Privacy Risks Research Articles

Don’t Be a Victim During a Pandemic! Analysing Security and Privacy Threats in Twitter During COVID-19

There has been a huge spike in the usage of social media platforms during the COVID-19 lockdowns. These lockdown periods have resulted in a set of new cybercrimes, thereby allowing attackers to victimise social media users with a range of threats. This paper performs a large-scale study to investigate the impact of a pandemic and the lockdown periods on the security and privacy of social media users. We analyse 10.6 Million COVID-related tweets from 533 days of data crawling and investigate users’ security and privacy behaviour in three different periods (i.e., before, during, and after the lockdown). Our study shows that users unintentionally share more personal identifiable information when writing about the pandemic situation (e.g., sharing nearby coronavirus testing locations) in their tweets. The privacy risk reaches 100% if a user posts three or more sensitive tweets about the pandemic. We investigate the number of suspicious domains shared on social media during different phases of the pandemic. Our analysis reveals an increase in the number of suspicious domains during the lockdown compared to other lockdown phases. We observe that IT, Search Engines, and Businesses are the top three categories that contain suspicious domains. Our analysis reveals that adversaries’ strategies to instigate malicious activities change with the country’s pandemic situation.

Privacy Threat MOdeling Language

Online Social Networks (OSNs) are becoming pervasive in today’s world. Millions of people worldwide are involved in different forms of online networking. However, this ease of use of OSNs comes with a cost in terms of privacy. Users of OSNs become victims of identity theft, cyberstalking, and information leakage, which are real threats to privacy. Consequently, new solutions need to be developed for addressing the threat scenarios to which a user is potentially exposed. In this sense, this paper presents PTMOL (Privacy Threat MOdeling Language) as an approach for modeling privacy threats in an OSN domain. The proposed language is related to the attempt to mitigate privacy threats at the design level, thus promoting concern about threats in the stages preceding the development of OSNs. Two studies were conducted to evaluate the use of PTMOL at the design stages, which provided insights into the correctness, completeness, ease of use, usefulness, user satisfaction, and feasibility of the proposal. The results indicated that PTMOL can be incorporated into software development during the design phase. Via the language, we expect to support designers in making more pre-emptive decisions about user privacy risk, and help them to introduce privacy early in the development cycle of OSNs.

The AILA Methodology for Automated and Intelligent Likelihood Assignment in Risk Assessment

This article recognises the widespread application of risk assessment in ICT and aims at reducing the influence of human subjectivity and distraction by means of a methodology for the Automated and Intelligent Likelihood Assignment (AILA). The AILA Methodology, with its various components, applies when risk assessment proceeds exclusively upon information stated in a policy coming as a text document. This scenario is extremely common through small to medium sized institutions. Among the main contributions of this article lies the AILA Entity Extractor, which facilitates the risk assessor in the identification of entities, then of assets, from a given policy. Then, the AILA Classifier automates the assignment of likelihood values to given threats for assets. Moreover, the synergy of AILA with an existing tool for risk assessment demonstrates how to achieve more objective likelihood assignments. AILA is general in support of any risk assessment and, for the sake of demonstration, is applied to assess the privacy risk induced over physical persons by three real-world manufacturers from the automotive domain, namely Toyota, Mercedes and Tesla. AILA is also validated against a risk assessment methodology by ENISA, thereby confirming effectiveness and efficiency of the new methodology (which is dramatically more automated than ENISA’s). AILA combines and consolidates together several techniques in an unprecedented fashion, including Natural Language Processing by summarisation and entity recognition, dataset labelling by appeal to the ToS;DR service, and fully-supervised Machine Learning and regression analysis. Finally, to contribute to open knowledge, the general, executable components of AILA, the AILA Entity Extractor and the AILA Classifier are released open source along with the the privacy-specific components, the AILA Privacy Dataset and the AILA Privacy Model.

Visual Analytics Platform for Centralized Covid-19 Digital Contact Tracing.

