You: For Sale

Protecting Your Personal Data and Privacy Online

Stuart Sumner

• Publisher: Syngress
• Year: 2015
• ISBN:
  9780128034231
• Topic: Computer Science
• Subtopic: Cyber Security
• Index: Computer Science

Everything we do online, and increasingly in the real world, is tracked, logged, analyzed, and often packaged and sold on to the highest bidder. Every time you visit a website, use a credit card, drive on the freeway, or go past a CCTV camera, you are logged and tracked. Every day billions of people choose to share their details on social media, which are then sold to advertisers.

The Edward Snowden revelations that governments - including those of the US and UK – have been snooping on their citizens, have rocked the world. But nobody seems to realize that this has already been happening for years, with firms such as Google capturing everything you type into a browser and selling it to the highest bidder. Apps take information about where you go, and your contact book details, harvest them and sell them on – and people just click the EULA without caring. No one is revealing the dirty secret that is the tech firms harvesting customers' personal data and selling it for vast profits – and people are totally unaware of the dangers.

You: For Sale is for anyone who is concerned about what corporate and government invasion of privacy means now and down the road. The book sets the scene by spelling out exactly what most users of the Internet and smart phones are exposing themselves to via commonly used sites and apps such as facebook and Google, and then tells you what you can do to protect yourself. The book also covers legal and government issues as well as future trends.

With interviews of leading security experts, black market data traders, law enforcement and privacy groups, You: For Sale will help you view your personal data in a new light, and understand both its value, and its danger.

• Provides a clear picture of how companies and governments harvest and use personal data every time someone logs on
• Describes exactly what these firms do with the data once they have it – and what you can do to stop it
• Learn about the dangers of unwittingly releasing private data to tech firms, including interviews with top security experts, black market data traders, law enforcement and privacy groups
• Understand the legal information and future trends that make this one of the most important issues today

Chapter 1

Introduction

Abstract

This chapter introduces the key concepts of online privacy, outlining why and how internet and app users’ privacy is threatened. Includes specific, real world examples of hacking attacks and privacy breaches.

Keywords

Privacy

Google

Internet

security

hacker

app

Hotmail

economy

currency

Facebook

Twitter

law

Contents

Why all this Fuss About Privacy? 1

Here’s My Cow, now Where’s My Change? 2

Hey I Thought this Lunch was Free! 5

Why should We care About Privacy? 8

Caution: Hackers at Work 11

Serious Business 13

References 15

Why All this Fuss About Privacy?

Does privacy really matter? In fact, do we all agree on what it actually is? As Paul Sieghart said in his 1975 book ‘Privacy and Computers’, privacy is neither simple nor well defined. “A full analysis of all its implications needs the skills of the psychologist, the anthropologist, the sociologist, the lawyer, the political scientist and ultimately the philosopher,” wrote Sieghart.

For our purposes we’ll dispense with the committee necessary for this full analysis, and start with a summary of the definition which came out of the International Commission of Jurists in Stockholm in May 1967:

‘The right to privacy is the right to be let alone to live one’s own life with the minimum degree of interference.’

That statement may be around 50 years old, but it still hits the right note. Then there’s the Universal Declaration of Human Rights, signed by the UN a few years earlier in 1948:

“No one shall be subjected to arbitrary interference with his privacy, family, home, or correspondence.”

Privacy is also enshrined in national laws. Under US Constitutional law it’s considered to be the right to make personal decisions regarding intimate matters (defined as issues around faith, moral values, political affiliation, marriage, procreation, or death).

Under US Common Law (which is the law to come out of the courtroom – where legal precedents are routinely set and followed), privacy is defined as the right of people to lead their lives in a manner that is reasonably secluded from public scrutiny, whether that scrutiny comes from a neighbor, an investigator, or a news photographer’s for instance.

Finally, under US statutory law, privacy is the right to be free from unwarranted drug testing and electronic surveillance.

In the UK the legal protection of privacy comes from the ‘Privacy and the Human Rights Act 1998’, which basically corresponds to the rights conferred under the 1948 UN declaration. But the law is changing, and we’ll explore how in chapter 7.

As we shall see, literally every aspect of these definitions of privacy is under attack from both public and private organizations today. Individuals’ privacy is being eroded at an alarming rate. In fact, some commentators are even beginning to ask if there can be such a thing as privacy in a world of cookies, government surveillance, big data and smart cities (to name just a handful of recent technology trends in part culpable for the situation).

And it’s not just commentators and experts who are fretting about the privacy-free world we appear to be unwittingly signing up to. The results of the Pew Research Internet Project of 2014 reveal that 91 per cent of Americans believe that consumers have lost control of their personal information. They trust the government only slightly more; 80 per cent agreed that Americans should be concerned about the government’s monitoring of their communications, which we’ll explore in the next chapter.

A White House Big Data Survey from May 2014 shows that 55 per cent of respondents in the EU and 53 per cent in the US see the collection of big data (which can be used to identify individuals from supposedly anonymized data) as a negative.

Privacy is an aspect of our freedom. It’s about being free to think and act with autonomy, and where desired, without those thoughts and actions being broadcast to others.

This book aims to explain how and why privacy is under threat, and give some basic recommendations for individuals, corporations and governments to follow in order to arrest this slide towards a world that is less free.

Here’s My Cow, now Where’s My Change?

What’s better than a great product at a reasonable price? What about a great product for free? It sounds too good to be true, and it is, and yet that’s the lie that’s repeatedly sold to all of us who use the internet or download apps to our tablets and smartphones. It’s such an obvious duplicity that you’d think more of us would see through it. That we don’t is a result of the way our brains are wired, but before we come to that, let’s have a brief look at the path humanity has taken in its history to bring us to this point.

