The Norwegian Blue A lesson in Privacy Engineering Eivind Arvesen, - - PowerPoint PPT Presentation

▶
the norwegian blue
SMART_READER_LITE
LIVE PREVIEW

The Norwegian Blue A lesson in Privacy Engineering Eivind Arvesen, - - PowerPoint PPT Presentation

Jan 05, 2024 532 likes •1.18k views

The Norwegian Blue A lesson in Privacy Engineering Eivind Arvesen, Aug. 7th 2020 Crypto & Privacy Village: Glitched (at DEF CON 28: SAFE MODE) $ whoami Eivind Arvesen Consultant @ Bouvet (Oslo, Norway) Privacy and security Senior

slide-1
SLIDE 1

Eivind Arvesen, Aug. 7th 2020 Crypto & Privacy Village: Glitched (at DEF CON 28: SAFE MODE)

The Norwegian Blue

A lesson in Privacy Engineering

slide-2
SLIDE 2

$ whoami

Eivind Arvesen
 Consultant @ Bouvet (Oslo, Norway)

  • Privacy and security
  • Senior software developer and architect
  • Security competency group leader
  • Argumentative hobby writer
  • Part of expert group evaluating Smittestopp

: @EivindArvesen EivindArvesen.com

slide-3
SLIDE 3

Disclaimers ⚠

slide-4
SLIDE 4
slide-5
SLIDE 5

Norway?

slide-6
SLIDE 6
slide-7
SLIDE 7
slide-8
SLIDE 8
slide-9
SLIDE 9
slide-10
SLIDE 10
slide-11
SLIDE 11

Norway

  • A scandinavian, nordic country (in Northern Europe)
  • Consistently scores high on
  • Per-capita income
  • Human Development Index
  • Inequality-adjusted ranking
  • World Happiness Report
  • OECD Better Life Index
  • Index of Public Integrity
  • Democracy Index
  • High trust in the government and public services in general
  • Highly digitalized society
  • Pride ourselves on «knowledge» and trusting experts
slide-12
SLIDE 12
slide-13
SLIDE 13

«I wish to register a complaint»

slide-14
SLIDE 14

Contagion

slide-15
SLIDE 15

Early examples of digital protocols and implementations (apps)

  • Singapore
  • South-Korea
  • Israel
slide-16
SLIDE 16
slide-17
SLIDE 17

Shutdown

slide-18
SLIDE 18

Source code leak

slide-19
SLIDE 19

Source code leak

slide-20
SLIDE 20

«It’s dead»

slide-21
SLIDE 21

The app

slide-22
SLIDE 22

Summary

  • Closed-source solution
  • Requires registration and de facto identification of users
  • Collects sensor data from multiple sources (both BLE and GPS)
  • Uploads data from all users, all of the time, to a centralized storage
  • «Heartbeats" that contain information about BLE and GPS-activations in the

app are sent in the background.

  • Static, device-specific identifier
slide-23
SLIDE 23

Basis for processing

Smittestopp’s basis for processing is not consent – but regulation (still voluntary to use) “We can all help stop the spread of infection and save lives,” Prime Minister Erna Solberg said in a statement at the time. “If many people download the Smittestopp app, we can open up society more and get our freedom back.”

slide-24
SLIDE 24

Dual purpose

Purposes of the Norwegian COVID-19 contact tracing solution:

  • Contact tracing
  • Provide data to evaluate

government interventions and use as input to epidemiological models

slide-25
SLIDE 25

Location Data

slide-26
SLIDE 26

Centralized storage

Continuously upload all sensor data from all users
 – as opposed to keeping user data on device, only uploading when needed.

slide-27
SLIDE 27

Privacy-first contact tracing

slide-28
SLIDE 28

Privacy-first contact tracing

slide-29
SLIDE 29

Data integrity and user traceability

slide-30
SLIDE 30

Identifying users and analytics data

slide-31
SLIDE 31

Legal implications

  • Regulation forbids sharing of health and location data data with law

enforcement, etc.