The Covid-19 pandemic and its dramatic worldwide impact have required global multidisciplinary actions to mitigate its effects. Mobile phone activity-based digital contact tracing (DCT) via Bluetooth Low Energy (BLE) technology has been considered a powerful pandemic monitoring tool, yet it sparked a controversial debate about privacy risks for people. In order to explore the potential benefits of a DCT system in the context of Occupational Risk Prevention, this paper presents the potential of Visual Analytics methods to summarize and extract relevant information from complex DCT data collected during a long-term experiment at our research centre. Visual tools were combined with quantitative metrics to provide insights into contact patterns among volunteers. Results showed that crucial actors such as participants acting as bridges between groups could be easily identified - ultimately allowing for making more informed management decisions aimed at containing the potential spread of a disease.

Differentially Private Speaker Anonymization

Sharing real-world speech utterances is key to the training and deployment of voice-based services. However, it also raises privacy risks as speech contains a wealth of personal data. Speaker anonymization aims to remove speaker information from a speech utterance while leaving its linguistic and prosodic attributes intact. State-of-the-art techniques operate by disentangling the speaker information (represented via a speaker embedding) from these attributes and re-synthesizing speech based on the speaker embedding of another speaker. Prior research in the privacy community has shown that anonymization often provides brittle privacy protection, even less so any provable guarantee. In this work, we show that disentanglement is indeed not perfect: linguistic and prosodic attributes still contain speaker information. We remove speaker information from these attributes by introducing differentially private feature extractors based on an autoencoder and an automatic speech recognizer, respectively, trained using noise layers. We plug these extractors in the state-of-the-art anonymization pipeline and generate, for the first time, private speech utterances with a provable upper bound on the speaker information they contain. We evaluate empirically the privacy and utility resulting from our differentially private speaker anonymization approach on the LibriSpeech data set. Experimental results show that the generated utterances retain very high utility for automatic speech recognition training and inference, while being much better protected against strong adversaries who leverage the full knowledge of the anonymization process to try to infer the speaker identity.

A Survey of Privacy Risks and Mitigation Strategies in the Artificial Intelligence Life Cycle

A Survey of Privacy Risks and Mitigation Strategies in the Artificial Intelligence Life Cycle

"Revoked just now!" Users' Behaviors Toward Fitness-Data Sharing with Third-Party Applications

The number of users of wearable activity trackers (WATs) has rapidly increased over the last decade. Although these devices enable their users to monitor their activities and health, they also raise new security and privacy concerns, given the sensitive data (e.g., steps, heart rate) they collect and the information that can be inferred from this data (e.g., diseases). In addition to sharing with the service providers (e.g., Fitbit), WAT users can share their fitness data with third-party applications (TPAs) and individuals. Understanding how and with whom users share their fitness data and what kind of approaches they take to preserve their privacy are key to assessing the underlying privacy risks and to further designing appropriate privacy-enhancing techniques. In this work, we perform, through a large-scale survey of N=628 WAT users, the first quantitative and qualitative analysis of users' awareness, understanding, attitudes, and behaviors toward fitness-data sharing with TPAs and individuals. By asking these users to draw their thoughts, we explore, in particular, users' practices and actual behaviors toward fitness-data sharing and their mental models. Our empirical results show that about half of WAT users underestimate the number of TPAs to which they have granted access to their data, and 63% share data with at least one TPA that they do not actively use (anymore). Furthermore, 29% of the users do not revoke TPA access to their data because they forget they gave access to it in the first place, and 8% were not even aware they could revoke access to their data. Finally, their mental models, as well as some of their answers, demonstrate substantial gaps in their understanding of the data-sharing process. Importantly, 67% of the respondents think that TPAs cannot access the fitness data that was collected before they granted access to it, whereas TPAs actually can do this.

PrivKVM*: Revisiting Key-Value Statistics Estimation With Local Differential Privacy

A key factor in big data analytics and artificial intelligence is the collection of user data from a large population. However, the collection of user data comes at the price of privacy risks, not only for users but also for businesses who are vulnerable to internal and external data breaches. To address privacy issues, local differential privacy (LDP) has been proposed to enable an untrusted collector to obtain accurate statistical estimation on sensitive user data (e.g., location, health, and financial data) without actually accessing the true records. As key-value data is an extremely popular NoSQL data model, there are a few works in the literature that study LDP-based statistical estimation on key-value data. However, these works have some major limitations, including supporting small key space only, fixed key collection range, difficulty in choosing an appropriate padding length, and high communication cost. In this article, we propose a two-phase mechanism <inline-formula><tex-math notation="LaTeX">$PrivKVM^*$</tex-math></inline-formula> as an optimized and highly-complete solution to LDP-based key-value data collection and statistics estimation. We verify its correctness and effectiveness through rigorous theoretical analysis and extensive experimental results.