Next time you pass a dairy farm, you could surprise and delight your friends by remarking that it’s an early form of bank (neither surprise nor delight guaranteed). That’s because the earliest form of currency is thought to be cattle. If you don’t possess the ability to mint coins or at least make something that’s easy and cheap to reproduce accurately yet hard to copy, a cow is a pretty good substitute. As something which produces milk and can be slaughtered for meat, leather and various other products, it has its own value. Despite small variances in size, one cow is pretty much as valuable as another. You can even get change from a cow – in many early economic systems it was considered to be worth two goats.

This worked well enough for many societies from about 9,000BC to 1,200BC, until they were replaced by Cowrie shells. After all, it’s great having a form of currency you can eat when times get tough, but it’s less good when your entire life savings gets wiped out by disease or is devoured by a pack of wolves or even hungry neighbors.

Cowrie shells – egg-shaped shells belonging to a species of sea snail common to the coastal waters of the Indian and Pacific Oceans - were popular because they were almost impossible to forge, portable, and neither too rare to stymie trading, nor so common that even an egg was worth several wheelbarrow-loads (and if that was the exchange rate, how would anyone have transported enough shells to afford the wheelbarrow?). The classical Chinese character for money (

) originated as a stylized drawing of a cowrie shell, and they are still used today in Nepal in a popular gambling game.

Things became more recognizable to us in modern societies in 1,000BC when China first began to manufacture bronze and copper coins, originally designed to resemble Cowrie shells to help people grasp what they were for. Five hundred years later came electrum (an alloy of gold and silver) coins in Sardis, the capital city of ancient Lydia (an area which roughly corresponds to Turkey today).

Paper money first appeared in China in 806 AD, during the Tang dynasty. It’s interesting to wonder what those financial pioneers would have made of the fact that their idea endures over 1,400 years later.

You might think your credit card is a relatively recent invention, but plastic money has been used in various forms since the late 19^th century when celluloid ‘charge coins’ were used by some hotels and department stores to enable transactions to be charged to their clients’ accounts.

Credit cards as we know them now however were first used in September 1958 when Bank of America launched the somewhat unimaginatively named ‘BankAmericard’ in Fresno, California. This eventually became the first successful recognizably modern credit card and nineteen years later changed its name to Visa.

That’s the past, but what of the future of money? Some believe it to be digital currency, the most recognizable example of which today is Bitcoin, an open-source, online software payment system unaffiliated to any central authority or bank. Anyone can download the software and use their computer to help verify and record payments into a public ledger, sometimes being rewarded with bitcoins themselves for their efforts.

Others see potential in the smartphone as a wallet, with its near-field communication capabilities enabling transactions at the push of a button or simple wave in the air. If you’ve ever suffered the inconvenience of losing your smartphone, or worse having it stolen, then the prospect if it also being your wallet might leave you with a knotted feeling in your stomach and an empty feeling in your bank account, in which case you might prefer the idea of a chip embedded under your skin, or even a barcode branded onto your arm.

There are apps which claim to offer simpler ways of transacting money, and many mainstream services are now diversifying into cash transfers: Facebook, Twitter and Snapchat to name a few.

These would be free services, because nothing is precisely the amount modern online consumers expect to pay for anything. So how would these offerings make money? One way is serving advertising, and another is to sell the data they collect on their customers. Information like what size of transaction you tend to make, when you tend to make them, and what you tend to buy. Snapchat in particular has a sketchy recent history as a guardian of personal data. The popular app (and ‘popular’ hardly does it justice, with over 700 million photos and videos shared each day) allows users to send data in the form of pictures, videos and written messages to one another. So far so pedestrian, but the supposed unique selling point is that the pictures are permanently deleted after a few seconds. Neither the receiver of the image, nor Snapchat itself can retrieve the picture once it has been deleted. Or at least, that’s the idea. In practise it’s the work of moment for a savvy user to make a permanent record whatever appears on their screen – for example by activating the phone’s screenshot mode, or by using a third party app specifically designed for the task (an example of which is SnapBox, an app designed to allow users to keep Snapchat images without the sender’s knowledge). And worse, in October 2014 a hacker published 12.6 gigabytes of images stolen from Snapchat’s users, none of which were ever supposed to have been recorded in the first place.

However in this instance Snapchat itself isn’t to blame. The breach itself occurred when now defunct third party site Snapsaved.com - which contained archived photos and videos from some Snapchat users - was attacked. However, Snapchat itself is guilty of a failure to act when in August 2013 Australian security firm Gibson Security alerted it to a vulnerability. In December that same year Snapchat finally put what it called mitigating features in place to plug the hole, but a few days later a hacking group bypassed the security measures calling them “minor obstacles”, and then released 4.6 million Snapchat usernames and passwords in via a website called SnapchatDB.info. Snapchat apologized a week later.

But whichever economic system wins out, and the likelihood is that it will be some combination of all of the above, the one certainty seems to be that the illusion of a free lunch will continue.

Hey I Thought this Lunch was Free!

Have you ever downloaded Angry Birds to a mobile device? How carefully did you read the user agreement that flashed up before you started catapulting creatures across the screen? If you didn’t so much as glance at it, then you’re with the vast majority of people, but in this case there is scant safety in numbers, the entire herd is being preyed upon, and most are totally oblivious.

We’re picking on Angry Birds here as it’s a common example, but most of this applies to many of the most common and well-known apps and other online services popular today, and no doubt to tomorrow’s apps currently in development.

By the beginning of 2014 Angry Birds had been downloaded over 1.7 billion ti...