Selected works.

Security and privacy related projects.

• What The Internet Knows About You

  (finished)

  -- exposed, demonstrated and educated about the risks of CSS History leak.
• How Much Are You Worth

  (finished)

  -- Analyzed private data flows in ad networks, used information leaks for fun and profit. Engineered transparency enhancing technologies (browser extension). Took advantage over standard mechanisms used in Real-Time Bidding. Link to results.
• SensorsPrivacy -- A project analyzing, describing and demonstrating privacy aspects of sensors available on modern devices and Web browsers.
• Security and Privacy Questionnaire - my work at W3C Technical Architecture Group term, privacy by design at W3C and improving the security/privacy review process.
• Humanitarian consequences of cyber operations - at ICRC, researched the various aspects of cyber operations and their consequences, in light of existing body of international law such as international humanitarian law.

Reports (technical/scientific/policy).

• Written contribution for EP LIBE Committee: data protection and privacy analysis of the European Commission proposal to amend eID Regulation
• On the governance of privacy-preserving systems, Handbook on the Politics and Governance of Big Data and Artificial Intelligence, Edward Elgar Publishing., 2023
• Self-Review Questionnaire: Security and Privacy (W3C announcement).
• The Potential Human Cost of Cyber Operations (PDF, (my blog), report of International Comittee of the Red Cross, 2019

I sometimes write articles, op-eds, etc.

• The Outer Space Treaty and Promoting Responsible Use of Space, Just Security 2023
• Smartphones Blur the Line Between Civilian and Combatant, Wired 2022
• The Dire Possibility of Cyberattacks on Weapons Systems, Wired 2021
• India's Data Protection Bill Threatens Global Cybersecurity, Wired 2020
• Websites Ask for Permissions and Attack Forgiveness (blog), Opinion in Wired, 2019
• Global Consequences of Escalating U.S.-Russia Cyber Conflict, Opinion at Council on Foreign Relations/Net Politics, 2019
• A second life for the 'do not track' setting - with teeth (blog), Opinion in Wired, 2019
• Making Web Ecosystem Safer - Certificates, Browsers, Web (my blog), IEEE Standards Education E-magazine, 2018

Papers are one way of summarizing projects and systematizing knowledge.

• My LL.M. dissertation in Information Technology Law (data protection assessment of Protected Audience API) (PDF)
• Policy strategies for value-based technology standards. Internet Policy Review, 10(3). (PDF).
• The CNAME of the Game: Large-scale Analysis of DNS-based Tracking Evasion (

  PDF

  ), Privacy Enhancing Technologies Symposium, 2021.
The Register
• Shedding light on web privacy impact assessment: A case study of the Ambient Light Sensor API, International Workshop on Privacy Engineering 2020 (

  PDF

  )
• Enhancing user transparency in online ads ecosystem with site self-disclosures (PDF)
• The potential human cost of cyber operations: Starting the conversation
• Making web ecosystem safer - certificates, browsers, web
• Privacy of Web Request API
• Stealing sensitive browser data with the W3C Ambient Light Sensor API (

  PDF

  )
• Battery Status Not Included: Assessing the Privacy Impact of the Modern Web, International Workshop on Privacy Engineering 2020,

  Best Paper Award

• Report on Sensors APIs: privacy and transparency perspective
• The leaking battery: A privacy analysis of the HTML5 Battery Status API (

  PDF

  )
  Guardian, and more.

  Fix: Firefox, W3C standard.

• To bid or not to bid? Measuring the value of privacy in RTB
  Sunday Times
• I'm 2.8% Neanderthal - The Beginning of Genetic Exhibitionism?, Workshop on Genome Privacy (PETS '14)
• Analysis of OpenX-Publishers Cooperation, HotPETS 2014
• Selling off User Privacy at Auction (

  PDF

  ), NDSS 14.
Slashdot, De Correspondent
• Towards Web-based Biometric Systems Using Personal Browsing Interests, 8th International Conference on Availability, Reliability and Security
• Data Harvesting 2.0: from the Visible to the Invisible Web, The 12th Workshop on the Economics of Information Security (WEIS 2013)
• Why Johnny Can't Browse in Peace: On the Uniqueness of Web Browsing History Patterns, HotPETS 2012

  (PDF)

American Scientist, CNET
• Secure quantum private information retrieval using phase-encoded queries, Phys. Rev. A, 2011
• Processing business data in Microsoft Azure, INGRID 2011 Workshop
• Web Browser History Detection as a Real-World Privacy Threat, ESORICS 2010

  (PDF)

  (Also: W2SP)

  (description)
  Slashdot, The Register, Heise, ...