Disclosure Of Sensitive Information Research Articles

Talking About Things: A Patient Cue for Sensitive Healthcare Problems and Effective Physician Responses

ABSTRACT In routine healthcare consultations, patients often use prefaces containing the word “thing”, including “the thing is”, “there’s this thing” or “one more thing”. Although “thing” is an all-encompassing term that is used in myriad ways, in this article we show that thing-prefaces perform a specific job. This study uses Conversation Analysis to analyze 90 video-recorded primary care consultations with 14 primary care physicians in the United States. Patients’ thing-prefaces mark the upcoming talk as a disclosure of sensitive information that may reflect negatively on the patient, physician or service (e.g., medication nonadherence, refill was not sent to pharmacy). Patients pursue explicit resolution of these problems (e.g., personalized recommendation, lab work, referral) despite these problems being downplayed and treated as delicate. Because patients may “talk around” these sensitive issues, thing-prefaces can be an important cue for physicians that patients are seeking resolution for a sensitive healthcare problem.

On the vulnerability of anti-malware solutions to DNS attacks

Anti-malware agents typically communicate with their remote services to share information about suspicious files. These remote services use their up-to-date information and global context (view) to help classify the files and instruct their agents to take a predetermined action (e.g., delete or quarantine). In this study, we provide a security analysis of a specific form of communication between anti-malware agents and their services, which takes place entirely over the insecure DNS protocol. These services, which we denote DNS anti-malware list (DNSAML) services, affect the classification of files scanned by anti-malware agents, therefore potentially putting their consumers at risk due to known integrity and confidentiality flaws of the DNS protocol. By analyzing a large-scale DNS traffic dataset made available to the authors by a well-known CDN provider, we identify anti-malware solutions that seem to make use of DNSAML services. We found that these solutions, deployed on almost three million machines worldwide, exchange hundreds of millions of DNS requests daily. These requests carry sensitive file scan information, often - as we demonstrate - without any additional safeguards to compensate for the insecurities of the DNS protocol. As a result, these anti-malware solutions that use DNSAML are vulnerable to DNS attacks. For instance, an attacker capable of tampering with DNS queries gains the ability to alter the classification of scanned files, without a presence on the scanning machine. We showcase three attacks applicable to at least three anti-malware solutions that could result in the disclosure of sensitive information and improper behavior by the anti-malware agent, such as ignoring detected threats. Finally, we propose and review a set of countermeasures for anti-malware solution providers to prevent attacks stemming from the use of DNSAML services.

Algorithm-Level Confidentiality for Average Consensus on Time-Varying Directed Graphs

Average consensus plays a key role in distributed networks, with applications ranging from time synchronization, information fusion, load balancing, to decentralized control. Existing average consensus algorithms require individual agents to exchange explicit state values with their neighbors, which leads to the undesirable disclosure of sensitive information in the state. In this paper, we propose a novel average consensus algorithm for time-varying directed graphs that can protect the confidentiality of a participating agent against other participating agents. The algorithm injects randomness in interaction to obfuscate information on the algorithm-level and can ensure information-theoretic privacy without the assistance of any trusted third party or data aggregator. By leveraging the inherent robustness of consensus dynamics against random variations in interaction, our proposed algorithm can also guarantee the accuracy of average consensus. The algorithm is distinctly different from differential-privacy based average consensus approaches which enable confidentiality through compromising accuracy in obtained consensus value. Numerical simulations confirm the effectiveness and efficiency of our proposed approach.

Security of Federated Learning: Attacks, Defensive Mechanisms, and Challenges

Recently, a new Artificial Intelligence (AI) paradigm, known as Federated Learning (FL), has been introduced. It is a decentralized approach to apply Machine Learning (ML) on-device without risking the disclosure and tracing of sensitive and private information. Instead of training the global model on a centralized server (by aggregating the clients’ private data), FL trains a global shared model by only aggregating clients’ locally-computed updates (the clients’ private data remains distributed across the clients’ devices). However, as secure as the FL seems, it by itself does not give the levels of privacy and security required by today’s distributed systems. This paper seeks to provide a holistic view of FL’s security concerns. We outline the most important attacks and vulnerabilities that are highly relevant to FL systems. Then, we present the recent proposed defensive mechanisms. Finally, we highlight the outstanding challenges, and we discuss the possible future research directions.

