SocioNomics

Your personal data in a box!

2017-01-09T07:45:00.000-08:00

By Hamed Haddadi @realhamed
http://www.eecs.qmul.ac.uk/~hamed/

Today's personal data ecosystem is in a fragile state. A large number of smartphone apps [1], third party trackers [2], or social media collect and aggregate personal information in order to provide location-based services or targeted advertising. This comes with several costs, including our privacy, energy, and bandwidth use. However, any attempts to reduce these costs that are in opposition to the basic economics of so many Internet services are unlikely to succeed. Likewise, personal data vaults and information silos are bound to become a target for security attacks.

In a new EPSRC-funded project, we are building the Databox [3], a personal networked device (and associated services) that collates and mediates access to personal and IoT data, allowing us to recover control of our online lives. The Databox is a first step to re-balancing power between us, the data subjects, and the corporations that collect and use our data.

In the Databox Project, starting from October 2016, the researchers are creating a hardware platform and an open source suite of software for bringing third party apps to personal data, without jeopardising individuals' privacy. This can be achieved by performing analytics over encrypted data [4] a first level of aggregation and data analysis at the user end, or in a distributed manner over the boxes in the community [5]. While the Databox is not a data silo, it allows the user to interact with their data using concepts inherited from the Human-Data Interaction framework, and install and verified authorised third party apps which have isolated and controlled access to different data sources.

One might think, what would we put our data together? What's in it for the user? Where's the business model? The way to think about it is the Android or iOS ecosystem, where the inherent value lies within the apps and the data, while in the Databox model, users might actually be tempted to pay for an app that does, say for example, income and expenditure analysis for getting the best mortgage, or mental and physical health analysis without giving up all their personal data and smartphone battery life. The app ecosystem is only limited by the developers' imagination and the users' needs.

Research in this space is the first step to fighting the privacy battle. The complex regulatory aspects over acquisition and trade of personal data, and various geographical jurisdictions surrounding [or lack there of] personal data all make for a challenging and bumpy road ahead. What is certain, is that the current wild-west nature of personal data can not continue for much longer.

[1] How Private Are Health-Tracking Apps on Your Phone?,
http://health.usnews.com/wellness/articles/2016-07-13/how-private-are-health-tracking-apps-on-your-phone

[2] The Murky World of Third Party Web Tracking, https://www.technologyreview.com/s/530741/the-murky-world-of-third-party-web-tracking/

[3] Hamed Haddadi, Heidi Howard, Amir Chaudhry, Jon Crowcroft, Anil Madhavapeddy, Derek McAuley, Richard Mortier, "Personal Data: Thinking Inside the Box”, The 5th decennial Aarhus conference (Aarhus 2015), August 2015

[4] Wang, Frank, James Mickens, Nickolai Zeldovich, and Vinod Vaikuntanathan. "Sieve: cryptographically enforced access control for user data in untrusted clouds." In 13th USENIX Symposium on Networked Systems Design and Implementation (NSDI 16), 2016.

[5] Hamed Haddadi, Richard Mortier, Steven Hand, Ian Brown, Eiko Yoneki, Derek McAuley and Jon Crowcroft: “Privacy Analytics”. ACM SIGCOMM Computer Communication Review, April 2012.

Title: Privacy-Preserving Personal Mobile Databox

2015-09-08T02:08:00.002-07:00

POST BY Mateus Felipe Eisenkraemer

It has been almost two years after the world was shocked with the surveillance scandal made by the NSA agency, where according to The Guardian ( http://www.theguardian.com/world/2013/sep/24/brazil-president-un-speech-nsa-surveillance ), “Personal data of citizens was intercepted indiscriminately”. Certainty, this scandal led to a global awareness of how valuable our personal information is and how badly it can be misused.

Unfortunately, there are very few studies and tools that focus into providing alternatives for keeping our private data safe, while still not completely disrupting with the current targeted ad campaigns or giving breach for terrorism threats.

Our online interactions seem to be increasing exponentially in the past few years. With more devices and services being used every day, it is really hard to be aware how much data we generate every day and an even harder to know how our data is being used by others.

Considering this constraints, we propose an Android mobile app that enables people to engage with the collection and management of their own personal data. The platform can be referred as a Databox, and will be situated on the users own smart phone with all the gathered data available there. The main reason why all the data will be persisted just on the user own device is because there are a range of privacy threats that arise due to, for example, storing all this data about us in a third party website or cloud service.

The data gathered and stored in the Databox is the following:

Online Profile: Facebook profile information, as name, gender, locale, email and age.

· Individual: Personal location history using the device GPS system.

· Online social Network Sentiment analysis: A sentiment analysis over the user own posts on Twitter.

· Online social Network Trend analysis: A daily trend analysis over the posts made by the user and their connections in Twitter and Instagram.

· Health: Total number of steps made by the user in each day.

The current objective of the Databox is to generate user awareness and control over its own online generated data. But we foresee a wider spectrum that this application could fit in. We plan to provide the users of the app with the ability to choose certain pieces of data to be made available to third parties as a form of payment for a service or simply appreciation. This could allow many different types of interaction, as the Databox being a new type of currency available for us to use.

The targeted ad campaigns models by the analysis of personal data could also be benefited by the use of Databox, in a much less invasive way. Media companies and end users could agree upon which and how each data piece would be used. Always allowing each of us to be in total control of our online generated data and deciding who should have access to it.

To download the app, please go to https://play.google.com/store/apps/details?id=project.course.qmul.databox.

The Databox project is open source and currently available at https://github.com/DataboxInc/DataboxQMULAndroidApp, all contributions are greatly appreciated.

Our response to VPN providers' request & reactions

2015-07-08T15:35:00.003-07:00

We have had a lot of interest in some of our recent work: “A Glance through the VPN Looking Glass: IPv6 Leakage and DNS Hijacking in Commercial VPN Clients”, which has just been published at the Privacy Enhancing Technologies Symposium in Philadelphia. We’re delighted this has made a positive impact, with many VPNs announcing fixes to deal with the issues we raised and notified them all months before publishing the paper. However, we wanted to add a few extra comments in light of the statements made in recent days.