The Effect of Deep Learning Methods on Deepfake Audio Detection for Digital Investigation

Voice cloning methods have been used in a range of ways, from customized speech interfaces for marketing to video games. Current voice cloning systems are smart enough to learn speech characteristics from a few samples and produce perceptually unrecognizable speech. These systems pose new protection and privacy risks to voice-driven interfaces. Fake audio has been used for malicious purposes and is difficult to classify what is real and fake during a digital forensic investigation. This paper reviews the issue of deep-fake audio classification and evaluates the current methods of deep-fake audio detection for forensic investigation. Audio file features were extracted and visually presented using MFCC, Mel-spectrum, Chromagram, and spectrogram representations to further study the differences. Harnessing the different deep learning techniques from existing literature were compared using five iterative tests to determine the mean accuracy and the effects thereof. The results showed a Custom Architecture gave better results for the Chromagram, Spectrogram, and Me-Spectrum images and the VGG-16 architecture gave the best results for the MFCC image feature. This paper contributes to further assisting forensic investigators in differentiating between synthetic and real voices.

Social media advertising for clinical studies: Ethical and data protection implications of online targeting

Social media advertising has revolutionised the advertising world by providing data-driven targeting methods. One area where social media advertising is just gaining a foothold is in the recruitment of clinical study participants. Here, as everywhere, social media advertising promises more yield per money spent because the technology can better reach highly specialised groups. In this article, we point out severe societal risks posed by advertising for clinical studies on social media. We show that social media advertising for clinical studies in many cases violates the privacy of individual users (R1), creates collective privacy risks by helping platform companies train predictive models of medical information that can be applied to all their users (R2), exploits the weaknesses of existing guidelines in (biomedical) research ethics (R3) and is detrimental to the quality of (biomedical) research (R4). We argue that the well-intentioned promises, which are often associated with the use of social media advertising for clinical studies, are untenable from a balanced point of view. Consequently, we call for updates of research ethics guidelines and better regulation of Big Data and inferential analytics. We conclude that social media advertising – especially with vulnerable patient populations – is not suitable as a recruitment tool for clinical studies as long as the processing of (even anonymised) social media usage data and the training of predictive models by data analytics and artificial intelligence companies is not sufficiently regulated.

Automated payroll system

An automated payroll system is a computerized system designed to process employee compensation and related information. It includes various features such as employee information management, time tracking, tax management, and reporting. The system offers several benefits, including increased efficiency, accuracy, and compliance, while also improving employee satisfaction. However, the implementation of such a system can also present challenges related to cost, technical expertise, and employee resistance to change. Additionally, security and privacy risks associated with automated payroll systems need to be addressed through advanced security measures such as encryption and access controls. Overall, the literature suggests that the benefits of implementing an automated payroll system outweigh the challenges, making it an important tool for organizations of all sizes to improve their payroll processing.

Towards an Integrated Approach for Preserving Data Utility, Privacy and Fairness

Data reusability has become a distinct characteristic of scientific, commercial, and administrative practices nowadays. However, an unlimited and careless reuse of data may lead to privacy breaches and unfair impacts on individuals and vulnerable groups. Data content adaption is a key aspect of preserving data privacy and fairness. Often, such content adaption affects data utility adversely. Further, the interaction between privacy protection and fairness protection can be subject to making trade-offs because mitigating privacy risks may adversely affect detecting unfairness and vice versa. Therefore, there is a need for research on understanding the interactions between data utility, privacy and fairness. To this end, in this contribution, we use concepts from causal reasoning and argue for adopting an integrated view on data content adaption for data driven decision support systems. This asks for considering the operation context wholistically. By means of two cases, we illustrate that, in some situations, local data content adaption may lead to low data quality and utility. An integrated wholistic approach, however, may result in reuse of the original data (i.e., without content adaption, thus in higher data utilization) without adversely affecting privacy and fairness. We discuss some implications of this approach and sketch a few directions for future research.

