Naming the Harm: A Privacy Threat Vocabulary for Cypherpunks| Mate Soos and Daniel Calderon

Hi everyone. Uh thank you for the wonderful introduction. Um um I'm mate and this is Daniel. Um we'll be talking about um basically privacy nomenclature um that is used in ana well originally in academic setting and then uh now in in practical use u in industry and of course within our uh uh within within our communities. Um so first just a little bit of a state of of privacy.

Um I guess you're aware of this but I just want to reiterate where we are. So there is uh lately of course there's been this whole mess around uh tornado cache and it's uh developer who have been uh sanctioned and then uh put in court and dragged around um for essentially um free speech. Um, hard to say anything other than that, like just code essentially. Um, and um, actually, funny enough, code as a weapon is now coming back with AI, right? So, if you think about it, there's just been some AI models being banned by the US government for for uh essentially saying that they're too powerful, which is the same uh rationale that was given for uh for asymmetric cryptography if you remember back in the days.

now and the same thing is playing out with tornado cache. Um, of course there's other things as well. I that's kind of the greater uh like to the thing that everybody hears around and hears about. But uh when it comes to everyday stuff, I mean there's of course chain analysis firms going on that um an analyze all transactions on the blockchain and uh build up networks of um transactions and uh spending patterns and uh you know time of day use for your of your of your uh accounts which often indicates which parts of the continent you are in of of the world you're in or which continent you're in or often even which countries you're in or likely countries you're in. Then of course there are KYC leaks which we have seen as well uh that connect the dots.

So now you have this uh open um transaction chain that anybody can read and now with the KYC I can actually connect to the to the to the actual individual and even if I can't I can connect it to their friends whose KYC has leaked. So even if your KC haven't hasn't leaked then you will see that we have a specific harm for this which is linkability where you can uh even if it wasn't you you can link um um information that is not specifically about you to information that is um that that is available and therefore uh can reveal information about you if not your name then just other kind of information that could be sensitive and then there's of course map surveillance which is basically uh stuff that you haven't even transacted. So transactions that are still sitting in the man pool um are being surveyed and of course front run left and right. Some of it has nothing to do with privacy. It's just pure speculation and making money off of your um transactions that haven't yet executed but uh there are of course privacy implications for it.

Okay, so just a very quick short description like privacy is not security. So you need to be kind of careful. It's not the same thing. um you can um perfectly secure all your information. Uh let's say that the uh the company that collected all the information has perfectly secured it, never released it.

Nevertheless, they can process it and and and and gather information from it. So just the act of of of gathering the information and processing it is a problem in itself. Even if we secure it with the best cryptography available, it's got nothing to do with security in this sense. And then so why are we doing this? Um just I I think I will give this to Daniel in a second but so the idea is that that um of course the the the things about privacy has been taught before the the the electronic age and it has been an important aspect of society and there's been interesting thoughts that have been uh taught about this and then uh the cipher punk manifesto is trying to sort of lift this into the electronic age um and now we're here uh No, I'll give it to Daniel.

Thank you, mate. So, I can have the clicker as well.

Thank you. So, I um Daniel, I'm a privacy engineer and um I currently work inside the web 2 e-commerce, but I'm in the place that I pay that work that I work for is not necessarily uh the stent of my discipline. Uh with this privacy engineering, I'm talking about something that is that is really a discipline that's about embedding privacy norms into IT systems. that's really about moving beyond compliance and into the design and implementation of user centric information flows um that use both technical and organizational processes. Um and this talk is largely going to be about a toolbox that can really serve as a map for how to do this.

Um as I go into my part of this um I'm going to be describing especially one particular kind of framework which is called Lynden. Um, and it's really very similar for those of you who might have a security background to an existing framework that's called stride. And it's almost exactly the same idea. It's just to use different terminology, not security terminology, but privacy terminology. Um, but uh for those of you who don't know even a stride, it's essentially a way of mapping a system and showing that in this system, this is a a place where you would have information flows happening and inside of a particular information flow, a particular problem would arise.

Maybe it's a security problem and stride is a is an acronym for finding a security problem there. Um it's the same idea with Lynden. It's just that it's now with privacy terms and in this talk we're going to go through those terms. Um it was developed at KU Lloyd uh by this paper that was that that is cited here. Dengal uh Kim Voitz has been a particular researcher that's been particularly good at um at uh at bringing attention to it and and showing how it can be put in practice um in in in practice.

