Daniel Smullen

Privacy Preference Declaration (PPD) for Home Networks

2025-Present

PPD is a privacy engineering and standards-development effort for expressing user-defined privacy preferences across home networks. The protocol architecture is designed so connected devices can discover, interpret, and respond to local privacy policy, moving preference expression from isolated product settings toward interoperable, network-level governance for IoT and smart-home ecosystems.

The work, co-authored with Brian Scriber, CableLabs' Chief Information Security Officer, includes an IETF Internet-Draft architecture and a machine-readable taxonomy for describing device data handling practices, including data types, purposes, actions, sources, and destinations. It combines privacy-enhancing technology, data governance, requirements engineering, and technical standards work so preferences and declarations can be understood by people, software agents, and connected devices.

Defining Privacy Engineering as a Profession

2025

This qualitative research project examined how privacy engineering is practiced inside organizations, based on interviews with 27 privacy engineers and adjacent practitioners. The study identifies recurring responsibilities, professional challenges, core competencies, and collaboration patterns for a technical role that sits between software engineering, product management, legal, compliance, security, and data governance teams.

The work clarifies privacy engineering as a technical profession rather than only a compliance function. It gives organizations and educators a stronger basis for privacy engineering job design, hiring expectations, skills assessment, professional development, training programs, and cross-functional privacy-by-design practice.

Alexa+ Feedback Processing Pipeline

2023-2024

At Amazon Lab126's Alexa Sensitive Content Intelligence team, I built an LLM-based feedback-processing pipeline for Alexa+ that used off-the-shelf large language models to analyze chat transcripts containing customer feedback. The system framed transcript analysis as a reading-comprehension and information-extraction problem, using prompt engineering and structured extraction to identify actionable trust, safety, and product-quality signals from natural conversational context.

This approach eliminated the need to develop custom BERT-style models and supporting training datasets for the feedback pipeline. It reduced engineering cost, development time, model maintenance, and data-labeling burden while preserving a scalable path for large-scale natural language processing, customer feedback analysis, and applied machine learning in production product workflows.

Privacy Attestation PII Prediction and Explanation

2022-2023

In Amazon Devices & Services Trust and Privacy, I built privacy engineering tooling to process data type classifications and cross-reference them with legal decisions on privacy-related attestations. The goal was to predict whether systems and attestations were likely to involve personally identifiable information by modeling relationships among product data types, privacy review outcomes, compliance reasoning, and documented legal decisions.

I developed an interpretable machine learning model using decision trees so the system could provide both predictions and explanations. The work connected privacy-by-design, compliance automation, data classification, PII detection, model explainability, and risk analysis, translating legal and privacy decision patterns into actionable engineering signals for product teams.

Generative AI Data Use Policy

2023

In Amazon Devices & Services Trust and Privacy, I served as penholder for an internal generative AI data use policy. The work helped translate privacy, legal, data governance, customer trust, and product-risk requirements into practical guidance for teams evaluating or building AI-enabled product features.

This policy work connected generative AI governance, privacy-by-design, data classification, responsible AI review, internal controls, and risk communication. It involved helping turn ambiguous legal and privacy requirements into implementable engineering language that product, legal, privacy, and leadership stakeholders could apply consistently.

Mobile App Privacy System (MAPS)

2019

MAPS was a large-scale mobile app privacy compliance analysis system developed with Peter Story, Sebastian Zimmeck, and collaborators at Carnegie Mellon and Fordham. In the original "Scaling Privacy Compliance Analysis to a Million Apps" study, we were the first to crawl and analyze the entire Google Play Store ecosystem, evaluating more than one million Android apps by comparing code-level privacy practices against privacy policy disclosures.

The project combined Android ecosystem crawling, privacy policy analysis, mobile app compliance automation, software measurement, and large-scale data processing to show that privacy review could scale beyond manual audits. The resulting tool and findings drew interest from public enforcement agencies, including the Federal Trade Commission and the California and New York attorneys general, who used the system to investigate app privacy practices.

