text: ENISA Work Programme 2010, available at: http://www.enisa.europa.eu/media/key-documents/enisa-work-programme-2010 , p. 36.

text: ENISA - Privacy, accountability and trust activities and publications: http://www.enisa.europa.eu/act/it/privacy-and-trust/pat

text: ENISA Work Programme 2011, available at: https://www.enisa.europa.eu/about-enisa/activities/programmes-reports

text: Rating Reputational process to Reputation information Rating input process Reputational score collect a function viewing and user’s query feedback process

text: s ite s 6 b e Not provided w f o Indirect r e b 4 Direct Num

text: Real Name Location Adress Sex Occupation Photo

text: s ite s b 6 e w Not provided f o r Indirect e b 4 Direct Num

text: Username E-mail adress Personal History Status Webpage

text: s ite s

text: e w f o r Not provided e b 4 Indirect Num Direct 2

text: Publishing Content Rating Comments Privacy Level Date

text: n/ l o. 23 ca n io ng y at ni ni No Description ge lic uc ai ch Pa tr Po Te Ed

text: Transparent trust models. It is recommended that web service providers give clear guidance regarding 15 x their reputation systems, highlighting how their system promotes user trust by managing or mitigating spurious, inappropriate or inaccurate reputation entries/scores. 2 Minimise personal and/or sensitive data. It is recommended that reputation systems are designed and 24 x constructed in a way that minimises the amount of data stored in order to decrease the risk of unintended exposure of sensitive data. It is recommended that the level of non-reputation data that can be extracted indirectly is minimal (e.g. username and e-mail address), especially where this information could be used to profile an individual’s use of other websites and applications. 3 Core reputation system design principle – designing privacy and enabling trust. When designing and 28 x x implementing reputation systems, organisations should consider the IT security risks and design and implement an appropriate set of security controls to mitigate the risks. It should be noted that the security controls do not necessarily have be technical; they could include a variety of controls, for example, training and awareness for their customers, clear and concise security and communication processes, and security technologies. 4 Proactively managing rater and ratee communications. Website providers need to provide communica- 29 x tions channels, enabling customers to ask questions regarding their privacy and the level of trust that they can place in any reputation score. 5 Openness regarding how reputation models operate. Organisations using reputation systems should 30 x become more open about the way their reputation systems operate. This would enable users to have greater trust in the reputation scores they were using to help them make informed decisions. 6 Key facts regarding user privacy. Within some industries, for example, the insurance industry, the regula- 31 x x tor recommends that users are shown a ‘key facts’ page, outlining the essential information relating to the terms and conditions and policies. It would be extremely beneficial if web service providers were to highlight key facts regarding data privacy so that individuals gained a full understanding of the associated risks. 7 Clear and user-friendly processes to support the operation of reputation systems. It is recom- 31 x x mended that web service providers provide clear guidance on the use of reputation systems and the processes for a person entering reputation information to update or remove a reputation score (at any point in the future) and how a ratee can challenge inappropriate/inaccurate scores. 8 Right to challenge. It is recommended that web service providers develop clear processes enabling 31 x users and suppliers to challenge information that has been entered into reputation systems. 9 Legal framework. There is significant confusion over which legislation is applicable to a website 32 x x transaction or the information provided by a rater as part of the reputation function. It is recom-

text: mended that further investigations be undertaken to identify clearly which legislation governs each transaction or reputation input and overall score – is it where the web service is hosted or the country of the service consumer? Once there is clarity within the service provider community, this information should be communicated to users.

text: Amazon Amazon collects and stores all Data will be shared with affili- All the data gathered is con- Users can view a broad range Unless indicated otherwise, user information entered on its ated businesses and third- trolled by Amazon, but once of the personal information when customers enter inforwebsite or stemming from user party service providers, but an account is closed the in- that Amazon has collected and mation they give Amazon a interaction such as : they may only access and use formation is no longer acces- can in certain cases update non-exclusive, royalty-free and it to perform their functions. sible by anyone. that information. fully sub-licensable right to e-mails – Amazon receives a use, reproduce, modify, adapt, confirmation when users open When the information is publish, translate, create e-mails that were sent by the shared for other purposes, derivative works from, distribwebsite users will receive notice and ute, and display such content may choose not to share their throughout the world in any information. Advertisers are media. information from third parties – Amazon uses this information not given access to data by to update the information it has Amazon, but may receive They also give Amazon and its registered for a user indirect information from users affiliates and sub-licensees the when they click on a personal- right to use the name that is ised advertisement submitted in connection with search information – Amazon such content, if they choose. stores all information related to

text: terms and results from searches conducted on its website. CNET Interac- CNET Interactive collects all Customer contact information By using the CNET website, Customers may have the CNET reserves the right, but is 26 tive information directly entered by will be shared with partners if customers consent to the opportunity to update that not obligated, to delete, move its users including personal consented by the user. collection, transfer, storage information on the organisa- or edit customer information, in data and preferences. and processing of information tion’s interactive website. If whole or in part. CNET shares customer infor- in the USA. customers ask for their ac- It also collects information mation with third parties so count to be shut down or When customers upload inautomatically from users’ that they may perform their Some of the customer infor- deleted this will be done by formation via the CNET webbrowsing habits through cook- functions. mation may remain in back-up CNET within a reasonable site they irrevocably grant ies, web beacons and other storage, even if customers ask period of time. CNET, its parent, subsidiaries, technologies. Some of the Data may be provided directly for it to be deleted. In some affiliates, and partners a noncollected data is obtained from to co-branded partners by the cases, customers may be exclusive, worldwide, royaltyother sources and includes user or shared with them by entitled under local law s to free licence containing, without publicly-observed data. CNET. access or object to the pro- limitation, all rights, titles and cessing of certain information. interest in customer upload All of the collected information information. Where permitted by law, may be combined. CNET may share information collected about customers within the family of the organisation’s interactive websites and with the wider corporation, the parent company, and other affiliated companies. It may also share aggregated or

text: anonymised data with third parties. 27 eBay eBay may collect and store eBay may disclose personal When opening an account with Users can see, review and When a customer gives eBay personal information, financial information to respond to legal eBay, customers agree that change most of their personal content, he grants it a noninformation, transactional requirements, and may share the organisation may process information by signing on to exclusive, worldwide, perpetuinformation and other infor- this information with members personal data. It may transfer the organisation website. al, irrevocable, royalty-free, mation provided through inter- of the corporate family. this data to other group com- Users must promptly update sub-licensable (through multiaction with the website. It may panies. personal information if it ple tiers) right to exercise any also collect information from It may share personal infor- changes or is inaccurate. and all copyright, publicity, third parties to confirm user mation with service providers eBay will close an account and trademarks, database rights information. under contract and other third remove personal data upon and intellectual property rights parties when explicitly asked request to Customer Services the customer has in the conby the customer. in accordance with applicable tent, in any media known now law. The organisation does or in the future. In addition, the retain personal information customer waives all moral If eBay merges with or is from closed accounts to com- rights he has in the content to acquired by another business ply with the law. the fullest extent permitted by entity, it may share customer law. data with the entity. 28 Facebook Facebook collects personal When customers connect with Even after information has Tools such as RSS feeds, For content that is covered by information, content generated an application or website they been removed from a user’s mobile phone address book intellectual property rights, on the website, transactional grant them access to General profile or an account has been applications, or copy and users specifically give the information, information re- Information. deleted, copies of this infor- paste functions, to capture, following permission, subject ceived through cookies, data mation may remain viewable export (and in some cases, to privacy and application from other websites and infor- The organisation provides elsewhere, however names import) information from Face- settings: They grant Facebook mation received from other users with tools to control how will no longer be associated book may be used by users a non-exclusive, transferable,

text: users. their information is shared with with the information. and their friends. sub-licensable, royalty-free, applications, websites and worldwide licence to use any friends. Additionally, the organisation IP content that they post on or may retain certain information in connection with Facebook The organisation occasionally to prevent identity theft and (‘IP Licence’). This IP Licence provides general information other misconduct even if ends when a customer deletes to pre-approved third-party deletion has been requested. his IP content or account websites and applications. Removed and deleted infor- unless the content has been Advertisers may use techno- mation may persist in backup shared with others, and they logical methods to measure copies for up to 90 days, but have not deleted it. the effectiveness of their ads. will not be available to others.

text: Facebook will share information with third parties when it believes this is permitted by the user, is reasonably necessary of when legally required. 29 Flickr (Yahoo!) Yahoo! collects personal The organisation provides the Data is transferred outside the Account information can be Consumers grant Yahoo! a information when registering information to trusted partners EEA, either to members of the edited and deleted at any time world-wide, royalty free and for a Yahoo! account, when who work on behalf of or with Yahoo! group of companies or by visiting the appropriate non-exclusive licence to reusing certain Yahoo! products Yahoo! under confidentiality to Yahoo!'s carefully selected page. produce, modify, adapt and or services, when entering agreements. business partners publish content such as photos promotions or sweepstakes or graphics on the services and when visiting Yahoo! The organisation responds to solely for the purpose of dispages or the pages of certain legitimate requests by authori- playing, distributing and pro- Yahoo! partners outside the ties with which the organisa- moting the specific Yahoo! branded Yahoo! network of Group for the purpose for

text: websites. Yahoo! Collects tion must comply. which such photo or graphic transactional information and was submitted. This licence is information obtained by cook- Yahoo! may transfer personal terminated at the time that ies. information if Yahoo! acquires, such content is deleted. or is acquired by or merged with, another company.