Where do migrants and natives belong in a community: a Twitter case study and privacy risk analysis

Today, many users are actively using Twitter to express their opinions and to share information. Thanks to the availability of the data, researchers have studied behaviours and social networks of these users. International migration studies have also benefited from this social media platform to improve migration statistics. Although diverse types of social networks have been studied so far on Twitter, social networks of migrants and natives have not been studied before. This paper aims to fill this gap by studying characteristics and behaviours of migrants and natives on Twitter. To do so, we perform a general assessment of features including profiles and tweets, and an extensive network analysis on the network. We find that migrants have more followers than friends. They have also tweeted more despite that both of the groups have similar account ages. More interestingly, the assortativity scores showed that users tend to connect based on nationality more than country of residence, and this is more the case for migrants than natives. Furthermore, both natives and migrants tend to connect mostly with natives. The homophilic behaviours of users are also well reflected in the communities that we detected. Our additional privacy risk analysis showed that Twitter data can be safely used without exposing sensitive information of the users, and minimise risk of re-identification, while respecting GDPR.

How to improve travel-app use continuance: The moderating role of culture

The use of travel apps profoundly influences the behavior of tourists throughout the entire tourism experience. The aim of the present study is therefore to contribute to travel-app use continuance. An extended ‘continued use’ model based on the UTAUT2 framework is proposed, including important tourist behavior variables: satisfaction, privacy risk, personalization, e-WOM, relative advantage, aesthetics, social interaction, and information quality. The importance of culture for technology acceptance and use is also verified, as is culture’s influence on tourist behavior, the latter being reflected in the moderating variables of the proposed model: the cultural dimensions of uncertainty avoidance and individualism/collectivism.

Privacy Risk Awareness and Intent to Disclose Personal Information of Users Using Two Social Networks: Facebook and Instagram

The research focuses on the perception and awareness of privacy risks to disclose users' personal information on two social networking platforms, Facebook and Instagram. The data was collected from 428 Facebook and Instagram user from 15 to 29 years old by an online questionnaire. The Structural Equation Model (SEM) was used to analyze the relationships in the research model supported by SPSS 20.0 and AMOS 24.0 software. Results indicate that if user trust or confidence is high in social networking sites such as Facebook and Instagram, the perception of user privacy risk is low. This result is beneficial for the researcher to have a fresh look at consumer behavior. For businesses, it takes a long time to develop a product that will gain the trust of customers. They must ensure that their products are as risk-free as possible in order to maintain consumer trust, because when consumers choose to trust, they always expect the product's risk to be as low as possible or zero. From the research results, it is possible to make suggestions for solutions to overcome the perceived problem of users in disclosing personal information on social networks in general. And it clearly shows that the factors that motivate online social media users to disclose personal information are extremely different.

Privacy in targeted advertising on mobile devices: a survey

Targeted advertising has transformed the marketing landscape for a wide variety of businesses, by creating new opportunities for advertisers to reach prospective customers by delivering personalised ads, using an infrastructure of a number of intermediary entities and technologies. The advertising and analytics companies collect, aggregate, process, and trade a vast amount of users’ personal data, which has prompted serious privacy concerns among both individuals and organisations. This article presents a comprehensive survey of the privacy risks and proposed solutions for targeted advertising in a mobile environment. We outline details of the information flow between the advertising platform and ad/analytics networks, the profiling process, the measurement analysis of targeted advertising based on user’s interests and profiling context, and the ads delivery process, for both in-app and in-browser targeted ads; we also include an overview of data sharing and tracking technologies. We discuss challenges in preserving the mobile user’s privacy that include threats related to private information extraction and exchange among various advertising entities, privacy threats from third-party tracking, re-identification of private information and associated privacy risks. Subsequently, we present various techniques for preserving user privacy and a comprehensive analysis of the proposals based on such techniques; we compare the proposals based on the underlying architectures, privacy mechanisms, and deployment scenarios. Finally, we discuss the potential research challenges and open research issues.