A few of the VPN providers say that our paper is out-of-date and they have deployed fixes. This is great news to hear, and something that we were obviously hoping for. We were fastidious about contacting all VPN providers before publication to give them the opportunity to deploy their fixes before the results were made public. In many cases, the VPN providers have explicitly acknowledged us as being responsible for them deploying the fix. Upon contacting them, some of the companies ignored our mail. We therefore refute claims that we were irresponsible in the disclosure of this work - any VPNs who remain vulnerable are solely responsible for their own infrastructure and the privacy and security of their customers.

We’ve been contacted by several VPNs that we did not include in the study. Further, some of the VPNs that we did study have dismissed our findings, stating that they are not vulnerable. Whereas some have now deployed fixes, we are exceedingly confident in the veracity of the experiments prior to this. We also want to thank the VPNs that came out and acknowledged our work as being accurate, rather than denying it. One way in which companies have claimed our experiments are wrong is by saying that the number of exit points we reported were incorrect. This is misleading. We were explicit in saying that these numbers were those observed by our vantage point. We never claimed to have a comprehensive view over all their exit points. Further, this in no way relates to the security attacks discussed, so it is rather irrelevant. Sadly, we cannot continue to repeatedly test all the VPNs contacting us as we simply don’t have the manpower. However, we encourage all VPNs to repeat the tests detailed in the paper, and to deploy fixes if the vulnerabilities are found.

Lastly, we want to emphasise the key point of our study: VPNs are not designed to give comprehensive anonymity. We were glad to see that some of companies were very candid about this, and publicly spoke of the benefits of Tor and the limitations of anonymity capabilities offered by a VPN. If you are genuinely concerned about your online privacy, then a service such as Tor is more appropriate. If you simply want to gain an IP address in another country then, sure, a VPN is perfectly suitable.

Source:

Vasile Claudiu Perta, Marco Valerio Barbera, Gareth Tyson, Hamed Haddadi, Alessandro Mei, "A Glance through the VPN Looking Glass: IPv6 Leakage and DNS Hijacking in Commercial VPN clients”, The 15th Privacy Enhancing Technologies Symposium (PETS 2015), June 30 – July 2, 2015, Philadelphia, PA, USA (paper, HackerNews, The Register, Tech times).

How a Box Could Solve the Personal Data Conundrum

2015-03-11T01:29:00.003-07:00

The MIT Technology Review has a nice article on our new Databox paper, and it was also followed by coverage in the Guardian. The idea is to be able to index all your personal data, ready for cross-correlations and research! Please had a read:

Hamed Haddadi, Heidi Howard, Amir Chaudhry, Jon Crowcroft, Anil Madhavapeddy, Richard Mortier, "Personal Data: Thinking Inside the Box”, January 2015, available on arXiv [paper , MIT Technology Review, Guardian]

A Glance through the VPN Looking Glass: IPv6 Leakage and DNS Hijacking in Commercial VPN clients

2015-03-11T01:25:00.003-07:00

Have you ever wondered how individuals' in countries with restricted Internet use services such as Facebook and Twitter? Are these users safe from their governments' ability to monitor their browsing behaviour? In many such places, Commercial Virtual Private Network (VPN) services have become a popular and convenient way for users seeking privacy and anonymity. They have been applied to a wide range of use cases, with commercial providers often making bold claims regarding their ability to fulfil each of these needs, e.g., censorship circumvention, anonymity and protection from monitoring and tracking.

In our new paper, to appear in The 15th Privacy Enhancing Technologies Symposium (PETS 2015), we investigated the claims of privacy and anonymity in commercial VPN services. We analyse 14 of the most popular ones, inspecting their internals and their infrastructures. To our surprise, and despite being a known issue, our experimental study reveals that the majority of VPN services suffer from IPv6 traffic leakage.

IPv6 is an increasingly popular web access method being adopted worldwide. Hence, our paper highlights that people using these VPN services may actually have their web browsing habits leaked to any organisation monitoring them. Perhaps most concerning is the unfounded common belief that these VPN services are actually securely hiding users' web browsing activities. We have informed all of these VPN providers about this study and our findings, and we hope they will address this issue immediately.

Vasile Claudiu Perta, Marco Valerio Barbera, Gareth Tyson, Hamed Haddadi, Alessandro Mei, "A Glance through the VPN Looking Glass: IPv6 Leakage and DNS Hijacking in Commercial VPN clients”, The 15th Privacy Enhancing Technologies Symposium (PETS 2015), June 30 – July 2, 2015, Philadelphia, PA, USA (paper)

WeChat – A good example of bad API security!

2014-11-11T01:00:00.001-08:00

In last few days Muhammad Haris was looking into network traffic data of mobile applications for related research on mobile privacy and security. However, in the process, we figure out shocking vulnerability in very famous WeChat messenger application. First, for those of you who never heard of Wechat: it is a primary messenger app in the Asian region specifically China, used by half a billion of individuals.

This app has one important feature named moments. By this feature users can share photos and status with their friends only. For the sake of privacy, photos and status shared by your friends are only visible to you in your moment (not the default friends-of-friends like in Facebook wall). Similarly there is another feature of album; which lets you see all pictures and status shared by a particular friend. You can visit your friends’ album through their profile. Important point to note here is that official explanation by WeChat mentioned that things shared on moments (and album) are visible to your friends only. However it seems like backend communicationa between the WeChat application and its server suffer from serious security flaws. Let me take you there step by step.

To capture mobile application data Haris used fiddler which is very nice proxy; should you wish to use fiddler to capture your mobile data you can follow this nice tutorial by Troy Hunt.

If you visit WeChat moments in phone, all the pictures visible in your moments are being loaded over HTTP. Hence by just looking at the mobile traffic data from fiddler you can get all the moments' pictures. Picture:1 shows Haris's WeChat moments, his friend has shared some photos of his hiking trip.

Now in the picture:2 as we browse over moments, the highlighted packets are sent by WeChat server to the application in the phone. Notice that protocol used for these packets is HTTP, which means photo data is not sent over secured HTTPS channel.

In picture:3 and picture:4 we see selected individual packets, you can see the same pictures of his friend which are in the moments here.

This simply means that if a WiFi provider collect the raw packets on the channel from mobile devices, they can easily get all the photos of your friends as soon as you visits moments on your WeChat. As a result on one hand personal photos (of you and your friends) can be leaked and on the other hand a malicious WiFi provider can also infer your social links by looking at the pictures. This just illustrates the point of how harmful a poorly implemented API (application programming interface) security can be!

