Search

This report addresses the area of data privacy, with a particular focus on detecting and anonymizing personally identifiable information (PII) in unstructured text. As digital data accumulation increases and the use of large datasets propels AI advancements, it has become crucial to protect sensitive information from closed-source programs, whose data handling practices remain a mystery. This paper explores efficient methods for identifying and anonymizing sensitive data, a key component in maintaining privacy and following the General Data Protection Regulation (GDPR). The study evaluates existing large language models (LLMs) and ways to prompt these models for specific purposes. It assesses their performance in accurately identifying various types of Personal Identifiable Information (PII) and replacing them with dummy data, ensuring the utility of the text is maintained. This contribution is significant in providing a solution adaptable to the Swedish language and format. Thereby helping organizations in effectively manage their own and their customer’s data.

This report addresses the area of data privacy, with a particular focus on detecting and anonymizing personally identifiable information (PII) in unstructured text. As digital data accumulation increases and the use of large datasets propels AI advancements, it has become crucial to protect sensitive information from closed-source programs, whose data handling practices remain a mystery. This paper explores efficient methods for identifying and anonymizing sensitive data, a key component in maintaining privacy and following the General Data Protection Regulation (GDPR). The study evaluates existing large language models (LLMs) and ways to prompt these models for specific purposes. It assesses their performance in accurately identifying various types of Personal Identifiable Information (PII) and replacing them with dummy data, ensuring the utility of the text is maintained. This contribution is significant in providing a solution adaptable to the Swedish language and format. Thereby helping organizations in effectively manage their own and their customer’s data.

In the contemporary digital ecosystem, the proliferation of personal data accessibility has markedly amplified concerns surrounding information privacy. Despite the critical nature of these concerns, extant measures (e.g., privacy policies, privacy settings) for safeguarding information privacy have demonstrated substantial deficiencies. Consequently, there exists an imperative need for the enhancement of information privacy analytics and risk assessment methodologies. Such advancements are essential to augment individuals' understanding and vigilance regarding their personal information exposure and the attendant privacy risks.This dissertation addresses this exigent issue through the development and implementation of Artificial Intelligence (AI)-enabled analytical tools aimed at dissecting privacy data. The ultimate goal is to employ the insights derived from these analyses to bolster efficient, proactive, and informed privacy defenses, with a particular focus on populations deemed at risk. Structured into four distinct essays, this scholarly work unfolds as follows: The inaugural essay delineates the creation of a Deep Learning (DL)-based text classification system tasked with segmenting and categorizing privacy policy content. This system serves to evaluate the dynamic nature of privacy policies in light of evolving privacy regulations. Subsequently, the second essay introduces a DL-based Entity Resolution (ER) system engineered to correlate Personally Identifiable Information (PII) surfaced on Dark Web platforms with corresponding data on Surface Web platforms, thereby facilitating a holistic assessment of individuals' information privacy risk profiles. The third essay extends the theoretical framework of the Protection Motivation Theory (PMT) to underpin the design of an exposed PII search mechanism aimed at succinctly communicating privacy threats and countermeasures to foster privacy-protective behaviors among senior citizens. The fourth essay proposes the i

Everyday we interact with online services from companies that ask for our permission to use our personal information. Nowadays it is common practice for websites and apps to collect big amounts of data which are mainly used for revenue optimization based on user analytics. This customer data collection and usage is regulated by legal agreements (i.e., privacy and cookie policies) which we are required to accept (multiple times a day), but which are generally very long and formulated in a way that makes their interpretation difficult for the general public. An average privacy policy takes 15 min to read and includes lots of legal jargon (e.g., including words like "data controller" and "legal basis for processing"). In this research project, we are developing a support system where users can search for concrete answers in the privacy policies of companies or websites, by formulating their questions in natural language. Instead of blindly accepting a privacy policy, a user could first query the system for answers to a potential concern. The system will return a ranked list of phrases and documents matching the query. In case the generated answer is not sufficient for the user, an extension will allow them to forward complex requests to best-matching legal professionals, specialized in privacy legislation, which can process them for a small fee. We present different aspects of the internal implementation, including the identification of relevant spans in unstructured privacy policies and the selection of the best-suited NLP model for this specific task. The initial results of a user evaluation are presented, showing promising directions. Eventually, some future research directions for the extension of the system conclude our contribution., + ID der Publikation: hslu_99243 + Art des Beitrages: Wissenschaftliche Medien + Sprache: Englisch + Letzte Aktualisierung: 2024-07-30 11:29:37

