USC Data Science Program 529 (DSci 529): Security and Privacy in Informatics - Spring 2021

Lecture Friday - Noon to 3:20PM PM
Clifford Neuman

Current Events for February 12 2021

Government Use of Data

Lawmakers in Baltimore voted to end the aerial surveillance program. The planes were equipped with advanced color video systems and flew over the city for up to 11 hours a day. Police state they were used to catch criminals, but officials declared there was no proof for reducing crime. ACLU advocates the system was disproportionately targeting people of color. -Michelle Muldoon

The news shows that the government demands user data includes shopping searches and data from its Echo,

New legislation proposed in California aims to put limitations on law enforcement’s use of automated license plate readers (ALPRs). In many cases, police forces were collecting excessive amounts of information and sharing them with hundreds of other agencies, often without clear reasoning. -Gan Xin

Biological Data (including Biometrics)

The article shows how DNA is used to solve cases involving serious violent crimes and why people have raised concern over the balance between using DNA databases against crime and privacy issues. It also covers the future of forensic genetic genealogy.

It was recently announced that 23andMe is planning a merger with Virgin Acquisition Group, a special purpose acquisition corporation (SPAC), before the company begins trading on the New York Stock Exchange. This merger has raised some questions on the privacy of its customer’s data, as 23andMe has shifted its focus on the health and research market. These concerns include the sharing of customer data to outside companies, security of genetic data, and unauthorized use of the data by 23andMe. – Carol Varkey

Facial Recognition and ALPR

Technical companies could be invading people’s privacy by using facial images to train facial recognition algorithms. Some of the images in the dataset could be downloaded from social media and used without consent. Researchers have built an online tool called Exposing.AI which allows people to search for old photos of theirs from the online sources of images. – Jiemin Tang

Canadian commissioners determined Clearview's collection of more than three billion images, millions of which belong to Canadians, took place without the knowledge or consent of citizens, and they also found that the company did not use and disclose the collected data properly. What the commissioners also found is the current slate of privacy laws in Canada are not sufficient to regulate facial recognition. The provincial commissioners said the Clearview situation shows their respective laws need improvements. -Yueming, Gao

Canada's privacy commissioner, Daniel Thierrien, asked Clearview to delete its database in a news conference. Clearview has been collecting photos from social media networks and has built a database of more than three billion photos. This application has been used by US and Canadian law enforcement agencies for facial recognition. Though the Canadian government does not have legal authority to force photo removal, they have taken a clear stand against Clearview and the company's definition of public information. - Arzu Karaer

Clearview AI is a New York-based startup company featuring advanced facial recognition technology and has faced backlash in the past for scraping social media websites without permission. Clearview AI has recently collected images of Canadians without permission and is claiming that Canada's privacy laws do not apply to them, and that the images were publicly available and did not need consent. Canadian authorities are seeking ways to hold Clearview AI accountable. – Danielle Sim

Clearview AI is a new research tool used by law enforcement agencies to identify perpetrators and victims of crimes. Canada says it inflicts broad-based harm on all members of society. It was found that the company had collected highly sensitive biometric information without consent – Sharad Narayan Sharma

This news explains automated license plate readers (ALPRs), a technology used to collect large amounts of data and track the real-time movement of hundreds of millions of people without a warrant. In many cases, police collect excessive amounts of information and sharing them with hundreds of other agencies, often without clear reasoning. Some think it violates people’s privacy, and we do not need a surveillance state in this country.. – Yansong Wang

Video Surveilance

Amazon is installing cameras on their delivery vehicles to improve safety, but the drivers are concerning about it. These cameras record drivers and several angles on the vehicles every minute to detect and prevent any potential danger with AI technic. The drivers fell untrusted and cannot act naturally if the recording camera is nearby, and they are also concerning about privacy disclosure and discrimination.– Lingyu Ge

Security cameras are getting cheaper by the year, but that doesn't mean customers should be comfortable giving up their privacy. How the security companies protect customers aren't entirely transparent. Attacks could go completely unnoticed to an untrained eye and most people wouldn't know how to check. - Yo-Shuan Liu

Google

Recently, Google revealed pricacy details for the YouTube app on iOS system that the list of users' data were collected for third-party advertising. For instance, datas of identidiers like user ID, physical and email address, Name, Phone number. etc would be collected by Google for futher analysis. –Zixin Zheng

Google will soon begin experiments in Chrome on its new “privacy sandbox” to find a middle ground between blocking all potential surveillance and the needs of advertisers. The new approach manages to use AI and a “trusted server” to let advertisers target ads without the vast surveillance ecosystem. A major difficulty for this approach is to ensure that the ads industry is not circumventing true user privacy. – Haonan Xu

