INF529: Security and Privacy In Informatics - Technical Means of Protection Prof. Clifford Neuman
←
→
Page content transcription
If your browser does not render page correctly, please read the page content below
INF529:
Security and Privacy
In Informatics
Technical Means of Protection
Prof. Clifford Neuman
Lecture 4
1 February 2019
12:00 Noon
OHE 100C
Course Outline • Overview of informatics privacy • What data is out there and how is it used • Technical means of protection • Identification, Authentication, Audit • The right of or expectation of privacy • Social Networks and the social contract • Measuring Privacy • Big data – Privacy Considerations • Criminal law, National Security, and Privacy • Civil law and privacy • International law and conflict across jurisdictions • The Internet of Things • The future – What can we do
A primer in-security
• Much of todays lecture will be review for students
in the security informatics program.
• The objectives of today’s lecture are to provide an
overview of identification, authentication, and
audit non-security specialist.
– Useful for those in data informatics
– Useful for those outside of engineering
• What you need to know about the security of the
information you manageSemester Project
All students are expected to prepare and present a 30 minute
lesson on a topic related to privacy that is of interest to them.
– If on a topic that is already in the syllabus, your presentation will be made
in the week that the topic is covered in class. The next slide shows some
possible topics that align with lectures (your title should be more specific).
– If on a topic that is not already in the syllabus, I will assign a week from
your presentation, based on available time in lecture, and based on
relevance.
– Please send me proposed topics for your class presentation by Thursday the
25th. You can suggest multiple topics if you like... if so let me know your order
of preference. All that you need is a short title and a one sentence description.
Topics may be chosen from among the topics listed in the syllabus for the
class, or you may propose topics around any particular problem domain (e.g.
type of system, type of business, type of activity) for which you will provide a
thorough discussion of privacy (or privacy invading) technology and policy.Possible Presentations • Week5: The right of or expectation of privacy • Week6: Social Networks and the social contract • Week7: Measuring Privacy • Week8: Big data – Privacy Considerations • Week9: Criminal law, National Security, and Privacy • Week10: Civil law and privacy • Week11: International law and conflict across jurisdictions • Week12: The Internet of Things • Week13: The future – What can we do
Current Alignment Security, Privace and Safety of Medical Devices and related tech. • Fumiko Uehara • Joseph Mehltretter • Abdullah Altokhais Future of Privacy – Technology, Training, Legislations, etc. • Yekaterina Glazko • Charlene Chen – Right ot be Forgotten and the future of privacy
Current Alignment Internet of Things • Lance Aaron - Smart Assistants • Brianna Tu • Yulie Felice - Amazon Alexa Security • Sophia Choi – RFID, USN, M2M • Jairo Hernandez - Security and Privacy of NFC • Kelsey Ann Bailleul - Implication of IoT on Privacy Facial Recognition and related technologies • Louis Uuh – Facial Recognition Messaging Technologies • Aaron Howland
Current Alignment Social Networks • Sevanti Nag • Chloe Choe • Nitya Mohini Harve • Deepti Rajashekharaiah Siddagangappa Legal Issues – Privacy regulations, Instigations, other • Arjun Raman – CCPA and related • Anupama Abhay Sakhalkar – International legal issues • Dewaine Redish – National Security and Privacy • Andrew Carmer - History of Government Surveillance
Current Alignment Big Data • Jacqueline Dobbas - Location Data • Kavya Sethuraman Monetization of PII • Ahmed Qureshi • Faris Almathami - Privacy vs. Marketers and Advertisers
Defining The Cloud • The cloud is many things to many people – Software as a service and hosted applications – Processing as a utility – Storage as a utility – Remotely hosted servers – Anything beyond the network card • Clouds are hosted in different ways – Private Clouds – Public Clouds – Hosted Private Clouds – Hybrid Clouds – Clouds for federated enterprises
Risks of Cloud Computing
• Reliability
– Must ensure provider’s ability to meet demand and to run reliably
• Confidentiality and Integrity
– Service provider must have their own mechanisms in place to protect data.
