Post Privacy Era

You are no longer
anonymous
This is the Post Privacy Era

Peter Kaptein | Elvira Berlingieri
peterkapten@gmail.com | elvira.berlingieri@gmail.com

Summary
- You are traceable
- Your data-traces tell where
you are / have been
- This will only increase
- The biggest threat is
ignorance
Elvira Berlingieri | Peter Kaptein December 5, 2009 Donnaèweb - Viareggio

Why?

Natural development
- human nature
= Safety
+ Making our life easier


Part one:

How you are
traceable

Three ways

Explicit action
Active devices
Biometry


Three ways

Explicit action
Active devices Database
Biometry


Tracking: Explicit action


Tracking: Active devices

Any radio-
transmitter
with an ID



> Phone IMEI Number


> Bluetooth MAC address


> WiFi MAC address

Tracking: Biometry


Tracking: Biometry

Camera


How it works


Tracking: phone


Making sure you can call

GSM Cell
You

GSM Cell
GSM Cell

What: range+signal strenght

Data
You

Database


Tool: Triangulation

Data
You

Database
Data

Data

“You are here”

Data
You

Database
Data

Data

Tracking: Biometry
Normalization

Database

Set of “coordinates”
representing face

Who?


Tracking: Biometry

Match

Database

Found “face”


Tracking: data buildup

1: Gathering data
2: Matching data
3: Creating proﬁles


Tracking: a city
Phone ID
Payment
Face recog.


Tracking: GSM Cells
GSM Cell
Shop
Camera coverage


Tracking: Camera coverage
GSM Cell
Shop
Camera coverage


Phone ID
Payment
Face recog.

You Friday, 12:45


Phone ID
Payment
Face recog.

Friday, 12:45

Friday, 12:47


Phone ID
Payment
Face recog. 13:50

Phone
Friday, 12:45
call

13:30 12:47

12:52


Tracking: deﬁning actions
Phone ID
Payment
Face recog. 13:50

Purchase 13:45
Phone call Friday, 12:45

13:30 12:47

Purchase 13:25 12:52


Tracking: Matching

GSM Cell data
- Identity
Payment data
- Action
- Location
- Time
Biometric data


Tracking: Data collection
Phone ID
Payment
Face recog.
Other people
You
You Friday, 12:45


Filtering the data
Phone ID
Payment Sunday, 12:45
Face recog. Dam Square
Other people Monday, 14:15
Maybe you Abbey road
You
Tuesday, 09:45
Matches now + past Johns Bagels


Result

phone ID
+ biometrical data (camera)
+ payments + purchased items
= You + your wherabouts


Tracking the car

> GPS based tracking in trucks

Tracking the car

“Bringing back trafﬁc
jams in Holland”

> GPS based tracking in cars

“Phone”
“Car” “Home”

GPS
location
Database


Tracking the Oyster card


Fingerprints on passport

> Holland: as of Sept 21 - on new passport
> Your (biometric) data is stored electronicly

Fingerprints on passport

Database

> Fingerprints also in central database

RFID - directing suitcases


RFID - medical data


You were somewhere else
But your car was
stolen and used to
commit a crime

- Can you prove you
were not there
driving your car?


Identity theft becomes easy
Passport
“Passport”
Copy

> You can copy the electronic content in seconds
> Faking your identity on a scanner is easy with copy

Evyerthing centralized


Is it safe for abuse?


What are the beneﬁts?


Internet delle cose
Already today many tags operate with a 128
bits address ﬁeld that allows
3402823669209384634633746074317682114
56 (≈ 3.4 × 1038) unique identiﬁers, more
than a trillion unique addresses for every
square centimetre on the earth.


Summary

- Automated systems
- Gathering data
- Building histories
- Matching data
- No human hands needed

Who can have access?

Governmental bodies
- Police
- Special (crime) units


Why is this not abused?
Everyone has the right to recognition
everywhere as a person before the law.

No one shall be subjected to arbitrary
interference with his privacy, family, home or
correspondence [...]. Everyone has the right
to the protection of the law against such
interference or attacks.

Declaration of Human Rights

What protects us?


Part two:The private sector

Gathering and selling
data

Bonus cards


Data attached to card

First + last name / age / sex
Marital stage
Address / phone number
Family size / name of relative


Data collected via card
What you bought
When
On sale?
How much money spent in a
week / month / year
Your personal preferences

Value
Marketing info:
- Demographic data
- Geographic data
- Statistics of anything
- Bound by privacy law
You are anonymous

Theft of this data
Black market value
- Demographic / Geographic
- Statistics
- You
- No respect for privacy
You are not anonymous

Data theft also happens in

Telcos



Banks



Governmental bodies



Medical centers


By angry people


Or criminals


Giving info about
- Who you called when
- What you bought where
- How much money you have
- Where you were
- What your medical status is
... and more

Data theft?


