36C3 preroll music Herald: It is my honor to introduce you today to Eva and Chris. Eva, she is a senior researcher at Privacy International. She works on gender, economical and social rights and how they interplay with the right to privacy, especially in marginalized communities. Chris, she is the privacy lead at technology lead at Privacy International. And his day-to-day job is to expose company and how they profit from individuals and specifically today they will tell us how these companies can even profit from your menstruations. Thank you. Chris: Thank you. applause C: Hi, everyone. It's nice to be back at CCC. I was at CCC last year. If you heard my talk from last year, this is going to be like a slightly vague part 2. And if you're not, I'm just gonna give you a very brief recap because there is a relationship between the two. So, I will give you a little bit of background about how this project started. Then we get to a little bit about menstruation apps and what a menstruation app actually is. Let me talk a little bit through some of the data that these these apps are collecting and talk how we did our research, our research methodology and then what our findings are and our conclusions. So last year, I and a colleague did a project around how Facebook collects data about users on Android devices using the Android Facebook SDK. And this is whether you have a Facebook account or not. And for that project, we really looked when you first opened apps and didn't really have to do very much interaction with them particularily, about the automatic sending of data in a post GDPR context. And so we looked a load of apps for that project, including a couple of period trackers. And that kind of led onto this project because we were seeing loads of apps, across different areas of categories. So we thought we'd like hone in a little bit on period trackers to see what kind of data, because they're by far more sensitive than many of the other apps on there, like you might consider your music history to be very sensitive.... laughs So. Yeah. So, just a quick update on the previous work from last year. We actually followed up with all of the companies from that, from that report. And by the end of like going through multiple rounds of response, over 60 percent of them a changed practices either by disabling the Facebook SDK in their app or by disabling it until you gave consent or removing it entirely. So I pass over to Eva Blum-Dumontet. She's going to talk you through menstruation apps. Eva: So I just want to make sure that we're all on the same page. Although if you didn't know what a menstruation app is and you still bothered coming to this talk, I'm extremely grateful. So how many of you are are using a menstruation app or have a partner, who's been using a menstruation app? Oh my God. Oh, okay. I didn't expect that. I thought it was going to be much less. Okay. Well, for the few of you who still might not know what a menstruation app is, I'm still going to go quickly through what a menstruation app is. It's the idea of a menstruation app. We also call them period tracker. It's to have an app that tracks your menstruation cycle. So that they tell you what days you're most fertile. And you can obviously, if you're using them to try and get pregnant or if you have, for example, a painful period, you can sort of plan accordingly. So that's essentially the main 2 reasons users would be would be looking into using menstruation apps: pregnancy, period tracking. Now, how did this research starts? As Chris said, obviously there was whole research that had been done by Privacy International last year on various apps. And as Chris also already said what I was particularly interested in was the kind of data that menstruation apps are collecting, because as we'll explain in this talk, it's really actually not just limited to menstruation cycle. And so I was interested in seeing what actually happens to the data when it is being shared. So I should say we're really standing on the shoulders of giants when it comes to this research. There was previously existing research on menstruation apps that was done by a partner organization, Coding Rights in Brazil. So they had done research on the kind of data that was collected by menstruation apps and the granularity of this data. Yet, a very interesting thing that we're looking at was the gender normativity of those apps. Chris and I have been looking at, you know, dozens of these apps and, you know, they have various data showing practices, as we'll explain in the stock. But they have one thing that all of them have in common is that they are all pink. The other thing is that they talk to their users as woman. They, you know, don't want sort of even compute the fact that maybe not all their users are woman. So there is a very sort of like narrow perspective of pregnancy and females' bodies and how does female sexuality function. Now, as I was saying, when you're using a menstruation app, it's not just your menstruation cycle that you're entering. So this is some of the questions that menstruation apps ask: So sex; There is a lot about sex that they want to know? How often, is it protected or unprotected? Are you smoking? Are you drinking? Are you partying? How often? We even had one app that was asking about masturbation, your sleeping