Search

What is the optimum balance between surveillance and privacy? During peak study hours, finding a quiet study space in a university library can be difficult and time-consuming. With an app that shows the occupancy of each library on a college campus, students could efficiently target their searches. To support the proposed mobile app, a computer vision model running on live camera feeds from each library floor would enumerate people in each study space. Users could consult the app to find areas with vacant study spaces. A design specification for such an app was developed and presented in a technical report. In the United States, government agencies and private companies collect vast personal data. Since the coronavirus pandemic, rising internet use and public awareness of data privacy have stimulated greater resistance. Data privacy advocates resist indiscriminate data collection through whistleblowing and litigation, and by developing accessible consumer privacy tools.

An important event that once again brought to the forefront issues related to mass surveillance was the judgment of the Court of Justice of the European Union (hereafter referred as CJEU) delivered on July 16, 2020 in the case of Data Protection Commissioner v. Facebook Ireland Ltd. and Maximilian Schrems (Schrems II). It can be considered as the first serious precedent in the field of surveillance, which is aimed at ensuring privacy in the field of national security. Therefore, it becomes an important issue to assess its impact on the legal framework of international transfers of personal data and on the level of privacy protection. The impact of the judgment on the level of privacy protection and mass surveillance is particularly important now that CОVID-19 contact tracing programs are being widely used. In this research we try to trace the formation of the approach to mass surveillance in the case-law of CJEU before and after the Schrems II. We also try to point out some of the difficulties that the process of cross-border data transfer will face after the Schrems II. The main question of the study is whether the approach of the CJEU developed in the Schrems II will actually increase the privacy protection against mass surveillance. We conclude that the Schrems II is an important decision with serious consequences that go beyond the direct impact on data transfer between the EU and the US. It can have controversial influence of the level of privacy protection. Together with the positive trend of formation of more harmonized global data protection standards it can create many unresolved problems in the field of international data transfer and in economic dimension.

For mass surveillance, the algorithm substitution attacks (ASAs) are serious security threats to the symmetric encryption schemes. At CRYPTO 2014, Bellare, Paterson, and Rogaway (BPR) formally developed the security notions of decryptability, undetectability, and surveillance and presented a unique ciphertext symmetric encryption scheme against all possible ASAs. At FSE 2015, Degabriele, Farshim, and Poettering (DFP) relaxed the correctness of decryptability and presented an input-triggered ASA, which meets the BPR security definitions but violates the security of the BPR unique ciphertext scheme. Hence, DFP refined the security notions of detectability and subversion resistance to remove their ASA from the BPR unique ciphertext scheme. At CCS 2015, Bellare, Jaeger, and Kane (BJK) also developed the security notion of key recovery to make the input-triggered ASA infeasible. We investigate ASAs on the symmetric encryption scheme. Our contribution is twofold. (1) We propose a new trigger ASA against the symmetric encryption scheme . Our proposed ASA cannot be captured by the BJK security definitions. Comparatively, the DFP security definitions can detect our proposed ASA. In the view of ASAs, this result demonstrates that the DFP security definitions are not identical to the BJK security definitions. (2) We improve the DFP definition of subversion resistance . DFP proved that the BPR unique ciphertext scheme defeats the input-triggered ASA under their subversion resistance definition. However, we show that the BPR unique ciphertext scheme fails to meet the DFP subversion resistance definition due to our proposed ASA. Therefore, an improved definition on subversion resistance is proposed to cover all existing trigger ASAs. We prove that the BPR unique ciphertext scheme is secure under our improved definition. Therefore, we believe that our improved definition is more suitable to evaluate the ASA security of the symmetric encryption scheme.