IoT Resource Registry

2017

The IoT Resource Registry was part of the larger Personalized Privacy Assistant and IoT Privacy Infrastructure work at Carnegie Mellon. It gave IoT service providers a structured way to describe nearby services, devices, resources, data practices, and user choices so privacy assistants could surface contextual notice and choice in connected environments.

The project connected IoT privacy infrastructure, usable privacy and security, service discovery, metadata modeling, user consent, and privacy preference management. It helped translate machine-readable descriptions of IoT resources into user-facing privacy and security controls for smart spaces, sensors, mobile devices, and context-aware systems.

Supervisor: Dr. Norman Sadeh, Carnegie Mellon University

• IoT Privacy Infrastructure

Eddy: A Privacy Requirements Specification Language

2016

Eddy is a privacy requirements specification language that privacy analysts can use to express rules over the collection, use, transfer, and retention of personal and technical information. The language uses a SQL-like syntax to state whether an action is permitted or prohibited and to restrict those statements by data subject, purpose, actor, and system context.

Eddy specifications compile into Description Logic so analysts can automatically detect conflicting requirements, reason over data flows, and trace privacy obligations within and across software architecture specifications. The project connects privacy requirements engineering, formal methods, policy analysis, data retention, compliance reasoning, and privacy-by-design for complex systems.

Supervisor: Dr. Travis Breaux, Carnegie Mellon University

• Project Site
• View on GitHub

Non-Local Interferometric SAR Parameter Estimator

2015

Synthetic aperture radar (SAR) and interferometric SAR (InSAR) images suffer from granular speckle noise that must be reduced before scientific analysis. At NASA JPL, we implemented enhancements to Deledalle's NL-InSAR denoising filter to improve the algorithm's speed-quality tradeoff while preserving interferometric phase, coherence, and image structure.

The implementation used high-performance computing, cross-platform Python/C11, OpenMP multithreading, MPI multiprocessing, and workstation-to-supercluster portability for full-sized UAVSAR imagery. The pipeline reduced processing time from weeks to minutes and supported production radar science workflows in remote sensing and scientific image processing.

Supervisor: Dr. Razi Ahmed, Jet Propulsion Laboratory

NL-InSAR with Gaussian-Laplacian Pyramids

2015

This project extended NL-InSAR filtering for interferometric Synthetic Aperture Radar by using Gaussian-Laplacian image pyramids to reduce the "canvas effect" introduced by some non-local filtering approaches. The method preserved fine image structures while improving estimation of reflectivity, interferometric phase, and coherence.

The work combined remote sensing, numerical image processing, algorithm design, scientific computing, and high-performance implementation for UAVSAR data. It complemented the broader JPL InSAR pipeline by improving denoising quality and exploring scalable approaches for resolution-preserving radar image analysis.

Supervisor: Dr. Razi Ahmed, Jet Propulsion Laboratory

Incident Recognition and Intelligence System (IRIS)

2014

IRIS is an integrated intelligence management system for highway incident recognition, combining a web frontend for road conditions and incident video review with a computer vision backend for autonomous, scalable highway surveillance. The system supported incident detection, video capture, statistical aggregation, and operational situational awareness for transportation monitoring.

The project combined computer vision, full-stack software engineering, data visualization, traffic systems, and real-time monitoring in a capstone-scale engineering prototype. IRIS won first place in the UOIT (now Ontario Tech University) Capstone ECSE Engineering Design Challenge 2014.

Supervisor: Dr. Shahryar Rahnamayan, Associate Professor, UOIT (now Ontario Tech University)

Special thanks to Dr. Baher Abdulhai and Asmus Georgi at University of Toronto, and Steve Spadafora at MTO for their funding and collaboration.

• Poster
• Presentation

Automated Marking System (AMS)

2014

AMS was a Ruby on Rails web application for creating, distributing, and automatically grading introductory programming assignments at UOIT (now Ontario Tech University). The system compiled, executed, and evaluated student submissions in a protected environment while providing instructors and students with immediate results, code quality metrics, and cheating-detection signals.

The project combined web application development, automated testing, static analysis, dynamic analysis, sandboxed execution, educational technology, and software quality automation. It was designed to improve feedback speed, grading consistency, and course administration for programming education.

