Cyber crime department. His areas of research and interest cover behavioral aspects of deviant use of technology, cyber criminal Behavior Analysis and understanding cyber terrorism. Today hell be presenting a talk entitled Cyber Security and social media, how big is your digital footprint and why should you care . As we do at every one of these, i would ask you to silence your electronic devices, please, but dont turn them off. We hope to see you tweeting to dawnordoom or posting to facebook, snapchat, instagram or whatever flavor of social product you use. Although i also understand that halfway through the presentation you decide to stop doing that. Please join me in welcoming dr. Mark rogers. Thank you. Can anybody hear me at the back . Im either blessed or cursed with a voice that tends to boom a little bit. Welcome to dawn or doom. As gerry indicated my talk is going to be about this concept of digital footprint. Im going to warning you its going to come across on the doom side of dawn or doom. For the record im a tech guy. Ask my wife. Im a geek. I like technology. I like my toys. I do online banking, purchase stuff over the internet. So this isnt about fear. This is about understanding the cost benefit analysis of technology. Nothing in like is without risk. Its the same with using technology. What is the cost of technology. What is the cost of the convenience that we now have with these devices . Because nothing is for free. We all know that. So without further ado, lets talk about this whole concept of a digital footprint. Were going to look at what is it . More importantly, why should you care . Its one thing to say theres this kind of concept out there but what difference does it make to me. What can we do once we understand some of the risks of this digital footprint, and then well put our soothsayers hat on and look at whats coming down the pike. Digital footprint. Were all aware of the concept of carbon footprint. Its something in the popular media. Were aware, concerned about how big is our carbon footprint. But very few of us think about how big our digital footprint really is. Think about it, were a wired society. Especially this next generation, current generation. They are wired. They are connected 24 7. They love to share information about themselves every 15 minutes in 140 characters or less. Its a very wired society. So because of that, we have a trail that we leave behind. So the concept of a digital footprint is exactly that. Its the information, its the artifacts, its the traces that you leave behind when you use technology, when you use the internet, when you drive your car, when you use that smart thermostat, when you do a lot of these things that we dont really take into consideration, leave traces of who we are, what we like, and what we do. Theres two types. Theres the passive. This is really creative, then when youre surfing the internet, talking on the phone. When youre doing these things we do daily. The passive is really collected, more importantly, without you knowing it. So as you go and surf the web, theres things called web cookies. If you go and search for a particular term, theres information such as ip addresses. So the passive is one. Active is a very interesting concept. This is what we voluntarily share with the companies. So think about this. This is the Data Information such as you put on your Facebook Page, your twitter accounts, your instagram. This is information that we voluntarily share. We know were sharing it. Whats interesting with this from a concept of risk benefit analysis is while we share it, were not always sure whats going to happen to that information once it gets collected. Theres the issue of, okay, i shared the information with company x, but what does company x do with that information . Where does it go . How can we control it . Can we control it and should we worry about it . Whats interesting, on the investigative side of the house, theres always this balance between security and privacy. When youre talking about Digital Footprints and these artifacts or traces, another trend that often gets used especially in Law Enforcement community is evidence. Because an investigation, these type of Digital Footprints can be used as a type of evidence. Why is the Data Collected . Several reasons. The main reasons are usually to do with money, commercial. Theres commercial reason for doing this. Your information is worth a lot of money. Now, your individual information might only be worth pennies. But if you take 50 million peoples information, all of a sudden the value of that information has increased. So you have people like direct marketers. They want to send you stuff, look at where youve gone, what youve done, what you shopped for, what you picked up at the Grocery Store and then directly market to you, because that actually is a better way of potentially swaying your purchasing opinions than doing Mass Marketing to everybody under the sun and not know if thats something of interest to you. Consumer profiling. Again, trying to understand what it is you like, what you dont like, and then trying to influence your buying decisions. You also have these organizations called data aggregators. What these companies do, they are kind of the big daddy the big data grandfathers of the internet. They collect the information from various sources all over, all these traces that aggregate the data. Supposedly they anonomize it and sell to direct marketers and consumer profilers. Youve also got government. Thanks so some of the things that happened over the past couple of years, some of the disclosures by some of the individuals that have decided to leak information, we know that various Government Agencies are looking at this data, are concerned about whats happening online. Using some of that same information the marketers and consumer profiling people are doing and using it for investigations. Using it to try to determine the next terrorist attack. Using it to try and determine is somebody going to commit a crime or somebody has commit add