The UC Berkeley Center for Long-Term Cybersecurity (CLTC) is proud to announce the recipients of our 2022 research grants. In total, 11 different student-led research groups have been awarded grants to support initiatives related to digital security issues emerging at the intersection of technology and society.
The 2022 grants will support studies on such important topics as algorithmic detection and moderation of gender-specific online abuse, privacy regulation and compliance, the social and psychological implications of targeted advertising on individuals with stigmatized health identities, and the transaction costs associated with cybersecurity governance frameworks in smart cities, among others. (See below for a full list of the projects.)
“This talented group of student-led research teams are asking important, challenging research questions at the forefront of the field,” says Chris Hoofnagle, Faculty Director of CLTC. “These projects will make meaningful contributions to the world of cybersecurity practices, technologies, policies, and more. Congratulations to our 2022 grantees.”
CLTC has also awarded the the 2022 Cal Cybersecurity Research Fellowship to two UC Berkeley graduate students: Emma Lurie, a UC Berkeley PhD student in the School of Information, and Conor Gilsenan, a UC Berkeley PhD student in the Department of Electrical Engineering and Computer Sciences (EECS). Lurie’s research focuses on how the policy choices of platforms and government agencies shape the online election information infrastructure. Gilsenan studies the impact of more usable account recovery mechanisms on users’ adoption and acceptance of multi-factor authentication (MFA). The Cal Cybersecurity Research Fellowship is made possible by a generous gift from an anonymous donor.
In seven years of grantmaking, CLTC has seen cybersecurity challenges grow and evolve, along with the need for empirical research that aims to provide users and decision-makers with practical solutions. Many of the projects we have funded in previous grant cycles are yielding important results, including research on diversity challenges in the cyber talent pool, safeguards against adversarial machine learning, and the social and psychological impacts of misinformation.
We celebrate the 2022 projects outlined below, and invite those with interest in our work to review CLTC’s groundbreaking grant-supported research from 2016, 2017, 2018, 2019, 2020, and 2021. All our grants can be searched through our Grants page.
CLTC 2022 Research Grantees
Below are titles, lists of primary researchers, and abstracts for projects that will be funded through the UC Berkeley Center for Long-Term Cybersecurity’s 2022 research grants.
Algorithmic Detection and Decentralized Moderation for Protecting Women from Online Abuse
Sarah Barrington, Graduate Student, School of Information, UC Berkeley
Online abuse is becoming an increasingly prevalent issue in modern day society, with 41% of Americans having experienced online harassment in some capacity in 2021. People who identify as women, in particular, can be subjected to a wide range of abusive behavior online, with gender-specific experiences cited broadly in recent literature across fields such as blogging, politics and journalism. Compounded to this, present approaches to online safety, such as black-box content moderation and ambiguous platform community guidelines, are a growing area of concern for a broad group of stakeholders. Specifically, algorithms that curate and moderate content online are typically considered as “one size fits all,” and as such, can exhibit technological vulnerabilities that can be exploited, and in particular, be perceived to alter the online experiences of marginalized groups. The goal of this research is to build upon the findings of a previous foundational study and literature review in order to validate the feasibility of automatically detecting abuse ecosystem factors during female-targeted online harassment, with the ultimate goal of incorporating this into an effective moderation algorithm to protect women who may risk being further marginalized online.
Deadlines for International Cooperation in AI
Severin Perez, Graduate Student, School of Information, UC Berkeley
Artificial intelligence (AI) is a field that promises to fundamentally change human society. Researchers, policymakers, and practitioners largely agree that AI could provide immense benefit to humanity; however, it also poses significant risks. As we speed towards the former, we may inadvertently and irrevocably be committing ourselves to the latter.
Although our society is in the midst of a robust discussion about AI regulation, verification, and monitoring — all in the name of forestalling the risks associated with AI — many parties have yet to commit themselves to serious and verifiable boundaries in AI development. This raises an important question: when will it be too late? This project aims to answer that question by systematically reviewing the risks associated with AI, and our progress towards installing policy mechanisms to avoid those risks. In recognition of the global impact of AI, this research will focus on international cooperation between nation-states.
The product of this work will describe deadlines for international cooperation on AI. These deadlines will evaluate the risks from AI itself, as well as cultural risks that will make implementation of effective AI policy more difficult. By providing policymakers and researchers with deadlines, this research will help with policy prioritization and instill a sense of urgency in discussions around AI policy.
