INF529: Security and Privacy In Informatics Social Networks Prof. Clifford Neuman Lecture 6 21 February 2020 OHE 100C Course Outline • What data is out there and how is it used • Technical means of protection • Identification, Authentication, Audit • The right of or expectation of privacy • Social Networks and the social contract – February 21st • Criminal law, National Security, and Privacy – March 6th • Big data – Privacy Considerations – March 13th • Civil law and privacy Regulations – March 27th • International law and conflict across jurisdictions – April 3rd • The Internet of Things – April 10th • Technology – April 17th • Other Topics – April 24th • The future – What can we do – may 1st March 6th Presentations Criminal Law, National Security, and Privacy Presentations on March 6th • Various elements related to national security and policing use of information. • Glenn Johnson • Madhuri Jujare • Joshua Vagts • Shagun Bhatia • Anthony Cassar • Haotian Mai • Harshit Kothari • Tejas Pandey • Uddipt Sharma March 13th Presentations Privacy Considerations in Big Data and AI • Kaijing Zhang • Brendan Chan • Aashray Aggarwal • Dwayne Robinson • Di Rama • Zhejie Cui • Zishu Wang New Readings • [CAS] Cloak and Swagger: Understanding Data Sensitivity Through the Lens of User Anonymity. • [Levemore] Saul Levemore, "The Offensive Internet: Speech, Privacy, and Reputation" • [Nissenbaum] Helen Nissenbaum, "Privacy in Context: Technology, Policy, and the Integrity of Social Life" Social Networks and Social Media Services that Enable us to: – Share our thoughts and experiences – Record intricate details of our lives – Create communities of like minded individuals – Manage our relationships with others online. The intersections of technology with social interaction. Bulletin Boards, AOL, Myspace, Facebook, Twitter, Instagram, SnapChat, and many related services. But also includes email and the rest of the web. Threat Vectors – Social Media Our use of social media – dissemination Others use of social media – retrieval Monitoring and surveillance of Social Media False information in social media Reputation and permanence Many forms of impersonation Inferences from network analysis Social Engineering through Social media What we Post Pay careful attention to what you post through social media. We include much information we might otherwise think of as private. We think it is going to only our friends We think it is ephemeral Remember what information is out there: Fortune Teller How Our Data is Used Surveillance through Social Media Social Media Surveillance Could Have a Devastating Impact on Free Speech. Here's Why. Surveillance through Social Media – Good or Bad • FBI’s near-brush with suspect in Florida school shooting draws scrutiny What is “actionable”. Is this prosecuting “pre-crime” Today’s Presentations Privacy in Social Networks Presentations on February 21st • Various elements related to specifically social networks and/or how this data is used. • Instagram Policy - Chinmaya Pandit • Instagram Security/Privacy - Venkat Ramana Reddy Mareddy • TikTok - Ziwei Zhao • Surveilance - Christopher Samayoa • Targeted Ads - Abhishek Tatti • User Data on Social Media - Shanice Williams SOCIAL NETWORKS Chinmaya Pandit • Instagram Privacy Policy • Instagram Security and Privacy • Privacy and Security of TikTok • Social Media and Surveillance • Privacy in Targeted Ad Generation • Privacy Concerns With User Data On Social Media INSTAGRAM PRIVACY POLICY CHINMAYA PANDIT Agenda • What Is Instagram • Instagram’s Privacy Policy • Information Collected • How Is The Information Used • How Is The Information Shared • How Ads Work On Instagram • Transparency Reports • Data Storage And Retention • What’s up with Instagram • References About IG A platform for quality pictures and videos What to use Insta for? • Follow • Feed • Likes and comments • Stories • DM Privacy Policy A privacy policy is a statement or a legal document that discloses some or all of the ways a party gathers, uses, discloses, and manages a customer or client's data. Effective date: January 19, 2013 • https://www.instagram.com/about/legal/privacy/before-january-19- 2013/ Effective date: November 1, 2017 • https://help.instagram.com/581066165581870 Data Collected Type of Data Information users provide directly • Creating a new account: Email address, username, password, user profile information, language, user content, location of a photo, communication with Instagram • Find friends: Social media sites, contact lists • Payment Information: card number, authentication information, shipping and billing address, contact details Type of Data Information collected automatically • Usage of the service • Device Information: IP Address, device identifiers, model of the device, mobile