INF529: Security and Privacy In Informatics - Technical Means of Protection Prof. Clifford Neuman

Page created by Donald Newton
 
CONTINUE READING
INF529: Security and Privacy In Informatics - Technical Means of Protection Prof. Clifford Neuman
INF529:
 Security and Privacy
    In Informatics

Technical Means of Protection

    Prof. Clifford Neuman

                                Lecture 4
                                1 February 2019
                                12:00 Noon
                                OHE 100C
INF529: Security and Privacy In Informatics - Technical Means of Protection Prof. Clifford Neuman
Course Outline
•   Overview of informatics privacy
•   What data is out there and how is it used
•   Technical means of protection
•   Identification, Authentication, Audit
•   The right of or expectation of privacy
•   Social Networks and the social contract
•   Measuring Privacy
•   Big data – Privacy Considerations
•   Criminal law, National Security, and Privacy
•   Civil law and privacy
•   International law and conflict across jurisdictions
•   The Internet of Things
•   The future – What can we do
A primer in-security

• Much of todays lecture will be review for students
  in the security informatics program.
• The objectives of today’s lecture are to provide an
  overview of identification, authentication, and
  audit non-security specialist.
    – Useful for those in data informatics
    – Useful for those outside of engineering
• What you need to know about the security of the
  information you manage
Semester Project
All students are expected to prepare and present a 30 minute
lesson on a topic related to privacy that is of interest to them.
   – If on a topic that is already in the syllabus, your presentation will be made
     in the week that the topic is covered in class. The next slide shows some
     possible topics that align with lectures (your title should be more specific).
   – If on a topic that is not already in the syllabus, I will assign a week from
     your presentation, based on available time in lecture, and based on
     relevance.
   – Please send me proposed topics for your class presentation by Thursday the
     25th. You can suggest multiple topics if you like... if so let me know your order
     of preference. All that you need is a short title and a one sentence description.
     Topics may be chosen from among the topics listed in the syllabus for the
     class, or you may propose topics around any particular problem domain (e.g.
     type of system, type of business, type of activity) for which you will provide a
     thorough discussion of privacy (or privacy invading) technology and policy.
Possible Presentations
•   Week5: The right of or expectation of privacy
•   Week6: Social Networks and the social contract
•   Week7: Measuring Privacy
•   Week8: Big data – Privacy Considerations
•   Week9: Criminal law, National Security, and Privacy
•   Week10: Civil law and privacy
•   Week11: International law and conflict across jurisdictions
•   Week12: The Internet of Things
•   Week13: The future – What can we do
Current Alignment
Security, Privace and Safety of Medical Devices and related tech.
• Fumiko Uehara
• Joseph Mehltretter
• Abdullah Altokhais

Future of Privacy – Technology, Training, Legislations, etc.
• Yekaterina Glazko
• Charlene Chen – Right ot be Forgotten and the future of privacy
Current Alignment
Internet of Things
• Lance Aaron - Smart Assistants
• Brianna Tu
• Yulie Felice - Amazon Alexa Security
• Sophia Choi – RFID, USN, M2M
• Jairo Hernandez - Security and Privacy of NFC
• Kelsey Ann Bailleul - Implication of IoT on Privacy

Facial Recognition and related technologies
• Louis Uuh – Facial Recognition

Messaging Technologies
• Aaron Howland
Current Alignment
Social Networks
• Sevanti Nag
• Chloe Choe
• Nitya Mohini Harve
• Deepti Rajashekharaiah Siddagangappa

Legal Issues – Privacy regulations, Instigations, other
• Arjun Raman – CCPA and related
• Anupama Abhay Sakhalkar – International legal issues
• Dewaine Redish – National Security and Privacy
• Andrew Carmer - History of Government Surveillance
Current Alignment
Big Data
• Jacqueline Dobbas - Location Data
• Kavya Sethuraman

Monetization of PII
• Ahmed Qureshi
• Faris Almathami - Privacy vs. Marketers and Advertisers
Defining The Cloud
• The cloud is many things to many people
   – Software as a service and hosted applications
   – Processing as a utility
   – Storage as a utility
   – Remotely hosted servers
   – Anything beyond the network card
• Clouds are hosted in different ways
   – Private Clouds
   – Public Clouds
   – Hosted Private Clouds
   – Hybrid Clouds
   – Clouds for federated enterprises
Risks of Cloud Computing