text: Yahoo! does not provide any personal information to advertisers. Geeknet (Slash- Geeknet may collect personal The organisation will not use None provided User information may be When submitting content, the 30 dot) information entered by users or share the personally identi- modified on the site or through user grants Geeknet a royaltyor stemming from their activity fiable information provided to it contacting the company direct- free, perpetual, irrevocable, on the site. It also collects online in ways unrelated to the ly. non-exclusive, transferable aggregated information from items described above without licence to use, reproduce, interaction with other sites. first letting a user know and modify, adapt, publish, transoffering the user a choice. late, create derivative works from, distribute, perform, and Certain information may be display such Content (in whole publicly available on the site. or part) worldwide and/or to incorporate it in other works in any form, media, or technology now known or later developed, all subject to the terms of any applicable licence. 31 Giffgaff Data is collected by Giffgaff Information may be shared The organisation is required to Registered personal infor- Users agree to grant to the

text: through transactions, enquir- with partners, agents, subcon- retain [personal information for mation may be edited at any organisation an irrevocable, ies, participation in competi- tractors and other companies not less than six months and time on the website. The non-exclusive, perpetual tions, use of the website and in the organisation. Giffgaff not more than two years in organisation can supply users licence to use, copy, install, also through external web- may also share data when it order to ensure that this infor- with certain types of personal maintain, modify, enhance and sites. It may also collect pub- suspects fraud or when mod- mation is available for the information on request adapt your Intellectual Properlicly available information from erating its service. purpose of the investigation, ty Rights in the Post third-parties. detection and prosecution of The organisation may pass serious crime. Aggregated Data to third parties, such as advertisers, content providers and business partners or prospective business partners. The company may use aggregated information to provide users with targeted adverts and offers. 32 Google Picasa Photos posted on their website The organisation does not sell, Account deletions or termina- Users may change account By submitting, posting or may be viewed without regis- rent or otherwise share per- tions will take immediate information and may organize, displaying the content the user tering for an account but cus- sonal information with any effect. Residual copies of modify or delete pictures, gives The organisation a tomers need to set up an third parties except in the deleted photos, associated albums, and associated infor- perpetual, irrevocable, worldaccount to be able to upload limited circumstances such as data, or accounts may take up mation. wide, royalty-free, and nonphotos. This requires providing being required to do so by law. to 60 days to be deleted from exclusive licence to reproduce, personal information. Google the company’s active servers adapt, modify, translate, pub- Picasa also collects infor- and may remain in backup lish, publicly perform, publicly

text: mation from user interaction systems. display and distribute this with the website and from content. cookies. Hospitali- Users have to provide person- Users have control over the A profile will be deleted as Profiles can be edited and Not available 33 tyclub.org al information when registering information they wish to share soon as the company receives deleted through the website. on the website and this infor- with other users on the site. the request. mation will be verified by the When contacting another organisation. member, users have to provide full personal identification.

text: LinkedIn The organisation collects LinkedIn will not share per- The organisation will retain Consumers have the right to The consumers grant The personal information submitted sonal information that is not user information for so long as access and modify the data organisation a nonexclusive, by the user, information ob- published in a public profile the account is active. they entered on LinkedIn. The irrevocable, worldwide, pertained through interaction with without specific consent by the company may keep a copy of petual, unlimited, assignable, the website and through using consumer, unless it believes it The organisation will retain the original information. sub-licensable, fully paid up third-party services, through to be reasonably necessary. and use personal information and royalty- free right to copy, cookies and advertising. as necessary to comply with prepare derivative works of, their legal obligations, resolve improve, distribute, publish, disputes, and enforce this remove, retain, add, process, Agreement. analyse, use and commercialize, in any way now known or in the future discovered, any information that has been provided, directly or indirectly to The organisation.

text: www.linkedin.com - http://www.linkedin.com/static?key=user_agreement&trk=hb_ft_userag - http://www.linkedin.com/static?key=privacy_policy&trk=hb_ft_priv

text: Lovefilm Persons under the age of 18 Data may be shared with third Subscriptions to the compa- Account information can be By supplying a phone number are not permitted to join The parties specifically engaged by ny’s services may be ended at changed online by the user. the consumers give the comorganisation and users are Lovefilm to provide services, in any moment and may require pany permission to contact required to provide correct which case they are required activation via telephone. them via the phone. personal data. to keep the information confidential. By submitting user material consumers grant to the organ- Aggregated information is isation an irrevocable, perpetprovided to companies and ual, non-exclusive, royaltyindividuals that have regis- free, sub-licensable, transferatered in the organisation’s ble and worldwide licence to Affiliate Program. use, reproduce, modify, prepare derivative works of, display and perform that User Material in any media. The licence will terminate when the User Material is removed from the website. 36 Netlog Netlog collects public and Third parties can access all Personal data may be stored User profiles can be edited When a user enters public private information that is public information, under the in a country outside the EU. and deleted at any time. User data including but not limited directly provided by the con- conditions specified in user’s information cannot be down- to text, pictures, images, sumer as well as browsing privacy settings. An account can be deleted at loaded. comment entry etc., the user history through cookies. any time and information that grants The organisation an The organisation can share has been uploaded will be unlimited licence to dissemidata for the purpose of target- stored during a period of six nate, use, process, translate or

text: ed advertising. The company months after it has been delet- modify this data. may be legally required to ed. Accounts will be deleted provide access to personal automatically after two years information in the case of of inactivity. illegal use or upon receiving such orders from authorities. 37 Twitter Information Collected Upon Information can be shared or Accounts can be deleted by Registered users can modify By submitting, posting or Registration: you provide disclosed to a third party users through the webpage. and delete their personal displaying Content on or some personal information, following user consent, but Upon deactivation an account information through the web- through the Services, consuch as your name, username, may only be used to perform is no longer viewable on the site. sumers grant Twitter a worldpassword, and e-mail address functions and provide services website but for up to 30 days it wide, non-exclusive, royaltyto the user. can be restored. After that free licence (with the right to Twitter collects personal in- period the company will start sublicense) to use, copy, formation registered by users Twitter may share aggregated deleting the account, which reproduce, process, adapt, as well as browsing history information with third parties can take up to a week. modify, publish, transmit, through cookies. The organi- and may be required to give display and distribute such sation may keep track of how access to personal information Content in any and all media users interact with third party when ordered to do so by legal or distribution methods (now services. authorities. known or later developed).

identifier: Trust and Reputation Models

nummer: trust-and-reputation-models

publisher: Europeiska unionens cybersäkerhetsbyrå

sprak: en

title: Trust and Reputation Models

serie: rapporter

text: Evaluation and guidelines 19 December 2011

type: rubrik

text: Report on trust and reputation models

type: stycke

text: I

text: Evaluation and guidelines

text: Contributors to this report

text:  Authors: Edward Hamilton, Mischa Kriens, Helen Karapandžić, Karim Yaici, and Mark Main of Analysys Mason Ltd and Stefan Schiffner of ENISA  Supervisor of the project: Rodica Tirtea of ENISA  ENISA staff involved in the project: Demosthenes Ikonomou

text: II Report on trust and reputation models

text: Evaluation and guidelines

text: About ENISA

text: The European Network and Information Security Agency (ENISA) acts as a centre of expertise on cyber security for the European Union (EU), its Member States (MS), the private sector and Europe’s citizens. As an EU agency, ENISA’s role is to work with all of these stakeholder groups, as well as the academic world, to develop advice and recommendations on good practice in computer security. The agency assists MS in implementing relevant EU legislation, and works to protect Europe’s critical information technology networks through activities such as pan-European cyber security exercises. In addition, ENISA acts as a “switchboard” for exchanging knowledge among all of its stakeholders.

text: Contact details

text: For contacting ENISA or for general enquiries, please use the following details:  E-mail: https://www.enisa.europa.eu/contact-info  Internet: http://www.enisa.europa.eu For questions related to trust and reputation models, please use the following details:  E-mail: sta@enisa.europa.eu Legal notice Notice must be taken that this publication represents the views and interpretations of the authors and editors, unless stated otherwise. This publication should not be construed to be a legal action of ENISA or the ENISA bodies unless adopted pursuant to the ENISA

text: Regulation (EC) No 460/2004

text: as lastly amended by

text: Regulation (EU) No 580/2011

text: . This publication does not necessarily represent state-of the-art and ENISA may update it from time to time. Third-party sources are quoted as appropriate. ENISA is not responsible for the content of the external sources including external websites referenced in this publication. This publication is intended for information purposes only. It must be accessible free of charge. Neither ENISA nor any person acting on its behalf is responsible for the use that might be made of the information contained in this publication. Reproduction is authorised provided the source is acknowledged. © European Network and Information Security Agency (ENISA), 2011

text: VI Report on trust and reputation models

text: Evaluation and guidelines

text: Report on trust and reputation models 1

text: Evaluation and guidelines

text: 1 Executive summary

text: Reputation systems are a key success factor of many websites, enabling users and customers to have a better understanding of the information, products and services being provided. However, by using reputation systems, European Union (EU) citizens place themselves at additional risk. These risks include, but are not limited to:  exposing personal data  facilitating the targeting of advertising against themselves  risking price discrimination  website providers sharing the reputation data they provide  the level of trust they place in the reputation score exceeding the level of trustworthiness of the reputation model  vendors and service providers monitoring reputation systems for poor reputation scores to identity and rectify potential customer issues  the linking of user identities across multiple sites through the use of advanced analytics on reputation information. Despite the fact that privacy issues can inhibit consumers from engaging in business, we found from discussions with web service providers that privacy concerns play a limited role in their thinking, beyond achieving legal compliance. Ignoring privacy risks, however, can damage a brand in the case of unintended disclosure of confidential data. Furthermore, there may be scope for privacy-aware providers to access new market segments. This study revealed that there is a significant difference between the real-life implementation of reputation systems and academic research that is currently being conducted. The reputation systems being deployed are primarily concerned with facilitating and promoting business transactions. The academic research into privacy and trust solutions for reputation systems does not appear to be considered, or further developed, in order to embed the research in operational systems. This study also identifies conclusions in five core areas regarding the risks to users of reputation systems and the trustworthiness of the resulting scores, customer communications regarding such systems, and the lack of clarity over the governing legislation. Mitigating security risks posed by reputation systems: by using reputation systems, EU citizens place themselves at additional risks (summarised above). When designing and

