Design And Implementation Of A Decision System For Chatbot Applications

Copyright © 2014 California Law Review, Inc.U.S. and EU privacy law diverge greatly. At the foundational level, they differ in their underlying philosophy: In the United States, privacy law focuses on redressing consumer harm and balancing privacy with efficient commercial transactions. In the European Union, privacy is hailed as a fundamental right that can trump other interests. Even at the threshold level-determining what information is covered by the regulation-the United States and European Union differ significantly. The existence of personal information- commonly referred to as personally identifiable information (PII)-triggers the application of privacy law. The U.S. and the European Union define this essential term of privacy law quite differently. The U.S. approach involves multiple and inconsistent definitions of PII that are often particularly narrow. The EU approach defines PII to encompass all information identifiable to a person, a definition that can be quite broad and vague. This divergence is so basic that it threatens the stability of existing policy mechanisms for permitting international data flows.In this Essay, we propose a way to bridge these differences regarding PII. We contend that a tiered approach to the concept of PII (which we call PII 2.0 ) represents a superior way of defining PII compared to the current approaches in the United States and European Union. We also argue that PII 2.0 is consistent with the different underlying philosophies of the U.S. and EU privacy law regimes. Under PII 2.0, all of the Fair Information Practices (FIPs) should apply when data refers to an identified person or when there is a significant risk of the data being identified. Only some of the FIPs should apply when data is merely identifiable, and no FIPs should apply when there is a minimal risk that the data is identifiable. We demonstrate how PII 2.0 furthers the goals of both U.S. and EU privacy law and how PII 2.0 is consistent with their different underlying philosophies. PII 2.0 thus advances the process of bridging the current gap between U.S. and EU privacy law.

This paper presents user privacy framework for web-of-objects based smart home services to control the release of personally identifiable information (PII) in smart home environment. The ubiquity of smart home enables smart home users and third parties to access home devices and data from any location at any time. The ubiquitous and pervasiveness improves the user comfort level, but also makes user PIIs highly prone to leakage. We propose Smart Home Web of Object User Privacy (SWOPR) architecture to protect and control the release of user PIIs according to the user consent. We suggest an architecture that integrates the RESTful framework, ISO/IEC-29101, and XACML/Ontology; the integration is not supported in existing systems. The SWOPR introduces Smart Home Web of Objects Privacy Controller (SWOPC) and Privacy Processor (SWOPP) nodes. SWOPC controls the process of collection of PIIs from users to the release of his PIIs to others. SWOPP provides PIIs processing functions such as anonymization and encryption under the control of SWOPC. The proposed privacy framework architecture is simple, lightweight and has high performance. We also present service scenarios to acquire the user PIIs, consents and release of PIIs to others.

Users’ personally identifiable information (PII) collection is a primary revenue model for the app-economy, and consequently user tracking has become increasingly invasive and ubiquitous. Smart and IoT devices provide even more access to users’ personal information by utilizing their exact location and default device settings. Although users in most cases must grant permission before their personal information is collected and shared with third-parties, this is not the case when user tracking happens through email or just by owning and using Bluetooth dependent devices. In any case, the average user is willing to accept the terms of the often unread “Privacy Policy” in order to receive the advertised “better user experience”, without really being aware of the consequences of this decision. In this work, we investigate the latest popular technologies for user tracking through mobile and web applications and demonstrate how much information about users can be gathered without user awareness or acknowledgment as well as in which cases and how we were able to limit this tracking. Finally, in our work, we attempt to create unified user profiles by combining our findings from the different tracking techniques against targeted users. We hope that our extensive analysis of beacon tracking will lead to greater awareness of the privacy risks involved with web beacons and Bluetooth tracking and motivate the deployment of stricter regulations and a more effective notification mechanism when such tracking is in place.

<span>The public and governmental focus have been shifted increasingly onto data and privacy due to Facebook’s standoff with Apple and several Nations’ Governments. An imperative for the discussion of data handling has been made, while Biofeedback human interfacing device (HID) companies such as CTRL-labs and Neuralink introduce new risks in the access, use, and control of personal health information. This paper combines the lexicon of digital self-extension with line drawing analysis to help visualize the industry use of personally identifiable information (PII). Through this analysis encapsulation methods of users' PII have been identified such that discussion of encrypting personal health information (PHI) can be facilitated through analogy. To reduce the likelihood that companies generating biometric hardware are subject to future legal action through laws analogous to European Privacy Law, it is in their best interest to be transparent with their users about data sharing, and educate them on how the companies encrypt their PHI. Should users consent to the use of biometric hardware, this process validates the user control of their own PHI.</span>

