00:00:00.000-->00:00:05.167 >>uh, hello everyone um this was a bit nerve wracking but uh fortunately the slides are 00:00:05.167-->00:00:10.792 working now um, I don’t know about you, but uh we are definitely very excited to be um 00:00:10.792-->00:00:16.000 I want to thank the organizers again for uh having us here um we’re from Germany in case you 00:00:16.000-->00:00:20.958 were wondering about the weird accent and we’re gonna present the project we did last year so 00:00:20.958-->00:00:27.417 um I’m Andreas and I’m a data scientist as it the data analyst and data analysts for this 00:00:27.417-->00:00:33.167 project and um I’m working as a data scientist for a German cyber security organization as 00:00:33.167-->00:00:38.167 well as for seven scientists and I can now um relax a bit because uh we are through the first part 00:00:40.667-->00:00:49.625 of the presentation. [laughter] >>Thank you I’m Svea and I’m a um journalist mainly doing 00:00:49.625-->00:01:04.292 investigative reporting on tech topics and yeah there was uh topic coming up and um just 00:01:04.292-->00:01:10.667 before we dive into it I want to explain why exactly we are here. Um, in this Spring I’ve heard 00:01:10.667-->00:01:21.083 about a severe decision you’ve had here in the US, um it was the US senate who uh voted to 00:01:21.083-->00:01:28.625 eliminate the broadband privacy rules that would have required ISPs to get consumer's explicit 00:01:28.625-->00:01:36.458 consent before selling or sharing their browsing data and in the research we did um just 00:01:36.458-->00:01:42.917 half a year earlier in Germany we learned in a very concrete and very shocking way what it 00:01:42.917-->00:01:50.958 means if somebody is selling your browsing data. So, I just yeah, want to take you with on 00:01:50.958-->00:01:57.250 that journey um maybe you can imagine about yourself, what would you think if somebody’s 00:01:57.250-->00:02:03.042 showing up on your door and saying “Hey, I have your complete browsing history, 00:02:03.042-->00:02:10.250 everyday, every hour, every second, every click you did on the web for the last month” so, 00:02:10.250-->00:02:25.292 that somebody was me [laughter] and uh at at first before I explain how I got that or how we 00:02:25.292-->00:02:33.958 got the data and what else was up with it, I first want to show you a reaction from a person I 00:02:33.958-->00:02:39.958 first confronted with her data. She’s a member from German Parliament, she’s a politician 00:02:39.958-->00:02:51.125 and uh yeah, and I was sitting next to her uh, just, uh it's a video so I, I’m not sure how 00:02:51.125-->00:03:05.333 this is working oh I [laughter] I would love uh yeah you can hear, you can hear it in German 00:03:05.333-->00:03:12.250 when she’s when she’s speaking so but >>so she’s not happy >>yeah, ok so that's what she’s 00:03:12.250-->00:03:22.083 saying basically [laughter] so-sorry guys can we get the video um rolling here um can 00:03:22.083-->00:03:30.792 somebody help me? For the next um, because I need it. Ok so, this is what I showed her, this 00:03:30.792-->00:03:37.833 is uh not a video, this one, but the next one because we want to scroll and dive into her life a 00:03:37.833-->00:03:45.333 little bit more. So what you can see here is uh her browsing history you can see that exactly 00:03:45.333-->00:03:53.042 what she was doing on the 1st of August and uh you can see that she likes to get up early and uh 00:03:53.042-->00:04:00.500 one of the first things she’s doing in the morning is banking and banking. And we can go 00:04:00.500-->00:04:10.333 through her whole browsing um history and that's a video no? Or we can, let’s try if we can 00:04:10.333-->00:04:21.833 get this because what's what you are seeing here oh that’s that's bad, because what you see here 00:04:21.833-->00:04:29.542 is her text declaration it's um in Germany it's called ester and um you can do it online, and 00:04:29.542-->00:04:35.958 it's typically that you do it in August because then the deadline is running out, can you help us 00:04:35.958-->00:04:46.292 with the video because I think would miss so much if we can...Is that the play button? 00:04:46.292-->00:04:54.792 No that's the next, that's the next uh [inaudible voice] a next one to the right, ok this one is 00:04:54.792-->00:05:16.625 a video [inaudible voice] yeah ok, ok that's, ok so what do you think might be all my text 00:05:16.625-->00:05:23.250 declaration maybe yeah maybe thats uh thats bad but what's even more worse especially when 00:05:23.250-->00:05:29.542 you are in a higher position is if you are searching for medication and that's exactly 00:05:29.542-->00:05:35.667 what she did on a day in August sitting in front of her computer she was searching for a med for 00:05:35.667-->00:05:42.292 medication tebonin, when do you take tebonin? You take tebonin when you feel dizzy or you have 00:05:42.292-->00:05:49.500 a tiny tose. So yeah, what was it like for her when I was sitting next to her and showing 00:05:49.500-->00:05:58.000 her her browsing