Brave New World: Privacy Risks for Mobile Users

Sophisticated mobile computing, sensing and recording devices are commonplace. Smart phones have achieved significant penetration and novel devices like Google Glass are imminent. These devices can serve most functions of a conventional notebook computer, but also have a range of additional capabilities, including image/audio/video recording, GPS location, compass, accelerometer, nearrange radio (NFC and Bluetooth), and soon health and fitness monitors. Moreover, these devices are carried by their users virtually around the clock, blurring the distinction between the online and offline world and enabling transformative new applications and services. For instance, mobile apps can provide location and activity-sensitive services and information, in the case of Google Glass overlaid right onto a user’s field of view. They can record what the user does, sees and hears for future reference; and they can keep track of a user’s encounters with nearby users’ devices to enable communication related to a shared experience or event. However, these applications and services also introduce a range of new threats to users’ privacy. While a user carries it, a mobile device can capture a complete record of the user’s location, online and offline activities, and social encounters, potentially including an audio-visual record. While such a record is very useful to a user for their own reference and to enable new applications, it is also highly sensitive and inherently private. Unlike information users post on Facebook or Twitter, most users would likely not want to share such a comprehensive record with anyone. In this paper, we catalog privacy threats introduced by these devices and applications. Our survey of threats underlines how privacy threats from mobile devices are fundamentally different and inherently more dangerous than in prior systems. For each specific risk vector, we describe technical challenges that, if solved, can mitigate its effects. We note that technical innovations merely provide a starting point: an end-to-end privacy-preserving infrastructure will require changes in how basic services are deployed, how laws