Throughout the years, authentication processes of individuals’ identities have become essential parts of our modern daily life. These authentication processes also introduced the heavy use of Personally Identifiable Information (PII) in various applications. On the other hand, the continuous increase of using identifiable information –the unauthorized use of such PII–has created rich business opportunities for identity protection service providers. These services usually consist of a monitoring system that continuously searches through the Internet for incidents that supposedly indicates identity theft activities. However, these solutions are largely based on case studies and a quantified method is missing among different identity protection services. This research offers a tool that provides quantitative analysis among different identity protection services. By bringing together previous work in the field, namely the UT Center for Identity (CID) Identity Ecosystem (a Bayesian network mathematical representation of a person’s identity), real world identity theft data, stochastic game theory, and Markov decision processes, we generate and evaluate the best strategy for defending against the theft of personal identity information. One of the research problems that this paper addresses is the computation complexity of quantitatively evaluating identity protection strategies with real world data. In a real world database like Identity Threat Assessment and Prediction (ITAP) project which the UT CID Identity Ecosystem is built on, the number of PII attributes in use are normally in the order of 103. We propose a reinforcement learning algorithm for solving the optimal strategy to protect the user’s identity against a malicious and efficient attacker. We aim to understand how initial individual PII exposure evolves into crucial PII breaches over time in terms of the dynamic integrity of the Identity Ecosystem. Real world identity protection strategies are then translated into the system and we evaluate/simulate their effectiveness against a malicious attacker for quantitative comparison in our experiment. We present the survival analysis to these strategies and calculate the survival gap between these strategies against our active protection strategy as our experiment result. This study is aimed to understand the evolutionary process of identity under attack which may inspire a new direction for future identity protection strategies.

Most of the modern web services offer their users the ability to be registered on them via dedicated registration pages. Most of the times, they use this method so the users can profit by accessing more content or privileged items. In these pages, users are typically requested to provide their names, email addresses, phone numbers and other personal information in order to create an account. As the purpose of the tracking ecosystem is to collect as many information and data from the user, this kind of Personally Identifiable Information (PII) might leak on the 3rd-Parties, when the users fill in the registration forms. In this work, we conduct a large-scale measurement analysis of the PII leakage via registration pages of the 200,000 most popular websites. We design and implement a scalable and easily replicable methodology, for detecting and filling registration forms in an automated way. Our analysis shows that a number of websites (\(\approx \)5%) leak PIIs to 3rd-Party trackers without any user’s consent, in a non-transparent fashion. Furthermore, we explore the techniques employed by 3rd-Parties in order to harvest user’s data, and we highlight the implications on user’s privacy.

In recent years, enterprise applications have begun to migrate from a local hosting to a cloud provider and may have established a business-to-business relationship with each other manually. Adaptation of existing applications requires substantial implementation changes in individual architectural components. On the other hand, users may store their Personal Identifiable Information (PII) in the cloud environment so that cloud services may access and use it on demand. Even if cloud services specify their privacy policies, we cannot guarantee that they follow their policies and will not (accidentally) transfer PII to another party. In this paper, we present Identity-as-a-Service (IDaaS) as a trusted Identity and Access Management with two requirements: Firstly, IDaaS adapts trust between cloud services on demand. We move the trust relationship and identity propagation out of the application implementation and model them as a security topology. When the business comes up with a new e-commerce scenario, IDaaS uses the security topology to adapt a platform-specific security infrastructure for the given business scenario at runtime. Secondly, we protect the confidentiality of PII in federated security domains. We propose our Purpose-based Encryption to protect the disclosure of PII from intermediary entities in a business transaction and from untrusted hosts. Our solution is compliant with the General Data Protection Regulation and involves the least user interaction to prevent identity theft via the human link. The implementation can be easily adapted to existing Identity Management systems, and the performance is fast.

