36C3 - No Body's Business But Mine, a dive into Menstruation Apps

36C3 preroll music

Herald: It is my honor to introduce you
today to Eva and Chris. Eva, she is a

senior researcher at Privacy
International. She works on gender,

economical and social rights and how they
interplay with the right to privacy,

especially in marginalized communities.
Chris, she is the privacy lead at

technology lead at Privacy International.
And his day-to-day job is to expose

company and how they profit from
individuals and specifically today they

will tell us how these companies can even
profit from your menstruations. Thank you.

Chris: Thank you.

applause

C: Hi, everyone. It's nice to be back at
CCC. I was at CCC last year. If you heard

my talk from last year, this is going to
be like a slightly vague part 2. And if

you're not, I'm just gonna give you a very
brief recap because there is a

relationship between the two. So, I will
give you a little bit of background about

how this project started. Then we get to a
little bit about menstruation apps and

what a menstruation app actually is. Let
me talk a little bit through some of the

data that these these apps are collecting
and talk how we did our research, our

research methodology and then what our
findings are and our conclusions. So last

year, I and a colleague did a project
around how Facebook collects data about

users on Android devices using the Android
Facebook SDK. And this is whether you have

a Facebook account or not. And for that
project, we really looked when you first

opened apps and didn't really have to do
very much interaction with them

particularily, about the automatic sending
of data in a post GDPR context. And so we

looked a load of apps for that project,
including a couple of period trackers. And

that kind of led onto this project because
we were seeing loads of apps, across

different areas of categories. So we
thought we'd like hone in a little bit on

period trackers to see what kind of data,
because they're by far more sensitive than

many of the other apps on there, like you
might consider your music history to be

very sensitive.... laughs So. Yeah. So,
just a quick update on the previous work

from last year. We actually followed up
with all of the companies from that, from

that report. And by the end of like going
through multiple rounds of response, over

60 percent of them a changed practices
either by disabling the Facebook SDK in

their app or by disabling it until you
gave consent or removing it entirely. So I

pass over to Eva Blum-Dumontet. She's
going to talk you through menstruation

apps.
Eva: So I just want to make sure that

we're all on the same page. Although if
you didn't know what a menstruation app is

and you still bothered coming to this
talk, I'm extremely grateful. So how many

of you are are using a menstruation app or
have a partner, who's been using a

menstruation app? Oh my God. Oh, okay. I
didn't expect that. I thought it was going

to be much less. Okay. Well, for the few
of you who still might not know what a

menstruation app is, I'm still going to go
quickly through what a menstruation app

is. It's the idea of a menstruation app.
We also call them period tracker. It's to

have an app that tracks your menstruation
cycle. So that they tell you what days

you're most fertile. And you can
obviously, if you're using them to try and

get pregnant or if you have, for example,
a painful period, you can sort of plan

accordingly. So that's essentially the
main 2 reasons users would be would be

looking into using menstruation apps:
pregnancy, period tracking. Now, how did

this research starts? As Chris said,
obviously there was whole research that

had been done by Privacy International
last year on various apps. And as Chris

also already said what I was particularly
interested in was the kind of data that

menstruation apps are collecting, because
as we'll explain in this talk, it's really

actually not just limited to menstruation
cycle. And so I was interested in seeing

what actually happens to the data when it
is being shared. So I should say we're

really standing on the shoulders of giants
when it comes to this research. There was

previously existing research on
menstruation apps that was done by a

partner organization, Coding Rights in
Brazil. So they had done research on the

kind of data that was collected by
menstruation apps and the granularity of

this data. Yet, a very interesting thing
that we're looking at was the gender

normativity of those apps. Chris and I
have been looking at, you know, dozens of

these apps and, you know, they have
various data showing practices, as we'll

explain in the stock. But they have one
thing that all of them have in common is

that they are all pink. The other thing is
that they talk to their users as woman.