text: 2 Report on trust and reputation models

text: Evaluation and guidelines

text: implementing reputation systems, web service providers must consider these risks and ensure they have appropriate security controls in terms of people, process and technology to mitigate them. Trustworthiness of reputation scores: organisations which use reputation systems should become more open about the way their systems operate. This will enable users to have greater trust in the reputation scores they are using to help them make decisions – essentially creating a business differentiator for the web service provider. Consumer communications: to improve consumer communications website providers using reputation models should highlight the key data privacy information from the website terms and conditions and other legal documents so that they are easy to understand. They also need to provide clear guidance on how to update or remove a reputation score (at any point in the future) and how a ratee can challenge inappropriate/inaccurate reputation scores. Website providers should also facilitate easy communications with customers, enabling them to ask questions regarding their privacy policy and the level of trust that they can place in the reputation system. Applicable legislation: there is significant confusion over which regional or national legislation is applicable: whether it is where the web service is hosted or the country of residence of the product/service consumer. It is recommended that further investigations are undertaken to identify clearly by which legislation each transaction or reputation information is regulated. Once it is fully understood which legislation is applicable, the EU should pro-actively encourage major web service providers to update their terms and conditions to comply with the required legislation. Additionally, the EU should undertake a marketing initiative to ensure EU citizens understand their consumer and data privacy rights when using reputation and other online systems. Linkability: using advanced analytic techniques, it is possible to link user identities on different websites. This is possible even if there is no or minimal common user information. Currently, this is complex and challenging, but as techniques develop, the ability to do this will become mainstream and could be used widely (e.g. by web service providers, vendors and advertising organisations) to gather information enabling them to target their products and services better. Further research is required to understand the privacy risks that advanced analytics will pose to EU citizens.

text: Report on trust and reputation models 3

text: Evaluation and guidelines

text: 2 Introduction

text: In the physical world, when a consumer is considering buying a product, they can examine the item in a shop. When purchasing a service they can discuss experiences with acquaintances. Over time, and with experience, people construct mechanisms to enable them to judge if someone is trustworthy, or if a product or service meets their requirements. With online products and services, these options are not readily available. In fact, the majority of the time we only have an impression of the service provider and a product description or photo as a reference. To recreate and substitute the options we have in the physical world, many web service providers use reputation systems to give their clients access to the opinions of other users, thus giving them sufficient confidence in the products and services being offered. Reputation is defined by the Macmillan dictionary as “the opinion that people have about how good or how bad someone or something is” . Reputation systems are used by well-known websites, such as Amazon (product reviews) and eBay (seller and buyer feedback scores). It should be noted that a reputation object can refer to a product or service as well as a user.

text: 2.1 Rationale

text: A person or business’ reputation can have a significant effect on day-to-day life. From a conservative design perspective that starts with maximal privacy, it is believed that what someone says about another person or an object should be considered as sensitive information, both by the one who states the opinion and by the one it concerns. However, for the sake of building up a reputation, some of this data needs to be disclosed. Reputation systems are the technical support to build a reputation in electronic networks. They are based on such opinions, which are collected from different users and published reputation scores. Thus, there is a risk of disclosing sensitive information. These systems, therefore, have a potential impact on the privacy of their users. Furthermore, it is also hard to estimate the level of trust that users can place in reputation scores, as these scores are provided by a system that is not transparent to its users.

text: Macmillan Dictionary http://www.macmillandictionary.com/dictionary/british/reputation

text: 4 Report on trust and reputation models

text: Evaluation and guidelines

text: 2.1.1 Background information In 2010, the European Network and Information Security Agency (ENISA) launched within its work programme a new thematic area of ‘Trust and Privacy in the Future Internet’. A number of introductory actions related to privacy, accountability and trust have been carried out , including work on reputation systems. In this study, we continue these activities in the area of privacy; also investigating trust and reputation models, as was intended within the ENISA 2011 work programme. On the one hand, there is an active academic community researching privacy in reputation systems; on the other hand, different organisations have implemented a variety of reputation systems. Currently, there is very little dialogue between these two communities to understand the risks to public privacy and trust. This study focuses on the privacy impact of reputation systems per se; hence the privacy implications of the underlying services are factored out as much as possible. This study, therefore, does not consider the privacy and trust issues related to recommender systems, i.e. systems that know what products and services the user has been looking at in order to recommend other products and services that might be interesting to them. These systems often use the same underlying data sets. They are, however, fundamentally different and are beyond the scope of this study. 2.1.2 Target audience and scope The intended audience for this report includes policy makers involved in defining regulations and legislation in relation to privacy. In Particular we mean by the term policy makers European Commission bodies, responsible for initiatives in the area of privacy (DG Justice), as well as national legal DPAs. This report is also of interest to organisations involved in designing, implementing and managing web services that use reputation systems, which wish to educate themselves about the practices of their peers with regard to

text: Report on trust and reputation models 5

text: Evaluation and guidelines

text: reputation systems. Lastly, it is intended to present an overview of current industry practice to the research community.

text: 2.2 Methodology

text: To undertake this study, The Authors identified a number of key providers of online products and services. Two forms of research were undertaken. Firstly, we reviewed consumer experiences of reputation systems and used them to identify potential privacy and trust issues; secondly, interviews were held with a number of key service providers to explore their reputation systems in greater depth. We evaluated the reputation systems covered by this research according to a framework. For each system we describe how feedback is collected, and how reputation scores are calculated and distributed. Furthermore, we identify privacy risks and assess how vulnerable different kinds of systems are. The study is qualitative in nature, i.e. neither the number of users/visits nor the economic success of the subjects of our study has been taken into consideration. It is highly recommended that these aspects are explored in a follow-up study by ENISA.

text: 2.3 Findings

text: This study relies on publicly available information and the information that service providers were willing to share with the authors. In the course of the research, we encountered unexpected resistance from service providers when asked to provide details of their reputation systems. In general, organisations were highly sensitive and would not release details pertaining to their reputation algorithms. The providers’ concerns are two-fold:  reputation systems are considered to be intellectual property that differentiate service providers and, potentially, provide business advantage  reputation systems are used as a fraud detection mechanism; exposing details of how a reputation system operates could heighten its vulnerability to fraud and manipulation.

text: See Section 3.2 for the definition of reputation systems in general and reputation scores in particular.

text: 6 Report on trust and reputation models

text: Evaluation and guidelines

text: Reputation systems are, however, holding, and processing, sensitive personal data and must comply with the appropriate legislation, for example, the EU Data Protection Directive (Directive

text: ) and good IT security practice. There are, therefore, strong motivations for web service providers to be open and transparent when using reputation systems. In the course of this research, it has become apparent that there is a significant difference between real-life implementation of reputation systems and the academic research that is currently being conducted.

text: 2.4 Structure of the study

text: This report is laid out as follows:  Section 3 provides an overview of reputation systems and why trust and privacy are important  Section 4 outlines the findings of the study  Section 5 provides our concluding remarks and lists of our recommendations  Section 6 includes references used within this document. The report includes a number of annexes containing supplementary material:  5.1 lists the websites that were reviewed to ascertain which reputation models are being used  Error! Reference source not found. outlines the data that is accessible directly nd indirectly from the reputation systems  Annex II reviews the documentation available on a selection of websites regarding users’ privacy and trust  Annex III provides an overview of the survey questionnaires.

text: See also Bygrave, L., Data Protection Law; Approaching its Rational, Logic and Limits, Kluwer Law International, Den Haag (London, New York, 2002), and Mahler, T. and Olsen, T., ‘Reputation Systems and Data Protection Law’, eAdoption and the Knowledge Economy: Issues, Applications, Case Studies, IOS Press (Amsterdam 2004),

text: pp. 180–187

text: Report on trust and reputation models 7

text: Evaluation and guidelines

text: 3 Overview of reputation systems

text: A reputation system is an electronic system that enables users to rate products, services, sellers, suppliers and people based on their experience. These values are aggregated into reputation scores, which can be used by other users to evaluate the trustworthiness of the services or people who have been rated. Such systems are used by well-known websites, such as Amazon (product reviews) and eBay (seller and buyer feedback scores). This section provides the background to the issues involved in reputation systems, outlines the different types of system in use by websites, the types of data collected, and explains how reputation values are derived.

text: 3.1 Background– trust, reputation and privacy

text: Websites consist of many different components, including modules, for user registration, authentication and the purchasing of products and services. A reputation module can be one of them. This study investigates privacy and trust issues associated with the use of such reputation modules. Trust is a complex social concept. Gambetta defines trust as “a particular level of the subjective probability with which an agent will perform a particular action [...] in a context in which it affects [the trustee’s] own action”. Abdul-Rahman and Hailes (2000) give a typology of trust. The authors distinguish three types of trust: interpersonal, system and basic trust. The first type refers to trust relations among individuals. The second type refers to the trust of an agent in a system; for example, trust in the legal system of a state. The third type of trust refers to a general attitude of the trustee. In this study we investigate the first two types of trust (interpersonal and system). These types of trust are constructed in two ways: word of mouth and personal experience. While personal experience works in electronic networks just as it does in the physi-

text: Gambetta, D. (2000), ‘Can we trust trust?’, Trust: Making and Breaking Cooperative Relations, electronic edition, Department of Sociology, University of Oxford, chapter 13

text: Abdul-Rahman, A. and Hailes, S., Supporting trust in virtual communities, Proceedings of the 33rd Annual Hawaii International Conference on System Sciences 2000

text: 8 Report on trust and reputation models

text: Evaluation and guidelines

text: cal world, word of mouth requires technical support. This technical support is provided by reputation systems. In terms of privacy, the legal grounds for a right of privacy were first argued by Warren and Brandeis who stated: “That the individual shall have full protection in person and in property is a principle as old as the common law; but it has been found necessary from time to time to define anew the exact nature and extent of such protection.” Additionally, the authors explicitly state that the right to be left alone (i.e. privacy) and reputation are integral parts of the individual and shall be protected as the individual’s physical integrity. The use of a reputation system by the user is optional; if one were to follow the logic of the Warren and Brandeis definition, users wishing to safeguard their privacy should not use reputation systems. However, the option to not use reputation systems is becoming harder as they become embedded into more and more Internet-based systems. Furthermore, the notion of what privacy is has changed since Warren and Brandeis were writing in the late nineteenth century. Gürses (2010) presents a different notion of privacy, defining three privacy paradigms, namely confidentiality, control and practice.  Here the term confidentiality is directly developed from Warren and Brandeis’s definition, and states that an individual can protect their privacy by not disclosing private data.  The term control stems from the fact that that the non-disclosure of information is not always an option; Gürses therefore proposes controlled disclosure, which involves a negotiation process among transaction partners about which data should be disclosed. However, even control does not cover all requirements, which is why Gürses adds the term ‘practice’.  Practice signifies that by giving out personal information, an individual receives something in return, whether it be subscribing for a newsletter or sharing stories with a friend.

