A Multilateral Privacy Impact Analysis Method for Android Apps

Majid Hatamian; Nurul Momen; Lothar Fritsch

doi:10.1007/978-3-030-21752-5_7

A Multilateral Privacy Impact Analysis Method for Android Apps

Majid Hatamian, Nurul Momen, Lothar Fritsch

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution › peer-review

19 Citations (Scopus)

Abstract

Smartphone apps have the power to monitor most of people’s private lives. Apps can permeate private spaces, access and map social relationships, monitor whereabouts and chart people’s activities in digital and/or real world. We are therefore interested in how much information a particular app can and intends to retrieve in a smartphone. Privacy-friendliness of smartphone apps is typically measured based on single-source analyses, which in turn, does not provide a comprehensive measurement regarding the actual privacy risks of apps. This paper presents a multi-source method for privacy analysis and data extraction transparency of Android apps. We describe how we generate several data sets derived from privacy policies, app manifestos, user reviews and actual app profiling at run time. To evaluate our method, we present results from a case study carried out on ten popular fitness and exercise apps. Our results revealed interesting differences concerning the potential privacy impact of apps, with some of the apps in the test set violating critical privacy principles. The result of the case study shows large differences that can help make relevant app choices.

Original language	English
Title of host publication	Privacy Technologies and Policy
Subtitle of host publication	7th Annual Privacy Forum, APF 2019, Rome, Italy, June 13–14, 2019, Proceedings
Editors	Maurizio Naldi, Giuseppe F. Italiano, Kai Rannenberg, Manuel Medina, Athena Bourka
Place of Publication	Cham, Switzerland
Publisher	Springer
Pages	87-106
Number of pages	20
Edition	1
ISBN (Electronic)	9783030217525
ISBN (Print)	9783030217518
DOIs	https://doi.org/10.1007/978-3-030-21752-5_7
Publication status	Published - 2019
Externally published	Yes
Event	Annual Privacy Forum 2019 - LUISS Guido Carli, Rome, Italy Duration: 13 Jun 2019 → 14 Jun 2019 https://2019.privacyforum.eu/

Publication series

Name	Security and Cryptology
Publisher	Springer
Volume	11498

Conference

Conference	Annual Privacy Forum 2019
Abbreviated title	AFP 2019
Country/Territory	Italy
City	Rome
Period	13/06/19 → 14/06/19
Internet address	https://2019.privacyforum.eu/

Keywords

Smartphone apps
Case study
Security
Privacy
Android
Privacy policy
Reviews
Privacy impact
Privacy score and ranking
Privacy risk
Transparency

Access to Document

10.1007/978-3-030-21752-5_7

Cite this

Hatamian, M., Momen, N., & Fritsch, L. (2019). A Multilateral Privacy Impact Analysis Method for Android Apps. In M. Naldi, G. F. Italiano, K. Rannenberg, M. Medina, & A. Bourka (Eds.), Privacy Technologies and Policy: 7th Annual Privacy Forum, APF 2019, Rome, Italy, June 13–14, 2019, Proceedings (1 ed., pp. 87-106). (Security and Cryptology; Vol. 11498). Springer. https://doi.org/10.1007/978-3-030-21752-5_7

Hatamian, Majid ; Momen, Nurul ; Fritsch, Lothar. / A Multilateral Privacy Impact Analysis Method for Android Apps. Privacy Technologies and Policy: 7th Annual Privacy Forum, APF 2019, Rome, Italy, June 13–14, 2019, Proceedings. editor / Maurizio Naldi ; Giuseppe F. Italiano ; Kai Rannenberg ; Manuel Medina ; Athena Bourka. 1. ed. Cham, Switzerland : Springer, 2019. pp. 87-106 (Security and Cryptology).

@inproceedings{6ae891d370fb4ce5995c148dd35b30c2,

title = "A Multilateral Privacy Impact Analysis Method for Android Apps",

abstract = "Smartphone apps have the power to monitor most of people{\textquoteright}s private lives. Apps can permeate private spaces, access and map social relationships, monitor whereabouts and chart people{\textquoteright}s activities in digital and/or real world. We are therefore interested in how much information a particular app can and intends to retrieve in a smartphone. Privacy-friendliness of smartphone apps is typically measured based on single-source analyses, which in turn, does not provide a comprehensive measurement regarding the actual privacy risks of apps. This paper presents a multi-source method for privacy analysis and data extraction transparency of Android apps. We describe how we generate several data sets derived from privacy policies, app manifestos, user reviews and actual app profiling at run time. To evaluate our method, we present results from a case study carried out on ten popular fitness and exercise apps. Our results revealed interesting differences concerning the potential privacy impact of apps, with some of the apps in the test set violating critical privacy principles. The result of the case study shows large differences that can help make relevant app choices.",

keywords = "Smartphone apps, Case study, Security, Privacy, Android, Privacy policy, Reviews, Privacy impact, Privacy score and ranking, Privacy risk, Transparency",