  • BLE is neither
  • Sunset-clause
  • Risks of CLOUD & Patriot acts
slide-32
SLIDE 32

Interoperability

slide-33
SLIDE 33

Misc.

slide-34
SLIDE 34
  • Unknown viability
  • Not in accordance with common

European Guidelines

  • Extremely invasive measures
  • Closed source

Discussion

slide-35
SLIDE 35

Re: Anonymity… «The report also has a recommendation of anonymization of data for analysis purposes, through so-called differential privacy. FHI has at this point already developed an elaborate system for anonymization that in FHIs view will have an equally anonymizing effect as so-called differential privacy, but which is easier to implement, communicate and doesn't lose any data quality to speak of.» (freely translated from Norwegian)

Anonymity in long-term data storage

slide-36
SLIDE 36

Possible attacks

  • Relay-attacks
  • Tracking-attacks (combine/collaborate for distributed surveillance!)
  • Infection-mapping
  • Impersonation/surveillance
  • Reidentification from de-identified (not the same as anonymized!) data points
  • Data theft, leak or misuse (risk magnified by state-actor)
slide-37
SLIDE 37

«It's restin’»

slide-38
SLIDE 38

The expert group

Appointing an independent expert group… The group must provide the following:

  • 1. An open report to the Ministry of Health and Care Services with an overall

assessment of whether security and privacy are properly taken care of.

  • 2. A report excluding the public to Simula and FHI with a copy to the Ministry of

Health on any identified weaknesses that must be corrected.

  • Expert group mandate (Google Translate)
slide-39
SLIDE 39

Preliminary report

Limited to smartphone apps, select parts of backend and only technical security aspects. Extremely little time + what solutions were finished (or even started) at that point. Deletion, matching algorhithms, and anonymization/aggregations are examples of things that were not implemented at this point. TLDR; Lots of low-hanging fruit, like scalability-issues, general robustness, vulnerable dependencies, methodological weakness, weak protocols, data- integrity-issues, data leaks, lack of input validation, and weakness in configuration.
 Also: PERMANENT, device-specific identifiers (!) – which would make it possible to derive others’ identity and/or COVID-status.

slide-40
SLIDE 40

The app was launched to the entire country while still in evaluation; collecting data from everyone, but

  • nly offering contact notifications

for a couple of select test- municipalities Promptly reverse-engineered, inspected by critical tech- community

Launch

slide-41
SLIDE 41
slide-42
SLIDE 42

A petition from over 300 professionals in security, privacy and tech, asking the government to change their approach

Petition

slide-43
SLIDE 43

«HELLO POLLY»

slide-44
SLIDE 44

Outline

Findings

  • Aggressive analytics
  • Static identifier in BLE-contact
  • Eternal connection string
  • Using preview feature for personal data
  • Limitations of auditing solutions
  • Data deletion also deletes audit logs
  • Quality issues in contact analysis code
  • Using SMS as notification channel
slide-45
SLIDE 45

«WAKEY WAKEY»

slide-46
SLIDE 46

Conclusion of the report

Is security properly handled?
 No Is privacy properly handled?
 No

slide-47
SLIDE 47

Outline

Recommendations

The group's recommendations in our final public report included:

  • Clarifying the regulation which serves as basis for processing (changing "anonymized" to "deidentified"), to enable data aggregation

in practice.

  • Split purposes, and allow users to choose how their data is used (split into several apps, or implement opt-in functionality). This might

both protect users' interests and lead to more users.

  • Remove all data that is not needed (e.g. delete location data older than 15-16 days, delete location data without crossing trajectories

at regular intervals) to increase data minimization.

  • Implement differential privacy in data aggregation processes, to reduce risk to privacy and increase accuracy of the resulting dataset.
  • Consider rewriting to a more distributed solution, post stabilized contact tracing criteria, as this could be both less invasive and lead

to an increase in users.