They, you know, don't want sort of even
compute the fact that maybe not all their

users are woman. So there is a very sort
of like narrow perspective of pregnancy

and females' bodies and how does female
sexuality function. Now, as I was saying,

when you're using a menstruation app, it's
not just your menstruation cycle that

you're entering. So this is some of the
questions that menstruation apps ask: So

sex; There is a lot about sex that they
want to know? How often, is it protected

or unprotected? Are you smoking? Are you
drinking? Are you partying? How often? We

even had one app that was asking about
masturbation, your sleeping pattern, your

coffee drinking habits. One thing that's
really interesting is that - and we'll

talk a little bit more again about this
later - but there's very strong data

protection laws in Europe called GDPR as
most of you will know. And it says that

only data that's strictly necessary should
be collected. So I'm still unclear what

masturbation has to do with tracking your
menstruation cycle, but... Other thing

that was collected is about your health
and the reason health is so important is

also related to data protection laws
because when you're collecting health

data, you need to show that you're taking
an extra step to collect this data because

it's considered sensitive personal data.
So extra steps in terms of getting

explicit consent from the users but also
through steps on behalf of the data

controller, in terms of showing that
they're making extra steps for the

security of this data. So this is the type
of question that was asked. There is so

much asked about vaginal discharge and
what kind of vaginal discharge you get

with all sorts of weird adjectives for
this: "Tiki, creamy". So yeah, they

clearly thought a lot about this. And it
is a lot about mood as well. Even, yeah, I

didn't know 'romantic' was a mood but
apparently it is. And what's interesting

obviously about mood in the context where,
you know, we've seen stories like

Cambridge Analytica, for example. So we
know how much companies, we know how much

political parties are trying to understand
how we think, how we feel. So that's

actually quite significant that you have
an app that's collecting information about

how we feel on a daily basis. And
obviously, like when people enter all

these data, their expectation at that
point is that the data stays between

between them and the app. And actually,
there is very little in the privacy policy

that could that would normally suggest
that it was. So this is the moment where I

actually should say we're not making this
up; like literally everything in this list

of questions were things, literal terms,
that they were asking. So we set out to

look at the most popular menstruation
apps. Do you want to carry on?

Chris: Yeah. I forgot to introduce myself
as well. Really? That's a terrible

speaking habit.
Eva: Christopher Weatherhead..

Chris: .. Privacy International's
technology lead. So yeah.. What I said

about our previous research, we have
actually looked at most of the very

popular menstruation apps, the ones that
have hundreds of thousands of downloads.

And these apps - like as we're saying that
this kind of work has been done before. A

lot of these apps that come into quite a
lot of criticism, I'd spare you the free

advertising about which ones particularly
but most of them don't do anything

particularly outrageous, at least between
the app and the developers' servers. A lot

of them don't share with third parties at
that stage. So you can't look between the

app and the server to see what they're
sharing. They might be sharing data from

the developers' server to Facebook or to
other places but at least you can't see

in-between. But we're an international
organization and we work around the globe.

And most of the apps that get the most
downloads are particularly Western, U.S.,

European but they're not the most popular
apps necessarily in a context like India

and the Philippines and Latin America. So
we thought we'd have a look and see those

Apps. They're all available in Europe but
they're not necessarily the most popular

in Europe. And this is where things
started getting interesting. So what

exactly did we do? Well, we started off by
triaging through a large number of period

trackers. And as Eva said earlier: every
logo must be pink. And we were just kind

of looking through to see how many
trackers - this is using extras (?)

privacy. We have our own instance in PI
and we just looked through to see how many

trackers and who the trackers were. So,
for example, this is Maya, which is

exceptionally popular in India,
predominantly - it's made by an Indian

company. And as you can see, it's got a
large number of trackers in it: a

CleverTap, Facebook, Flurry, Google and
Inmobi? So we went through this process and

this allowed us to cut down... There's
hundreds of period trackers. Not all of

them are necessarily bad but it's nice to
try to see which ones had the most

trackers, where they were used and try and
just triage them a little bit. From this,

we then run through PI's interception
environment, which is a VM that I've made.

I actually made it last year for the talk
I gave last year. And I said I'd release

it after the talk and took me like three
months to release it but it's now

available. You can go onto PI's website
and download it. It's a man in the middle

proxy with a few settings - mainly for
looking at iOS and Android apps to do data

interception between them. And so we run
through that and we got to have a look at

all the data that's being sent to and from
both the app developer and third parties.

And here's what we found.
Eva: So out of the six apps we looked out,

five shared data with Facebook. Out of
those five, three pinged Facebook to let

them know when their users were
downloading the app and opening the app.

And that's already quite significant
information and we'll get to that later.

