Surveillance: From Solutions to New Problems

Thesis (Ph.D.)--University of Washington, 2017-06The use of digital communications networks like the Internet has led to the creation of digital surveillance operations. The digital nature of these networks allows surveillance to be conducted in a broader and more automated fashion than traditional surveillance. In addition, the types of adversaries with surveillance motives and capabilities changes in the digital realm: while governments are the traditional operators of surveillance, this dissertation identifies the extensive online advertising ecosystem as a similarly capable surveillance framework. As the Internet continues to facilitate more and more everyday actions of individuals, there is increased risk that more and more of these everyday actions can become subject to surveillance. Understanding what surveillance is occurring, who is capable of accessing this data, and how individuals can protect themselves is critical to future privacy and security of individual users. This dissertation addresses parts of these problems on all three fronts. First, it designs and assesses a covert communication system designed to facilitate two-way real-time text conversations over a steganographic covert channel in online games. Second, this dissertation evaluates user defenses in the webtracking context to rigorously evaluate the efficacy of these defenses using both traditional tracking mechanisms approaches and newer targeted ad measurements. We find that that many existing recommended defenses are not effective, particularly that the type of ad-friendly tracking defenses that would be essential to protecting user privacy without disrupting ad-revenue based business models are significantly less effective than more aggressive ad-blocking defenses. Finally, it addresses who is capable of obtaining the data gathered by surveillance entities, specifically the advertising ecosystem, by exploring the ability for individuals to use this ecosystem for targeted surveillance. We refer to this as ADINT - for advertising intelligence \dash and find that the modern advertising ecosystem allows individuals or small groups with modest budgets ($1,000) to obtain surveillance capabilities reminiscent of state-level capabilities, such as fine-grained location tracking. These three components demonstrate the perniciousness of modern digital surveillance and the difficulty that users face in trying to defend against it