Upload
galena-ferguson
View
36
Download
2
Tags:
Embed Size (px)
DESCRIPTION
Report to the President Big Data and Privacy: A Technological Perspective. President’s Council of Advisors on Science and Technology May 2014. Part Two: Privacy. IS 376 October 16, 2014. message fromto. message fromto. message fromto. Encryption. - PowerPoint PPT Presentation
Citation preview
REPORT TO THE PRESIDENT
BIG DATA AND PRIVACY:
A TECHNOLOGICAL PERSPECTIVE
President’s Council of Advisors on Science and Technology
May 2014
IS 376OCTOBER 16, 2014
PART TWO: PRIVACY
BIG DATA: PRIVACYIS 376OCTOBER 16, 2014 PAGE 2
ENCRYPTION
messagefrom to
messagefrom to
NETWORKS ARE SET UP TO SEND MESSAGES RIGHT PAST STATIONS THAT AREN’T AUTHORIZED TO READ THEM, BUT
WHAT’S TO PREVENT SUCH UNAUTHORIZED VIEWING?
THE MOST COMMON SOLUTION TO THIS PROBLEM IS ENCRYPTION, WHERE THE MESSAGE IS CODED IN SUCH A WAY
THAT ONLY THE RECEIVING STATION CAN DECODE IT.
BIG DATA: PRIVACYIS 376OCTOBER 16, 2014 PAGE 3
PUBLIC-KEY ENCRYPTION
1.CREATE
MESSAGE
FIRE BAD!FRIEND GOOD!
CHUCKY AMNSGFYDDKDDRACULA DBRIUGNDLWGFREDDY HGWDNCHSGSHJASON HWBSGCYDHZX
2.LOOK UP
RECIPIENT’S PUBLIC KEY
3.ENCRYPT MESSAGE WITH RECIPIENT’S
PUBLIC KEY
XSJB2DHDKWB$XZDUND&HSNQABI?
DSJSG%
4.
TRANSMIT ENCRYPTED
MESSAGE ACROSS
NETWORK
XSJB2DHDKWB$XZDUND&HSNQABI?
DSJSG%
5.DECRYPT MESSAGE WITH RECIPIENT’S
PRIVATE KEY
FIRE BAD!FRIEND GOOD!
BIG DATA: PRIVACYIS 376OCTOBER 16, 2014 PAGE 4
AUTHENTICATION
messagefrom to
HOW CAN A RECEIVING STATION BE SURE THAT A RECEIVED MESSAGE CAME FROM THE SPECIFIED SOURCE?
THE MOST COMMON SOLUTION TO THIS PROBLEM IS AUTHENTICATION, WHERE THE MESSAGE IS CODED IN A WAY
THAT ONLY THE REAL SENDING STATION COULD HAVE ACCOMPLISHED.
BIG DATA: PRIVACYIS 376OCTOBER 16, 2014 PAGE 5
KEY-BASED AUTHENTICATION
1.CREATE
MESSAGE
BE CAREFUL WHEN YOU REMOVE THOSE BANDAGES, DUDE.
THEY’LL RIP THE HAIR RIGHT OFF YOUR
SKIN!2.
ENCRYPT MESSAGE WITH SENDER’S PRIVATE KEY
MA3NDHVYR#BCJAQWPFQKGUIORKFOHSK
XI8VCE%FPGKJFHIKFVDAMXXYEMFIDEYCHSSFHSGDHAHDM$DLGLYN7BU
CHSO
3.
TRANSMIT
ENCRYPTED MESSAGE
MA3NDHVYR#BCJAQWPFQKGUIORKFOHSK
XI8VCE%FPGKJFHIKFVDAMXXYEMFIDEYCHSSFHSGDHAHDM$DLGLYN7BU
CHSO
4.DECRYPT MESSAGE
WITH SENDER’S PUBLIC KEY
BE CAREFUL WHEN YOU REMOVE THOSE BANDAGES, DUDE.
THEY’LL RIP THE HAIR RIGHT OFF YOUR SKIN!
BIG DATA: PRIVACYIS 376OCTOBER 16, 2014 PAGE 6
SYMMETRIC CIPHERS
1.CREATE
MESSAGE
I’M SHOPPING
FOR A DOLL FOR MY
YOUNGUNS!3.
ENCRYPT MESSAGE WITH RECIPIENT’S
PUBLIC KEY
&SADBS1KFBADAAAPRFDGH
9SIJCHZJZJ%NDMSDNDS4
ZZP
4.
TRANSMIT DOUBLY
ENCRYPTED MESSAGE
&SADBS1KFBADAAAPRFDGH
9SIJCHZJZJ%NDMSDNDS4
ZZP
2.ENCRYPT MESSAGE
WITH SENDER’S PRIVATE KEY
TSG#DFJ4FUDBSZVDH?WGFDJED8S
DKJFI
5.DECRYPT MESSAGE WITH RECIPIENT’S
PRIVATE KEY
TSG#DFJ4FUDBSZVDH?
WGFDJED8SDKJFI
6.DECRYPT
MESSAGE WITH SENDER’S
PUBLIC KEY
I’M SHOPPING
FOR A DOLL FOR MY
YOUNGUNS!
ENSURE PRIVACY AND AUTHENTICATION VIA DOUBLE ENCRYPTION!
BIG DATA: PRIVACYIS 376OCTOBER 16, 2014 PAGE 7
NOTICE AND CONSENTTHE MOST COMMON
APPROACH TO ENSURING PRIVACY ON
THE WEB, “NOTICE AND CONSENT” GIVES USERS “NOTICE” THAT
WHAT THEY ARE ABOUT TO DO (INSTALLING SOFTWARE,
ACCESSING DATA, ETC.) CONSTITUTES THEIR “CONSENT”
THAT THEIR PRIVACY BE VIOLATED.