history and saying why do you, why you have been searching for tebonin and 00:05:58.000-->00:06:07.625 she said “mm I-I don’t know why I was searching at the time but this is a really bad thing to 00:06:07.625-->00:06:16.292 see something like this especially if this is connected with your own name” So this went 00:06:16.292-->00:06:24.375 on this story, so, we basically had this data from 3 million German citizens and uh a lot of 00:06:24.375-->00:06:31.250 politicians or better most of the employees were also in this data and this even went up near 00:06:31.250-->00:06:40.042 the chancellor Merkel um where yeah where we had the data from these guys so how we did this? 00:06:40.042-->00:06:50.542 Did some shady hacker criminal game and gave us this this data no, it's way more easier. You 00:06:50.542-->00:07:02.833 can buy it. So, this landscape what you can see here is all the companies who are having contact 00:07:02.833-->00:07:09.917 with with this um very sensitive or very personal data. It’s a business universe for itself 00:07:09.917-->00:07:20.375 with hundreds of thousands of companies making millions with data. And, uh what some of them 00:07:20.375-->00:07:27.583 do, is just watching the web and they sell the analysis of of what their watching as a product 00:07:27.583-->00:07:35.917 and usually this is for competitors analysis interesting or for user analytics. And, some 00:07:35.917-->00:07:46.208 of them exchange the data under each other, um some take them all by themselves, and a very 00:07:46.208-->00:08:00.167 few, sell it, to who? To who you might ask, here comes the social engineering part, So, first of 00:08:00.167-->00:08:09.458 all you need a very convincing business partner that was a Anna Rosenberg, Hi. And this 00:08:09.458-->00:08:18.708 research, this was my or our alter ego and Anna worked in Tel Aviv for, because I liked the 00:08:18.708-->00:08:28.667 city very much and for a very promising start up, and after a while, she even had more than 00:08:28.667-->00:08:36.917 100 business connections, nobody we actually knew, but so many people are just accepting her 00:08:36.917-->00:08:46.792 friend um request without checking, took us 2 weeks. So, there's the promising company 00:08:46.792-->00:08:56.458 Anna is working for, took us 2 hours its uh its a website and the company was named meets 00:08:56.458-->00:09:06.542 technology because technology meets creativity, so it was just many nice pictures and some 00:09:06.542-->00:09:14.542 marketing buzz words. The story was easy, our standup had developed a sel self learning 00:09:14.542-->00:09:22.833 algorithm something like AI’s and uh this algorithm uh could predict which um products people 00:09:22.833-->00:09:28.667 are willing to buy in the future, and to train this algorithm we would need a 00:09:28.667-->00:09:34.542 massive amount of data, raw data, and there was a mysterious German customer in the back who 00:09:34.542-->00:09:43.583 would pay for all of this. And with this promising story uh we went on the market we even had a 00:09:43.583-->00:09:55.167 career side and we even had applications in the end uh, [laughter]. So, um we went on 00:09:55.167-->00:10:02.333 the market for I would say like a couple of weeks uh and with a valid phone number, with a valid 00:10:02.333-->00:10:09.583 email address and uh we wrote, we called more than 50, I think nearly 100 companies in the 00:10:09.583-->00:10:19.667 market and asked them if we could have raw data, if we could have data out of the 00:10:19.667-->00:10:26.833 clickstream, out of people's lives. And, uh in the end we got into a deeper discussion with um 00:10:26.833-->00:10:34.875 yeah two handful like 10 or 20 companies where we really had more phone calls more emails 00:10:34.875-->00:10:41.417 exchanging, and which turned out to be the challenge challenging thing of the research was that I 00:10:41.417-->00:10:50.208 often heard browsing data is no problem, um but for Germany it's hard. But it's no problem, we 00:10:50.208-->00:11:01.417 only have it for the US and the UK [inaudible] Yeah, what did we get at the end? Uh, Andreas will 00:11:01.417-->00:11:09.458 now dive into the data. >>So, we were actually quite astonished, uh um what we got as a freebie 00:11:09.458-->00:11:15.125 from this company because uh when we opened the data uh we saw that it was uh con 3 billion 00:11:15.125-->00:11:23.333 um unique URL’s that we received um for free, and the data was structured in a way such that we 00:11:23.333-->00:11:31.083 had uh uh 30 days of browsing data in it and each entry and um the data files that we got 00:11:31.083-->00:11:36.750 basically contained a URL, some of the URL’s were slightly anonymized like here um like you 00:11:36.750-->00:11:41.750 see these little x’s which were removed from the data set and each line also has a user ID 00:11:41.750-->00:11:46.583 which is anonymized, uh identifiers such as a random number, and some other 00:11:46.583-->00:11:53.167 information like a time stamp. So, uh and these 3 billion URL’s linked to