pattern, your coffee drinking habits. One thing that's really interesting is that - and we'll talk a little bit more again about this later - but there's very strong data protection laws in Europe called GDPR as most of you will know. And it says that only data that's strictly necessary should be collected. So I'm still unclear what masturbation has to do with tracking your menstruation cycle, but... Other thing that was collected is about your health and the reason health is so important is also related to data protection laws because when you're collecting health data, you need to show that you're taking an extra step to collect this data because it's considered sensitive personal data. So extra steps in terms of getting explicit consent from the users but also through steps on behalf of the data controller, in terms of showing that they're making extra steps for the security of this data. So this is the type of question that was asked. There is so much asked about vaginal discharge and what kind of vaginal discharge you get with all sorts of weird adjectives for this: "Tiki, creamy". So yeah, they clearly thought a lot about this. And it is a lot about mood as well. Even, yeah, I didn't know 'romantic' was a mood but apparently it is. And what's interesting obviously about mood in the context where, you know, we've seen stories like Cambridge Analytica, for example. So we know how much companies, we know how much political parties are trying to understand how we think, how we feel. So that's actually quite significant that you have an app that's collecting information about how we feel on a daily basis. And obviously, like when people enter all these data, their expectation at that point is that the data stays between between them and the app. And actually, there is very little in the privacy policy that could that would normally suggest that it was. So this is the moment where I actually should say we're not making this up; like literally everything in this list of questions were things, literal terms, that they were asking. So we set out to look at the most popular menstruation apps. Do you want to carry on? Chris: Yeah. I forgot to introduce myself as well. Really? That's a terrible speaking habit. Eva: Christopher Weatherhead.. Chris: .. Privacy International's technology lead. So yeah.. What I said about our previous research, we have actually looked at most of the very popular menstruation apps, the ones that have hundreds of thousands of downloads. And these apps - like as we're saying that this kind of work has been done before. A lot of these apps that come into quite a lot of criticism, I'd spare you the free advertising about which ones particularly but most of them don't do anything particularly outrageous, at least between the app and the developers' servers. A lot of them don't share with third parties at that stage. So you can't look between the app and the server to see what they're sharing. They might be sharing data from the developers' server to Facebook or to other places but at least you can't see in-between. But we're an international organization and we work around the globe. And most of the apps that get the most downloads are particularly Western, U.S., European but they're not the most popular apps necessarily in a context like India and the Philippines and Latin America. So we thought we'd have a look and see those Apps. They're all available in Europe but they're not necessarily the most popular in Europe. And this is where things started getting interesting. So what exactly did we do? Well, we started off by triaging through a large number of period trackers. And as Eva said earlier: every logo must be pink. And we were just kind of looking through to see how many trackers - this is using extras (?) privacy. We have our own instance in PI and we just looked through to see how many trackers and who the trackers were. So, for example, this is Maya, which is exceptionally popular in India, predominantly - it's made by an Indian company. And as you can see, it's got a large number of trackers in it: a CleverTap, Facebook, Flurry, Google and Inmobi? So we went through this process and this allowed us to cut down... There's hundreds of period trackers. Not all of them are necessarily bad but it's nice to try to see which ones had the most trackers, where they were used and try and just triage them a little bit. From this, we then run through PI's interception environment, which is a VM that I've made. I actually made it last year for the talk I gave last year. And I said I'd release it after the talk and took me like three months to release it but it's now available. You can go onto PI's website and download it. It's a man in the middle proxy with a few settings - mainly for looking at iOS and Android apps to do data interception between them. And so we run through that and we got to have a look at all the data that's being sent to and from both the app developer and third parties. And here's what we found. Eva: So out of the six apps we looked out, five shared data with Facebook. Out of those five, three pinged Facebook to let them know when their users were downloading the app and opening the app. And that's already quite significant information and we'll get to that later. Now, what's actually interesting and the focus of a report was