– The physical machines are not under your control.
• Back channel into own systems
– Hybrid clouds provide a channel into ones own enterprise
• Less control over software stack
– Software on cloud may not be under your enterprise control
• Harder to enforce policy
– Once data leaves your handsDefining Policy
• Characterize Risk
– What are the consequences of failure for different functions
• Characterize Data
– What are the consequences of integrity and confidentiality
breaches
• Mitigate Risks
– Can the problem be recast so that some data is less critical.
• Redundancy
• De-identification
– Control data migration within the cloudControlling Migration
• Characterize Node Capabilities
– Security Characteristics
• Accreditation of the software for managing nodes and data
– Legal and Geographic Characteristics
• Includes data on managing organizations and contractors
– Need language to characterize
– Need endorsers to certify
• Define Migration Policies
– Who is authorized to handle data
– Any geographic constraints
– Necessary accreditation for servers and software
• Each node that accepts data must be capable for enforcing
policy before data can be redistributed.
– Languages needed to describeEnforcing Constraints
• With accredited participants
– Tag data and service requests with constraints
– Each component must apply constraints when
selecting partners
• Sort of inverting the typical access control
model
• When not all participants are accredited
– Callbacks for tracking compliance
– Trusted computing to create safe containers
within unaccredited systems.Cloud Security Summary
• Great potential for cloud computing
– Economies of scale for managing servers
– Computation and storage can be distributed along
lines of a virtual enterprise.
– Ability to pay for normal capacity, with short term capacity
purchases
to handle peak needs.
• What needs to be addressed
– Forces better assessment of security requirements for
process and data.
– Accreditation of providers and systems is a must.
– Our models of the above must support automated
resolution of the two.Why Identity is So Important
Most policy specifications are identity based
– CIA policies last week, depend on knowing who is
trying to read or change data.
Most security breaches include some form of
impersonation
– Malicious code runs as an authorized user
– Passwords stolen by phishing
Identifiers link data and make it findable/searchable.
– Whether right or wrong, this identification has
significant impact on users.Identification vs. Authentication
Identification
Associating an identity with an individual,
process, or request
Authentication
Verifying a claimed identityBasis for Authentication
Ideally
Who you are
Practically
Something you know
Something you have
Something about you
(Sometimes mistakenly called things you are)Something you know
Password or Algorithm
e.g. encryption key derived from password
Issues
Someone else may learn it
Find it, sniff it, trick you into providing it
Other party must know how to check
You must remember it
How stored and checked by verifierSomething you Have Cards Mag stripe (= password) Smart card, USB key Time varying password Issues How to validate How to read (i.e. infrastructure)
Case Study – RSA SecureID Claimed - Something You Have Reduced to something they know How it works: Seed Synchronization Compromises: RSA Break-in Or man in the middle
Implication of Authentication Failures
Implication of Authentication Failures Access to data (confidentiality or integrity) as if attacker were the authorized user. For one system, or for many systems. Failure can propagate through system. Don’t depend on a less critical system.
How Authentication Fails Stolen Credentials – Passwords – Cards / devices – Copied biometrics • The role of malicious code – GP devices can not protect credentials
Problems of e-mail authentication
And password recovery
- General email security is weak
- Emails can be intercepted
- Or are sent to a compromised account
- http://abcnews.go.com/Business/online-
security-time-upgrade-
passwords/story?id=36223462Implications of password reuse If users use same password on multiple systems. - The security of the users account on any system becomes dependent on the security of the weakest system used with that password. - https://thestack.com/security/2016/02/03/t aobao-hack-20-59-million/
Implications of Data Compromise
The biggest reason most people are
concerned with data breach is:
?Implications of Data Compromise
The biggest reason most people are
concerned with data breach is:
The data is used for authentication
Social Security Numbers
Credit Card Numbers
PINsAddressing Data Compromise
Don’t collect the data
– If you don’t need it
– Design systems so you don’t need it
Don’t use the data for authentication
– Why do we use public information for
authentication:
• Mothers maiden name
• Password reset information
• SSNWhy such poor practices
Internet services require scalability to be viable.