Now, what's actually interesting and the
focus of a report was on the two apps that

shared every single piece of information
that their users entered with Facebook and

other third parties. So just to brief you:
the two apps we focused on are both called

Maya. So that's all very helpful. One is
spelled Maya: M-a-y-a. The other ones

spellt Mia M-I-A. So, yeah, just bear with
me because this is actually quite

confusing. But so initially we'll focus on
Maya, which is - as Chris mentioned - an

app that's based in India. There have a
user base of several millions. Their are

based in India. Userbase, mostly in India,
also quite popular in the Philippines. So

what's interesting with Maya is that they
start sharing data with Facebook before

you even get you agree to their privacy
policy. So I should say already about the

privacy policy of a lot of those apps that
we looked at is that they are literally

the definition of small prints. It's very
hard to read. It's legalese language. It

really puts into perspective the whole
question of consent in GDPR because GDPR

says like the consents must be informed.
So you must be able to understand what

you're consenting to. When you're reading
this extremely long, extremely opaque

privacy policies of a lot - literally all
the menstruation apps we've looked at,

excluding one that didn't even bother
putting their privacy policy, actually.

It's opaque. It's very hard to understand
and - absolutely, definitely, do not say

that they're sharing information with
Facebook. As I said, data sharing happened

before you get to agree to their privacy
policy. The other thing that's also worth

remembering is that when to share
information with Facebook - doesn't matter

if you have a Facebook account or not, the
information still being relayed. The other

interesting thing that you'll notice as
well in several of the slides is that the

information that's being shared is tied to
your identity through your unique ID

identifiers, also your email address. But
basically most of the questions we got

when we released the research was like:
oh, if I use a fake email address or if I

use a fake name, is that OK? Well, it's
not because even if you have a Facebook

account through your unique identifier,
they would definitely be able to trace you

backs. There is no way to actually
anonymize this process unless - well at

the end, unless you deliberately trying to
trick it and use a separate phone

basically for regular users. It's quite
difficult. So this is what it looks like

when you enter the data. So as I said, I
didn't lie to you. This is the kind of

questions they're asking you. And this is
what it looks like when it's being shared

with Facebook. So you see the symptomes
changing, for example, like blood

pressure, swelling, acne, that's all being
shipped through craft out Facebook,

through the Facebook SDK. This is what it
looks like when they show you

contraceptive practice, so again, like
we're talking health data. Here we're

talking sensitive data. We're talking
about data that shouldn't normally require

extra steps in terms of collecting it, in
terms of how it's being processed. But

nope, in this case it was shared exactly
like the rest. This's what it looks like.

Well, so, yeah with sex life it was a
little bit different. So that's what it

looks like when they're asking you about,
you know, you just had sex, was it

protected? Was it unprotected? The way it
was shared with Facebook was a little bit

cryptic, so to speak. So if you have
protected sex, it was entered as love "2",

unprotected sex was entered as Love "3". I
managed to figure that out pretty quickly.

So it's not so cryptic. That's also quite
funny. So Maya had a diary section where

they encourage people to enter like their
notes and your personal faults. And I

mean, it's a menstruation app so you can
sort of get the idea of what people are

going to be writing down in there or
expected to write on. It's not going to be

their shopping list, although shopping
lists could also be personal, sensitive,

personal information, but.. So we were
wondering what would happen if you were to

write in this in this diary and how this
data would be processed. So we entered

literally we entered something very
sensitive, entered here. This is what we

wrote. And literally everything we wrote
was shared with Facebook. Maya also shared

your health data, not just with Facebook,
but with a company called CleverTap that's

based in California. So what's CleverTap?
CleverTap is a data broker, basically.

It's a company that - sort of similar to
Facebook with the Facebook SDK. They

expect of developers to hand over the data
and in exchange app developers get

insights about like how people use the
app, what time of day. You know, the age

of their users. They get all sorts of
information and analytics out of the data

they share with this company. It took us
some time to figure it out because it

shared as wicked wizard?
Chris: Wicket Rocket.

Eva: Wicket Rocket, yeah. But that's
exactly the same. Everything that was

shared with Facebook was also shared with
CleverTap again, with the email address

that we were using - everything. Let's
shift. Now, let's look at the other Mia.

