<figure><img src="image_1.png" /></figure>

HAL
open science

# Deriving and Using Synthetic Consequences for Privacy Risk Modeling

Stuart S. Shapiro

► To cite this version:

Stuart S. Shapiro. Deriving and Using Synthetic Consequences for Privacy Risk Modeling. 37th IFIP International Conference on ICT Systems Security and Privacy Protection (SEC), Jun 2022, Copenhagen, Denmark. pp.20-33, 10.1007/978-3-031-06975-8_2. hal-05319912

HAL Id: hal-05319912

https://inria.hal.science/hal-05319912v1

Submitted on 17 Oct 2025

HAL is a multi-disciplinary open access
archive for the deposit and dissemination of sci-
entific research documents, whether they are pub-
lished or not. The documents may come from
teaching and research institutions in France or
abroad, or from public or private research centers.

L'archive ouverte pluridisciplinaire HAL, est
destinée au dépôt et à la diffusion de documents
scientifiques de niveau recherche, publiés ou non,
émanant des établissements d'enseignement et de
recherche français ou étrangers, des laboratoires
publics ou privés.

<figure><img src="image_2.png" /></figure>

Distributed under a Creative Commons Attribution 4.0 International License
<figure><img src="image_3.png" /></figure>

ifip

International Federation for Information Processing

This document is the original author manuscript of a paper submitted to an IFIP
conference proceedings or other IFIP publication by Springer Nature. As such, there
may be some differences in the official published version of the paper. Such
differences, if any, are usually due to reformatting during preparation for publication or
minor corrections made by the author(s) during final proofreading of the publication
manuscript.
# Deriving and Using Synthetic Consequences for Privacy Risk Modeling

Stuart S. Shapiro(✉)

MITRE Corporation, Bedford, MA 01730, USA

sshapiro@mitre.org

**Abstract.** Highly contextual socio-technical systems demand highly contextual risk models for relevant system properties, including privacy. Many privacy risk models revolve around adverse consequences, i.e., typologies of bad privacy outcomes. The attendant mirror issues of insufficient contextual nuance (too few/general consequences) versus problematic analytical manageability (too many/granular consequences) can be addressed through the development of synthetic consequences as part of privacy engineering risk management. The objective is to categorize the total set of consequences so as to produce a small number of categories that nonetheless manage to capture the full range of meaning of the original consequences. Those categories can then be tailored to better reflect the context of the socio-technical system being analyzed. Relevant theoretical foundations for the construction of synthetic consequences are discussed and a step-by-step methodology for deriving them is described. This methodology is then applied to the example of a smart TV.

**Keywords:** Privacy risk management · Risk modeling · Synthetic consequences

## 1 Introduction

Any risk assessment activity that is not ad hoc, in any domain, is based, either implicitly or explicitly, on a risk model that denotes some set of relevant dimensions and values and how they interact to generate risks. In the absence of a risk model, risk identification becomes essentially arbitrary. As a result, while privacy risk assessors may not be fully aware that they're employing a risk model, they almost invariably are, particularly when, as in many cases, legal compliance is an issue. This has typically translated into risk models grounded in Fair Information Practice Principles (FIPPs), as versions of these have tended to heavily inform privacy statutes and regulations. These include the federal Privacy Act in the US and the General Data Protection Regulation (GDPR) in the EU. Their grounding in FIPPs is reflected in associated privacy impact assessments (PIAs) and data protection impact assessments (DPIAs) respectively. However, additional privacy risk models are increasingly available.

Approved for public release. Distribution unlimited 21-01156-9.

© IFIP International Federation for Information Processing 2022

Published by Springer Nature Switzerland AG 2022

W. Meng et al. (Eds.): SEC 2022, IFIP AICT 648, pp. 20–33, 2022.

https://doi.org/10.1007/978-3-031-06975-8_2
Many of these models, as well as FIPPs, revolve around adverse consequences. In other words, the models provide a typology of bad privacy outcomes. While useful, this can have drawbacks. Such typologies may be insufficiently comprehensive or nuanced for the relevant context. By the same token, though, a sufficiently broad set of consequences may, when combined with a variety of threats and vulnerabilities, create problems of analytical manageability, particularly under typical resource constraints. This dilemma can be partially addressed through the development of synthetic consequences as part of privacy engineering risk management.