operator or ISP, storage available, hardware- software versions, battery level, signal strength, connection speed • In some cases: Information about other devices nearby. • Device operations: mouse movements, window information, • Bluetooth signals, beacons, cell towers, nearby Wi-Fi access points, Access to GPS location, • Cookies • Metadata: hashtag, geotag, friends, groups, actions, login details, purchases Type of Data Information provided by others • Log in with Facebook, Google • APIs, SDKs, Facebook Pixel • Analytics Providers • Third party Advertisers • Web pages visited, add-ons, web-beacons How Is This Information Used? • Saved: So you will not have to enter it when you re-visit • Metrics: Total number of visitors, traffic • Detect and fix technical problems • Auto-updates of the application • Hashtags are collected for certain Events • Personalize –News feed, Instagram feed, Instagram stories and Ads • Consistent experience on all Facebook products • Location information for improving Ads • Testing and improving the product • To verify account, detect and prevent spam, detect suspicious activities, violation of terms and policies • To conduct and support research and innovation • To communicate with the customers How Is The Information Shared ➢ The information is not shared without user content except with the following parties: • Affiliates • Service Providers and Vendors • Third Party Partners • Analytics Services – Can Use Anonymization And Data Aggregation • Advertisers – Reports • Measurement Partners • Researchers And Academics • Law enforcement • Legal Requests ➢ Public information can be shared with anyone – Even if they don’t have an account! ➢ User Content – Users can decide (Public or Private accounts, close friends) How Ads Work On Instagram? • Shows Ads relevant to you – people you follow, things you like • Instagram doesn’t share information with advertising partners or advertisers that personally identifies you unless you give us permission Personally identifiable information (PII) is information like your name or email that can by itself be used to contact you or identify who you are Transparency Reports • Valid subpoenas, court orders, and search warrants required for obtaining records • May voluntarily disclose information to law enforcement where there is a good reason to believe that the matter involves imminent risk of serious physical injury or death • Legal Process Requests Requests we receive from governments that are accompanied by legal process, like a search warrant. We disclose account records solely in accordance with our terms of service and applicable law. • Emergency Disclosure Requests In emergencies, law enforcement may submit requests without legal process. Based on the circumstances, we may voluntarily disclose information to law enforcement where we have a good faith reason to believe that the matter involves imminent risk of serious physical injury or death. Data Storage And Retention • Information stored and transferred in any other country in which IG, its Affiliates and Service Providers maintain facilities. • Instagram can not ensure the security of any information you transmit to Instagram or guarantee that information on the Service may not be accessed, disclosed, altered, or destroyed. • Following termination or deactivation of your account, Instagram, its Affiliates, or its Service Providers may retain information (including your profile information) and User Content for a commercially reasonable time for backup, archival, and/or audit purposes. • If you remove information that you posted to the Service, copies may remain viewable in cached and archived pages of the Service, or if other Users or third parties using the Instagram API have copied or saved that information. • Content you delete may persist for a limited period of time in backup copies and will still be visible where others have shared it. What’s up with Instagram? • 'Instagram Privacy Policy Changes' is a Hoax • Where did the likes go? • How to mess with IG's Tracking Algorithm Recent Privacy Breaches • Instagram confirms security issue exposed user accounts and phone numbers ! References • Wikipedia • Google • Instagram Privacy Policy THANK YOU ! FIGHT ON ☺ INSTAGRAM SECURITY AND PRIVACY VENKAT RAMANA REDDY MAREDDY Data? ▪Names and passwords of account holders. ▪Captured content, such as photos and videos. ▪Data that links users to the photos they took, tagged or liked. ▪Text message history, address book contacts or other similar personal information. ▪Metadata on how people use the Instagram mobile app. ▪Transactional data from Facebook products and services. ▪Facial recognition data. ▪Data on which devices are linked to which accounts. ▪Geolocational data. Use of Data What Is Instagram's