crime. Then youve got other. Youve got Cell Phone Companies that are collecting information supposedly for engineering purposes, for purposes of troubleshooting networks, devices. This is information if used for those purposes still says a lot about where you are, what youve done and where youve gone. Youve also got Health Insurers and insurance companies. This information is being collected so they get a medical profile. They can understand what issues you have health related. They might look at passing this on to underwriters, actuarials, whats your risk fact are now. Should it go up next time you try to renew your policy. Information like that. In some cases, definitely a very positive, is there something in your Health History they can basically tell you about early so you might be able to be pro active as opposed to reactive with your health care. So theres lots of various reasons why this information is being collected. Some good, some bad, but mostly its neutral. Data in and of itself isnt good, evil or anything else, its neutral. Its what we do with that data that determines how much of a risk there can possibly be. So tracking technologies. This the passive side. Theres all kinds of technologies out there. As we speak theres new technologies coming online to track what youre doing. This became very obvious when the last bunch of operating systems got updated and the browsers got updated. In those browsers was a concept of ad blocking. Man, did that ever annoy these companies that were trying to collect this information because thats their bread and butter. They got really annoyed because, wait a minute, we cant follow, we cant track so easily. In fact, if you were to go to some of these websites with ad blocking browsers which were default in the operating system, it would come back and say, wait a minute, youre using an ad blocking browser. Whees dont use this or white list us, in order to keep the site going we really need to collect this information from you. Thats an interesting concept. Youve also got things like malware. Weve all heard stories about systems being taken over, information being leaked off of these systems without our knowledge so we have basically the bad side of the house. We have interesting things as invisible disguise links. Links that look like one thing and you click on it and it takes you some place completely different. So theres all kinds of tracking technologies that are both inherent in the technologies were using. Some are rather creative ways of those companies, those entities i talked about tracking what youre doing and creating this large database of what you do, where you go, what you like, and who you associate with. When you enter into data mining, this becomes a very, very interesting concept. This is the stuff we share. This is the active side of the house. Email, texting. Youre voluntarily giving that information away, who youre talking to. In some cases, what youre talking about. Depending upon the Internet Company or the mail provider, even the content of your mail they are allowed to look at, part of the terms of services. Credit card purchases. This is an interesting kind of a positive to using these credit cards. Youll find that these Credit Card Companies keep profiles of your buying habits, of your spending habits. How many of you have gone and purchased something that was a little bit out of the ordinary only to get a phone call or text saying, wait a minute, are you sure this is you buying it . How do you think they are doing that . They arent sitting over your shoulder, they have created a profile, consumer profile and you dont fit it. Thats a good. Thats a positive, especially if that purchase is happening in new york at the same time youre sitting here in West Lafayette trying to use your credit card at the same time. We kind of want to know. Think about the information weve collected in order to develop that consumer profile. Twitter, social media, facebooks and facebooks to come and other technologies to come, part of their business is not to give you free access to their services, its to collect your data and to make money off your data. Thats how they stay alive, through marketing, consumer profiling, data aggregation. At least on this side of the house, we should be aware of the fact that our data is being collected, and we should have made an informed, educated decision that were okay with these folks collecting our data. We should probably go one step further and be okay with what they are doing with it afterwards. Who are they selling it to. Who gets this information . How is it being used . This is the side thats probably a little bit easier for us to have some controls over as far as what we now think is acceptable risk for our data. So what is collected . Okay. So we understand why, kind of have an idea of who. But what . Youd be amazed at the information thats available especially if you get involved in basically the correlation of these very large data reposit y repositories and can start doing Trend Analysis and pattern analysis. Basically the information thats being collected is enough to create something called your personal narrative, your profile. What you do from when you get up in the morning to when you go to bed at night and everything in between. Its kind of like the ultimate big brother from the 1984 in these books about how were being surveilled. It can be thought of as that type of an issue. Theres a lot of information they know. What route you took to work or you drove. How fast you went to work. The time you have lunch, the time you get up. The time you go to work. Your coffee break. The time you get home. This is a lot of information. In the good old days when Law Enforcement used to want to do surveillance on somebody, they physically had to do the old stakeout. They had to park the car by the house, get the binoculars out. Law enforcement doesnt have to do this anymore. Youre giving this information. Youre creating this persona, this narrative they can actually follow. In some cases this information