1. Privacy Policy, Law and Technology Carnegie Mellon University Fall 2005 Lorrie Cranor http://lorrie.cranor.org/courses/fa05/ 1 Privacy and Technology Week 12 - November 14, 16

2. Privacy Policy, Law and Technology Carnegie Mellon University Fall 2005 Lorrie Cranor http://lorrie.cranor.org/courses/fa05/ 2 Announcements Be very careful about avoiding plagiarism - see week 1 notes for details and ask if you have questions! Guest speaker, Mike Shamos, next Monday No class next Wednesday - Thanksgiving Break Any requests for what we should talk about the following week?

3. Privacy Policy, Law and Technology Carnegie Mellon University Fall 2005 Lorrie Cranor http://lorrie.cranor.org/courses/fa05/ 3 Finishing up government surveillance Examples of government surveillance that violated civil liberties in the US? Watch part of DVD “Unconstitutional: The War on Our Civil Liberties” http://www.aclu.org/unconstitutional/ http://www.aclu.org/unconstitutional/

4. Privacy Policy, Law and Technology Carnegie Mellon University Fall 2005 Lorrie Cranor http://lorrie.cranor.org/courses/fa05/ 4 Preparing a short presentation

5. Privacy Policy, Law and Technology Carnegie Mellon University Fall 2005 Lorrie Cranor http://lorrie.cranor.org/courses/fa05/ 5 Research and Communication Skills Plan your talk Make an outline of what you want to talk about No need to present every detail of your paper Your presentation should motivate people who find it interesting to read your paper Consider the background of your audience If they are experts, focus on the details of your research and results If they are not experts, spend time on background and motivating the problem Consider how much time you have (10 minutes MAXIMUM + 5 minutes for questions)

6. Privacy Policy, Law and Technology Carnegie Mellon University Fall 2005 Lorrie Cranor http://lorrie.cranor.org/courses/fa05/ 6 Structure your talk Outline Optional for short talks Background and motivation Sometimes you may want to lead with this Research methodology Or system design + evaluation Results You may not have them if this is a work in progress Related work Could also go after background or at end, optional for short talks Contributions Useful in job talk, probably no time in 10-minute talk Future work Optional for short talks Research and Communication Skills

7. Privacy Policy, Law and Technology Carnegie Mellon University Fall 2005 Lorrie Cranor http://lorrie.cranor.org/courses/fa05/ 7 Making slides Use easy-to-read fonts Avoid text < 20 pt font Use a simple slide design, no distracting background images Use a color scheme with high contrast Avoid animation unless it helps illustrate your point Clipart can help make your points more clear and/or memorable, but don’t let it distract Make figures and tables readable Don’t make too many slides (1-3 minutes/slide) Research and Communication Skills

8. Privacy Policy, Law and Technology Carnegie Mellon University Fall 2005 Lorrie Cranor http://lorrie.cranor.org/courses/fa05/ 8 Slide content Are slides lecture notes/handouts? For a class or tutorial, slides may double as lecture notes  more content on slides For a research presentation, your paper is usually the “handout”  less content on slides Don’t try to put everything on the slide Don’t include text unless you want people to read it If people are reading your slides they are not listening to you Keep text short Don’t put too much math on a slide Just include key points, examples, etc. A figure may be worth 1000 words Research and Communication Skills

9. Privacy Policy, Law and Technology Carnegie Mellon University Fall 2005 Lorrie Cranor http://lorrie.cranor.org/courses/fa05/ 9 If you use overhead projector White background usually best Don’t use a paper to cover up part of your slide and uncover as you go If you have to skip slides, don’t put them up and take them down real fast, just skip them Research and Communication Skills

10. Privacy Policy, Law and Technology Carnegie Mellon University Fall 2005 Lorrie Cranor http://lorrie.cranor.org/courses/fa05/ 10 Prepare Make your slides in advance Practice Time yourself Get feedback from others Watch yourself on video Make sure you know how to hook your laptop up to the projector, change screen resolution, advance your slides, etc. (Mac users, bring your adaptor!) If you need to point to parts of your slides, decide if you will use, mouse, stick, laser pointer, etc. and bring it with you Research and Communication Skills

11. Privacy Policy, Law and Technology Carnegie Mellon University Fall 2005 Lorrie Cranor http://lorrie.cranor.org/courses/fa05/ 11 Giving your talk Dress neatly Stand up straight, hands out of pockets Don’t hide behind the podium Move around, but not too much Keep track of time Put your watch on podium, note clock in room, watch moderator with time cards, etc. Face the audience, look at your audience, not just one person Project your voice Don’t talk too fast Finish on time (or early!) Research and Communication Skills

12. Privacy Policy, Law and Technology Carnegie Mellon University Fall 2005 Lorrie Cranor http://lorrie.cranor.org/courses/fa05/ 12 Keeping your audience engaged Convey enthusiasm Inject humor Tell a story Ask the audience questions Modulate your voice Speak slowly Try to prevent your audience from getting lost Provide ample background Define important terms up front Don’t get into highly technical details unless that’s what your audience expects Research and Communication Skills

