Download E-Surveillance and User Privacy

yes no Was this document useful for you?
   Thank you for your participation!

* Your assessment is very important for improving the workof artificial intelligence, which forms the content of this project

Document related concepts

PRISM (surveillance program) wikipedia , lookup

Unix security wikipedia , lookup

Security-focused operating system wikipedia , lookup

Next-Generation Secure Computing Base wikipedia , lookup

Carrier IQ wikipedia , lookup

Deep packet inspection wikipedia , lookup

Information privacy law wikipedia , lookup

Malware wikipedia , lookup

Distributed firewall wikipedia , lookup

Trusted Computing wikipedia , lookup

Cyber-security regulation wikipedia , lookup

Computer security wikipedia , lookup

Mobile security wikipedia , lookup

Medical privacy wikipedia , lookup

Spyware wikipedia , lookup

Privacy International wikipedia , lookup

Computer and network surveillance wikipedia , lookup

Cybercrime countermeasures wikipedia , lookup

E-Surveillance and User
Yvonne Gladden
Lauran Hollar
Tim Kennedy
Grant Wood
• Surveillance – “The act of observing or the
condition of being observed”.
• Electronic Surveillance (US Government FISA) – “the acquisition by an electronic,
mechanical, or other surveillance device of
the contents of any wire or radio
communication …”
License Plate Monitoring
• “The right of individuals to control or
influence what information related to them
may be collected and stored and by whom
and to whom that information may be
Google Street View
Why is it Important?
Impacts virtually everyone
Cell Phones
Personal information
Law Enforcement
Evidence Collection
National Security
Drift Net Type Approach
Keyword Detection
Legal Background
• e-Surveillance is not a new subject that the
courts have had to deal with.
• In 1928 the U.S. Supreme Court ruled on a
case about it.
• In 1934 this ruling was reviewed and
Legal Background
• In 1967 the Supreme Court ruled that the
government could not infringe upon a
persons reasonable expectation of privacy.
• In 1968 Congress codified the requirements
to obtain court authority for interception of
oral and wire communication
• In 1986 this Act was amended to include
electronic communication
e-Surveillance Techniques
Network Monitoring
Compromising Emanations (CE)
Biometrics (hand scanning, iris scanning)
• Various Threat Levels
• Identification Cookies (low)
• Associated (3rd party) Cookies (low – med)
• Application based (medium – high)
Spyware Infections
Key loggers send sensitive
data (i.e. passwords) to
spyware controller
habits, and search
Sends host name, IP
addresses, and computer
Associated Cookies
Delivery of App Based Spyware
• Piggybacking on other software
• Hidden in utility applications
• Execution of ActiveX or Java Applets
Network Monitoring
• Packet Sniffers
• Hardware + Software
• Narus Semantic Traffic Analyzer
• State of the art monitoring software (“Ultimate
Net Monitoring Tool”)
• Linux based
• Used by NSA in monitoring Internet traffic
• Used by ISP’s to perform court-ordered
Compromising Emanations
• TEMPEST – codename referring to study of
• Heavily researched in military applications
• Examples:
• computer monitors (optical, electromagnetic)
• cpu (electromagnetic)
• keyboard (accoustic)
Compromising Emanations
• Soft Tempest
• method for preventing eavesdropping on
monitor emissions
• works by using software to filter off some of
the higher frequencies before they are sent to
the monitor
Soft Tempest Example
• Automated methods of recognizing a person
based on a physiological or behavioral
Use of Biometrics
• Sec. 403(c) of the USA-PATRIOT Act specifically requires the
federal government to "develop and certify a technology standard that
can be used to verify the identity of persons" applying for or seeking
entry into the United States on a U.S. visa "for the purposes of
conducting background checks, confirming identity, and ensuring that
a person has not received a visa under a different name."
• Enhanced Border Security and Visa Entry Reform Act of 2002,
Sec. 303(b)(1), requires that only "machine-readable, tamper-resistant
visas and other travel and entry documents that use biometric
identifiers" shall be issued to aliens by October 26, 2004. The
Immigration and Naturalization Service (INS) and the State
Department currently are evaluating biometrics for use in U.S. border
control pursuant to EBSVERA.
Uses of e-Surveillance Summary
• National Security (Government)
• Carnivore (now defunct)
• Law Enforcement
• Finding Dealers of Child Pornography
• Finding Child Predators
• Corporate Security
• Employee Monitoring
• Internet Advertising
• Spyware
• Malicious Uses
• Identity Theft
• Credit Card Fraud
Techniques for Privacy Protection
• Firewalls
• software or hardware based
• Anti-spyware software
• Ad-Aware, Spybot, PestPatrol
• Encryption
• Tighter Security at OS Level
• Changes to Network Protocols
• System to prevent execution of malicious code on
• Prior to execution, checks hash of binaries against
signature of allowed binaries – if not allowed,
execution denied
• Prevents unauthorized indirect branching
• Protects from buffer overflow attacks
• Cost – 35% performance hit!
• Weakness – Does not protect against scripted
(interpreted) code attacks – Perl, VB, etc
• New approach to user privacy
• Goals
• Allow users to take advantage of new services
without worrying about their private
information being misused
• Structure
• Three additional network layers (sub-layers of
the Application Layer)
• Identity Layer
• Confidentiality Layer
• Policy Control Layer
• Balancing user privacy vs. the need for
• encryption – if it is too good then criminals can
communicate with impunity
• Balancing security and user friendliness
• Volume of Information (Mass Surveillance)
• Legal Issues
• Patriot Act
Moving Forward
• Awareness
• 70% of American computer users claim to have
anti-spyware software on their computer, only
55% actually do
• Only 22% have an enabled firewall, updated
anti-virus software, and anti-spyware software
installed on their computers
Moving Forward
• Pass laws to make it tougher to collect
personal information without consent, and
to prohibit unfair deceptive practices using
• I-SPY ACT (passed three times by House,
currently in Senate committee)
• Privacy will be an ongoing issue
• More capabilities lead to more security and
ethical issues