Privacy & Security Lab (P&SL)

Info 290 LEC 003 (CCN 41237) / Law 276.31 sec. 1 (CCN 40828)

GSI: Lily Lin (office hours Tu 10AM, Co-lab South Hall 110)
Chris Hoofnagle (office hours W 10 AM, South 212)

Units: 4
Meeting Time: TuTh 11:20AM-12:50PM

Meeting Location

Classroom: TBD, check course schedule below

Lab: Tolman Computing Facility (TCF), 1535 Tolman Hall

Description

There is a burgeoning market for technologists and lawyers who can understand the application and implementation of privacy and security rules to network connected services. Privacy and Security Lab is a new course designed to promote the development of such “privacy technologists.” Students will meet twice a week, once in discussion, and the second time in a computer lab to gain hands-on skills in privacy and security analysis. The course will explore the concepts, regulations, technologies, and business practices in privacy and security, including how different definitions of “privacy” may shape technical implementation of information-intensive services; the nature of privacy and security enhancing services; and how one might technically evaluate the privacy and security claims made by service providers. There are no prerequisites and enrollment is open to law students to encourage cross-disciplinary exchanges.

Assessment

Your grade will be based on two, short individual writing assignments (30%), your group project (50%), and your classroom participation (20%). Here is a good template to use for your assignments.

• Short writing assignment: describe a technology to a lay audience (1,000 words max)
• Short writing assignment: describe how a technology could be designed to be more protective of privacy or security (1,000 words max)(you may use the same technology as assignment 1)
• Group project

 Some suggested group topics to get the conversation flowing:

• An analysis of a service in light of the GDPR's privacy-by-design and by-default mandate.
• A comparison of EU and US-directed web services (perhaps most interesting to compare the same company’s website in the two jurisdictions)
• An assessment of the risk of IoT botnets from Mirai-like attacks (that is, a survey of IoT devices to see whether they have hardcoded passwords, or easily-guessable default passwords)
• A comparison of web sites from US and EU IP addresses
• A privacy/security analysis of the recently-emerged "credit lock" packages
• An analysis, possibly comparative, of a browser privacy plugin
• Privacy forensics on an IoT device (we have a budget to buy devices)
• There has been a proliferation of in-person tracking technologies (audio beacons, IMSI catchers, and so on). A project could design an app/device to detect these tracking technologies.
• Net neutrality – data collection relevant to possible changes
• Analysis of a payment system
• SB 27 “Shine the Light Law” Compliance
• Europeans: Make an access request for your data—particularly interesting would be one of these personality analytics firms such as Cambridge Analytica.
• Analysis of Consumers Union’s Digital Protocol
• Creation of a browser extension that elucidates a privacy or security issue
  • Could be simple, such as computer vision tags https://github.com/ageitgey/show-facebook-computer-vision-tags

APM-015 Part II statement

This course will deal with material concerning current events and exploration of government actions and their possible consequences. Class discussion will feature such material.

Course Readings

Luckily most of our readings will be in the public domain, and there is no appropriate textbook for our course. Some readings will be behind paywalls. In order to get the readings at no cost, you will have to use the Berkeley Library VPN or the Library Proxy. These tools enable you to obtain all UCB-subscribed journals and books from your home computer. If you have problems, see your helpdesk.

Tech Cred

If you are feeling at sea with tech, you might explore the relevant courses on lynda.com. UCB has a site license, so you can watch as many as you'd like :) For instance:

• Ethical Hacking: Pen Testing: https://www.lynda.com/Security-tutorials/Ethical-Hacking-Penetration-Testing/529366-2.html
• Python Pen Testing: https://www.lynda.com/Python-tutorials/Learning-Python-Web-Penetration-Testing/521198-2.html
• Search for "ethical hacking" or "cybersecurity" for many more, filter by "course" and "beginner."

The quality of these videos vary, but some are excellent.

To log in, you need to use this link and your calnet: https://hr.berkeley.edu/development/learning/online-learning 

Spring 2018