In comparison with other OSNs, Instagram seems to be still suffering form similar security issues, but in case of WeChat there is no need to hijack any sessions, it's all open by default! Google offered full encryption as an option for Gmail in 2008, but two years later made it the default. Facebook switched it on by default in January 2011.

Privacy-preserving Adsense Systems Using Delay Tolerant Networking

2014-07-05T06:33:00.002-07:00

an undergrad student of mine did this work based on our research on MobiAd, which I found pretty impressive!

With the ever-increasing number of smart phones, a growing num- bers of people view advertisements on their phones and hence the smart phone advertising market has become rich and noticeable. To raise click-through rate and maximize profit, ad brokers ensure their ads are more personalized and targeted. Therefore, they col- lect personal information to build an accurate user profile. The use of sensitive and personal information may raise privacy concerns. In this paper we focus using Delay Tolerant Networking (DTN) to anonymize click reports, aiming to stop attackers tracking and identifying users based on behaviour and location. The results of our simulations prove that a few-hop DTN-based system can protect users’ identity and privacy while not heavily increasing their energy costs.

http://www.eecs.qmul.ac.uk/~hamed/papers/advdtn.pdf

Do-Not-Record-Me: Quantified Self and the Privacy Challenge

2014-05-19T13:29:00.000-07:00

We are increasingly surrounded by recording and quantifying devices. Devices such as Google Glass can record images and sound from an individual, even of the owner of the device has no such intensions. Can we use a Privacy-Beacon to avoid this? something like, a local area broadcast, that forces, or at least politely asks the intruding device, to either not record an individual, or remove their data after recording has been done? In a short note, myself and Ian Brown think this is possible! here's a short note on this topic:

The increasing availability of personal activity monitors, tracking devices, wearable recording devices, and associated smartphone apps has given rise to a wave of Quantified Self individuals and applications. The data from these apps and sensors are usually collected by associated apps and uploaded to the software developers for feedback to individual and their selected partners. In this paper we highlight the privacy risks associated with this practice, demonstrating the ease with which an app provider can infer individuals co-location and joint activities without having access to specific location data. We highlight a number of potential solution to this challenge in order to minimise the privacy leakage from these applications.

http://www.eecs.qmul.ac.uk/~hamed/papers/qselfprivacy2014.pdf

The Rise of Panopticons: Examining Region-Specific Third-Party Web Tracking

2014-01-24T06:31:00.000-08:00

Today’s web has a huge, diverse ecosystem of third party websites collecting information about users and providing them with content such as targeted advertisements. In this paper we study this ecosystem of third-party websites. We sample every continent, targeting the 500 most popular websites in the US, UK, Australia, China, Egypt, Iran and Syria. This allows us to contrast the commonplace, western-dominated views of the web with less studied countries. We find 2,097 third-party websites, reflecting the diversity of services and types of application/content they involve, e.g., advertisement, ad trackers, CDNs, news, sport, and pornography. We find those third-party websites offering ad tracking services to be the most prevalent. In addition to the usual suspects (e.g., DoubleClick and Google), we find a rich ecosystem of local third-party websites that are country and language dependent.

Marjan Falahrastegar, Hamed Haddadi, Steve Uhlig, and Richard Mortier, “The Rise of Panopticons: Examining Region-Specific Third-Party Web Tracking”, In Sixth Workshop on Traffic Monitoring and Analysis (TMA), London, UK, April 2014.

Promoted tweets versus promoted trends

2013-12-29T15:53:00.002-08:00

Advertising on Twitter? There are a number of factors to consider: use of hashtags, use of keywords, target audience and locations. But also choosing the type of adverts is important: promoted tweets, or promoted trends? Our research shows that promoted trends lead to higher number of tweets, while promoted tweets lead to higher user engagement, which may be the ultimate measure of success. For a use-case study, see:

Shana Dacres, Hamed Haddadi, Matthew Purver, “Topic and Sentiment Analysis on OSNs: a Case Study of Advertising Strategies on Twitter”, arXiv, December 2013 (PDF)

Meeyoung Cha, Hamed Haddadi, Fabricio Benevenuto, Krishna Gummadi, "Measuring User Influence in Twitter: The Million Follower Fallacy", in ICWSM 2010, 4th Int'l AAAI Conference on Weblogs and Social Media, May 23-26, 2010, George Washington University, Washington, DC (paper) (NYTimes coverage ) (Harvard Business Review coverage ) (Media coverage)

Human-Data Interaction

2013-10-05T03:34:00.000-07:00

I have been thinking about this concept a lot recently... just to clarify, this is NOT a new discipline or field, it is basically an interest group, and a way of thinking about the aggregate effect of user profiling, advertising, interface, HCI, privacy and the way the users' behaviour may be changed due to change in these topics, rather similar to the way that the Quantified Self movement is shaping up.. an interest group of inter-disicplinary researchers..

This all started after a casual talk and meeting with Mort in Nottingham, then filtering the ideas through Jon, Mac and Tristan, which resulted to a draft of our thoughts for the UK Digital Economy all-hands meeting:

Richard Mortier, Hamed Haddadi, Tristan Henderson, Derek McAuley, and Jon Crowcroft, "Challenges & Opportunities in Human-Data Interaction", DE2013: Open Digital, November 2013, MediaCityUK, Salford, UK. (PDF)

On 4th October 2013, we had the EPSRC/ITaaU first workshop on HDI, which brought in a large number of top-notch industry and academic researchers across law, privacy, HCI, economics, computer science, engineering, geography, and financial sector. You may enjoy reading the detailed liveblog by Cambridge guys. The participants all took part in a range of activities, and are interested in officially forming an interest group, so watch this space for more news!

Individual's perception of the value of privacy, a contextual experiment.

2013-06-04T14:28:00.000-07:00

There are a large number of studies surveying individuals about the value fo their personal information. These are particularly motivated by the claims of big cloud , good or bad, that individuals can't evaluate their personal information, so it must be free!

we recently did a survey using android apps , asking individuals to let us know twice a day, what they are doing, who they are with, and how much are these information worth to them. However we divided the individuals into 4 groups, with different buying and selling criteria..