text: Warren, S. and Brandeis, L. (1890), ‘The Right to Privacy’, Harvard Law Review 193

text: Vol. IV (No. 5)

text: Fahriye Seda Gürses, Multilateral Privacy Requirements Analysis in Online Social Networks, May 2010

text: Report on trust and reputation models 9

text: Evaluation and guidelines

text: Reputation systems are not covered by the second paradigm (control). This is mainly because data ownership is not clear within these systems: one agent’s opinion of another agent is, in fact, owned by both parties – however, only the originator has control over the data. It is therefore no longer true that the person who created the data and controls it is the sole owner, which invalidates the precondition of privacy being determined by control. Privacy as a practice focuses on the dynamic parts of identities “the freedom from unreasonable constraints on the construction of one’s own identity”. This definition requires a constant reassessment of the data processing procedure. Data owners need to have the possibility to withdraw the right of processing, if they desire. This includes mechanisms to resolve conflicts of interest if a data item is owned by multiple stakeholders. Building blocks, such as an anonymous messenger service, which is designed under privacy as confidentiality paradigm, can be used to build larger systems under the privacy as control paradigm; the resulting systems can be used as building blocks to design systems under the privacy as practice paradigm. Other frameworks and constructs do exist, which can assist in achieving the same goals.

text: 3.2 What is a reputation system?

text: In social science, reputation is modelled as a network, equipped with a learning mechanism (the query and the transaction experience) and a control mechanism (the rate algorithm). However, for the purposes of this study, reputation systems are, considered as technical solutions with the purpose to assist social learning and control of the reputation object (e.g., peers, consumers and so on).

text: Agre, P. (1999), ‘The architecture of identity: Embedding privacy in market institutions’, Information, Communication and Society, Vol. 2 (No. 1), pp. 1–25

text: Buskens, V. and Raub, W. (2001), ‘Embedded Trust: Control and Learning’, Vol. 19 of Advances in Group Process-

text: es, pp. 167–202

text: Steinbrecher, S. (2009), ‘Enhancing multilateral security in and by reputation systems’, in Proceedings of the IFIP/FIDIS Internet Security and Privacy Summer School, Vol. 298 of IFIP AICT, pp. 135–150

text: 10 Report on trust and reputation models

text: Evaluation and guidelines

text: A reputation system collects information from users and from different functions on the website and uses this information to create a reputation score, for example, a score that shows how reliable a seller has been. As shown in Figure 3.1, reputation systems need to provide the following three core elements:  the rating process – a protocol enabling a user (rater) to provide feedback on their experience while using or interacting with the reputation item (ratee); furthermore, other information that could be utilised as an indicator to the behaviour of a reputation item might be collected  a query process that allows users to investigate the reputation of an item  a reputation function that calculates a reputation score.

text: Figure 3.1:Overview of reputation system

text: 3.2.1 Types of reputation system Farmer and Glass (2010) define a number of common reputation models. In this section, we summarise the five common models used by web service providers we have observed based on the models defined by the authors: vote to promote, content rating and ranking, content reviewing and comments, incentive points, and quality karma. Vote to promote Rating: users are allowed to vote for a product, a video or a person. This reputation system can also take into account the actions or the number of

text: Building Web Reputation Systems O'Reilly Media, Inc. ISBN-13: 978-0-596-15979-5

text: Report on trust and reputation models 11

text: Evaluation and guidelines

text: hits generated by its users to rate a product. Some of these systems allow users to retract their votes or allow users to vote against an item, and in these cases the score is decreased accordingly. Reputation function: the number of votes is used as a ranking score by the website. Querying : mostly indirect for content filtering, for example, on YouTube the most popular video clips will be positioned higher in search results. However, Facebook uses this system with its ‘Like’ button, and does not use this information for ranking. Clicking on the button simply communicates the fact that the user appreciates a certain item and would like their friends to be aware of this. Content rating and Rating: this system is very similar to the ‘vote to promote’ system, and is ranking differentiated only by the fact that it allows users to rate a product on a scale instead of simply letting them vote for or against it. Different scales can be used to rate a product or a user, such as stars, bars, and numbered scales, depending on the item that is being rated. Reputation function: an average score is then calculated based on different opinions. The more users who have voted for a product, the more representative the score can be assumed to be. Querying: see ‘vote to promote’. Wikipedia is an example of a website that uses this system to rate its different articles. Content reviewing Rating: this system goes a step further than ‘content rating and ranking’ to and comments the extent that it allows users to give a more precise description of their experience or viewpoint. Users are asked to rate different aspects of a product or an experience, such as quality, price and delay. This reputation score is accompanied by freeform text, where the user is able to provide more information and the details behind their score. Reputation function: the resulting review is the average of the total score for each aspect, with a compilation of the different written reviews accessible if needed. Often there is an additional overall score.

text: Querying is the process for users to view and access reputation information

text: 12 Report on trust and reputation models

text: Evaluation and guidelines

text: Querying: often explicit by clicking on a user, but a simpler aggregation might be used as in ‘vote to promote’ for continent filtering. Amazon and Blogger are two websites that use this system. Incentive points Rating: in the ‘incentive points’ model, each user action is worth a fixed number of points, which are automatically collected and form the reputation score. Unlike other reputation systems there is no direct requirement for a rater to rate an individual, product or service. It is also possible to specify actions in this model which reduce the total number of points (e.g. lack of user activity). Reputation function: the higher the number of points accumulated by a user, the better their reputation. The system exploits the user’s desire to achieve a better ranking, leading them to fulfil certain tasks. Querying: taking social network LinkedIn as an example, users are prompted to provide more information about themselves to achieve a 100% profile. The reputation score is created by the user undertaking activities. Scores are displayed on public leader boards or as events in a user’s news feed. Similarly, when a user plays a social game operated by publisher Zynga, posts are automatically generated, for example, telling the user’s friends that they have upgraded their town in the game CityVille or that they gave one of their friends a gift. In some instances, these points can be redeemed to access services for free. This is comparable to loyalty cards used in supermarkets that reward customers for shopping. Quality karma This system deals solely with the quality of user contributions and does not concern itself with the number of contributions. One of the reasons behind this is to avoid people manipulating the system by posting a high number of fake reviews to receive a higher ranking. An example of a website that uses this system is eBay, eBay uses a range of reputation functions one of which is quality karma. Rating: users are allowed to rate sellers on criteria such as communication, dispatch time and postage charges, but only once a transaction has gone through. Reputation function: eBay, for example, displays an extensive set of karma scores for sellers, indicating the amount of time the seller has been a member on eBay, the number of transactions they have conducted and a

text: Report on trust and reputation models 13

text: Evaluation and guidelines

text: feedback score, among many others. Querying: often explicit by clicking on a user, but a simpler aggregation might be used as in ‘vote to promote’ for content filtering. A seller on eBay that has a high percentage of positive feedback is assumed to be more trustworthy than sellers with a low reputation score, and is likely to receive more custom. 3.2.2 Rating protocol A rating protocol enables the user to rate a reputation item, i.e. a way to express an opinion on their user experience. For very simple systems this can be as simple as one click (as is the case for ‘vote to promote’). This can lead to ballot stuffing where a single user votes multiple times for an item to promote this item disproportionately. In more complex systems, the user needs to register first to be allowed to vote. This registration is in place to prevent or filter out double ratings. This still cannot prevent Sibyl attacks. In a Sibyl attack, a single adversary registers multiple times with a system, to perform actions as if they were multiple users. Sybil attacks are hard to prevent, however, two mechanisms are often used by advanced reputation systems, namely, strong authentication for the registration of users and costly ratings. In the first version, the provider ask mostly for an alternative way to send an authentication voucher, while for the second variant a rater needs a token to rate. eBay is the most known example for the second, only a user who bought a product can rate a seller. Depending on the rating protocol, reputation function receives a history of rate actions, which is more or less rich in information. One end of the spectrum is a simple list of votes for every item, while at the other end there is a rich list of multidimensional ratings, including authentic information about the rater and the transaction. 3.2.3 Reputation functions A reputation function takes the reputation information and uses it to calculate a reputation score for users, products, services or organisations. Reputation information can relate to diverse aspects of the ratee’s behaviour. This is often, but not solely, user feedback, collected by the rating protocol, for example, inputs to a reputation function such

text: Douceur, J. (2002), ‘The Sibyl Attack’, Peer-to-Peer Systems LNCS, Vol. 2429, pp. 251–260