It's not just the name that's similar,
it's also the data showing practices. Mia

is based in Cypress, so in European Union.
I should say, in all cases, regardless of

where the company is based, the moment
that they market the product in European

Union, so like literally every app we
looked at, they need to - well they should

respect GDPR. Our European data protection
law. Now, the first thing that Mia asked

when you started the app and again - I'll
get to that later about the significance

of this - is why you're using the app or
you using it to try and get pregnant or

are you just using it to try to track your
periods? Now, it's interesting because it

doesn't change at all the way you interact
with the app eventually. The apps stays

exactly the same. But this is actually the
most important kind of data. This is

literally called the germ of data
collection. It's trying to know when a

woman is trying to get pregnant or not. So
the reason this is the first question they

ask is, well my guess on this is - they
want to make sure that like even if you

don't actually use the app that's at least
that much information they can collect

about you. And so this information was
shared immediately with Facebook and with

AppsFlyer. AppsFlyer is very similar to
CleverTap in the way it works. It's also a

company that collects data from these apps
and that as services in terms of analytics

and insights into user behavior. It's
based in Israel. So this is what it looks

like when you enter the information. Yeah,
masturbation, pill. What kind of pill

you're taking, your lifestyle habits. Now
where it's slightly different is that the

information doesn't immediately get shared
with Facebook but based on the information

you enter, you get articles that are
tailored for you. So, for example, like

when you select masturbation, you will
get, you know, masturbation: what you want

to know but are ashamed to ask. Now,
what's eventually shared with Facebook is

actually the kind of article that's being
offered to you. So basically, yes, the

information is shared indirectly because
then you know you have Facebook and...

You've just entered masturbation because
you're getting an article about

masturbation. So this is what happened
when you enter alcohol. So expected

effects of alcohol on a woman's body.
That's what happened when you enter

"unprotected sex". So effectively, all the
information is still shared just

indirectly through the articles you're
getting. Yeah. Last thing also, I should

say on this, in terms of the articles that
you're getting, is that sometimes there

was sort of also kind of like crossing the
data.. was like.. so the articles will be

about like: oh, you have cramps outside of
your periods, for example, like during

your fertile phase. And so you will get
the article specifically for this and the

information that's shared with Facebook
and with AppsFlyer is that this person is

in their fertile period in this phase of
their cycles and having cramps. Now, why

are menstruation apps so obsessed with
finding out if you're trying to get

pregnant? And so, this goes back to a lot
of the things I mentioned before that, you

know, about wanting to know in the very
first place if you're trying to get

pregnant or not. And also, this is
probably why a lot of those apps are

trying to really nail down in their
language and discourse how you're using

the apps for. When a person is pregnant,
they're purchasing habit, their consumer

habits change. Obviously, you know, you
buy not only for yourself but you start

buying for others as well. But also you're
buying new things you've never purchased

before. So what a regular person will be
quite difficult to change her purchasing

habit was a person that's pregnant.
They'll be advertisers will be really keen

to target them because this is a point of
their life where their habits change and

where they can be more easily influenced
one way or another. So in other words,

it's pink advertising time. In other more
words and pictures, there's research done

in 2014 in the US that was trying to sort
of evaluate the value of data for a

person. So an average American person
that's not pregnant was 10 cents. A person

who's pregnant would be one dollar fifty.
So you may have noticed we using the past

tense when we talked about - well I hope I
did when I was speaking definitely into

the lights at least - we used the past
tense when we talk about data sharing of

these apps. That's because both Maya and
MIA, which were the two apps we were

really targeting with this report, stop
using the Facebook SDK when we wrote to

them about our research
before we published it.

applause
So it was quite nice because he didn't

even like rely on actually us publishing
the report. It was merely at a stage of

like, hey, this is all right of response.
We're gonna be publishing this. Do you

have anything to say about this? And
essentially what they had to say is like:

"Yep, sorry, apologies. We are stopping
this." I think, you know.. What's really

interesting as well to me about like the
how quick the response was is.. it really

shows how this is not a vital service for
them. This is a plus. This is something

that's a useful tool. But the fact that
they immediately could just stop using it,

I think really shows that, you know, it
was.. I wouldn't see a lazy practice, but

it's a case of light. As long as no one's
complaining, then you are going to carry

on using it. And I think that was also the
discourse with your research. There was

also a lot that changed
their behaviors after.

Chris: A lot of the developers sometimes
don't even realize necessarily what data

they're up to sharing with people like
Facebook, with people like CleverTap. They

just integrate the SDK and
hope for the best.