Algorithm substitution attack (ASA) on signatures can have severe consequences as the authentication services of numerous systems and applications rely on signature schemes. In this paper, we present a highly efficient ASA on the widely-used digital signature algorithm (DSA). Compared with the generic ASAs on signature schemes proposed in the literature, our attack provides fast and undetectable subversion, which can extract the user's private signing key by collecting the maximum three signatures arbitrarily. Moreover, our ASA is proven to be robust against state reset. We implemented the proposed ASA by replacing the original DSA in Libgcrypt (a popular cryptographic library used in many applications) with our subverted DSA. Our experiment shows that the user's private key can readily be recovered once the subverted DSA is used to sign messages. In our implementation, various measures have been considered to significantly reduce the possibility of detection through comparing the running time of the original DSA and the subverted one (i.e. timing analysis). To our knowledge, this is the first implementation of the ASA in practice, which shows that the ASA is a real threat rather than only theoretical speculation.

Diagnostic testing to identify patients infected with severe acute respiratory syndrome coronavirus 2 (SARS-CoV-2) plays a key role to control the coronavirus disease (COVID-19) pandemic. While several countries have implemented the use of diagnostic testing in a massive scale as a cornerstone for infection control and surveillance, other countries affected by the pandemic are hampered by its limited testing capacity. Pooled testing was first introduced in the 1940s and is now used for screening in blood banks. Testing is done by pooling multiple individual samples together. Only in the case of a positive pool test would individual samples of the pool be tested, thus substantially reducing the number of tests needed. Several studies regarding their use for SARS CoV-2 have been done in the United States, Israel, and Germany. Studies have shown that an individual positive sample can still be detected in pools of up to 32 samples, and possibly even 64 samples, provided that additional polymerase chain reaction (PCR) amplification cycles are conducted with a sensitivity of 96%. Simulation studies to determine optimal pool size and pooling techniques have also been conducted. Based on these studies, pooled testing is shown to be able to detect positive samples with sufficient accuracy and can easily be used with existing equipment and personnel for population-wide screening.

Trabajo de fin de Grado. Grado en Derecho. Curso académico 2019-2020, [ES] Uno de los hechos clave a nivel político de la última década fueron las revelaciones hechas por Edward Snowden acerca de los programas que los Estados Unidos junto con otros Estados venían llevando a cabo con el objetivo de interceptar comunicaciones relevantes realizadas a través de cualquier medio, ya fuera telefónico o a través de Internet. Aunque de la existencia de algunos se tiene constancia desde principios del siglo XXI (ECHELON), otros han sido desarrollados y descubiertos en esta última década. Su objetivo aparente es la lucha contra el terrorismo, y de hecho, desde el ataque de Al Qaeda a las Torres Gemelas en septiembre de 2001, han proliferado enormemente. Sin embargo, esconden todo un entramado de espionaje político que ha alcanzado incluso a Presidentes y Primeros Ministros de importantes países, y en ocasiones ha sido empleado para que empresas nacionales de los involucrados logren ventajas económicas en el mercado. Frente a esto, en Europa se ha reforzado la protección de los ciudadanos ante estas amenazas mediante la obligatoria adhesión de los Estados miembros de la Unión Europea al Convenio Europeo para la Protección de los Derechos Humanos, con base en el cual el Tribunal Europeo de Derechos Humanos ha establecido los requisitos que deben reunir las legislaciones nacionales para respetar los derechos fundamentales de sus ciudadanos., [EN] One of the main politic facts in the last decade was the revelations made by Edward Snowden about the programs that the United States with other States have been made with the objective of the interception of important communications made by any way of communication: by phone or by the Internet. Even if the existence of some of them was known since the beginning of the 21st century (ECHELON), some of them has been developed and discovered in the last century. Their apparent objective is the fight against terrorism, and, in fact, since the Al Qaeda attack to the Twin Towers in September of 2001, it has proliferated hugely. However, they hide a complicated politic espionage network that has reach Presidents and First Ministers of many important countries, and sometimes it has been used for the benefit in the market of national business. In front of that threats, Europe has improve in the protection of the citizens, by the necessary adhesion of the European Union members to the European Convention on Human Rights, which is the main base for the European Court of Human Rights to create the requirements that national legislations must respect in order to protect the fundamental human rights of their citizens.

