End-to-End Encryption in Messaging Services and National Security—Case of WhatsApp Messenger

The ubiquity of instant messaging services on mobile devices and their use of end-to-end encryption in safeguarding the privacy of their users have become a concern for some governments. WhatsApp messaging service has emerged as the most popular messaging app on mobile devices today. It uses end-to-end encryption which makes government and secret services efforts to combat organized crime, terrorists, and child pornographers technically impossible. Governments would like a “backdoor” into such apps, to use in accessing messages and have emphasized that they will only use the “backdoor” if there is a credible threat to national security. Users of WhatsApp have however, argued against a “backdoor”;they claim a “backdoor” would not only be an infringement of their privacy, but that hackers could also take advantage of it. In light of this security and privacy conflict between the end users of WhatsApp and government’s need to access messages in order to thwart potential terror attacks, this paper presents the advantages of maintaining E2EE in WhatsApp and why governments should not be allowed a “backdoor” to access users’ messages. This research presents the benefits encryption has on consumer security and privacy, and also on the challenges it poses to public safety and national security.

Privacy,National Security,and Internet Economy:An Explanation of China's Personal Information Protection Legislation

With the development of the internet and the increasing role played by information technology in the economy,personal information protection has become one of the most significant legal and public policy problems.Since 2013,China has accelerated its legislation efforts towards protecting personal information.The Cybersecurity Law of the People's Republic of China took effect on June 1,2017.Legal scholars focus on the nature of personal information,discuss the necessity of enacting specific laws on protecting personal information,and attempt to propose relevant draft laws regarding personal information protection.Personal information protection,however,is not only a legal issue but also a political one.We need to look at the decision-making process about legislation on personal information protection in China.Why has China sped up its legislation on personal information protection since 2013?Is privacy,civil rights,or legal interest the main reason behind the legislation?Only after placing personal information protection legislation in a broader context,can we have a better understanding of the underlying logic and dynamics of personal information protection in China,and can perceive the potential content and possible future of these legislation.This paper argues that Internet industry development,the social consequences of personal information infringement,and national security are the main drivers of China's personal information protection legislation.

Transborder Personal Security of Chinese Nationals and Its Legal Safeguard

Personal security is an im- portant human right. There would be no human rights to talk about if personalsecurity, including personal safety, were not safeguarded. So long as a person is in the person＇s own coun- try, there will always be a measure of legal safeguard for the person＇s interests and personal security, ff the person has his or her rights infringed upon when the person is outside the country, there will be more than one province of judicial jurisdiction over the case, and the subsequent legal remedies for the person, if any, in most cases will not be so timely and easily available as provided under the domestic laws of the person＇s own country.

Interpretation of Information Security and Data Privacy Protection According to the Data Use During the Epidemic

COVID-19 has swept the whole our country and the world in the beginning of 2020.31 provinces and municipalities across the country have launched the first-level response to major public health emergencies since January 24,and China has carried out intensive epidemic control.It is critical for effectively responding to COVID-19 to collect,collate and analyze people’s personal data.What’s more,obtaining identity information,travel records and health information of confirmed cases,suspected cases and close contacts has become a crucial step in epidemic investigation.All regions have made full use of big data to carry out personnel screening,travel records analysis and other related work in epidemic prevention and control,effectively improving the efficiency of epidemic prevention and control.However,data leakage,personnel privacy data exposure,and personal attack frequently occurred in the process of personnel travel records analysis and epidemic prevention and control.It even happened in the WeChat group to forward a person’s name,phone number,address,ID number and other sensitive information.It brought discrimination,telephone and SMS harassment to the parties,which caused great harm to individuals.Based on these,lack of information security and data security awareness and other issues were exposed.Therefore,while big data has been widely concerned and applied,attention should be paid to protecting personal privacy.It is urgent to pay more attention to data privacy and information security in order to effectively protect the legitimate rights of the people.Therefore,measures can be taken to achieve this goal,such as improving the relevant legal system,strengthening technical means to enhance the supervision and management of information security and data protection.

Research on Residents’Willingness to Protect Privacy in the Context of the Personal Information Protection Law:A Survey Based on Foshan Residents’Data

The Personal Information Protection Law,as the first law on personal information protection in China,hits the people’s most concerned,realistic and direct privacy and information security issues,and plays an extremely important role in promoting the development of the digital economy,the legalization of socialism with Chinese characteristics and social public security,and marks a new historical development stage in the protection of personal information in China.However,the awareness of privacy protection and privacy protection behavior of the public in personal information privacy protection is weak.Based on the literature review and in-depth understanding of current legal regulations,this study integrates the relevant literature and theoretical knowledge of the Personal Protection Law to construct a conceptual model of“privacy information protection willingness-privacy information protection behavior”.Taking the residents of Foshan City as an example,this paper conducts a questionnaire survey on their attitudes toward the Personal Protection Law,analyzes the factors influencing their willingness to protect their privacy and their behaviors,and explores the mechanisms of their influencing variables,to provide advice and suggestions for promoting the protection of privacy information and building a security barrier for the high-quality development of public information security.

