Entries Tagged "academic papers"

Page 47 of 88

"The Medieval Origins of Mass Surveillance"

This interesting article by medieval historian Amanda Power traces our culture’s relationship with the concept of mass surveillance from the medieval characterization of the Christian god and how piety was policed by the church:

What is all this but a fundamental trust in the experience of being watched? One must wonder about the subtle, unspoken fear of the consequences of refusing to participate in systems of surveillance, or even to critique them seriously. This would be to risk isolation. Those who have exposed the extent of surveillance are fugitives and exiles from our paradise. They have played the role of the cursed serpent of Eden: the purveyor of illicit knowledge who broke the harmony between watcher and watched. The rest of us contemplate the prospect of dissent with careful unease, feeling that our individual and collective security depends on compliance.

[…]

Eight centuries ago, in November 1215, Pope Innocent III presided over a Great Council of the Church in Rome known as the Fourth Lateran Council. It was attended by high-ranking members of the ecclesiastical hierarchy and the monastic world, together with representatives of emperors, kings, and other secular leaders from throughout Christendom. Their decisions were promulgated through seventy-one constitutions. They began with a statement of what all Christians were required to believe, including specifics on the nature of God­by this time: “eternal and immeasurable, almighty, unchangeable, incomprehensible and ineffable”—and the view that salvation could be found only through the Roman Catholic Church. Anyone who disagreed, according to the third constitution, was to be handed over to secular lords for punishment, stripped of their property, and cast out of society until they proved their orthodoxy, or else be executed if they did not. Anyone in authority would be punished if they did not seek out and expel such people from their lands; their subjects would be released from obedience and their territories handed over to true Catholics. There was nothing empty about this threat: the council occurred in the middle of the bitter Albigensian Crusade, during which heresy—likened to a cancer in the body of Christendom—was purportedly being cut out of Languedoc by the swords of the pious.

The Fourth Lateran Council was talking about crimes of thought, of dissent over matters of belief, matters not susceptible of proof. But whether individuals were heretics could not, in theory, be established without investigating the contents of their minds. To this end, the council decreed that bishops’ representatives should inquire in every parish at least once a year to discover “if anyone knows of heretics there or of any persons who hold secret conventicles or who differ in their life and habits from the normal way of living of the faithful.” These representatives were to follow these external indications of nonconformity into the recesses of the mind and establish their meaning in each case. Over the decades the role of the inquisitor was developed into an art and a science, and elaborate handbooks were produced. But in 1215 it was stated merely that individuals should be punished if “unable to clear themselves of the charge.”

[…]

What is all this but a fundamental trust in the experience of being watched? Our trust is so strong that it seems to have found its own protective rationality, deeply rooted in Western consciousness. It’s an addict’s rationality, by which we’re unable to refrain from making public a stream of intimate details of our lives and those of children too young to consent. One must wonder about the subtle, unspoken fear of the consequences of refusing to participate in systems of surveillance, or even to critique them seriously. This would be to risk isolation. It would be a trifle paranoid to reveal less—a little eccentric, not quite rational.

Posted on December 21, 2015 at 1:09 PM • View Comments

How People Learn about Computer Security

Interesting research: “Identifying patterns in informal sources of security information,” by Emilee Rader and Rick Wash, Journal of Cybersecurity, 1 Dec 2015.

Abstract: Computer users have access to computer security information from many different sources, but few people receive explicit computer security training. Despite this lack of formal education, users regularly make many important security decisions, such as “Should I click on this potentially shady link?” or “Should I enter my password into this form?” For these decisions, much knowledge comes from incidental and informal learning. To better understand differences in the security-related information available to users for such learning, we compared three informal sources of computer security information: news articles, web pages containing computer security advice, and stories about the experiences of friends and family. Using a Latent Dirichlet Allocation topic model, we found that security information from peers usually focuses on who conducts attacks, information containing expertise focuses instead on how attacks are conducted, and information from the news focuses on the consequences of attacks. These differences may prevent users from understanding the persistence and frequency of seemingly mundane threats (viruses, phishing), or from associating protective measures with the generalized threats the users are concerned about (hackers). Our findings highlight the potential for sources of informal security education to create patterns in user knowledge that affect their ability to make good security decisions.

