Watch in depth live on sunday on book tv on cspan2. Forensics expert and former crime investigator Marcus Rogers heads. You purdues he spoke about how data is collected online and how it is used by Law Enforcement and employees. And employers. This is 45 minutes. Good morning. I am happy to introduce our next speaker. Rogers is here at the Polytechnic Institute at purdue university. He is a Forensic Research psychologist, you should pay extra for that, that is exciting. [laughter] the University Faculty know this is serious, and he went to the American Academy of forensic sciences. Dr. Rogers is the coeditor of privacy and security crime department. His areas of Research Cover the behavioral aspects of the deviant use of technology, cyber criminal behavior analysis, and understanding cyber terrorism. Today, he will be presenting a talk entitled, Cyber Security and social media, how big is your digital footprint and why should you care . As we do at every one of these, i will ask you to silence electronic devices, but do not turn them off. Orhope to see you tweeting posting to facebook, snapchat, instagram, or whatever flavor of social product you use. I also understand halfway through the presentation, you might stop doing that. Please join me in welcoming dr. Marcus rogers. [applause] Marcus Rogers thank you. Can anybody hear me in the back . I have a voice that tends to be in. Welcome to dawn or doom. My talk will be about the concept of the digital footprint. And i will warn you off the back, it will come across on the doomy sidekick i am a tech guy, i have my toys and i do online banking. Thisis is not about fear, is about understanding the cost benefit analysis of technology. Nothing in life is without risk. It is the same technology, what is the cost of technology . What is the cost of the convenience we have with these devices . Nothing is for free. We know that. So lets talk about the concept of a digital footprint. We will look at what is it . And more important, why should you care . Ok, this is a concept that is out there, but with different does it make to meet . What can we do once we understand some of the risks of the footprint . And then we will put our hat on and look at what is coming down the pipe. Awarel footprint, we are of the concept of the carbon footprint. It is something that has been in the popular media and we are concerned about how big is our carbon footprint. But very few things about how big is our digital footprint. And think about it, we are a wired society. Especially the next generation, the current generation. They are wired, connected 24 7. They love to share information every 15 minutes and in 140 characters or less. It is a wired society and because of that we have a trail that we leave behind. The concept of a digital footprint is exactly that. It is the information, the artifact, the traces you leave behind when you use technology. When you use the internet. When you drive your car. When you use that smart thermostat. When you do a lot of these things that we do not take into consideration, leave traces of who we are what we like, and what we do. There are two types, there is this is really creating, then when you are surfing the internet, when you are talking on the phone, when you are doing things we do daily. And it is really collected without you knowing it. Web, you go and surf the there are things called web if you search for a particular term, there is information stored about you because of the ip address. So that is passive. Active is what we voluntarily share with companies. Think about this, data or information you put on facebook, on your twitter account, your instagram and this is information that we voluntarily share. We know we are sharing it, but what is interesting with this and the concept of risk and benefit analysis, while we share it we are not sure what will happen to the information once it is collected. There is the issue of ok, i shared the information with company x, but what do they do with the information . Where does it go . Can we control it . Should we be worried about it . What is interesting is on the investigative side, there is always a balance between security and privacy. When we are talking about digital footprint and the artifacts or traces, another term that is used, especially in Law Enforcement, is evidence. The an investigation digital footprint can be used as evidence. Why is Data Collected . For several reasons, the main reason is usually to do with money. Commercial, there is a commercial reason for doing this. Your information is worth a lot of money. Now, your individual information might only be worth pennies, but if you take 50 million peoples information, the value of the information has increased. Say you have people like direct marketers, they want to send you something. They want to look at where you have gone and what you have done and what you are shopping for, what you got at the Grocery Store and directly market it to you. Because this is a better way of potentially swaying your purchasing opinion, then doing the math massmarketing to everybody and not knowing if it is of interest to you. It is like profiling. Trying to understand what it is you like, what you do not like, then trying to influence your buying decision. You also have these organizations called data aggregators. What companies do is they are the kind of big daddy, the big data grandfathers, they collect information from various sources all over, all of these traces, the aggregate the data and supposedly they sell it to a lot of these direct marketers and consumer profilers. So we also have government. And thanks to some of the things that have happened over the past couple of years, the disclosures , the individuals that decided to leak information, we know that various Government Agencies are looking at this data. Our concern about what is happening online. Using some of the same information that the marketers and consumer profiling people are doing, and using it for investigation. Using it to try to determine