Eva: We also got this interesting response
from AppsFlyer is that it's very

hypocritical. Essentially, what they're
saying is like oh, like we specifically

ask our customers or oh, yeah, do not
share health data with us specifically for

the reason I mentioned earlier, which is
what? Because of GDPR, you're normally

expected to take extra step when you
process sensitive health data. So their

response is that they as their customer to
not share health data or sensitive

personal data so they don't become liable
in terms of the law. So they were like,

oh, we're sorry, like this is a breach of
contract. Now, the reason is very

hypocritical is that obviously when you
have contracts with menstruation apps and

actually Maya was not the only
menstruation apps that we're working with.

I mean, you know, what can you generally
expect in terms of the kind of data you're

gonna receive? So here's a conclusion for
us that research works. It's fun, it's

easy to do. You know, Chris has not
published the environment. It doesn't

actually - once the environment is sort of
set up it doesn't actually require

technical background, as you saw from the
slides it's pretty straightforward to

actually understand how the data is being
shared. So you should do it, too. But more

broadly, we think it's really important to
do more research, not just at this stage

of the process, but generally about the
security and the data and the data showing

practices of apps, because, you know, it's
hard law and more and more people are

using or interacting with technology and
using the Internet. So we need to do think

much more carefully about the security
implication of the apps we use and

obviously it works. Thank you.

applause

Herald: Thank you. So, yeah, please line
up in front of the microphones. We can

start with microphone two.
Mic 2: Hi. Thank you. So you mentioned

that now we can check whether our data is
being shared with third parties on the

path between the user and the developer.
But we cannot know for all the other apps

and for these, what if it's not being
shared later from the developer, from the

company to other companies. Have you
conceptualize some ways of testing that?

Is it possible?
Chris: Yes. So you could do it, data

separate access request and the GDPR that
would... like the problem is it's quite

hard to necessarily know. How the process
- how the system outside of the app to

serve relationship is quite hard to know
the processes of that data and so it is

quite opaque. They might apply a different
identifier too, they might do other

manipulations to that data so trying to
track down and prove this bit of data

belong to you. It's quite challenging.
Eva: This is something we're going to try.

We're going to be doing in 2020, actually.
We're going to be doing data subject

access request of those apps that we've
been looking up to see if we find anything

both under GDPR but also under different
data protection laws in different

countries. To see basically what we get,
how much we can obtain from that.

Herald: So I'd go with the signal angle.
Signal: So what advice can you give us on

how we can make people understand that
from a privacy perspective, it's better to

use pen and paper instead of entering
sensitive data into any of these apps?

Eva: I definitely wouldn't advise that. I
wouldn't advise pen and paper. I think for

us like really the key... The work we are
doing is not actually targeting users.

It's targeting companies. We think it's
companies that really need to do better.

We're often ask about, you know, advice to
customers or advice to users and

consumers. But what I think and what we've
been telling companies as well is that,

you know, their users trust you and they
have the right to trust you. They also

have the right to expect that you're
respecting the law. The European Union has

a very ambitious legislation when it comes
to privacy with GDPR. And so the least

they can expect is that you're respecting
the law. And so, no, I would ... and this

is the thing, I think people have the
right to use those apps, they have the

right to say, well, this is a useful
service for me. It's really companies that

need you. They need to up their game. They
need to live up to the expectations of

their consumers. Not the other way around.
Herald: Microphone 1.

Mic 1: Hi. So from the talk, it seems and
I think that's what you get, you mostly

focused on Android based apps. Can you
maybe comment on what the situation is

with iOS? Is there any technical
difficulty or is it anything completely

different with respect to these apps and
apps in general?

Chris: There's not really a technical
difficulty like the setup a little bit

different, but functionally you can look
at the same kind of data. The focus here,

though, is also.. So it's two-fold in some
respects. Most of the places that these

apps are used are heavily dominated
Android territories, places like India,

the Philippines. iOS penetration there,
uh, Apple device penetration there is very

low. There's no technical reason not to
look at Apple devices. But like in this

particular context, it's not necessarily
hugely relevant. So does that answer your

question?
Mic 1: And technically with youre set-up,

you could also do the same
analysis with an iOS device?

Chris: Yeah. As I said it's a little bit
of a change to how you... You have to

register the device as an MDM dev.. like a
mobile profile device. Otherwise you can

do the exact same level of interception.
Mic: Uh, hi. My question is actually

related to the last question
is a little bit technical.

