Editor’s note: Wired for Safety is a weekly column on cybersecurity and other tech issues. Duane Dunston is an assistant professor of cybersecurity and networking at Champlain College. He received his bachelor’s and master’s of science from Pfeiffer College. From 2001 to 2011 he worked in cybersecurity for NOAA. He is a first-year doctoral student at Northeastern University. His other activities include “You Have A Voice,” a project to develop an electronic screening assessment to identify human trafficking victims.
We need to understand information and what can happen when it is disclosed to unauthorized people (that is, a confidentiality breach); modified by unauthorized people (an integrity breach); and made unavailable when needed (an availability breach).
Those are the three foundations of why people need to be aware of cybersecurity threats. We need to take time and ruminate on the consequences of disclosing information, especially when it concerns others.
It is difficult to remain private when so much information is made publicly available, especially due to legal requirements. Someone who wants your address just needs your legal name and date of birth to check voter registration websites. In Vermont, the website lists the voter’s street address. Someone being stalked or escaping an abusive partner, or who is a victim of sexual abuse, may not take this legal requirement lightly.
RECOMMENDATION: The Vermont Safe at Home program does give those who have experienced sexual assault, domestic abuse or stalking a way to prevent the leakage of that information from the voter registration website. This helps prevent a confidentiality breach where someone’s location can be made known publicly.
“I have nothing to hide” is something people often say when it comes to privacy. Those who think this way could cause the disclosure of information about others who need and/or want to have privacy. “I have nothing to hide” could lead to carelessness when deciding what to post on social media, write in an email or public forum, or tell other people.
Consider those who have experienced domestic violence. Like others, they deserve to have contact through social media with friends and family. However, they can choose what to share and whom to share it with. Just because someone goes on vacation with them doesn’t mean they want their photo posted on another’s social media page or their location or posts about domestic violence shared on their page. People who make such posts because they believe they have nothing to hide may unintentionally disregard the privacy of someone else.
RECOMMENDATION: If you try to tag someone in a photo and it doesn’t allow tagging or a message appears that a person doesn’t want to be tagged, don’t post the photo. If you try to share a post and get a message that you can’t due to the person’s privacy settings, respect it — regardless of how passionate you are about what was stated.
If you know someone who doesn’t want to appear in photos online, crop the photo, blur the person out or something else if it is that important to post the photo. Photos can give away the location of someone in several ways, including by revealing surrounding buildings and landmarks.
Details can be revealing
It may be believed that small amounts of information are OK to post or share. However, when small amounts are aggregated, or analyzed and cross-referenced, they can create a big picture.
The word “metadata” is used often these days when discussing privacy. Metadata is a summary of other information: duration of a phone call, the number called, time called, etc. This information may seem trivial, but information has value to someone. In this case, your phone provider for charging purposes, but also law enforcement, private investigators or a snooping partner.
For example, what can you tell about someone’s life from these Google search queries and websites visited?
child waking in the middle of the night
getting your child to sleep longer
entertaining a 2-year-old in Vermont
older brother and younger brother rivalry
essex junction post office hours
You can infer the person has at least two boys and the approximate age, and lives in or near Essex Junction.
Selling this information to advertisers could earn the seller and merchant money through emails, pop-ups, website advertisements or physical mail. Products related to kids and going to sleep — like those projectors that display images on the wall and play music — could start showing up. Vermont gets cold in the winter, so ads also can target products or local services that boys can do inside — at a cost. If you know the psychology of sleep deprivation, imagine the tricks that can be played, like the sweet online deals that show up 2 a.m.
Details are relevant in the photo example too. Posting a photo without specifying the location may seem harmless. However, when you know how to use the information a photo provides, the location could still be determined, such as from metadata that may be inside the photograph. Don’t laugh; see the site I Know Where Your Cat Lives.
Social media sites tend to remove that metadata. But objects, buildings and surrounding scenery can still provide useful information. If you have enough photos and enough surrounding scenery, it is possible to determine someone’s location, their friends, or places they frequent. That’s enough for someone to get close to the person being targeted.
Keep in mind that information has value to someone. Respect someone when they request no photos be posted of them or their children, and no tagging of them in photos. Email is also not a guarantee that the information is safe from prying eyes. Your lack of concern because of “nothing to hide” could lead to exposing information about someone else.