has been used in a lot of cases for very good reasons. There are stories about people who have gotten lost. Older people that maybe have dementia that wander off. They can be found through technology, the ability of that technology to do geo location. The gps on your phone, to find out where you are. Find out maybe which hot spot your phone or your wifi came from, where youre sitting. For lots of folks, some incredible advantages. So for everything im talking about with a bit of a negative flavor, theres definitely a positive flavor. Were more aware of the positive, so spend a little more time educating us not on the negative but the risky side of the house. Lets look at this again. Your personal narrative. This is a lot of pretty i would say personal information but im not sure i want everybody to know about. Im not sure i want a Marketing Company to know this information. While it could be very good for directed marketing, theres a real downside. Just briefly here is the narrative or information this data can portray about you. What you like to eat. What you like to drink. What you watch on tv. That streaming, thats not necessarily for free or for the low price youre paying for it. Youre paying it back, collecting what you like to watch the the whole concept of the neilson rating has changed with streaming tv and streaming video. Your partnership status. That can be important for a lot of different reasons. For health care, child custody, you name it. The size of your family, your religion, your sexual orientation, your political orientation, your circle of friends. Why would we be concerned about who knows who our friends are . Theres at least a few reports where individuals who had been applying for loans, for credit were turned down as being a high risk because the group of friends they associated with were high risk, didnt fit that profile that that Financial Institution thought was good or nonrisky. So even the choice of your friends can affect decisions about you. Your current health. These days with the telemedicine and telehealth care and everything online, im not sure i want everybody to know my health information. Im not sure maybe i want my employer to know everything about my health. Maybe my Insurance Company and my doctor but not necessarily my employer. So each one of these things individually can cause people to go, hey, thats a little much. You combine this all together, and it becomes even a bigger. In some cases we hope precise picture but not necessarily. One of the issues with our digital footprint and collecting data and personas, you have no way checking to see if its accurate picture of you. Think about that. A lot of data is being collected about you. They are creating these profiles. They are creating basically a digital version of you. Im going to show you what some of the decisions are being made based on that profile and you do not have access to fact check, to make sure its correct. If anybody in this room doesnt think theres going to be errors made, a lot of stuff done on a statistical basis, i have news for you. There is a good possibility its not all accurate. So why should you care . Quite often people say im not a criminal, i have nothing to hide. Im going to challenge theres not one person in this room that doesnt have something they really do not want to be made public. Doesnt mean criminal, anything criminal, but theres parts of our lives which are private. Not everything we want shared. So privacy. Big issue. Well, what do i care if this information gets out there, were talking Cyber Security risk. Who is going to attack me. You would be surprised. If you simply have a connection to the internet and you do with your phone, you are a potential victim for somebody to attack you. A lot of cases they are not after you but entry point maybe into your bank, Health Care System and you become that toll into the institution. And your information then gets used in some cases to create an attack vector to go after something bigger. In some cases the attacks against you. In those cases weve heard about things like Identity Theft and really dark side. So lets have a look. What are some of the privacy concerns . The big concern is, what if its inaccurate . Potentially you can be denied employment. Employers go and check data, right . They actually go and purchase information from data aggregators and make decisions. Its very interesting when i had a quick look at whats out there, the majority of the information on Digital Footprints is geared towards High School Students and the only warning they have is dont post bad stuff to facebook because you wont get a job. Well, obviously its a lot more than that. But necessarily employers will go and look and purchase this information. If its inaccurate, you could have a problem. Credit Companies Due diligence, they go out and look at the stuff. They create a risk profile. You could be denied health insurance. Public humiliation. You could be basically slammed on the internet, defamed, have your picture on the front page of the local newspaper. Whats interesting is the media is very quick to put these pictures up there. But if it happens that youre innocent and it wasnt you, thats a little biline on the ninth page near the obituaries at the back of the paper. Its not going to be a retraction on the front page saying, oops, were sorry. Youre going to have to go digging for that. You can be basically found guilty simply by being in the press. In some cases, even arrested. Information could have shown your phone, your computer was used to attack that Financial Institution. Persona used for a false identity. Wait a minute. All of a sudden, its you. You can still be denied credit, all those things i talked about. This information used to make some very life changing serious decisions. In some cases even to look at acceptance to university. So if this data is out there it should be used in such a way at least we have a chance of defending ourselves against it or challenging the accuracy of it. Also from privacy perspective