Um and uh and yeah, it's even been noted as as a as a as a as a tool that um is accepted by by um authoritative entities like the NIST and also by um uh I think the Kennel um or Nissa um as places where if you ever ever need to be following article 25 of the GDPR following a process like this is an accepted one that's yeah this is a good way of really meeting that that expectation. Um, so yeah, the goal to systematically elicit privacy threats in a system. Um, not just rely fully on on intuition and also expand the view so that you're not just tunnel visioned into one particular problem you're solving well and forget about the other problems that might also still be there. Um, and really help also know where where you could bring in mitigations. Uh maybe you're focused in your um your place on one particular problem and know that there are other places where you could find the solutions that could that could help you out.

Um, so let's go into that. Lyndon. Uh before I do that though, actually yes, it's useful to have a an overview of how this um this works and and here I'm I'm bringing you a little of that academic view on this that um to to to note this problem, it's it's good to break it down into the different sections. So using the terminology that was used by um this researcher Daniel Solov, he broke it into the information life cycle and really looked at three key pieces. The collection stage, the processing stage, and the dissemination stage.

Those who are familiar with the GDPR terminology, this really maps really quite nicely to the modern GDPR terminology as well of data collectors who both use collect and process data, data processors who will process data and also um the ways in which data controllers will share that data with either data controllers or data processors. Um and and the thing is that at each of these different stages different problems arise and it's useful to be very specific about the problems rather than talk very generally about privacy as a problem but rather say that there are privacy problems at the collection stage, privacy problems at the processing stage and privacy problems at the dissemination stage. Um and yeah to be really clear as well about this is a bit of mixing of them. I know this is a talk that's intended to introduce a terminology. So I also want to be specific that this is a blending of two different ones that Solov's taxonomy was the one that was used for the overall life cycle here.

Um but we're going to be talking about Lynden and Lynden is different terms that are being used than the ones that Solv did for his taxonomy. Uh but Lyndon is useful because of that stride connection and that more connecting to private the the practical aspects. So that's why we move into this. This is actually Lynden on this slide. So, Lyndon is an acronym that um is noting about seven different um privacy harms that can arise at each of these different stages.

Whether that's linkability, identifiability, uh non-repudiation, detection, data disclosure, unawareness, uh and non-compliance. Each of these when we talk about privacy, we often may even blend these or speak abstractly about all of them. Um, but it's useful to to say that when there's a particular problem and maybe even a particular solution that it's only targeting one of those problems and and and is a solution for only one of those problems. Um, I think this talk wouldn't be long enough um for me to go through each of the different seven. So, I think we've only selected a handful of them and we'll try and and help describe how these can be um understood better and also tied into into more hands-on ways.

But um but the talk will need to be a lot longer for us to go through all of them. Um so let's go through a few of them first. I think we're starting with linkability. Um and that one is defined as the association of data or actions to learn about an individual without necessarily knowing who they are. We started with this one particular because it's very useful to break it apart from what a lot of thoughts about um privacy are which is very often just about identification.

Um but linkability isn't about identification. Um it's not about necessarily being able to say that this particular person is in this data set. It's about being able to learn something about those that are in that data set um by putting a lot of pieces of information together. Uh, one of the classic examples that was used, but a lot of other examples could be used um happened in the states with this um company that's um like a a commerce company called Target that identified pregnant customers just from their shopping patterns, which is, you know, it's apparently a period in one's life when when when a person is pregnant, that's a very likely period in which they're going to change, which is their most common place which they shop. And so for a marketer's perspective, they can learn that stage.

That's exactly the place in which they can end up knowing um that they can change. But how do you end up learning that? Well, they learned it from shopping behaviors. If they saw that somebody had normally bought in a certain way and then suddenly they were buying a bunch of um pregnancy related aspects, then they got the sense, okay, this person's pregnant, it's time to market a lot to them because I might be able to switch to switch them, which from a marketer's perspective, that sounds like gold. From a privacy perspective, that sounds creepy.

Um, and so this is really an aspect of linkability. It was never really about specifically an an specific individual. It was just about learning about behaviors and showing that this could be something you could learn about somebody. Making it even newer. Um, you can also see that like the Cambridge Analytica kind of scandals were also in that space as well.

not not just about targeting a particular person but about finding patterns of behavior that would lead you to think that this person could be perhaps politically persuadable which um I think mate especially will talk a little about that like about the aspects of having to think about politics of this um I'll keep in mind that Lyndon is just um a tool that can be used in in one way or another to identify whether or not a problem is there um but when you know that something like Cambridge Analytica is the kind of linkability problem that you're thinking about then you realize that there's there's quite serious um problems that are even there for society that that need to be considered. Um so I think we also noted here about some of the ones that are for crypto where we mean cryptocurrency here right and I'll especially hand it over to Monte here to mention about the chain analysis clustering and how that can happen for linkability.