author = "Majid Hatamian and Nurul Momen and Lothar Fritsch",

year = "2019",

doi = "10.1007/978-3-030-21752-5_7",

language = "English",

isbn = "9783030217518",

series = "Security and Cryptology",

publisher = "Springer",

pages = "87--106",

editor = "Maurizio Naldi and Italiano, {Giuseppe F.} and Kai Rannenberg and Manuel Medina and Athena Bourka",

booktitle = "Privacy Technologies and Policy",

address = "Germany",

edition = "1",

note = "Annual Privacy Forum 2019, AFP 2019 ; Conference date: 13-06-2019 Through 14-06-2019",

url = "https://2019.privacyforum.eu/",

}

Hatamian, M, Momen, N & Fritsch, L 2019, A Multilateral Privacy Impact Analysis Method for Android Apps. in M Naldi, GF Italiano, K Rannenberg, M Medina & A Bourka (eds), Privacy Technologies and Policy: 7th Annual Privacy Forum, APF 2019, Rome, Italy, June 13–14, 2019, Proceedings. 1 edn, Security and Cryptology, vol. 11498, Springer, Cham, Switzerland, pp. 87-106, Annual Privacy Forum 2019, Rome, Italy, 13/06/19. https://doi.org/10.1007/978-3-030-21752-5_7

A Multilateral Privacy Impact Analysis Method for Android Apps. / Hatamian, Majid; Momen, Nurul; Fritsch, Lothar.
Privacy Technologies and Policy: 7th Annual Privacy Forum, APF 2019, Rome, Italy, June 13–14, 2019, Proceedings. ed. / Maurizio Naldi; Giuseppe F. Italiano; Kai Rannenberg; Manuel Medina; Athena Bourka. 1. ed. Cham, Switzerland: Springer, 2019. p. 87-106 (Security and Cryptology; Vol. 11498).

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution › peer-review

TY - GEN

T1 - A Multilateral Privacy Impact Analysis Method for Android Apps

AU - Hatamian, Majid

AU - Momen, Nurul

AU - Fritsch, Lothar

PY - 2019

Y1 - 2019

N2 - Smartphone apps have the power to monitor most of people’s private lives. Apps can permeate private spaces, access and map social relationships, monitor whereabouts and chart people’s activities in digital and/or real world. We are therefore interested in how much information a particular app can and intends to retrieve in a smartphone. Privacy-friendliness of smartphone apps is typically measured based on single-source analyses, which in turn, does not provide a comprehensive measurement regarding the actual privacy risks of apps. This paper presents a multi-source method for privacy analysis and data extraction transparency of Android apps. We describe how we generate several data sets derived from privacy policies, app manifestos, user reviews and actual app profiling at run time. To evaluate our method, we present results from a case study carried out on ten popular fitness and exercise apps. Our results revealed interesting differences concerning the potential privacy impact of apps, with some of the apps in the test set violating critical privacy principles. The result of the case study shows large differences that can help make relevant app choices.

AB - Smartphone apps have the power to monitor most of people’s private lives. Apps can permeate private spaces, access and map social relationships, monitor whereabouts and chart people’s activities in digital and/or real world. We are therefore interested in how much information a particular app can and intends to retrieve in a smartphone. Privacy-friendliness of smartphone apps is typically measured based on single-source analyses, which in turn, does not provide a comprehensive measurement regarding the actual privacy risks of apps. This paper presents a multi-source method for privacy analysis and data extraction transparency of Android apps. We describe how we generate several data sets derived from privacy policies, app manifestos, user reviews and actual app profiling at run time. To evaluate our method, we present results from a case study carried out on ten popular fitness and exercise apps. Our results revealed interesting differences concerning the potential privacy impact of apps, with some of the apps in the test set violating critical privacy principles. The result of the case study shows large differences that can help make relevant app choices.

KW - Smartphone apps

KW - Case study

KW - Security

KW - Privacy

KW - Android

KW - Privacy policy

KW - Reviews

KW - Privacy impact

KW - Privacy score and ranking

KW - Privacy risk

KW - Transparency

U2 - 10.1007/978-3-030-21752-5_7

DO - 10.1007/978-3-030-21752-5_7

M3 - Conference contribution

SN - 9783030217518

T3 - Security and Cryptology

SP - 87

EP - 106

BT - Privacy Technologies and Policy

A2 - Naldi, Maurizio

A2 - Italiano, Giuseppe F.

A2 - Rannenberg, Kai

A2 - Medina, Manuel

A2 - Bourka, Athena

PB - Springer

CY - Cham, Switzerland

T2 - Annual Privacy Forum 2019

Y2 - 13 June 2019 through 14 June 2019

ER -

Hatamian M, Momen N, Fritsch L. A Multilateral Privacy Impact Analysis Method for Android Apps. In Naldi M, Italiano GF, Rannenberg K, Medina M, Bourka A, editors, Privacy Technologies and Policy: 7th Annual Privacy Forum, APF 2019, Rome, Italy, June 13–14, 2019, Proceedings. 1 ed. Cham, Switzerland: Springer. 2019. p. 87-106. (Security and Cryptology). Epub 2019 Jun 8. doi: 10.1007/978-3-030-21752-5_7

A Multilateral Privacy Impact Analysis Method for Android Apps

Abstract

Publication series

Conference

Keywords

Access to Document

Fingerprint

Cite this