Chris: Sure.
Mic: I'm also doing some research on apps

and I've noticed with the newest versions
of Android that they're making more

difficult to install custom certificates
to have this pass- through and check what

the apps are actually communicating to
their home servers. Have you find a way to

make this easier?
Chris: Yes. So we actually hit the same

issue as you in some respects. So the
installing of custom certificates was not

really an obstacle because you can add to
the user if it's a rich device, you can

add them to the system store and they are
trusted by all the apps on the device. The

problem we're now hitting is the Android 9
and 10 have TLS 1.3 and TLS 1.3

to text as a man in the middle or at
least it tries to might terminate the

connection. Uh, this is a bit of a
problem. So currently all our research is

still running on Android 8.1 devices. This
isn't going to be sustainable long term.

Herald: Um, 4.
Mic 4: Hey, thank you for the great talk.

Your research is obviously targeted in a
constructive, critical way towards

companies that are making apps surrounding
menstrual research. Did you learn anything

from this context that you would want to
pass on to people who research this area

more generally? I'm thinking, for example,
of Paramount Corp in the US, who've done

micro dosing research on LSD and are
starting a breakout study on menstrual

issues.
Eva: Well, I think this is why I was

concluded on it. I think there is a
there's still a lot of research that needs

to be done in terms of the sharing. And
obviously, I think anything that touches

on people's health is a key priority
because it's something people relate very

strongly to. The consequences, especially
in the US, for example, of sharing health

data like this, of having - you know -
data, even like your blood pressure and so

on. Like what are the consequences if
those informations are gonna be shared,

for example, with like insurance companies
and so on. This is what I think is

absolutely essential to have a better
understanding of the data collection and

sharing practices of the services. The
moments when you have health data that's

being involved.
Chris: .. yeah because we often focus

about this being an advertising issue. But
in that sense as well, insurance and even

credit referencing of all sorts of other
things become problematic, especially when

it comes to pregnancy related.
Eva: Yeah, even employers could be after

this kind of information.
Herald: Six.

Mic 6: Hi. I'm wondering if there is an
easy way or a tool which we can use to

detect if apps are using our data or are
reporting them to Facebook or whatever. Or

if we can even use those apps but block
this data from being reported to Facebook.

Chris: Yes. So, you can file all of faith
graft on Facebook.com and stop sending

data to that. There's a few issues here.
Firstly, it doesn't really like.. This

audience can do this. Most users don't
have the technical nuance to know what

needs to be blocked, what doesn't
necessarily need to be blocked. It's on

the companies to be careful with users
data. It's not up to the users to try and

defend against.. It shouldn't be on the
use to defend against malicious data

sharing or...
Eva: You know... also one interesting

thing is that if Facebook had put this in
place of light where you could opt out

from data sharing with the apps you're
using, but that only works if you're a

Facebook user. And as I said, like this
data has been collected whether you are a

user or not. So in a sense, for people who
aren't Facebook users, they couldn't opt

out of this.
Chris: The Facebook SDK the developers are

integrating the default state for sharing
of data is on, the flag is true. And

although they have a long legal text on
the help pages for the developer tools,

it's like unless you have a decent
understanding of local data protection

practice or local protection law. It's
like it's not it's not something that most

developers are gonna be able to understand
why this flag should be something

different from on. You know there's loads
of flags in the SDK, which flags should be

on and off, depending on which
jurisdiction you're selling to, or users

going to be in.
Herald: Signal Angel, again.

Singal: Do you know any good apps which
don't share data and are privacy friendly?

Probably even one that is open source.
Eva: So, I mean, as in the problem which

is why I wouldn't want to vouch for any
app is that even in the apps that, you

know, where in terms of like the traffic
analysis we've done, we didn't see any any

data sharing. As Chris was explaining, the
data can be shared at a later stage and

it'd be impossible for us to really find
out. So.. no, I can't be vouching for any

app. I don't know if you can...
Chris: The problem is we can't ever look

like one specific moment in time to see
whether data is being shared, unlike what

was good today might bad tomorrow. What
was bad yesterday might be good today.