In brief, the results show that individual's CAN evaluate the value of their personal info, and these values are in agreement with findings of others (see Vijay Erramilli's paper in WWW'13 for example or Bernardo Huberman's information market paper)

The paper is published at ACM SIGCOMM HOTPLANET 2013 workshop. you can ready it here

Bernadette Kamleitner, Stephan Dickert, Marjan Falahrastegar, Hamed Haddadi, “Information Bazaar: a Contextual Evaluation”, 5th ACM HotPlanet workshop, co-located with SIGCOMM 2013, August 2013, HongKong.

Opportunities and Challenges in Interdisciplinary Research

2012-10-09T14:34:00.001-07:00

Today I attended this excellent workshop arranged by EPSRC UBHAVE project team, bringing together a number of excellent computer scientists, engineers, medics, industry members, psychologists and HCI experts from across the world, discussing the challenges faced by interdisciplinary researchers, from convincing patients to carry around monitors, to setting the right interface/sampling rate/data collection strategy for devices and sensors. The interesting projects, range of smart phone apps, and the adoption of technology in form of peculiar mixes of software and hardware brought a mesmerising atmosphere. Number of challenges were highlighted:

difficulty in establishing what method and which collaborator is right
privacy issues and security of devices
economic and personal incentives to use technology
large delay between research grant cycle and industrial advancements
Lower academic rewards (promotion/etc) for interdisciplinary research
understanding each other!

I worked 2 years on the Huntington Disease project, and indeed, communication between biologists, engineers, mathematicians and computer scientists is a SERIOUSLY challenging issues, however it is just as vital to go through, as otherwise we face the classic problems that us (i.e., engineers and computer scientists) are constantly facing: designing systems by geeks, approved in conferences by geeks, adopted by geeks, and often failing to make it to mass markets, on the other extreme, our technology offers scale, speed and accuracy, and more importantly, ability to monitor in situ, capturing the contextual data, relieving the sociologist and biologist from privacy-intrusive and cumbersome ethnography, monitoring, lab experiments and interviews.

Rather than poisoning your fresh brains with my rants, I'll let you have a look at the program yourself and click on the links ! :)

Conference Programme

Morning Session: “Making Multidisciplinary Research Work”

10.30 – 10.40am Welcome and Introduction

Professor Lucy Yardley, University of Southampton, UK

Professor Susan Michie, University College London, UK

10.40 – 11.20am “Engaging the Users in Multidisciplinary Projects: How to find them, what to do with them, and where to go next”

Professor Torben Elgaard Jensen, Technical University of Denmark

11.20 – 12.00pm “Multilevel and Reciprocal Behaviour Change: The Role of Mobile and Social Technologies”

Professor Kevin Patrick, University of California, San Diego, USA

12.00 – 12.50pm Panel Discussion led by:

Dr Niels Rosenquist, Massachusetts General Hospital

12.50 – 1.40pm Buffet Lunch(First floor, South Corridor Foyer)

Afternoon Session 1: “The Potential of Digital Technology for Assessing and Changing Behaviour”

(Small Meeting House)

1.40 – 2.20pm “Behavioural Intervention Technologies for Depression”

Professor David Mohr, Northwestern University, USA

2.20 – 3.00pm “My Smartphone told me I’m Stressed”

Professor Andrew Campbell, Dartmouth College, USA

3.00 – 3.40pm “UBhave: Addressing the question of how best to use phones to measure and change behaviour”

Professor Lucy Yardley, University of Southampton, UK

Dr Cecilia Mascolo, University of Cambridge, UK

3.40 – 4.10pm Coffee(First floor, South Corridor Foyer)

4.10 – 5.00pm Panel Discussion led by:

Professor Susan Michie, University College London, UK

5.00 – 5.30pm Close

Afternoon Session 2: “Challenges of User Led Innovation for Energy Technologies”

(First floor, Room 2)

1.30 – 5.30pm Led by Dr Alastair Buckley, University of Sheffield, UK

Innovation for the Internet: the need to engage all stakeholders

2012-05-15T08:19:00.002-07:00

Prof. Steve Uhlig & Dr. Hamed Haddadi, Queen Mary, University of London, UK.

Innovation for the Internet: the need to engage all stakeholders

ABSTRACT

The Internet is evolving at a significant pace due to new usage trends and platforms such as mobile devices, social media, streaming networks and content delivery platforms. Within the next EU framework, the researchers need to focus on the future trends, devices and usage habits and strategically align their research to support those needs. In this document, we propose a number of challenges, related to the new interactions between different stakeholders. We also discuss how today’s Internet ecosystem requires to revisit not only the functionalities of the network, but also to rethink the different business models that will shape the future Internet. We also suggest that the Societal relevance of the Internet should be more supported by the Horizon 2020 agenda, as well as encourage that future projects have wider and more specific public engagement and community reach plans, engaging all stakeholders such as user communities, industrial bodies, the research community, policy makers and the Internet governing bodies.

Motivation: Today’s changing Internet ecosystem

Today’s Internet [1] differs significantly from the one that is described in popular textbooks [2], [3], [4]. The early commercial Internet had a strongly hierarchical structure, with large transit Internet Service Providers (ISPs) providing global connectivity to a multitude of national and regional ISPs [5]. Most of the applications/content was delivered by client-server applications that were largely centralized. With the recent advent of large-scale content distribution networks (CDNs), e.g., Akamai, Youtube, Yahoo, Limelight, and One Click Hosters (OCHs), e.g., Rapidshare, MegaUpload, the way the Internet is structured and traffic is delivered has fundamentally changed [1].

Today, the key players in the application and content delivery ecosystem, e.g., Cloud providers, CDNs, OCHs, data-centers and content sharing websites such as Google and Facebook which often have direct peerings with Internet Service Providers or are co-located within ISPs. Application and content delivery providers rely on massively distributed architectures based on data centers to deliver their content to the users. Therefore, the Internet structure is not as strongly hierarchical as it used to be [1].

These fundamental changes in application and content delivery and Internet structure have deep implications on how the Internet will look like in the future. Hereafter, we describe how we believe that three different aspects of the Internet may lead to significant changes in the way we need to think about the forces that shape the flow of traffic in the Internet. Specifically, we first describe how central DNS has become as a focal point between application/content providers and ISPs. Next, we discuss how software-defined networking may change the ability of many stakeholders to influence the path that the traffic belonging to specific flows will follow across the network infrastructure. Finally, we discuss how the distributed nature of existing application and content delivery networks will, together with changes within the forwarding/routing, enable much more advanced handling of the traffic, on a much finer granularity compared to the current Internet.