about 9 million 00:11:53.167-->00:11:59.875 different domains and contained the data of 3 million, uh roughly 3 million people from 00:11:59.875-->00:12:06.125 Germany, um, where some of the users in there had um only a couple of dozen of data points 00:12:06.125-->00:12:14.042 and some others had tens of thousands of data points actually. So, now of course what 00:12:14.042-->00:12:19.875 we wanted to do was to try and see if we could uh from this anonymized data, get back to the 00:12:19.875-->00:12:24.667 real people in there, so like deanonymize the users in this data set. And, we used a 00:12:24.667-->00:12:29.542 technique which is called statistical de anonymization for that, um it's um actually quite 00:12:29.542-->00:12:35.250 old technique and uh and they are very there are a lot of um academic and applied research 00:12:35.250-->00:12:41.917 studies on that so here I linked a paper from 2007 um which got a lot a lot of press coverage back 00:12:41.917-->00:12:49.000 then, where researchers managed to de anonymize a dataset that was provided by netflix for uh a 00:12:49.000-->00:12:54.833 machine running competition, uh by correlating the data in this data set with other publicly 00:12:54.833-->00:13:01.000 available information, in this case from a website called IMDB and uh by correlating this, the 00:13:01.000-->00:13:06.208 researchers were able to link many of the anonymized users in the netflix data set to real 00:13:06.208-->00:13:15.125 user names um in the IMDB data. And, So how does this work? As I said, the data we got consisted 00:13:15.125-->00:13:22.417 of uh many URL’s with uh user identifier associated and you can imagine it as having um 00:13:22.417-->00:13:27.917 these columns uh of vectors um that contain different attributes and that are 00:13:27.917-->00:13:33.000 associated with a given user, and what you can put in this attribute is basically 00:13:33.000-->00:13:39.208 arbitrary. So in our case for example, we could put in information um that a given user 00:13:39.208-->00:13:45.333 in our data set has visited a given domain, for example, google.com. And, by doing that 00:13:45.333-->00:13:52.625 we can for each user create uh this kind of attribute vector and now um we can see if we also 00:13:52.625-->00:13:58.250 can find some publicly available information that contains the same or some of these attributes 00:13:58.250-->00:14:02.375 that we have in our anonymized data. So, we can for example, I will show you some examples 00:14:02.375-->00:14:08.208 later, try to find uh, publicly available data about web pages that people visited, and then 00:14:08.208-->00:14:16.375 try to correlate the data with our data set here, and by doing this, we can exclude users on 00:14:16.375-->00:14:22.042 the left side here that do not um that are not compatible with the public data that we have 00:14:22.042-->00:14:28.583 seen for a given person. And, if we have enough information available, then we can exclude 00:14:28.583-->00:14:34.208 almost anyone, almost everyone, and the list in our anonymized data set and if we manage to 00:14:34.208-->00:14:40.833 drill down um, um our possible users to one or maybe a few candidates, then we have 00:14:40.833-->00:14:50.208 effectively de anonymized this person in our data set. So, let’s try this. Um, in order to 00:14:50.208-->00:14:56.292 do this, we first take our input data and convert it into a matrix, where each um row in the 00:14:56.292-->00:15:01.958 matrix corresponds to one user and each column corresponds to a domain that this user has or has 00:15:01.958-->00:15:06.292 not visited, so whenever a given user has visited a domain before the one in the entry of this 00:15:06.292-->00:15:13.333 matrix if not we put a zero there so this gets a very large but sparsely populated matrix 00:15:13.333-->00:15:19.083 that we can then um use in order to compare our data set to publicly available information. 00:15:19.083-->00:15:25.708 Now the algorithm that we use for that is quite simple, so as I said we generate this matrix 00:15:25.708-->00:15:31.292 and then we can um generate a feature vector which is called v, with our public information 00:15:31.292-->00:15:36.333 so there we would just put um a domain that we find on the public web for example and we 00:15:36.333-->00:15:41.167 then just multiply these two things together which gives us a new vector that contains for 00:15:41.167-->00:15:47.375 every user the number of domains uh, so to say the number of domains from our public feature 00:15:47.375-->00:15:54.792 vector that he or she visited and uh we can use that uh vector again and just see where the 00:15:54.792-->00:15:59.208 largest value is and the largest value will often give us then the user which corresponds to 00:15:59.208-->00:16:07.333 the public data, and which is linked to the anonymized data in our set. Now, um you might ask 00:16:07.333-->00:16:11.708 yourself how well does this actually work. So here I have an example from our data set um 00:16:11.708-->00:16:18.708 here we took from our 3 million