Automation provides that scalability.
Effective Customer service does not.
It is all about avoiding personal contact with the
customer, which would require more staff.The future of second factors What do we have Who takes responsibility This is a major stumbling block Responsibility means liability
Back to Identification
Identification is important for attribution
– Audit trails and logs
– Identifying wrongdoers
• Identification can be wrong
– Attacks facilitated through
compromised machines
– IP Addresses that changePoints of Identification Biometric Data Surveillance Data Internet Addresses MAC Addresses Payment details
Implications http://www.networkworld.com/article/26836 92/microsoft-subnet/is-swat-raid-on- wrong-house-based-on-open-wi-fi-ip- address-unconstitutional.html
Audit and Detection
Identification data is recorded in audit logs
routinely together with observed actions
– Accesses, authentication attempts,
failures, etc.
Systems use tools to process this audit
data and alert on suspicious actions.Attack Detection
• External attacks
– Password cracks, port scans, packet spoofing, DOS
attacks
• Internal attacks
– Masqueraders, Misuse of privilegesAttack Stages
• Intelligence gathering
– attacker observes the system to determine vulnerabilities
(e.g, port scans)
• Planning
– decide what resource to attack and how
• Attack execution
– carry out the plan
• Hiding
– cover traces of attack
• Preparation for future attacks
– install backdoors for future entry pointsIntrusion Detection • Intrusion detection is the problem of identifying unauthorized use, misuse, and abuse of computer systems by both system insiders and external penetrators • Why Is IDS Necessary?
IDS types
• Detection Method
– Knowledge-based (signature-based ) vs
behavior-based (anomaly-based)
• Behavior on detection
– passive vs. reactive
• Deployment
– network-based, host-based and application -
basedComponents of ID systems • Collectors – Gather raw data • Director – Reduces incoming traffic and finds relationships • Notifier – Accepts data from director and takes appropriate action
Examples of Detection
The Anonymity Debate
• Should we be required to identify ourselves when
using the internet?
– What about other situations
– Event:
– https://www.bleepingcomputer.com/news/security/windo
ws-drm-files-used-to-decloak-tor-browser-users/
• Authentication of Attributes vs Identity
– Over 21, but without showing your DL
• Use of Internet CafesWhat shall you do if Compromised
What to do when your companies systems are
attacked will depend on many factors, but most
importantly:
What you have done to prepare.
– Emergency Response Plan
– Emergency Response Team
– How the system has been set up
• Backups, Data Collection for Forensics, Baselines
• Your containment architecture
42
An NSA Center for Academic Excellence - ResearchAre we less secure today
No: It is the environment that has changed
– Users today demand instant and universal access to everything they
can get.
– In the past, data was better protected because it wasn’t accessible
– Some data was better protected because no-one collected it to begin
with.
Understanding this can help you prepare
– Develop a containment architecture
– Different data can have different
accessibility
– Collect and distributed data to mitigate the
impact of the inevitable breach
43
An NSA Center for Academic Excellence - ResearchContainment Architecture Action PLAN
Conduct an Inventory – of data
– What Kinds of Data do you have in your business
– How is it handled and where is it handled
– Who needs access to this data
– Which systems need access to this data
– How is it protected in transit, and in situ
44
An NSA Center for Academic Excellence - ResearchContainment Architecture Action PLAN
Conduct an Inventory – of physical assets
– What Kinds of systems do you have
• E.g. POS terminals, servers, network hardware
– Understand the access to each system
• Employees, customers, etc
– How are the different classes of systems protected from one another
• Network zones, etc
– How do you contain breaches to particular zones.
