Hello, everyone, I'm Michael Lutaaya, and today I will be presenting our late breaking
work titled I'm Not a Millionaire: How Users' Online Behaviours
and Offline Behaviours Impact Their Privacy.
Personally identifiable information or PII is any
information that can be used to distinguish or trace an individual's identity,
either alone or when combined with other information connected to the individual.
Disclosures of personally identifiable information expose users
to privacy risks. And compared to other user data like browsing behaviours,
PII disclosures can have serious consequences.
For example, Social Security Numbers in the United States are widely used
by the public and private sector, and sometimes they can be found in public records
or in leaked data sets.
This can allow an identity thief to steal a person's benefits and open
credit cards under someone else's name, amongst other things.
Given the serious consequences associated with PII disclosures,
our work explores three research questions: What PII
is easily obtainable online?
How visible are users' social media accounts to others,
and what online and offline protection strategies do users take to
protect their PII?
In this study, we conducted 90 minute sessions in a lab setting or
in similar environments with sufficient privacy for our participants.
In total, we ran sessions with 27 participants.
Each session began with a short demographic questionnaire, followed by an interview
where participants were asked about their opinions of certain technologies
like mobile wallets and digital identities, and about behaviours they engage
in both online and offline that could affect the safety of their personal
information. Participants also completed two exercises:
a social media exercise where they browsed their most highly used social
media accounts to determine what types of their PII could be found
through their account. And a search exercise where participants went
to Google were told what to enter into the search field and then clicked on
results to confirm whether they contained their personal information.
After all of the data was collected, we analysed our questionnaire data
and results from the search and social media exercise, which we grouped into
the categories listed on the right.
For the qualitative data, we transcribed our audio recordings and then
applied content analysis methodology to interpret the data.
Facebook and Instagram were the most used social networking sites by our participants
and together represented eighty three percent of the accounts that we analysed.
When we analysed participants accounts for their PII, we found of all
the categories, personal information was identified most frequently,
birth information was deduced most frequently and vehicle
information was not identified most frequently.
The results for the search exercise looked similar to this.
However, there tended to be fewer occurrences of a participant's PII.
We structured our qualitative analysis around the five categories listed on the right,
and it provided two examples of quotes from some of the categories.
In the breaches and violations category, some participants explained their
outlooks on the levels of risk associated with their behaviours.
For example, P1 said, "I don't view myself as that much
of a target. I'm not a millionaire.
Right?" This way of thinking that people with more wealth or that are prominent
figures are more likely to be targeted was expressed by multiple participants.
In the risky behaviours and vulnerabilities category, we heard from several participants
who explained that they were deliberately not using any authentication schemes on their
device, such as P 10 who said, "I think having a password on
my device is a wastage of time".
In short, the main takeaways from this study are the following: for the majority
of our participants, some amount of their PII was discoverable, suggesting
that focussing on online information may be worthwhile for attackers.
We also found that personal security and privacy came as an afterthought for some
participants. That's potentially putting them at greater risk of becoming victims of
identity theft. Ultimately, these findings can help ensure that our interactions
online and offline are designed to be privacy protective and to help prevent
the leakage of PII. Thank you.