The protection of personally identifiable information (PII) is being increasingly demanded by customers and governments via data protection regulations. Private and public organizations store and exchange through the Internet a large amount of data that include the personal information of users, employees, and customers. While discovering PII from a large unstructured text corpus is still challenging, a lot of research work has focused on identifying methods and tools for the detection of PII in real-time scenarios and the ability to discover data exfiltration attacks. In those research attempts, natural language processing (NLP)-based schemas are widely adopted. Our work combines NLP with deep learning to identify PII in unstructured texts. NLP is used to extract semantic information and the syntactic structure of the text. This information is then processed by a pre-trained Bidirectional Encoder Representations from Transformers (BERT) algorithm. We achieved high performance in detecting PII, reaching an accuracy of 99.558%. This represents an improvement of 7.47 percentage points over the current state-of-the-art model that we analyzed. However, the experimental results show that there is still room for improvement to obtain better accuracy in detecting PII, including working on a new, balanced, and higher-quality training dataset for pre-trained models. Our study contributions encourage researchers to enhance NLP-based PII detection models and practitioners to transform those models into privacy detection tools to be deployed in security operation centers.

Personal data related to a user's activities, preferences and services, is considered to be a valuable commodity not only for a wide range of technology-oriented companies like Google, Amazon and Apple but also for more traditional companies like travel/transport, banking, entertainment and marketing industry. This has resulted in more targeted and to a great extend personalised services for individuals -- in most cases at a minimal financial cost to them. The operational reality upon which a user authorises companies to collect his/her personal data to receive, in return, more personalised/targeted/context-aware services and hassle-free activities (for users) is widely deployed. It becomes evident that the security, integrity and accessibility of the collected data are of paramount importance. These characteristics are becoming more entrenched in the era of Internet-of-Things (IoT), autonomous vehicles and seamless travel. In this position paper, we examine the challenges faced by both users and organisations in dealing with the Personal Identifiable Information (PII). Furthermore, we expand on the implications of the General Data Protection Regulation (GDPR) specifically for the management of the PII. Subsequently, we extend the discussion to future technologies, especially the IoT and integrated transport systems for better customer experience -- and their ramification on the data governance and PII management. Finally, we propose a framework that balances user's privacy and data control with an organisation's objective of delivering quality, targeted and efficient services to their customers using the "collected user data". This framework is referred to as "Consumer Oriented Data Control \& Auditability" (CODCA) and defines the technologies that are adapted to privacy concerns and legal/regulation-frameworks.

Secure data distribution is critical for data accountability. Surveillance caused privacy breaching incidents have already questioned existing personal data collection techniques. Organizations assemble a huge amount of personally identifiable information (PII) for data-driven market analysis and prediction. However, the limitation of data tracking tools restricts the detection of exact data breaching points. Blockchain technology, an ‘immutable’ distributed ledger, can be leveraged to establish a transparent data auditing platform. However, Art. 42 and Art. 25 of general data protection regulation (GDPR) demands ‘right to forget’ and ‘right to erase’ of personal information, which goes against the immutability of blockchain technology. This paper proposes a GDPR complied decentralized and trusted PII sharing and tracking scheme. Proposed blockchain based personally identifiable information management system (BcPIIMS) demonstrates data movement among GDPR entities (user, controller and processor). Considering GDPR limitations, BcPIIMS used off-the-chain data storing architecture. A prototype was created to validate the proposed architecture using multichain. The use of off-the-chain storage reduces individual block size. Additionally, private blockchain also limits personal data leaking by collecting fast approval from restricted peers. This study presents personal data sharing, deleting, modifying and tracking features to verify the privacy of proposed blockchain based personally identifiable information management system.

Since the emergence of ChatGPT in 2022, generative artificial intelligence has brought rapid changes across industries and daily life. Because artificial intelligence model performance depends on the quality and scale of training data, companies are building large-scale training datasets by utilizing publicly available personal information and personal information of users they already possess. However, legal uncertainty persists as it remains unclear whether the processing of artificial intelligence training data containing personal information is lawful under personal information protection laws. Accordingly, this paper examines the concept, characteristics, and privacy risks of artificial intelligence training, and reviews interpretations regarding the processing of artificial intelligence training data, focusing on publicly available personal information and personal information of existing users, while analyzing their limitations. Ultimately, to achieve a balance between personal information protection and artificial intelligence industry development, it is urgent to clarify the lawful basis for processing artificial intelligence training data containing personal information and establish legal standards that can guarantee the rights of data subjects. Through this, it will be possible to resolve legal uncertainty for businesses, protect the right to self-determination of personal information, and promote trust-based development of the artificial intelligence industry.