text: 14 Report on trust and reputation models

text: Evaluation and guidelines

text: as quality of a product, and delivery time. Furthermore, this can be objective observable information. Some examples follow. Additive reputation functions: some systems use a very simple reputation function, such as the ‘vote to promote’ system, which calculates the overall score by adding up the number of positive votes. When a static item receives a positive vote from a large number of users, it can be assumed that it is trustworthy; however, with dynamic reputation items (such as individuals or services) that behaviour can change as soon as their reputation is high enough. To prevent this kind of unwanted adaptive behaviour, a mechanism for supplying negative feedback is needed. Weighted averages: in more complex systems, such as ‘content rating and ranking’ or ‘content reviewing and comments’, the reputation score can be calculated as the global average of the different reputation inputs or a weighted average, depending on the different elements that have been reviewed. A breakdown of the different elements of the reputation scores may also be supplied alongside the overall reputation score. This allows users to make a personal decision on whether to trust the item or not. For example, booking.com provides an overall reputation score of different hotels, which is then broken down into categories such as cleanliness, comfort, location and services. As such, customers can make an informed decision and weigh up whether they prefer their accommodation to be clean, but outside the city centre, for example, or whether they prefer to be in a good location, but less comfortable. To prevent its system from being manipulated, the rating protocol requires users to have a rating token before they are allowed to contribute a review. The token is distributed to the users if they have stayed at the hotel. This prevents hotels from promoting themselves through false reviews. It also prevents other hotels from posting bad reviews about their competitors. Because these systems require users to sign up for the website before giving a review, the information is more trustworthy and harder to manipulate. Social graph-based reputation functions: an even more complex system is the ‘quality karma’ reputation system. In order to compute the reputation score of a user, such systems have to take into account a multitude of reputation inputs, scores and reviews, all of which carry different weights. A user who has reviewed similar items in the past and whose reviews have been agreed upon by other users will have a more influential vote than a user who just joined the site. These systems are continuously computing new scores as users undertake different actions. To prevent users from manipulating reputa-

text: Report on trust and reputation models 15

text: Evaluation and guidelines

text: tion scores, the majority of organisations using reputation systems are unwilling to discuss how their reputation algorithm works to any degree of detail. Companies operating such systems believe that as long as this information is not publicly available it remains very hard to manipulate the system. Such companies believe this integrity is fundamental to maintaining user trust in the system. Google’s PageRank is the scientific basis for Google’s search result ranking. It is based on the random surfer model: the random surfer is dropped at a random page and follows random links. It then stops after a random number of steps and starts again. When this process is repeated a certain number of times, it is possible to infer the probability that the surfer will end at a certain page. A stationary distribution can thus be determined for all pages covered by the PageRank algorithm. The rank of a page is the probability that the random process ends at this page. In practice the PageRank algorithm is very vulnerable to manipulation as it is possible to increase a page’s ranking by creating more links to it. It has also been shown that link bombs are a very effective way of attacking the algorithm. A link bomb is a number of web pages under the control of the attacker, linking them all to the attacker’s target site. The current ranking system being used by Google is more complicated and is being kept secret in order to avoid manipulation. All kinds of combinations and reputation functions are used in current reputation systems. However, these are confidential and cannot be discussed in detail here. Since the authors believe that transparency leads to more security we conclude this section with the following recommendation. Recommendation One – Transparent trust models. It is recommended that web service providers give clear guidance regarding their reputation systems, highlighting how their system promotes user trust by managing or mitigating spurious, inappropriate or inaccurate reputation entries/scores.

text: Page, L., Brin, S., Motwani, R., and Winograd, T. (1999), ‘The PageRank Citation Ranking: Bringing Order to the web’, Technical Report, Stanford InfoLab

text: Gyöngyi, Z. and Garcia-Molina, H. (2005), ‘Link spam alliances’, in Proceedings of VLDB

text: 16 Report on trust and reputation models

text: Evaluation and guidelines

text: 3.2.4 Querying protocols The querying protocol allows users of a reputation system to investigate a reputation item’s reputation score. This can be done directly or indirectly. Direct queries can be observed in eBay, for example. A user can search for a seller’s name and study their reputation scores. This can lead to severe privacy problems depending on the richness of the scores, since automatic web crawlers can collect this information easily. This can be prevented by limiting the amount of reputation information available and by hindering automatic crawling. The latter is done by excluding non-human surfers by using CAPTCHA (Completely Automated Public Turing test to tell Computers and Humans Apart ) solutions or by detecting atypical behaviour, e.g. high click rates and repetitive querying. Preventing web crawling reduces traffic costs for the providers, meaning cost benefits and user privacy go hand in hand – and it can be assumed that every serious service provider deploys web crawling protection. If scores are used for content filtering, then the querying is indirect. Due to the lack of a query interface it is harder to crawl reputation scores automatically; moreover, scores for content filtering are normally scalars and thus much less private information can be exposed. 3.2.5 Reputation models used by websites Outlined in Figure 3.2 below is a breakdown of the reputation models used by a range of European and other websites. The authors selected a range of websites, including well known global websites and specialist Member State (MS) country websites for review. The selection of websites (listed in Error! Reference source not found.) was based on the tudy team’s knowledge and experience. No quantitative methods were used in selecting the websites.

text: At the time the study was performed.

text: A web crawler is a program that automatically collects data from webpages by following links.

text: Report on trust and reputation models 17

text: Evaluation and guidelines

text: 6% Vote to promote 11% 23% Content rating and ranking Content reviewing and comments Incentive points 31% 29% Quality karma

text: Figure 3.2: Use of reputation models by a range of web service providers

text: The most popular reputation model is the ‘content reviewing and comments’ model, closely followed by ‘content rating and ranking’ based on a sample of 36 websites (please refer to Error! Reference source not found. for the list of websites).

text: 3.3 Reputation data

text: Within many websites, the reputation system is closely linked with other functions, such as user registration and purchase transactions. This report focuses purely on the issues of trust and privacy with regard to the reputation system and the data used within it. To analyse the available data we segmented it into four core data types:  physical personal information – user’s real name, geographic location, gender, etc.  Internet-related identity information – website identity, e-mail address, etc.  user’s site activity data – people, products and services on which the user has commented, etc.

text: 18 Report on trust and reputation models

text: Evaluation and guidelines

text:  potential inputs into the reputation function – comments and their publishing date, ratings, etc. It should be noted that web avatar identity information can often provide information relating to real-world personal information. For example, many e-mail addresses contain individuals’ first and/or last names. Ten websites (listed in Annex II) were reviewed to ascertain the amount of data in the four categories defined above that a standard website user could access. These websites were chosen to have a variety of pages in terms of target audience and to have representatives of US-based and EU-based providers. For each of these segmented data types, research was conducted to identify the data that was:  accessible directly – from within the reputation system  accessible indirectly – using the reputation system to access information held within other website modules, for example, using the username listed in the reputation module to then look at additional information held in the user’s website profile  not provided – the information of that data type was not accessible either directly or indirectly. Figure 3.3 to Figure 3.6 inclusive highlight the data that is available in each category, either directly through the reputation system, or indirectly via the reputation system into other website functions (additional information is listed in Annex II). 3.3.1 Physical personal information Figure 3.3 identifies the various forms of personal data that are accessible (either directly or indirectly) via the reputation systems. ‘Personal data’ was assessed to be any form of information regarding the physical world (either a single piece of information or in combination with other information) that would assist or allow the rater and ratee potentially to be identified.

text: Report on trust and reputation models 19

text: Evaluation and guidelines

text: Figure 3.3: Availability of personal information via reputation systems on select websites

text: The level of personal information available directly and indirectly was considerable and more than is required for the effective operation of the reputation system. 3.3.2 Internet-related identity information To interact with many websites, users are persuaded to provide Internet-related information (for example e-mail addresses) to create unique accounts. How this information is used has a direct impact on the privacy of the user. Figure 3.4 below, identifies the various forms of Internet-related identity information that could enable a profile of a user to be constructed and, in certain circumstances, link a user’s activity on one website to other websites.

text: 20 Report on trust and reputation models

text: Evaluation and guidelines

text: Figure 3.4: Availability of web identity information via reputation systems on selected websites

text: 3.3.3 User site activity data Service providers are able to record a user’s activities on a website. What activities are recorded and made available to other users could affect their privacy. Figure 3.5 below identifies the various forms of website information that may prove useful in creating a profile of a user’s activity.

text: Report on trust and reputation models 21

text: Evaluation and guidelines

text: b 6

text: Figure 3.5: Availability of site activity data via reputation systems on selected websites

text: 3.3.4 Potential inputs into the reputation function The reputation values that are collected have a direct impact on the level of risk to a user’s privacy and to the level of trust a user can place in the reputation score. Figure 3.6 below identifies the types of reputation function input that are accessible to other users. For example, on some websites it is relatively easy to use the reputation system to review all the products, services, and users that a single rater has reviewed.

text: 22 Report on trust and reputation models

text: Evaluation and guidelines

text: Figure 3.6: Availability of content-related data via reputation systems on selected websites

text: Across all four data types, the level of information available directly and indirectly is more than would be required for the effective operation of the reputation system.

text: Report on trust and reputation models 23

text: Evaluation and guidelines

text: 4 Analysis of reputation systems

text: This section builds on the background information in the previous chapter and provides our analysis of the privacy and trust issues. It then makes recommendations to minimise the threat to EU citizens’ privacy and to enable them to place the appropriate level of trust in reputation information provided by web service providers. When investigating the use of reputation systems and their potential impact on a user’s privacy and on the level of trust that can be established/inferred by the use of reputation systems, the key areas outlined below must be examined.  Data exposed by reputation systems, and its potential impact on a user’s privacy. This also includes any implications regarding how trustworthy the values are that are presented by the reputation system to the user.  Details of reputation models that are in use, including: — how reputation inputs are collected and how it is ensured that those inputs are factually accurate — how the reputation scores are generated and how organisations ensure that the reputation scores are accurate and fair, while ensuring customer privacy — how organisations ensure the availability of reputation scores, while ensuring user privacy — how systems achieve privacy and anonymity and ensure that raters and ratees who provide reputation information cannot be linked to the systems.  The appropriateness of the level of data being collected, and the management of issues around data privacy.