Supervisor: Dr. Kamran Sartipi, Associate Professor, UOIT (now Ontario Tech University)

• Presentation

Policy IDE, TOSServ, Finger2IPv6

2013

Policy IDE, TOSServ, and Finger2IPv6 were TinyOS-based wireless sensor network tools developed under an NSERC Undergraduate Research Award. The work supported policy-based programming for embedded systems, including an integrated development environment for debugging policy-driven applications, server-side support for TinyOS workflows, and IPv6-enabled remote development through Finger2IPv6.

The projects combined embedded systems, wireless sensor networks, policy programming, distributed systems, IPv6 networking, developer tooling, and open-source software engineering. They were published and presented at EUSPN-2013, posted through the Stanford TinyOS community, and released in GitHub branches.

Supervisor: Dr. Ramiro Liscano, Associate Dean, UOIT (now Ontario Tech University)

• GitHub: tinyos-main
• GitHub: Finger2IPv6 branch

Military Logistics Management System (MLMS)

2013

MLMS was a military logistics management and large-scale visualization system built for the UOIT (now Ontario Tech University) Data Management Systems course. The ASP.NET web application delivered supply, personnel, and operational information through a secure logistics dashboard and a Logistics Management View for rapid status assessment.

The system combined database design, web application development, role-aware access, logistics data modeling, geospatial-style visualization, and operational reporting. It also provided real-time battlespace updates through an Order of Battle imagery workflow for command-and-control style situational awareness.

Supervisor: Dr. Eyhab Al-Masri, Senior Lecturer, UOIT (now Ontario Tech University)

• Presentation
• Report

sneakyFS File System Design and Implementation

2012

sneakyFS is a UNIX-style file system implemented in C on a simulated hard disk. It uses hybrid indexed and linked allocation to manage disk space efficiently while supporting large disks, deep directory trees, and large files.

The project incorporated transparent encryption, journaling, universal unique identifiers, low-level memory management, data structures, and object-oriented design patterns in C. It won "Best Project" distinction in the UOIT (now Ontario Tech University) Operating Systems course and demonstrates systems programming, file-system architecture, and secure storage design.

Supervisor: Dr. Kamran Sartipi, Associate Professor, UOIT (now Ontario Tech University)

• External Link
• Presentation
• Design Brief

Datacenter Utilization Research Study

2012

This research study assessed mission-critical datacenter utilization, availability, and performance for SNC-Lavalin Global Information Technologies risk management and infrastructure remediation. The work quantified business value, workload, and operational dependency for critical server assets at the West Mall campus datacenter.

The study combined infrastructure risk assessment, availability analysis, performance measurement, disaster recovery planning, asset utilization modeling, and executive reporting. The findings informed a practical remediation plan for improving resilience, capacity planning, and infrastructure investment decisions.

Supervisor: M. Ross, Senior Vice-President, SNC-Lavalin Global Information Technologies

Laboratory Information Management System (LIMS)

2009

This project supported collaborative development of ISO 9000-certified laboratory information management software for production geotechnical and materials-testing workflows. The system managed sample intake, logging, categorization, process queues, laboratory status tracking, and reporting for active laboratory operations.

The work combined database-backed workflow automation, quality management, production software support, laboratory information management, and regulated-process documentation. It bridged engineering operations, laboratory QA/QC, and software maintenance during live infrastructure project delivery.

Supervisor: Dr. John Emery, P.Eng., President, JEGEL

Trans-Canada Highway Rehabilitation Geoinformatics

2009

This geoinformatics project supported large-scale asphalt rehabilitation planning on the Trans-Canada Highway across more than 300 km around Banff. The work produced technical drawings and location data for probe holes, highway layout, pavement conditions, and remediation planning.

The project combined civil engineering support, geospatial data management, CAD-style technical drafting, field-data coordination, pavement rehabilitation, and infrastructure project documentation. It helped translate subsurface sampling and highway-condition data into actionable plans for construction and remediation teams.

Supervisor: Alain Duclos, P.Eng., Senior Engineer, JEGEL