Michael Spiegel, Esq Timothy Shimeall, Ph.D. Protecting Privacy During Network Flow Analysis: A Survey of Possible Approaches Michael Spiegel, Esq Timothy Shimeall, Ph.D.

Distribution Statements This presentation is not considered legal advice and does not establish an attorney- client relationship. Copyright 2016 Carnegie Mellon University This material is based upon work funded and supported by the Department of Defense under Contract No. FA8721-05-C-0003 with Carnegie Mellon University for the operation of the Software Engineering Institute, a federally funded research and development center. NO WARRANTY. THIS CARNEGIE MELLON UNIVERSITY AND SOFTWARE ENGINEERING INSTITUTE MATERIAL IS FURNISHED ON AN “AS-IS” BASIS. CARNEGIE MELLON UNIVERSITY MAKES NO WARRANTIES OF ANY KIND, EITHER EXPRESSED OR IMPLIED, AS TO ANY MATTER INCLUDING, BUT NOT LIMITED TO, WARRANTY OF FITNESS FOR PURPOSE OR MERCHANTABILITY, EXCLUSIVITY, OR RESULTS OBTAINED FROM USE OF THE MATERIAL. CARNEGIE MELLON UNIVERSITY DOES NOT MAKE ANY WARRANTY OF ANY KIND WITH RESPECT TO FREEDOM FROM PATENT, TRADEMARK, OR COPYRIGHT INFRINGEMENT. [Distribution Statement A] This material has been approved for public release and unlimited distribution. Please see Copyright notice for non-US Government use and distribution. This material may be reproduced in its entirety, without modification, and freely distributed in written or electronic form without requesting formal permission. Permission is required for any other use. Requests for permission should be directed to the Software Engineering Institute at permission@sei.cmu.edu. CERT® and FloCon® are registered marks of Carnegie Mellon University. DM-0004331

Overview Possible abuses Privacy concerns Why privacy matters Privacy protection methods

Possible Abuses Connection between addresses and individuals Browsing history Absence of customary activity Corporate activity Visits to unacceptable sites Visits to revealing sites Changes in corporate behavior Insider trading

Privacy Concerns US HIPAA Reasonable basis to believe it can be used to identify individual Inferences about medical information US SEC Regulation Fair Disclosure Non-public information Financially exploitable network behavior Network traffic related to compromise US Children’s Online Privacy Protection Act Identification of children via browsing patterns Child profiling information US Communications Act of 1934, Section 222 Customer proprietary Network Information Internal abuse Organization for Economic Cooperation and Development (OECD) Privacy Principles #2 - Data Quality #4 - Use Limitation

Why Privacy Matters “Metadata absolutely tells you everything about somebody’s life….If you have enough metadata you don’t really need content…. [It’s] sort of embarrassing how predictable we are as human beings.” -- Stewart Baker, former general counsel, NSA Network flow analysis is a new field Laws and regulations effect on collection not much explored Privacy policies and limitations on use of network flow data Least privilege and limited access Management concerns

Methods of Protection All of these will impair analysis to a degree Analogous to database protection methods Data suppression – don’t allow some queries Data aggregation – collapse addresses to net blocks, statistical trends Data concealment – anonymize results (see prior FloCon presentation) Noise insertion – insert false data to conceal identity Disclose information kept and obtain consent of users Opt-out for non-sensitive information Opt-in for sensitive information (active permission)

Summary Network flow analysis can have privacy risks (less than packet- level, but still some) Field is still young Currently protected largely by confidentiality clauses in employment agreements Need to better understand privacy concerns and protections Balance risks of disclosure vs. lack of monitoring Issues here affect other sorts of security-relevant data (DNS records, web or email logs, especially packet capture)