on the two apps that shared every single piece of information that their users entered with Facebook and other third parties. So just to brief you: the two apps we focused on are both called Maya. So that's all very helpful. One is spelled Maya: M-a-y-a. The other ones spellt Mia M-I-A. So, yeah, just bear with me because this is actually quite confusing. But so initially we'll focus on Maya, which is - as Chris mentioned - an app that's based in India. There have a user base of several millions. Their are based in India. Userbase, mostly in India, also quite popular in the Philippines. So what's interesting with Maya is that they start sharing data with Facebook before you even get you agree to their privacy policy. So I should say already about the privacy policy of a lot of those apps that we looked at is that they are literally the definition of small prints. It's very hard to read. It's legalese language. It really puts into perspective the whole question of consent in GDPR because GDPR says like the consents must be informed. So you must be able to understand what you're consenting to. When you're reading this extremely long, extremely opaque privacy policies of a lot - literally all the menstruation apps we've looked at, excluding one that didn't even bother putting their privacy policy, actually. It's opaque. It's very hard to understand and - absolutely, definitely, do not say that they're sharing information with Facebook. As I said, data sharing happened before you get to agree to their privacy policy. The other thing that's also worth remembering is that when to share information with Facebook - doesn't matter if you have a Facebook account or not, the information still being relayed. The other interesting thing that you'll notice as well in several of the slides is that the information that's being shared is tied to your identity through your unique ID identifiers, also your email address. But basically most of the questions we got when we released the research was like: oh, if I use a fake email address or if I use a fake name, is that OK? Well, it's not because even if you have a Facebook account through your unique identifier, they would definitely be able to trace you backs. There is no way to actually anonymize this process unless - well at the end, unless you deliberately trying to trick it and use a separate phone basically for regular users. It's quite difficult. So this is what it looks like when you enter the data. So as I said, I didn't lie to you. This is the kind of questions they're asking you. And this is what it looks like when it's being shared with Facebook. So you see the symptomes changing, for example, like blood pressure, swelling, acne, that's all being shipped through craft out Facebook, through the Facebook SDK. This is what it looks like when they show you contraceptive practice, so again, like we're talking health data. Here we're talking sensitive data. We're talking about data that shouldn't normally require extra steps in terms of collecting it, in terms of how it's being processed. But nope, in this case it was shared exactly like the rest. This's what it looks like. Well, so, yeah with sex life it was a little bit different. So that's what it looks like when they're asking you about, you know, you just had sex, was it protected? Was it unprotected? The way it was shared with Facebook was a little bit cryptic, so to speak. So if you have protected sex, it was entered as love "2", unprotected sex was entered as Love "3". I managed to figure that out pretty quickly. So it's not so cryptic. That's also quite funny. So Maya had a diary section where they encourage people to enter like their notes and your personal faults. And I mean, it's a menstruation app so you can sort of get the idea of what people are going to be writing down in there or expected to write on. It's not going to be their shopping list, although shopping lists could also be personal, sensitive, personal information, but.. So we were wondering what would happen if you were to write in this in this diary and how this data would be processed. So we entered literally we entered something very sensitive, entered here. This is what we wrote. And literally everything we wrote was shared with Facebook. Maya also shared your health data, not just with Facebook, but with a company called CleverTap that's based in California. So what's CleverTap? CleverTap is a data broker, basically. It's a company that - sort of similar to Facebook with the Facebook SDK. They expect of developers to hand over the data and in exchange app developers get insights about like how people use the app, what time of day. You know, the age of their users. They get all sorts of information and analytics out of the data they share with this company. It took us some time to figure it out because it shared as wicked wizard? Chris: Wicket Rocket. Eva: Wicket Rocket, yeah. But that's exactly the same. Everything that was shared with Facebook was also shared with CleverTap again, with the email address that we were using - everything. Let's shift. Now, let's look at the other Mia. It's not just the name that's similar, it's also the data showing practices. Mia is based in Cypress, so in European Union. I should say, in all cases, regardless of where the company is based, the moment that they market