"Modern computing security is like a flimsy house that needs to be fundamentally rebuilt"

Image courtesy NY Times

Zeynep Tufekci has an interesting take on the latest cyber security news in her column entitled The Looming Digital Meltdown. The money quote is this: "Modern computing security is like a flimsy house that needs to be fundamentally rebuilt." Her focus is the chip-based vulnerabilities disclosed last week, but she's talking about cyber security in general. And her point is hard to argue with.

Tufekci has been thinking both deeply and broadly about these topics for quite some time. She's the author of Twitter and Tear Gas: The Power and Fragility of Networked Protest, and her TED talk "We're building a dystopia just to make people click on ads" gets right to the point about the economic incentives that enable the Internet's stalker economy.

The theme of Tufekci's column is that vendors, driven by consumer demand and the frenzy to be first to market, have sacrificed security for speed and convenience. She rightly asserts that this is a solvable problem--and maybe would have already been solved if we simply held our vendors accountable (as we do with airplane travel, for example, or with consumer products).

But I think users have been complicit. By users, I mean people who use Facebook, and who buy smartphones, and who are inevitably attracted to "free" apps and services. I put the word free in quotes because the cost is real but not always evident. The stalker economy, which leads to exploits such as ADINT where by using the same techniques available to advertisers one can easily track friends, relatives and even strangers. We've ceded this power to the technology providers in order to have easy access to social networking apps and other "free" services.

And profit-driven technology is proving more powerful than traditional safety systems. Witness the fact that Uber Can Find You but 911 Can’t. Would we ever have designed such an outcome consciously?

Maybe there's hope on the horizon: Mark Zuckerberg says one of his goals for 2018 is to fix Facebook.

Meanwhile, here on earth, we're left to live with the chip-related vulnerabilities (known as Meltdown and Spectre). There's much hand-wringing that the proposed fixes will slow our systems down--maybe by as much as 30%. But MIT has developed an ad-blocking system that improves web page download times by up to 34%. That sounds like a fair tradeoff to me.

ADINT: Do It Yourself Surveillance

"If it's free you're the product." Most of us have heard this meme often enough, and have a vague understanding that it relates to online ads. But when most of us think about online ads, we think about the occasional annoyance of having to scroll past or otherwise ignore an ad—doing so is assumed to be the price of free online services, and it seems a small price to pay.

If only it were so simple.

Researchers at the University of Washington published a paper at the ACM Workshop on Privacy in the Electronic Society entitled "Exploring ADINT: Using Ad Targeting for Surveillance on a Budget." The subtitle is "How Alice Can Buy Ads to Track Bob." Yes, it's as bad as it sounds. The authors point out that for as little as $1,000, someone can use targeted ads to track the location of specified individuals. The mobile advertising infrastructure allows any attacker with modest means to to "know where the target goes, where they live, and other sensitive information such as what apps they use". Knowledge of what apps are being used can be considered sensitive for a variety of reasons, including mental health conditions, diabetes trackers, dating apps (which can indicate relationship or sexual preferences), political affiliation apps, and religious and church apps.

As I've pointed out before, most people think it's a reasonable trade-off to allow ads to be shown in order to get apps and services for free. But in order to deliver those ads, the ad networks need to learn as much as possible about all of us, so that advertisers know whether it's worth paying to target an ad to any of us (and when and where it should do so). Advertisers have enabled what we can refer to as a stalker economy. If you think it sounds creepy, you're right. And it's also ubiquitous, part of the background noise of being a mobile-phone using netizen. 

This is how Alice can buy ads to track Bob. But what is meant by "ADINT"? The authors invented this term, and I think it's a good one. Whereas the intelligence community refers to human intelligence as "HUMINT" and signals (electronic) intelligence as "SIGINT", the corresponding term for advertising intelligence has been coined by the paper's researchers as "ADINT."

Most of the focus on mobile security has been around malware and network attacks that deliver malware. But malware is rare, whereas the stalker economy, or ADINT, can affect us all. In my previous post, I noted that mobile devices send considerable amounts of data into the cloud, which is to say the data is now in the wild—outside of our ability to track and control it. ADINT represents another threat vector regarding the digital exhaust of our mobile devices. This should worry us.