•   Reliability
     – Must ensure provider’s ability to meet demand and to run reliably
•   Confidentiality and Integrity
     – Service provider must have their own mechanisms in place to protect data.
     – The physical machines are not under your control.
•   Back channel into own systems
     – Hybrid clouds provide a channel into ones own enterprise
•   Less control over software stack
     – Software on cloud may not be under your enterprise control
•   Harder to enforce policy
     – Once data leaves your hands
Defining Policy
•   Characterize Risk
     – What are the consequences of failure for different functions
•   Characterize Data
     – What are the consequences of integrity and confidentiality
        breaches
•   Mitigate Risks
     – Can the problem be recast so that some data is less critical.
         • Redundancy
         • De-identification
     – Control data migration within the cloud
Controlling Migration
•   Characterize Node Capabilities
     – Security Characteristics
          • Accreditation of the software for managing nodes and data
     – Legal and Geographic Characteristics
          • Includes data on managing organizations and contractors
     – Need language to characterize
     – Need endorsers to certify
•   Define Migration Policies
     – Who is authorized to handle data
     – Any geographic constraints
     – Necessary accreditation for servers and software
          • Each node that accepts data must be capable for enforcing
            policy before data can be redistributed.
     – Languages needed to describe
Enforcing Constraints
• With accredited participants
  – Tag data and service requests with constraints
  – Each component must apply constraints when
    selecting partners
     • Sort of inverting the typical access control
       model
• When not all participants are accredited
  – Callbacks for tracking compliance
  – Trusted computing to create safe containers
    within unaccredited systems.
Cloud Security Summary
• Great potential for cloud computing
   – Economies of scale for managing servers
   – Computation and storage can be distributed along
     lines of a virtual enterprise.
   – Ability to pay for normal capacity, with short term capacity
     purchases
     to handle peak needs.
• What needs to be addressed
   – Forces better assessment of security requirements for
     process and data.
   – Accreditation of providers and systems is a must.
   – Our models of the above must support automated
     resolution of the two.
Why Identity is So Important

Most policy specifications are identity based
    – CIA policies last week, depend on knowing who is
       trying to read or change data.
Most security breaches include some form of
impersonation
    – Malicious code runs as an authorized user
    – Passwords stolen by phishing
Identifiers link data and make it findable/searchable.
    – Whether right or wrong, this identification has
       significant impact on users.
Identification vs. Authentication

Identification
  Associating an identity with an individual,
    process, or request
Authentication
  Verifying a claimed identity
Basis for Authentication

Ideally
  Who you are
Practically
  Something you know
  Something you have
  Something about you
    (Sometimes mistakenly called things you are)
Something you know

Password or Algorithm
   e.g. encryption key derived from password
Issues
   Someone else may learn it
      Find it, sniff it, trick you into providing it
   Other party must know how to check
   You must remember it
   How stored and checked by verifier
Something you Have

Cards
   Mag stripe (= password)
   Smart card, USB key
   Time varying password
Issues
   How to validate
   How to read (i.e. infrastructure)
Case Study – RSA SecureID

Claimed - Something You Have
  Reduced to something they know
How it works:
  Seed
  Synchronization
Compromises:
  RSA Break-in
  Or man in the middle
Implication of Authentication Failures
Implication of Authentication Failures

Access to data (confidentiality or integrity)
 as if attacker were the authorized user.
For one system, or for many systems.
  Failure can propagate through system.
  Don’t depend on a less critical system.
How Authentication Fails

Stolen Credentials
  – Passwords
  – Cards / devices
  – Copied biometrics
• The role of malicious code
  – GP devices can not protect credentials
Problems of e-mail authentication

And password recovery
- General email security is weak
  - Emails can be intercepted
  - Or are sent to a compromised account

  - http://abcnews.go.com/Business/online-
    security-time-upgrade-
    passwords/story?id=36223462
Implications of password reuse

If users use same password on multiple
   systems.
- The security of the users account on any system
  becomes dependent on the security of the weakest
  system used with that password.