Google is trying to build up an anti-tracking turn and discussing the method to limit data collection and cross-app tracking in Android. Based on the increasing demand for consumer privacy, Google wants to develop a least one technology related to anti-tracking policies. However, it might be a dilemma for Google since the advertising brings a large amount of annual revenue to Google. – Yi Lin

Consumer demand has increased for privacy due to the amount that companies earn from ad revenue. Apple has made it part of their privacy strategy to require applications to give a summary of what data they collect, as well as opt-in requirements for tracking data. Google is looking to implement similar policies due to market pressure, but seeing as they have a much higher profit from targeted advertising, how strict their new policies will be is up for debate. - Brianna Heffernen

Google Chrome is making plans to remove all third party cookies, by 2022, in light of growing security and privacy concerns. As an alternative, Google is planning on sending targeted ads using its own AI system called Federated Learning of Cohorts (FLoC). The new system would use web browsing history, and other data points owned by Google to classify users based on their interests. However, critics of the change say that Google risks putting smaller ad firms, and websites that rely on ads out of business, all while reaping the benefits of a larger market of the web advertisement business. -- Philana Williams

The story explains Google has been testing a new API called FLoC to replace third-party cookies. FLoC will use first-party data, or data uploaded to a site directly from the user to target ads instead so that the privacy of users can be protected and privacy concerns will be decreased. - Yi Jin

Third-party cookies have been a longtime source of privacy concerns. A year ago, Google said that it would do away with them. Few days ago, Google says they have updated its work progress and will delete so-called third-party cookies from the Chrome browser which are used by a website's advertisers or partners and can be used to track a user's internet browsing habits. The new technology will eliminate “individual identifiers" and instead groups users into large demographic flocks.

Google hasn't updated a few of its apps for about two months now. Most of these updates were in terms of security. Google defended it by saying that the pop up warnings were due to a bug – Sharad Narayan Sharma

Google is exploring an alternative to Apple Inc.’s new anti-tracking feature, which means that the internet industry is slowly considering user privacy as part of its necessity to change. Regarding the Android operating system, Google is trying to balance the increasing demand of limited data collection of customers and the financial requirement of developers and advertisers. Google’s web alternative, known as the Privacy Sandbox, allows some ad targeting with less-specific data collection. – Lei Gao

Supply Chain Subversion

Today, if we want to protect data security and prevent supply-chain attacks, the key challenge is, how can we secure today's ecosystem that is made mostly of open-source and closed-source hybrids?
Given the cultural background and approach to open source that is pervasive today, developers need to start injecting infrastructure and convey all of this information to users and consumers so they can make educated decisions.
Besides, the lazy factor also causes this problem, using cryptography is inconvenient and not taken seriously. A cryptographic paper trail can provide verifiable information. --Tingyi Guo

Other

Businesses are improving identity techniques to keep balance between security and accessibility, so that users can access their services without burdensome steps, but hackings can be detected and prevented. Several digital footprints are involved into intelligence analysis to draw a more complete picture bring more confidence for identity proof. Risks, however, still exist, as fraudsters are innovating hack techniques, and more data are being collected and in risk of exposure. – Lingyu Ge

On the Consumer Electronics Show (CES) 2021, a message of rasing the bar on privacy of those tech companies' online services was brought up due to more customers were using their products for very important interactions. Many Tech companies claimed that they have a duty to help users feel safe online when using their products, and also including transparent privacy controls and data protection rules. In addition. those collections towards user's private datas for artificial intelligence and machine learning purposes were brought up to be concerned. –Zixin Zheng

A bug in Tik Tok's find a friend feature was found which allows an attacker to get details to all contacts in a victim's phone book Since user's sync their phone numbers with their account this allows attackers to bypass https messaging to sign in An attacker could use this to get private sensitive information and use it for malicious purposes such as phising.

We humans always care about the terrible outcomes of surveillance of the ubiquitous cameras, animals may have been watched more. Animals cannot choose what information to provide to other individuals. Data that the animals generated can be used to hurt them, for example, poachers in India attempted to hack into data from GPS collar of a tiger.- Chengyuan Zhou

The Pandemic and Privacy

One of the main ways that the government has tried to control the spread of COVID-19 is by using technology. Because of this, there has been a large increase in health and medical data recorded for citizens. To ensure that this data is not misused and that an individuals privacy is protected, Democrats have proposed the Public Health Emerging Privacy Act to ensure that companies don't misuse this data for marketing and that the data is prevent from landing in the wrong hands. – Addison Allred

