......

Computational policies

• An explicit representation of constraints and rules that govern an agent or system's behavior
• Machine understandable norms of behavior
• A refinement of social, legal, organizational policies (abstract) into policies relating to specific agents, services, actions, and data in the domain
• Used by policy management system to restrict agent's behavior, or identify violations of policy

Implementing computational policies

• Representation language: Language for expressing explicit machine understandable policies
• Model domain knowledge
• Convert high level policies to machine policies using policy language and domain knowledge
• Policy management system
  • Encapsulates (virtually) agents, services, and devices in the domain
  • Intercepts messages between agents, services, devices
  • Captures changes to the state

Policy Management

• Types
  • Enforcement
  • Accountability
• Different systems require different management
• Could also have a combination of management

Enforcement versus accountabilility

• Enforcement
  • prevents policy violations
  • prevents agents from performing certain actions
  • restricts access to certain data
  • Example: Unix file permissions

Enforcement versus accountabilility

• Accountability
  • does not prevent agents from performing actions or restrict access to certain data
  • identifies policy violations after violation has occured
  • captures and stores transaction log (who did what, with what information, and for what purpose)
  • reasons over annotated transaction logs and audit trails to check if any violations occured
  • social aspect
  • Suitable in
    • systems where information about individuals is easily obtained - web, public records, etc.
    • It is difficult to prevent information leakage
    • tools can be bypassed
  • Example: TAMI http://dig.csail.mit.edu/TAMI

TAMI project

Focused on privacy management Not just about preventing access to certain information Also regulates what you can do with the information - statistical analysis, research, civil case, criminal investigations Facilitates compliance of usage policies by reasoning over audit trails Social system holds agents accountable for policy violations

TAMI project

• Representation/policy language
  • AMORD In RDF (AIR)
  • Policy reasoner in scheme and python
  • Realizes privacy policies in terms of allowable uses of information
• Model domain knowledge
  • Semantic Web technologies
• Convert high level policies to machine policies
  • manually specifying computational policies
  • Privacy policies such as the Privacy Act
• Policy management system: Accountability + proof based access control

Scenario 0

MIT Prox Card Data Policy: Prox card data can only the basis for an adverse consequence in a criminal investigation

• On Monday at 9am Student Sam in granted extension on paper due to illness based on claim that she is sick in bed
• an entry in the CSAIL prox card log (public) shows Sam entering 5th floor of CSAIL at 9:45am/Monday
• TA Ted looks at proxcard log and discovers that Sam was in CSAIL
• Ted tells Professor Pam who files a compliant with the CoD
• CoD hearings are not criminal proceedings
• CoD hearing calls Sam to explain and presents a complaint (machine-readable) citing entry in prox card log as evidence that she lied about matters of academic significance
• Sam's advocate challenges the complaint because the offense cannot be proven without the use of prox card data and may not, according to the rule, be proven with the use of prox card data

Example AIR policy for scenario 0

:MITProxCardPolicy a air:Policy;
    rdfs:label "MIT prox-card policy #1";
    air:pattern
        {
        :U a air:UseEvent;
            :refers-to :D;
            air:purpose :P.
        :D a :ProxCardEvent.
        };
     air:subrule
         [
         rdfs:label "MIT prox-card policy #2";
         air:pattern { :P air:is-member-of pur:criminal-investigation };
         air:assert { :U air:compliantWith :MITProxCardPolicy };
          ];
      air:subrule
          [
          rdfs:label "MIT prox-card policy #3";
          air:pattern { :P air:is-not-member-of pur:criminal-investigation };
          air:assert { :U air:incompliantWith :MITProxCardPolicy };
          ]
  .

Working through Scenario 0

• Complaint is analyzed by the reasoner with the following result:
  • "reasoning result": accusation of lying by the CoD against Sam cannot be supported by the available facts
  • "explanation" offered by reasoner: -argument in complaint is invalid because (i) accusation is of lying (ii) lying accusation is supported by prox card data -prox card data may only justify an adverse consequence in a criminal investigation

Summary

• Computational policies are explicit machine understandable representations of social and legal norms
• Used for providing flexible and adaptable management
• Two mechanisms of management: enforcement, accountability
• Accountability is more suited to open systems where information leakage is possible
• TAMI is a research project aimed at developing accountability mechanisms for the Web

This work is licensed under a Creative Commons Attribution - Non-Commercial - No Derivatives 3.0 License.