the product in European Union, so like literally every app we looked at, they need to - well they should respect GDPR. Our European data protection law. Now, the first thing that Mia asked when you started the app and again - I'll get to that later about the significance of this - is why you're using the app or you using it to try and get pregnant or are you just using it to try to track your periods? Now, it's interesting because it doesn't change at all the way you interact with the app eventually. The apps stays exactly the same. But this is actually the most important kind of data. This is literally called the germ of data collection. It's trying to know when a woman is trying to get pregnant or not. So the reason this is the first question they ask is, well my guess on this is - they want to make sure that like even if you don't actually use the app that's at least that much information they can collect about you. And so this information was shared immediately with Facebook and with AppsFlyer. AppsFlyer is very similar to CleverTap in the way it works. It's also a company that collects data from these apps and that as services in terms of analytics and insights into user behavior. It's based in Israel. So this is what it looks like when you enter the information. Yeah, masturbation, pill. What kind of pill you're taking, your lifestyle habits. Now where it's slightly different is that the information doesn't immediately get shared with Facebook but based on the information you enter, you get articles that are tailored for you. So, for example, like when you select masturbation, you will get, you know, masturbation: what you want to know but are ashamed to ask. Now, what's eventually shared with Facebook is actually the kind of article that's being offered to you. So basically, yes, the information is shared indirectly because then you know you have Facebook and... You've just entered masturbation because you're getting an article about masturbation. So this is what happened when you enter alcohol. So expected effects of alcohol on a woman's body. That's what happened when you enter "unprotected sex". So effectively, all the information is still shared just indirectly through the articles you're getting. Yeah. Last thing also, I should say on this, in terms of the articles that you're getting, is that sometimes there was sort of also kind of like crossing the data.. was like.. so the articles will be about like: oh, you have cramps outside of your periods, for example, like during your fertile phase. And so you will get the article specifically for this and the information that's shared with Facebook and with AppsFlyer is that this person is in their fertile period in this phase of their cycles and having cramps. Now, why are menstruation apps so obsessed with finding out if you're trying to get pregnant? And so, this goes back to a lot of the things I mentioned before that, you know, about wanting to know in the very first place if you're trying to get pregnant or not. And also, this is probably why a lot of those apps are trying to really nail down in their language and discourse how you're using the apps for. When a person is pregnant, they're purchasing habit, their consumer habits change. Obviously, you know, you buy not only for yourself but you start buying for others as well. But also you're buying new things you've never purchased before. So what a regular person will be quite difficult to change her purchasing habit was a person that's pregnant. They'll be advertisers will be really keen to target them because this is a point of their life where their habits change and where they can be more easily influenced one way or another. So in other words, it's pink advertising time. In other more words and pictures, there's research done in 2014 in the US that was trying to sort of evaluate the value of data for a person. So an average American person that's not pregnant was 10 cents. A person who's pregnant would be one dollar fifty. So you may have noticed we using the past tense when we talked about - well I hope I did when I was speaking definitely into the lights at least - we used the past tense when we talk about data sharing of these apps. That's because both Maya and MIA, which were the two apps we were really targeting with this report, stop using the Facebook SDK when we wrote to them about our research before we published it. applause So it was quite nice because he didn't even like rely on actually us publishing the report. It was merely at a stage of like, hey, this is all right of response. We're gonna be publishing this. Do you have anything to say about this? And essentially what they had to say is like: "Yep, sorry, apologies. We are stopping this." I think, you know.. What's really interesting as well to me about like the how quick the response was is.. it really shows how this is not a vital service for them. This is a plus. This is something that's a useful tool. But the fact that they immediately could just stop using it, I think really shows that, you know, it was.. I wouldn't see a lazy practice, but it's a case of light. As long as no one's complaining, then you are going to carry on using it. And I think that was also the discourse with your research. There was also a lot that changed their behaviors after. Chris: A lot of the