1. Michael Spiegel, Esq Timothy Shimeall, Ph.D.
Protecting Privacy During Network Flow Analysis: A Survey of Possible Approaches
Michael Spiegel, Esq
Timothy Shimeall, Ph.D.

2. Distribution Statements
This presentation is not considered legal advice and does not establish an attorney- client relationship.
Copyright 2016 Carnegie Mellon University This material is based upon work funded and supported by the Department of Defense under Contract No. FA C-0003 with Carnegie Mellon University for the operation of the Software Engineering Institute, a federally funded research and development center. NO WARRANTY. THIS CARNEGIE MELLON UNIVERSITY AND SOFTWARE ENGINEERING INSTITUTE MATERIAL IS FURNISHED ON AN “AS-IS” BASIS. CARNEGIE MELLON UNIVERSITY MAKES NO WARRANTIES OF ANY KIND, EITHER EXPRESSED OR IMPLIED, AS TO ANY MATTER INCLUDING, BUT NOT LIMITED TO, WARRANTY OF FITNESS FOR PURPOSE OR MERCHANTABILITY, EXCLUSIVITY, OR RESULTS OBTAINED FROM USE OF THE MATERIAL. CARNEGIE MELLON UNIVERSITY DOES NOT MAKE ANY WARRANTY OF ANY KIND WITH RESPECT TO FREEDOM FROM PATENT, TRADEMARK, OR COPYRIGHT INFRINGEMENT. [Distribution Statement A] This material has been approved for public release and unlimited distribution. Please see Copyright notice for non-US Government use and distribution. This material may be reproduced in its entirety, without modification, and freely distributed in written or electronic form without requesting formal permission. Permission is required for any other use. Requests for permission should be directed to the Software Engineering Institute at CERT® and FloCon® are registered marks of Carnegie Mellon University. DM

3. Overview
Possible abuses Privacy concerns Why privacy matters Privacy protection methods

4. Possible Abuses Connection between addresses and individuals
Browsing history
Absence of customary activity
Corporate activity
Visits to unacceptable sites
Visits to revealing sites
Changes in corporate behavior
Insider trading

5. Privacy Concerns US HIPAA
Reasonable basis to believe it can be used to identify individual
Inferences about medical information
US SEC Regulation Fair Disclosure
Non-public information
Financially exploitable network behavior
Network traffic related to compromise
US Children’s Online Privacy Protection Act
Identification of children via browsing patterns
Child profiling information
US Communications Act of 1934, Section 222
Customer proprietary Network Information
Internal abuse
Organization for Economic Cooperation and Development (OECD) Privacy Principles
#2 - Data Quality
#4 - Use Limitation

6. Why Privacy Matters
“Metadata absolutely tells you everything about somebody’s life….If you have enough metadata you don’t really need content…. [It’s] sort of embarrassing how predictable we are as human beings.” -- Stewart Baker, former general counsel, NSA Network flow analysis is a new field Laws and regulations effect on collection not much explored Privacy policies and limitations on use of network flow data Least privilege and limited access Management concerns

7. Methods of Protection All of these will impair analysis to a degree
Analogous to database protection methods
Data suppression – don’t allow some queries
Data aggregation – collapse addresses to net blocks, statistical trends
Data concealment – anonymize results (see prior FloCon presentation)
Noise insertion – insert false data to conceal identity
Disclose information kept and obtain consent of users
Opt-out for non-sensitive information
Opt-in for sensitive information (active permission)

8. Summary
Network flow analysis can have privacy risks (less than packet- level, but still some) Field is still young Currently protected largely by confidentiality clauses in employment agreements Need to better understand privacy concerns and protections Balance risks of disclosure vs. lack of monitoring Issues here affect other sorts of security-relevant data (DNS records, web or logs, especially packet capture)