users, about 1.1 million those users namely that have at least 00:16:18.708-->00:16:25.500 10 different URL’s in their data set and we just um looked for a single user how um and like 00:16:25.500-->00:16:31.042 having knowledge about a domain that he or she visited reduces the number of possible users in 00:16:31.042-->00:16:36.083 our data set that, that are compatible with having visited these domains and so you see in 00:16:36.083-->00:16:40.042 the beginning we have about 1.1 billion users, then if you take the first domain, in this case 00:16:40.042-->00:16:45.417 it's a gaming website, gog.com you can see that they are only 15-->000 users roundabout left in 00:16:45.417-->00:16:51.667 the data set that uh have visited this domain. And now if you uh we say okay maybe our 00:16:51.667-->00:16:56.083 user he’s also come at the kundencenter telekom. And if that's the case you can see that 00:16:56.083-->00:17:03.208 um these combined domains that only been visited by about 367 users, so from 1 million, we 00:17:03.208-->00:17:08.000 already drilled down the number of possible users to only a few hundred. We can do that again 00:17:08.000-->00:17:12.500 with a few other domains and as you can see after only 4 uh domains for given users we 00:17:12.500-->00:17:18.917 already have only one compatible user in our data set and uh we would so to say already de 00:17:18.917-->00:17:27.542 anonymized this user. Now, the questions of course is can we actually get this public 00:17:27.542-->00:17:33.292 information that we need to do that and I want to show you two examples of that. So the first 00:17:33.292-->00:17:39.625 example, for the first example we use twitter, as you know people they like to tweet about 00:17:39.625-->00:17:43.667 what they are reading and their posting it on their timelines so what we did was to pick a random 00:17:43.667-->00:17:50.042 user from our anonymized data set that had a twitter profile and so and uh had a twitter link 00:17:50.042-->00:17:57.000 so to say and we then use the twitter API to scrape all the URL’s that this user posted on 00:17:57.000-->00:18:02.833 their timeline in the given time period and from these URL’s we abstracted the domains that are 00:18:02.833-->00:18:08.708 assoc-associated with them. And this information we can simply feed to our Algorithm and see so 00:18:08.708-->00:18:15.167 to say if we can find the user again. Um, in this example you can see that we have about I 00:18:15.167-->00:18:23.250 think 9 different domains, um so mostly development websites like github um, some blocks, some 00:18:23.250-->00:18:27.917 documentation pages and what I show you in the parenthesis there is the number of times 00:18:27.917-->00:18:33.917 this URL appeared in our data set. So you can see some of the URL’s appear quite often, github 00:18:33.917-->00:18:39.500 for example 2.5 million times, some others are uh quite rare in our data set they appear only 00:18:39.500-->00:18:47.583 129 times. So now if you run the 2 hour algorithm, we can plot the results like this. So what 00:18:47.583-->00:18:53.583 you see on this graph is on the x- axis just a particular user that we are looking at so there 00:18:53.583-->00:19:00.167 sorted completely arbitrarily um and in the y-axis you see the number of matching domains, uh 00:19:00.167-->00:19:05.708 from this set on the left, that the given user has visited, and you can see um that of these 00:19:05.708-->00:19:11.333 100-->000 users about that have a twitter profile in our data set that most of them didn’t visit 00:19:11.333-->00:19:17.542 any of those domains but a few of them visited at least 1, 2, 3 ,4, 5, 6, or 7 and uh 1 user 00:19:17.542-->00:19:24.667 yeah with the 7 ones, 7 domains was actually the user we were looking for, so um it was quite 00:19:24.667-->00:19:31.125 good luck so we were really able to identify this user given only this information on the left. 00:19:31.125-->00:19:36.167 And we did that for about a few thousand users in order to verify it, um it didn’t always 00:19:36.167-->00:19:41.042 like yield 100 percent confident uh success rate but we were al-always able to narrow down 00:19:41.042-->00:19:46.375 the number of compatible users to a very small group of maybe a couple of dozen users total. So 00:19:46.375-->00:19:51.917 you can see that this technique, even with very few information, works quite well actually. Now, 00:19:51.917-->00:20:00.542 this works also with different kind of identifiers, um there’s also youtube data in our data 00:20:00.542-->00:20:05.542 set because that’s usually quite interesting for the advertisers so, the URL’s they were not 00:20:05.542-->00:20:13.958 anonymized, and we could therefore extract the video IDs from these URLs. And again, we 00:20:13.958-->00:20:19.667 play the same game, so we just look for users in our data that had a youtube, uh a public 00:20:19.667-->00:20:24.292 youtube playlist and uh, we used the youtube API again to download all the um elements 00:20:24.292-->00:20:30.500 from this playlist, extract the video IDs from that