The use of online personalized advertisements has drawn attention among firms, in efforts of acquiring and maintaining competitive advantage. By collecting individual consumer information, firms are able to personalize advertisements to specific individuals in online contexts. The collection and use of individuals’ personal information have given rise to privacy concerns among consumers. However, contemporary research displays disparate conclusions regarding the extent to which these privacy concerns influence the effectiveness of online personalized advertisements. In order to provide insights regarding this discrepancy, this study explored the theoretical foundations of consumer perceived benefits and risks, upon which contemporary research was based. Two focus groups were conducted to explore how consumers perceive benefits and risks of online personalized advertisements. Using pattern matching, the interpretation of the empirically gathered material implied that consumer perceived benefits, in form of perceived relevance, appears to be insufficient in appealing to the interests and preferences of consumers. Instead, consumers’ perceptions of relevance appear to be dependent on several elements. Furthermore, the findings imply that consumers are aware of the risks through personal information disclosure, yet appear to be unconcerned by them. Instead, consumers seem to possess a sense of hopelessness in online environments, that attempts to restrict the availability of their personal information are pointless.

The rapid increase in mobile malware and deployment of over-privileged applications over the years has been of great concern to the security community. Encroaching on user’s privacy, mobile applications (apps) increasingly exploit various sensitive data on mobile devices. The information gathered by these applications is sufficient to uniquely and accurately profile users and can cause tremendous personal and financial damage. On Android specifically, the security and privacy holes in the operating system and framework code has created a whole new dynamic for malware and privacy exploitation. This research work seeks to develop novel analysis techniques that monitor Android applications for possible unwanted behaviors and then suggest various ways to deal with the privacy leaks associated with them. Current state-of-the-art static malware analysis techniques on Android-focused mainly on detecting known variants without factoring any kind of software obfuscation. The dynamic analysis systems, on the other hand, are heavily dependent on extending the Android OS and/or runtime virtual machine. These methodologies often tied the system to a single Android version and/or kernel making it very difficult to port to a new device. In privacy, accesses to the database system’s objects are not controlled by any security check beyond overly-broad read/write permissions. This flawed model exposes the database contents to abuse by privacy-agnostic apps and malware. This research addresses the problems above in three ways. First, we developed a novel static analysis technique that fingerprints known malware based on three-level similarity matching. It scores similarity as a function of normalized opcode sequences found in sensitive functional modules and application permission requests. Our system has an improved detection ratio over current research tools and top COTS anti-virus products while maintaining a high level of resiliency to both simple and complex obfuscation. Next, we augment the signature-related weaknesses of our static classifier with a hybrid analysis system which incorporates bytecode instrumentation and dynamic runtime monitoring to examine unknown malware samples. Using the concept of Aspect-oriented programming, this technique involves recompiling security checking code into an unknown binary for data flow analysis, resource abuse tracing, and analytics of other suspicious behaviors. Our system logs all the intercepted activities dynamically at runtime without the need for building custom kernels. Finally, we designed a user-level privacy policy enforcement system that gives users more control over their personal data saved in the SQLite database. Using bytecode weaving for query re-writing and enforcing access control, our system forces new policies at the schema, column, and entity levels of databases without rooting or voiding device warranty.

Homes are involved in a significant fraction of Internet traffic. However, meaningful and comprehensive information on the structure and use of home networks is still hard to obtain. The two main challenges in collecting such information are the lack of measurement infrastructure in the home network environment and individuals’ concerns about information privacy. To tackle these challenges, the dissertation introduces Home Network Flow Logger (HNFL) to bring lightweight privacy-preserving passive measurement to home networks. The core of HNFL is a Linux kernel module that runs on resource-constrained commodity home routers to collect network traffic data from raw packets. Unlike prior passive measurement tools, HNFL is shown to work without harming either data accuracy or router performance. This dissertation also includes a months-long field study to collect passive measurement data from home network gateways where network traffic is not mixed by NAT (Network Address Translation) in a non-intrusive way. The comprehensive data collected from over fifty households are analyzed to learn the characteristics of home networks such as number and distribution of connected devices, traffic distribution among internal devices, network availability, downlink/uplink bandwidth, data usage patterns, and application traffic distribution.