45
An NSA Center for Academic Excellence - ResearchCOLLECT BASLINE INFO ON ALL
ASSETS
Software and system checksums
– Used to detect changes to the system
– To identify which assets are affected
– To enable recovery – reinstall those affected
systems
Baseline data communication from all assets
– In you network infrastructure, use this to
identify
anomalous flows
– As they happen to block exfiltration
– From Logs to identify where data went and
how much, and over what time periods
46
An NSA Center for Academic Excellence - ResearchThis much PREPARATION CHANGES
THE STORY
From:
XYZ corporation is the latest company to report
that the personal information of 70M customers
may have been compromised.
TO:
XYZ corporation reports that users of its beach
city store between October 1st and 3rd may
have been affected by …
47
An NSA Center for Academic Excellence - ResearchAfter a breach: Containment
– You will need to shut down or take offline
those systems affected by the breach
(those you can no longer trust) to prevent
further loss of data.
– Collect forensic data to assist in
assessing impact, to identify attackers,
and for prosection.
– Stronger containment (from preparation
phase) means fewer critical services that
you need to take offline.
48
An NSA Center for Academic Excellence - ResearchAfter a breach: Notification
• California Breach Law SB-1386
November 2003 If personal information
is stolen and not encrypted, the business
has a fiduciary responsibility to advise
every client or customer and employee
their information has been compromised.
• SB-24 Addendum to SB-1386 January
2012 The business must also notify DOJ
and provide particulars of how the
information was stolen, when, how.
49
An NSA Center for Academic Excellence - ResearchAfter a breach: analysis
– Check for changes to your systems and data.
– Use forensic data collected using technologies in
place from your planning phase to identify
sources of the attack, and the techniques used.
– Use this information to determine which
customers data and which systems were
affected.
– Use this information to fix the vulnerabilities in
your existing systems.
– Subject to legal requirements, share this
information as appropriate with the authorities
and the security community.
50
An NSA Center for Academic Excellence - ResearchAfter a breach: recovery
– Systems/data must be restored to a trusted
state.
• Using backups
• Legitimate updates to data may need to be
reapplied
– Vulnerably used in the attack must be patched
before systems are brought back online.
– You need a plan for operating your business for
some period without the impacted systems.
• Part of your planning phase
51
An NSA Center for Academic Excellence - ResearchWhat if I’m a small business
– Some parts of your operation are likely
outsourced
– Carefully vet your providers, apply the same
standards here, and ask how they address
them.
– Consider using multiple sources so that you
can switch from one to another in the event of a
breach that it outside your control.
– Insist that they have containment architectures
that better protect your information while it is in
their hands.
52
An NSA Center for Academic Excellence - ResearchWhat Technology should I deploy
– Audit and intrusion detection
– Encryption throughout the systems
• Data in transit and data on disk
• As close to the source as possible
– System mapping/configuration tools
• Align with your containment architecture
– Effective identity and policy management
– Configuration management systems
53
An NSA Center for Academic Excellence - ResearchWeekly Current Event Assignment Beginning in week 2 students should find a current event regarding security or privacy (preferably privacy) in the news and and me a URL, title, and three sentence write-up which we will discuss in class. The write-up should be sent to me before 7AM the morning of our lecture. These will be due from all students for each class and will count toward you class participation grade. We will discuss all submissions in class and you will be called on to provide additional information about your submission. Example: Google's Art Selfie App Offers A Lesson In Biometric Privacy Laws – NPR 1/18/18 Story explains why the Art Selfie app is not available to users in Illinois or Texas. Explains the unintended consequences of privacy legislation. – Your name
Current Events
UAE used cyber super-weapon to spy on iPhones of foes Reuters 1/30/19
U.S. government intelligence operatives working for the UAE were able to subvert iPhones of prominent
foreign leaders using a sophisticated spying tool known as "Karma." This tool is thought to exploit a flaw
in iMessage that allowed for the implantation of the malicious tool without any user interaction (iPhone
security updates at the end of 2017 reduced the effectiveness of Karma). Photos, emails, text
messages, saved passwords, and location information were all obtainable using the Karma tool.