Achieve Personalized Anonymity Through Query Blocks Exchanging

In cyberspace security,the privacy in location-based services(LBSs) becomes more critical. In previous solutions,a trusted third party(TTP) was usually employed to provide disturbance or obfuscation,but it may become the single point of failure or service bottleneck. In order to cope with this drawback,we focus on another important class,establishing anonymous group through short-range communication to achieve k-anonymity with collaborative users. Along with the analysis of existing algorithms,we found users in the group must share the same maximum anonymity degree,and they could not ease the process of preservation in a lower one. To cope with this problem,we proposed a random-QBE algorithm to put up with personalized anonymity in user collaboration algorithms,and this algorithm could preserve both query privacy and location privacy. Then we studied the attacks from passive and active adversaries and used entropy to measure user's privacy level. Finally,experimental evaluations further verify its effectiveness and efficiency.

国家安全观视域下的美国数据隐私框架探析

[目的/意义]从国家安全观视角,不仅能考察美国数据隐私保护框架的顶层设计,也能充分、全面、立体地揭示出美国数据隐私保护制度的整体趋势与优劣,为我国跨境数字贸易流通有效安全政策的制定提供理论依据。[方法/过程]运用文献研究与内容分析法,对美国新型国家安全观的基本构成与特点、数据隐私立法演化历程及其数据隐私框架进行了分析。[结果/结论]美国新型国家安全观下的数据隐私保护以数字经济优先发展为前提;其数据隐私整体框架,由国内和跨境数据保护与流动规则两个部分组成;美国数据隐私保护统一立法、跨境数据流动监管与治理现代化立法成为趋势;美国主导的同盟国跨境数据流动圈的形成,成为逆全球化的数据贸易壁垒;构建“共同价值观下的网络空间命运共同体”成为中国的必然选择。

英国警务数据开放过程中的数据安全风险防控体系研究

[研究目的]梳理英国警务数据开放过程中的数据安全风险防控政策、制度体系和具体防控措施,系统分析其特征特点,为我国警务数据安全风险防控提供参考和借鉴,以推进警务数据有序规范开放。[研究方法]采用文献研究方法,梳理英国政府和警察机构在政府网站、警察网和地方警局门户网站上公开的警务数据管理法规、制度和政策,描述英国警务数据开放过程中的数据安全风险防控机构的职责权限和分工协作、数据安全风险防控原则、数据安全风险偏好分类分级制度,并具体分析英国警务数据开放过程中的数据安全风险类型和相应的防控举措等方面内容。[研究结论]研究发现,英国警务数据开放过程有序推进、有章可循;数据开放制度体系相对完善规范;安全风险管理方法操作性强,无论是在数据安全管理政策和制度体系方面,还是在个人隐私保护和数据安全风险管理方面,英国都进行了卓有成效的探索。在此基础上,提出我国警务数据开放过程中数据安全风险管理的政策建议。

数据跨境双轨制下个人信息出境监管豁免制度的适用与完善

数据跨境新规确立了个人信息出境监管豁免制度,既豁免了申报数据出境安全评估,也豁免了订立个人信息出境标准合同、通过个人信息保护认证。但从我国数据跨境管理双轨制体系来看,这些豁免规则在理解适用上仍存在一系列困惑:符合场景豁免的个人信息是否必然豁免安全评估,一定数量个人信息为何可以豁免同等保护要求出境,过境个人信息豁免、负面清单外豁免的合理限度何在,实践需要与安全关切双重压力下应如何完善豁免。破解这些困惑,就应该明确特定豁免只是豁免保护个人权益的监管机制,厘清个人信息与重要数据关系以明确豁免边界,系统把握过境个人信息豁免和负面清单外豁免,增强数据跨境制度协同性以缓解豁免规则压力。