developers sometimes don't even realize necessarily what data they're up to sharing with people like Facebook, with people like CleverTap. They just integrate the SDK and hope for the best. Eva: We also got this interesting response from AppsFlyer is that it's very hypocritical. Essentially, what they're saying is like oh, like we specifically ask our customers or oh, yeah, do not share health data with us specifically for the reason I mentioned earlier, which is what? Because of GDPR, you're normally expected to take extra step when you process sensitive health data. So their response is that they as their customer to not share health data or sensitive personal data so they don't become liable in terms of the law. So they were like, oh, we're sorry, like this is a breach of contract. Now, the reason is very hypocritical is that obviously when you have contracts with menstruation apps and actually Maya was not the only menstruation apps that we're working with. I mean, you know, what can you generally expect in terms of the kind of data you're gonna receive? So here's a conclusion for us that research works. It's fun, it's easy to do. You know, Chris has not published the environment. It doesn't actually - once the environment is sort of set up it doesn't actually require technical background, as you saw from the slides it's pretty straightforward to actually understand how the data is being shared. So you should do it, too. But more broadly, we think it's really important to do more research, not just at this stage of the process, but generally about the security and the data and the data showing practices of apps, because, you know, it's hard law and more and more people are using or interacting with technology and using the Internet. So we need to do think much more carefully about the security implication of the apps we use and obviously it works. Thank you. applause Herald: Thank you. So, yeah, please line up in front of the microphones. We can start with microphone two. Mic 2: Hi. Thank you. So you mentioned that now we can check whether our data is being shared with third parties on the path between the user and the developer. But we cannot know for all the other apps and for these, what if it's not being shared later from the developer, from the company to other companies. Have you conceptualize some ways of testing that? Is it possible? Chris: Yes. So you could do it, data separate access request and the GDPR that would... like the problem is it's quite hard to necessarily know. How the process - how the system outside of the app to serve relationship is quite hard to know the processes of that data and so it is quite opaque. They might apply a different identifier too, they might do other manipulations to that data so trying to track down and prove this bit of data belong to you. It's quite challenging. Eva: This is something we're going to try. We're going to be doing in 2020, actually. We're going to be doing data subject access request of those apps that we've been looking up to see if we find anything both under GDPR but also under different data protection laws in different countries. To see basically what we get, how much we can obtain from that. Herald: So I'd go with the signal angle. Signal: So what advice can you give us on how we can make people understand that from a privacy perspective, it's better to use pen and paper instead of entering sensitive data into any of these apps? Eva: I definitely wouldn't advise that. I wouldn't advise pen and paper. I think for us like really the key... The work we are doing is not actually targeting users. It's targeting companies. We think it's companies that really need to do better. We're often ask about, you know, advice to customers or advice to users and consumers. But what I think and what we've been telling companies as well is that, you know, their users trust you and they have the right to trust you. They also have the right to expect that you're respecting the law. The European Union has a very ambitious legislation when it comes to privacy with GDPR. And so the least they can expect is that you're respecting the law. And so, no, I would ... and this is the thing, I think people have the right to use those apps, they have the right to say, well, this is a useful service for me. It's really companies that need you. They need to up their game. They need to live up to the expectations of their consumers. Not the other way around. Herald: Microphone 1. Mic 1: Hi. So from the talk, it seems and I think that's what you get, you mostly focused on Android based apps. Can you maybe comment on what the situation is with iOS? Is there any technical difficulty or is it anything completely different with respect to these apps and apps in general? Chris: There's not really a technical difficulty like the setup a little bit different, but functionally you can look at the same kind of data. The focus here, though, is also.. So it's two-fold in some respects. Most of the places that these apps are used are heavily dominated Android territories, places like India, the Philippines. iOS penetration there, uh, Apple device penetration there is very low. There's no technical reason not to look at Apple devices. But like in this particular context, it's not necessarily hugely relevant. So does that answer your question? Mic 