the next terrorist attack, using it to determine, is somebody going to commit a crime or has committed a crime. And then you have others, the Cell Phone Companies collecting information, supposedly for engineering purposes, for purposes of troubleshooting networks, publishing, this is information that while it is used for those purposes, says a lot about where you are, what you have done and where you have gone. And you have Health Insurance companies, information collected so they can get a medical profile and understand maybe what issues you might have Better Health related. They could look at passing it on to underwriters so they can look at what is the risk factor much of your policy goal of the next time you try to renew it. Information such as that. Is there are positives, there something in your Health History they can tell you about early so you could be proactive, as opposed to reactive, with your health care. So there are various reasons why information is being collected. Some of it good, some of it back, but mostly it is neutral. Good orlection is not evil, it is neutral. It is what we do with the data that determines how much risk there could be. So looking at technology, this is all kind of technology. As we speak, new technologies are coming online to track what you are doing. This became obvious when the last bunch of operating systems were updated and browsers were updated, and in the browsers was the concept of ad blocking. It annoyed the companies trying to collect information on the past information, and information, and now they cannot track easily. And if you go to some of these websites with the ad blocking browsers, it would come back and say, wait a minute, you are using ad blocking browsers. Please do not use this, because in order to keep the site going, we need to collect information from you. It is an interesting concept. And you have things like malware. We have heard stories about systems being taken over, information being ripped off of the systems without our knowledge. And you have interesting things like invisible disguise links, they look like one thing and you click on it and it takes is a place different. So there are all kinds of tracking technologies that are both inherent in the technologies we are using, and some are rather creative ways of the companies, those entities i talked about, tracking what you are doing and creating this large database of what you do, where you go, what you like, and you associate with. When you enter into the data, this is where becomes interesting. This is stuff we share. This is the active side of it. Email, texting, you are voluntarily giving information away. , in somee talking cases, what you are talking about dependent upon the internet company, even the content of your mail they are allowed to look at. Credit card purchases. This is an interesting kind of a positive to using these credit cards, you will find that these Companies Keep profiles of your buying habits, of spending habits. How many of you have purchased something that was a little bit out of the ordinary, only to get a phone call that says, is this you buying it . How do you think they are doing that . They are not fitting over your shoulder, they have created a profile and you do not fit it. That is a good thing. Especially if that purchase is happening in new york the same time you are in lafayette trying to use your credit card. But to think about the information they have collected in order to develop that consumer profile. Twitter, social media, facebook, and those to come, the other technologies to come, part of their business is not to give you free access to their services. It is to collect data and make money off of your data, that is how they stay alive. They market. With data aggregation. At least on the side of the house, we should be aware of the fact that it is being collected and we should have made an informed decision that we are ok with these folks collecting our data. We should probably go a step further and be ok with what they are doing with it, who are they selling it to, who gets the information and how is it being used. This is the side a little bit easier for us to have control over, as far as what we now think is acceptable risk for our data. So it is collective . We understand why, we have an idea of who, ok, but what . You would be amazed at the information available, especially to get involved and the correlation of a very large data depository and you can start doing Trend Analysis and pattern analysis. Basically, the information that is being collected is enough to create Something Like a personal narrative, your profile. What you do from when you get up in the morning to going to bed at night and everything in between. The ultimate big the ultimate big brother from 1984 on how we are being surveilled. There is a lot of information they know, what road you took to work, how fast you want to work, what time you get up, what time you go to work, your coffee brew, what time you get home. This is a lot of information. In the good old days when lawenforcement wanted to be in on someone, they had to do the oldfashioned stakeout. They would get the binoculars outk watch people. Toenforcement does not have do this anymore. You are giving them this data. Youre giving them a narrative they can follow. In a lot of cases this data has been used for good reasons. There are stories of people who got lost. Older people i have dementia that wander off, and they are able to be found through the ability of technology through geolocation. To find out where you are, which hotspot your wifi came from, where you are sitting. For everything that has a bit of a negative flavor, there is a positive. We are aware of the positives, so i want to educate us on the more risky sides. Thispersonal narrative is a lot of tricky personal information i am not sure i want everyone to know about. I am not sure i want Marketing Company to know all this information. While it could be good for directed marketing, there is a real downside. Just