This paper explores how project or assessment-specific consequences can be derived from existing privacy risk models and tailored to a specific socio-technical context. In doing so, it attempts to address a specific instance of a more general problem: as socio-technical systems become embedded in evermore complex contexts, risk models must become more contextual as well, while remaining analytically manageable. The remainder of the paper is organized as follows. Section 2 discusses the nature and role of risk models both generally and with respect to privacy specifically. Section 3 elaborates on the dilemma posed by trying to rely exclusively on the consequences of existing privacy risk models and the benefits of deriving synthetic consequences. Section 4 sets out some theoretical foundations for synthetic consequences in terms of cognitive categorization processes and mathematics and then defines a methodology for deriving them. Section 5 then illustrates the application of this methodology through the example of a smart TV. Finally, Sect. 6 offers some concluding thoughts and discusses the possible extension of this approach to vulnerability identification.

## 2 Privacy Risk Modeling

Risk models consist of some set of factors—threats, vulnerabilities, consequences, likenesses, severities, etc.—and their relations to one another. The US National Institute of Standards and Technology (NIST) defines a risk model as “a fixed set of factors, a fixed assessment scale for each factor, and a fixed algorithm for combining factors” [1, p. 16]. It is generally understood that threats exploit vulnerabilities to produce (adverse) consequences as the principal factors while likenesses and severities may attach to any or all of these. (The recently published ISO/IEC TR 27550 includes some privacy-specific discussion of risk modeling [2].) In some cases the models are wholly pre-constructed and utilized as-is while in other cases, at the other extreme, they are constructed from scratch to support a specific analysis. Many assessments, though, exhibit a combination of prior and in-situ risk model construction (the latter constituting the activity of risk modeling). This has certainly been the case for privacy, not least because existing privacy risk models are often sparse.

Existing privacy risk models tend to be sparse in the sense that they frequently address only a few potential model factors. By far, the most commonly addressed factor is consequence. This is not terribly surprising for a couple of reasons. The first is that risks are typically articulated in terms of consequences. Risk is not equivalent to consequence as it is normally associated with a quantitative or qualitative value denoting its level or degree. However, because the adverse consequence is the thing of concern, it is used to frame the risk. The second reason is that for risk models reflecting compliance obligations (which, for obvious reasons, are the most plentiful), their compliance imperatives are
by definition the converse of adverse consequences. If, for example, a system is legally
required to provide data subjects with access to their personal information, failure to
provide that access would constitute an adverse consequence of the associated risk model.
As a result of these two conditions, privacy risk models often focus on consequences,
sometimes exclusively.

Due to their integration into legal compliance regimes, in which compliance violations are the adverse consequences, FIPPs are undoubtedly the most widely used privacy risk model. However, other models exist, partly as a result of the last decade of privacy scholarship. Of these, Solove's Taxonomy of Privacy [3] is probably the best known, describing 16 different types of adverse privacy consequence. Others include Calo's subjective and objective privacy harms (adverse consequences) [4] and Nissenbaum's contextual integrity heuristic [5], in which disruptions to informational norms can be considered vulnerabilities (creating the potential for adverse consequences). NIST's Privacy Risk Assessment Methodology (PRAM) [6] utilizes a risk model that addresses both vulnerabilities ("problematic data actions") and adverse consequences ("problems for individuals") that the vulnerabilities may make possible. However, it can be the case that models nominally consisting of a single factor can also implicate another factor. Thus, the descriptions in Solove's Taxonomy often imply the kinds of threats that could produce those consequences, while a vulnerability identified by the contextual integrity heuristic (i.e., a violation of informational norms) may imply the type of adverse consequence that could result from exploitation of that vulnerability. Similarly, a threat identified using the LINDDUN framework [7] will highlight the vulnerability it might exploit. Figure 1 shows these alignments, with dashed lines indicating implied factors.

While not all privacy risk models indirectly address factors beyond the ones they
directly address, project or system-specific risk modeling can explicitly address some or
all of the missing factors. This may also happen implicitly as a tacit aspect of the assess-
ment process, a by-product of thinking through possible risk scenarios and, in effect,
filling in the blanks. However, it is also possible to simply ignore factors completely
unaddressed within a risk model. This introduces additional degrees of freedom into the
model, which results in a broader set of identified risks with less definition.

