accompanying P3P policy for a real web site. The project will be done
in several parts, which will be assigned as part of homework
assignments throughout the semester.
The project will be done in small groups. Here are the group assignments:
8-533: jkase, snovick, stroucki
8-733: siyer, pkelley, gmariner, cragkhit, fshaikh
19-608 + 8-709: wdh, crjang, karora, lsaavedr
Part 1 - Due October 4 (as part of HW3)
(I) Review the privacy policies of at least three other universities. For each one:
- (b) List any content that is missing from the policy or described
inadequately. See Cranor p. 67 for a list of content to look for in a
is missing completely, too confusing, etc. (If nothing is missing, say
- (c) List any practices described by the policy that you consider
to be inadequate from a privacy perspective. Briefly explain why the
practice is inadequate and how you would recommend improving it. (If
you think the policy offers adequate privacy protections, say
- (d) Critique the presentation of the policy, including both the
readability and formatting.
(II) Familiarize yourself with the various CMU web sites. Make a list of
for CMU. You will have an opportunity to ask these questions in class
on October 11.
Part 2 - Due October 18 (as part of HW4)
Draft a privacy
policy for CMU. Format it as an HTML file suitable for posting
on the CMU web site (but include a note that this is a draft and not the
official policy). Submit the HTML file (or if you have
multiple files, submit a zip archive) via email.
Your policy will be graded on the following points:
bullet points on Cranor p. 67.
clear, concise, and correct English, and should be carefully
proofread. Points will be taken off for sloppy organization,
spelling, punctuation, and grammar.
headings that stand out, lists set off with bullet points, important
points or words emphasized, readable fonts, etc. The document should
the needs expressed by the organization representatives.
Part 3 - Due November 1 (as part of HW5)
Review the draft privacy policies created by the other teams. Based
on your review and the feedback provided in class on October 25, create
drafts. Once again, format your policy in HTML and submit the files
via email. Your policy will again be graded on accuracy, completeness,
readability, formatting, and usefulness, as described under Part 2, above.
Part 4 - Due November 20 (as part of HW6)
(I) Create a plan for P3P enabling CMU web sites. Do the following:
- (a) Describe your plan. Be sure to address at least the
- (i) how many P3P policies to create
- (ii) whether to use the well-known location or alternatives
- (iii) whether to use compact policies
- (iv) whether to combine policies in the policy reference file or
to have policies in separate files
- (b) Briefly state the rationale for each of your choices on the
four issues listed in part (a).
(II) Create the necessary P3P files as outlined in your plan. Make sure
you validate them!
Submit via email the following files:
- your P3P plan
- p3p files
- a set of instructions for posting the P3P files on the company's
Your plan, P3P files, and instructions will be graded on:
- your decisions in (I) should meet the
needs of the company, and your rationale should explain how your
decisions meet the company's needs
- the company should be able to fully P3P enable their
site by simply follow your instructions
- the P3P files you submit should accurately reflect the privacy
policy you wrote for Part 3 and should be bug-free