The research reported in this thesis focuses on developing a framework for game design to protect computer users against phishing attacks. A comprehensive literature review was conducted to understand the research domain, support the proposed research work and identify the research gap to fulfil the contribution to knowledge. Two studies and one theoretical design were carried out to achieve the aim of this research reported in this thesis. A quantitative approach was used in the first study while engaging both quantitative and qualitative approaches in the second study. The first study reported in this thesis was focused to investigate the key elements that should be addressed in the game design framework to avoid phishing attacks. The proposed game design framework was aimed to enhance the user avoidance behaviour through motivation to thwart phishing attack. The results of this study revealed that perceived threat, safeguard effectiveness, safeguard cost, self-efficacy, perceived severity and perceived susceptibility elements should be incorporated into the game design framework for computer users to avoid phishing attacks through their motivation. The theoretical design approach was focused on designing a mobile game to educate computer users against phishing attacks. The elements of the framework were addressed in the mobile game design context. The main objective of the proposed mobile game design was to teach users how to identify phishing website addresses (URLs), which is one of many ways of identifying a phishing attack. The mobile game prototype was developed using MIT App inventor emulator. In the second study, the formulated game design framework was evaluated through the deployed mobile game prototype on a HTC One X touch screen smart phone. Then a discussion is reported in this thesis investigating the effectiveness of the developed mobile game prototype compared to traditional online learning to thwart phishing threats. Finally, the research reported in this thesis found that the mobile game is somewhat effective in enhancing the user’s phishing awareness. It also revealed that the participants who played the mobile game were better able to identify fraudulent websites compared to the participants who read the website without any training. Therefore, the research reported in this thesis determined that perceived threat, safeguard effectiveness, safeguard cost, self-efficacy, perceived threat and perceived susceptibility elements have a significant impact on avoidance behaviour through motivation to thwart phishing attacks as addressed in the game design framework.

No description available.

"Mémoire présenté à la Faculté des études supérieures en vue de l'obtention du grade de Maîtrise en LL.M. Droit - Recherche option Droit, Biotechnologies et Sociétés" / Les registres médicaux sont des banques de données, ayant des caractéristiques spécifiques, rassemblant tous les cas d'une maladie sur un territoire précis. Ces informations permettent la mise en place de politiques de santé publique ainsi que l'étude de maladies afin de faire progresser la recherche médicale. La question se pose donc de savoir comment la réglementation concernant le respect de la vie privée s'applique aux particularités des registres. La législation actuellement en vigueur au Québec prévoit l'obligation d'obtenir le consentement du patient avant d'inclure les données le concernant dans le registre. Ces renseignements personnels de santé recueillis dans le registre doivent être protégés afin de respecter la vie privée des participants. Pour cela, des mesures concernant la confidentialité et la sécurité des données doivent être mises en place en vue de leur conservation et durant celle-ci. Après l'utilisation principale de ces données, il est possible de se servir à nouveau de ces renseignements personnels à d'autres fins, qu'il faille ou non les transférer vers une autre banque de données, nationale ou étrangère. Néanmoins cette utilisation secondaire ne peut se faire qu'à certaines conditions, sans porter atteinte au droit des participants concernant le respect de la vie privée. / Medical registries are databases which record aIl cases of a specifie disease found in a given area. Registries provide vital information for public health research and for the implementation of appropriate public policies. The question is : How does the regulation of privacy apply to registries? Legislation currently in force in the province of Quebec requires the consent of a patient in order to inc1ude personal information in the registry. Personal health data in a registry have to be protected to preserve the privacy of research subjects. To ensure data security and confidentiality sorne measures must be taken during their conservation. Secondary use of data is possible under certain conditions aimed at protecting the right to privacy. It is possible to use such personal information again for other purposes even if the data need to be transferred to another national or foreign database.

Cloud computing has changed how services are provided and supported through the computing infrastructure. It has the advantages such as flexibility , scalability , compatibility and availability . However, the current architecture design also brings in some troublesome problems, like the balance of cooperation benefits and privacy concerns between the cloud provider and the cloud users, and the balance of cooperation benefits and free-rider concerns between different cloud users. Theses two problems together form the incentive problem in cloud environment. The first conflict lies between the reliance of services and the concerns of secrets of cloud users. To solve it, we proposes a novel architecture, NeuCloud, to enable partially, trusted, transparently, accountably privacy manipulation and revelation. With the help of this architecture, the privacy-sensitive users can be more confident to move to public clouds. A trusted computing base is not enough, in order to stimulate incentive-compatible privacy trading, we present a theoretical framework and provide the guidelines for cloud provider to compensate the cloud user's privacy-risk-aversion. We implement the NeuCloud and evaluate it. Moreover, a improved model of NeuCloud is discussed. The second part of this thesis strives to solve the free-rider problem in cloud environment. For example, the VM-colocation attacks have become serious threats to cloud environment. We propose to construct an incentive-compatible moving-target-defense by periodically migrating VMs, making it much harder for adversaries to locate the target VMs. We developed theories about whether the migration of VMs is worthy and how the optimal migration interval can be determined. To the best of our knowledge, our work is the first effort to develop a formal and quantified model to guide the migration strategy of clouds to improve security. Our analysis shows that our placement based defense can significantly improve the security level of the cloud with acceptable costs. In summary, the main objective of this study is to provide an incentive-compatible to eliminate the cloud user's privacy or cooperative concerns. The proposed methodology can directly be applied in commercial cloud and help this new computing fashion go further in the history. The theoretical part of this work can be extended to other fields where privacy and free-rider concerns exist.