- https://thestack.com/security/2016/02/03/t
  aobao-hack-20-59-million/
Implications of Data Compromise

The biggest reason most people are
 concerned with data breach is:

              ?
Implications of Data Compromise

The biggest reason most people are
 concerned with data breach is:
  The data is used for authentication
    Social Security Numbers
    Credit Card Numbers
    PINs
Addressing Data Compromise

Don’t collect the data
  – If you don’t need it
  – Design systems so you don’t need it
Don’t use the data for authentication
  – Why do we use public information for
    authentication:
      • Mothers maiden name
      • Password reset information
      • SSN
Why such poor practices

Internet services require scalability to be viable.
Automation provides that scalability.
Effective Customer service does not.

It is all about avoiding personal contact with the
    customer, which would require more staff.
The future of second factors

What do we have

Who takes responsibility
  This is a major stumbling block
  Responsibility means liability
Back to Identification

Identification is important for attribution
   – Audit trails and logs
   – Identifying wrongdoers
• Identification can be wrong
   – Attacks facilitated through
     compromised machines
   – IP Addresses that change
Points of Identification

Biometric Data
Surveillance Data
Internet Addresses
MAC Addresses
Payment details
Implications

http://www.networkworld.com/article/26836
  92/microsoft-subnet/is-swat-raid-on-
  wrong-house-based-on-open-wi-fi-ip-
  address-unconstitutional.html
Audit and Detection

Identification data is recorded in audit logs
  routinely together with observed actions
   – Accesses, authentication attempts,
     failures, etc.
Systems use tools to process this audit
  data and alert on suspicious actions.
Attack Detection
• External attacks
  – Password cracks, port scans, packet spoofing, DOS
    attacks

• Internal attacks
  – Masqueraders, Misuse of privileges
Attack Stages
• Intelligence gathering
   – attacker observes the system to determine vulnerabilities
      (e.g, port scans)
• Planning
   – decide what resource to attack and how
• Attack execution
   – carry out the plan
• Hiding
   – cover traces of attack
• Preparation for future attacks
   – install backdoors for future entry points
Intrusion Detection

• Intrusion detection is the problem of
  identifying unauthorized use, misuse, and
  abuse of computer systems by both
  system insiders and external penetrators

• Why Is IDS Necessary?
IDS types
• Detection Method
   – Knowledge-based (signature-based ) vs
     behavior-based (anomaly-based)
• Behavior on detection
   – passive vs. reactive
• Deployment
   – network-based, host-based and application -
     based
Components of ID systems

• Collectors
   – Gather raw data
• Director
   – Reduces incoming traffic and finds relationships
• Notifier
   – Accepts data from director and takes appropriate action
Examples of Detection
The Anonymity Debate

• Should we be required to identify ourselves when
  using the internet?
  – What about other situations

  – Event:
  – https://www.bleepingcomputer.com/news/security/windo
    ws-drm-files-used-to-decloak-tor-browser-users/

• Authentication of Attributes vs Identity
   – Over 21, but without showing your DL
• Use of Internet Cafes
What shall you do if Compromised

            What to do when your companies systems are
            attacked will depend on many factors, but most
            importantly:
                   What you have done to prepare.
                   – Emergency Response Plan
                   – Emergency Response Team
                   – How the system has been set up
                     • Backups, Data Collection for Forensics, Baselines
                     • Your containment architecture

                                                                           42
An NSA Center for Academic Excellence - Research
Are we less secure today
            No: It is the environment that has changed
                     – Users today demand instant and universal access to everything they
                       can get.
                     – In the past, data was better protected because it wasn’t accessible
                     – Some data was better protected because no-one collected it to begin
                       with.

            Understanding this can help you prepare
              – Develop a containment architecture
              – Different data can have different
                accessibility
              – Collect and distributed data to mitigate the
                impact of the inevitable breach

                                                                                        43
An NSA Center for Academic Excellence - Research
Containment Architecture Action PLAN

            Conduct an Inventory – of data
                     –    What Kinds of Data do you have in your business
                     –    How is it handled and where is it handled
                     –    Who needs access to this data
                     –    Which systems need access to this data
                     –    How is it protected in transit, and in situ

                                                                            44
An NSA Center for Academic Excellence - Research
Containment Architecture Action PLAN

            Conduct an Inventory – of physical assets
                     – What Kinds of systems do you have
                        • E.g. POS terminals, servers, network hardware
                     – Understand the access to each system
                        • Employees, customers, etc
                     – How are the different classes of systems protected from one another
                        • Network zones, etc
                     – How do you contain breaches to particular zones.

