Compass: Realizing Privacy by Definition through Contextual Integrity

TL;DR

Compass is a revolutionary social network design that replaces manual privacy settings with Contextual Integrity (CI). Instead of managing "friends lists," users join pre-defined social contexts (like "Classroom" or "Family") where information flow is governed by formal logic. By compiling social norms into Binary Decision Diagrams (BDDs), Compass ensures that a post about a late-night party stays with friends and never leaks to a context involving employers or family.

The Problem: The Mismatch of Intent and Control

Modern social networks like Facebook and Google+ treat privacy as a "gatekeeping" problem—you either show a post to a group or you don't. This leads to three systemic failures:

1. Policy Mismatch: Users often don't understand what their settings actually do.
2. Context Leakage: Information intended for a specific group (e.g., a "Circle") can easily be reshared to the public without the original poster's consent.
3. Verification Gap: There is no mathematical guarantee that the system's code follows the user's social intent.

The authors argue that privacy isn't just about "secrecy"; it's about Contextual Integrity—the assurance that information flows only in ways that are appropriate to the social setting.

Methodology: Compiling Norms into Logic

Compass treats social settings as "Contexts." Each context has:

• Roles: (e.g., Elder, Student, Instructor)
• Attributes: (e.g., "contains PII," "is about grades")
• Norms: Formal rules that dictate who can see what.

The BDD Engine

The core innovation is the Norm Compiler. It takes human-readable social norms, converts them into propositional logic, and then compiles them into a Binary Decision Diagram (BDD).

When a user makes a post, the system traverses the BDD graph to check if the transmitter (the sender), receiver, and subject (the content) satisfy the context's norms. If the logic path evaluates to True, the information flows; otherwise, it is blocked.

Example: The Family Context

In a "Family" context (Figure 1 in the paper), norms can be highly nuanced:

• Norm 5: Information about a "genetic disease" from a parent is shared only with actors in the "elder" role.
• Norm 8: Posts about "parties" remain exclusively within the "generation-1" (children) role.

This prevents the "Context Collapse" often seen on Facebook, where a comment intended for a sibling is accidentally seen by a grandparent or a boss.

Experimental Results

The authors implemented Compass using C++, Flex/Bison, and the BuDDy BDD library. Their findings demonstrate that formalizing privacy doesn't have to be slow:

• Efficiency: The system handles 10,000 queries per second, meaning privacy checks add negligible latency to the user experience.
• Surprise Detection: To combat "Copy-Paste" attacks (where a user manually copies text to another context), Compass uses similarity matching to alert the original poster of a "surprise information flow."

Figure: Formal logic representing Classroom norms, where student-to-student gossip is hidden from the instructor.

Critical Insight & Evaluation

Compass identifies a fundamental truth: Users shouldn't be security administrators. By moving the burden of defining privacy rules from the average user to "Privacy Experts" who design context definitions, Compass provides a "Least Privilege" environment by default.

Limitations:

• The system relies on "Privacy Experts" to define public contexts correctly. If a context definition is flawed, everyone using it is at risk.
• While it detects "Copy-Paste" attacks via similarity matching, a determined adversary could paraphrase content to bypass automated detection.

Conclusion

Compass represents a shift from "Privacy as Control" to "Privacy as Appropriateness." By leveraging BDDs and formal logic, it proves that it is possible to build a social network that respects the complex boundaries of human life without requiring every user to have a degree in security configuration.