Challenge 1: DNS and Server Redirection

The Domain Name System (DNS) was originally intended to provide a naming service, i.e., one-to-one mappings between a domain name and an IP address. Since then, DNS has evolved into a highly scalable system that fulfils the very stringent needs of applications in terms of its responsiveness [6,7,8]. Today, the DNS system is a commodity infrastructure that allows applications and content providers to map individual users to servers. This behaviour diverges from the original purpose of deploying DNS [10]. As application and content delivery infrastructures control how DNS is used to map end-users to their servers, the transport network, namely ISPs, has very limited control as to how traffic flows across the Internet [31]. Note that the case of DNS is a specific instance of a more general class of mapping systems for networked applications, such as trackers used in P2P or Locator/ID split approaches, e.g., LISP. Whatever the actual mapping system being used, the use of DNS by application/content providers is a sign that network-aware application optimization approaches are needed. P4P as well as Application-layer Traffic Optimization (ALTO) are possible solutions for this. Direct CDN-ISP collaboration is another way of ensuring that the application side and the network collaborate to provide the best possible service to the end-users in a cost-efficient manner [32].

Challenge 2: Software-defined networking

Applications and content are not the only place where an Internet (r)evolution is taking place. Thanks to a maturing market that is now close to “carrier grade” [13,14,15,16,17], the deployment of open source based routers has significantly increased during the last few years. While these devices are not competing with commercial high-end switches and routers available with respect to reliability, availability and density, they are fit to address specialized tasks within enterprise and ISP networks. Even PC-based routers with open source routing software are evolving fast enough to foresee their use outside research and academic environments [18,19,20].

The success of open-source routing software is being paralleled with increasing virtualization, not only on the server side, but also inside network devices. Server virtualization is now followed by network virtualization, which is made possible thanks to software-defined networking, e.g., OpenFlow [21] that expose the data path logic to the outside world. The model of network devices controlled by proprietary software tied to specific hardware will slowly but surely be made obsolete. Innovation within the network infrastructure will then be possible. A decade ago, IP packets were strictly following the paths decided by routing protocols. Tomorrow, together with the paths chosen by traditional routing protocols, a wide range of possibilities will arise to customize not only the path followed by specific traffic, but also the processing that this traffic undergoes. Indeed, specific actions that are statically performed today by specialized middleboxes placed inside the network, e.g., NAT, encryption, DPI, will be implemented on-path if processing capabilities happen to exist, otherwise the traffic will be dynamically redirected to close-by computational resources. This opens a wide range of applications that could be implemented almost anywhere inside the network infrastructure.

Fusing the transport network and applications/content

As content is moving closer to the end-user for improved quality of experience and the infrastructure opens up to unprecedented control and flexibility, the old business model of hierarchical providers and customer-provider relationships is hardly viable. Nowadays, delivering applications and content to end-users is becoming a less and less profitable business, except for the few able to capitalize on the revenues from advertising, e.g., Google, Facebook. On the other side, network infrastructure providers struggle to provide the necessary network bandwidth and low latency for these applications, at reasonable costs. The consequence of more and more limited ISP profit margins is a struggle between content providers and the network infrastructure to gain control of the traffic.

This struggle stems from fundamental differences in the business model of applications/content providers and ISPs. Today, application/content providers, for example through DNS tweaking, decide about the flow of the traffic by properly selecting the server from which a given user fetches some content [8,22,23]. This makes application/content delivery extremely dynamic and adaptive. On the ISP side, most of the traffic engineering relies on changing the routing configuration [24,25,26]. Tweaking existing routing protocols is not only dangerous, due to the danger of mis-configurations [27], routing instabilities [28] and convergence problems [29,30], but is simply not adequate to choose paths at the granularity of applications and content.

Industry and academia must join forces to address the challenges posed by the evolving Internet. We believe that the three research areas above need critical input from the community in order to enable a truly content-centric Internet. First, even after more than two decades of deployment and evolution, the DNS is still poorly understood. The DNS is much more than a naming system, it is a critical mapping system and a critical point in the application/content distribution arena. Second, software-defined networking opens a wide range of possibilities that would transform the current dumb pipes of the Internet core into a flexible and versatile infrastructure. Further, software-defined networking researchers has the ability to allow injecting intelligence inside the network without having to think about how it will affect a whole range of legacy protocols.

One way to go is to enable the different stakeholders to work together, e.g., enable ISPs to collaborate with application/content providers [31,32]. This can be achieved for example by exploiting the diversity in content location to ensure that ISP’s network engineering is not made obsolete by content provider decisions [31,32] or the other way around. Another option in which we believe is to leverage the flexibility in network virtualization and making their infrastructure much more adaptive than today’s static provisioning [33].

New Internet business models and privacy

The networks research community has been witnessing an explosive growth in the adoption of wireless devices such as smartphones and tablets. This new fertile market has been fueled by applications and games brought through multiple markets of third party developers. These markets today rely on “App Stores” provided and controlled by device or operating system manufacturers such as Apple or Google, now recently joined by Facebook. At the heart of this trade lies a particular revenue model: provide attractive content and applications, and in return benefit from a trusted ecosystem built from a large number of users. Majority of these ecosystems revolve around targetted advertising and use of personal information. Several recent proposals have been made by the networks and social computing research community, on enabling market places for personal information [34,35].

It has been suggested that personal data is the new currency on the Internet. This highlights the urgent need for understanding privacy issues, which requires engagement with policy makers and investing in new methods to create federated marketplaces for resources and data.

Engaging all stakeholders

The deep changes we discussed create unprecedented opportunities for industry and researchers to develop new solutions that will address not only relevant operational challenges, but also potentially business-critical ones. The ossification of the Internet protocols does not mean that the Internet is not evolving. The Internet has changed enormously over the last decade, and will continue to do so, no matter what. What we observe today is a convergence of applications/content and network infrastructure that questions a model of the Internet that used to separate two stakeholders: application/content infrastructures on the one side and a dumb transport network on the other.

The fundamental changes in the Internet lead to fundamental questions about the possible directions in which the Internet might be going, not only at a technical level, but also from a business perspective. These are Societal questions, that ask for answers for the sake of Internet governance and to ensure that the infrastructure is serving the purposes of the Society as a whole, not of a few business players. Emphasis must also be placed on engagement with users as the focal point of the ecosystem, not only business stakeholders.