                                                                                         45
An NSA Center for Academic Excellence - Research
COLLECT BASLINE INFO ON ALL
                           ASSETS
            Software and system checksums
              – Used to detect changes to the system
              – To identify which assets are affected
              – To enable recovery – reinstall those affected
                 systems
            Baseline data communication from all assets
              – In you network infrastructure, use this to
                 identify
                 anomalous flows
              – As they happen to block exfiltration
              – From Logs to identify where data went and
                 how much, and over what time periods

                                                                46
An NSA Center for Academic Excellence - Research
This much PREPARATION CHANGES
                        THE STORY
            From:
            XYZ corporation is the latest company to report
            that the personal information of 70M customers
            may have been compromised.
            TO:
            XYZ corporation reports that users of its beach
            city store between October 1st and 3rd may
            have been affected by …

                                                          47
An NSA Center for Academic Excellence - Research
After a breach: Containment
                    – You will need to shut down or take offline
                      those systems affected by the breach
                      (those you can no longer trust) to prevent
                      further loss of data.
                    – Collect forensic data to assist in
                      assessing impact, to identify attackers,
                      and for prosection.
                    – Stronger containment (from preparation
                      phase) means fewer critical services that
                      you need to take offline.

                                                                   48
An NSA Center for Academic Excellence - Research
After a breach: Notification

            • California Breach Law SB-1386
              November 2003 If personal information
              is stolen and not encrypted, the business
              has a fiduciary responsibility to advise
              every client or customer and employee
              their information has been compromised.
            • SB-24 Addendum to SB-1386 January
              2012 The business must also notify DOJ
              and provide particulars of how the
              information was stolen, when, how.
                                                                    49
An NSA Center for Academic Excellence - Research
After a breach: analysis
                    – Check for changes to your systems and data.
                    – Use forensic data collected using technologies in
                      place from your planning phase to identify
                      sources of the attack, and the techniques used.
                    – Use this information to determine which
                      customers data and which systems were
                      affected.
                    – Use this information to fix the vulnerabilities in
                      your existing systems.
                    – Subject to legal requirements, share this
                      information as appropriate with the authorities
                      and the security community.

                                                                       50
An NSA Center for Academic Excellence - Research
After a breach: recovery
                    – Systems/data must be restored to a trusted
                      state.
                      • Using backups
                      • Legitimate updates to data may need to be
                         reapplied
                    – Vulnerably used in the attack must be patched
                      before systems are brought back online.
                    – You need a plan for operating your business for
                      some period without the impacted systems.
                      • Part of your planning phase

                                                                      51
An NSA Center for Academic Excellence - Research
What if I’m a small business
                    – Some parts of your operation are likely
                      outsourced
                    – Carefully vet your providers, apply the same
                      standards here, and ask how they address
                      them.
                    – Consider using multiple sources so that you
                      can switch from one to another in the event of a
                      breach that it outside your control.
                    – Insist that they have containment architectures
                      that better protect your information while it is in
                      their hands.

                                                                     52
An NSA Center for Academic Excellence - Research
What Technology should I deploy

                    – Audit and intrusion detection
                    – Encryption throughout the systems
                      • Data in transit and data on disk
                      • As close to the source as possible
                    – System mapping/configuration tools
                      • Align with your containment architecture
                    – Effective identity and policy management
                    – Configuration management systems

                                                              53
An NSA Center for Academic Excellence - Research
Weekly Current Event Assignment
Beginning in week 2 students should find a current event regarding
security or privacy (preferably privacy) in the news and and me a
URL, title, and three sentence write-up which we will discuss in
class. The write-up should be sent to me before 7AM the morning
of our lecture. These will be due from all students for each class
and will count toward you class participation grade.
We will discuss all submissions in class and you will be called on
to provide additional information about your submission.