Posted on December 10, 2015 at 6:54 AM • View Comments

Voter Surveillance

There hasn’t been that much written about surveillance and big data being used to manipulate voters. In Data and Goliath, I wrote:

Unique harms can arise from the use of surveillance data in politics. Election politics is very much a type of marketing, and politicians are starting to use personalized marketing’s capability to discriminate as a way to track voting patterns and better “sell” a candidate or policy position. Candidates and advocacy groups can create ads and fund-raising appeals targeted to particular categories: people who earn more than $100,000 a year, gun owners, people who have read news articles on one side of a particular issue, unemployed veterans…anything you can think of. They can target outraged ads to one group of people, and thoughtful policy-based ads to another. They can also fine-tune their get-out-the-vote campaigns on Election Day, and more efficiently gerrymander districts between elections. Such use of data will likely have fundamental effects on democracy and voting.

A new research paper looks at the trends:

Abstract: This paper surveys the various voter surveillance practices recently observed in the United States, assesses the extent to which they have been adopted in other democratic countries, and discusses the broad implications for privacy and democracy. Four broad trends are discussed: the move from voter management databases to integrated voter management platforms; the shift from mass-messaging to micro-targeting employing personal data from commercial data brokerage firms; the analysis of social media and the social graph; and the decentralization of data to local campaigns through mobile applications. The de-alignment of the electorate in most Western societies has placed pressures on parties to target voters outside their traditional bases, and to find new, cheaper, and potentially more intrusive, ways to influence their political behavior. This paper builds on previous research to consider the theoretical tensions between concerns for excessive surveillance, and the broad democratic responsibility of parties to mobilize voters and increase political engagement. These issues have been insufficiently studied in the surveillance literature. They are not just confined to the privacy of the individual voter, but relate to broader dynamics in democratic politics.

Posted on November 23, 2015 at 12:03 PM • View Comments

Personal Data Sharing by Mobile Apps

Interesting research:

“Who Knows What About Me? A Survey of Behind the Scenes Personal Data Sharing to Third Parties by Mobile Apps,” by Jinyan Zang, Krysta Dummit, James Graves, Paul Lisker, and Latanya Sweeney.

We tested 110 popular, free Android and iOS apps to look for apps that shared personal, behavioral, and location data with third parties.

73% of Android apps shared personal information such as email address with third parties, and 47% of iOS apps shared geo-coordinates and other location data with third parties.

93% of Android apps tested connected to a mysterious domain, safemovedm.com, likely due to a background process of the Android phone.

We show that a significant proportion of apps share data from user inputs such as personal information or search terms with third parties without Android or iOS requiring a notification to the user.

EDITED TO ADD: News article.

Posted on November 13, 2015 at 6:08 AM • View Comments

Testing the Usability of PGP Encryption Tools

“Why Johnny Still, Still Can’t Encrypt: Evaluating the Usability of a Modern PGP Client,” by Scott Ruoti, Jeff Andersen, Daniel Zappala, and Kent Seamons.

Abstract: This paper presents the results of a laboratory study involving Mailvelope, a modern PGP client that integrates tightly with existing webmail providers. In our study, we brought in pairs of participants and had them attempt to use Mailvelope to communicate with each other. Our results shown that more than a decade and a half after Why Johnny Can’t Encrypt, modern PGP tools are still unusable for the masses. We finish with a discussion of pain points encountered using Mailvelope, and discuss what might be done to address them in future PGP systems.

I have recently come to the conclusion that e-mail is fundamentally unsecurable. The things we want out of e-mail, and an e-mail system, are not readily compatible with encryption. I advise people who want communications security to not use e-mail, but instead use an encrypted message client like OTR or Signal.

Posted on November 12, 2015 at 2:28 PM • View Comments

Analyzing Reshipping Mule Scams

Interesting paper: “Drops for Stuff: An Analysis of Reshipping Mule Scams. From a blog post:

A cybercriminal (called operator) recruits unsuspecting citizens with the promise of a rewarding work-from-home job. This job involves receiving packages at home and having to re-ship them to a different address, provided by the operator. By accepting the job, people unknowingly become part of a criminal operation: the packages that they receive at their home contain stolen goods, and the shipping destinations are often overseas, typically in Russia. These shipping agents are commonly known as reshipping mules (or drops for stuff in the underground community).

[…]

Studying the management of the mules lead us to some surprising findings. When applying for the job, people are usually required to send the operator copies of their ID cards and passport. After they are hired, mules are promised to be paid at the end of their first month of employment. However, from our data it is clear that mules are usually never paid. After their first month expires, they are never contacted back by the operator, who just moves on and hires new mules. In other words, the mules become victims of this scam themselves, by never seeing a penny. Moreover, because they sent copies of their documents to the criminals, mules can potentially become victims of identity theft.

Posted on November 4, 2015 at 1:54 PM • View Comments

1 … 45 46 47 48 49 … 88

Sidebar photo of Bruce Schneier by Joe MacInnis.