Pardis Emami-Naeini takes on security & privacy in IoT

Security & Privacy, IoT

Student Name

Pardis Emami-Naeini

pardis hero 1

Pardis, tell us a little bit about your background and how you came to the Societal Computing PhD program.

I did my undergrad at Sharif University of Technology in my home country of Iran. I graduated in 2015 with a Bachelors in computer engineering, specializing in hardware engineering.

When I came to CMU, I was first admitted to the Electrical and Computer Engineering Department (ECE). But after a short while, I realized that my true passion and interest was actually in privacy and security. And, furthermore, I really wanted to make my mark on the field, to do my own research that didn't fit neatly inside the borders of ECE.

Around that time I got really interested in the work that Lorrie Cranor was doing in privacy and security. I got in touch with her group and came to learn that their work wasn't JUST privacy and security. They were working across so many boundaries. They had collaborators from across the university all contributing to this work that could, honestly, change the world.

I knew that was where I wanted to be. That was where I could make my mark.

It sounds like you have quite a bit of drive and vision, where do you want to see yourself in 10 years and how do you think the Societal Computing PhD is going to help you get there?

I've known for a while now - maybe since my senior year of undergrad - that I want to start my own company. I have a few ideas that I think have real value and could change the way we work with technology. So, in 10 years, I'd like to be running my own start-up.

Now, with that said, I came to do a PhD for two reasons:

First, I wanted to build the expertise that I would need to take my ideas and make them a reality. I wanted to test those ideas against other great ideas. I wanted to make sure that they were as cutting-edge as I believe them to be. And I wanted to improve them through a deep understanding of the groundbreaking work that is already out there in a variety of fields.

Second, I wanted to branch out and explore. Especially in the Societal Computing program, you feel powerful. If you can think of a good question to answer or problem to solve, you are encouraged to get out there, explore, find what you need to read, talk to whomever you need to, do the experiments you have to do to find your answers. Your fate is, for the most part, in your hands. It's the same in a start-up. Start with the problem and dive deep; but also understand the broader context and don't be afraid to go to unexpected places to find the information you need to solve that problem.

What is it about the societal computing program that distinguishes it from other programs in computer science?

I think a lot of the distinguishing features of the Societal Computing program that sets it apart are couched in the fact that we are tackling REALLY big societal issues.

As a result of that mission, we are deeply interdisciplinary. We can't afford not to be! To solve problems like homelessness or security in IoT, you can't just stick to computer science because these aren't just computer science problems. You have to bring in economics, psychology, sociology, statistics, etc in order to build a solution that will ACTUALLY solve the problem, as a whole.

Also, what you get from a program that is all about the big problems is a culture of work where incremental progress is part of the equation. The problems we are trying to solve are, frankly, pretty crazy in their scale. If you tried to take them on wholesale, you'd fail every time. But in Societal Computing, we focus on what we can do now and, once that is complete, move on to the next part of the problem. It teaches us, as researchers, that we need to be willing to be in this for the journey. Because, when you are looking to change the world, the road is long!

So, on that topic, how do you think Societal Computing is going to change the world?

In this field, you are going to have to think big. Again, we're talking about society-scale problems. Those are the problems we're aiming to solve.

And so, again, you aren't going to solve those problems in 6 months. And you aren't going to solve them with computer science alone.

I think that is how Societal Computing is going to change the world: By demonstrating that an approach that thinks big and thinks across borders is what we need to get optimal, effective, sustainable solutions.

Okay, so let's talk a bit about your research. What problem are you interested in taking on?

I am really interested in privacy and security as it relates to the Internet of Things.

The fact of the matter is that we are living in a world where we are surrounded by IoT devices which are collecting data on us. As a result, privacy and security concerns are coming more and more to the forefront of people's minds. One way to alleviate those concerns is to build tools and applications called "privacy assistants" that can aid users in knowing, understanding, and making decisions about data collection going on around them.

But, in order to develop privacy assistants that are both functional and accessible, we have to build a really thorough understanding of people's privacy-related preferences and concerns toward IoT data collection.

So, in the first part of my work I am exploring how users' comfort with data collection and their desire to allow or deny data collection can be explained by privacy factors such as data type or the purpose of data collection. Additionally, I am examining how social influence from privacy experts and friends can affect people's privacy-related decisions toward data collection.

In the second part of my research, I am hoping to better understand the impact of privacy and security on consumers' IoT-related purchasing behaviors. More specifically, I am looking to explore how consumers would want to be presented with information related to privacy and security for IoT devices while making their purchase decisions.

So, as it is right now, buying an IoT device is an inherently risky venture, where privacy and security is concerned. Standing in an aisle at Home Depot or Best Buy, you really have no idea how secure or privacy sensitive a device is. Because of this, consumers may overlook the importance of privacy and security information, exposing themselves to any number of potential vulnerabilities. To address this, I am planning to develop prototype privacy and security labels for IoT devices and evaluate their usability as well as their effectiveness by conducting user and expert studies.

Pardis, what sort of student do you think should seriously consider applying to the Societal Computing program?

I think that people who are driven and think of themselves as creative are the sort who should really think about the program.

They should never be willing to just sit back and be satisfied. Even just walking down the street, you are noticing new problems to tackle or things you need to learn about in order to better answer the research question you are exploring.

In this program, you are constantly improving and adding to your skill set in radical new ways. It's one of the keys to successful research in this field. You have to be willing to get out there into unfamiliar territory, talk to researchers in completely different fields. If you hate being put into a disciplinary silo, you might be a good fit here in Societal Computing and I hope you apply!

To learn more about the vital work Pardis is doing, visit her at her website. To learn more about the critical research other students and faculty are doing in Societal Computing, check out our research page!