Um I mean this is quite easy. So let's say that you have agnosis cards and all the transactions are on the chain. uh you all go together to buy uh you know for for lunch with your colleagues and everybody's going to spend at the same uh restaurant you know one after the other within you know a 1 2 3 minute interval you all going to spend and you're going to do this every weekday I mean it's going to be hard for me not to know that you're working together right uh so this is an obvious linkability case where you know there's no direct link between me and you uh in any way like I'm not transacting with you um we just happen to both transacting with the same entity because we both have lunch at the same place because we're working together. So I can figure out groups of people working together even if they're not in an employment relationship. Maybe they're just friends, lovers, girlfriends, boyfriends, you know, they go to clubbing together.

I can all figure that out just by spending patterns. So this this linkability, I don't know who you are, like I don't actually know who these people are, but I can group them together and and say they belong in in social circles, right? And that can be a problem because if if you know one individual happens to commit a crime, you know, what is the police going to do? Well, they immediately do the the the the the grouping and then start investigating all the other people. And ostensively, you know, you have nothing to do with these people necessarily.

You know, you might just be, I don't know, having out going out in clubbing. You have no idea what they're doing in their, you know, in their their daily lives. But now you're a suspect or you could be um you could be uh digged into your your your um your spending habits could be then further analyzed for um some kind of suspected behavior that you might never have had. Um so this is linkability and I mean obvious that um nobody needs to know who this person is for them to be linked right just by the spending uh cool spending heristics

and a little one solutions as well especially for currencies and

I mean there are like staff addresses I think it's quite obvious if you know uh what stealth addresses are so basically create a new address for every single spend and uh use that uh then of course you cannot be linked so every single transaction happen see seems like it's coming from a new address so there's no way to link uh people together Right. It's essentially like getting a uh you can get this actually even without crypto or like dynamic uh credit cards. You can get a new credit card every time uh I mean new credit card number and they just use that for every single spend then you cannot be connected together. Uh same thing of course but on crypto.

Yeah. Thank you for that and I think that's the useful thing of this right is like once you know like instead of dealing you've generally got a privacy problem you know you have a linkability problem then you might be thinking in the space of of stealth addresses or things like that. Um moving to the next one. Let's say you think you might have an identifiability problem where this is defined as as learning the identity of an an individual from nominally pseudonymous data. I like how that's um phrased there because yes, pseudonmous is not the same as anonymous.

And this is really where you get into the the space where a lot of people who really think about privacy are very much talking in this space a lot. Um solutions that are really about trying to find issues for identifiability. Um there's a lot of technologies that have been in this space, but it's definitely as well within the GDPR understood. Um, and the way the the way the regulators talk about it of making a difference between anonymous versus pseudonymous versus fully clear data. Um, I mean the real world examples probably are fairly wellnown.

I went with one of the oldest ones that is known here. Uh, the Netflix problem was also one that had this. Um, but any one of those scenarios where you have a data set and they did nothing more than perhaps remove names but kept all the rest of the information. um the fact that you can pull any of these other features of of this data set and and and note that there's a unique signal to one particular one can still allow you to identify even if you've removed the let's call them direct identifiers which is the terminology that most gets used here. um this problem that occurs so often and is unfortunately still occurring even though GDPR tried to make us know that we had to be paying attention to this but nonetheless um then there are solutions for it but let's now talk about it in the cryptocurrency sense

right so I mean this is quite obvious it's the classic KYC issue right so your K you get KYC uh Gnosius's KYC um uh provider actually got hacked if I remember correctly their data got leaked so if you ever got if you if you got KYC by Gnos this is a provider that got leaked and your ID is out there which of course ties to your address which from there on uh ties to uh what you have done um um I mean the obvious solution is ZK there's there's nothing else that I would uh recommend here um the problem of course with ZK is that it has cost to pay we'll talk about cost later but it's it's a non-trivial cost to pay um to to have ZK um as um as a way to to reduce the um the the the risk of identity the disclosure.

Yeah. And if there's one other thing that I'll just add to this, it's really important to have the distinction between linkability and identifiability. And so I think this is the thing that adds value is that you can have a perfect solution for identifiability that does absolutely nothing for linkability. And sometimes you can have the reverse as well. Um so you can need to make sure that you're you're doing something about both of them if you really want to have a full privacy control on on on the system.