Example:
Google's Art Selfie App Offers A Lesson In Biometric Privacy Laws – NPR 1/18/18
Story explains why the Art Selfie app is not available to users in Illinois or Texas.
Explains the unintended consequences of privacy legislation. – Your name
Current Events
UAE used cyber super-weapon to spy on iPhones of foes Reuters 1/30/19
     U.S. government intelligence operatives working for the UAE were able to subvert iPhones of prominent
     foreign leaders using a sophisticated spying tool known as "Karma." This tool is thought to exploit a flaw
     in iMessage that allowed for the implantation of the malicious tool without any user interaction (iPhone
     security updates at the end of 2017 reduced the effectiveness of Karma). Photos, emails, text
     messages, saved passwords, and location information were all obtainable using the Karma tool.
     -- Aaron Howland

Indian Digital Privacy in Jeopardy - TheDiplomat.com-1/29/2019
     A one-year delay in approving overarching privacy regulations in India has opened the flood gates for new
     initiatives to be passed which pose threats to privacy, free speech, and investment. This could also pose a
     threat/deterrent to Indian businesses as more layers of regulation must be complied with. -- Dewaine Reddish

AIG of Japan raised its cyber insurance limits to 137 thousand dollars. Prtimes 2/1/19
     AIG of Japan announced that it will raie its cyber insurane limimts to 137 thounsand dollars. The new plan will
     start on February 5th. Background of the newly raised plan is that increasing of forensic investigation cost for
     privacy data breach incidents. AIG of Japan provides cyber insurance service from 2012, mainly for medium
     sized enterprises. Risks of monetary damages and costs for ivestigaion are continusly increasing. -- Fumiko
     Uehara

                                                                      55
Current Events
PRIVACY GROUPS CLAIM ONLINE ADS CAN TARGET ABUSE VICTIMS - WIRED - 1.27.2019
    Complex bidding process behind online behavioral advertising threatens consumers’ privacy and the
    way personal data is handled during the process of matching advertisements to ad slots may not comply
    with the GDPR. For instance, the list of labels agreed upon by the Interactive Advertising Bureau, a
    trade group that establishes industry norms, includes categories like incest/abuse support, gay life, hate
    content, substance abuse, and AIDS/HIV. This has enormous implications for the digital marketing
    industry including key solutions within the sector like Google AdWords and Google’s Authorized Buyer
    Program, and the third parties that leverage these tools to run 5campaigns. - Arjun Raman
Google Also Exploited Apple's Backdoor for Data Collection Tech Crunch 1/30/2019
    Similar to Facebook, Google exploited Apple’s employee only app distribution system to collect user data.
    Although much clearer on their intentions than Facebook, this still violates Apple’s policy. Balance between
    privacy and financial rewards systems. — Lance Aaron See

Mozilla security policy cracks down on creepy web trackers, holds supercookies over fire The Register 1/29/19
     Mozilla is planning on limiting the ability of websites and other online services to track users using the Firefox
     browser. Mainly, it is focusing on tracking techniques that users cannot control, such as stateful identifiers used
     by third parties to build a user profiles, URL tracking, and supercookies. Firefox will not immediately be blocking
     all behaviors, but is taking a stance to protect their users from being tracked. -- Charlene Chen

                                                                       56
Current Events - IoT
The doorbells have eyes: The privacy battle brewing over home security cameras – 1/31/2019
The Washington Post
      A man was licking a family’s doorbell for 3 hours on earlier January. Washington is paying up to $500 for security cameras
      on private property. Washington, Amazon, Google, etc. care about privacy, but there are ethical problems such as point
      the camera neighbors, sharing on social media, police involving, deleting issue, hacking camera, etc. -- Sophia Choi

Pwn the LIFX Mini white – liitedresults.com
      IoT devices are consuming our lives more and more, but what do you do when one of those devices fail? Do
      you just throw it away? You shouldn’t. In this recent article by “LimitedResults” he/she explains that your smart
      devices may be holding up precious information in just plain text. - Louis Uuh

The Spy Inside Your Car-Fortune 1/24/19
     Voice-recognition systems in cars will soon be able to integrate personal assistants like Amazon Alexa, Apple's
     Siri, and Google's Assistant on the go, but how that data is used is yet to be determined. The threat to privacy is
     that as recognition improves with accents and dialects, companies will have greater insight into consumer
     desires. A concerning threat is that there is a lack of clarity regarding who will control the collected data. -
     Jacqueline Dobbas

                                                                           57
Current Events - Microsoft
Microsoft 365 gets new compliance and data privacy features                        VentureBeat 1/31/2019
     Microsoft 365 by Microsoft is a product used by businesses/enterprises/ universities to provide Microsoft products across
     the given organization. This article discusses new ways Microsoft is focusing on ensuring data privacy for its users. The
     biggest update is the "dedicated workspace" that helps administrators enforce regulatory obligations and other data
     privacy features. The launch of these features was directly motivated by GDPR.
     Joseph Mehltretter