Everyday we interact with online services from companies that ask for our permission to use our personal information. Nowadays it is common practice for websites and apps to collect big amounts of data which are mainly used for revenue optimization based on user analytics. This customer data collection and usage is regulated by legal agreements (i.e., privacy and cookie policies) which we are required to accept (multiple times a day), but which are generally very long and formulated in a way that makes their interpretation difficult for the general public. An average privacy policy takes 15 min to read and includes lots of legal jargon (e.g., including words like "data controller" and "legal basis for processing"). In this research project, we are developing a support system where users can search for concrete answers in the privacy policies of companies or websites, by formulating their questions in natural language. Instead of blindly accepting a privacy policy, a user could first query the system for answers to a potential concern. The system will return a ranked list of phrases and documents matching the query. In case the generated answer is not sufficient for the user, an extension will allow them to forward complex requests to best-matching legal professionals, specialized in privacy legislation, which can process them for a small fee. We present different aspects of the internal implementation, including the identification of relevant spans in unstructured privacy policies and the selection of the best-suited NLP model for this specific task. The initial results of a user evaluation are presented, showing promising directions. Eventually, some future research directions for the extension of the system conclude our contribution., + ID der Publikation: hslu_99243 + Art des Beitrages: Wissenschaftliche Medien + Sprache: Englisch + Letzte Aktualisierung: 2024-07-30 11:29:37

Forensic analysis commonly involves searching an investigation target for personal identifiable information. An Inland Revenue Department (IRD) number is used for taxation purposes in New Zealand and can provide evidence of perpetrator identity, transaction information or electronic fraud. This research has designed and implemented a bulk_extractor feature scanner to detect and validate IRD numbers (features). The IRD scanner has been tested on a known data set to ensure tool functionality. A large real world data set was then used to determine scanner effectiveness in a realistic investigation scenario. Real world data set testing highlighted a high number of unrelated features detected by the scanner. To combat this, a novel post-processing technique was implemented to identify forensically interesting IRD numbers by performing feature context searching. The post-processing findings proved that feature context searching is an effective data reduction technique that identified a low number of directly relevant IRD numbers.

Forensic analysis commonly involves searching an investigation target for personal identifiable information. An Inland Revenue Department (IRD) number is used for taxation purposes in New Zealand and can provide evidence of perpetrator identity, transaction information or electronic fraud. This research has designed and implemented a bulk_extractor feature scanner to detect and validate IRD numbers (features). The IRD scanner has been tested on a known data set to ensure tool functionality. A large real world data set was then used to determine scanner effectiveness in a realistic investigation scenario. Real world data set testing highlighted a high number of unrelated features detected by the scanner. To combat this, a novel post-processing technique was implemented to identify forensically interesting IRD numbers by performing feature context searching. The post-processing findings proved that feature context searching is an effective data reduction technique that identified a low number of directly relevant IRD numbers.

U.S. and EU privacy law diverge greatly. At the foundational level, they differ in their underlying philosophy: In the United States, privacy law focuses on redressing consumer harm and balancing privacy with efficient commercial transactions. In the European Union, privacy is hailed as a fundamental right that can trump other interests. Even at the threshold level-determining what information is covered by the regulation-the United States and European Union differ significantly. The existence of personal information- commonly referred to as "personally identifiable information" (PII)-triggers the application of privacy law. The U.S. and the European Union define this essential term of privacy law quite differently. The U.S. approach involves multiple and inconsistent definitions of PII that are often particularly narrow. The EU approach defines PII to encompass all information identifiable to a person, a definition that can be quite broad and vague. This divergence is so basic that it threatens the stability of existing policy mechanisms for permitting international data flows.

U.S. and EU privacy law diverge greatly. At the foundational level, they differ in their underlying philosophy: In the United States, privacy law focuses on redressing consumer harm and balancing privacy with efficient commercial transactions. In the European Union, privacy is hailed as a fundamental right that can trump other interests. Even at the threshold level-determining what information is covered by the regulation-the United States and European Union differ significantly. The existence of personal information- commonly referred to as "personally identifiable information" (PII)-triggers the application of privacy law. The U.S. and the European Union define this essential term of privacy law quite differently. The U.S. approach involves multiple and inconsistent definitions of PII that are often particularly narrow. The EU approach defines PII to encompass all information identifiable to a person, a definition that can be quite broad and vague. This divergence is so basic that it threatens the stability of existing policy mechanisms for permitting international data flows.

