CyLab's Alessandro Acquisti at TEDx Mid-Atlantic

Carnegie Mellon University CyLab researcher Alessandro Acquisti has shaken the world of privacy and social media more than once over the past few years, and he is not nearly finished (stay tuned).

So it's no surprise that he was one of forty-four "thinkers, does and innovators" invited to speak at TEDx MidAtlantic. The theme of the conference was "2012: Be Fearless."

Here's the video ...

Alessandro Acquisti at TEDxMidAtlantic 2012

See Also

• CyLab's Alessandro Acquisti and Fellow CMU Researcher Christina Fong Win IAPP Privacy Law Scholars Conference Award
• New Study Co-Authored by CyLab Researcher: Face Recognition Software and Social Media Result in Increased Privacy Risks
• CyLab Researcher’s Study Shows Social Security Numbers Can Be Predicted from Publicly Available Information
• There is an Elephant in the Room, and Everyone's Social Security Numbers are Written on Its Hide

• Not Just Yesterday's Headlines, But the Day After Tomorrow's As Well
• International Privacy Day 2011: Insights into 21st Century Privacy from Carnegie Mellon Panel Featuring CyLab Experts
• Microsoft TAP Interview w/ CyLab's Alessandro Acquisti
• Video Record of CyLab's Alessandro Acquisti on "The Dish: It's All in the Numbers - Privacy, Math, and Social Security" at Koshland Museum
• CyLab Chronicles: Q and A with Alessandro Acquisti (2008)

A Caravanaseri at the Crossroads of Alternate Futures: A Report on the CyLab Silicon Valley Briefing

A Caravanaseri at the Crossroads of Alternate Futures: A Report on the CyLab Silicon Valley Briefing

By Richard Power

As we hurtle forward into the 21st Century (a mere synonym for the Information Age), there is a profound challenge before us. Year by year, day by day, moment by moment, the importance of digital information and cyber systems increases in almost all aspects of human life; and likewise, the spectrum of related risks and threats deepens and broadens year by year, day by day.

Will we develop the 21st Century cyber security technologies and strategies required to cope with this runaway risk and threat matrix? Or will we continue to try and make do with 20th Century visions of cyber security and its digital thumb in the dike approach? Which of these alternate futures will we find ourselves in at the end of the second decade of the 21st Century?

Recently, an impressive gathering was held at the Carnegie Mellon Silicon Valley Campus in NASA Research Park. The presenters were all CyLab researchers. The other participants consisted of CEOs, VPs, CTOs, CSOs and leading technologists from a range of companies from Cisco and Microsoft to WhiteHat Security and iSEC, along with regional representatives from the Federal Bureau of Investigations and the U.S. Secret Service, as well as Board of Directors members from the local chapters of Information Systems Security Association (ISSA) and the American Society for Industrial Security (ASIS). The ultimate aim of the gathering was to push for the better of those two possible futures.

Attendance was RSVP, and by my personal invitation; there was no advertising for this event, no marketing, no hype. It was limited to 50 people, and the attendees were selected to provide a cross-section of concerns, knowledge, influence and experience. If you have been in cyber security for any length of time, you know there are many circles, there is the law enforcement circle, the security professional circle, the technical expert circle, the technology vendors circle, etc. It is at the points where these circles intersect that the most vital work is done. At the CyLab Silicon Valley Briefing, all of these circles intersected, and the dialogue that ensured was rich and rewarding.

Jeremiah Grossman, Founder and CTO of WhiteHat Security: "The speakers were highly informative and very qualified. Definitely good data to be had and I'm happy to we attended. I personally learned several things. Even the audience was well qualified, which is not something ones tends to find at smaller events."

Leslie Lambert, former CSO of Sun Microsystems: "The dialogue with the attendees was rich, as well. The event was very valuable and has the opportunity to increase the interactions between industry folks, government folks, and CMU folks. Good use of my time."

The theme of the event was "Harnessing the Future to Secure the Present," and the agenda highlighted four of CyLab's research thrusts: Trustworthy Computing Platforms and Devices, Software Security, Privacy Protection and Mobility. (Driven by over fifty faculty researchers, working with over one hundred graduate students, CyLab's program, is organized around seven research thrusts and seven additional, cross-cutting thrusts.)


Adrian Perrig, CyLab Technical Director spoke on "Building Secure Applications with Attestation."

"The problem I am going to address is how do we trust the computer we are currently using? How do I really know, as a human user? The goal is that we want to provide the user with strong security properties, such as execution integrity, data secrecy and authenticity.

"Virgil Gligor, CyLab Director, has coined the phrase Cyber-Secure Moments (© Virgil Gligor). So when you connect to your bank account, you want to have a Cyber-Secure Moment, you want to make sure that you have connected to the correct bank, that there is no man in the middle attack, no malware on your local system, stealing your credentials.

"You will also want to make sure that there are no transaction generators, that is one of the most recent attacks; malware is on your system, it waits for you to log-in to your bank account, and as soon as you are logged in, it conducts transactions with your secure login. How can you make sure that no one these malicious activities are happening? So how can you live these Cyber-Secure Moments?