text: 4.1 Data exposed by reputation systems

text: The reputation information that is gathered can be categorised into the following data types:  reputation system inputs from a discreet and finite set. Essentially, all possible inputs can be enumerated; this is any structured feedback, e.g., a vector combined from scales as a scale from 1 to 10 for delivery time and another for the quality of the product.  free text areas allowing raters to provide additional comments

text: 24 Report on trust and reputation models

text: Evaluation and guidelines

text:  the circumstances in which the data was collected, e.g. the delivery time of the product ordered. Information such as usernames and credit card details are not considered to be a part of the reputation system, as they are almost exclusively used by unrelated website functions such as authentication and payment. Outlined below is an overview of the range of information that can be identified (either directly or indirectly) using the reputation system:  web identity username  real name  e-mail address  other products and services that the user has rated  other websites the user has visited and their username there  friends and acquaintances  location  freeform text, which could include any of the above information, plus additional personal information. From the research undertaken, it has become apparent that reputation systems act as a portal to obtain significant information (personal and other data) from other modules of the website. On many systems it was possible to click on the individual reputation score and find personal details regarding the reviewer, e.g. their location. Recommendation Two – Minimise personal and/or sensitive data. It is recommended that reputation systems are designed and constructed in a way that minimises the amount of data stored in order to decrease the risk of unintended exposure of sensitive data. It is recommended that the level of non-reputation data that can be extracted indirectly is minimal (e.g. username and e-mail address), especially where this information could be used to profile an individual’s use of other websites and applications.

text: 4.1 Information used to generate reputation values

text: Some reputation systems only use the information provided by users (for example, specific scores), and are quite basic in the way they calculate an overall score. Other systems are more sophisticated and use a wide range of information scores. For example, from discussions with a range of service providers it is understood that their reputation sys-

text: Report on trust and reputation models 25

text: Evaluation and guidelines

text: tems are part of their wider fraud detection systems, and that a wide range of information is used to generate an overall user and seller reputation score. This includes:  information collected from the user’s activity on the website (e.g. web pages visited, clicks, products and services viewed) and the level of information they have provided  the volume of personal information that is provided  geographic location (there is a perceived higher level of fraud generated from specific ISP networks and countries)  background information provided by third parties e.g. credit ratings.

text: 4.2 Risks posed by the use of reputation systems

text: To better understand the risks associated with reputation systems, an IT security risk assessment has been undertaken. Risk is a combination of threat, probability and impact level. Within this IT security risk assessment, the identified risks can be thought of as consisting of a number of components:  threat level and sources – the threat level is a value attributed to the combination of the capability and motivation of a group or individual to manipulate or extract data from reputation systems  potential impact – the potential impact to a reputation system user’s sensitive and personal information or the manipulation of the reputation score. The threat sources considered within the risk assessment are as follows:  reputation rater – the person leaving feedback regarding a product, service or user  reputation ratee – a person, product or service being rated  reputation information user – an individual using the reputation information to make a decision  service provider – the organisation providing the website and reputation system  information exchange partner – organisations with which the service provider shares reputation system data  supplier – organisations that supply services to the service provider

text: 26 Report on trust and reputation models

text: Evaluation and guidelines

text:  external party – an external party that uses various methods to extract reputa-tion information from the website without the permission of the rater or the service provider. Figure 4.1 shows the key risks generated from the risk assessment, which the design, implementation and operation of the reputation system should mitigate. Risk Description Exposure of per- There is a risk that the free text descriptions/opinions that are entered sonal data by the user and used by a reputation system could expose additional information (personal and non-personal) about the customer. Targeting of prod- There is a risk that organisations monitor reputation systems and other ucts and services transactional information to build a better understanding of how citizens (individuals and groups) use their website(s) in order to target their own products and services. There is also the risk of organisations selling information to other organisations, an issue identified by researchers at Stanford Law School who noted that: “Home Depot, The Wall Street Journal, Photobucket, and hundreds of other websites share visitors’ names, usernames, or other personal information with advertisers or other third parties, often without disclosing the practice in privacy policies.” Sharing of data There is a risk that organisations will share reputation information with other organisations – typically related to a set of products or services where a manufacturer would appreciate feedback. Manipulation There is a risk that the calculation of the overall reputation score could be manipulated (up and down), leading to the misrepresentation of user opinions. Monitoring for There is a risk that external organisations could monitor social media customer satisfac- and other systems with analytic systems to identify poor reputation tion scores for products and services. With the use of the information that is displayed within the reputation system and their own internal applications providing sufficient information, they could link the reputation score to a specific client. Linkability There is a risk that people use the same user identifier across multiple reputation systems, enabling the linking of user reputation entries and feedback across multiple websites. There are advanced analytic techniques which have the ability to link a single user’s activity even if the website identifiers and other identity information differ.

text: Report on trust and reputation models 27

text: Evaluation and guidelines

text: Figure 4.1: Key risks from reputation systems

text: We reviewed a range of websites (the web pages themselves and the terms and conditions of use) to assess the level of personal data that is exposed by each of the five different types of reputation system. With the ‘vote to promote’ system the risk of accidentally exposing personal data to another website user remains low as the system only retains a user’s opinion, and not their identity. The little information that is exposed by voting for an item could potentially be used to monitor customer satisfaction. It could also be manipulated to reflect a false opinion or to target products and services. Even if the information were to be used for these purposes, it would not greatly affect the privacy of the users, as it mostly concerns aggregated data. All the different reputation systems have a high risk of service providers using and sharing reputation data with third parties. This is because most websites using reputation systems are trying to rate and rank different items, and, as such, have access to information that is very valuable to organisations such as manufacturers. Most of the sites that have been reviewed by the authors state that they provide third parties with aggregated data on user activity. A manufacturer could also look up the overall reputation scores of its products on sites such as Amazon and Facebook. There is a substantial risk of exposing personal data when a website uses ‘content rating and ranking’ or ‘content reviewing and comment’, as users have to log in to the website in order to post a review. As such it is easy to connect a user to different reviews. The risk of linkability is also quite high. There is also a risk that reviews and opinions can be manipulated under these systems, but even if this were to happen, the impact on user privacy remains small. As with the ‘vote to promote’ system, organisations will easily be able to monitor user satisfaction, but, again, this will not affect user privacy, as it involves aggregated data. It should, however, be noted that aggregating data does not always achieve privacy. Service providers should ensure that any aggregation function ensures and maximises privacy. Incentive points systems carry a very low risk of breaches of trust because they involve encouraging users to undertake certain actions, but do not require them to provide any personal information.

text: 28 Report on trust and reputation models

text: Evaluation and guidelines

text: Figure 4.2 maps the identified risks to the common reputation models (as outlined in Section 3.2.1) and assesses the IT security and privacy risks in terms of its potential impact on EU citizens. The categories used to rate the reputation systems and the identified risks are:  low – the likelihood of the risk occurring and the potential impact on privacy and trust for EU citizens would be minimal  medium – the likelihood of these risks occurring is high, but the impact on privacy and trust for EU citizens is low  high – the likelihood of these risks occurring is significant and the impact on privacy and trust for EU citizens could be significant and might expose citizens to phishing, identity theft and other forms of IT security risk and fraud. Risks Vote to pro- Content rat- Content re- Incentive Quality kar-mote ing and rank- viewing and points ma ing comment Exposure of Low High High Low High personal data Targeting of products and Medium Medium Medium Low Medium services Sharing of reputation High High High High High data Manipulation Medium Medium Medium Low Medium Monitoring for customer Medium Medium Medium Low Medium satisfaction Linkability Medium High High High High Figure 4.2: Potential impact from the use of reputation systems Recommendation Three – Core reputation system design principle – designing privacy and enabling trust. When designing and implementing reputation systems, organisations should consider the IT security risks and design and implement an appropriate set of security controls to mitigate the risks. It should be noted that the security controls do not necessarily have be technical; they could include a variety of controls, for example, training and awareness for their customers, clear and concise security and communication processes, and security technologies.

text: Report on trust and reputation models 29

text: Evaluation and guidelines

text: 4.3 Reputation models

text: To gain more information about the use and configuration of reputation systems, the authors contacted 53 organisations, of which only two decided to participate in the study. A summary of the survey questions is listed in Annex IV of this study. The recruitment process revealed that there is significant confusion among organisations as to who owns the reputation system and who is responsible for the data held within it. For example, in our discussions with organisations, we were passed between legal/regulatory, fraud, privacy, security, and software development personnel. If a customer had a concern regarding the reputation system, it would be extremely difficult for them to identify the correct contact to obtain a suitable answer. Recommendation Four – Proactively managing rater and ratee communications. Website providers need to provide communications channels, enabling customers to ask questions regarding their privacy and the level of trust that they can place in any reputation score. In the majority of cases, as soon as we mentioned that we would like more information on how reputation systems operate, we were passed to the legal and regulatory teams. Within a reputation system, there is a body of sensitive data, which may be governed by legislation, for example, the EU Data Protection Directive (Directive

text: ). There is also a significant element regarding the trustworthiness of the reputation information and associated scores provided. 4.3.1 How reputation values are generated A key area of privacy and trust associated with the use of reputation models is the way the reputation values are generated and how websites ensure that reputation values are not being manipulated. During conversations with organisations that use reputation systems, they were generally unwilling to discuss how their reputation system worked and the types of measure they deployed to ensure that the reputation value generated was a true representation, and that it had not been manipulated.

