Chapter 5, Tracking and Surveillance Lorrie Faith Cranor, Manya Sleeper, Blase Ur This is the authors’ draft of a chapter that will appear in the IAPP Privacy and Information Technology text book, expected to be published in 2013. 5.1. Introduction ............................................................................................................................... 2 5.2. Internet Monitoring ................................................................................................................. 3 5.2.1. An Overview of Computer Networking ..................................................................................... 3 5.2.1.1. Packets and IP Addresses .......................................................................................................................... 3 5.2.1.2. Email ................................................................................................................................................................... 4 5.2.1.3. The HTTP and HTTPS Protocols ............................................................................................................. 4 5.2.2. Network-Scale Monitoring and Deep Packet Inspection ..................................................... 5 5.2.3. Wi-Fi Eavesdropping ....................................................................................................................... 5 5.2.4. Internet Monitoring for Employers, Schools, and Parents ................................................. 6 5.2.5. Spyware ................................................................................................................................................ 7 5.2.6. Preventing Network-Level Surveillance ................................................................................... 7 5.2.7. Best Practices ..................................................................................................................................... 8 5.3. Web Tracking ............................................................................................................................. 8 5.3.1. HTTP Cookies and Web Tracking ................................................................................................ 9 5.3.2. Web Tracking Beyond HTTP Cookies ..................................................................................... 10 5.3.3. Tracking Email Recipients .......................................................................................................... 12 5.3.4. Best Practices .................................................................................................................................. 13 5.4. Blocking and Controlling Web Tracking ......................................................................... 13 5.4.1. Blocking web tracking .................................................................................................................. 14 5.4.1.1. Privacy Settings in Browsers and Do Not Track ........................................................................... 14 5.4.1.2. Web-based Privacy Tools ....................................................................................................................... 15 5.4.1.3. Third-Party Browser Add-ons .............................................................................................................. 15 5.4.1.4. Deciding What to Block ........................................................................................................................... 16 5.4.2. Blocking tracking of web searches .......................................................................................... 17 5.4.3. Blocking email tracking ............................................................................................................... 17 5.4.4. Best practices .................................................................................................................................. 18 5.5. Location Tracking ................................................................................................................... 19 5.5.1. Location-Tracking Technologies .............................................................................................. 19 5.5.1.1. Wi-Fi and cell tower triangulation ...................................................................................................... 19 5.5.1.2. GPS .................................................................................................................................................................... 19 5.5.1.3. RFID ................................................................................................................................................................. 19 5.5.1.4. Phone tracking ............................................................................................................................................ 20 5.5.1.5. Metadata ........................................................................................................................................................ 20 5.5.2. Location-Based Services .............................................................................................................. 20 5.5.2.1. Social Media .................................................................................................................................................. 20 5.5.2.2. Location-Based Applications ................................................................................................................. 21 5.5.2.3. Tracking Kids, Employees ...................................................................................................................... 21 1 5.5.2.4. Location-Based Ads ................................................................................................................................... 21 5.5.2.5. Combining with Data from Other Sources ...................................................................................... 22 5.5.3. Geographic Information Systems ............................................................................................. 22 5.5.4. Preventing and Controlling Location Tracking ................................................................... 22 5.5.4.1. Blocking Location-Based Tracking ..................................................................................................... 22 5.5.4.2. User Controls ............................................................................................................................................... 23 5.5.4.3. Research into Privacy Protections for Location ........................................................................... 23 5.5.5. Best Practices .................................................................................................................................. 23 5.6. Audio and Video Surveillance ............................................................................................ 24 5.6.1 Hidden Cameras and Microphones ........................................................................................... 24 5.6.1.1 Smartphones as Hidden Cameras and Microphones ................................................................... 24 5.6.1.2 Monitoring Through Laptop and Desktop Computers ................................................................ 24 5.6.2 CCTV .................................................................................................................................................... 25 5.6.3 Protecting Against Audio and Video Surveillance ............................................................... 25 5.6.4 Best practices ................................................................................................................................... 25 5.7. Surveillance in Emerging Technologies .......................................................................... 25 5.7.1. Medical Device Surveillance ...................................................................................................... 26 5.7.2. Surveillance of Smart Meters ..................................................................................................... 26 5.7.3. Best Practices .................................................................................................................................. 26 5.8. Chapter Summary ................................................................................................................... 26 5.9. About the Contributors ......................................................................................................... 27 Chapter 5, Tracking and Surveillance Lorrie Faith Cranor, Manya Sleeper, Blase Ur 5.1. Introduction In today’s digital world, both electronic and non-electronic actions and communications have the potential to be tracked and surveilled. Reasons for tracking are manifold. On one level, advertising companies wish to profile users so that they can better target relevant ads. Other groups or individuals might wish to spy on a person for the purpose of blackmail, extortion, or to cause embarrassment. On a grander scale, a government or other organization may hope to gather intelligence to thwart an act of terrorism, or perhaps to spy on a group or individual for more insidious purposes. Our goal in this chapter is to provide IT professionals with a richer understanding of the techniques that enable tracking and surveillance on a number of different levels, alongside an explanation of countermeasures