13. Privacy Policy, Law and Technology Carnegie Mellon University Fall 2005 Lorrie Cranor http://lorrie.cranor.org/courses/fa05/ 13 Handling questions If you have a strict time limit, leave time for questions or avoid taking them Answer clarification questions quickly Suggest that questions that will require lengthy answers be taken off line Don’t get flustered by critics or questions you don’t know the answer to Stay calm, diffuse the question, keep going Research and Communication Skills

14. Privacy Policy, Law and Technology Carnegie Mellon University Fall 2005 Lorrie Cranor http://lorrie.cranor.org/courses/fa05/ 14 Privacy invasive technologies Location tracking (cell phones, GPS devices that phone home, etc.) RFID Transit cards Computer software that phones home Devices that phone home Video cameras (hidden cameras, cell phones) Personalized ecommerce sites Automobile data recorders Face recognition

15. Privacy Policy, Law and Technology Carnegie Mellon University Fall 2005 Lorrie Cranor http://lorrie.cranor.org/courses/fa05/ 15 The Global Positioning System (GPS) Radio-navigation system operated by US DoD Comprised of 24 satellites and 5 ground stations Uses satellites like “man-made stars” to triangulate and calculate 3D position from 4 satellite signals Receivers listen for radio beacons and triangulate their position Typical accuracy in meters, cm accuracy possible DoD intentionally degraded accuracy until May 2000 One-way system If receivers are to report their location back they must use another system, for example cellular phone network Does not work indoors

16. Privacy Policy, Law and Technology Carnegie Mellon University Fall 2005 Lorrie Cranor http://lorrie.cranor.org/courses/fa05/ 16 Radio-frequency identification (RFID) Tags Antenna bonded to small silicon chip encapsulated in glass or plastic (as small as grain of rice) Unpowered (passive) tags and powered (active) tags Readers Broadcast energy to tags, causing tags to broadcast data Energy from readers can also power onboard sensors or cause tag to write new data to memory Read ranges currently a few centimeters up to a few meters

17. Privacy Policy, Law and Technology Carnegie Mellon University Fall 2005 Lorrie Cranor http://lorrie.cranor.org/courses/fa05/ 17 Current and near term uses of RFID Automobile immobilizers Animal tracking Building proximity cards Payment systems Automatic toll collection Inventory management (mostly at pallet level) Prevent drug counterfeiting Passports

18. Privacy Policy, Law and Technology Carnegie Mellon University Fall 2005 Lorrie Cranor http://lorrie.cranor.org/courses/fa05/ 18 Electronic Product Code Standard managed by EPCglobal Relatively small tags Inexpensive No encryption, limited security Kill feature Password feature Designed to replace UPC bar codes 96-bit+ serial number Object Name Service (ONS) database operated by EPCglobal

19. Privacy Policy, Law and Technology Carnegie Mellon University Fall 2005 Lorrie Cranor http://lorrie.cranor.org/courses/fa05/ 19 Post-sale uses Read product labels to blind people Sort packaging for recycling Provide laundry instructions to washer, dryer, dry cleaner Allow smart refrigerator to automatically generate shopping lists and warn about expired items and recalls Allow smart closet to suggest outfits Simplify product returns

20. Privacy Policy, Law and Technology Carnegie Mellon University Fall 2005 Lorrie Cranor http://lorrie.cranor.org/courses/fa05/ 20 Privacy concerns with EPCs? What are the privacy risks? What are possible solutions? What are the limitations of these solutions?

21. Privacy Policy, Law and Technology Carnegie Mellon University Fall 2005 Lorrie Cranor http://lorrie.cranor.org/courses/fa05/ 21 Building proximity cards Used for access control to buildings Many prox cards have no security features Easily clonable, even remotely Can be read through someone’s pocket or from longer distances while card is being read by legitimate reader Solutions involve adding crypto to cards

22. Privacy Policy, Law and Technology Carnegie Mellon University Fall 2005 Lorrie Cranor http://lorrie.cranor.org/courses/fa05/ 22 RFID payment systems Gas station keyfobs Coming soon to the major credit cards in your wallet Chase “Blink” card already issued in Philadelphia and NYC Can be read from about 20 cm In some countries integrated into watches and cell phones Main advantage is to save time Don’t have to swipe machine Don’t need signature Supposedly crypto is used to prevent cloning, but JHU researchers demonstrated how to break SpeedPass

23. Privacy Policy, Law and Technology Carnegie Mellon University Fall 2005 Lorrie Cranor http://lorrie.cranor.org/courses/fa05/ 23 RFIDs in passports cause concerns State Department announced plan in 2004 Lots of privacy concerns 2,335 comments, 98.5% negative Concerns People could scan and get your identity info  Identity theft (including fake passports)  Tracking people  Selecting victims

24. Privacy Policy, Law and Technology Carnegie Mellon University Fall 2005 Lorrie Cranor http://lorrie.cranor.org/courses/fa05/ 24 Revised passport plan Revised plan in October 2005 addressed some, but not all concerns Improvements  Screen in cover prevents reading RFID except when passport is open  Visual encryption key prevents decrypting content of passport Problems  People can still be tracked due to anti-collision field  This can be do from distances much further than official read distance of chip What problem does RFID in passports solve and what other solutions are there? http://www.schneier.com/crypto-gram- 0511.html#1