text: 30 Report on trust and reputation models

text: Evaluation and guidelines

text: There is significant secondary information regarding how the reputation systems on specific websites operate. However, without direct co-operation from web service providers, it is impossible to ascertain exactly how their reputation systems work. Many organisations attempt to secure business by not disclosing basic information. Web service providers would be in a better position if they were more open regarding how their reputation models operate. This would enable users to gain a better understanding of the reputation systems, which would, in turn, enable them to make better informed decisions. Recommendation Five – Openness regarding how reputation models operate. Organisations using reputation systems should become more open about the way their reputation systems operate. This would enable users to have greater trust in the reputation scores they were using to help them make informed decisions. 4.3.2 Privacy and anonymity One of the key risks associated with the use of reputation systems is the potential impact on a user’s privacy. To better understand how reputation data is used within organisations, further research was conducted on:  the range of reputation data collected and the privacy issues associated with the data collected  how reputation data is shared with other organisations  how long reputation data is retained  the ability of a customer to challenge and verify that the reputation data concerning them or their products and services is accurate  the ownership of the reputation data that users enter into the system. Annex III provides a synopsis of the terms and conditions and privacy statements regarding reputation information entered into or collected from a range of websites. It should be noted that none of the websites researched specifically mentioned reputation data as a defined data type. The key findings of the review are outlined below. The range and detail of reputation data that is collected varies greatly from site to site. Organisations regularly share data with other organisations in their group. Many provid-

text: Report on trust and reputation models 31

text: Evaluation and guidelines

text: ers share information with their suppliers, and some with third parties. Users must be made aware any data entered into a website has the potential to be shared. It is often unclear what happens to a user’s reputation scores or the reputation information they have provided on other users, products or services once their account is deleted. Recommendation Six – Key facts regarding user privacy. Within some industries, for example, the insurance industry, the regulator recommends that users are shown a ‘key facts’ page, outlining the essential information relating to the terms and conditions and policies. It would be extremely beneficial if web service providers were to highlight key facts regarding data privacy so that individuals gained a full understanding of the associated risks. Once reputation information is entered, users have minimal control over how the service provider uses that data. The risk (Section 4.2) to citizens is directly dependent on the type of reputation model being used. The service provider’s terms and conditions provide minimal additional privacy protection. Recommendation Seven – Clear and user-friendly processes to support the operation of reputation systems. It is recommended that web service providers provide clear guidance on the use of reputation systems and the processes for a person entering reputation information to update or remove a reputation score (at any point in the future) and how a ratee can challenge inappropriate/inaccurate scores. The way in which ratees can challenge reputation data is unclear. From the websites reviewed as part of this research, the user is generally required to contact customer services and pursue the issue it through the standard customer service process. There is a risk that an incorrect reputation score could have a significant impact on a user or a business, potentially leading to reputation damage and the loss of business. Recommendation Eight – Right to challenge. It is recommended that web service providers develop clear processes enabling users and suppliers to challenge information that has been entered into reputation systems. Our review also suggested that legislation governing the use of reputation systems was unclear. Many types of regulation and legislation were mentioned, but which legislation

text: 32 Report on trust and reputation models

text: Evaluation and guidelines

text: took precedence was not clear. To understand the information provided would require significant legal training. It was not clear how country legislation (where the user is residing) interacts with the legislation defined within the terms and conditions of the websites. Recommendation Nine – Legal framework. There is significant confusion over which legislation is applicable to a website transaction or the information provided by a rater as part of the reputation function. The research community should undertake further investigations to identify clearly which legislation governs each transaction or reputation input and overall score – is it where the web service is hosted or the country of the service consumer? Once there is clarity within the service provider community, this information should be communicated to users.

text: Report on trust and reputation models 33

text: Evaluation and guidelines

text: 5 Concluding remarks

text: Reputation systems are a key success factor of many websites, enabling users and customers to have a better understanding of the information, products and services being provided. However, they can be the source of privacy risks. Ensuring customer privacy, and maximising the level of trust that customers can place in the reputation values, should be a key concern of the website providers. Despite the fact that privacy issues can inhibit consumers from engaging in business, we found from discussions with web service providers that privacy concerns play a limited role in their thinking, beyond achieving legal compliance. The reputation system is seen as a business tool to generate sales and additional use of the website. Ignoring privacy risks, however, can damage a brand in the case of unintended disclosure of confidential data. Furthermore, there may actually be scope for privacy-aware providers to access new market segments. This concluding section provides a summary of the key points of this study regarding the risks to users of reputation systems and the trustworthiness of the resulting scores, customer communications regarding such systems, and the lack of clarity over the governing legislation. Risk from the use of reputation systems By using reputation systems, EU citizens place themselves at additional risk of:  exposing personal data  facilitating the targeting of advertising against themselves  risking price discrimination  website providers sharing the reputation data they provide  the level of trust they place in the reputation score exceeding the level of trustworthiness of the reputation model  vendors and service providers monitoring reputation systems for poor reputation scores to identity and rectify potential customer issues  the linking of user identities across multiple sites through the use of advanced analytics on reputation information. When designing and implementing reputation systems, web service providers must consider these risks and ensure they have appropriate security controls in terms of people, process and technology to mitigate these risks.

text: 34 Report on trust and reputation models

text: Evaluation and guidelines

text: Trustworthiness of reputation scores A key area of investigation in this study has been the level of trust that website users place in the use of reputation scores, and whether this level of trust is appropriate. During conversations with organisations that use reputation systems, they were generally unwilling to discuss how their reputation scoring systems calculate scores. There is significant secondary information regarding how the reputation systems of specific websites operate, but providers are unwilling to validate this information. Many organisations attempt to secure business by not disclosing basic information, but web service providers would be in a better position if they were more open regarding the way their reputation models work. Organisations which use reputation systems should become more open about the way their reputation systems operate. This would enable users to have greater trust in the reputation scores they use to help them make better informed decisions – essentially creating a business differentiator for the web service provider. Improving customer communications From our discussions with website provides, if a customer had a concern regarding their reputation system, it would be extremely difficult for them to identify the correct person/team to talk to and obtain a suitable answer. To improve customer communications, website providers using reputation models should:  highlight the key data privacy information from the website terms and conditions and other legal documents so that they are easy to understand  provide clear guidance on how to update or remove reputation scores (at any point in the future) and how a ratee can challenge inappropriate/inaccurate reputation scores  facilitate easy communications with customers, enabling them to ask questions regarding their privacy and the level of trust that they can place in the reputation system. Applicable legislation There is significant confusion over which regional or national legislation is applicable – is it where the web service is hosted or the country of the product and service consumer? It is recommended that further investigations are undertaken to identify clearly by which legislation each transaction or reputation information is regulated. Once it is fully understood which legislation is applicable, the EU should pro-actively encourage major web

text: Report on trust and reputation models 35

text: Evaluation and guidelines

text: service providers to update their terms and conditions to comply with the required legislation. Additionally, the for

text: article 29

text: relevant commission services in cooperation with national DPA should undertake marketing initiatives to ensure EU citizens understand their consumer and data privacy rights when using reputation and other online systems. Linkability Using advanced analytic techniques, it is possible to link user identities on different websites. This is possible even if there is no or minimal common user information. Currently, this is complex and challenging, but as techniques develop, the ability to do this will become mainstream and could be used widely (e.g. by web service providers, vendors and advertising organisations) to gather information enabling them to target their products and services better. Further research is required to understand the privacy risks that advanced analytics will pose to EU citizens. This should be supported with EU funding within FP7 for Research and Technological development.

text: 36 Report on trust and reputation models

text: Evaluation and guidelines

text: 5.1 List of recommendations

text: By the term policy makers we mean European Commission bodies, responsible for initiatives in the area of privacy (DG Justice), as well as national legal DPA.

text: Report on trust and reputation models 37

text: Evaluation and guidelines

text: Figure 5.1: Summary of study recommendations

text: 38 Report on trust and reputation models

text: Evaluation and guidelines

text: 6 References

text: References are provided in the order in which they appear in the text.  Macmillan Dictionary. Macmillan Publishers Limited. Available at: http://www.macmillandictionary.com/dictionary/british/reputation [Accessed 23 November 2011]  Buskens, V & Raub, W. Embedded Trust: Control and Learning, Group Cohesion, Trust, and Solidarity. Vol. 19 of Advances in Group Processes, pages 167-202. 2001.  Steinbrecher, S, Enhancing multilateral security in and by reputation systems. In proceedings of the IFIP/FIDIS Internet Security and Privacy Summer School, Brnom 2008, volume 298 of IFIP AICT, pages 135-150.  ENISA Work Programme 2010. Available at: http://www.enisa.europa.eu/media/keydocuments/enisa-work-programme-2010 , p. 36. [Accessed 23 November 2011]  ENISA Work Programme 2011. Available at: https://www.enisa.europa.eu/aboutenisa/activities/programmes-reports [Accessed 23 November 2011]  Gambetta, D. Can we trust?, Trust: Making and Breaking Cooperative Relations. Electronic edition, Department of Sociology, University of Oxford, chapter 13. 2000.  Abdul-Rahman, A and Hailes, S, Supporting trust in virtual communities. Proceedings of the 33rd Annual Hawaii International Conference on System Sciences. 2000.  Warren, S and Brandeis, L. D. The Right to Privacy. Harvard Law Review 193 (1890) Vol. IV December 15, 1890, No. 5  Seda Gürses, F (2010), Multilateral Privacy Requirements Analysis in Online Social Networks. Available at: http://www.cosic.esat.kuleuven.be/publications/thesis-177.pdf [Accessed 23 November 2011]  Agre, P., The architecture of identity: embedding privacy in market institutions. Information, Communication and Society 1999. 2(1): p. 1-25.  Farmer, R and Glass, G (2010) Building web Reputation Systems O'Reilly Media, Inc. ISBN-13: 978- 0-596-15979-5  Douceur, J.R. (2002) The Sibyl Attack. Peer-to-Peer Systems LNCS, 2002, Volume 2429/2002, 251- 260, DOI: 10.1007/3-540-45748-8_24  Page, L et al, The PageRank Citation Ranking: Bringing Order to the web. Technical Report. Stanford InfoLab. 1999.  Gyöngyi, Z and Garcia-Molina, H (2005) Link spam alliances. In Proceeding of VLDB '05. 2005.  The Register (2011) Available at: http://www.theregister.co.uk/2011/10/11/websites_share_usernames/ [Accessed 23 November 2011]