Locality-Sensitive Hashing-Based Link Prediction Process on Smart Campus Education or Online Social Platform

With the development of the Internet, smart campus education and online social platforms have become the mainstream of establishing social relationships. Although many users communicate by social networks, the social networks are caught in the problem of relationship sparsity, which severely impedes users’ communication space. More fatally, in the course of building social relationships, the disclosure of sensitive information will cause users’ privacy vulnerable to be compromised by attackers. Therefore, this paper proposes a potential social relationships prediction approach based on locality-sensitive hashing (LSH) to address the above issues. Specifically, the LSH clusters similar users into the same bucket, and the fuzzy computing method is developed to predict the types of social relationships among these similar users. To further alleviate the relationship sparsity problem, the existing social network structure is utilized to predict users’ social relationships and relationship types. Furthermore, the rationality of prediction results is verified by using the social balance theory (SBT). Finally, massive experiments are executed on Epinions, and the experimental results further confirmed the efficiency and accuracy of our methodology in terms of link prediction while guaranteeing privacy-preservation.

Trust in data‐requesting organizations—A quantitative analysis on cultural antecedents and individual‐level perceptions

AbstractInteractions in situations involving the disclosure of personal information require trust‐based relationships. However, trust manifests in different ways, depending on the cultural and contextual environment. An in‐depth understanding of how culture influences trust is therefore of considerable importance to managing situations that require the disclosure of sensitive health information, both from an academic and practical perspective. Drawing on the Model of National Culture and the Development of Trust, our study investigates culture as a determinant of trust in data‐requesting organizations. We link the model's three cultural dimensions (relation to self, risk, and authority) with Hofstede's study cultural dimensions and the privacy calculus (Laufer and Wolfe's study). To test our hypotheses, we analyze survey data collected in Nigeria, in cooperation with a non‐governmental organization working on data‐driven healthcare solutions. Our results confirm an influence of culture on trust in data‐requesting organizations which is, however, dependent on the cultural dimension. In addition, we show that perceived benefits increase trust significantly and provide a theoretical starting point for extending the Model of National Culture and the Development of Trust by the dimension relation to benefit.

Privacy and Online Social Networks: A Systematic Literature Review of Concerns, Preservation, and Policies

Background: Social media usage is one of the most popular online activities, but with it comes privacy concerns due to how personal data are handled by these social networking sites. Prior literature aimed at identifying users’ privacy concerns as well as user behavior associated with privacy mitigation strategies and policies. However, OSN users continue to divulge private information online and privacy remains an issue. Accordingly, this review aims to present extant research on this topic, and to highlight any potential research gaps. Method: The paper presents a systematic literature review for the period 2006 - 2021, in which 33 full papers that explored privacy concerns in online social networks (OSN), users’ behavior associated with privacy preservation strategies and OSN privacy policies were examined. Results: The findings indicate that users are concerned about their identity being stolen, the disclosure of sensitive information by third-party applications and through data leakage and the degree of control users have over their data. Strategies such as encryption, authentication, and privacy settings configuration, can be used to address users’ concerns. Users generally do not leverage privacy settings available to them, or read the privacy policies, but will opt to share information based on the benefits to be derived from OSNs. Conclusion: OSN users have specific privacy concerns due primarily to the inherent way in which personal data are handled. Different preservation strategies are available to be used by OSN users. Policies are provided to inform users, however, these policies at times are difficult to read and understand, but studies show that there is no direct effect on the behavior of OSN users. Further research is needed to elucidate the correlation between the relative effectiveness of different privacy preservation strategies and the privacy concerns exhibited by users. Extending the research to comparatively assess different social media sites could help with better awareness of the true influence of privacy policies on user behavior.

Privacy preserving data mining - past and present

Data mining is the process of discovering patterns and correlations within the huge volume of data to forecast the outcomes. There are serious challenges occurring in data mining techniques due to privacy violation and sensitive information disclosure while providing the dataset to third parties. It is necessary to protect user's private and sensitive data from exposure without the authorisation of data holders or providers when extracting useful information and revealing patterns from the dataset. Also, internet phishing gives more threat over the web on extensive spread of private information. Privacy preserving data mining (PPDM) is an essential for exchanging confidential information in terms of data analysis, validation, and publishing. To achieve data privacy, a number of algorithms have been designed in the data mining sector. This article delivers a broad survey on privacy preserving data mining algorithms, different datasets used in the research and analyses the techniques based on certain parameters. The survey is highlighted by identifying the outcome of each research along with its advantages and disadvantages. This survey will guide the future research in PPDM to choose the appropriate techniques for their research.

