These slides are from a briefing to Congressional staffers about privacy, October 30 2014. It talks about our ongoing work with PrivacyGrade.org, which uses crowdsourcing techniques plus static analysis techniques to infer the privacy-related behaviors of apps.

1. ©2014 Carnegie Mellon University : 1
How to Analyze the Privacy
of 1 Million Smartphone Apps
Oct 30 2014
Jason Hong
jasonh@cs.cmu.edu
Computer
Human
Interaction:
Mobility
Privacy
Security

2. ©2014 Carnegie Mellon University : 2
In the near future, our
smartphones will know
everything about us

3. ©2014 Carnegie Mellon University : 3
Smartphones are Intimate
• Mobile phones and
millennials (Cisco 2012):
• 75% use in bed before sleep
• 83% sleep with their phones
• 90% check first thing in the
morning
• A third use in bathroom (!!)
• A fifth check every ten
minutes

4. ©2014 Carnegie Mellon University : 4
Lots of Data on Smartphones
Who we know
(contact list)
Who we call
(call log)
Who we text
(sms log)

5. ©2014 Carnegie Mellon University : 5
Lots of Data on Smartphones
Where we go
(gps, foursquare)
Photos
(some geotagged)
Sensors
(accel, sound, light)

6. ©2014 Carnegie Mellon University : 6
The Opportunity
• We are creating
a worldwide
sensor network
with these
smartphones
• Can analyze
human behavior
unprecedented
fidelity and
scale

7. ©2014 Carnegie Mellon University : 7
These Capabilities Can Be
Used for Tremendous Good
• Ex. detecting onset of depression
• Ex. understanding cities
• Ex. next-gen intelligent agents

8. ©2014 Carnegie Mellon University : 8
These Capabilities Can Also
Be Creepy and Invasive
Shared your location,
gender, unique phone ID,
phone# with advertisers
Uploaded your entire
contact list to their server
(including phone #s)

9. ©2014 Carnegie Mellon University : 9
Many Smartphone Apps Have
“Unusual” Permissions
Location Data
Unique device ID
Location Data
Network Access
Unique device ID
Location Data
Unique device ID

10. Nissan Maxima Gear Shift
©2014 Carnegie Mellon University : 10

11. ©2014 Carnegie Mellon University : 11
Privacy as Expectations
• Apply this same idea of mental
models for privacy
– Compare what people expect an app
to do vs what an app actually does
– Emphasize the biggest gaps,
misconceptions that many people had
App Behavior
(What an app
actually does)
User Expectations
(What people think
the app does)

12. ©2014 Carnegie Mellon University : 12
85% users were surprised this app
sent their phone’s unique ID to
mobile ads providers.
25% users were surprised this app
sent their approximate location to
dictionary.com for searching nearby
words.
10% users were surprised this app
wrote contents to their SD card.
0% users were surprised this app
could control their audio settings.
See all
95% users were surprised this app
sent their approximate location
to mobile ads providers.
95% users were surprised this app
sent their phone’s unique ID to
mobile ads providers.
90% users were surprised this app
sent their precise location to
mobile ads providers.
0% users were surprised this app
can control camera flashlight.

13. ©2014 Carnegie Mellon University : 13
Results for Location Data
(N=20 per app, Expectations Condition)
App Comfort Level (-2 – 2)
Maps 1.52
GasBuddy 1.47
Weather Channel 1.45
• People more
Foursquare 0.95
TuneIn Radio 0.60
Evernote 0.15
Angry Birds -0.70
Brightest Flashlight Free -1.15
Toss It -1.2
comfortable when
told why app used
data (even ads)
• Our work helped
influence FTC in
fining Brightest
Flashlight in Dec 2013

14. Scaling Up to 1 Million Apps
©2014 Carnegie Mellon University : 14

15. ©2014 Carnegie Mellon University : 15
Scaling Up to 1 Million Apps
• Crawled 1M apps on Google Play
• Created a model to predict concerns
– Ex. Contact list for social network mild
– Ex. Contact list for ads very bad
• Analyzed 1M apps for behaviors
– Advertising, analytics, social net, other
• Assigned grades based on model

16. ©2014 Carnegie Mellon University : 16

17. ©2014 Carnegie Mellon University : 17
What
permissions
used and why

18. ©2014 Carnegie Mellon University : 18
Libraries are
reusable pieces
of code
Most sensitive
data requests
due to third-party
libraries

19. ©2014 Carnegie Mellon University : 19
Check it out at
privacygrade.org

20. ©2014 Carnegie Mellon University : 20
Reflections on Privacy
• FTC overwhelmed by sheer numbers
– Too many web sites, hardware, apps
• Developers don’t know what to do
– State of developer tools also poor
• NSF funding flat, unpredictable
• Business models predicated on
leveraging lots of user data
• Too much burden on end-users

21. ©2014 Carnegie Mellon University : 21
Reflections on Privacy
• FTC (and third parties) need better tools
to detect privacy problems
– Scale up what FTC lawyers manually do today
– Consider FTC fund 6.1, 6.2, 6.3 research
• Expand NSF funding
– Both education and research (centers)
• Developers
– Consider NIST holding developer conferences
to work out best practices for privacy
– Longer term: fund scholarships for privacy

22. ©2014 Carnegie Mellon University : 22
Reflections on Privacy
• Operating Systems / App Markets
– Nearly every app distributed via markets
– Ex. Make devs more aware of 3rd party issues
– Ex. Better tools to help average developer
– Not clear if much government can do here
other than embarrassing Google, Apple
• Businesses
– Slap wrist of most egregious to set tone
– Need to be careful not to squelch innovation
• Ex. Facebook Newsfeed initially unpopular
– Clearer rules for advertisers

23. ©2014 Carnegie Mellon University : 23
Thanks!
More info at cmuchimps.org
or email jasonh@cs.cmu.edu
• Shah Amini
• Song Luan
• Yuvraj Agarwal
Special thanks to:
• Army Research Office
• NSF
• Google
• CMU Cylab
• Jialiu Lin
• Norman Sadeh