To secure information technology and telecommunications systems, the U.S Department of Homeland Security created the United States Computer Emergency Readiness Team (U.S. CERT) to provide 24-hour early warning and detection for the federal government's Internet infrastructure. A leading program in this effort, EINSTEIN, was developed by U.S. CERT in partnership with the National Security Agency (NSA) and private industry. EINSTEIN is an intrusion detection program that monitors network traffic and searches for signatures of known malicious code. Now in its third generation, EINSTEIN now generates alerts that have the possibility of including Personal Identifying Information, monitors live traffic on networks in real-time, and also has the ability to counter the intrusion as it takes place. By reviewing current privacy policy and past privacy case studies, in addition to careful analysis of federal court cases and statutes, this thesis establishes the fundamental and constitutional right to privacy. Through secondary research, this thesis identifies elements and exemptions of current communications legislation that can be used in the development of a comprehensive cyberspace monitoring policy. The result is a recommendation that a new Einstein III Privacy Impact Assessment, as well as a new legal opinion document, be drafted to balance the trade-off between privacy rights and the objectives of securing cyberspace, and that establishes a proper legal foundation for the implementation of the controversial technology.

Cílem práce je seznámit odbornou i širokou veřejnost s metodou Malintent a jejím využitím pro odhalování potencionálních pachatelů teroristické činnosti. Práce přiblíží čtenářům záměr metody Malintent. Současný stav výzkumu ve světě. Další postupy po kladné odezvě technologie využívající Malintent. Analyzuje potřebu využití metody v ČR a vyhodnotí budoucnost metody., Objective of this work is to inform professionals and the general public with Malintent method and its application for detecting potential terrorists. Readers learn about Malintent method. What to do after the positive response technology Malintent. It analyzes whether the need to use the methods in the Czech Republic and evaluate future of this method., Ústav elektroniky a měření, obhájeno

The objective of the audit was to determine whether the controls over transactions processed through the Deployable Disbursing System (DDS) were adequate to ensure the reliability of the data processed, including financial information processed by disbursing stations supporting Operation Iraqi Freedom. The Army processed at least 272,131 commercial and miscellaneous payments, totaling $13.1 billion, through DDS from FY 2006 through FY 2008. Disbursing office controls over these payments were inadequate. Army disbursing personnel at 16 disbursing stations did not adequately control access to commercial and miscellaneous payment data processed through DDS. Specifically, disbursing personnel used accounts that bypassed controls to process $595.6 million in payments and assigned the system administrator privilege to 90 of the 253 individual main site user accounts in DDS. Furthermore, the disbursing offices at the seven disbursing stations visited did not properly restrict access to DDS interface files, maintain adequate separation of payment duties, and maintain adequate security and contingency plans. This occurred because the Army Financial Management Centers did not effectively review DDS user access or oversee the payment process, and the DDS Program Management Office did not provide sufficient visibility in DDS for management to review and identify access control weaknesses. As a result, the Army is at risk for losing disbursing data, improperly modifying payment transactions, improper payments, and unauthorized viewing of personally identifiable or classified information for 272,131 commercial and miscellaneous payments, totaling $13.1 billion. We identified potential monetary benefits for duplicate payments, totaling $162,258, that, if collected, the Government could put to better use. In addition, the Army's financial system did not maintain accurate or complete information. This occurred because Army finance offices did not properly use DDS interfaces.

Researchers in computer science departments throughout the U.S. are violating federal law and their own organization s regulations regarding human subjects research and in most cases they don t even know it. The violations are generally minor, but the lack of review leaves many universities open to significant sanctions, up to and including the loss of all federal research dollars. The lack of review also means that potentially hazardous research has been performed without adequate review by those trained in human subject protection. We argue that much computer science research performed with the Internet today involves human subject data and, as such, must be reviewed by Institutional Review Boards including nearly all research projects involving network monitoring, email, Facebook, other social networking sites and many Web sites with user-generated content. Failure to address this issue now may cause significant problems for computer science in the near future., Published in Communications of the ACM, v53 n6 p38-40, Jun 2010.

