Use & Abuse of Personal Information

Principal Investigator:

Alan Michaels, director, Electronic Systems Lab, Virginia Tech

Use & Abuse of Personal Information

The Use & Abuse of Personal Information (U&A) experiential learning effort engages a diverse and multi-disciplinary group of undergraduate students to explore and quantify how personal information propagates across the internet.  

The CCI project builds on two years of experimentation that demonstrated the ability to generate realistic fake identities, perform one-time online interactions, and subsequently collect and analyze how that information is being both used and abused across email, SMS text, and voicemail modalities.  

Of particular interest are cross-site sharing behaviors (attributable due to one-time interaction), adherence to published privacy policies, trends across industries, root sources of spam/malicious content, and answering a variety of social science questions.  

The initial experiment engaged 15 students from 10 different majors at Virginia Tech. The upcoming experiment incorporates published lessons learned from three conference papers and a Blackhat USA presentation to perform a scaled experiment with 100,000 fake identities that also integrates automated open source intelligence (OSINT) collection and analysis tools.  

In addition, the CCI investment is aimed at propelling U&A towards an independently sustainable Vertically Integrated Project (VIP) that can broaden engagement to include faculty and students at other universities, with an end goal of being a real-time dashboard / open dataset that reflects information use and sharing behaviors.

This project, among nine experiential learning projects funded for fiscal year 2022-23, is a part of CCI's strategy to provide students with industry experience and enhance their skill sets to better prepare them to enter the cybersecurity workforce.