The Better Business Bureau warns people do not share their covid-19 vaccine cards because they may give their personal info away. Another issue is that it provides convenience to scammers to create imitation cards to sell. The BBB suggests to share vaccine stickers instead of vaccine cards. – Bolong Pan

13% of Americans saying they won’t take the vaccine, which now emerged a black market regarding the COVID-19 vaccine card. According to DomainTools, scammers copy batch code from people who posted their real card on social media and started to sell them on Shopify-backed online stores. They have reached out to Shopify to monitor this kind of goods– Mingliao Xu

Privacy Regulation and other Government Regulation

While CCPA(California Consumer Privacy Act) allows consumers to "institute a civil action" for unauthorised access to their personal information, it does not provide a right of action. CPRA(California Privacy Rights Act), which is based on CCPA, uses the term “right to know” and “right to access” synonymously. A customer can submit request of specific information, which urges companies to give more detailed information than category-level, which was the case before. – Zihuan Ran

Virginia is about to become the second state in the country which adopts a comprehensive online data protection law for consumers. The CDPA applies to entities that "control or process" personal information of 100,000 or more Virginia residents in a calendar year or to entities that make 50 percent or more of their gross revenue from the sale of personal data if they hold information about at least 25,000 residents. – Rosy Zhou

Virginia will be the second state that passes its state-level data privacy bills after California passed its privacy law in 2018. Many other states also have their plans on data privacy laws pending, while experts believe that different state levels can be troublesome. Experts expect the Biden administration to be more proactive in pushing forward a federal-level data privacy law. – Haonan Xu

Virginia is set to be the next U.S. state with a comprehensive data privacy law, Consumer Data Protection Act (CDPA). The Senate Bill passed unanimously by the Virginia Senate on its first and second readings and is set for the final approval on Feb 5. The bill follows principles outlined in CCPA and GDPR such as threshold requirements, definition of personal data, individual rights for VA residents, and opt-out provisions. More interestingly, it includes a separate category called "sensitive data" which includes racial or ethnic origin, religious beliefs, biometric data, and geolocation that can only be processed with consent. If signed into law, it will go into effect the same day as CPRA (January 1, 2023). -- Jonathan De Leon

The Consumer Financial Protection Bureau is preparing to change its rules on financial data. In Section 1033 of the Dodd-Frank Act, the changes could have a major impact on how consumers can access and move their financial data between banks, fintechs and other companies — as well as which companies become consumers' go-to source for financial services. – Nana Andriana

Singapore has yet to see any significant impacts from the SolarWinds security breach on its critical information infrastructures or government systems. But It is looking into concerns related to upcoming privacy policy changes on WhatsApp, which is amongst messaging platforms the government uses to push information to the local population. WhatsApp in recent weeks has begun pushing notifications to users about an update to its privacy statement. –Yixiang Cao

WhatsApp published its new terms and conditions. And users are obliged to accept this if they wish to continue using WhatsApp after February 8 2021. In this new term, Facebook would be having access to millions of user information from WhatsApp. Some countries such as India have filed a petition against WhatsApp saying it is jeopardizing national security. GDPR applicable countries will receive a privacy policy because GDPR is one of the strictest in the world. Therefore, it is not too late to act, and introduce sound privacy legislation now to ensure that app providers have meaningful, clear terms and conditions that will allay doubts and suspicions in the minds of the user. —— Tingyi Guo

People are concerned more about their data privacy, especially during the pandemic. However, they are not protecting their personal information proactivity, some don't even read the terms and conditions. Many people, especially the younger generations, are willing to share their personal information for convenience. – Junbo Sheng

Italy ordered Tiktok to block access to users whose age cannot be confirmed. The temporary ban comes after the death of a young girl will last until 15 February. Italy also asked other social networks for clarification on children policy.– Jia-Yu Lee

Social Media and Other Apps and Privacy

Grindr, Hinge and Halo among many other apps and tech gadgets were tagged 'Privacy not Included' label by the report. The report looks through data collection policies and security posture of 24 dating apps including Tinder and Bumble in the V-Day edition. Dating apps, especially Grindr and POF, are deemed as privacy nightmare since they share biometrics and personal information collected with third parties. - Phuong Ngo

To communicate with others, some people turn to social media, while others use the social networks to take a break from their everyday lives or vent their frustrations. Social media is now playing a part in politics more and more. The channels are now used by politicians, advocacy parties, policymakers, and more as a way to communicate with voters and spread their message. -Supreet Randhawa

Many O.G. usernames on Instagram are stolen by hacking, extortion, blackmail and harassment and been sold. Instagram is coordinating with Twitter and Tiktok to ban this users who are involved in stealing.– Congrui Li

