[Paper Review] Quantifying Surveillance in the Networked Age: Node-based Intrusions and Group Privacy.

Laura Radaelli, Piotr Sapieżyński+3 more|arXiv (Cornell University)|Mar 23, 2018

Privacy-Preserving Technologies in Data17 references14 citations

TL;DR

This paper formalizes group privacy in networked systems by introducing node- and edge-observability metrics, showing that hub nodes increase surveillance risk while clustering reduces it. Using synthetic and real-world mobile data, it demonstrates that compromising just 1% of nodes can expose 46% of communications, revealing systemic vulnerabilities in individual-centric privacy models.

ABSTRACT

From the right to be left alone to the right to selective disclosure, privacy has long been thought as the control individuals have over the information they share and reveal about themselves. However, in a world that is more connected than ever, the choices of the people we interact with increasingly affect our privacy. This forces us to rethink our definition of privacy. We here formalize and study, as local and global node- and edge-observability, Bloustein's concept of group privacy. We prove edge-observability to be independent of the graph structure, while node-observability depends only on the degree distribution of the graph. We show on synthetic datasets that, for attacks spanning several hops such as those implemented by social networks and current US laws, the presence of hubs increases node-observability while a high clustering coefficient decreases it, at fixed density. We then study the edge-observability of a large real-world mobile phone dataset over a month and show that, even under the restricted two-hops rule, compromising as little as 1% of the nodes leads to observing up to 46% of all communications in the network. More worrisome, we also show that on average 36\% of each person's communications would be locally edge-observable under the same rule. Finally, we use real sensing data to show how people living in cities are vulnerable to distributed node-observability attacks. Using a smartphone app to compromise 1\% of the population, an attacker could monitor the location of more than half of London's population. Taken together, our results show that the current individual-centric approach to privacy and data protection does not encompass the realities of modern life. This makes us---as a society---vulnerable to large-scale surveillance attacks which we need to develop protections against.

Motivation & Objective

• To formalize Bloustein's concept of group privacy in networked environments using node- and edge-observability metrics.
• To analyze how graph structure—particularly degree distribution, clustering, and hubs—affects surveillance exposure.
• To evaluate the real-world impact of node compromise on communication and location privacy using large-scale mobile datasets.
• To demonstrate that current individual-centric privacy models fail to protect against large-scale, distributed surveillance attacks.

Proposed method

• Define local and global node- and edge-observability as formal metrics to quantify surveillance exposure in networks.
• Prove that edge-observability is independent of graph structure, while node-observability depends solely on degree distribution.
• Use synthetic network models to simulate multi-hop surveillance attacks under varying structural properties (density, clustering, hubs).
• Analyze a real-world mobile phone dataset over one month to measure edge-observability under a two-hops rule.
• Deploy a smartphone app to simulate distributed node compromise and assess location privacy exposure in urban populations.
• Use real sensing data to model city-scale surveillance risks from low-probability node compromises.

Experimental results

Research questions

• RQ1 How does network structure—specifically degree distribution, clustering, and hubs—affect node- and edge-observability in surveillance scenarios?
• RQ2 To what extent does compromising a small fraction of nodes lead to widespread communication surveillance in real-world networks?
• RQ3 How does the two-hops rule for surveillance impact the observability of individual communications and locations?
• RQ4 Can distributed attacks on 1% of a population lead to large-scale monitoring of urban populations?
• RQ5 To what extent does the current individual-centric privacy model fail to protect against group-level surveillance risks?

Key findings

• Compromising just 1% of nodes in a real-world mobile network can lead to the observation of up to 46% of all communications under a two-hops surveillance rule.
• On average, 36% of each individual’s communications are locally edge-observable when only 1% of nodes are compromised.
• The presence of hubs increases node-observability, while a high clustering coefficient reduces it, even at fixed network density.
• Using a smartphone app to compromise 1% of London’s population enables monitoring of more than half of the city’s population in real-time location data.
• Node-observability depends only on the degree distribution of the network, while edge-observability is independent of graph structure.
• The findings reveal systemic vulnerabilities in individual-centric privacy models, highlighting the need for collective privacy protections in networked societies.