Although, I was in Argentina recently
speaking to a group of feminist activists,

and they have been developing a
menstruation tracking app. And the app was

removed from the Google Play store because
it had illustrations that were deemed

pornographic. But they were illustrations
around medical related stuff. So even

people, who were trying to do the right
thing, going through the open source

channels are still fighting a completely
different issue when it comes to

menstruation tracking.
It's a very fine line.

Herald: Um, three.
inaudible

Eva: Sorry, can't hear -the Mic's not
working.

Herald: Microphone three.
Mic 3: Test.

Eva: Yeah, it's great - perfect.
Mic 3: I was wondering if the graph API

endpoint was actually in place to trick
menstruation data or is it more like a

general purpose advertisement
tracking thing or. Yeah.

Chris: So my understanding is that there's
two broad kinds of data that Facebook gets

as automated app events that Facebook were
aware of. So app open, app close, app

install, relinking. Relinking is quite an
important one for Facebook. That way they

check to see whether you already have a
Facebook account logged in to log the app

to your Facebook account when standing.
There's also a load of custom events that

the app developers can put in. There is
then collated back to a data set - I would

imagine on the other side. So when it
comes to things like whether it's nausea

or some of the other health issues, it is
actually being cross-referenced by the

developer. Does that answer your question?
Mic 3: Yes, thank you.

Herald: Five, microphone five.
Mic 5: Can you repeat what you said in the

beginning about the menstruation apps used
in Europe, especially Clue and the Period

Tracker? Yeah. So those are the most
popular apps actually across the world,

not just in Europe and the US. A lot of
them in terms of like the traffic analysis

stage, a lot of them have not clean up
their app. So we can't see any any data

sharing happening at that stage. But as I
said, I can't be vouching for them and

saying, oh, yeah, those are safe and fine
to use because we don't know what's

actually happening to the data once it's
been collected by the app. All we can say

is that as far as the research we've done
goes, we didn't see any data being shed

Chris: Those apps you mentioned have been
investigated by The Wall Street Journal

and The New York Times relatively
recently. So they've been.. had quite like

a spotlight on them. So they've had to
really up their game and a lot of ways

which we would like everyone to do. But as
Eva says, we don't know what else they

might be doing with that data on their
side, not necessarily between the phone

and the server but from their server to
another server.

Herald: Microphone one.
Mic 1: Hi. Thank you for the insightful

talk. I have a question that goes in a
similar direction. Do you know whether or

not these apps, even if they adhere to
GDPR rules collect the data to then at a

later point at least sell it to the
highest bidder? Because a lot of them are

free to use. And I wonder what is their
main goal besides that?

Eva: I mean, the advertisement his how
they make profit. And so, I mean, the

whole question about them trying to know
if you're pregnant or not is that this

information can eventually be - you know -
be monetized through, you know, through

how they target the advertisement at you.
Actually when you're using those apps, you

can see in some of the slides, like you're
constantly like being flushed with like

all sorts of advertisement on the app, you
know, whether they are selling it

externally or not - I can't tell. But what
I can tell is, yeah, your business model

is advertisement and so they are deriving
profit from the data they collect.

Absolutely.
Herald: Again, on microphone one.

Mic 1: Thank you. I was wondering if there
was more of a big data kind of aspect to

it as well, because these are really
interesting medical information on women’s

cycles in general.
Eva: Yeah, and the answer is, like, I call

it—this is a bit of a black box and
especially in the way, for example, that

Facebook is using this data like we don't
know. We can assume that this is like part

of the … we could assume this is part of
the profiling that Facebook does of both

their users and their non-users. But the
way the way this data is actually

processed also by those apps through data
brokers and so on, it’s a bit of a black

box.
Herald: Microphone 1.

Mic 1: Yeah. Thank you a lot for your talk
and I have two completely different

questions. The first one is: you've been
focusing a lot on advertising and how this

data is used to sell to advertisers. But I
mean, like you aim to be pregnant or not.

It's like it has to be the best kept
secret, at least in Switzerland for any

female person, because like if you also
want to get employed, your employer must

not know whether or not you want to get
pregnant. And so I would like to ask,

like, how likely is it that this kind of
data is also potentially sold to employers

who may want to poke into your health and
reproductive situation? And then my other

question is entirely different, because we
also know that female health is one of the

least researched topics around, and that's
actually a huge problem. Like so little is

actually known about female health and the
kind of data that these apps collect is

actually a gold mine to advance research
on health issues that are specific for

certain bodies like female bodies. And so
I would also like to know like how would

it be possible to still gather this kind
of data and still to collect it, but use

it for like a beneficial purpose, like it
to improve knowledge on these issues?