This news tells us about people exposing most of their information over social media making it easier for hackers to do social engineering. The readily available information on social media is being used to do phishing or online fraud. - Aziza Saulebay

Grindr has been fined by the Norwegian Data Protection Authority for sending location and tracking data to advertising companies without user consent. This not only violates European policy, but has dangerous implications for users in countries where homosexuality is illegal. The sanctions will hopefully emphasize the need for dating apps to acquire consent before sharing sensitive user information. - Brianna Heffernen

Clubhouse, a fast-growing, invite-only app on iPhone, seems to be taking users’ contact data further than the norm. The article explained how Clubhouse uses your personal data in a creative and a little creepy way. By uploading your phone’s address book, you will be able to see a list showing you how many “friends on Clubhouse” each of those people already has. – Yilin Zhang

Apple

• The privacy labels of some Apple apps were found to not accurately represent the information collected, tested by a number of media sources
• The main issue is due to apple's not checking each and every app submitted to the store for compliance
• It seems like Apple’s new privacy labels may rely strongly on “community policing” to be truly effective, if not properly handled
• Haipeng Yu

As discussed in lecture, security mechanisms are what realize security policy. In its most recent patch notes, Apple disclosed an 'arbitrary code execution' bug. This kind of flaw allows hackers to bypass security mechanisms and unfortunately it was seen 'actively exploited'. – Francisco Ventura

APPLE store requires application manufacturers to list labels to indicate how the application will use the collected data to process customer information, which will also cause confusion for other applications. How to Read Apple’s Privacy Labels become important. – Jinglun Chen

Apple decided to release a new feature called App Tracking Transparency(ATT) in "early spring". This will require apps to ask for users' permission in order to track them around the web. Facebook said Apple was pushing for "anti-personalized ads and will take the world back 10 or 20 years", they believe "ATT" will kill small businesses by preventing them from advertising to would-be customers. Also, Facebook targets a number of other features of IOS that are applied unfairly. A new set of "privacy nutrition labels" requires Facebook to list the types of data it collects while apps provided by Apple like iMessage do not display the same info. - Xihao Zhou

The new Apple IDFA terms will soon require apps that use ad tracking to notify iPhone and iPad users and obtain consent via a pop-up.That appears to be the tack that Facebook is taking. And Facebook started rolling out the messages to users of the Apple Facebook and Instagram apps on Monday – Hehan Xie

The story explains different views of executives of Apple's big tech buddies on Apple’s new privacy updates which mandate that apps ask for permission to track user behavior. Executives of Facebook and Snap were pretty much down with the privacy, while Twitter claimed the changes could have a modest impact and Google kept silent on it. - Yi Jin

Data Breaches

A hacker is selling over 500 million Facebook users’ phone numbers through a Telegram bot, which allows matching ID and phone numbers for 533 million Facebook users- Shengwang Zhang

Privacy of 1.6 million Washington state residents was recently compromised. In addition to personal data of people who have filed for unemployment claims, sensitive data held by the Washington state Department of Children, Youth and Families are leaked as well. – Kung-Hsiang (Steeve) Huang

A large-scale cyber attack on a PA law firm potentially exposed health information for ~36,000 patients at the University of Pittsburgh medical center. According to the article, hackers had access to patient sensitive data through employee email accounts. A law firm working with the UPMC confirmed that sensitive data such as names, DOB, SSN, financial account numbers, medical record numbers were all potentially leaked and/or accessed. As of now there is no confirmed evidence that the leaked information was misused and what the blast radius or impact of this breach is, although access to the patient data was indeed confirmed – Tanmay Ghai

Hackers stole the personal information of more than 200,000 patients from Nebraska Medicine using malware. Patient information includes medical records, insurance information, and even social security numbers. The good news is that the leaks haven't yet cost patients anything. – Junbo Sheng

A researcher claims to have hacked into internal systems of major companies including Apple and Microsoft using novel supply chain attack whhich included creating malicious node packages and uploading them to npm registry under unclaimed names and these packages collected information through their preinstallation scripts on th

Facebook

Facebook forces users to do a Facebook login when they use oculus headsets. Facebook will collect users' data via those headsets, and then use the data to target relevant ads to users. From my point of view, Facebook should show more respect to user privacy. - Jinyu Zhao

Facebook’s Oculus Quest 2 requires a Facebook login, and agreeing to Facebook’s terms of service for the device. Facebook confirmed that users' activity on an Oculus device, such as which apps users use, will be used to target “relevant content” to users, for example ads or Facebook events. -- Kaifan Lu