-- Aaron Howland
Indian Digital Privacy in Jeopardy - TheDiplomat.com-1/29/2019
A one-year delay in approving overarching privacy regulations in India has opened the flood gates for new
initiatives to be passed which pose threats to privacy, free speech, and investment. This could also pose a
threat/deterrent to Indian businesses as more layers of regulation must be complied with. -- Dewaine Reddish
AIG of Japan raised its cyber insurance limits to 137 thousand dollars. Prtimes 2/1/19
AIG of Japan announced that it will raie its cyber insurane limimts to 137 thounsand dollars. The new plan will
start on February 5th. Background of the newly raised plan is that increasing of forensic investigation cost for
privacy data breach incidents. AIG of Japan provides cyber insurance service from 2012, mainly for medium
sized enterprises. Risks of monetary damages and costs for ivestigaion are continusly increasing. -- Fumiko
Uehara
55Current Events
PRIVACY GROUPS CLAIM ONLINE ADS CAN TARGET ABUSE VICTIMS - WIRED - 1.27.2019
Complex bidding process behind online behavioral advertising threatens consumers’ privacy and the
way personal data is handled during the process of matching advertisements to ad slots may not comply
with the GDPR. For instance, the list of labels agreed upon by the Interactive Advertising Bureau, a
trade group that establishes industry norms, includes categories like incest/abuse support, gay life, hate
content, substance abuse, and AIDS/HIV. This has enormous implications for the digital marketing
industry including key solutions within the sector like Google AdWords and Google’s Authorized Buyer
Program, and the third parties that leverage these tools to run 5campaigns. - Arjun Raman
Google Also Exploited Apple's Backdoor for Data Collection Tech Crunch 1/30/2019
Similar to Facebook, Google exploited Apple’s employee only app distribution system to collect user data.
Although much clearer on their intentions than Facebook, this still violates Apple’s policy. Balance between
privacy and financial rewards systems. — Lance Aaron See
Mozilla security policy cracks down on creepy web trackers, holds supercookies over fire The Register 1/29/19
Mozilla is planning on limiting the ability of websites and other online services to track users using the Firefox
browser. Mainly, it is focusing on tracking techniques that users cannot control, such as stateful identifiers used
by third parties to build a user profiles, URL tracking, and supercookies. Firefox will not immediately be blocking
all behaviors, but is taking a stance to protect their users from being tracked. -- Charlene Chen
56Current Events - IoT
The doorbells have eyes: The privacy battle brewing over home security cameras – 1/31/2019
The Washington Post
A man was licking a family’s doorbell for 3 hours on earlier January. Washington is paying up to $500 for security cameras
on private property. Washington, Amazon, Google, etc. care about privacy, but there are ethical problems such as point
the camera neighbors, sharing on social media, police involving, deleting issue, hacking camera, etc. -- Sophia Choi
Pwn the LIFX Mini white – liitedresults.com
IoT devices are consuming our lives more and more, but what do you do when one of those devices fail? Do
you just throw it away? You shouldn’t. In this recent article by “LimitedResults” he/she explains that your smart
devices may be holding up precious information in just plain text. - Louis Uuh
The Spy Inside Your Car-Fortune 1/24/19
Voice-recognition systems in cars will soon be able to integrate personal assistants like Amazon Alexa, Apple's
Siri, and Google's Assistant on the go, but how that data is used is yet to be determined. The threat to privacy is
that as recognition improves with accents and dialects, companies will have greater insight into consumer
desires. A concerning threat is that there is a lack of clarity regarding who will control the collected data. -
Jacqueline Dobbas
57Current Events - Microsoft
Microsoft 365 gets new compliance and data privacy features VentureBeat 1/31/2019
Microsoft 365 by Microsoft is a product used by businesses/enterprises/ universities to provide Microsoft products across
the given organization. This article discusses new ways Microsoft is focusing on ensuring data privacy for its users. The
biggest update is the "dedicated workspace" that helps administrators enforce regulatory obligations and other data
privacy features. The launch of these features was directly motivated by GDPR.