Data theft


Part three:

What info can you
link?

Building your proﬁle

You



Prefe-
Medical
rences
Private data
stuff
You Financial
data
Incrimina-
ting stuff
Where- Family
abouts Friends


Literature Consumer
Sexual
Diseases
Photo’s

Prefe- Current
Medical state
rences
Opinions
Private data
stuff Expenses
You Financial
Photo’s data
Incrimina-
Budgets
ting stuff
Where- Family
Sexual
abouts Friends
Connect-
ions
People
Personal
Elvira Berlingieri | Peter Kaptein Commutes
TravelsDecember 5, 2009 data Donnaèweb - Viareggio

XMale Female
Gay X Hetero Bisexual
Age: <5 <10 X <20 <40
Single Married X Living togethe
Address:
Income: <10.000 X <20.000

Possible usage

Hire this person for job
Do not hire for job
Fire


Possible usage

Harmless
Potential criminal
Potential terrorist


Possible usage

Gullible / simple to con
Educated / smart
Avoid


Un nuovo concetto di dato pubblico

Facilità di reperimento delle
informazioni
Accesso remoto (computer,
connessione Internet, motore
di ricerca)


Possibilità del data mining
C. Carter Jernigan and Behram
Mistree '08, electrical
engineering and computer
science, for
Gaydar: Facebook
Friendships Expose Sexual
Orientation

How?
Google searches

GSM Cell data
Bonus card data
Phone calls

Payment data Medical data
Proﬁle database

Whereabouts via
Browsing data
biometric data

Travel data

By governmental bodies


Criminals


Anyone


Anyone: what?
Google searches

GSM Cell data
Bonus card data
Phone calls

Medical data
Payment data
Proﬁle database shared online

Whereabouts via Browsing data
biometric data via cookies

Elvira Berlingieri | Peter Kaptein Travel data
December 5, 2009 Donnaèweb - Viareggio

Part four:

What to expect in
the next 5 years?

Reduction


Fewer cards


One card for many things

RFID


Public
Discounts
transport

Loyalty
programs
Checking
in RFID

Book-
Opening marking
doors

Public Cafe’s
Discounts
transport

Hotels Shops
Loyalty
programs
Checking
in RFID
Restaura
Events
Book-
Opening marking Places
Home doors
Elvira Berlingieri | Peter Kaptein Ofﬁce
December 5, 2009 Objects
Donnaèweb - Viareggio

Phone: more uses
Tracing

Remote
Mobile Control
phone

Payments


Phone: more uses
Via
Roads Tracing application

Flow of Remote
people Control
Streets Mobile
Shopping phone
centers
Via dial in
Payments
Shops

Parking

Storing of data by anyone
Public
Discounts
transport

Database
Loyalty
Checking
in RFID Database

Book-
Opening marking
doors
Database

Private enterprises

Database

RFID Database

Database

The same for phones
IMEI #

Phone #
Mobile
phone


Stored in systems
IMEI #

Phone #
Mobile
phone

Database

Database- Viareggio
Elvira Berlingieri | Peter Kaptein December 5, 2009 Donnaèweb

Buildable by anyone


Not really monitored

Elvira Berlingieri | Peter Kaptein FidoDecember 5, 2009
the watchdog Donnaèweb - Viareggio

Combining data is easy
Mobile
Discounts RFID phone
IMEI #

Loyalty
programs

Phone #
Book-
marking Your
name


Handy for many things
Personal
data
Locations

IMEI #

Photo’s You

Phone #

Friends
Google
data


And for criminals


Using your data against you
5 minutes Proﬁle

Findable IMEI #

You

Phone #
Callable

Usage Con trick


Winning your trust


Based on your online data


Doing a confidence trick

A confidence trick or confidence game is
an attempt to defraud [deceive / damage]
a person or group by gaining their
confidence or trust.