and then again run a 2 hour algorithm. So 00:20:30.500-->00:20:36.667 doing that we have on the left side the video IDs from the random user again, and here on 00:20:36.667-->00:20:41.417 the right side you again see the results of our algorithm. You can see now we have only about 00:20:41.417-->00:20:46.458 um slightly less than 20-->000 user, users that have uh at least one public youtube 00:20:46.458-->00:20:51.333 playlist in our data set, and you can see that most of them didn’t see, didn’t watch any of 00:20:51.333-->00:20:57.333 those clips um at all on the left side, but again we have one user who watched about 9 of 00:20:57.333-->00:21:04.292 those, and that’s, that is again the user we who we’re looking for. So, it’s you can see, um 00:21:04.292-->00:21:07.708 this technique is working not only with domains, but with a lot of different uh kinds of 00:21:07.708-->00:21:14.000 data. These were just two examples of um data types that we can use for this kind of 00:21:14.000-->00:21:19.417 analysis. We also for example looked at uh google maps URLs so whenever you opened google maps 00:21:19.417-->00:21:25.958 in your browser um it a stores the latitude and longitude of the map area you are looking at 00:21:25.958-->00:21:30.708 and and the URL, and of course we can go and extract that and then we can get an impression of 00:21:30.708-->00:21:34.875 what people are looking at in the map. You can see that German’s not surprisingly, well 00:21:34.875-->00:21:39.750 they look at Germany and of course at their fav- at their favorite vacation destination 00:21:39.750-->00:21:46.125 Majorca, and having the data you could again search for publicly available and geolocated data, 00:21:46.125-->00:21:52.208 for example here we have um public ratings of the user on google plus and then you could 00:21:52.208-->00:21:57.583 again use that data uh to run into our algorithm and see if some users in our data set are 00:21:57.583-->00:22:03.708 compatible within this case the geodata of the ratings. And, this works as well with um 00:22:03.708-->00:22:08.708 different types of identifiers, you could do that with Facebook posts, uh and with any kind of 00:22:08.708-->00:22:17.333 like social identifier or URL or information that you have in the data set. To be honest though, 00:22:17.333-->00:22:23.250 in most cases, we didn’t even have to do this, because we could already de anonymize users 00:22:23.250-->00:22:29.333 um with a single URL in our data set and it's what we call an instant de anonymization. Here 00:22:29.333-->00:22:36.708 I’ll show two examples of that, um first of all there’s a twitter URL here from the 00:22:36.708-->00:22:41.250 twitter analytics page, so maybe you know that page, you can go there and then you see some 00:22:41.250-->00:22:45.083 statistics about how many people viewed your tweets and how often you got retweeted, and the nice 00:22:45.083-->00:22:50.000 thing about this URL at least, for uh us we try to de anonymize people instead it contains the 00:22:50.000-->00:22:55.750 user name and that its only visible to the user that was logged in, so whenever we 00:22:55.750-->00:23:01.042 receive this URL in our data set, we can be quite sure that the user to which it belongs is 00:23:01.042-->00:23:05.583 actually the owner of this twitter profile and this really allowed us to de anonymize a lot 00:23:05.583-->00:23:09.708 of people without going through like the pain of having this cominte, combination uh uh like 00:23:09.708-->00:23:15.542 the statistical uh matter so to say. There are other examples of URLs like that, for example, we 00:23:15.542-->00:23:21.333 have here um a URL from Xing, which is the German clone of Linkedin and uh there, whenever 00:23:21.333-->00:23:28.500 you click on your profile picture that you see on the left there, uh what Xing does is it 00:23:28.500-->00:23:36.917 attaches this uh search um parameter here to the URL which is only uh shown if you really 00:23:36.917-->00:23:41.917 clicking on this picture from your own dashboard. And, this URL is accessible by anyone, but 00:23:41.917-->00:23:46.875 on the other hand it's only, mostly, the people that click on this from their dashboard that 00:23:46.875-->00:23:51.375 actually see the URL so again, uh by seeing something like that in our data set, we can be 00:23:51.375-->00:23:56.875 really quite sure that the person who opened this URL is the owner of this Xing profile 00:23:56.875-->00:24:04.125 and that's especially nice for de anonymization because the URL also contains the name, the real 00:24:04.125-->00:24:10.917 name of the person in most cases. So, now that I showed you how we can de anonymize the 00:24:10.917-->00:24:17.083 people in the data, Svea will show you what we actually found in there. >>Ok, I have two more 00:24:17.083-->00:24:27.708 examples, um yeah one was this guy, and um I think it's it’s really a pity because we can’t, 00:24:27.708-->00:24:33.375 I can’t play you the the videos so we can scroll through his whole browsing data and I can 00:24:33.375-->00:24:40.250 