Joseph Mehltretter
A Vulnerability in Microsoft Exchange Could Allow for Privilege Escalation
- Center for Internet Security, Inc. 01/29/2019
A vulnerability has been discovered in Microsoft Exchange which could allow for privilege escalation.
Successful exploitation of this vulnerability could allow for privilege escalation to the Domain Admin
account. - Sevanti Nag
58Current Events - Apple
Can we trust tech giants with our faces? Google, Amazon and Microsoft can't agree
on how to protect us. USA Today (no link provided)
Face recognition, powered by artificial intelligence, could allow the government to supercharge surveillance by automating identification and tracking.
Authorities could use it to track protesters, target vulnerable communities (such as immigrants), and create digital policing in communities of color that are already
subject to pervasive police monitoring. So how are the world's biggest technology companies responding to this serious threat to privacy, safety and civil rights?
-- Gene Zakrzewski
Apple's bug could help u listen to friend's conversation over facetime without actually being on a call – The Verge
Apple's facetime is a very popular app and when everyone was lauding apple for its strong stand on privacy, there is now a serious bug which allows users to eves
drop on others' conversations without actually being on the call with them. If you see your iPhone ringing with a FaceTime video call, it’s possible that the person
calling you could listen to your microphone before you’ve picked up and it could also transmit your video and this is a serious privacy breach. While we wait for a
fix, the temporary workaround is only to turn off facetime and it can have many people to be affected. -- Kavya Sethuraman
Apple's iOS 12.1.4 Update to Fix FaceTime Eavesdropping Bug Showing Up in Analytics - MacRumors 01/31/2019
An update to the recent FaceTime bug that allows users to eavesdrop on others. The bug allows users to invade the privacy of others if they use the Group
FaceTime feature. Apple disabled the group chat feature and is planning to roll out a fix this week. - Abdulla Alshabanah
How Apple could miss a privacy-invading FaceTime security flaw The Verge 1/29/2019
Apple Facetime is reported to have a privacy invading problem that allows callers to eavesdrop on receivers without their agreement to answer the call. The article
explains how a typical test method called "fuzzing" in which negative inputs are fed into the system would not have caught the bug because of the UI (user
interface) nature of the bug. Quality assurance testing with real world scenarios are also ineffective in this case as most people do not usually call their own number
after calling someone. -- Yulie Felice
59Current Events - Apple
Apple's empty grandstanding about privacy 01/31/2019
Expresses the author's opinions that while Tim Cook advocates privacy, Apple still deals with companies that
allegedly violate customers' privacy. Example - Safari routing to Chrome for which Apple paid Google $9 billion in
2018. I thought this made for an interesting read, especially since the last two lectures a lot of people(myself
included) came up with current events related to Tim Cook advocating privacy. -- Anupama Sakhalkar
Although Tim Cook, Apple's CEO, said that "We at Apple believe that privacy is a fundamental human right", but
the company enables the surveillance that supposedly offends its values. Apple claims that personal data serve
only to enrich the companies that collect them. However, if Apple really wants to protect customers' privacy, they
could offer a serious substitute for their own apps (e.g. maps), instead of providing data to third parties.
-- (Mindy) Huang
https://www.theatlantic.com/technology/archive/2019/01/apples-hypocritical-defense-data-
privacy/581680/
This is a article about a recent incident between Apple and Facebook. Facebook has been incentivizing its
users, particularly teenagers, to download a research application that collects large amounts of information
about them. Apple found this to be a violation of privacy and revoked Facebook’s permission to distribute these
kinds of applications via iPhone. The author discusses whether Apple should take a look at its own practices as
well. -- Ann Bailleul
60Current Events - Facebook
Facebook’s Plan to Merge Instagram, Messenger and WhatsApp Raises Privacy Concerns Inside Sources 1/29/2019
Facebook's announcement of merging Facebook, WhatsApp, and Instagram has raised a lot of attention to
users being concerned about their privacy. Facebook, known as the top privacy violator, is now planning to
merge multiple platforms, and that will facilitate Facebook in accessing more of users' private data to benefit
from. Germany and Ireland were the first countries to respond to Facebook's announcement and question it in
regards to privacy changes and causes of the integration - Faris Almathami
EU data watchdog raises concerns over Facebook integration TheGaurdian | 01/28/2019
After being battered by scandals, Mark Zuckerberg plans on integrating Messenger, Instagram and WhatsApp.