Active Engagement with the European Community and Beyond

Traditionally, EU projects in the networking area have not been strongly urged to engage with the public, but focus their attention on the impact for European Industry. Given the Societal relevance of the Internet in supporting the Digital Economy, we encourage that future projects have wider and more specific public engagement and community reach plans, engaging user communities, industrial bodies, the research community, policy makers and the Internet governing bodies. This approach will encourage working beyond the usual outputs in the form of periodic reports and standard workshops that do not reach the relevant audience. Re-focusing the dissemination and impact criteria during project evaluation would incentivize projects to target long-term growth and innovation in Europe. We feel that today impact and dissemination play mostly a role at satisfying short-term industrial or business use-cases, which are heavily biased by industrial partners during review process of project proposals for impact.

Lastly, we encourage the inclusion of research and development organisations in China, India, Brazil and similar developing countries which are shaping the future of the network usage trends. Indeed, we now live in a globalized world, meaning that EU project should compete with their US and Chinese counterparts, both in terms of agenda but also in terms of their reach and impact.

[1] C. Labovitz, S. Lekel-Johnson, D. McPherson, J. Oberheide, and F. Jahanian, “Internet Inter-Domain Traffic,” in Proc. of ACM SIGCOMM, 2010.

[2] K. Claffy, H. Braun, and G. Polyzos, “Traffic Characteristics of the T1 NSFNET backbone,” in Proc. of IEEE INFOCOM, 1993.

[3] K. Thompson, G. Miller, and R. Wilder, “Wide-Area Internet Traffic Patterns and Characteristics,” IEEE Network Magazine, 11(6), November/December 1997.

[4] W. Fang and L. Peterson, “Inter-AS Traffic Patterns and their Implications,” in Proc. of IEEE Global Internet Symposium, 1999.

[5] L. Subramanian, S. Agarwal, J. Rexford, and R. Katz, “Characterizing the Internet Hierarchy from Multiple Vantage Points,” in Proc. of IEEE INFOCOM, 2002.

[6] B. Krishnamurthy, C. Wills, and Y. Zhang, “On the Use and Performance of Content Distribution Networks,” in Proc. of ACM IMW, 2001.

[7] R. Krishnan, H. Madhyastha, S. Srinivasan, S. Jain, A. Krishnamurthy, T. Anderson, and J. Gao, “Moving Beyond End-to-end Path Information to Optimize CDN Performance,” in Proc. of ACM Internet Measurement Conference, 2009.

[8] T. Leighton, “Improving Performance on the Internet,” Communications of the ACM, 52(2):44–51, 2009.

[9] J. Jung, E. Sit, H. Balakrishnan, and R. Morris, “DNS Performance and the Effectiveness of Caching,” IEEE/ACM Trans. Netw., 10(5):589–603, 2002.

[10] P. Vixie, “What DNS is Not,” Commun. of the ACM, vol. 52, no. 12, 2009.

[11] B. Ager, W. Muehlbauer, G. Smaragdakis, and S. Uhlig, “Comparing DNS Resolvers in the Wild,” in Proc. of ACM Internet Measurement Conference, 2010.

[12] C. Contavalli, W. van der Gaast, S. Leach, and D. Rodden, “Client IP Information in DNS requests,” IETF draft, work in progress, draftvandergaast-edns-client-ip-00.txt, Jan 2010.

[13] “Quagga Routing Suite,” http://www.quagga.net.

[14] M. Handley, O. Hodson, and E. Kohler, “XORP: an Open Platform for Network Research,” ACM Comp. Comm. Rev., vol. 33, no. 1, 2003.

[15] J. Edwards, “Enterprises Cut Costs with Open-source Routers,” http:

//www.computerworld.com/s/article/9133851, 2009.

[16] “IP Infusion ZebOS,” http://www.ipinfusion.com/.

[17] Arista Networks, “EOS: An Extensible Operating System,” www.aristanetworks.com/en/EOS, 2009.

[18] E. Kohler, R. Morris, B. Chen, J. Jannotti, and F. Kaashoek, “The Click Modular Router,” ACM Trans. Comput. Syst., 18(3):263– 297, August 2000.

[19] N. Egi, A. Greenhalgh, M. Handley, M. Hoerdt, F. Huici, and L. Mathy, “Towards High Performance Virtual Routers on Commodity Hardware,” in Proc. of ACM CoNEXT, 2008.

[20] M. Dobrescu, N. Egi, K. Argyraki, B. Chun, K. Fall, G. Iannaccone, A. Knies, M. Manesh, and S. Ratnasamy, “RouteBricks: Exploiting Parallelism to Scale Software Routers,” in Proc. of ACM SOSP, 2009.

[21] N. McKeown, T. Anderson, H. Balakrishnan, G. Parulkar, L. Peterson, J. Rexford, S. Shenker, and J. Turner, “OpenFlow: Enabling Innovation in Campus Networks,” ACM Comp. Comm. Rev., 2008.

[22] C. Huang, A. Wang, J. Li, and K. W. Ross, “Measuring and Evaluating Large-scale CDNs,” in Proc. of ACM Internet Measurement Conference, 2008. Paper withdrawn at Microsoft request.

[23] S. Triukose, Z. Al-Qudah, and M. Rabinovich, “Content Delivery Networks: Protection or Threat?” in Proc. of ESORICS, 2009.

[24] B. Fortz and M. Thorup, “Internet Traffic Engineering by Optimizing OSPF Weights,” in Proc. of IEEE INFOCOM, 2000.

[25] B. Fortz and M. Thorup, “Optimizing OSPF/IS-IS Weights in a Changing World,” IEEE Journal in Selected Areas in Communications, 20(4):756–767, 2002.

[26] Y. Wang, Z. Wang, and L. Zhang, “Internet Traffic Engineering Without Full Mesh Overlaying,” in Proc. of IEEE INFOCOM, 2001.

[27] R. Mahajan, D. Wetherall, and T. Anderson, “Understanding BGP Misconfigurations,” in Proc. of ACM SIGCOMM, 2002.

[28] C. Labovitz, G. R. Malan, and F. Jahanian, “Internet Routing Instability,” in Proc. of ACM SIGCOMM, 1997.