个性化本地差分隐私机制的研究现状与展望

本地差分隐私作为一个优秀的隐私保护模型,被广泛应用于数据收集和统计分析中的隐私保护问题。但是本地差分隐私没有考虑不同用户的隐私需求差异以及不同数据的属性差异,因此作为本地差分隐私的一种变体,个性化本地差分隐私被提出。本文根据上述两类差异将个性化本地差分隐私机制分为两类,并在此基础上对该领域的研究现状进行了分析和总结。首先本文介绍了个性化本地差分隐私的基本概念和理论模型。其次对近年来的个性化本地差分隐私机制的若干文献进行了分析和归类,并详细介绍了几种代表性方案的原理和特点,包括数据扰动方法和数据聚合方法等。最后本文对该领域的未来发展方向进行了讨论与分析。

数智时代的个人信息保护失范行为:AIGC赋能的扎根理论分析

数智时代个人信息被广泛收集和深度利用的背景下,识别个人信息保护失范行为对于推进个人隐私及信息安全保障具有重要意义。本研究基于当前个人信息保护相关法律法规,采用AIGC辅助的扎根理论分析方法,对2100个违法案例进行定性分析,识别个人信息处理活动中常见的信息保护失范行为,并对其进行系统梳理和分类,最终确定了11大类、55小类个人信息保护失范行为,并分析了数智时代个人信息保护的重点问题。本研究不仅能够为个人信息保护相关研究提供可遵循的理论框架,还可为政府职能部门等各类组织提供决策支持。

一种基于国密算法的保密多方字符串排序协议

保密排序问题由百万富翁问题衍生而来,是安全多方计算研究的基本问题,多参与方字符串排序对于数据库保密查询及电子投票求和问题的研究具有重要意义。现有保密排序问题的研究多集中在私密数据排序或者两方字符串排序,高效的多参与方字符串排序方案尚处于探索中,该文基于改进的SM2同态加密算法与门限密码算法,提出半诚实模型下的保密多方单字符排序协议,进一步构造基于权重的保密单字符排序协议以及保密多方字符串排序协议。使用模拟范例对3种协议进行安全性证明,并对协议进行性能分析与仿真实验,结果表明该文提出的保密多方单字符排序协议与保密多方字符串排序协议性能相较现有同类方案均有明显提升。

基于共性梯度的人脸识别通用对抗攻击

人脸识别技术的恶意运用可能会导致个人信息泄露,对个人隐私安全构成巨大威胁,通过通用对抗攻击保护人脸隐私具有重要的研究意义.然而,现有的通用对抗攻击算法多数专注于图像分类任务,应用于人脸识别模型时,常面临攻击成功率低和生成扰动明显等问题.为解决这一挑战,研究提出了一种基于共性梯度的人脸识别通用对抗攻击方法.该方法通过多张人脸图像的对抗扰动的共性梯度优化通用对抗扰动,并利用主导型特征损失提升扰动的攻击能力,结合多阶段训练策略,实现了攻击效果与视觉质量的均衡.在公开数据集上的实验证明,该方法在人脸识别模型上的攻击性能优于Cos-UAP、SGA等方法,并且生成的对抗样本具有更好的视觉效果,表明了所提方法的有效性.

一种满足个性化差分隐私的多方垂直划分数据合成机制

当今时代,随着大数据技术的飞速发展和数据量的持续增加,大量数据不断被不同的公司或者机构收集,把来自不同公司或机构的数据聚合起来并发布,有助于更好地提供服务、支持决策。然而他们各自的数据中可能包含敏感程度不同的隐私信息,所以在聚合发布各方数据时需要满足个性化隐私保护要求。针对个性化隐私保护的多方数据聚合发布问题,该文提出满足个性化差分隐私的多方垂直划分数据合成机制(PDP-MVDS)。该机制通过生成低维边缘分布实现对高维数据的降维,用低维边缘分布更新随机初始的数据集,最终发布和各方的真实聚合数据集分布近似的合成数据集;同时通过划分隐私预算实现个性化差分隐私保护,利用安全点积协议和门限Paillier加密保证各方数据在聚合过程中的隐私性,利用分布式拉普拉斯机制有效保护了多方聚合边缘分布的隐私。该文通过严格的理论分析证明了PDP-MVDS能够确保每个参与方数据和发布数据集的安全。最后,在公开数据集上进行了实验评估,实验结果表明PDP-MVDS机制能够以低开销生成高效用的多方合成数据集。