The term "spyware" generally refers to any software that is downloaded onto a computer without the owner's or user's knowledge. Spyware may collect information about a computer user's activities and transmit that information to someone else. It may change computer settings, or cause "pop-up" advertisements to appear (in that context, it is called "adware"). Spyware may redirect a Web browser to a site different from what the user intended to visit, or change the user's home page. A type of spyware called "keylogging' software records individual keystrokes, even if the author modifies or deletes what was written, or if the characters do not appear on the monitor. Thus, passwords, credit card numbers, and other personally identifiable information may be captured and relayed to unauthorized recipients. Some of these software programs have legitimate applications the computer user wants. They obtain the moniker "spyware" when they are installed surreptitiously, or perform additional functions of which the user is unaware. Users typically do not realize that spyware is on their computer. They may have unknowingly downloaded it from the Internet by clicking within a website, or it might have been included in an attachment to an electronic mail message (e-mail) or embedded in other software. The Federal Trade Commission (FTC) issued a consumer alert on spyware in October 2004. It provided a list of warning signs that might indicate that a computer is infected with spyware, and advice on what to do if it is. Additionally, the FTC has consumer information on spyware that includes a link to file a complaint with the commission through its "OnGuard Online" website. Several states have passed spyware laws, but there is no specific federal law and no legislation has been introduced thus far in the 111th Congress., CRS Report for Congress.

This report contributes to further development of the Security Quality Requirements Engineering (SQUARE) method to support privacy. Risk assessment is Step 4 in the standard SQUARE process. The report examines privacy definitions, privacy regulations, and risk assessment techniques for privacy. The risk assessment techniques are classified using a standard method, and promising techniques are applied to two case studies. The case study results are provided along with future plans for SQUARE in support of Privacy. Software-intensive systems are widely used for the rapid storage and retrieval of data. We trust that all types of data will reside in these systems and easily be transferred to other systems. This high level of trust poses certain privacy risks for sensitive information. If these risks are identified, we will be able to understand the potential consequences and establish the necessary preventative measures. This report summarizes the assessment of risks while focusing primarily on privacy concerns., Sponsored in part by the Army Research Office (ARO). The original document contains color images.

When considering information security and privacy issues most of the attention has previously focused on data protection and the privacy of personally identifiable information (PII). What is often overlooked is consideration for the operational and transactional data. Specifically, the security and privacy protection of metadata and metastructure information of computing environments has not been factored in to most methods. Metadata, or data about data, can contain many personal details about an entity. It is subject to the same risks and malicious actions personal data is exposed to. This paper presents a new perspective for information security and privacy. It is termed Meta Privacy and is concerned with the protection and privacy of information system metadata and metastructure details. We first present a formal definition for Meta Privacy, and then analyze the factors that encompass and influence Meta Privacy. In addition, we recommend some techniques for the protection of Meta Privacy within the information systems. Further, the paper highlights the importance of ensuring all informational elements of information systems are adequately protected from a privacy perspective.

With the increasing number of proposals and approaches to privacy protection, it has become very difficult to build information systems that provide comprehensive protection for a very broad range of information privacy issues. Proposals to information privacy are normally based on one or a combination of the four major models of privacy protection. That is, Comprehensive Privacy Laws, Sectoral Privacy Laws, Privacy Self-Regulation, and Technologies of Privacy. Used without direction or by not following privacy by design principles results in the ineffective privacy protection. What is required is a complete solution, that gives due consideration to all models, and is easily integrated in to all types of environments. In this paper we address this problem by providing a privacy solution for integration into information systems called Shield Privacy. The Shield Privacy solution provides an effective system wide approach to privacy protection. It integrates relevant components from the various privacy models while also providing comprehensive information security through privacy influences data access controls.

There are numerous information privacy approaches based on the four major models of privacy protection. That is, Comprehensive Privacy Laws, Sectoral Privacy Laws, Privacy Self-Regulation, and Technologies of Privacy. These solutions, used individually or without proper system privacy design considerations, have not been very effective. This is because there has been little in the way of instruction on how developers and designers are supposed to use these privacy tools. In this paper we address the problem by providing a privacy solution for integration into information systems called Shield Privacy. The Shield Privacy solution provides an effective system wide approach to privacy protection. It integrates relevant components from the various privacy models. We have implemented our Shield Privacy in a collaborative environment application. In this paper we also describe the prototype and discuss its advantages and areas of future work.