explain what you would have seen. And, so, this guy he’s a police officer and um so you can 00:24:40.250-->00:24:48.208 see if you go through his whole browsing history that he’s uh researching um yeah topics and 00:24:48.208-->00:24:56.792 that he’s going to the police union uh site and stuff. And uh what you also could do is um he 00:24:56.792-->00:25:03.917 is using google translate, to translate a text from English to German. This was the text he’s 00:25:03.917-->00:25:12.042 trans he, he had, had been wanted to, to uh translate from Google and uh [laughter] was 00:25:12.042-->00:25:18.917 really funny, so he had access, I did this, so I nearly did the whole I-I completely anonymized 00:25:18.917-->00:25:26.500 it because I I didn't’ want to embarrass him in front of you. And so he, he was investigating 00:25:26.500-->00:25:35.625 a, a computer fraud and asking another ISP for a specific IP address and uh yeah, he also 00:25:35.625-->00:25:43.750 stated his email address, his first name, last name and his phone number, so yeah so, that’s 00:25:43.750-->00:25:50.042 the problem with google translate because everything he put into the translation box 00:25:50.042-->00:25:55.667 goes into the URL and the somebody that has this URL can see the whole text which you 00:25:55.667-->00:26:03.792 have written down. You can follow this guy through his whole life and August, what he 00:26:03.792-->00:26:19.750 was searching [chuckles] so, some funny stuff [laughter][applause]. Ok, one 00:26:19.750-->00:26:26.958 last example, I was really thinking about showing this on this conference, um, but, I 00:26:26.958-->00:26:40.792 [laughter] but, but, but I- I nearly felt forced to do this because this is part of the 00:26:40.792-->00:26:50.458 truth, um and this is very typical it's I mean when I spent the first days diving, digging 00:26:50.458-->00:26:59.708 through the data I was um yeah aha I thought now I knew that now that I know the internet 00:26:59.708-->00:27:13.167 [laughter][applause]. So, what is special on this profile is that this guy, he’s a judge and 00:27:13.167-->00:27:24.542 [laughter] from a German court, and uh he has a really specific taste, so if this uh [laughter] 00:27:24.542-->00:27:29.750 If this would have been the video then I could you know we could go on this everyday every 00:27:29.750-->00:27:35.500 couple of hours it goes like this and what you also can see and and going further through 00:27:35.500-->00:27:41.750 this browsing history, that he’s waiting for his child so he’s also looking for baby surnames 00:27:41.750-->00:27:48.417 and for a stroller and where he can go with his wife for uh yeah for getting his child or for 00:27:48.417-->00:28:00.583 getting his baby. So, what I want to to emphasize with this last example is that this guy he 00:28:00.583-->00:28:11.958 he doesn’t do anything criminal at all uh he’s just a normal guy I would say [laughter] but you 00:28:11.958-->00:28:19.750 see how intimate this data can be and um how easily he could be for example blackmailed with 00:28:19.750-->00:28:26.458 this data um especially in his sensitive position. So, uh or yeah what would you think when 00:28:26.458-->00:28:33.833 this data gets out and his wife could see it or employee or his employer could see it, so then I 00:28:33.833-->00:28:40.958 think his, his life would be dramatically changing so that I think it’s very important to say 00:28:40.958-->00:28:52.500 say here yeah who did this? Who collected the data? Uh the answer is is easy uh when we saw 00:28:52.500-->00:28:58.250 the detainers, the deepness of the data so we had this suspicion that it must browser 00:28:58.250-->00:29:06.250 plug ins and we did a small test um I mean one of the first things I did when we got the 00:29:06.250-->00:29:14.792 data I was searching for colleagues and uh I then asked a really good friend I found in 00:29:14.792-->00:29:21.417 this data, I asked him I, I told him and then I asked him if he could please uninstall his 00:29:21.417-->00:29:27.583 browser plug ins to a specific time, um he did this and uh then after the last one he, he, he 00:29:27.583-->00:29:36.292 installed or he uninstalled uh we had a small time period where we could do something like live 00:29:36.292-->00:29:45.250 looking into the data where we w- refreshed itself everyday and then he vanished from our screen 00:29:45.250-->00:29:52.667 when he de installed this like browser plug in, um it's a browser plug in it is supposed 00:29:52.667-->00:30:04.208 to [laughter] to protect you during browsing and it has 140 million users worldwide. Um, we 00:30:04.208-->00:30:09.917 tested this browser plug in then a second time in a virtual machine we make made of really 00:30:09.917-->00:30:19.583 set up some kind of scientific set up with the extra website and um then we could the guy who 00:30:19.583-->00:30:27.083 did this was Mike Kukis it's a security researcher thanks by the way here. And uh, so he, he 00:30:27.083-->00:30:32.833 did the test and we found him in the data so we could be sure for