Fairness in Cybersecurity Insurance Contracts
Yoon Lee, PhD Candidate, Industrial Engineering and Operations Research, UC Berkeley
A limitation of existing approaches for incentive design in cybersecurity insurance contracts (CIC) is that they do not incorporate fairness. Fairness is crucial for incentives because improper design can harm people of certain classes (e.g., race or gender). In this study, we develop optimization problems for CIC design that incorporate notions of fairness into the model. The technical difficulty is that existing definitions of fairness are specialized to statistics and not to CIC. Hence, we formulate quantitative notions of fairness in the settings of principal-agent models and cybersecurity. Our model is then evaluated by theoretically studying the properties of these new definitions and empirically verifying their external validity. We also explore these definitions from both game-theoretic and stochastic perspectives to ensure that these definitions satisfy qualitative properties consistent with fairness. In order to mitigate the risk when some quantifications of fairness do not satisfy all the desired qualities, we propose multiple quantitative definitions, which encapsulate the entire range of qualitative properties. Furthermore, we analyze numerical well-posedness of the quantitative definitions of fairness for CIC by examining whether optimization problems involving our novel definitions satisfy relaxed constraint qualification. To achieve this, we leverage techniques from variational analysis and optimization theory to study the mathematical structure of the constraints resulting from incorporating fairness.
Increasing the Usability of Multi-Factor Authentication (MFA) Recovery Mechanisms
Conor Gilsenan, PhD Student, Electrical Engineering and Computer Sciences, UC Berkeley
Multi-factor authentication (MFA) — logging in with a combination of at least two of something you know, something you physically have, or something you are — has consistently been shown to drastically increase the security of online accounts compared to the use of a password alone. Though many online services offer one or more of the prevalent methods of MFA, adoption rates among consumers remain alarmingly low. Research into the security and usability of various MFA methods has consistently found that users are worried about account lockout in the event that they lose their primary authenticator (i.e., their phone or other device). To prevent legitimate users from getting locked out of their accounts, many sites recommend that users enable multiple different methods of MFA, which is both cumbersome and, counterintuitively, can negatively impact the overall security of the account. Our hypothesis is that MFA adoption can be increased through the deployment of more secure, private, and usable account recovery options. To that end, we are investigating the processes and tools that people use to recover in the real world, starting with the backup mechanisms in time-based one-time password (TOTP) authenticator apps, a widely deployed method of MFA.
Investigating the Compliance of Android App Developers with the California Consumer Privacy Act (CCPA)
Nikita Samarin, PhD Student, Electrical Engineering and Computer Sciences, UC Berkeley; Jordan Fischer, Lecturer, School of Information, UC Berkeley; Primal Wijesekera, Staff Research Scientist, Electrical Engineering and Computer Sciences, UC Berkeley
The California Consumer Privacy Act (CCPA) provides California residents with a range of enhanced privacy protections and rights. Our project aims to investigate the extent to which Android app developers comply with the provisions of the California Consumer Privacy Act (CCPA) that require them to provide consumers with accurate privacy notices and respond to consumers’ “right to know” requests by disclosing personal information that they have collected, used, or shared about them for a business or commercial purpose. In doing so, we aim to understand whether the information provided by developers in privacy notices and in response to “right to know” requests is complete and accurate, and whether the response accurately explains how this data has been collected, used, and shared.
Practical Pre-Constrained Cryptography (Or: Balancing Privacy and Traceability in Encrypted Systems)
James Bartusek, Graduate Student, Electrical Engineering and Computer Sciences, UC Berkeley; Abhishek Jain, Associate Professor, Computer Science, Johns Hopkins University; Guru Vamsi Policharla, Graduate Student, Electrical Engineering and Computer Sciences, UC Berkeley
As end-to-end encrypted storage and messaging services become widely adopted, law enforcement agencies have increasingly expressed concern that such services interfere with their ability to maintain public safety. Indeed, there is a direct tension between preserving user privacy and enabling content moderation on such platforms. Recent research has begun to address this tension, proposing systems that purport to strike a balance between the privacy of “honest” users and the traceability of “malicious” users. Unfortunately, these systems all suffer from a lack of protection against malicious or coerced service providers.
This project will address the privacy vs. content moderation question through the lens of pre-constrained cryptography (Ananth et al., ITCS 2022). We will introduce the notions of set pre-constrained (SPC) encryption and SPC group signatures, and formulate rigorous security properties of SPC cryptosystems that in particular encompass security against malicious key generators. We will demonstrate that SPC encryption is useful for encrypted cloud storage services that offer built-in detection for harmful content, such as child sexual abuse material (CSAM), and that SPC group signatures are useful for encrypted messaging systems that offer the ability to trace users who originate harmful content. Our security properties that hold against malicious key generators directly correspond to security against malicious service providers in the above applications.
We will construct concretely efficient protocols for SPC encryption and SPC group signatures, and demonstrate the real-world feasibility of our approach via an implementation of our SPC group signatures. The starting point for these protocols is the recently introduced Apple PSI system, which we will significantly modify to improve security and expand functionality.
PrivGuard: Privacy Regulation Compliance Made Easier
Lun Wang, PhD Candidate, Electrical Engineering and Computer Sciences, UC Berkeley; Xiaoyuan Liu, PhD Student, Electrical Engineering and Computer Sciences, UC Berkeley
Privacy regulation compliance is becoming a burden for most companies due to the high cost and inefficiency of human auditing. We propose a regulation enforcement framework, PrivGuard, to reduce the cost and improve productivity by partly replacing human-auditing with a static analyzer. One open challenge is that the static analysis itself cannot defend against malicious insiders. We plan to integrate dynamic analysis to patch this vulnerability and deploy PrivGuard through collaboration with industry partners.