Uh moving on there though, now we'll go to non-repudiation. And this again is also to make sure that we're really thinking not in the security framework think but rather from the privacy framework because those of you who might know the security framework and might know stride you might know what the R stands for where R actually stands for repudiation. Uh but here in Lynon it's exactly the reverse. This is one of those scenarios where security is not the same as privacy. They're actually exactly opposite of each other.

In privacy you're actually wanting to make sure that the person can't have a claim attributed to them. where in superior you might want to make sure that you know who it is that you're dealing with and that there's reputation attached to it. Here you want plausible deniability. You want to be able to say that no, it wasn't necessarily attached to me in that scenario. Um there's real world examples of this, right, where where Meta surrendered a Facebook med messenger.

Um so one of those that had the data controller that was controlling information about somebody and there was a mother and her 17-year-old daughter that were under warrant. So we're facing, you know, threats from the state. Um and and because of these these messages um they they did not have that plausible deniability um that was completely because of this data controller um that that probably made things very difficult for for the individuals attorneys. Um and so it's the it's important to think that messages that they may have thought were ephemeral then suddenly become courtroom evidence. Um do you want to comment a little on the crypto or maybe we can start?

Does Jim jump it? I think um it's quite an obvious like um all transactions are permanent record that's the whole point of ledger right so yeah it's just there like you cannot repudiate it you have to sign your your private key right the only way to do that is with shielded transactions uh nothing else um let's skip to the next one I think uh actually maybe we can okay let's do this and then

just real quick yeah this is defined as just whether or not you're even present in the database or not um and in the real world this has happened where where some um military soldiers were just using Estraa app and they thought that all this was just their anonymous fitness data but just because of the presence of that information people were actually able to reconstruct their their paths that were happening in that in that military base. Um metadata alone was the issue that was that was leaked here. Um not any identities necessarily or any real linkability. It's just they were present in a database. Um and so yeah in cryptocurrency there's nothing more to be said right that the transaction occurred and just that it occurred is sensitive.

Um

right.

Yeah. I mean then this mitigation is mixed nets. I guess you all know that. But of course it has its own um cost to pay because you have to wait um mainly and some other you might go to jail if you actually develop one right that's what happened with Cornado. Uh slight slight issue but yeah so there are of course costs associated with the mitigations.

That was just a whirlwind went through four of them. Lynon is of course seven but we don't really have time to go through all of them. Just wanted to leave with one last thought on this is to remember that also even if you do try and like you know tackle all of the seven at the end of the day is really most realistic to realize that there is no perfect solution. I've been working in this space for what 16 years and I don't think I've really found anybody that has found a solution that will work on all of these aspects. There's almost always going to be a cost trade-off to privacy.

You may find privacy for one of these harms um and not be able to deal with some of the others or there could be non-privacy costs that arise in there like usability. You might build the most private and secure system that is great but it's super expensive and absolutely nobody can use it. That's not so useful especially for trying to build a community of getting this to be used by more people. Um so these are just the things to end up thinking about on this. Um the examples that we're using here from a cryptocurrency of course is that cash might be a lowcost infrastructure setup.

Um it has some amount of privacy. you could certainly get a lot more privacy by using a very sophisticated infrastructure that's only burner devices and and is maybe less usable than cache um but has all those additional costs on there. Um there's also a way of thinking of this from like a utility trade-off, right? The the thing that you're actually trying to get accomplished here might have a trade-off where as you're the the more accurate you're trying to be, for example, with your data, you might have to trade it off with um with loss of privacy, but you might find this place in the middle where you can be sufficiently useful. um but but also sufficiently private.

Uh and now I'll hand it over to um to M to close it out with us.

Yeah. Um right. Um I mean I won't go too much into this but the the point is that Lyndon is just a framework to identify the harms and uh and and of course then you can assign add privacy enhancing technologies pets uh to mitigate some of these harms. But it doesn't talk anything about you know who is in government, who's in charge, who has the power. Um what are the what is the infrastructure that you operate within that has a certain set of boundaries that you may not be able to at least alone uh change or or or or sufficiently um um impose your will on basically and so others will impose their will on you whether you like it or not uh when they have the power and of course uh coercion is is a classic issue where I mean you when you're sitting in a in a police court you know in in a in in a in a in the police they head course you in ways that you basically have no way to say no to in some jurisdictions um uh for example your password is not something that you cannot not give up.