Eva: Sure. So to answer your first
question, the answer will be similar to

the previous answer I gave, which is, you
know, it's black box problem. It's like

it's very difficult to know exactly, you
know, what's actually happening to this

data. Obviously, GDPR is there to prevent
something from happening. But as we've

seen from these apps, like they were, you
know, towing a very blurry line. And so

the risk, obviously, of … this is
something that can’t be relia…. I can't be

saying, oh, this is happening because I
have no evidence that this is happening.

But obviously, the risk of multiple, the
risk of like employers, as you say, the

insurance companies that could get it,
that political parties could get it and

target their messages based on information
they have about your mood, about, you

know, even the fact that you're trying to
start a family. So, yeah, there is a very

broad range of risk. The advertisement we
know for sure is happening because this is

like the basis of their business model.
The risk, the range of risk is very, very

broad.
Chris: To just expand on that: Again, as

Eva said, we can't point out a specific
example of any of this. But if you look at

some of the other data brokers, her
experience as a data broker, they collect.

They have a statutory response. In the UK
is a statutory job of being a credit

reference agency, but they also run what
is believed to be armed data enrichment.

One of the things her employers could do
is by experience data to when hiring

staff. Like I can't say that if this data
ever ends up there. But, you know, as they

all collect, there is people collecting
data and using it for some level of

auditing.
Eva: And to transfer your second question.

I think this is a very important problem
you point out is the question of data

inequality and whose data gets collected
for what purpose. There is I do quite a

lot of work on delivery of state services.
For example, when there are populations

that are isolated, not using technology
and so on. You might just be missing out

on people, for example, who should be in
need of health care or state

support and so on. Just because you like
data about about them. And so, female

health is obviously a very key issue. We
just, we literally lack sufficient health

data about about woman on women's health
specifically. Now, in terms of how data is

processed in medical research, then
there's actually protocol a in place

normally to ensure, to ensure consent, to
ensure explicit consent, to ensure that

the data is properly collected. And so I
think I wouldn't want you means that you,

just because the way does apps. I've been
collecting data. If you know, if there's

one thing to take out of this of this dog
is that, it's been nothing short of

horrifying, really. That data is being
collected before and shared before you

even get your consent to anything. I
wouldn't trust any of these private

companies to really be the ones carrying
well taking part in in in medical research

or on those. So I agree with you that
there is a need for better and more data

on women's health. But I don't think. I
don't think any of these actors so far

have proved to be trusted on this issue.
Herald: Microphone 2.

Mic 2: Yeah. Thank you for this great
talk. Um. Short question. What do you

think is the rationale of, uh, this
menstruation apps to integrate the

Facebook SDK if they don't get money from
Facebook? OK, uh. Being able to

commercialize and this data.
Chris: Good question. Um, it could be a

mix of things. So sometimes it's literally
the the the developers literally just have

this as part of their tool chain their
workflow when they're developing apps. I

don't necessarily know about these two
peer trackers where other apps are

developed by these companies. But, uh, in
our in our previous work, which I

presented last year, we find that some
companies just produce a load of apps and

they just use the same tool chain every
time. That includes by default. The

Facebook SDK is part of a tool chain. Uh,
some of them are like included for what I

would regard as genuine purposes. Like
they want their users to share something

or they want their users to be able to log
in with Facebook and those cases, they

included, for what would be regarded a
legitimate reason below them. Just don't

ever actually they haven't integrated it
does appearance and they don't ever really

use anything of it other than that. Mean
that there are a lot of developers simply

quite unaware of the default state is
verbose and how it sends data to Facebook.

Herald: Yeah. Maybe we be close with one
last question from me. Um, it doesn't it's

usually a bunch of ups. How many of them
do certificate pinning? Uh, we see this as a

widespread policy or...
Chris: Are they just not really. Yet. I

would have a problem doing an analysis
where stuff could've been pinned. You say

TLS 1.3 is proven to be
more problematic than pinning. Uh, yeah.

Herald: Ok, well, thank you so much. And,
uh. Yeah.

Applause

36C3 Postroll music

Subtitles created by c3subtitles.de
in the year 2020. Join, and help us!