Trabajo de fin de Grado. Grado en Derecho. Curso académico 2019-2020 [ES] Uno de los hechos clave a nivel político de la última década fueron las revelaciones hechas por Edward Snowden acerca de los programas que los Estados Unidos junto con otros Estados venían llevando a cabo con el objetivo de interceptar comunicaciones relevantes realizadas a través de cualquier medio, ya fuera telefónico o a través de Internet. Aunque de la existencia de algunos se tiene constancia desde principios del siglo XXI (ECHELON), otros han sido desarrollados y descubiertos en esta última década. Su objetivo aparente es la lucha contra el terrorismo, y de hecho, desde el ataque de Al Qaeda a las Torres Gemelas en septiembre de 2001, han proliferado enormemente. Sin embargo, esconden todo un entramado de espionaje político que ha alcanzado incluso a Presidentes y Primeros Ministros de importantes países, y en ocasiones ha sido empleado para que empresas nacionales de los involucrados logren ventajas económicas en el mercado. Frente a esto, en Europa se ha reforzado la protección de los ciudadanos ante estas amenazas mediante la obligatoria adhesión de los Estados miembros de la Unión Europea al Convenio Europeo para la Protección de los Derechos Humanos, con base en el cual el Tribunal Europeo de Derechos Humanos ha establecido los requisitos que deben reunir las legislaciones nacionales para respetar los derechos fundamentales de sus ciudadanos. [EN] One of the main politic facts in the last decade was the revelations made by Edward Snowden about the programs that the United States with other States have been made with the objective of the interception of important communications made by any way of communication: by phone or by the Internet. Even if the existence of some of them was known since the beginning of the 21st century (ECHELON), some of them has been developed and discovered in the last century. Their apparent objective is the fight against terrorism, and, in fact, since the Al Qaeda attack to the Twin Towers in September of 2001, it has proliferated hugely. However, they hide a complicated politic espionage network that has reach Presidents and First Ministers of many important countries, and sometimes it has been used for the benefit in the market of national business. In front of that threats, Europe has improve in the protection of the citizens, by the necessary adhesion of the European Union members to the European Convention on Human Rights, which is the main base for the European Court of Human Rights to create the requirements that national legislations must respect in order to protect the fundamental human rights of their citizens.

Wastewater-based epidemiology (WBE) is an approach that can be used to estimate COVID-19 prevalence in the population by detecting severe acute respiratory syndrome coronavirus 2 (SARS-CoV-2) RNA in wastewater. As the WBE approach uses pooled samples from the study population, it is an inexpensive and non-invasive mass surveillance method compared to individual testing. Thus, it offers a good complement in low- and middle-income countries (LMICs) facing high costs of testing or social stigmatization, and it has a huge potential to monitor SARS-CoV-2 and its variants to curb the global COVID-19 pandemic. The aim of this review is to systematize the current evidence about the application of the WBE approach in mass surveillance of COVID-19 infection in LMICs, as well as its future potential. Among other parameters, population size contributing the fecal input to wastewater is an important parameter for COVID-19 prevalence estimation. It is easier to back-calculate COVID-19 prevalence in the community with centralized wastewater systems, because there can be more accurate estimates about the size of contributing population in the catchment. However, centralized wastewater management systems are often of low quality (or even non-existent) in LMICs, which raises a major concern about the ability to implement the WBE approach. However, it is possible to mobilize the WBE approach, if large areas are divided into sub-areas, corresponding to the existing wastewater management systems. In addition, a strong coordination between stakeholders is required for estimating population size respective to wastewater management systems. Nevertheless, further international efforts should be leveraged to strengthen the sanitation infrastructures in LMICs, using the lessons gathered from the current COVID-19 pandemic to be prepared for future pandemics.