text: Report on trust and reputation models 39

text: Evaluation and guidelines

text: Annex I Reputation models reviewed

text: The research team conducted a review of information provided on the websites listed below in September and October 2011 to ascertain which reputation models they were using: 1. eBay, www.ebay.com 2. Amazon, www.amazon.com 3. Facebook, www.facebook.com 4. Blogger, www.blogger.com 5. Lovefilm, www.lovefilm.com 6. CNET, www.cnet.co.uk 7. Expert exchange, www.expertexchange.org 8. Flickr, www.flickr.com 9. Slashdot.org, www.slashdot.org 10. Freshmeat.net, www.freshmeat.net 11. Thinkgeek.com, www.thinkgeek.com 12. Giffgaff, www.giffgaff.com 13. Picasa, www.picasa.google.com/ 14. Heise, www.heise.de 15. HospitalityClub, www.hospitalityclub.org 16. LinkedIn, www.linkedin.com 17. Netlog, www.netlog.be 18. Twitter, www.twitter.com 19. Wikipedia, www.wikipedia.org/ 20. Zynga, www.zynga.com 21. Google+, https://plus.google.com/ 22. Yahoo!, www.yahoo.com/ 23. laterooms.com, www.laterooms.com 24. booking.com, www.booking.com 25. Argos, www.argos.co.uk/ 26. TripAdvisor, www.tripadvisor.co.uk/ 27. Yelp, www.yelp.co.uk/ 28. epinions.com, www.epinions.com/ 29. imdb.com, www.imdb.com/ 30. AlloCine, www.allocine.fr/ 31. Pixmania, www.pixmania.co.uk/ 32. toptable.com, www.toptable.com 33. blockbuster.com, www.blockbuster.com 34. dabs.com, www.dabs.com 35. digg.com, www.digg.com 36. Expedia, www.expendia.co.uk

text: 40 Report on trust and reputation models

text: Evaluation and guidelines

text: Annex II Data accessible via reputation systems

text: The following websites were reviewed to understand the data that is accessible directly from the reputation system, and indirectly accessible using the reputation model as a vehicle to identify sensitive data held within other modules of the website, for example, profile information.

text: Website Data exposed by the directly from the reputa- Data exposed indirectly from the reputation

text: tion system web pages system

text: Amazon (On the product review page) (On the reviewer public profile)  Username  Total number of products reviewed  Date when the review was submitted  Other products reviewed  Location: country  Reviewer ranking  Label indicating the reviewer’s ranking (e.g.  Total number of reviews considered to be Top 1000) helpful  Label indicating whether the reviewer has accepted to uses his/her real name  Product review text  Star rating  Comments on the review from other users CNET (On the product review page) (On the reviewer public profile)  Username  Date when the user joined the website total  Date when the review was submitted number of products reviewed  Star rating  Other products reviewed  Review  Total number of comments  Pro and cons of the product as well as  List of latest submitted comments review summary eBay (On the product’s page) (On the seller profile)  Username  Username  Positive feedback score  Potentially user photo  Number of feedbacks  Date when the user joined the website  Icon that reflects the feedback score  Location (country)  Icon that indicates that the seller is a shop  Number of positive feedback owner  Other users reputation scores and a small  Link to seller shop (if available). area for comments on specific transactions  Icon that reflects the feedback score  Icon that indicates that the seller is a shop owner  List of customers/sellers feedbacks  List of currently listed items

text: Report on trust and reputation models 41

text: Evaluation and guidelines

text: tion system web pages system

text: Facebook This information depends on whether the person is in your network, and also what information can be shared with particular groups of friends. Information shared with linked friends can include status updates, photos/video uploaded or shared, web links, events, groups, comments, notes, or message sent. Flickr (On the photo page) (On the user profile)  Username  Date when the user joined the website  Real name (if provided by the user)  Location – hometown  Icon indicating if user has a ‘pro’ account  Occupation  User photo  Sex  Date when this photo was taken  Personal website  Location – where the photo was taken  Real name (depending on what the user  Photos taken by the users provides)  Other users’ views/comment  Link – link to 'collections', 'sets', 'galleries', 'tags', 'people', 'archives', and 'favourites'  Total number of views  Total number of comments  Total number of users favouring the picture  List of comments  List of people tagged in the photo  Keywords  Copyright licence  Privacy level (i.e. to whom the photo is visible) Geeknet (On the message thread) (On the user profile) (Slashdot)  Username  Username  Registration ID  List of comments  e-mail address  Achievements in terms of the number of news submitted and posted, stories moderated, comments provided, etc.  List of friends  Keywords used during news submissions  Link to personal web page giffgaff (On the community forum) (On the user profile)  Username  Current online status  Reputation title (newcomer, beginner,  Recent posts on the community forum steward, associate, consultant, etc.)  Top keywords used in forum messages  Avatar photo  Date of registration and last visit  Number of kudos (i.e. reputation) points  Total number of messages posted received from other users  Total number of tags used  Total of kudos received

text: 42 Report on trust and reputation models

text: Evaluation and guidelines

text: tion system web pages system

text:  List of recent kudos received  List of recent kudos given LinkedIn (When searching for a name on the website) (On the user profile) Depending on the security settings, full name, The information available depends on the position, location and field of employment are privacy settings for the different sections of the provided, including a free text area which personal profile and whether the person is in allows LinkedIn users to make recommenda- the network. tions regarding other users they have worked The profile can contain information on profeswithin the past. In addition, icons are used to sional experience, education, the number of indicate whether the user has a premium connections, and areas of expertise. account, whether the user is part of 24 OpenLink , and the degree of separation. The Hos- (Information available when reading a mes- (On the user profile) pitality sage from the forum) A lot of personal information is available on the Club  Username website, accessible to registered users. This  Avatar photo information is verified after registration by the website. It includes:  real name  address  occupation Twitter  Username  Full name  Badge – to indicate that the account has been verified  Status update  User avatar  Total number of ‘tweets’ posted  Total number of ‘tweets’ followed  Total number of followers  Total number of lists that include the user’s tweets

text: Service which allows users to send emails to any other OpenLink subscriber even if they are outside their network. This service is exclusively available to premium LinkedIn users.

text: Annex III Privacy and trust assessment

text: Outlined in the table below are extracts of a range of web service providers’ publicly available information regarding their privacy and trust statements, as well as terms and conditions of use of their services.

text: Company Data collected Data sharing Data processing and reten- Customer’s ability to ac- Rights given to company to tion (after account closure) cess and modify infor- use the content mation

text: www.amazon.com http://www.amazon.co.uk/gp/help/customer/display.html/ref=hp_left_ac?ie=UTF8&nodeId=492866

text: III–2 Report on trust and reputation models

text: Evaluation and guidelines

text: www.cnet.com - http://cbsiprivacy.custhelp.com/app/answers/detail/a_id/1268/session/L2F2LzEvdGltZS8xMzE5NzkzODE2L3NpZC83SDhEUkdIaw%3D%3D http://cbsitou.custhelp.com/app/answers/detail/a_id/1320/?tag=footer%3bfooter_nav

text: Report on trust and reputation models 3

text: Evaluation and guidelines

text: www.ebay.com -http://pages.ebay.co.uk/help/policies/privacy-policy.html?rt=nc - http://pages.ebay.co.uk/help/policies/user-agreement.html?rt=nc

text: www.facebook.com - http://www.facebook.com/about/privacy/#!/about/privacy/

text: III–4 Report on trust and reputation models

text: Evaluation and guidelines

text: www.flickr.com - http://info.yahoo.com/privacy/us/yahoo/

text: Report on trust and reputation models 5

text: Evaluation and guidelines

text: www.geeknet.com -http://geek.net/privacy-statement - http://geek.net/terms-of-use

text: III–6 Report on trust and reputation models

text: Evaluation and guidelines

text: www.giffgaff.com -http://giffgaff.com/boiler-plate/terms - http://giffgaff.com/boiler-plate/privacy

text: www.picasaweb.google.com - http://www.google.co.uk/intl/en/privacy/ - https://accounts.google.com/TOS?hl=en

text: Report on trust and reputation models 7

text: Evaluation and guidelines

text: www.hospitalityclub.org - http://rules.hospitalityclub.org/

text: III–8 Report on trust and reputation models

text: Evaluation and guidelines

text: www.lovefilm.com - http://www.lovefilm.com/info/terms_and_conditions.html#terms

text: www.netlog.com - http://en.netlog.com/go/about/legal/view=privacy - http://en.netlog.com/go/about/legal/view=general

text: Report on trust and reputation models 9

text: Evaluation and guidelines

text: www.twitter.com - http://twitter.com/privacy - http://twitter.com/tos

text: IV–1 Report on trust and reputation models

text: Evaluation and guidelines

text: Annex IV Survey questionnaire

text: Outlined below is an overview of the questionnaire sent to the websites operating reputation models. Reputation data and the operational of the reputation system  Can you please outline the business objective(s) and value of employing the reputational system?  How long have you been using a reputational system?  Please outline the data that is considered to be part of the reputational system?  In broad terms, can you please describe how is the reputational system is implemented?  What reputational models are used? If you use multiple reputational models how are these models combined to generate an overall reputational score?  How do your reputational systems achieve the anonymity and un-linkability of enquirers and users who input information into reputational information into your systems?  What mechanisms ensure the integrity and authorisation of ratings?  How is the fairness of the reputational ratings achieved?  How do you ensure the privacy of users?  How long is reputational data kept?  Can users modify and delete reputational information they have entered? Are there any restrictions on the modification?  How do you handle situations where the information entered is not accurate and could be libellous?  What processes do you have to identify suspicious ratings? Have you implemented any mechanism to detect these practices?  Have you implemented a solution to prevent (or limit) the crawling of your reputational data to stop external bodies collecting reputational information? Privacy statement and terms and conditions of use  Are there specific statements regarding the information users enter into the reputational system? If yes, can we have a copy of the documents?  Are these documents easily available to the public?  How are users informed of changes in these documents that could affect their privacy?  Do you share / sell reputational information to third parties?  How do you ensure the reputational system complies with various country legislations including the EU Data Protection Directive?

text: IV–2 Report on trust and reputation models

text: Evaluation and guidelines

text: P.O. Box 1309, 71001 Heraklion, Greece www.enisa.europa.eu