1: And technically with youre set-up, you could also do the same analysis with an iOS device? Chris: Yeah. As I said it's a little bit of a change to how you... You have to register the device as an MDM dev.. like a mobile profile device. Otherwise you can do the exact same level of interception. Mic: Uh, hi. My question is actually related to the last question is a little bit technical. Chris: Sure. Mic: I'm also doing some research on apps and I've noticed with the newest versions of Android that they're making more difficult to install custom certificates to have this pass- through and check what the apps are actually communicating to their home servers. Have you find a way to make this easier? Chris: Yes. So we actually hit the same issue as you in some respects. So the installing of custom certificates was not really an obstacle because you can add to the user if it's a rich device, you can add them to the system store and they are trusted by all the apps on the device. The problem we're now hitting is the Android 9 and 10 have TLS 1.3 and TLS 1.3 to text as a man in the middle or at least it tries to might terminate the connection. Uh, this is a bit of a problem. So currently all our research is still running on Android 8.1 devices. This isn't going to be sustainable long term. Herald: Um, 4. Mic 4: Hey, thank you for the great talk. Your research is obviously targeted in a constructive, critical way towards companies that are making apps surrounding menstrual research. Did you learn anything from this context that you would want to pass on to people who research this area more generally? I'm thinking, for example, of Paramount Corp in the US, who've done micro dosing research on LSD and are starting a breakout study on menstrual issues. Eva: Well, I think this is why I was concluded on it. I think there is a there's still a lot of research that needs to be done in terms of the sharing. And obviously, I think anything that touches on people's health is a key priority because it's something people relate very strongly to. The consequences, especially in the US, for example, of sharing health data like this, of having - you know - data, even like your blood pressure and so on. Like what are the consequences if those informations are gonna be shared, for example, with like insurance companies and so on. This is what I think is absolutely essential to have a better understanding of the data collection and sharing practices of the services. The moments when you have health data that's being involved. Chris: .. yeah because we often focus about this being an advertising issue. But in that sense as well, insurance and even credit referencing of all sorts of other things become problematic, especially when it comes to pregnancy related. Eva: Yeah, even employers could be after this kind of information. Herald: Six. Mic 6: Hi. I'm wondering if there is an easy way or a tool which we can use to detect if apps are using our data or are reporting them to Facebook or whatever. Or if we can even use those apps but block this data from being reported to Facebook. Chris: Yes. So, you can file all of faith graft on Facebook.com and stop sending data to that. There's a few issues here. Firstly, it doesn't really like.. This audience can do this. Most users don't have the technical nuance to know what needs to be blocked, what doesn't necessarily need to be blocked. It's on the companies to be careful with users data. It's not up to the users to try and defend against.. It shouldn't be on the use to defend against malicious data sharing or... Eva: You know... also one interesting thing is that if Facebook had put this in place of light where you could opt out from data sharing with the apps you're using, but that only works if you're a Facebook user. And as I said, like this data has been collected whether you are a user or not. So in a sense, for people who aren't Facebook users, they couldn't opt out of this. Chris: The Facebook SDK the developers are integrating the default state for sharing of data is on, the flag is true. And although they have a long legal text on the help pages for the developer tools, it's like unless you have a decent understanding of local data protection practice or local protection law. It's like it's not it's not something that most developers are gonna be able to understand why this flag should be something different from on. You know there's loads of flags in the SDK, which flags should be on and off, depending on which jurisdiction you're selling to, or users going to be in. Herald: Signal Angel, again. Singal: Do you know any good apps which don't share data and are privacy friendly? Probably even one that is open source. Eva: So, I mean, as in the problem which is why I wouldn't want to vouch for any app is that even in the apps that, you know, where in terms of like the traffic analysis we've done, we didn't see any any data sharing. As Chris was explaining, the data can be shared at a later stage and it'd be impossible for us to really find out. So.. no, I can't be vouching for any app. I don't know if you can... Chris: The problem is we can't ever look like one specific moment in time to see whether data is being shared, unlike what was good today might bad tomorrow. What was bad yesterday might be good today. Although, I was in Argentina