"But you also want to be compatible with existing systems ... we can't easily change all the hardware or change all the operating systems ... We also want efficient execution. There are some solutions, which people have proposed that would slow down your system ten-fold, but obviously we want performance.

"So ideally in the presence of malware, we can still perform secure operations ..."

Perrig went on to explore Attestation, a promising approach for building secure systems, based on the recent development of a Trusted Platform Module (TPM) by the Trusted Computing Group (TCG). In particular, Perrig highlighted four related CyLab projects Flicker, XTREC, Sec Visor and Lockdown, and demonstrated the roles each can play in creating those precious Secure Cyber Moments.

CyLab researcher Alessandro Acquisti (who rocked the world last year with his revelations on predicting Social Security Numbers) spoke on "The Economics (and Behavioral Economics) of Privacy." In his talk, Acquisti outlined evolution of the economics of privacy, and highlighted some experiments in investigating privacy valuations and decision making through the lenses of behavioral economics.

"Contrary to the assumption in much social science that people have stable, coherent preferences with respect to personal privacy, we find that privacy valuations and concerns are highly sensitive to contextual and non-normative factors, and even internally inconsistent. This research raises questions about whether individuals are able to navigate in a self-interested fashion increasingly complex issues of privacy, as well as information security."

CyLab researcher David Brumley spoke on "Safe Software and Systems."

"A major focus of my research is developing techniques for protecting vulnerable applications when the program is only readily available as binary (i.e., executable) code. Since most programs are available in binary form, and binary-only analysis does not require cooperation of the source code vendor, this line of research is likely to impact a wide audience."

Brumley described two new security applications of binary code analysis: "automatic patch-based exploit generation, demonstrating how binary analysis can be used to automatically generate exploits based upon patches released from Windows Update, allowing attackers to create new exploits before all vulnerable hosts can receive a patch, and automatic input filter generation, which offers a way to defend against exploits by automatically generating input filters."

After a delicious Middle Eastern buffet luncheon, which was a abuzz with dialogue spinning of the morning's presentations, there were three more sessions.

Martin Griss, Director of the Silicon Valley Campus and the CyLab Mobility Research Center (MRC) spoke on "Creating a Truly Mobile Companion."

Griss' research is focused on the vision of a mobile device, with an integrated suite of applications on the device and services in the cloud and on telecom infrastructure.

"It must be context-aware. It must understand where I am, and what I am doing. It must be adaptable and able to learn, so that I do not have to repeat the same things over and over again. Machine-learning ...

"It should be pro-active; it should do thing for me, but it shouldn't constantly do things for me or to me; so it should be considerate. So we are trying to define what it is to be a proactive but considerate system. There is this balancing act between too helpful and not helpful enough.

"It must be secure and private, of course. Because as people use it for more and more things, and as you carry it more and more of the time, it knows more and more about you.

"It must be social; it must interact well with me and others as well as with other devices and with the social networks. It should be a device that recommends, reminds and advises. The obvious example is having turn by turn driving instructions on your phone, but we can do much more than that.

"And it should act for me, when needed. So, in extreme cases, I tell it to do something, and then I go off and do something else, while the phone, or the phone and the services are doing things for me, it will negotiate in the background. So when I would like to make a meeting, I would rather not go poking around on my calendar, I could just tell it 'meeting with my friends,' and at some point later it would say, 'meeting with your friends.'"


CyLab researcher Collin Jackson spoke on "Securing the Web Platform."

He outlined his work on Browserscope, an ongoing collaboration with browser vendors to improve browser encryption, defend against the most common web application vulnerabilities, and develop building blocks for securing third-party advertisements and applications; Browserscope has been deployed in many of the world's most popular browsers, including Firefox, Google Chrome, and Safari.

Patrick Tague spoke on "Guaranteeing Availability and Reliability in Mobile Wireless
Networks." He delivered an overview of issues related to availability and reliability of service in mobile wireless networks, and presented a variety of vulnerabilities and attacks of interest at the network layer and below, including interference and jamming by external adversaries and data- and control-plane routing attacks by internal adversaries."

Perrig and Brumley flew in from Pittsburgh, PA. where the main campus of Carnegie Mellon University is located. Griss, Jackson and Tague are based at the Silicon Valley Campus. Underscoring the bi-coastal nature of Carnegie Mellon's program, Acquisti spoke via video conference from the Pittsburgh campus.

As the host of the event, I was delighted that the level of engagement between the presenters and the attendees was so genuine that I had to cut-off the Q and A at the end of every session to keep on the event on track.

Indeed, "Harnessing the Future to Secure the Past: A CyLab Silicon Valleuy Briefing" was a compelling re-affirmation of academic research's vital role in helping us choose the better of the alternate futures that stretch out before us, i.e., the one that demands 21st Century responses to 21st Century challenges.