3 Modeling Constraints and the Case for Synthetic Consequences

We start this discussion from a simple premise: FIPPs are often a necessary but always an
insufficient basis for assessing privacy risk in modern socio-technical systems. Framing
this in terms of the previous discussion, a privacy risk model based solely on FIPPs
probably will not lead to the identification of all relevant privacy risks. FIPPs, while
occupying a deservedly central place in the minds of privacy practitioners, nevertheless
suffer from a number of problems. First and foremost, FIPPs are non-normative with
respect to purpose, which is highly problematic given that many FIPPs are contingent
on purpose. Second, a privacy risk model grounded exclusively in FIPPs by definition
excludes consideration of privacy consequences that do not directly correspond to the
violation of a Fair Information Practice Principle. Third, a FIPPs-based privacy risk
model is inescapably parochial, in the sense that it focuses almost exclusively on the
system or business process in question without explicitly considering the surrounding
context.
<figure><img src="image_4.png" /><figcaption>**Fig. 1.** Privacy risk model alignments</figcaption></figure>

An obvious solution to these issues is to employ multiple privacy risk models when engaging in privacy risk assessment. One can, for example, combine FIPPs with Solove's Taxonomy to construct a broader privacy risk model. This would capture a variety of adverse privacy consequences beyond those consisting of FIPP violations. However, this would also approximately triple (depending on which version of FIPPs one used) the number of consequences to around two dozen. Given that any one consequence could potentially result from multiple vulnerabilities, each of which could potentially be exploited by multiple threats, combinatorial expansion can quickly afflict the privacy risk modeling process. While the expansion of the consequences in a hybrid privacy risk model clearly would be much less were FIPPs to be combined with, say, Calo's subjective/objective privacy harms (around 10 consequences), it could also be much greater were FIPPs to be combined with contextual integrity. As a point of comparison, the NIST Guide to Conducting Information Security Risk Assessments organizes consequences into just five “impact types” [1]. So FIPPs, even with their limited scope, actually already trend high in terms of number of consequences, creating a disincentive to expand the risk model.
Synthetic consequences, in contrast, offer a way of both achieving adequate scope and keeping the number of consequences manageable. They do this by systematically deriving subsets from the combined consequences based on which consequences are similar or related to others.<fnref n="1" /> The objective is to categorize the total set of consequences so as to produce a small number of categories that, irrespective of their number, manage to capture the full range of meaning of the original consequences. Further, those categories can then be configured to better reflect the context of the socio-technical system, recognizing that they may take forms specific to that context. Both of these steps are grounded in some basic theory, principally from cognitive science, which is briefly discussed in the next section.

# 4 Foundations and Method for Developing Synthetic Consequences

We first describe some relevant theoretical foundations for the construction of synthetic consequences. We then describe a step-by-step methodology for deriving them from pre-existing sets of consequences.

## 4.1 Theoretical Foundations

Categories are not wholly products of either cognition or the environment [8]. Rather, they result from the interaction of the two. Domain knowledge helps us make sense of the environment through categorization while interaction with that environment shapes our domain knowledge. The properties of categories and their members and our contextual understanding both come into play when dealing with consequences as categories and as members of broader categories. While a comprehensive review of categorization processes is beyond the scope of this paper, it is worth briefly considering some of the basic aspects of these processes, including the nature of equivalence relations.

Typically, some members of a category are considered stronger or more representative examples of the category than other members [9]. These “central” members in turn are characterized by key (central) features. In their most basic form, central features are specific attribute-value pairs that exhibit immutability, i.e., resistance to change [10]. If those features are changed, category membership becomes more contestable. (For example, the central features of a member of the category US Social Security accounts would include a nine digit Social Security number.)

<footnote n="1">¹ Solove [3] actually divides the 16 consequences in his Taxonomy into four categories, however, only one of the categories—Invasions—actually relates to the nature of the constituent consequences. The other categories—Information Collection, Information Processing, Information Dissemination—convey only the nature of the relevant activity rather than the nature of the consequence.</footnote>
Prior to contextualization, a synthetic consequence is a collection of other consequences. This is, then, a categorization exercise. (As such, it is fundamentally different from policy formalization [e.g., 11], with potential adverse privacy consequences from a risk assessment standpoint likely extending beyond pure policy violations in any case.) Individuals with little domain experience tend to perform initial categorization based on a single atomic feature or dimension, extending to multiple dimensions only for those items that could not be sorted using the initial dimension [12]. Experienced individuals, on the other hand, perform multi-dimensional sorting from the outset, leading to more nuanced categorization based on overall similarity.

Such similarity goes beyond atomic features and into structural alignment. Relations between features exist as well as relations between relations and so on [13]. (For example, a US Social Security number that starts within the range 545–573 tends to correspond to a place of birth in California, relating two features. New parents with a California address would request a Social Security number for that child, implying that the number starts within the range 545–573, associating the two relations.) The more feature structure that members of a category share, the greater the category’s coherence, i.e., the greater the overall strength or soundness of the category [14]. Some of this structure may involve dependency relations, such that particular features are contingent on other features to degrees ranging from correlation all the way to causation.