recently speaking to a group of feminist activists, and they have been developing a menstruation tracking app. And the app was removed from the Google Play store because it had illustrations that were deemed pornographic. But they were illustrations around medical related stuff. So even people, who were trying to do the right thing, going through the open source channels are still fighting a completely different issue when it comes to menstruation tracking. It's a very fine line. Herald: Um, three. inaudible Eva: Sorry, can't hear -the Mic's not working. Herald: Microphone three. Mic 3: Test. Eva: Yeah, it's great - perfect. Mic 3: I was wondering if the graph API endpoint was actually in place to trick menstruation data or is it more like a general purpose advertisement tracking thing or. Yeah. Chris: So my understanding is that there's two broad kinds of data that Facebook gets as automated app events that Facebook were aware of. So app open, app close, app install, relinking. Relinking is quite an important one for Facebook. That way they check to see whether you already have a Facebook account logged in to log the app to your Facebook account when standing. There's also a load of custom events that the app developers can put in. There is then collated back to a data set - I would imagine on the other side. So when it comes to things like whether it's nausea or some of the other health issues, it is actually being cross-referenced by the developer. Does that answer your question? Mic 3: Yes, thank you. Herald: Five, microphone five. Mic 5: Can you repeat what you said in the beginning about the menstruation apps used in Europe, especially Clue and the Period Tracker? Yeah. So those are the most popular apps actually across the world, not just in Europe and the US. A lot of them in terms of like the traffic analysis stage, a lot of them have not clean up their app. So we can't see any any data sharing happening at that stage. But as I said, I can't be vouching for them and saying, oh, yeah, those are safe and fine to use because we don't know what's actually happening to the data once it's been collected by the app. All we can say is that as far as the research we've done goes, we didn't see any data being shed Chris: Those apps you mentioned have been investigated by The Wall Street Journal and The New York Times relatively recently. So they've been.. had quite like a spotlight on them. So they've had to really up their game and a lot of ways which we would like everyone to do. But as Eva says, we don't know what else they might be doing with that data on their side, not necessarily between the phone and the server but from their server to another server. Herald: Microphone one. Mic 1: Hi. Thank you for the insightful talk. I have a question that goes in a similar direction. Do you know whether or not these apps, even if they adhere to GDPR rules collect the data to then at a later point at least sell it to the highest bidder? Because a lot of them are free to use. And I wonder what is their main goal besides that? Eva: I mean, the advertisement his how they make profit. And so, I mean, the whole question about them trying to know if you're pregnant or not is that this information can eventually be - you know - be monetized through, you know, through how they target the advertisement at you. Actually when you're using those apps, you can see in some of the slides, like you're constantly like being flushed with like all sorts of advertisement on the app, you know, whether they are selling it externally or not - I can't tell. But what I can tell is, yeah, your business model is advertisement and so they are deriving profit from the data they collect. Absolutely. Herald: Again, on microphone one. Mic 1: Thank you. I was wondering if there was more of a big data kind of aspect to it as well, because these are really interesting medical information on women’s cycles in general. Eva: Yeah, and the answer is, like, I call it—this is a bit of a black box and especially in the way, for example, that Facebook is using this data like we don't know. We can assume that this is like part of the … we could assume this is part of the profiling that Facebook does of both their users and their non-users. But the way the way this data is actually processed also by those apps through data brokers and so on, it’s a bit of a black box. Herald: Microphone 1. Mic 1: Yeah. Thank you a lot for your talk and I have two completely different questions. The first one is: you've been focusing a lot on advertising and how this data is used to sell to advertisers. But I mean, like you aim to be pregnant or not. It's like it has to be the best kept secret, at least in Switzerland for any female person, because like if you also want to get employed, your employer must not know whether or not you want to get pregnant. And so I would like to ask, like, how likely is it that this kind of data is also potentially sold to employers who may want to poke into your health and reproductive situation? And then my other question is entirely different, because we also know that female health is one of the least researched topics around, and that's actually a huge problem. Like so little is actually known about female health and the kind of data that these apps collect is actually a gold mine to advance research