While it is not recommended, Internet users tend to include personal information in their passwords for easy memorization. However, the use of personal information in passwords and its security implications have yet to be studied. In this paper, we dissect user passwords from several leaked data sets to investigate the extent to which a user's personal information resides in a password. Then, we introduce a new metric called coverage to quantify the correlation between passwords and personal information. Afterward, based on our analysis, we extend the probabilistic context-free grammars (PCFGs) method to be semantics-rich and propose personal-PCFG to crack passwords by generating personalized guesses. Through offline and online attack scenarios, we demonstrate that personal-PCFG cracks passwords much faster than PCFG and makes online attacks much more likely to succeed. To defend against such semantics-aware attacks, we examine the use of simple distortion functions that are chosen by users to mitigate unwanted correlation between personal information and passwords.

With the continuous development of the Internet and communication technologies, network communication provides convenience but also brings security problems such as exposure of users' personal privacy information and theft, private tampering, and forgery of false information. Modern cryptography technology is an important safeguard against message eavesdropping and tampering, while the rapidly developing anonymous communication technology in this century makes it difficult for attackers to infer user's personal information and communication relationships. In response to the potential threats of traditional centralized systems such as central nodes being vulnerable to attacks and data storage being tampered with, this paper proposes a blockchain anonymous communication algorithm KDAC based on key derivation, which takes advantage of the decentralization, data immutability, consensus mechanism and anonymity of blockchain and combines the ECC cryptographic derivation algorithm and anonymous communication technology to realize the key-at-a-time, one-address-at-a-time The key derivation scheme ensures the message integrity and tamper-evident while effectively hiding the identity information of both communication parties. In addition, this paper also optimizes the blockchain anonymous communication system with key derivation. Users only need the initial key of blockchain nodes to join the network for communication, and the information transmission is difficult to trace based on the blockchain network, which can effectively guarantee communication security and anonymity. The experimental results show that the efficiency of the derived key algorithm is roughly in the same order of magnitude as that of the 256-bit AES symmetric encryption algorithm, which can play a better role in practical applications. On the other hand, the derived key generated based on the algorithm has complete randomness in association verification, and it is impossible to reverse the initial parameters, which can well guarantee the anonymity of user identity.

The last decade has seen a massive explosion of data, with a lot of Personally Identifiable Information (PII) flooding devices and the cyberspace. This has necessitated the growing call and global awareness for data protection, to ensure the responsible use of data, protect the privacy of data subjects, and prevent crimes such as identity theft and cybercrime. This paper investigated the presence of residual data and Personally Identifiable Information (PII) in refurbished hard drives bought from a retail shop. The study leveraged digital forensic tools to perform data recovery on refurbished hard drives, and analyses for presence of PII. The study adopted a modified form of the steps in Digital Investigation outlined by NIST IR 8354. Result of this study showed that one out of the 3 hard drives that were reportedly formatted and sanitized by the vendors had residual data with PII. Data recovered includes 28691 files with size on disk as 152.20GB, including PII and sensitive data. Digital Forensic tools used for this study includes EaseUS Data Recovery Wizard and Autopsy. The findings of this study are quite relevant to current studies in privacy and data protection, including recent legislations such as Nigeria Data Protection Act (NDPA), General Data Protection Regulation (GDPR), and others. The paper also presents a comprehensive and forensically sound software-based methodology focused on the recovery of deleted data from hard drives.

In the context of third-party social apps, the problem of interdependency of privacy refers to users making app adoption decisions which cause the collection and utilization of personal information of users’ friends. In contrast, users’ friends have typically little or no direct influence over these decision-making processes. We conduct a conjoint analysis study with two treatment conditions which vary the app data collection context (i.e., to which degree the functionality of the app makes it necessary for the app developer to collect friends’ information). Analyzing the data, we are able to quantify the monetary value which app users place on their friends’ and their own personal information in each context. Combining these valuations with the responses to a comprehensive survey, we apply structural equation modeling (SEM) analysis to investigate the roles of privacy concern, its antecedents, as well as app data collection context to work towards a model of interdependent privacy for the scenario of third-party social app adoption. We find that individuals’ past experiences regarding privacy invasions are negatively associated with their trust for third-party social apps’ proper handling of their personal information, which in turn influences their concerns for their own privacy associated with third-party social apps. In addition, positive effects of users’ privacy knowledge on concerns for their own privacy and concerns for friends’ privacy regarding app adoption are partially supported. These privacy concerns are further found to affect how users value their own and their friends’ personal information. However, we are unable to support an association between users’ online social capital and their concerns for friends’ privacy. Nor do we have enough evidence to show that treatment conditions moderate the association between the concern for friends’ personal information and the value of such information in app adoption contexts.