So in the UK if I I believe um they can actually put you in jail as a as um for for um for um essentially not adhering to their request for your password. So I mean yes you can then you don't give out there's actually a specific case for this where somebody's been sitting in jail for a while. um he happened to hack the well as allegedly hacked the the police itself. So they were not very happy about that and um they the person is still if I remember correctly is still sitting in jail. Uh and the only quote unquote crime he they can figure out that he actually did commit is not giving up his password.

So clearly, you know, Lindon doesn't model any of that. That's got nothing to do with it. This is purely a technical uh system for figuring out what kind of privacy crimes there are. And this is situated within a real world where it's expensive to have burning burner accounts. It's expensive to have burner phones.

It's expensive to um not use your credit card because you will not get I don't know 3% cash back and all this kind of stuff. So there are relevant ways in which you sort of lose money and lose control and and and and lose friends and social status by not um by by by not giving up your privacy. Um okay. Yeah, I mean the takeaway is really just what I said, which is to say that um and and what um what what Daniel has said, which is that um this is just a technology for you to be able to identify priv privacy harms in a in more accurate way. um pin it down and then find ways to mitigate these harms as cheaply as possible within the within reason within what you're happy to actually pay as a cost because most people think that privacy is like cheap or easy or or or or should be trivial.

Um no, it actually is. The people I know who are who live more privately and I know Daniel is one of these people. It's it's rough. Like it's actually quite rough. Um it's hard to reach Daniel sometimes [laughter] and and I mean even though we know each other for like I don't know how many years now like seven or eight or even more.

Uh so you know it it has real cost to it and you just have to put up with it if you want to put up with it. Of course our job you know as technologists for example and and also people who work in politics is to make this cost as low as possible right in order to have as much privacy as possible. Like that would be the best right? if we can we can lower the cost of having um an privacy and and but in order to do to be able to do that you have to be able to express what the problem is and this Lindon is a way for you to nomature for you to be able to express these problems.

Yeah that's it. [applause] We have room for one question from the audience. Make it a good one. Okay.

Can't promise it's the best question. Um, so I was just wondering uh if you were to have a technology company and you claim to be privacy by design or you built it with privacy by design. Um, and you use this as a model to say this is how I've done it and these are the standards that I've applied. Um, is that in I mean maybe by countries in general I is that something that governments will accept because I know that many governments will have issues with it being too private as well. Um, would this be for example GDPR compliant?

Um, and at the same time, yeah, I think you know what you mean. Sorry.

I'm not that big of a fan of the term GDPR compliant. Like I feel like it's very difficult. I think even the GPR is actually one of the few like laws that is somewhat nuanced in that sense that it's very risk designed and I think this system is actually very good in that sense. It's at some point yes still a definition of power like when do you decide that the risk has been good enough and that that still can yes be jurisdiction dependent but it is at least a way of being more specific about it and yes for at least with the GDPR setup this is something that's really really good for that. I don't know if I could speak to all of the different laws and jurisdictions on whether or not they're always going to apply um a risk based approach.

Um but Lynon is one that can be good at that, right?

Um if I can give just another answer uh is I used to work in in in securing down banks and if you talk to banks of course as a customer they always tell you we're secure but internally that's not how this works. I mean of course there's like risks involved with doing work. like the easiest way not to get hit by a tree is never to leave the apartment, but it's going to be a really shitty life, right? So, you you're going to take some risks. And the thing is that uh this is basically just trying to figure out what that risk is and trying to find the best risk to to reward ratio, right?

And this is what banks do as well and essentially everybody in their daily lives. I mean, you could be driving around at 300 km an hour on, you know, Berlin roads, but I mean, eventually you'll hit a tree, right? So at one point you know like society has imposed some kind of riskreward sort of point where we say okay well this is this is how fast we're going to drive otherwise you know people are going to get killed I mean people are still getting killed on the streets and you could say that we should lower them the maximum uh speed limit and then you know but that's that's a riskreward I think a risk sort of point that we have figured out this is the place that we're happy with and this is kind of a way for you to figure out where is this point like how did we get here and can we lower the the cost in order to get more more privacy with lower lower input which is more or less what you know when you're doing security you're doing the same thing like hey this is how much we're willing to spend on security how can we the best way we can do it so we can have have the lowest risk and it's the same here except instead of risk security it's privacy

yeah it's a good I'd say it's a good way of finding out where you are on the spectrum but if there's a threshold somebody else has to set the threshold at least you just find out where you are in relation to that threshold Thank you again.