A Vulnerability in Microsoft Exchange Could Allow for Privilege Escalation
- Center for Internet Security, Inc. 01/29/2019
     A vulnerability has been discovered in Microsoft Exchange which could allow for privilege escalation.
     Successful exploitation of this vulnerability could allow for privilege escalation to the Domain Admin
     account. - Sevanti Nag

                                                                          58
Current Events - Apple
Can we trust tech giants with our faces? Google, Amazon and Microsoft can't agree
on how to protect us. USA Today (no link provided)
     Face recognition, powered by artificial intelligence, could allow the government to supercharge surveillance by automating identification and tracking.
     Authorities could use it to track protesters, target vulnerable communities (such as immigrants), and create digital policing in communities of color that are already
     subject to pervasive police monitoring. So how are the world's biggest technology companies responding to this serious threat to privacy, safety and civil rights?
     -- Gene Zakrzewski

Apple's bug could help u listen to friend's conversation over facetime without actually being on a call – The Verge
     Apple's facetime is a very popular app and when everyone was lauding apple for its strong stand on privacy, there is now a serious bug which allows users to eves
     drop on others' conversations without actually being on the call with them. If you see your iPhone ringing with a FaceTime video call, it’s possible that the person
     calling you could listen to your microphone before you’ve picked up and it could also transmit your video and this is a serious privacy breach. While we wait for a
     fix, the temporary workaround is only to turn off facetime and it can have many people to be affected. -- Kavya Sethuraman

Apple's iOS 12.1.4 Update to Fix FaceTime Eavesdropping Bug Showing Up in Analytics - MacRumors 01/31/2019
     An update to the recent FaceTime bug that allows users to eavesdrop on others. The bug allows users to invade the privacy of others if they use the Group
     FaceTime feature. Apple disabled the group chat feature and is planning to roll out a fix this week. - Abdulla Alshabanah

How Apple could miss a privacy-invading FaceTime security flaw The Verge 1/29/2019
     Apple Facetime is reported to have a privacy invading problem that allows callers to eavesdrop on receivers without their agreement to answer the call. The article
     explains how a typical test method called "fuzzing" in which negative inputs are fed into the system would not have caught the bug because of the UI (user
     interface) nature of the bug. Quality assurance testing with real world scenarios are also ineffective in this case as most people do not usually call their own number
     after calling someone. -- Yulie Felice

                                                                                                     59
Current Events - Apple
Apple's empty grandstanding about privacy 01/31/2019
   Expresses the author's opinions that while Tim Cook advocates privacy, Apple still deals with companies that
   allegedly violate customers' privacy. Example - Safari routing to Chrome for which Apple paid Google $9 billion in
   2018. I thought this made for an interesting read, especially since the last two lectures a lot of people(myself
   included) came up with current events related to Tim Cook advocating privacy. -- Anupama Sakhalkar

   Although Tim Cook, Apple's CEO, said that "We at Apple believe that privacy is a fundamental human right", but
   the company enables the surveillance that supposedly offends its values. Apple claims that personal data serve
   only to enrich the companies that collect them. However, if Apple really wants to protect customers' privacy, they
   could offer a serious substitute for their own apps (e.g. maps), instead of providing data to third parties.
    -- (Mindy) Huang

https://www.theatlantic.com/technology/archive/2019/01/apples-hypocritical-defense-data-
privacy/581680/
    This is a article about a recent incident between Apple and Facebook. Facebook has been incentivizing its
    users, particularly teenagers, to download a research application that collects large amounts of information
    about them. Apple found this to be a violation of privacy and revoked Facebook’s permission to distribute these
    kinds of applications via iPhone. The author discusses whether Apple should take a look at its own practices as
    well. -- Ann Bailleul

                                                                     60
Current Events - Facebook
Facebook’s Plan to Merge Instagram, Messenger and WhatsApp Raises Privacy Concerns Inside Sources 1/29/2019
    Facebook's announcement of merging Facebook, WhatsApp, and Instagram has raised a lot of attention to
    users being concerned about their privacy. Facebook, known as the top privacy violator, is now planning to
    merge multiple platforms, and that will facilitate Facebook in accessing more of users' private data to benefit
    from. Germany and Ireland were the first countries to respond to Facebook's announcement and question it in
    regards to privacy changes and causes of the integration - Faris Almathami