In a big and modern city, the security system is not a single-layered single module system. Instead, it consists of many layers with autonomous subsystems which are capable of interfacing reciprocally in an efficient and coordinated way horizontally and vertically. The design of such indigenous subsystems and ensuring tight interaction between them while taking into account high usability and resource utilization is not a simple task. In this regard, this article provides a comprehensive overview of the security systems in smart cities. We begin by introducing trends and key stakeholders in smart cities. Next, we provide examples of mass surveillance systems in developed countries like the USA, UK, and China. Finally, we highlight some of the major challenges in the practical realization of smart cities. The concepts and security aspects discussed in this study can be beneficial in designing security systems for future smart cities. peerReviewed

This work introduces a new class of Algorithm Substitution Attack (ASA) on Symmetric Encryption Schemes. ASAs were introduced by Bellare, Paterson and Rogaway in light of revelations concerning mass surveillance. An ASA replaces an encryption scheme with a subverted version that aims to reveal information to an adversary engaged in mass surveillance, while remaining undetected by users. Previous work posited that a particular class of AEAD scheme (satisfying certain correctness and uniqueness properties) is resilient against subversion. Many if not all real-world constructions – such as GCM, CCM and OCB – are members of this class. Our results stand in opposition to those prior results. We present a potent ASA that generically applies to any AEAD scheme, is undetectable in all previous frameworks and which achieves successful exfiltration of user keys. We give even more efficient non-generic attacks against a selection of AEAD implementations that are most used in practice. In contrast to prior work, our new class of attack targets the decryption algorithm rather than encryption. We argue that this attack represents an attractive opportunity for a mass surveillance adversary. Our work serves to refine the ASA model and contributes to a series of papers that raises awareness and understanding about what is possible with ASAs.

These days we are in the middle of a huge scandal about NSA fighting against terrorism by running a massive surveillance program. Mister Eduard Snowden, a former NSA employee, revealed classified documents that clearly show how NSA is targeting the communications of everyone by collecting, storing and filtering the data in various ways.

Part 2: Critical Reflections; International audience; With the growing utilization of “smart” technologies, social media and “Internet of Things” applications, citizen-government interactions are rapidly changing. These changes have substantially transformed participatory models where governments apply e-participation measures not necessarily for participatory goals. As cosmetic e-participation applications and mass online surveillance increase in scope, there is a critical need to re-assess the applicability of dominant frameworks of analysing participatory practices. The paper aims to provide a nuanced understanding of the role of the internet in citizen-government interactions in authoritarian contexts based on a critical assessment of dominant participation models. It first maps key analytical typologies and models of public participation based on an extensive literature review. This is intended to help identify potential models that explain public participation—or lack thereof—in authoritarian contexts. The outcomes of this review are (1) revealing a scholarly gap of substantial policy relevance on e-participation in authoritarian contexts, and (2) assessing the applicability of dominant e-participation analytical models in such contexts. The findings indicate that, in the digital era, the transformations in citizen-government interactions lack contemporary understanding. Based on this comparative review, an analytical framework is proposed which extends and adapts Arnstein’s ladder of participation to the digital era. The paper argues that the proposed model helps better understand emerging practices of citizen-government interaction, especially in authoritarian contexts, but also in some democratic contexts where e-participation measures are utilized for mass-surveillance or as political façade.

Legal frameworks exist within democracies to prevent the misuse and abuse of personal data that law enforcement authorities obtain from private communication service providers. The fundamental rights to respect for private life and the protection of personal data underpin this framework within the European Union. Accordingly, the protection of the principles and safeguards required by these rights is key to ensuring that the oversight of State surveillance powers is robust and transparent. Furthermore, without the robust scrutiny of independent judicial review, the principles and safeguards guaranteed by these rights may become more illusory than real. Following the Edward Snowden revelations, major concerns have been raised worldwide regarding the legality, necessity and proportionality standards governing these laws. In 2014, the highest court in the EU struck down the legal framework that imposed a mandatory duty on communication service providers to undertake the mass retention of metadata for secret intelligence and law enforcement authorities across the EU. This article considers the influence of the Snowden revelations on this landmark judgment. Subsequently, the analysis explores the significance of this ruling for the future reform of EU law governing metadata surveillance and its contribution to the worldwide debate on indiscriminate and covert monitoring in the post-Snowden era.