briefly, this is some of the information that is data can portray about you. What you like to eat, what you like to drink, what you watch on tv. That is streaming, not necessarily the low price you are paying for it. That cost is the information you collecting about what you like to watch. The business of ratings has changed with streaming video. Your partnership status. That could be important for a lot of different reasons. For health care, child custody. The size of your family, your religion, sexual orientation, political affiliation, your circle of friends. Why would we be concerned about who knows who our friends are . There are at least a few reports of individuals who have been applying for loans for credit, who were turned down as being a high risk because the group of friends they associated with were high risk. Theidnt fit that profile Financial Institution font was non risky. Was using your choice of friends can affect decisions about you. Your current health. Telemedicine,h everything is online. I am not sure i want everyone to know i hope information. I am not sure i want my employer to know everything about my health information. Myrman my doctor surely doctor, but not my employer. Hey can cause people to go , that is a little much. Combine this altogether, and it can become much bigger. One of the issues with your digital footprint and collecting this data, you have no way to see if this is an accurate picture of you. Think of that. A level data is collected about you. They are creating a digital version of you. Im going to show you the decisions being made based on the profile. And you do not have access to fact check to make sure it is correct. If anybody does not think there a law oferrors made, this is done on a statistical basis. I have news for you. There is a good possibility it is not all accurate. Why should you care . People say, i am not a criminal, i have nothing to hide. There is not one person in this has something they dont want to be made public. Nothing criminal, other reports of our lives that are private. But there are parts of our lives that are private. Privacy is a big issue. What do i care that this information gets out there . Who is going to attack me . You would be surprised. If you simply have a connection to the internet, as you do with your phone, you are a potential victim for someone to attack you. In a lot of cases, they are not after you. Intoare in an entry point your bank, and you become that portal into the institution. Used toormation gets create an attack vector to go after something bigger. In some cases, the attack is against you. We have heard about Identity Theft, they really dark side. Let us have a look. What are some of the privacy concerns . A big concern, what if it is inaccurate . Essentially you could be denied employment. Employers check data, right . They purchased this information from data aggregators and make decisions. It is interesting when i made a decision about what was posted. Information on Digital Footprints is geared toward high school students. The only warning they have is dont post bad stuff to facebook because you wont get a job. Obviously it is a lot more than that. Employers will go and purchase information. If it is inaccurate, you will have a problem. Credit Card Companies due diligence. They look at this stuff. They create a risk profile. You can be denied Health Insurance. Public humiliation. You could be slammed, defamed on the internet, have your picture on the front page of the local newspaper. Is that theresting media is quick to put these pictures up there. If it happens that if you are innocent and it wasnt you, that is a byline at the back of the paper. That is not going to be a reduction on the front saying oops. You will have to go digging for that. You can basically be found guilty simply by being in the press. And in some cases, even arrested. Information could have shown that your phone, your computer was used to attack a Financial Institution, your persona was used to create an identity and committed a car. Minute. N wait a all of a sudden it is you. What if it is inaccurate . You could still be denied unemployment, credit. This information is being used to make some very lifechanging decisions. In some cases, even getting into a university. This data should be used in such a way that at least we have a chance of defending ourselves against it, or challenging the accuracy of it. Also from a privacy perspective, why should someone else make money off of your data . It would be a great idea if you got 0. 001 of every transaction that was made with your data being sold to somebody else. That would be a pretty good income considering the millions and millions of pieces of information being shared. In some cases, it is without consent. Ok, i willingly allow this company to take my data because i want that functionality. I want the convenience of Online Shopping or fast delivery. I did not agree for these telemarketers that are going to call me at 9 00 a. M. On sunday. Where do you think those numbers come from . Thanarketers are better asking, hey, can we have your number so we can bother you 24 7 . They are a little smarter than that. They are buying this information. If you do not think that information would have been shared, he would have readily agreed, even if you meant getting deliveries a day early. It is understanding the costbenefit risk tradeoff. One of the questions that comes up, great, but can you ever really be Anonymous Online with technology . That is a good question. There is not one we can get into here. We feel that the concepts of anonymity gets into the concept of privacy. Can you really be practiced . Be private . My generation and current generation of Digital Natives has a completely different definition of privacy. In my generation, privacy is a binary decision. It is either private or it isnt. To the generations since, privacy tends to be on a continuum. Something can be kind of private. We are in constant pseudoprivacy, which is bizarre. It is part of th