[29] T. Griffin and G. Wilfong, “An Analysis of BGP Convergence Properties,” in Proc. of ACM SIGCOMM, 1999.

[30] C. Labovitz, A. Ahuja, A. Bose, and F. Jahanian, “Delayed Internet Routing Convergence,” in Proc. of ACM SIGCOMM, 2000.

[32] Ingmar Poese, Benjamin Frank, Bernhard Ager, Georgios Smaragdakis, Steve Uhlig, Anja Feldmann, "Improving Content Delivery with PaDIS," IEEE Internet Computing, 16(3):46-52, May-June 2012.
[33] J. He, R. Zhang-Shen, Y. Li, C.-Y. Lee, J. Rexford, and M. Chiang, “DaVinci: Dynamically Adaptive Virtual Networks for a Customized Internet,” in Proc. of ACM CoNEXT, 2008.
[34] Hamed Haddadi, Richard Mortier, Steven Hand, Ian Brown, Eiko Yoneki, Derek McAuley and Jon Crowcroft: “Privacy Analytics”. ACM SIGCOMM Computer Communication Review, April 2012.
[35] Christina Aperjis and Bernardo A. Huberman. A Market for Unbiased Private Data: Paying Individuals According to their Privacy Attitudes. Available at http://dx.doi.org/10.2139/ssrn.2046861, April 2012.

PayPal and Ebay, offshore, lawless banking service ? privacy breach and data protection act

2011-11-14T07:06:00.000-08:00

While all the European markets are suffering, there are some businesses doing very well.. Paypal is one of them, ebay's banking arm, set up in luxembourg for tax evation purpose, sending money here and there and getting massive commissions and cuts also on ebay and many other services

they are so strong that they arrogantly refuse to provide you with your own record of the information they they have about you, simply because they are not a UK-based company so they don't have to abide by UK regulations..

the only way is not to use them!

Twitter no longer whitelisting researchers

2011-03-05T02:37:00.000-08:00

So this came as sad news for me, http://www.readwriteweb.com/archives/how_recent_changes_to_twitters_terms_of_service_mi.php?utm_source=feedburner&utm_medium=feed&utm_campaign=Feed%3A+readwriteweb+%28ReadWriteWeb%29&utm_content=Google+Reader
I believe Twitter is a great source for sociologists, psychologists, market researchers and etc.. and I am sad to hear this.. though yes there are privacy concerns about tweets that are later removed.. see the related tweets

@elsubliminal @realhamed Yes I thought the same this morning. It's very old stuff, last year or so...only the whitelisting thing.

mircomusolesi Mirco Musolesi

@realhamed Also: you can still redistribute content but not in order to "substitute" Twitter. Otherwise Twitter clients should be illegal :)

mircomusolesi Mirco Musolesi

@realhamed They were not able to share them also before or better they had to support deletions (they had to mirror Twitter...impossible).

elsubliminal Vijay Erramilli

@realhamed Ok learnt from a source in Twitter - the article has tons of errors. Nothing has changed except whitelisting.

mircomusolesi Mirco Musolesi

@realhamed But I agree that the removal of the whitelist might be a problem for collecting large datasets...

mircomusolesi Mirco Musolesi

@realhamed These are not new changes. They were made last year as far as I know. Not major changes anyway - dev.twitter.com/pages/api_terms

Suksant Suksant Sae Lor

@realhamed well, we're using twitter to complain about twitter's policy lol sorry twitter, but ur data can be very useful!

Suksant Suksant Sae Lor

@realhamed and will MPI comply? Just curious...

Suksant Suksant Sae Lor

@realhamed thank you Hamed : ) this is ashamed since the crawled data is so useful... I'm sure they will make it into business somehow : (

tnhh Tristan Henderson

@realhamed Rubbish! Just because I am willing to make data public for one purpose doesn't mean you can use them. See @zephoria's WWW talk.

Suksant Suksant Sae Lor

@realhamed I'm referring to the change of twitter policy that prevent crawling... Thank you : )

Suksant Suksant Sae Lor

@realhamed could u pls kindly give me a link to the source? I couldn't find it... Thank you Hamed.

guppiefish guppiefish

@realhamed Guess we need a Tweet federation protocol (even if Twitter resist :)

tnhh Tristan Henderson

@realhamed identi.ca? I still maintain that crawling the OSNs without users' consent is on dodgy ethical ground though.

guppiefish guppiefish

@realhamed http://www.opensourcetweet.com/

elsubliminal Vijay Erramilli

@realhamed Worse is prohibiting data already crawled.. This is problematic indeed..

realhamed hamed haddadi

@mircomusolesi so now we have a few institutions who have the data for few years, but they cant share it! it is a difficult situation

realhamed hamed haddadi

@Suksant not sure what the source is.. though Twitter has also emailed MPI asking them not to share the data we previously collected !

realhamed hamed haddadi

@tnhh @zephoria maybe! I still go 4 open model :) twitter is not doing this 4public sake anyway I guess. prob 4 prevention of legal battles.

realhamed hamed haddadi

@tnhh I think facebook maybe, but twitter.. if u r publicly & globally announcing something. u shoudl be prepared 4 it 2 stay with u forever

realhamed hamed haddadi

@guppiefish ah.. genius.. why hasn't this taken off yet then!.. maybe the uncool name? why didn't they drop the "source" from the name!

realhamed hamed haddadi

so.. seems like we need an open version of twitter.. opentweet..., like wikipedia.. no ads, decentralized and publicly accessible..

realhamed hamed haddadi

@elsubliminal yeah i wonder if they'll ask MPI/KAIST to remove the datasets.. we already actually have 1-2 papers under review too

realhamed hamed haddadi

WOW.. Twitetr changes policy and no longer allows crawls .. what a shame for social science research

ignore the consumer, and you are dead!