According to sources these applications would be standalone however the underlying technical infrastructure will be unified. This would give an opportunity for 2.6 billion users to
communicate across the platform. According to the Irish commission that regulates the social network in the EU, Facebook’s plan to merge will raise significant data protection
concerns. Under GDPR, a company may designate one national regulator as its “lead supervisory authority”, to prevent it having to deal with 28 separate regulators; for Facebook,
Ireland’s DPC takes that role. The Data Protection Commission has asked for an urgent briefing with Facebook Ireland so it can assess the proposals. “The Irish DPC will be very
closely scrutinizing Facebook’s plans as they develop, particularly insofar as they involve the sharing and merging of personal data between different Facebook companies.
-- Deepti Siddagangappa
Illinois Supreme Court: No ‘Actual Harm’ Required for Biometric Information Privacy Act Claims – CyberAdvisor 1/29/19
The Illinois Supreme Court held on January 25, 2019, that plaintiffs filing suit under the Biometric Information Privacy Act—which regulates how private entities
disclose and discard biometric identifiers—do not need actual damages for standing. The decision has serious implications for companies collecting biometric data
from Illinois residents. The Act provides a private right of action to individuals “aggrieved” by any violation, allowing them to seek, among other remedies, liquidated
or actual damages, attorneys’ fees, and costs. However, there has been widespread uncertainty as to whether an aggrieved individual asserting a private action
under the Act needed to show that he or she suffered an actual injury as a result of an alleged violation, or if a violation of the Act in and of itself conveys standing.
-- Gene Zakrzewski
61Current Events - Facebook
People say they care about Facebook's privacy scandals, but their actions show they don't — here's what that means for other
tech giants CNBC 1/31/19
Write-Up: Despite the harsh media criticisms and public outcries about Facebook’s string of issues regarding privacy, they
reported great quarterly earnings for Q4 of 2018. For example, in Europe Facebook faced lots of disapproval of their
Cambridge Analytica scandal; as well as issues with complying to GDPR. Despite this, data shows that there is a
resurgence of European users going back to the platform; perhaps showing a willingness on users’ behalf to forgo their
concerns and continue using the platform. For other companies, seeing Facebook’s bottom line being minimally affected
by the scandals could reduce their concerns about questionable privacy practices affecting their bottom line.
-- Kate Glazko
62Current Events – Apple/Facebook
Apple leaves Facebook offices in disarray after revoking app permissions - The Guardian 1/31/19
The article discusses how apple has revoked Facebook's enterprise developer certificate after finding out that
they were using a loophole to harvest users data. Facebook Research would route traffic through the company's
own servers and because it had been built as an "internal" enterprise app Facebook had unrestricted access to
all data. Apple keeps pushing its focus on users privacy when using the iPhone. -- Ahmed Qureshi
Facebook pays teens to install VPN that spies on them TechCrunch (01/29/19)
This article talks about how Facebook has been using third party companies to recruit teens and young adults to
install VPN's to track their mobile usage. Facebook told TechCrunch that it would immediately shut down the app
on iOS but Apple said that it actually banned the app before Facebook even did this. This shows what people will
do to sell their privacy ($20/month) - Chloe Choe
Apple takes down Facebook’s Research App – C|Net 1/30/2019
This story talks about how Facebook was paying up to $20 a month “to access a user’s phone and web activity
for marketing research”. Though that seems to be legal, one of the main points of contention is the age
demographic of these users, which range from 13 – 35. Facebook claims that nothing was being misrepresented
as the title of the app said it was for research, there were waivers and documentation signed, and that less than
5% of participants were teens. Privacy experts are concerned with the amount of privacy that users are willing to
give away. -- Jairo Hernandez
63You can also read