on health issues that are specific for certain bodies like female bodies. And so I would also like to know like how would it be possible to still gather this kind of data and still to collect it, but use it for like a beneficial purpose, like it to improve knowledge on these issues? Eva: Sure. So to answer your first question, the answer will be similar to the previous answer I gave, which is, you know, it's black box problem. It's like it's very difficult to know exactly, you know, what's actually happening to this data. Obviously, GDPR is there to prevent something from happening. But as we've seen from these apps, like they were, you know, towing a very blurry line. And so the risk, obviously, of … this is something that can’t be relia…. I can't be saying, oh, this is happening because I have no evidence that this is happening. But obviously, the risk of multiple, the risk of like employers, as you say, the insurance companies that could get it, that political parties could get it and target their messages based on information they have about your mood, about, you know, even the fact that you're trying to start a family. So, yeah, there is a very broad range of risk. The advertisement we know for sure is happening because this is like the basis of their business model. The risk, the range of risk is very, very broad. Chris: To just expand on that: Again, as Eva said, we can't point out a specific example of any of this. But if you look at some of the other data brokers, her experience as a data broker, they collect. They have a statutory response. In the UK is a statutory job of being a credit reference agency, but they also run what is believed to be armed data enrichment. One of the things her employers could do is by experience data to when hiring staff. Like I can't say that if this data ever ends up there. But, you know, as they all collect, there is people collecting data and using it for some level of auditing. Eva: And to transfer your second question. I think this is a very important problem you point out is the question of data inequality and whose data gets collected for what purpose. There is I do quite a lot of work on delivery of state services. For example, when there are populations that are isolated, not using technology and so on. You might just be missing out on people, for example, who should be in need of health care or state support and so on. Just because you like data about about them. And so, female health is obviously a very key issue. We just, we literally lack sufficient health data about about woman on women's health specifically. Now, in terms of how data is processed in medical research, then there's actually protocol a in place normally to ensure, to ensure consent, to ensure explicit consent, to ensure that the data is properly collected. And so I think I wouldn't want you means that you, just because the way does apps. I've been collecting data. If you know, if there's one thing to take out of this of this dog is that, it's been nothing short of horrifying, really. That data is being collected before and shared before you even get your consent to anything. I wouldn't trust any of these private companies to really be the ones carrying well taking part in in in medical research or on those. So I agree with you that there is a need for better and more data on women's health. But I don't think. I don't think any of these actors so far have proved to be trusted on this issue. Herald: Microphone 2. Mic 2: Yeah. Thank you for this great talk. Um. Short question. What do you think is the rationale of, uh, this menstruation apps to integrate the Facebook SDK if they don't get money from Facebook? OK, uh. Being able to commercialize and this data. Chris: Good question. Um, it could be a mix of things. So sometimes it's literally the the the developers literally just have this as part of their tool chain their workflow when they're developing apps. I don't necessarily know about these two peer trackers where other apps are developed by these companies. But, uh, in our in our previous work, which I presented last year, we find that some companies just produce a load of apps and they just use the same tool chain every time. That includes by default. The Facebook SDK is part of a tool chain. Uh, some of them are like included for what I would regard as genuine purposes. Like they want their users to share something or they want their users to be able to log in with Facebook and those cases, they included, for what would be regarded a legitimate reason below them. Just don't ever actually they haven't integrated it does appearance and they don't ever really use anything of it other than that. Mean that there are a lot of developers simply quite unaware of the default state is verbose and how it sends data to Facebook. Herald: Yeah. Maybe we be close with one last question from me. Um, it doesn't it's usually a bunch of ups. How many of them do certificate pinning? Uh, we see this as a widespread policy or... Chris: Are they just not really. Yet. I would have a problem doing an analysis where stuff could've been pinned. You say TLS 1.3 is proven to be more problematic than pinning. Uh, yeah. Herald: Ok, well, thank you so much. And, uh. Yeah. Applause 36C3 Postroll music Subtitles created by c3subtitles.de in the year 2020. Join, and help us!