2010-10-21T15:52:00.000-07:00

I worked 2 summers in Sony Europe, and I never remember having heard the term "consumer demands" or "customer requirements" maybe because I was too low in the programming/design hierarchy, or I was just a summer intern, or it was said just by the japanese.. but today I found out the reason why Sony Vaio, that was was the herald of laptops and laptop of choice for the last decade, is now a failure and virtually ignored brand in the market.. with individuals, it has been replaced by Apple's range of macbooks, and in organizations, it has lost the battle to Dell and IBM (now Lenovo) thinkpads

last year, when my hard drive on my macbook started misbehaving, I went to apple store and without any questions it was replaced, sane thing happened to the iPhone that I had actually bought second hand on ebay, it was replaced free of charge when the control button broke.. result, I buy more macs!

despite my discouragements, my dad decided to buy a Vaio laptop (because 20 years ago the name Sony was associated with quality), so he paid about £500 for a Vaio laptop (bought from MAKRO superstores) which could hardly match a £350 Acer/Lenovo...

few days later when this gift finally got to my sister, we found the screen to be cracked with dead pixels.. clearly Makro took no responsibility and gave us an 0870 number for Sony customer support.. Sony customer support told us that they can accept a repair service only if we post them the laptop, and we are responsible for all the repair costs.. However, they could not give us any estimate for the repair cost, because an engineer had to look at the laptop.. although I could clearly tell them the the LCD had a crack in the box, and in such corner (which would naturally require the whole monitor to be replaced), however they still refused to give a quotation for the repair costs... more interesting, if upon inspection, we are not happy to go ahead and pay the estimated repair cost, we are still liable for £50 admin fee!

Sony may not be getting any repair money from me in this case, they may think that we have lost few hundred pounds.. but in the age of social media and recommendations and social networks, it is ultimately the consumer which gets the best deal.. perhaps it is obvious why we don't see anymore Vaio's in universities and corporations, and home users love macbooks (posh) and EEEPCs (practical and cheap)...

Web science: A new frontier

2010-09-28T01:17:00.000-07:00

so this two day meeting at royal society brought together a range of different people across the whole web social ecosystem, videos and tweet feeds here:

so yesterday and today i have been at
http://royalsociety.org/Web-science-a-new-frontier/

you can watch the talks online too i believe... but dont necessarily
watch the barabasi one, too boring he covered his 99 and 2000 papers
on power laws etc

there was some engineering talks (ipv6 and etc) and semantic web which
I didn't pay enough attention, so I focus on social networks ones)

overall, it was great, seems like people are now thinking what we

thought with Mia this time last year, how do we use social network data to

- Show quoted text -

answer long standing questions in social networks and how is the web
affecting the .. Kleinberg picked up exactly on that.. how do we see
what threshold (number of friends doing an action) is required for
people to adopt an idea (join a group on live journal, edit
wikipedia), so this is exactly what we started to touch on on the
twitter data but didn't actually get to follow up on.. I think it will
be amazing to test this in different contexts, start tweeting about
iphone, start spreading URLs and etc, there is definitely room for
exploring on that

there was also a relatively ok talk about social recommendation from
anne-marie kermarrec , it turns out that the large or small number of
usrs can both be bad for recommendation so they focus on distribution
of interests of a person with different size of user groups , some
interesting discussions of positive and negative sides of this
approach on twitter http://twitter.com/#search?q=%23RSwebsci

the notion of collective intelligence and decision making seemed to
also be very strong, but no one knows how to quantify it... on twitter
this would be amazing (maybe better in slashdot?!) but obviously Levy
would insist on that a bit too much! but he has this idea of having
semantic URL (USL = Universal Semantic Locator ) to enable extraction
of collective intelligence etc (philosophy!) but a neat idea
http://pierrelevy.posterous.com/

then manuel castells on socialnets in the net: media has given bad
image to web as they just report on bad/negative news (their nature),
but he thinks we are more social today since we have more practice for

sociability online and offline, he believes the internet enables people to

pursue happiness easier hence strong presence of less powerful
people... so inernet use has led to more autonomy, sociability and
happiness (based on their survey)..

Ramesh Jain gave a decent talk on twitter and events, and why the
real time web is so important as it captures the events in life.. so
camera publishes to flickr/tweeter directly with location info.. the
location can also help with event detection and speed of propagation
of events, so you can for example detect activity rates of say swine
flu or demonstrations.. so a kind of heat plot if you can imagine...

finally tim berners-lee talking about social cloud and storage
(dbpedia for example) .. he mentions a big issue with social networks
being so "walled" so sharing things across is difficult. so better to
have webpages and URLs??!! also issues with privacy and control of
data (for example download all data).. overall not sure what he
wanted.. overall interesting though

Productivity at work

2010-09-01T16:19:00.000-07:00

I enjoyed reading this http://matt.might.net/articles/productivity-tips-hints-hacks-tricks-for-grad-students-academics/

I think productivity is severly affected by trying to do too many projects, just as bad as by focusing only one a single task for a period longer than half a day.. a bit of writing or analysis while writing code for another simulation or measurement always helps, and even reviewing can be joyful when interlaced properly with related work.. anyway, have a read and see what you think.. it even mentions "Optimize transaction costs" !

Net Neutrality And Wireless Providers

2010-08-16T12:02:00.003-07:00

so recently there has been a heated debate on the wireless provider’s attempts on delaying the net neutrality debate (seehttp://googlepublicpolicy.blogspot.com/2010/08/joint-policy-proposal-for-open-internet.html )

I was surprised to find out today that Three UK does not let you navigate towww.jailbreakme.com website on iphone.. although it is a perfectly legal to jailbreak an iphone ( http://www.cnet.com/8301-17918_1-20011824-85.html )

My phone in unbranded and unlocked, but if you buy a phone from Three UK, you can’t use it for internet tethering.. by jailbreaking (which is legal) you CAN tether the phone using some apps. so it may prevent many who pay for extra 3G dongles and etc from doing so since they can just use their phones.

the issue is that they are preventing you from accessing a standard website that may have content/programs/capabilities that simply reduces Mr Hutchinson’s profits… this is a good example why Verizon does not want the net neutrality debate to start leaking into their wireless empire too?

Life Metrics !

2010-08-16T12:02:00.001-07:00

I recently read this amazing article on HBR on assessing the quality of life, and I was relieved to see that there are still high ranking academics who actually consider things like family, faith and personal time more important than the never ending deadlines, papers, reviews and etc:

http://hbr.org/2010/07/how-will-you-measure-your-life/ar/1

In my understanding, life is only measured “externally” by career success.. however ultimately it’s one’s inner comfort and satisfaction that determines the true quality of one’s life… that is perhaps one reason that countries with highest quality of life also have such high suicide rates!

anyway, I certainly recommend reading this article!