  • Implement local differential privacy before uploading user data, to further decrease privacy impact.
  • Make as much source code as possible available as open source, to give the public real insight into how their data is used.
  • Regularly evaluate the solution, purpose and effect, to ensure that the solution is still suitable, and the problem is still relevant.
slide-48
SLIDE 48

«It's bleedin' demised»

slide-49
SLIDE 49

Aftermath

1.The Norwegian Institute of Public Health disagreed with our conclusion 2.The supplier/producer responds to this by publicly attacking the expert group, questioning their motives and claiming that their conclusions and recommendations are personal political opinions 3.Parliament decides to split app based on purpose 4.The Norwegian Data Protection Authority concludes that the degree of privacy-invasiveness is not justified 5.Health authorities chose to stop all data collection, and to delete existing data 6.Amnesty International stated that they found the Norwegian app to be among the most dangerous tracing apps for privacy. 7.International media (NYT, etc.)

slide-50
SLIDE 50

Sidenote

Media-strategy/handling criticism

What about privacy? The expert group concludes that they "think privacy is not well enough taken care of". Simula would like to point out that this is not justified with any sides of the app itself. The expert group do not wish that location data be collected, and they therefore conclude that privacy is not handled good enough. Political recommendations Several of the recommendations from the expert group, on the other hand, bears the impression of being the members' views on some familiar discussions that have been around Smittestopp along the way. This especially goes for the members of the group wanting contact tracing only locally on the phones (Recommendations "Go over to a dsitributed model for collection of data" and "Split the purposes and make it possible to elect to be part of only one") and that the members wish that the source code be made publicly available. ("Make available as much source code as possible as open source"). These are familiar subjects of debate, but has little to do with how Smittestopp works.

slide-51
SLIDE 51

Sidenote

Media-strategy/handling criticism

"There are many countries I think should not use the Norwegian solution – precisely because they don't have a well regulated democracy; They don't have strong privacy interests and governments that keep watch»
 (freely translated from Norwegian) Simula's Deputy Managing Director in episode #2

  • f the Norwegian podcast Waterhouse.
slide-52
SLIDE 52

Key point:

Data protection and and privacy are different things.

slide-53
SLIDE 53

Aftermath

1.The Norwegian Institute of Public Health disagreed with our conclusion 2.The supplier/producer responds to this by publicly attacking the expert group, questioning their motives and claiming that their conclusions and recommendations are personal political opinions 3.Parliament decides to split app based on purpose 4.The Norwegian Data Protection Authority concludes that the degree of privacy-invasiveness is not justified 5.Health authorities chose to stop all data collection, and to delete existing data 6.Amnesty International stated that they found the Norwegian app to be among the most dangerous tracing apps for privacy. 7.International media (NYT, etc.)

slide-54
SLIDE 54

It's rung down the curtain and joined the choir invisible!»

slide-55
SLIDE 55

Takeaways

1.What can we learn from all of this? 2.What happens next?

slide-56
SLIDE 56

Recap

slide-57
SLIDE 57

Summary

In being ambitious in it’s scope (attempt to solve several problems), without regard for users’ rights and interests, refusing to listen to expertise and criticism at just about every turn, Norway has made one of the most privacy- hostile COVID-19 apps as of yet.

slide-58
SLIDE 58

This is not good craftmanship from the perspective of privacy engineering. This is architecturally not a privacy-friendly solution. This seems to be the very antithesis of «privacy by design.»

Summary

slide-59
SLIDE 59

Outline

Summary

"There are better options available that balance the need to trace the spread of the disease with privacy... This episode should act as a warning to all governments rushing ahead with apps that are invasive and designed in a way that puts human rights at risk. Privacy doesn't need to be a casualty in the rollout of these apps.» – Claudio Guarnieri, Head of Amnesty Security Lab

slide-60
SLIDE 60

Now we have no app.

slide-61
SLIDE 61
slide-62
SLIDE 62

… but there’s hope

The future

slide-63
SLIDE 63

👌

(graphics from unsplash.com)

: @EivindArvesen EivindArvesen.com