CyLab Seminar Series: Of Frogs, Herds, Behavioral Economics, Malleable Privacy Valuations, and Context-Dependent Willingness to Divulge Personal Info

[NOTE: CyLab's weekly seminar series provides a powerful platform for the highlighting vital research. The physical audience in the auditorium is composed of Carnegie Mellon University faculty and graduate students, but CyLab's corporate partners also have access via the World Wide Web. On a frequent basis, CyBlog will wet your appetite by offering brief glimpses into these talks. Here are my notes from a talk delivered by Alessandro Acquisti on 4-6-09. -- Richard Power]

The boiling frog story states that a frog can be boiled alive if the water is heated slowly enough — it is said that if a frog is placed in boiling water, it will jump out, but if it is placed in cold water that is slowly heated, it will never jump out. Wikipedia

CyLab Seminar Series Notes: Of Frogs & Herds, Behavioral Economics, Malleable Privacy Valuations, & Context-Dependent Willingness to Divulge Personal Info

Carnegie Mellon University CyLab researcher Alessandro Acquisti, Assistant Professor of Information Technology and Public Policy at Carnegie Mellon’s H. John Heinz III College, always warns his students not to trust Wikipedia; nevertheless, this Boiling Frog story, whether apocryphal or not, provides a useful foil for some fascinating research.

Working with collaborators Leslie John and George Loewenstein, Acquisti has been delving into the mysteries of privacy and security from a behavioral economics perspective. Aquisti and his colleagues see a great application for this particular discipline in the exploration of privacy and security decision-making.

“Behavioral economics is a field of economics that combines psychology plus more traditional economic thinking to understand why people really make decisions, and why certain decisions are sometimes sub-optimal, inconsistent and paradoxical,” Acquisti explains.

Acquisiti’s seminar focused on three studies his team had conducted:

Study 1: The “frog” effect (or lack thereof) on information disclosure.
Study 2: The “herding” effect on information disclosure.
Study 3: The effect of framing on privacy values.

“We feel we are uncovering something novel and peculiar to the privacy area.”

These notes will focus on Study 1.

The research on the “frog” effect explores the impact of privacy intrusions on the propensity to disclose, and in particular, what A sees as “a crucial question, one of the most interesting questions, and one of the most difficult to answer, “Do privacy intrusions (and how we react them) alert or rather desensitize individuals to privacy concerns”

“We live in a society in which every week in the media there is some new event, e.g., exposing personal data on millions of consumers, NSA is spying on domestic communications, passport records of important people are being accessed illegally, etc. Does all of this exposure to privacy intrusions make people believe that well, there is no privacy any longer, so I stop caring; there is so much information out there that there is nothing I can do about it? Or, in fact, is it the opposite, there is so much discussion and so much evidence of intrusions that it will create the opposite effect, at a certain moment, subjects start saying this is too much, enough is enough, and start reacting?”

“This is a difficult question to answer. Because you have to combine longitudinal data and effect, the age effect and the cohort effect, e.g., ‘Do you people use Facebook so much because they are young (age effect) or because they are born in a certain culture (cohort effect)?’ And in the absence of a longitudinal study that tracks people over ten, twenty or thirty years, what we did was simulate a scenario of privacy intrusions by creating a survey of questions with different levels of sensitivity. The sensitivity of the questions ranged from the tame, e.g., ‘Have you ever failed to turn the lights out at home or at work when you left?’ to the intrusive, e.g., ‘Have you ever had sex with the current husband, wife or partner of a friend?’

The survey included ten tame questions, ten moderately intrusive questions, and ten intrusive questions. The design of the survey included randomly assigning respondents to eight different conditions, e.g., the order of the questions, i.e., from tame to intrusive or from intrusive to tame as well as in pseudo-random or sudden order. It was framed as a survey on “ethical behavior.’ Another important factor was when respondents were asked for identifying information, i.e., at the beginning or at the end. “As you can imagine, people were much more willing to give an e-mail address before seeing the survey then after seeing what the survey was about.” The pool of respondents consisted of online readers of the New York Times (NYT), and the survey was linked to from the blog of a NYT op-ed columnist.

“We manipulated the order in which questions were presented to survey participants. Some subjects would see a survey which started with very tame questions and then increasingly became very intrusive. While other subjects started from the very intrusive questions and then went down to questions of lower and lower sensitivity.”


Two hypotheses were tested: the “Frog” hypothesis and the “Coherent Arbitrariness” hypothesis. The “Frog” hypothesis says that people will admit to sensitive behavior more often when they get “warmed up” by getting the tame questions before the more intrusive ones. The “Coherent Arbitrariness” says that people will admit to sensitive behavior less often when they “warmed up” by the survey, because their expectations about the intrusiveness of the survey will be established early on.

The “Coherent Arbitrariness” hypothesis was the one supported.

The “Frog” hypothesis was strongly rejected by the data.

Subjects in the increasing condition admitted to sensitive, moderate, and tame behaviors less often than subjects in other conditions

Subjects in the decreasing condition admitted to sensitive behaviors more often than subjects in other conditions

Bottom line: starting a survey with tame questions, then increasing their intrusiveness, inhibits information disclosure. Sensitive behaviors were more frequently admitted to when asked first.

To read a CyLab Chronicles Q&A with Alessandro Acquisti, click here.

For information on the benefits of partnering with CyLab, contact Gene Hambrick, CyLab Director of Corporate Relations: hambrick at andrew.cmu.edu