New research by former CSE Ph.D. student Paul Vines, Lab Faculty Associate Franzi Roesner, and Faculty Co-Director Yoshi Kohno demonstrates how targeted advertising can be used for personal surveillance.
The online advertising ecosystem is built upon the ability of advertising networks to know properties about users (e.g., their interests or physical locations) and deliver targeted ads based on those properties. Much of the privacy debate around online advertising has focused on the harvesting of these properties by the advertising networks. In this work, we explore the following question: can third-parties use the purchasing of ads to extract private information about individuals? We find that the answer is yes. For example, in a case study with an archetypal advertising network, we find that — for $1000 USD — we can track the location of individuals who are using apps served by that advertising network, as well as infer whether they are using potentially sensitive applications (e.g., certain religious or sexuality-related apps). We also conduct a broad survey of other ad networks and assess their risks to similar attacks. We then step back and explore the implications of our findings.
The Tech Policy Lab plans to work with the ADINT research team to explore the policy implications of this research, examining potential recommendations for issues raised by this new form of personal surveillance.
More information can be found on the team’s website, and the UW News and UW CSE releases. The paper will be presented at ACM’s Workshop on Privacy in the Electronic Society later this month.