Privacy-Preserving Task Offloading Strategies in MEC

In mobile edge computing (MEC), mobile devices can choose to offload their tasks to edge servers for execution, thereby effectively reducing the completion time of tasks and energy consumption of mobile devices. However, most of the data transfer brought by offloading relies on wireless communication technology, making the private information of mobile devices vulnerable to eavesdropping and monitoring. Privacy leakage, especially the location and association privacies, can pose a significant risk to users of mobile devices. Therefore, protecting the privacy of mobile devices during task offloading is important and cannot be ignored. This paper considers both location privacy and association privacy of mobile devices during task offloading in MEC and targets to reduce the leakage of location and association privacy while minimizing the average completion time of tasks. To achieve these goals, we design a privacy-preserving task offloading scheme to protect location privacy and association privacy. The scheme is mainly divided into two parts. First, we adopt a proxy forwarding mechanism to protect the location privacy of mobile devices from being leaked. Second, we select the proxy server and edge server for each task that needs to be offloaded. In the proxy server selection policy, we make a choice based on the location information of proxy servers, to reduce the leakage risk of location privacy. In the edge server selection strategy, we consider the privacy conflict between tasks, the computing ability, and location of edge servers, to reduce the leakage risk of association privacy plus the average completion time of tasks as much as possible. Simulated experimental results demonstrate that our scheme is effective in protecting the location privacy and association privacy of mobile devices and reducing the average completion time of tasks compared with the-state-of-art techniques.

Modelling barriers to wearable technologies in Indian context: validating the moderating role of technology literacy

PurposeThe purpose of this study is to examine diverse risks and barriers that influence customers' attitude leading to their actual use of wearable devices in India. This study used technological literacy as a moderating variable to understand the relationship between barriers and attitudes toward adoption of wearable device.Design/methodology/approachA survey questionnaire was developed through focused group discussions with field experts. Data were collected through online as well as offline modes. A Google form was created and its weblink was shared with the respondents using wearable devices. Both online as well as offline modes were used for data collection. Several reminders through telephone and revisits were undertaken to approach the respondents.FindingsThe results of this study indicated that psychological risk and financial risk emerged strongest barriers of wearable technologies. This was followed by infrastructure barriers and performance risk. The strength of the relationship between technological anxiety and attitudes was lower but still significant. Surprisingly, privacy risk and social risk were not statistically significant. This study also validated the impact of technological literacy as a moderator between risks and attitudes.Originality/valueThis study contributes to the research by validating numerous risks and barriers in the adoption of wearable devices. This study not only offers a novel perspective on researching diverse barriers but also elucidates the moderating role of technological literacy which has not been covered in extant literature.

Privacy-Enhancing Technology and Everyday Augmented Reality

Fundamental to Augmented Reality (AR) headsets is their capacity to visually and aurally sense the world around them, necessary to drive the positional tracking that makes rendering 3D spatial content possible. This requisite sensing also opens the door for more advanced AR-driven activities, such as augmented perception, volumetric capture and biometric identification - activities with the potential to expose bystanders to significant privacy risks. Existing Privacy-Enhancing Technologies (PETs) often safeguard against these risks at a low level e.g., instituting camera access controls. However, we argue that such PETs are incompatible with the need for always-on sensing given AR headsets' intended everyday use. Through an online survey (N=102), we examine bystanders' awareness of, and concerns regarding, potentially privacy infringing AR activities; the extent to which bystanders' consent should be sought; and the level of granularity of information necessary to provide awareness of AR activities to bystanders. Our findings suggest that PETs should take into account the AR activity type, and relationship to bystanders, selectively facilitating awareness and consent. In this way, we can ensure bystanders feel their privacy is respected by everyday AR headsets, and avoid unnecessary rejection of these powerful devices by society.

Statistical biases due to anonymization evaluated in an open clinical dataset from COVID-19 patients

Anonymization has the potential to foster the sharing of medical data. State-of-the-art methods use mathematical models to modify data to reduce privacy risks. However, the degree of protection must be balanced against the impact on statistical properties. We studied an extreme case of this trade-off: the statistical validity of an open medical dataset based on the German National Pandemic Cohort Network (NAPKON), which was prepared for publication using a strong anonymization procedure. Descriptive statistics and results of regression analyses were compared before and after anonymization of multiple variants of the original dataset. Despite significant differences in value distributions, the statistical bias was found to be small in all cases. In the regression analyses, the median absolute deviations of the estimated adjusted odds ratios for different sample sizes ranged from 0.01 [minimum = 0, maximum = 0.58] to 0.52 [minimum = 0.25, maximum = 0.91]. Disproportionate impact on the statistical properties of data is a common argument against the use of anonymization. Our analysis demonstrates that anonymization can actually preserve validity of statistical results in relatively low-dimensional data.