Thesis (Ph. D.)--University of London, 2004. / Title from title screen. Description based on contents viewed Apr. 21, 2005. Includes bibliographical references.

Thesis (Ph. D.)--Florida State University, 2003. / Advisor: Dr. Dianne F. Harrison, Florida State University, School of Social Work. Title and description from dissertation home page (viewed Sept. 08, 2004). Includes bibliographical references.

Inaug.-Diss.--Bonn. / Vita. Bibliography: p. 6-21.

Honors Project--Smith College, Northampton, Mass., 2010. / Includes bibliographical references (p. 99-106).

Thesis (M.A. in Security Studies (Civil-Military Relations))--Naval Postgraduate School, March 2010. / Thesis Advisor(s): Bruneau, Thomas ; Ear, Sophal. "March 2010." Description based on title screen as viewed on April 26, 2010. Author(s) subject terms: Private military companies, Private security companies, Civil-military relations, Regulation of private military companies, Contractors. Includes bibliographical references (p. 93-100). Also available in print.

Thesis (B.A.)--Haverford College, Dept. of Political Science, 2006. / Includes bibliographical references.

Thesis (J.C.L.)--Catholic University of America, 1986. / Includes bibliographical references (leaves 65-72).

Smartphones are highly-capable mobile computing devices that have dramatically changed how people do business, interact with online services, and receive entertainment. Smartphone functionality is enhanced by an ecosystem of apps seemingly covering the entire gamut of functionality. While smartphone apps have undoubtedly provided immeasurable benefit to users, they also contribute their fair share of drawbacks, such as increases in security risks and the erosion of user privacy. In this thesis, I focus on the Android smartphone operating system, and pave the way for improving the security and privacy of its app ecosystem. Chapter 3 starts by doing a comprehensive study on how Android apps have evolved over a three-year period, both in terms of their dangerous permission usage and the vulnerabilities they contain. It uncovers a trend whereby apps are using increasing numbers of dangerous permissions over time and at the same time becoming increasingly vulnerable to attack by adversaries. By analysing the Google Play Store, Android's official app marketplace, Chapter 4 shows that many general-purpose apps can be replaced with functionallysimilar alternatives to the benefit of the user. This confirms that users still wield power to improve their own security and privacy. Chapter 5 combines this insight with real-world data from approximately 30,000 smartphones to understand the actual risk that the average user faces as a result of their use of apps, and takes an important first step in measuring the improvements that can be made. Users, however, are not always aware of the risks they face and thus Chapter 6 demonstrates the feasibility of a classification system that can transparently and unobtrusively identify and alert users to the presence of apps of concern on their devices. This classification system identifies apps from features in the network traffic they generate, without itself analysing the payload of their traffic, thus maintaining a high threshold of privacy. While the work presented in this thesis has uncovered undesirable trends in app evolution, and shows that a large fraction of users are exposed to non-trivial risk from the apps they use, in many cases there is suficient diversity in the offerings of general-purpose apps in the Google Play Store to empower users to mitigate the risks coming from the apps they use. This work takes us a step further in keeping users safe as they navigate and enjoy app ecosystems.

With the continued proliferation of mobile devices, the collection of information associated with such devices and their users - such as location, installed applications and cookies associated with built-in browsers - has become increasingly straightforward. By analysing such information, organisations are often able to deliver more relevant and better focused advertisements. Although such Targeted Mobile Advertising (TMA) offers great benefits to advertisers, it gives rise to a number of concerns, with privacy-related concerns being prominent amongst them. It follows that there is a need for an advertisement-selection mechanism that can support the existing TMA business model in a manner that takes into account consumers' privacy concerns. The research described in this dissertation explores the delicate balance between the goals of the advertisers and the consumers: advertisers pursue profits by applying TMA, which violates consumers' privacy; consumers hope to benefit from useful mobile advertisements without compromising their personal information. The conflicts of interests between consumers and advertisers in the context of targeted mobile advertising brings us to our research question: Is it possible to develop a privacy-preserving TMA framework that enables mobile users to take advantage of useful advertising services without their privacy being compromised, and without impacting significantly advertising effectiveness? In order to answer this question, this dissertation presents four main contributions. First, we report upon the result of a qualitative study to discuss the balance that needs to be struck between privacy and utility in this emerging area. Second, a number of formal models are developed to reason about privacy, as well as to reason about the relationship between privacy and utility in the context of TMA. Third, a novel ad-selection architecture, PPTMA (Privacy-Preserving Targeted Mobile Advertising), is presented and evaluated. Finally, a privacy-preserving advertisement-selection mechanism, AdSelector, is introduced. The mechanism is novel in its combination of a user subscription mechanism, a two-stage ad-selection process, and the application of a trustworthy billing system.

Access to Personal Health Information (PHI) is a valuable part of the modern health care model. Timely access to relevant PHI assists care providers in making clinical decisions and ensure that patients receive the highest quality of care. PHI is highly sensitive and unauthorized disclosure of PHI has potential to lead to social, economic, or even physical harm to the patient. Traditional electronic health (eHealth) tools are designed for the needs of care providers and are insufficient for the needs of patients. Our research goal is to investigate the requirements of electronic health care systems which place patient health and privacy above all other concerns. Control of secure resources is a well established area of research in which many techniques such as cryptography, access control, authentication, and organizational policy can be combined to maintain the confidentiality and integrity of data. Access control is the dominant data owner facing privacy control. To better understand this domain we conducted a scoping literature review to rapidly map the key concepts underpinning patient facing access controls in eHealth systems. We present the analysis of that corpus as well as a set of identified requirements. Based on the identified requirements we developed Circle of Health based Access Control (CoHBAC), a patient centered access control model. We then performed a second scoping review to extend our research beyond just access controls, which are insufficient to provide reasonable privacy alone. The second review yielded a larger, more comprehensive, set of sixty five requirements for patient centered privacy systems. We refined CoHBAC into Privacy Centered Access Control (PCAC) to meet the needs of our second set of requirements. Using the conceptual model of accountability that emerged from the reviewed literature we present the identified requirements organized into the Patient Centered Privacy Framework. We applied our framework to the Canadian health care context to demonstrate its applicability. / Graduate