There are numerous information privacy approaches based on the four major models of privacy protection. That is, Comprehensive Privacy Laws, Sectoral Privacy Laws, Privacy Self-Regulation, and Technologies of Privacy. These solutions, used individually or without proper system privacy design considerations, have not been very effective. This is because there has been little in the way of instruction on how developers and designers are supposed to use these privacy tools. In this paper we address the problem by providing a privacy solution for integration into information systems called Shield Privacy. The Shield Privacy solution provides an effective system wide approach to privacy protection. It integrates relevant components from the various privacy models. We have implemented our Shield Privacy in a collaborative environment application. In this paper we also describe the prototype and discuss its advantages and areas of future work.

When considering information security and privacy issues most of the attention has previously focussed on data protection and the privacy of personally identifiable information (PII). What is often overlooked is consideration for the operational and transactional data. Specifically, the security and privacy protection of metadata and metastructure information of computing environments has not been factored in to most methods. Metadata, or data about data, can contain many personal details about an entity. It is subject to the same risks and malicious actions personal data is exposed to. This paper presents a new perspective for information security and privacy. It is termed Meta Privacy and is concerned with the protection and privacy of information system metadata and metastructure details. We first present a formal definition for meta privacy, and then analyse the factors that encompass and influence meta privacy. In addition, we recommend some techniques for the protection of meta privacy within the information systems. Further, the paper highlights the importance of ensuring all informational elements of information systems are adequately protected from a privacy perspective.

Preserving Privacy and the protection of personally identifiable information (PII) have been of increasing interest over the last few years. Many privacy advocates, and a significant portion of the general public, feared that the new initiatives used in an attempt to fight terrorism, would have a serious impact on an individual?s right and ability to protect their privacy. This paper proposes a new framework for Preserving Privacy for individuals along with the protection of personally identifiable information. We have termed it Privacy Shield. Through the application of anonymity and privacy principles in design, the privacy protecting separation of data, the use of public key infrastructure, and the application of our Information System Hippocratic Policies, we provide a framework of privacy shield to protect an information system user?s personal data.

Many new Privacy Laws and Regulations have placed an increased importance on the correct design and implementation of information systems. This is an attempt to preserve and protect user and information privacy. Incorporating privacy regulations and guidelines into an active information system is often unsuccessful and ineffective. In addition, systems that have already progressed through the development life cycle can very expensive to change once implemented. We propose the integration of privacy preservation methodologies and techniques into each phase of the system development life cycle (SDLC). This is to preserve the privacy of individuals and to protect PII (Personally Identifiable Information) data. The incorporation of IT Security measures in each SDLC phase is also discussed. This is due to its direct relevance and correlation with information system privacy issues. The proposed methodology involves identifying the privacy and security issues in each phase. From there appropriate privacy protecting and security techniques are applied to address these issues. Special mention is made of the recently proposed Common Criteria. The CC is an international standard for IT Security for Information Systems. Specifically, this paper will analyse the way the Common Criteria currently deals with privacy in information systems, and what is needed to improve its current inadequate handling of information privacy.

Jones, A., Angelopoulou, O., Vidalis, S., & Janicke, H. (2017). The 2016 hard disk study on information Available on the second hand market in the UK. In European Conference on Information Warfare and Security ECCWS. (pp. 193-199). United Kingdom: Curran Associates.

De-identification methods have helped government organizations provide the public with useful information—promoting transparency and accountability while also protecting the individual privacy of the data subjects. However, due to the recent massive increase in data collection and improved methods of analysis, de-identification has become a more difficult task. This work outlines challenges and discusses procedures for making a potentially sensitive data set available to extramural researchers and institutions without significant risk to human subject privacy. We provide a detailed explanation of personally identifiable information to help us understand what forms of personally identifiable information can cause the most harm. Furthermore, we discuss the legality and ethics behind working with personally identifiable information to illustrate the importance of protecting privacy. We then offer a taxonomy of threats, vulnerabilities, and impacts and describe how these determine risk. Based on this taxonomy, we develop a framework to assess risk on the Real Data Corpus, a collection of forensic disk images containing personally identifiable information. In addition, we analyze de-identification methods such as pseudonymization and anonymization, and consider re-identification risks. Finally, we apply our framework and methodology to a real-world scenario to determine the risk of data disclosure to an extramural researcher., http://archive.org/details/aresponsibledeid1094550531, Civilian, National Science Foundation Scholarship for Service Recipient, Approved for public release; distribution is unlimited.