This is taken a step further in categories characterized by some higher-order relation (i.e., a relation exhibiting or implying significant semantic structure) that logically connects all their members. This is the case, for example, with goal-oriented categories in which the category members all contribute to achieving an objective, such as the set of specific organizational requirements that achieve compliance with the GDPR. The existence of an invariant higher-order relation is, it has been argued, what renders probabilistic categories—those characterized by family resemblance, where members exhibit different subsets of a larger set of features—learnable [15]. While different members may exhibit different feature combinations, those combinations all reflect an overarching definable commonality. Indeed, Solove explicitly argues that privacy is a category whose members are characterized by family resemblance [3]. From Solove’s perspective, the invariant higher-order relation that supplies the category’s coherence revolves around the concept of privacy problems, i.e., problems falling under the rubric of privacy that “have achieved a significant degree of social recognition” and have been seen as warranting legal attention [3]. All the members of the category participate in this relation.

We are not just assigning consequences to categories, though, we are partitioning consequences into subsets in which, for the purpose of synthesis, we will claim that each member is equivalent to every other member. In other words, we assert a relevant equivalence relation among all the members of each subset such that each consequence in a subset is considered approximately identical in its effect. Each of these subsets, therefore, is deemed an equivalence class and all equivalence classes within a given set are disjoint.
This returns us to the concept of category coherence. To achieve coherent categories, we must identify combinations of central features and relational structures that can form their bases. This does not imply that all members of each equivalence class necessarily will exhibit all central features and relational structures relevant to that class, but rather that each member will exhibit enough of these to distinguish it from other equivalence classes.

How, then, do we identify these multiple sets of central features and relational struc-
tures for any given case? While it is unlikely that such a process can be deterministic,
it can't be completely arbitrary. Therefore, we posit three heuristics to guide identifi-
cation of central features and relational structures and subsequent identification of the
resultant equivalence classes. We have both induced them from existing synthetic con-
sequences we have developed [e.g., 16] and deduced them from categorization theory.
These heuristics are described in the next section.

Note that multiple attempts or permutations may be required to achieve a satisfac-
torily defined set of equivalence classes. However, the objective is not to iterate across
all possible combinations in pursuit of a theoretical minimum, but rather to reduce the
number of consequences to a more manageable figure. Ultimately, the adequacy decision
belongs to the risk assessment practitioner.

There is a validation heuristic, though, arising out of the need to assign contextual
equivalence class designations, i.e., category labels and descriptions. While one can, in
principle, employ completely generic labels (e.g., EC<sub>1</sub>, EC<sub>2</sub>, EC<sub>3</sub>, etc.), usability dictates
the need for meaningful labels and definitions of each equivalence class. Through this,
the equivalence classes become synthetic consequences and therefore members of a
larger category of adverse privacy consequences. If that category is lent coherence by
an invariant higher-order relation, we posit that meaningful labels are likely to connect
with the contextual higher-order relation in which the members participate. Another
way of thinking about this is that the higher-order relation reflects the equivalence of
the members of each class, an equivalence grounded in the nature of their participation
in the higher-order relation. If we cannot find a label and description that captures this
participation, reconsideration of the equivalence class memberships may be in order.
However, note that, as is the case with Solove's approach, this relation need not be
formally defined; an informal description can provide sufficient analytical traction.

4.2 Methodology

We can now enumerate the steps required to derive a synthetic consequence set from
a set of consequences. Note that this is a generic methodology that potentially can be
applied to system properties beyond privacy. We will illustrate the application of the
methodology in the next section by applying it to an example involving a smart TV.

1. Construct the union of the original consequences.

2. Analyze the consequences using the following heuristics in this order:

a. Independent features, actions, and absent actions in particular;

b. Feature relations, e.g., correlated features, dependent features, causal features;

c. Higher-order relations, goals in particular.
3. Group consequences with significant intersections—taking into account feature relations and higher-order relations as well as atomic features—into provisional equivalence classes with the objective of minimizing the number of classes. Multiple iterations may be required to achieve a likely minimum, initially selecting elements with higher cardinalities and, if the results are problematic (e.g., yielding multiple orphan consequences), sorting on elements with lower cardinalities. Some interpretation may be required due to differences in wording.

4. Identify the contextual higher-order relation in which the equivalence classes participate and use the nature of that participation as the basis of the equivalence class labels and descriptions. Because the equivalence classes represent adverse consequences, this higher-order relation will resemble an anti-goal [17]. If one or more labels or descriptions do not exhibit a clear link with the higher-order relation, revise the higher-order relation. If problems persist, revisit Step 3.