Privacy and Security Issues in Social Networking Sites (SNS)

Social Networking Sites (SNS) have become very fashionable during the past decade, as they permit users to both express their personal feelings and meet friends, relatives, and people with similar interests. There are many potential threats to data privacy and security like fraud, identity theft, and disclosure of sensitive information. Many users are still not conscious of these threats. Moreover, the privacy settings provided by SNSs aren't flexible and reliable enough to protect user data. Users don't have any control over what others reveal about them. We conducted a preliminary study among internet users of Nepal which examines the privacy and security issues in SNSs because the users share their information and put varieties of data on SNSs. This study intends to protect the user information from any misuse, to make sure of data security, and to permit users to choose what information to share and with whom. Another objective of this study is to measure the level of steps taken by the SNS operators. We identified privacy and security issues in SNS and propose a Privacy and Security Framework as a foundation to deal with these problems.

Ethical and Methodological Considerations Interviewing Dementia Caregivers

Greater inclusion of people living with dementia (PLWD) and their caregivers in research is a global research priority and an expressed priority of dementia advocacy organizations. Absent inclusion of PLWD and caregivers, our understanding of dementia-related experiences and optimization of care and caregiving interventions is stymied. Qualitative interviewing techniques constitutes a primary method for obtaining PLWD and caregivers’ perspectives. Yet, there is little guidance on use of qualitative interviewing techniques among PLWD and caregivers or discussion of potential challenges encountered, despite unique vulnerabilities faced throughout the research process, which may be further heightened among historically excluded groups. Meaningful progress toward inclusion of PLWD and their caregivers in dementia research necessitates broader examination of associated methodological and ethical considerations that arise in the conduct of interviews. Drawing from a large multi-site qualitative study of dementia caregivers with exposure to high levels of social disadvantage, we used a multiple-triangulation qualitative approach across interview transcripts, memos, and interviewer discussions to identify methodological and ethical challenges that arose during the interviewing process. Challenges were identified across all phases of research, and included relational concerns with PLWD and family members due to disclosure of sensitive information, risk of re-traumatization in discussing past experiences, multiple roles of caregivers with conflicting perspectives, variable recall capacity, limited prior appraisal of caregiving, and request of interviewers for medical advice or selecting services . We outline events evidencing these challenges and proposed strategies (i.e. use of research consults, interview debriefing) to strengthen research capacity to anticipate and respond to them.

Patient portals for the adolescent and young adult population: Benefits, risks and guidance for use

Patient portals are the primary means by which electronic health information (EHI) is shared with patients and families. The use of patient portals increased during the COVID-19 pandemic and may continue to rise with the implementation and enforcement of the 21st Century Cures Act that encourages facilitation of access to EHI and prohibits information blocking. Research on the use of patient portals by adolescents and their families is limited. Potential benefits of portal use to adolescents include increased engagement in their own health care, direct communication with their health care clinicians, and facilitation of transition of care to new clinicians in adulthood. Clinicians need to educate adolescents on the functions available through the portal, appropriate use and expectations for messaging through the portal, and the pros and cons of viewing EHI such as test results independently. Parental proxy access to the adolescent's portal should be carefully and thoughtfully implemented, because it poses a potential breach to confidential care via disclosure of sensitive or protected information. Adolescents who choose to deny their parents proxy access to the portal should be supported in that decision. It is important that all clinicians understand portal functionality and have strategies to optimize use within their practice. This paper provides the reader considerations and tips for portal use within this population.

How does qualitative data collection modality affect disclosure of sensitive information and participant experience? Findings from a quasi-experimental study

Focus groups (FGs) and individual interviews (IDIs) can be conducted in-person or in several different online contexts. We conducted a quasi-experimental study and assessed sharing of sensitive or dissenting information and participant comfort in FGs and IDIs across four modalities: (1) in-person, (2) online video-based, (3) online chat-based (synchronous), and (4) online email/message board-based (asynchronous). Participants were systematically assigned to one of the four modalities and randomized to one of 24 FGs or 48 IDIs (N = 171). The study topic was medical risk during pregnancy. All participants also completed a survey on their perceptions of the data collection process. We found no significant difference in the frequency of disclosure of sensitive information by modality. Text-based FGs (chat and message board) were more likely to contain dissenting opinions than visually-based FGs (in-person and video). Participants also reported feeling less rapport and personal comfort in sharing information in the FG video modality than other modalities. These findings provide initial data that can guide researchers in choosing among data collection modalities to maximize participant engagement and comfort.