Robust Object Classification via Part-Based Models
Chawin Sitawarin, PhD Student, Computer Science, UC Berkeley
Robustness becomes one of the most desired properties in machine learning (ML) models due to their increasing adoption in safety/security-sensitive settings. Most attempts to train robust methods against adversarial manipulation rely on expensive robust optimization and a large amount of data. As a result, they are difficult to scale and yield limited improvement, especially when data are scarce. This work addresses these issues with a novel solution by incorporating human-guided knowledge into the architecture design and training objectives. As a first step, we propose part-based models, which first recognize parts that make up specific objects and then combine this high-level information to make a final prediction. Our model aligns better with human perception as it incorporates a hierarchical structure that recognizes simple shapes and parts before moving up to complex objects. This structure also reduces complexity of the overall task, allowing the model to be smaller and less data-hungry, which in turn makes adversarial training more efficient and effective. Additionally, our defense can make use of the orthogonal advancement on robust training and shed light on a broader scientific question around inductive bias in deep learning.
The Tyranny of Relevancy: Investigating the Effects of Targeted Fertility Ads on Individuals Grappling with Infertility
Seyi Olojo, PhD Student, School of Information, UC Berkeley
Our study aims to investigate the social and psychological implications of targeted advertising on individuals with stigmatized health identities. With nearly every user on social media platforms encountering personalized advertising, the personal data economy has become a major component of our everyday lives. This use of personal data, especially as it pertains to health, presents both security and psychological risks to users. We will specifically seek to understand how individuals grappling with infertility respond to targeted ads and what sensemaking strategies these individuals use to articulate instances of harm over time. Additionally, we hypothesize that online behavioral patterns that reflect stigmatized biosocial identities receive more targeted ads claiming to attend to these identities more than online behavioral identities that do not display behaviors related to a stigmatized biosocial identity. We aim to use a sequential mixed-methods approach that will include an interview study, diary study, and an experiment. The experiment will utilize web crawler bots that are programmed to complete relevant tasks, such as views and clicks, to determine if behaviors exhibiting a particular health status garner online advertising that claims to attend to that particular status. Ultimately, this research seeks to explore the ways in which structural violence is materialized within online behavioral targeting.
Transaction Costs of Cybersecurity Governance in Smart City Initiatives
Dagin Faulkner, PhD Candidate, City and Regional Planning, UC Berkeley
Smart cities lie at the evolving intersection of people and digital technologies. Establishing cross-sector cybersecurity protocols that treat the smart city as an interdependent assemblage of activities entails more than addressing the costs associated with responding to cyberattacks. This research proposal seeks to answer the question: What are the transaction costs associated with developing and implementing cybersecurity governance frameworks, such as third-party data trusts, in smart cities? Smart city scholarship includes discussions on third-party data trusts as data governance mechanisms (Andrade et al., 2020; Valverde and Flynn, 2019) and empirically, there are examples of such data trusts in practice in Spain and Estonia (Barcelona Digital City, CityOS; Digital Governance Proposals Draft Report, Sidewalk Labs, 2018). The results of this proposed study could then be used as part of efforts to estimate the total costs of smart city initiatives and contribute to more robust evaluations of cybersecurity management in urban settings. To investigate the research question, will employ a mixed-methods case study-based approach, using transaction cost analysis (Whittington, 2012; Siemiatycki, 2011), semi-structured interviews, and document analysis. The results of this work will contribute to theory development in urban governance and cybersecurity scholarship, particularly given the understudied nature of transaction costs associated with third-party data trusts. This is all the more important as recent research regarding third-party trusts as technology governance mechanisms suggests that their presence will persist, especially in Europe and the US (Andrade et al., 2020; Cybersecurity Futures 2025, 2019).
Understanding Governance, Values, and Identity in the Online Election Information Infrastructure
Emma Lurie, PhD Student, School of Information, UC Berkeley
In the United States, people are increasingly turning to online sources to find information about elections. Election information includes everything from mail-in ballot instructions to candidate Facebook page posts. In the U.S., as well as around the world, online misinformation threatens democratic systems. Politicians, technology companies, journalists, and voters all understand the importance of high-quality online information to fair and trustworthy democratic processes. This project defines a strong online election information infrastructure as one that is robust to malevolent actors and enables constituents to easily identify important information. This project acknowledges that the current online election infrastructure is intricately related to technology platforms (e.g., social media sites and search engines). This research considers how the technical and policy choices of platforms, government agencies that support election administration, and civic organizations shape the online election information infrastructure; and how the misinformation they produce is interpreted by specific marginalized communities with legacies of voter disenfranchisement and shapes their trust in elections.