We will now demonstrate these steps in the context of a smart TV as described below.

# 5 Smart TV Example

In the US, the smart TV will collect and store a record of the programs watched by individual users who each have their own profile on the device, including via streaming services such as Netflix. This viewing data will consist of entries that include the date and time (timestamp), the channel and/or service provider, and the program name. This viewing data will be regularly transmitted to the TV manufacturer, who will combine it with demographic data (based on IP address) and maintain the combined data, including IP address, in a repository. The data will be used to support behavioral advertising through the TV. Users must opt-in to the collection and use of viewing data by the manufacturer, as governed by the privacy policy associated with the TV.

## 5.1 Step 1: Construct the Union of the Consequences

The TV manufacturer, also in the US, has decided to consider privacy consequences from three different sources: the Video Privacy Protection Act of 1988, a US Federal Trade Commission (FTC) version of FIPPs, and Calo's privacy harms. These are paraphrased and itemized below, along with designations to enable convenient referencing.

*Video Privacy Protection Act of 1988* [18].

- VPPA1: Disclosure of personal rental information without consent.

- VPPA2: Disclosure to police without a valid warrant or court order.

- VPPA3: Disclosure of “genre preferences” along with names and addresses for marketing despite consumer opt out.

*FTC report on privacy online* [19].

- FTC1: Failure to disclose information practices before collecting personal information (PI).
- FTC2: PI used without consent for purposes beyond those for which the information was provided.

- FTC3: Inability to view and contest the accuracy and completeness of PI.

- FTC4: PI is inaccurate.

- FTC5: PI is subject to unauthorized use.

Note that FTC4 and FTC5 are derived from what was originally a compound imperative in the source report.

*Calo's privacy harms* [4].

- Calo1: Perception of unwanted surveillance (subjective privacy harm).

- Calo2: Forced or unanticipated use of PI (objective privacy harm).

In those cases in which items were originally structured as imperatives or prohibitions, we have reframed them as adverse consequences. None of the consequences are clearly duplicative, therefore, their union is all of them combined.

## 5.2 Step 2: Analyze Consequences

The results of this step are presented in Table 1. Relations between features are *italicized*. Note that we have expressed the opt out in VPPA3 in terms of consent, since it is the denial of consent, while we have not expressed the unauthorized use in FTC5 in terms of consent as the source document makes clear that this is a security issue.

## 5.3 Step 3: Group into Provisional Equivalence Classes

Tables 2 and 3 convey alternative possible sets of equivalence classes resulting from the stepwise grouping process, **bolding** the bases for the grouping decisions and *underlining* inferred higher-order relations. Table 2 reflects an initial focus on “no consent,” given its relatively high cardinality across features and relational structures, as a basis for establishing the first equivalence class. An additional class can then be formed on the basis of inaccurate PI and the inability to contest it. However, there is no clear basis for any other equivalence classes, leaving the remaining 4 original consequences as orphans (whose presence in Table 2 is left implicit). The end result, then, is a total of six classes, of which four consist of orphan consequences. While this is not an intolerable result, neither is it a particularly satisfying one.

Table 3 reflects an alternative emphasis on “disclosure,” with lower cardinality, for defining the initial class. While this produces a smaller first class, it enables the formation of additional multi-member classes based on the usage of personal information without consent, inaccurate PI (as before), and the inferred relation between unexplained practices and perceived surveillance. This produces a smaller set of four equivalence classes with no orphan consequences and highlights the importance of considering multiple grouping approaches. While this does not preclude the possibility of producing an even smaller number of equivalence classes, the resulting 60% reduction in consequences is significant enough to justify proceeding to the next step.
<table><caption>**Table 1.** Consequence analysis</caption><thead><tr><th>Consequence</th><th>Independent features</th><th>Feature relations</th><th>Higher-order relations</th></tr></thead><tbody><tr><td>VPPA1</td><td>PI disclosure<br>No consent</td><td>PI disclosure <i>despite</i> no consent</td><td></td></tr><tr><td>VPPA2</td><td>PI disclosure<br>Disclosure to police<br>No valid warrant or court order</td><td>PI disclosure <i>to</i> police</td><td>(PI disclosure <i>to</i> police) <i>despite</i> no warrant or court order</td></tr><tr><td>VPPA3</td><td>PI disclosure<br>Disclosure for marketing<br>No consent</td><td>PI disclosure <i>for</i> marketing</td><td>(PI disclosure <i>for</i> marketing) <i>despite</i> no consent</td></tr><tr><td>FTC1</td><td>PI collection<br>No practices communicated</td><td>PI collection <i>despite</i> no practices communicated</td><td></td></tr><tr><td>FTC2</td><td>PI usage<br>No consent</td><td>PI usage <i>despite</i> no consent</td><td></td></tr><tr><td>FTC3</td><td>No PI viewing<br>No contesting PI accuracy</td><td>No PI viewing <i>implies</i> no contesting PI accuracy</td><td></td></tr><tr><td>FTC4</td><td>PI inaccurate</td><td></td><td></td></tr><tr><td>FTC5</td><td>PI usage<br>No authorization</td><td>PI usage <i>despite</i> no authorization</td><td></td></tr><tr><td>Calo1</td><td>Perceived surveillance<br>Unwanted surveillance</td><td>Perceived surveillance <i>and</i> unwanted surveillance</td><td></td></tr><tr><td>Calo2</td><td>PI usage<br>No consent</td><td>PI usage <i>despite</i> no consent<br>PI usage <i>not</i> anticipated</td><td></td></tr></tbody></table>