Chapter 6 – Navigating National Security: The Prosecution of the Toronto 18

Prosecutions of terrorism cases pose unique challenges because they typically raise complex issues engaging the right of an accused person to disclosure of relevant material and the public interest in protecting national security. This chapter provides the lead prosecutor’s perspective on the Toronto 18 prosecution, some of the disclosure issues that arose in that case, and how similar issues might be handled in the future. Part II provides an overview of the Toronto 18 investigation. Part III reviews the Canadian disclosure regime in the context of terrorism prosecutions, contrasts it with disclosure regimes in the U.K. and the U.S.A., and highlights some problems associated with the current bifurcated approach when the defence seeks to compel disclosure of sensitive information. Part IV discusses how the prosecution in the Toronto 18 approached the disclosure of information in CSIS holdings. Part V concludes with a discussion of how the prosecution managed its disclosure obligations in the context of the Garofoli review of the wiretap authorizations, and how similar issues might be handled in the future given subsequent developments in the law.

Ring signature and improved multi‐transaction mode consortium blockchain‐based private information retrieval for privacy‐preserving smart parking system

SummaryIn big cities, the drivers face a major problem in identifying an optimal vacant parking space for their vehicles as the number of vehicles has rapidly grown over the recent years. This objective of determining the available parking space results in wastage of time, air pollution, and traffic congestion. Smart parking systems facilitate the driver to book parking slots and attain real‐time parking information. However, the existing smart parking solutions necessitate the disclosure of sensitive information like desired destination from the vehicle drivers. Moreover, the current smart parking solutions are highly centralized, making them vulnerable for launching privacy breaches by service providers and resulting in the issues of single‐point failure. In this paper, ring signature and improved multi‐transaction mode consortium blockchain‐based private information retrieval (RS‐IMTMCB‐PIR) scheme is proposed for privacy preserving in smart parking system. This RS‐IMTMCB‐PIR scheme initially utilizes an improved multi‐transaction mode consortium blockchain constructed by different number of parking lot owners in order to achieve maximized parking offers based on the factor of availability, transparency, and security. It incorporates an improved private information retrieval approach for protecting the location privacy of drivers and secretly retrieving the offers of parking from the improved multi‐transaction mode consortium blockchain. It further utilizes the benefits of ring signature for permitting the drivers in a potential anonymous authentication process that aids in available parking slot reservation. The simulation results of this proposed RS‐IMTMCB‐PIR scheme portrayed a predominant performance in ensuring maximized degree of drivers' privacy with reduced computation and communication overheads.

Optimal Location Privacy Preserving and Service Quality Guaranteed Task Allocation in Vehicle-Based Crowdsensing Networks

With increasing popularity of related applications of mobile crowdsensing, especially in the field of Internet of Vehicles (IoV), task allocation has attracted wide attention. How to select appropriate participants is a key problem in vehicle-based crowdsensing networks. Some traditional methods choose participants based on minimizing distance, which requires participants to submit their current locations. In this case, participants' location privacy is violated, which influences disclosure of participants' sensitive information. Many privacy preserving task allocation mechanisms have been proposed to encourage users to participate in mobile crowdsensing. However, most of them assume that different participants' task completion quality is the same, which is not reasonable in reality. In this paper, we propose an optimal location privacy preserving and service quality guaranteed task allocation in vehicle-based crowdsensing networks. Specifically, we utilize differential privacy to preserve participants' location privacy, where every participant can submit the obfuscated location to the platform instead of the real one. Based on the obfuscated locations, we design an optimal problem to minimize the moving distance and maximize the task completion quality simultaneously. In order to solve this problem, we decompose it into two linear optimization problems. We conduct extensive experiments to demonstrate the effectiveness of our proposed mechanism.

Prevention to Sensitive Information Disclosure via OSINT

This paper describes OSINT Tools and Approaches to find out sensitive information of any organization's Web Application or network. The paper contains the steps for gathering information and how to secure the web application, organization or network. There are many automated and paid tools available for vulnerability finding and penetration testing. In this paper we are performing recon with the help of OSINT to gather information and give the solution, before an attacker uses this vulnerability and exploits it. Nowadays lot many vulnerabilities are on the web application. I already learned the many cases in the security programs, where a Sensitive data leakage was happening on many reputed websites. So I will start to find out a web-application in which such types of information’s are disclosed, the Problem was that if we find out such information leaking like credentials, Token, API key we can easily get authorization to admins/users account. I found a lot many well-known websites where we can easily use this sensitive data. To perform such kind of attack you just need to perform reconnaissance with the help of various open source tools available on internet.