BIG DATA: PRIVACYIS 376OCTOBER 16, 2014 PAGE 8
ANONYMIZATIONEFFORTS TO ANONYMIZE DATA BY EXCLUDING THOSE DATA
FIELDS THAT ARE CONSIDERED DIRECTLY TIED TO AN INDIVIDUAL HAVE MET WITH QUESTIONABLE SUCCESS.
THE PERSONAL GENOME PROJECT (PGP) WAS DESIGNED
TO ACCUMULATE AND PUBLICLY DISPLAY DNA
INFORMATION, BEHAVIORAL TRAITS, MEDICAL CONDITIONS, PHYSICAL CHARACTERISTICS,
AND ENVIRONMENTAL FACTORS OF THOUSANDS OF
VOLUNTEERS IN AN EFFORT TO AID RESEARCHERS IN
ESTABLISHING CORRELATIONS BETWEEN CERTAIN TRAITS
AND TREATMENTS IN PERSONALIZED MEDICINE.
ZipCode
BirthDate
Gender
VoterRegistration
Data
Name
Address
Party Affiliation
Date Registered
PGP Data
Medications
Diagnoses
Procedures
ZipCode
BirthDate
Gender
WHEN CROSS-CHECKED AGAINST VOTER REGISTRATION RECORDS, ANONYMIZED PGP VOLUNTEERS WERE CORRECTLY
IDENTIFIED 84% OF THE TIME.
BIG DATA: PRIVACYIS 376OCTOBER 16, 2014 PAGE 9
NON-RETENTIONONE MECHANISM FOR ENSURING PRIVACY HAS BEEN TO DELETE DATA AFTER A
CERTAIN PERIOD OF TIME, BUT SUCH RESTRICTIONS ARE INCREASINGLY DIFFICULT TO ENFORCE TECHNOLOGICALLY.
SNAPCHAT IS A PHOTO MESSAGING APPLICATION
DESIGNED TO ALLOW USERS TO SEND PHOTOS
THAT WILL ONLY BE AVAILABLE TO RECIPIENTS
FOR A FEW SECONDS.
TO HELP ENSURE PRIVACY, SNAPCHAT NOTIFIES THE USER WHEN A RECIPIENT
TAKES A SCREENSHOT OF THE RECEIVED IMAGE.
VARIOUS NEW APPLICATIONS (SUCH AS
SNAP-SAVE) HAVE BECOME AVAILABLE THAT PERMIT
RECIPIENTS TO SAVE SNAPS PERMANENTLY WITHOUT INFORMING THE SENDER.
BIG DATA: PRIVACYIS 376OCTOBER 16, 2014 PAGE 10
CONTEXT & USETHE PRESIDENT’S COUNCIL OF ADVISORS ON SCIENCE AND
TECHNOLOGY ADVOCATE LESS EMPHASIS ON RESTRICTING THE COLLECTION OF DATA AND MORE ON RESTRICTING ITS USE.
Virtru allows users to send encrypted
e-mail and attachments.
Users may revoke messages, restrict
forwarding, and add expirations.
Administrative functions allow the sender to see
how and where information has traveled.
BIG DATA: PRIVACYIS 376OCTOBER 16, 2014 PAGE 11
ACCOUNTABILITYAS AN EXAMPLE OF RESTRICTING DATA USE RATHER THAN DATA
COLLECTION, THE FAIR CREDIT REPORTING ACT IS A FEDERAL LAW THAT REGULATES THE USE OF CONSUMER CREDIT
INFORMATION.
• CREDIT BUREAUS ARE REQUIRED TO PROVIDE CONSUMERS WITH ANY INFORMATION THEY HAVE ABOUT THE CONSUMERS AND TO VERIFY THE ACCURACY OF INFORMATION DISPUTED BY A CONSUMER.
• UNDER AN AMENDMENT TO THE FCRA, CONSUMERS ARE ABLE TO RECEIVE ONE FREE CREDIT REPORT PER YEAR.
• CREDIT BUREAUS MAY NOT RETAIN NEGATIVE INFORMATION FOR AN EXCESSIVE PERIOD OF TIME, SEVEN YEARS FOR LATE PAYMENTS AND TEN YEARS FOR BANKRUPTCIES.
• CREDIT BUREAUS MAY PROVIDE INFORMATION ONLY TO THOSE WITH A LEGITIMATE NEED, SUCH AS WHEN THE CONSUMER HAS MADE AN APPLICATION TO A CREDITOR, A LANDLORD, OR AN INSURER.
• CREDIT BUREAUS MAY NOT GIVE OUT INFORMATION TO AN EMPLOYER OR A POTENTIAL EMPLOYER WITHOUT THE CONSUMER’S WRITTEN CONSENT.
BIG DATA: PRIVACYIS 376OCTOBER 16, 2014 PAGE 12
CONSUMER PRIVACY BILL OF RIGHTSThe purpose of the Consumer Privacy
Bill of Rights is to deter Internet companies from indiscriminate
collection of personal information for targeted ads.
In response, Internet companies such as Mozilla, Google, Microsoft, Yahoo!, and
AOL promised to provide a "do not track" mechanism so that customers can choose whether they want to participate
in online behavioral advertising.
The Obama Administration encouraged Congress to grant the Federal Trade Commission the authority to enforce
each element of the Consumer Privacy Bill of Rights.