Wikipedia


Part ﬁve:

When things turn
wrong

Copyright lobby / privacy

Three strikes
European community said no


Dystopia

A dystopia is the often futuristic
vision of a society in which
conditions of life are miserable


Dystopia

9/11/2001
“War on terrorism”


Dystopia

1992 - 2009
“War on digital copyright
piracy”


Dystopia

When “security” becomes
more important than privacy


Nuovi modelli di business

 aumento dell’offerta legale (o legalizzata)
dei contenuti protetti
 piattaforme sotto il controllo dei titolari
di diritti


When equality fades

“We are all
equal”
“But some are
more equal
than others”


When this:


Becomes this:


And this:


Eventi

Caso Agenzia delle Entrate
(dichiarazioni dei redditi 2005
scaricabili dal sito: in poche ore erano
sulle reti peer to peer!)
Caso Peppermint (3.636 utenti italiani
di reti peer to peer destinatari di
richieste di risarcimento )


Capacità a delinquere

Art. 133 cp - Gravità del reato: valutazione agli effetti della pena
- Nell'esercizio del potere discrezionale indicato nell'articolo
precedente, il giudice deve tenere conto della gravità del
reato, desunta: 1) dalla natura, dalla specie, dai mezzi,
dall'oggetto, dal tempo, dal luogo e da ogni altra modalità
dell'azione; 2) dalla gravità del danno o del pericolo cagionato
alla persona offesa dal reato; 3) dalla intensità del dolo o dal
grado della colpa. Il giudice deve tener conto, altresì, della
capacità a delinquere del colpevole, desunta: 1) dai motivi a
delinquere e dal carattere del reo; 2) dai precedenti penali e
giudiziari e, in genere, dalla condotta e dalla vita del reo,
antecedenti al reato; 3) dalla condotta contemporanea o
susseguente al reato; 4) delle condizioni di vita individuale,
familiare e sociale del reo.


Fatto notorio

« Art. 115 del codice di procedura civile -
"Disponibilita' delle prove".Salvi i casi
previsti dalla legge, il giudice deve porre
a fondamento della decisione le prove
proposte dalle parti o dal pubblico
ministero.Puo' tuttavia, senza bisogno di
prova, porre a fondamento della
decisione le nozioni di fatto che rientrano
nella comune esperienza. »


Dato personale

- Violazioni diritto d’autore
- Interferenze (illecite) nella
vita privata
- Identity theft (frode,
sostituzione di persona)

http://www.amazon.com/gp/help/customer/display.html?nodeId=200399690&#general

And this is your police:


And these are your rights:


And these are your rights:

“Whites only”


And we will be here?


Part six:

Awareness, not fear

Core:
- Awareness
- Understanding
- Knowledge
- Research

Be aware of what you share

We share a lot of information
Online and to companies


Protect your identity


You can be found

My name is ...


“Drunk ass friend”


Understand consequences

Hire this person for job
Do not hire for job
Fire


Facebook: cosa raccontiamo
di noi?

Foto degli amici su FaceBook, blog ecc.

5/3. Il trattamento di dati personali
effettuato da persone ﬁsiche per ﬁni
esclusivamente personali è soggetto
all'applicazione del presente codice
solo se i dati sono destinati ad una
comunicazione sistematica o alla
diffusione. Si applicano in ogni caso le
disposizioni in tema di responsabilità e
di sicurezza dei dati di cui agli articoli
15 e 31

Art. 2050 cc Responsabilità per

Chiunque cagiona danno ad altri nello
svolgimento di un'attività pericolosa,
per sua natura o per natura dei mezzi
adoperati, è tenuto al risarcimento, se
non prova di avere adottato tutte le
misure idonee a evitare il danno.


What to do:

- Use different aliases
- Only share private info to
people you trust
- Only share what is yours

What to do:

- Do not give or share your
home address if not clear
why
- Lie / fake if you do not trust


What to do:

- Personal stuff online: make it
unreliable / contradictional
- (Your professional proﬁle is
another story)


Only use your own name:

For professional outings


- Awareness
- Understanding
- Knowledge
- Research

Your human rights
Everyone has the right to recognition
everywhere as a person before the law.

No one shall be subjected to arbitrary
interference with his privacy, family, home or
correspondence [...]. Everyone has the right
to the protection of the law against such
interference or attacks.

Declaration of Human Rights

It starts here:


It is evolving here:


Hardly understood here:


Progress


- You are traceable
- Your data-traces tell where
you are / have been
- This will only increase

Keys
- Awareness
- Understanding
- Knowledge
- Research

The biggest threat is
ignorance

Questo siete voi

Da “Batman Begins”, Warner Bros 2005

04/12/09

 Potere di tornare indietro/cancellare da
servizi web così come da devices
 Rettiﬁcare
 Avere controllo dei nostri dati e dei nostri
contenuti


Post Privacy Era

Recomendados

Recomendados

Mais conteúdo relacionado

Mais de Peter Kaptein

Mais de Peter Kaptein (6)

Último

Último (20)

Post Privacy Era