<table><caption>**Table 2.** Grouping starting from “No Consent”</caption><thead><tr><th>Consequence</th><th>Independent features</th><th>Feature relations</th><th>Higher-order relations</th></tr></thead><tbody><tr><td>VPPA1,<br>VPPA3,<br>FTC2,<br>Calo2</td><td>PI disclosure<br><b>No consent</b><br>PI disclosure<br>Disclosure for marketing<br><b>No consent</b><br>PI usage<br><b>No consent</b><br>PI usage<br><b>No consent</b></td><td>PI disclosure <i>despite</i> no consent<br>PI usage <i>despite</i> no consent<br>PI usage <i>despite</i> no consent<br>PI usage <i>not</i> anticipated</td><td>(PI disclosure <i>for</i> marketing) <i>despite</i><br><b>no consent</b><br><b>Information life</b><br><i>cycle action despite no consent</i></td></tr><tr><td>FTC3,<br>FTC4</td><td>No PI viewing<br>No contesting PI accuracy<br><b>PI inaccurate</b></td><td>No PI viewing <i>implies</i> no contesting<br><b>PI accuracy</b><br>No contesting PI accuracy <i>despite</i><br><b>PI inaccurate</b></td><td></td></tr></tbody></table>

## 5.4 Step 4: Contextualize the Consequences

The final step involves developing a contextualized label and description for each of the derived equivalence classes. However, we must first identify an invariant contextual higher-order relation that will establish a basis for this activity. For this, it is useful to revisit the description of the smart TV scenario at the beginning of this section. Based on
this, we will assert that the higher-order relation in which the consequences participate involves improper profiling.

Having identified this relation, we can now develop appropriately contextualized labels and descriptions for the synthetic consequences. Difficulty doing so would suggest that either the higher-order relation is inappropriate or that the consequence groupings are less coherent than originally believed, either one raising questions regarding the validity of the resulting synthetic consequences. These questions would prompt revision of the higher-order relation or reconsideration of the groupings, respectively. However, neither of these appears to be an issue and the resulting labels and descriptions are shown in Table 4. This set of four synthetic consequences can now be employed for privacy risk assessment of the smart TV.

<table><caption>**Table 3.** Grouping starting from “Disclosure”</caption><thead><tr><th>Consequence</th><th>Independent features</th><th>Feature relations</th><th>Higher-order relations</th></tr></thead><tbody><tr><td>VPPA1,<br>VPPA2,<br>VPPA3</td><td><strong>PI disclosure</strong><br>No consent<br><strong>PI disclosure</strong><br><strong>Disclosure</strong> to police<br>No valid warrant or court order<br><strong>PI disclosure</strong><br><strong>Disclosure</strong> for marketing<br>No consent</td><td><strong>PI disclosure</strong> despite no consent</td><td>(<strong>PI disclosure</strong> to police) <strong>despite</strong><br>no warrant or court order<br>(<strong>PI disclosure</strong> for marketing)<br><strong>despite</strong> no consent</td></tr><tr><td>FTC2,<br>FTC5,<br>Calo2</td><td><strong>PI usage</strong><br>No consent<br><strong>PI usage</strong><br>No consent</td><td><strong>PI usage</strong> despite no consent<br><strong>PI usage</strong> despite no authorization<br><strong>PI usage</strong> despite no consent<br><strong>PI usage</strong> not anticipated</td><td></td></tr><tr><td>FTC3,<br>FTC4</td><td>No <strong>PI</strong> viewing<br>No contesting <strong>PI</strong> accuracy<br><strong>PI</strong> inaccurate</td><td>No <strong>PI</strong> viewing <strong>implies</strong> no contesting <strong>PI</strong> accuracy<br>No contesting <strong>PI</strong> accuracy despite <strong>PI</strong> inaccurate</td><td></td></tr><tr><td>FTC1,<br>Calo1</td><td><strong>PI</strong> collection<br>No practices communicated<br>Perceived surveillance<br>Unwanted surveillance</td><td><strong>PI</strong> collection <strong>despite</strong> no practices communicated<br>Perceived surveillance and unwanted surveillance</td><td>(<strong>PI collection</strong><br><strong>despite</strong> no practices<br><strong>communicated</strong>)<br><strong>implies</strong> perceived surveillance</td></tr></tbody></table>