this browser plug in, at this 00:30:32.833-->00:30:41.042 time that this plug in was spying on him. What did they say to all of this ummm they um 00:30:41.042-->00:30:47.208 after we um made this story public then they slightly adapted their privacy policy, 00:30:47.208-->00:30:53.292 but they basically say it in their policy that they are collecting vet pages visited and 00:30:53.292-->00:31:03.542 time stamps of the visit and uh haha that they are going to uh great great length and that they 00:31:03.542-->00:31:10.167 have really try to make sure that the information remains anonymous. What you know now 00:31:10.167-->00:31:23.208 after this, yeah after everything what we told you that this is nearly impossible. >>So, 00:31:23.208-->00:31:28.625 um this gave us um one of the plug ins the browser extensions that uh was collecting data, but 00:31:28.625-->00:31:33.375 the question was of course how many others are there? And the, luckily in the data set we could 00:31:33.375-->00:31:39.417 also get random identity or unique identifier for each uh extension version that collected 00:31:39.417-->00:31:44.958 the given data point and uh by analyzing that we can see how many different extensions are 00:31:44.958-->00:31:50.542 actually generating data. This is what you're seeing which is a double algorithmic graph. So 00:31:50.542-->00:31:56.417 every unit here uh the number is like multiplying by 10 so to say and on the x-axis you can see 00:31:56.417-->00:32:03.167 the different extension and versions basically sorted by there by the number of data 00:32:03.167-->00:32:08.500 points that they contributed to the data set and these number itself you’re seeing on the y- 00:32:08.500-->00:32:12.500 axis and you can see the most popular extension here contributes already about 1 00:32:12.500-->00:32:18.083 billion data points to this data set. And if you take the first 10 extension versions, you can 00:32:18.083-->00:32:23.708 see that 95 percent of the data is already accounted for by those and if I say 10 extension 00:32:23.708-->00:32:28.458 versions, I don’t mean that's 10 different browser extensions but possibly uh different versions 00:32:28.458-->00:32:33.500 of the same extensions or different variants for example extension versions for different 00:32:33.500-->00:32:40.333 browser for Firefox, Chrome or like a new version of the extension. And uh you can see by 00:32:40.333-->00:32:44.708 the number of ideas we have in the data set, that it could be up to 10-->000 extension versions 00:32:44.708-->00:32:49.333 affected here that are spying on the users but um effectively the number is probably a little 00:32:49.333-->00:32:55.417 lower because um the version IDs are corresponding probably to the different versions of the 00:32:55.417-->00:33:00.500 same of the same extension so the true number should be somewhere between a few ten and 00:33:00.500-->00:33:07.417 maybe a few thousand or a few hundred extensions I think. The questions of course why is uh 00:33:07.417-->00:33:13.583 interesting to use browser extensions for tracking at all? And you might know, normally, 00:33:13.583-->00:33:18.792 tracking works um in this way, so you go visit a website where tracker is installed and then on 00:33:18.792-->00:33:25.667 this website um asks you to download some java script uh in your browser and this java 00:33:25.667-->00:33:31.667 script basically um does something and sends some data to a tracking server. And of course 00:33:31.667-->00:33:36.583 it's a problem that has been exist, that existed for many years and that’s why today many 00:33:36.583-->00:33:41.167 users are using um plug-ins to block these trackers. So for example, you block origin here 00:33:41.167-->00:33:48.167 and uh that's a quite effective way um to keep most of these trackers from sending data to 00:33:48.167-->00:33:53.375 the remote server. And for the data collection company this is of course a problem because the 00:33:53.375-->00:33:58.542 collection efficiency goes down and they can see less and less of the users actually. Now, um 00:33:58.542-->00:34:03.250 if you imagine that you instead of like having a script installed on a website, use a 00:34:03.250-->00:34:08.583 browser extension um this is much more uh uh attractive for the data collector because now 00:34:08.583-->00:34:14.375 the extension can completely bypass the security mechanism and send the data directly to 00:34:14.375-->00:34:18.792 the tracking server without being blocked by other extensions in the browser. This 00:34:18.792-->00:34:24.375 is of course very interesting for them and the even bigger thing uh oh the bigger advantage 00:34:24.375-->00:34:29.417 of these extensions is that they do not only attract the user on the pages were actually trackers 00:34:29.417-->00:34:34.208 are installed, but they can track the users on every page that he or she visits so even on 00:34:34.208-->00:34:39.542 pages that have no trackers at all um they would get a complete URL information of the user. 00:34:39.542-->00:34:44.750 Which of course for like