构建罕见病数据信托的中国方案——以制定《上海市促进浦东新区罕见病医药发展若干规定》为视角

罕见病数据共享是解决诊疗难题、提高药品可及性的关键,必须以主体协同与统一立法来克服数据孤岛和高成本研发的挑战。在《关于构建数据基础制度更好发挥数据要素作用的意见》出台的背景下,数据要素价值的开发利用不断推进,发展出与医疗数据共享相一致的罕见病数据共享模式。然而,现有模式设计无法适应罕见病的诊疗需求,在实践中仍面临诸多挑战。数据信托作为一种创新模式,因其在平衡数据权益、保障数据安全以及促进数据高效利用方面的优势,显示出与罕见病领域的高度契合性。基于此,罕见病数据共享应立足于现实需求,通过发挥浦东新区法规先行先试的优势,以患者需求为出发点,确立共享、开放和公益的基本原则。同时,须注重个人隐私与数据安全的保护,通过优化收益分配规则,构建起罕见病数据信托的中国方案。最后,应通过对内推广最佳实践,对外建立互认机制,实现数据信托效力的外溢,促进各主体共同应对罕见病挑战。

数据要素产权界定层次论——法理基础、规范设计与机制保障

数据要素市场良好发展的基础是数据要素权属清晰化、层次明确化。数据要素的经济价值、数据要素所承载的不同主体权利,以及数据要素对于经济发展和国家安全的公共价值,构成数据要素产权界定的法理基础。基于数据要素来源、生成和交易各环节的主体利益,层次化的数据要素产权包括数据生产者的财产性和非财产性权利、数据处理者的有限产权,出于国家安全和公共利益保护,还应当对数据要素产权进行安全审查、使用控制等措施。完善数据要素产权的机制保障,一是应当以试点先行的方式建立数据产权登记制度,确认产权归属;二是应当区分交易主体和数据利益属性,构建类型化的数据交易机制;三是在积极参与国际数据交易规则制定的同时,推进多元化的、中国特色的数据交易争议解决机制建设。

比较视野下的个人信息保护法律模式及其未来发展--以我国个人信息保护法为中心

尽管我国境内以及跨境个人信息数据的流动大大增加,但是我国关于个人信息安全法律制度的建立及法律后果的研究仍然匮乏。通过比较我国个人信息保护相关法律与欧盟和美国的主要法律,确定我国个人信息保护法律制度的主要特征,以及致使我国模式与域外模式产生差异的原因。这些特征构成了我国个人信息保护的独特模式,也使我国在个人信息保护立法领域走出与欧美截然不同的“第三条道路”。这种具有中国特色的个人信息保护制度将对我国个人信息保护法律的完善以及未来的人工智能法规产生重要的影响。

基于相似度聚类和正则化的个性化联邦学习

联邦学习(FL)应用场景中,常面临客户端数据异质性和不同任务需求需要提供个性化模型的问题,但现有的部分个性化联邦学习(PFL)算法中存在个性化与全局泛化的权衡问题,并且这些算法大多采用传统FL中根据客户端数据量加权聚合的方法,导致数据分布差异大的客户端模型性能变差,缺乏个性化聚合策略。针对上述问题,提出一种基于相似度聚类和正则化的PFL算法pFedSCR。pFedSCR算法在客户端本地更新阶段训练个性化模型和局部模型,其中:个性化模型在交叉熵损失函数中引入L2范数正则化,动态调整参考全局模型的程度,在汲取全局知识的基础上实现个性化;在服务端聚合阶段,根据客户端模型更新的相似度聚类,构建聚合权重矩阵,动态调整聚合权重,为不同客户端聚合个性化模型,让参数聚合策略具有个性化的同时解决数据异构问题。在CIFAR-10、MNIST、Fashion-MNIST 3个数据集上通过狄利克雷(Dirichlet)分布模拟了多种非独立同分布(Non-IID)数据场景,结果表明:pFedSCR算法在各种场景下的准确度和通信效率都优于经典算法FedProx和最新个性化算法FedPCL(Federated Prototype-wise Contrastive Learning)等联邦学习算法,最高可达到99.03%准确度。

数据与科技双重驱动下智慧老年服务模式创新研究

随着全球老龄化的发展,提供高效和贴心的老年服务已经变得日益重要。在数据科技和现代技术持续演进的背景下,智慧老年服务模式正逐步成为新的发展趋势。从数据与科技双重驱动的视角,探讨了智慧老年服务模式的创新,对现有的服务模式进行了分析,并提出了新的建议和方向。研究重点是如何利用大数据分析、人工智能和物联网等技术,为老年人提供更加个性化、智能化的服务,同时确保服务的质量和安全性。

大数据时代计算机网络安全管理策略探究

随着大数据时代的到来,计算机网络安全已经成为企业等领域必须应对的一个重要问题。在这一背景下,如何制定并实施一套完善的计算机网络安全管理策略已经成为不可忽视的议题。文章旨在从行业的角度出发,深入探讨大数据时代下的计算机网络安全管理策略。