<table><caption>**Table 4.** Synthetic consequences resulting from contextualization</caption><thead><tr><th>Constituent consequences</th><th>Synthetic consequence</th><th>Description</th></tr></thead><tbody><tr><td>VPPA1,<br>VPPA2,<br>VPPA3</td><td>Involuntary Profile Availability</td><td>Program-based profiles of individuals are made available to unknown entities without permission</td></tr><tr><td>FTC2,<br>FTC5,<br>Calo2</td><td>Involuntary Profile Exploitation</td><td>Program-based profiles of individuals are used for unknown purposes without permission</td></tr><tr><td>FTC3,<br>FTC4</td><td>Blackbox Profiling</td><td>Individuals have no insight into the state of their <strong>PI</strong> as maintained by the TV, TV manufacturer, or others, and/or they have no ability to manipulate it</td></tr><tr><td>FTC1,<br>Calo1</td><td>Ambiguous Profiling</td><td>Uncertainty regarding <strong>PI</strong> processing engenders surveillance concerns</td></tr></tbody></table>
# 6 Conclusions and Future Directions

By synthesizing four consequence equivalence classes from the original ten consequences, we have made privacy risk assessment more manageable in a number of ways. The reduction in the number of consequences simplifies the risk model that is being employed. (Recall that there is *always* a risk model being used in any non-arbitrary privacy risk assessment, though it may not be explicitly defined.) The concomitant reduction in model complexity will reduce the level of effort required to perform any privacy risk assessment. Further, the contextual tailoring of the synthetic consequences will also make for more efficient assessment by alleviating the analyst of the necessity of bridging between the specifics of the socio-technical system being assessed and abstract privacy consequences, an advantage that is qualitative and goes beyond a quantitative improvement that is, in this example, modest in absolute terms. (One can easily imagine, though, the potential for more profound quantitative improvements in cases that start with many more consequences.) While one could simply bank that saved effort, one could also redeploy it to support the application of more sophisticated forms of privacy risk analysis, such as System-Theoretic Process Analysis for Privacy (STPA-Priv) [20].

There is, of course, a trade-off involved given that the process of deriving synthetic consequences itself entails significant effort. For a one-off privacy risk assessment, a judgement will be required as to whether this trade-off is worthwhile. However, if the risk assessment is likely to undergo future updates in response to system or environmental changes, the effort of deriving synthetic consequences can be amortized over multiple assessments. Further, if the synthetic consequences are domain rather than system-specific and therefore reusable, the expected amortization across different assessments would make the case for them even more compelling.

Judgement is also very relevant when executing the synthesis process. As a result, different people may arrive at somewhat different sets of consequences derived from the same initial set. However, a similar observation could be made of any of the existing consequence-oriented privacy risk models. Someone else employing an approach like that which produced any of these could be reasonably expected to produce a set of non-identical consequences, but this hardly de-legitimizes either set. Rather, we simply acknowledge that each may exhibit particular strengths and weaknesses, but that they are all likely to prove useful even if non-definitive. Ultimately, they are a means, not an end.

While synthesizing consequences will certainly mitigate the combinatorial expansion inherent in the privacy risk model for any complex socio-technical system, it only addresses one facet of the expansion problem. Even allowing for the fact that this expansion is seldom unconstrained (i.e., not every possible threat will exploit every possible vulnerability which will lead to every possible type of consequence), it likely will remain problematic, particularly given the general desire/insistence for low-overhead privacy risk assessment. This raises the natural question of whether a similar process can be applied to the other risk model factors. Coming before consequences in the modeling chain, vulnerabilities may be the logical next step in leveraging synthesis as a technique.