their purposes might be of course more interesting since it gives you 00:34:44.750-->00:34:52.125 more complete picture of the user. Now, the question we often get is can I protect myself 00:34:52.125-->00:34:56.458 against this? Um, yeah of course, um the first thing that you need to do is to be very 00:34:56.458-->00:35:01.375 careful with the browser extensions that you’re installing so on the very, there 00:35:01.375-->00:35:06.625 various studies as well and projects that are trying to actually um uh analyze these 00:35:06.625-->00:35:10.708 extensions but you're putting them in a sandbox so um if you’re installing a new 00:35:10.708-->00:35:15.208 extension you should always uh try to see and if you can find it in those lists and it's 00:35:15.208-->00:35:20.042 actually a trustworthy uh vendor and you have to always ask yourself the question how is 00:35:20.042-->00:35:24.375 this extension created and making money with that? You know is it just an open source 00:35:24.375-->00:35:28.667 project maybe or is it something commercial, and if it's something commercial how are 00:35:28.667-->00:35:32.417 they generating their revenue? Are they maybe using my data for doing that? And, but even if you 00:35:32.417-->00:35:38.250 do that and if you use plugins like uh privacy patch or you block origin, there’s still a 00:35:38.250-->00:35:43.083 possibility that you can be tracked based on your IP address or another identifier that stays 00:35:43.083-->00:35:50.083 stable over a longer time period like a few hours or even a few days sometimes. And in order to 00:35:50.083-->00:35:55.542 circumvent or to like alleviate this problem, the only thing that you can do is to have a, a 00:35:55.542-->00:36:01.708 proxy solution like a tour for example or also commercial VPN that uses rotating IP addresses, 00:36:01.708-->00:36:07.708 exit notes in order to masquerade your IP address and um, so if you um can do that 00:36:07.708-->00:36:12.750 that's a good solution in order to protect yourself, you should of course also be careful about 00:36:12.750-->00:36:17.333 which extensions you’re using, because some of the uh commercial ones are also 00:36:17.333-->00:36:22.333 collecting the data yourself. You’ve seen before that the web of trust is actually doing that 00:36:22.333-->00:36:26.375 to their users or was doing it and there are other extensions which are similarly collecting 00:36:26.375-->00:36:32.750 uh data from the users in order to sell it. So always try to find uh trustworthy vendor so to 00:36:32.750-->00:36:39.375 say. Now, another question we often get is can I hide in my data by acting randomly. So can 00:36:39.375-->00:36:47.542 I just maybe open different websites and try to fool the algorithm into thinking that I’m 00:36:47.542-->00:36:52.625 somebody else? And, unfortunately in most the cases the answer is no, because the 00:36:52.625-->00:37:00.083 algorithm, at least the one that we are using in our study is um not sensitive against this kind 00:37:00.083-->00:37:04.083 of perturbation and you can think about it in this way because you saw earlier that 00:37:04.083-->00:37:09.708 what we were doing is basically comparing the public information that we have about a given user 00:37:09.708-->00:37:16.000 to the domains or um URLs that this user opened and if we keep, if a single user keeps adding 00:37:16.000-->00:37:20.792 new domains or new URLs to his or her profile then this won't actually change the score 00:37:20.792-->00:37:25.792 because the public information stays the same and uh since other users are not changing 00:37:25.792-->00:37:31.458 their data it also doesn’t change the score relative to other users so uh effectively by 00:37:31.458-->00:37:39.708 just acting randomly, you can normally not hide in your data unfortunately. So, what are the 00:37:39.708-->00:37:44.583 takeaways? Um, I hope you could see that um it's highly problematic to have this very 00:37:44.583-->00:37:51.208 high dimensional data um that is user related and uh that you publish because it's very very 00:37:51.208-->00:37:56.542 difficult to anonymize it even if you have the intention of doing so. And, you can also see 00:37:56.542-->00:38:02.167 that um the public information that is available about users be it on social media or other 00:38:02.167-->00:38:08.208 channels is also growing so it's becoming more easy to find this kind of public information that 00:38:08.208-->00:38:14.417 you can use then to do the de anonymization. And, lastly, yous have seen that only a few data 00:38:14.417-->00:38:22.208 points, in most cases less than 10 already sufficient to uh lead back to a single user even in a 00:38:22.208-->00:38:32.458 very large data set of millions or tens of millions of users. >>ok, so we want to thank you 00:38:32.458-->00:38:38.208 all for listening to our talk and also want to say a special thanks to a very big team of 00:38:38.208-->00:38:45.000 people who are who have been working with us, believing in us, and um yeah so yeah thank 00:38:45.000-->00:00:00.000 you. [applause]