This article aims to introduce the contributions to the monograph "The challenges of collective action in the post-Snowden era: readings from Latin America" ​​and is intended to promote further discussion in our social and cultural context. Techno-surveillance is located in the center of a regulatory system of relationships, interactions, and behaviours in contemporary societies. We argue that state institutions, Internet Service Providers, industries of personal data and surveillance, and the media are acting as articulated forces. Technological, financial, narrative, and legal devices are created to legitimate surveillance. The implications are reflected in the production of laws, artifacts, events, discourses, imaginaries, cultural practices, bodies and places for surveillance. Surveillance questions our understanding of privacy, freedom of expression, security, social relations, and the exercise of citizenship. Targeted and mass surveillance shape both public and private spheres. This fact demands a reflection on the possibilities of collective action and resistance. Analytical frameworks are needed to identify the mechanisms and implications of the surveillance society. Este artículo busca por una parte, introducir las contribuciones que forman parte del monográfico “Los desafíos de la acción colectiva en la era post-Snowden: lecturas desde América Latina” y por otra, hacer un llamado a continuar el debate en nuestro contexto sociocultural. La tecnovigilancia se encuentra en el centro de un sistema regulatorio de las relaciones, interacciones y conductas del sujeto en la sociedad contemporánea. Partimos de la premisa de que existe una articulación de fuerzas entre las instituciones del Estado, las empresas proveedoras de servicios de telecomunicaciones, la industria de los datos personales y la industria mediática que construyen dispositivos tecnológicos, financieros, narrativos, analíticos y jurídicos para la legitimación de la vigilancia. Los resultados se plasman en leyes, la construcción de imaginarios, eventos, discursos, artefactos, formas de interacción y espacios para vigilar. La vigilancia selectiva y masiva ocupan las esferas pública y privada, ponen en discusión la comprensión sobre la intimidad, la libertad de expresión, la seguridad, las relaciones sociales, el ejercicio de la ciudadanía. Esta coyuntura demanda una reflexión sobre los ejes de la resistencia y las posibilidades de la acción colectiva, su análisis en el marco de las sociedades de control y la identificación de los mecanismos que entran en juego para su ejecución. Este artigo procura, por um lado, introduzir as contribuições que integram este número especial “Os desafios da ação coletiva na era pós-Snowden: leituras a partir da América Latina” e, por outro, incentivar a continuidade do debate em nosso contexto sociocultural. Na sociedade contemporânea, a “tecnovigilância” está no centro de um sistema regulador das relações, interações e condutas do sujeito. Partimos da premissa de que existe uma articulação de forças – entre instituições do Estado, empresas provedoras de serviços de telecomunicações, indústria de dados pessoais e indústria midiática – que constrói dispositivos tecnológicos, financeiros, narrativos, analíticos e jurídicos para a legitimação dessa vigilância. Os resultados se plasmam em leis, em construção de imaginários, eventos, discursos, artefatos, formas de interação e espaços para vigiar. A vigilância seletiva e massiva ocupa as esferas pública e privada; põe em discussão o entendimento sobre a intimidade, a liberdade de expressão, a segurança, as relações sociais, o exercício da cidadania. Esta conjuntura exige uma reflexão sobre os eixos de resistência e as possibilidades de ação coletiva; uma análise sob o marco das sociedades de controle e a identificação dos mecanismos que entram em jogo para sua execução.

Las revelaciones de Snowden han arrojado luz sobre un conjunto de programas de vigilancia masiva que recogen grandes cantidades de datos personales, consistentes en información de metadatos, así como contenido de comunicaciones de personas de todo el mundo. Este informe pretende revisar los programas de la NSA más renombrados y las contramedidas asociadas. Les revelacions de Snowden han llançat llum sobre un conjunt de programes de vigilància massiva que recullen grans quantitats de dades personals, consistents en informació de metadades, així com contingut de comunicacions de persones de tot el món. Aquest informe pretén revisar els programes de la NSA més famosos i les contramesures associades. Snowden's revelations have shed light on a large set of secret mass surveillance programs that were and are collecting huge amounts of personal data, consisting of metadata information and communications contents from people around the world. This report aims to review the most renowned NSA programs and the associated countermeasures.