The purpose of this thesis is to elucidate what online profiling is, what happens with users' or customers' personal data during this process, how these activities interfere with the individuals' right to privacy, what the legal regulation in this field is, whether the privacy interests of individuals are sufficiently protected and if not, how the situation might be improved. The thesis starts with description of todays' business practices that are based on collecting data about customers, analyzing it and creating profiles suggesting the most profitable behaviour of businesses towards customers. It is followed by explanation of the technological tools enabling data collection and the method of data mining that is the key enabler of creating profiles. The text continues with description of risks of profiling in relation to privacy, i.e. the issues of discrimination, de-individualisation, restriction of individual autonomy, information asymmetries and possible misuse of profiles. The notion of right to privacy is explained and other interests that have to be balanced with privacy are mentioned as well. After that follows a critical description of the current legal framework in the European Union. It consists of Data Protection Directive, ePrivacy Directive and since 2018 of the General Data...

Title of the Thesis: Freedom of information rights to obtaining information on salaries and bonuses of employees in public administration bodies This thesis aims to analyse the theoretical framework of the freedom of information laws in the Czech republic, with a particular focus on obtaining information about salaries, wages, and benefits of public administration employees, and its subsequent comparison with the practice. The goal of this thesis is not only to summarise the development of jurisprudence concerning the freedom of information laws up to this day, which will be dealt with in chapter II, as well as in the relevant parts of chapter III.1 and 2 respectively, dealing with the right to privacy and information self-determination. More importantly, this thesis aims to offer a possible solution to the conflict between, on the one hand, the right to obtain relevant information pursuant to the freedom of information laws, and, on the other hand, the right to privacy and information self-determination, using the proportionality test described in chapter III.4. In doing so, this thesis offers a framework that has not yet been used in the relevant literature. Following a short summary, the thesis introduces the sources of the freedom of information laws relevant to the Czech legal system in order...

This study examines how consumers reason and their opinions about personal data collection online. Its focus is to investigate whether consumers consider online data collection as an issue with moral implications, and if these are unethical. This focus is partly motivated by the contradiction between consumers’ stated opinions and actual behavior, which differ. To meet its purpose, the study poses the research question How is personal data collection and its prevalence online perceived and motivated by consumers?. The theoretical framework consists of the Issue-Contingent Model of Ethical Decision-Making by Jones (1991), thus putting the model to use in a new context. Collection of data for the study was done by conducting focus groups, since Jones’ model places ethical decision- making in a social context. The results of the study showed that consumers acknowledge both positive and negative aspects of online data collection, but the majority of them do not consider this data collection to be unethical. This result confirms partly the behaviour that consumers already display, but does not explain why their stated opinions do not match this. Thus, this study can be seen as an initial attempt at clarifying consumer reasoning on personal data collection online, with potential for future studies to further investigate and understand consumer online behaviour. / Denna uppsats undersöker hur konsumenter resonerar och tänker kring insamling av personlig data på Internet. Fokus är att utreda ifall konsumenter anser att denna insamling har konsekvenser, och ifall dessa anses vara oetiska. Detta fokus baseras delvis på resultat som visar på skillnader i vad konsumenter uttrycker för åsikter kring detta ämne, och deras faktiska beteende på Internet. Undersökningen utgår ifrån forskningsfrågan som lyder Hur uppfattar och motiverar konsumenter insamling av personlig data på Internet? Studiens teoretiska ramverk består av modellen An Issue-Contingent model of Ethical Decision- Making som är utvecklad av Jones (1991), och modellen används därmed i en ny kontext. Studiens data samlades in genom fokusgrupper. Detta val baserades på Jones (1991) modell, som menar att etiskt beslutsfattande alltid sker i en social kontext. De resultat som kommit fram visar att konsumenter ser både positiva och negativa aspekter och konsekvenser av att ha sin personliga data insamlad, däremot utan att anse att insamlingen i sig är oetisk. Detta bekräftar delvis tidigare resultat, men förklarar inte varför de åsikter konsumenter uttrycker kring ämnet inte stämmer överens med hur de sedan faktiskt beter sig. Därmed kan den här uppsatsen ses som ett första försök att klargöra hur konsumenter resonerar kring insamling av personlig data på Internet. Det har bedömts finnas mycket potential för framtida studier inom samma område, för att fortsatt undersöka och förstå konsumenters beteende på Internet.