A trust-based privacy-preserving friend matching scheme in social Internet of Vehicles

In this paper, to expand the social circle of vehicle users in the non-trusted network environment, a trust-based privacy-preserving friend matching scheme in social Internet of Vehicles is designed, which can prevent the leakage of sensitive information caused by the matching of user attributes, and make the interaction between vehicles faster and more convenient. The proposed scheme can efficiently evaluate the credibility of the vehicles, and eliminate the malicious vehicles to protect the privacy information of the vehicles. Particularly, we use Bloom Filters to convert the attribute matching problem of the vehicles into the number of calculated intersection elements to judge the matching degree of the interests of both parties. The vehicles that fulfill the matching requirements can add each other as friend according to their interests, avoiding the abuse and disclosure of sensitive information by malicious vehicles. The theoretical analysis demonstrates that the proposed scheme is effective and accurate in privacy protection when vehicle attribute information matching. Simulation results illustrate that the proposed scheme can support large-scale data sets, be effectively applied to network environments with complex information types and rich data content, and satisfy the real-time demand in social Internet of Vehicles.

Game Analysis of Privacy Protection Based on Nash Equilibrium in Big Data Environment

Big data analysis has brought convenience to all fields of human life. At the same time, the problem of privacy leakage follows. Protecting user's private data and preventing sensitive information disclosure become urgent problems. However, big data has the characteristics of large amount of data, diversification of types and sources and rapid growth, so the traditional privacy protection technology is more and more unsuitable. The traditional privacy protection mechanism protects the privacy of users, at the same time, it will inevitably reduce the data utility[1]. On the basis of differential privacy knowledge, based on the Nash equilibrium privacy protection mechanism, this paper constructs an interrelated differential privacy model, analyzes and evaluates the game model among multiple data publishers, and proves the correctness of the game analysis.

Analyzing Information Disclosure in the Chinese Electricity Market

Electricity generation relies heavily on fossil fuels in China, and this has posed great challenges for sustainable development. In 2015, China launched a new series of power reforms, aimed primarily at sustainable development and building a competitive power market system, where an information disclosure system plays an important role. This paper analyzes the effects of sensitive information disclosure, constructs different information disclosure scenarios, and compares the market clearing results under different scenarios. The results show that information transparency is conducive to the promotion of market efficiency. However, some problems, especially collusion, arise and inevitably bring negative impacts to the power market. Therefore, more attention should be paid to the content and quality of data transparency to avoid manipulations in the market. The data of power systems are complex and various, and thus big data applications may be conducive to effective information disclosure and better market regulation. Moreover, disclosure delay will help the electricity market become more transparent by reducing the risk of collusion. Besides, the information’s scope and contents, timing should also be taken into consideration. These findings may provide some references for the sustainable development of the electricity industry and have certain policy implications for policymakers.

QoSChain: Provisioning Inter-AS QoS in Software-Defined Networks With Blockchain

Data flows of various applications, such as video conferencing, telesurgery, online-gaming, etc., require particular treatment regarding Quality of Service (QoS) because of their sensitivity to such parameters as high bandwidth, low delay, and so on. However, provisioning of QoS-based routing services across Autonomous Systems (ASes) poses gruelling challenges due to the distributed nature and business confidentially hesitations. This study presents a novel blockchain-aided QoS-enabled inter-AS routing framework, QoSChain (QC) , by blending merits of Software-Defined Networking (SDN) and Blockchain technologies. QC framework introduces a coordination framework with mutually distrusting participants that eliminates centralized mediators in provisioning QoS among SDN-enabled ASes. Also, QC reduces the time to set up an end-to-end (E2E) path and the number of messages exchanged and processed by SDN controllers for a QoS flow. Furthermore, it alleviates the concerns of network operators regarding potentially sensitive information disclosure resulting from the required information sharing for QoS-based cross-AS paths by masking details of any confidential information. Experimental results verify the feasibility of the proposed framework on E2E QoS-based routing among SDN networks. This work aims at being a useful primer for researchers in providing insights on how blockchain can be deployed in QoS-enabled routing.