Building a Privacy Testbed

How do we assure that a software application preserves privacy properties – whether it is with regards to contact tracing in a pandemic, information flows from AI assistants or leakage from client-side scanning of end-to-end encryption services? Formal verification is one means but often not within the purview of most software developers and intractable for end-users and regulators. Privacy researchers also require easy and repeatable ways of generating data on privacy properties of applications and third party APIs. We present experiences of building a first of its kind privacy testbed as part of the UK’s National Research Centre on Privacy, Harm Reduction and Adversarial Influence Online. We will discuss our software-defined networking architecture, design challenges encountered, how these have been overcome and ongoing work on integrating the captured traffic with privacy frameworks. We will also discuss plans for the testbed to be widely accessible to the privacy research community.