EU data watchdog raises concerns over Facebook integration TheGaurdian | 01/28/2019
      After being battered by scandals, Mark Zuckerberg plans on integrating Messenger, Instagram and WhatsApp.
      According to sources these applications would be standalone however the underlying technical infrastructure will be unified. This would give an opportunity for 2.6 billion users to
      communicate across the platform. According to the Irish commission that regulates the social network in the EU, Facebook’s plan to merge will raise significant data protection
      concerns. Under GDPR, a company may designate one national regulator as its “lead supervisory authority”, to prevent it having to deal with 28 separate regulators; for Facebook,
      Ireland’s DPC takes that role. The Data Protection Commission has asked for an urgent briefing with Facebook Ireland so it can assess the proposals. “The Irish DPC will be very
      closely scrutinizing Facebook’s plans as they develop, particularly insofar as they involve the sharing and merging of personal data between different Facebook companies.
       -- Deepti Siddagangappa

Illinois Supreme Court: No ‘Actual Harm’ Required for Biometric Information Privacy Act Claims – CyberAdvisor 1/29/19
     The Illinois Supreme Court held on January 25, 2019, that plaintiffs filing suit under the Biometric Information Privacy Act—which regulates how private entities
     disclose and discard biometric identifiers—do not need actual damages for standing. The decision has serious implications for companies collecting biometric data
     from Illinois residents. The Act provides a private right of action to individuals “aggrieved” by any violation, allowing them to seek, among other remedies, liquidated
     or actual damages, attorneys’ fees, and costs. However, there has been widespread uncertainty as to whether an aggrieved individual asserting a private action
     under the Act needed to show that he or she suffered an actual injury as a result of an alleged violation, or if a violation of the Act in and of itself conveys standing.
     -- Gene Zakrzewski

                                                                                                              61
Current Events - Facebook
People say they care about Facebook's privacy scandals, but their actions show they don't — here's what that means for other
tech giants CNBC 1/31/19
      Write-Up: Despite the harsh media criticisms and public outcries about Facebook’s string of issues regarding privacy, they
      reported great quarterly earnings for Q4 of 2018. For example, in Europe Facebook faced lots of disapproval of their
      Cambridge Analytica scandal; as well as issues with complying to GDPR. Despite this, data shows that there is a
      resurgence of European users going back to the platform; perhaps showing a willingness on users’ behalf to forgo their
      concerns and continue using the platform. For other companies, seeing Facebook’s bottom line being minimally affected
      by the scandals could reduce their concerns about questionable privacy practices affecting their bottom line.
       -- Kate Glazko

                                                                           62
Current Events – Apple/Facebook
Apple leaves Facebook offices in disarray after revoking app permissions - The Guardian 1/31/19
     The article discusses how apple has revoked Facebook's enterprise developer certificate after finding out that
     they were using a loophole to harvest users data. Facebook Research would route traffic through the company's
     own servers and because it had been built as an "internal" enterprise app Facebook had unrestricted access to
     all data. Apple keeps pushing its focus on users privacy when using the iPhone. -- Ahmed Qureshi

Facebook pays teens to install VPN that spies on them TechCrunch (01/29/19)
    This article talks about how Facebook has been using third party companies to recruit teens and young adults to
    install VPN's to track their mobile usage. Facebook told TechCrunch that it would immediately shut down the app
    on iOS but Apple said that it actually banned the app before Facebook even did this. This shows what people will
    do to sell their privacy ($20/month) - Chloe Choe

Apple takes down Facebook’s Research App – C|Net 1/30/2019
     This story talks about how Facebook was paying up to $20 a month “to access a user’s phone and web activity
     for marketing research”. Though that seems to be legal, one of the main points of contention is the age
     demographic of these users, which range from 13 – 35. Facebook claims that nothing was being misrepresented
     as the title of the app said it was for research, there were waivers and documentation signed, and that less than
     5% of participants were teens. Privacy experts are concerned with the amount of privacy that users are willing to
     give away. -- Jairo Hernandez

                                                                      63
You can also read