Privadome: Protecting Citizen Privacy from Delivery Drones

TL;DR

Privadome is a system designed to protect citizen privacy from delivery drones by enabling citizens to identify drones capturing their footage and verify privacy-preserving measures, scalable to city-wide deployments.

Contribution

This paper introduces Privadome, a novel privacy protection system integrating secure identification and audit mechanisms for drone-captured citizen footage.

Findings

System scales to hundreds of drones in city environments

Mobile data usage for identification is comparable to routine activities

Workflow consumes modest CPU and power resources

Abstract

As e-commerce companies begin to consider using delivery drones for customer fulfillment, there are growing concerns around citizen privacy. Drones are equipped with cameras, and the video feed from these cameras is often required as part of routine navigation, be it for semi autonomous or fully-autonomous drones. Footage of ground-based citizens may be captured in this video feed, thereby leading to privacy concerns. This paper presents Privadome, a system that implements the vision of a virtual privacy dome centered around the citizen. Privadome is designed to be integrated with city-scale regulatory authorities that oversee delivery drone operations and realizes this vision through two components, PD-MPC and PD-ROS. PD-MPC allows citizens equipped with a mobile device to identify drones that have captured their footage. It uses secure two-party computation to achieve this goal without compromising the privacy of the citizen's location. PD-ROS allows the citizen to communicate with such drones and obtain an audit trail showing how the drone uses their footage and determine if privacy-preserving steps are taken to sanitize the footage. An experimental evaluation of Privadome using our prototype implementations of PD-MPC and PD-ROS shows that the system scales to near-term city-scale delivery drone deployments (hundreds of drones). We show that with PD-MPC the mobile data usage on the citizen's mobile device is comparable to that of routine activities on the device, such as streaming videos. We also show that the workflow of PD-ROS consumes a modest amount of additional CPU resources and power on our experimental platform.