While not as numerous among established privacy risk models as sets of consequences, sets of vulnerabilities have been described (irrespective of whether they are identified as such) as part of the PRAM [6] and LINDDUN [7] assessment techniques.
Contextual integrity [5], moreover, amounts to a method of identifying context-specific privacy vulnerabilities. However, given the scope of the technique, these could prove numerous in any given case. Synthesizing vulnerability equivalence classes, then, could greatly mitigate the resultant complexity. Further, because vulnerabilities identified through application of the contextual integrity heuristic would be intrinsically contextual, this would streamline the final step of the synthesis process.

**Acknowledgements.** Thanks to MITRE colleague Julie Snyder and to discussants at the Privacy Law Scholars Conference for comments on an earlier version of this paper.

## References

1. US National Institute of Standards and Technology (NIST): Guide for Conducting Risk Assessments, NIST Special Publication 800-37, Revision 1. NIST, Gaithersburg, MD (2012)

2. International Organization for Standardization (ISO), Privacy Engineering for System Life Cycle Processes, ISO/IEC TR 27550:2019. ISO, Geneva, Switzerland (2019)

3. Solove, D.: Understanding Privacy. Harvard University Press, Cambridge (2010)

4. Calo, M.R.: The boundaries of privacy harm. Indiana Law J. 86(3), 1131 (2011)

5. Nissenbaum, H.: Privacy in Context: Technology, Policy, and the Integrity of Social Life. Stanford Law Books, Palo Alto (2009)

6. NIST Privacy Engineering Program Resources. https://www.nist.gov/itl/applied-cybersecurity/privacy-engineering/resources. Accessed 14 July 2021

7. Deng, M., Wuyts, K., Scandariato, R., Preneel, B., Joosen, W.: A privacy threat analysis framework: supporting the elicitation and fulfillment of privacy requirements. Requirements Eng. 16(1), 3–32 (2011). https://doi.org/10.1007/s00766-010-0115-7

8. Malt, B.C.: Category coherence in cross-cultural perspective. Cogn. Psychol. 29(2), 85–148 (1995). https://doi.org/10.1006/cogp.1995.1013

9. Lakoff, G.: Women, Fire, and Dangerous Things: What Categories Reveal About the Mind. University of Chicago Press, Chicago (1987)

10. Sloman, S.A., Love, B.C., Ahn, W.-K.: Feature centrality and conceptual coherence. Cogn. Sci. 22(2), 189–228 (1998). https://doi.org/10.1207/s15516709cog2202_2

11. Pardo, R., Le Métayer, D.: Analysis of privacy policies to enhance informed consent. In: Foley, S.N. (ed.) DBSec 2019. LNCS, vol. 11559, pp. 177–198. Springer, Cham (2019). https://doi.org/10.1007/978-3-030-22479-0_10

12. Johansen, M.K., Palmeri, T.J.: Are there representational shifts during category learning? Cogn. Psychol. 45(4), 482–553 (2002). https://doi.org/10.1016/S0010-0285(02)00505-4

13. Gentner, D.: Structure-mapping: a theoretical framework for analogy. Cogn. Sci. 7(2), 155–170 (1983). https://doi.org/10.1207/s15516709cog0702_3

14. Rehder, B., Burnett, R.C.: Feature inference and the causal structure of categories. Cogn. Psychol. 50(3), 264–314 (2005). https://doi.org/10.1016/j.cogpsych.2004.09.002

15. Jung, W., Hummel, J.: Making probabilistic relational categories learnable. Cogn. Sci. 39(6), 1259–1291 (2015)

16. US Department of Transportation (USDOT): Privacy Issues for Consideration by USDOT Based on Review of Preliminary Technical Framework (Final – Rev A), Report Number FHWA-JPO-15-236. USDOT, Washington, DC (2016). https://www.regulations.gov/document?D=NHTSA-2016-0126-0003

17. van Lamsweerde, A.: Requirements Engineering: From System Goals to UML Models to Software Specifications. Wiley, Chichester (2009)
18. Video Privacy Protection Act of 1988, 18 U.S.C. § 2710 (2002)

19. US Federal Trade Commission (FTC): Privacy Online: Fair Information Practices in the Electronic Marketplace. FTC, Washington, DC (2000)

20. Shapiro, S.: Privacy risk analysis based on system control structures: adapting system-theoretic process analysis for privacy engineering. In: 2016 IEEE Security and Privacy Workshops (SPW), San Jose, CA, pp. 17–24 (2016)