Any good references on Privacy Testing?

Question

I heard a reference to Privacy testing recently (James Whittaker mentioned it here.) and it seems like a valuable area to know something about. It's extremely important these days as companies balance "social features" with protecting users P2I (personally identifiable information).

My question is how would someone go about understanding the basis for user privacy? Assuming you’d need to understand what privacy is before you could test for it?

Are there references (blog posts, Wikipedia, books, videos, experts in the field?) on the factors involving user privacy? The end result could involve checking for your own or others user privacy.

Answer 1

The first thing to be mindful of when it comes to privacy is the simple fact that you are dealing with specific legal constraints upon what is and is not allowed. Therefore unless you have dealt with regulatory issues before, you are going to need somewhat of a different mental model for deriving requirements and testing.

Your location, the type of application (web or desktop), does the app require / transmit personal data, where the servers are and many other factors; will determine which, if any, laws you need to become familiar with.

Consider the following scenario, a web based app that is created by developers in country X with users around the world, and hosted by a third party cloud provider, whose physical server location may change on the fly. Which jurisdictions laws do you need to worry about? Probably all of them.

Fundamentally therefore privacy considerations need to be baked into the architecture and design from day one. There are far too many ways for personally identifiable information to leak otherwise. It is also not possible to secure this data in isolation, there needs to be an understanding of the risks from top to bottom of the organization (large or small) on who may get access to this.

Privacy testing is really a combination of the following:

1. Store only as little information as needed. You can't leak what you don't know.
2. Compliance with relevant regulations for what information you do store
3. Prevention of unintentional leaks e.g. security testing for info leaks, SQL injection etc.
4. Methods to identify intentional leaking. Monitor for unusual data movement patterns, back doors...
5. Recovery procedures in the case of a data leak. This is technically covered by item 2 but worth reiterating. There are, depending on jurisdiction, legal obligations regarding notification of data loss.

Answer 2

There seems to be a lot of information on the web about privacy but nothing so specific as it relates to testing it. However in order to test it you probably need to have experience in some / many aspects. From what I can tell there are several aspects to Privacy including:

• Technical: As Steve mentions it depends on the type of application, how data is transmitted and stored, etc. This would also related to how you track users, how you verify who's identity is in use, etc.

• Legal: Privacy laws for each country or state; laws for specific industries like Health Care, how legal jurisdictions work. Does the legal aspect cross other aspects?

• Social: How does society value privacy and in what ways? What are the social norms and are they changing with social media? Is this area based on a lot of subjectivity - in the eye of the beholder?

• Ethical: What information should we collect? How should be it be collected? Are there certain groups of the population we shouldn't and others where we can collect more? Protecting your own privacy might fall into this area if you feel others can't be trusted to do it for you.

• Historical: How do our past involvements with privacy influence our current views? What is the history of Privacy / privacy law in certain countries, states, etc.? Consequences?

Others I can think of include cultural influences, tools that are used, people and organizations involved in the debate.

This isn't a comprehensive list but I'd like to get more input. Anyone see some category I've missed or have additional details on the categories?

--- Chris

Answer 3

I believe you asked to test for your privacy, ie. you identity must be protected when browsing. To test what web browser reveals about you.

www.onion-router.net/Tests.html

www.maxa-tools.com/cookie-privacy.php

www.ultimate-anonymity.com/ready.htm