Spotlight Scholar

Navigating Cybersecurity

Networking expert sees many sides of Internet privacy
  • UMass Amherst Professor Brian Levine in the staircase of the Information and Computer Science building.

“The tensions between what governments need to protect safety and to ensure justice, and the security and privacy citizens need online and from mobile devices, are coming to a head.”

—Brian Levine

Brian Levine wants to have a conversation with you about security and privacy. A network security expert and UMass Amherst professor in the College of Information and Computer Sciences (CICS), Levine sees the difficult tensions between protecting an individual’s online data, the use of it by private enterprise, and the need for governments to access information for law enforcement and homeland security, coming to a head.

“The Internet allows for the free exchange of information, but unfortunately, some of what people are exchanging is illegal. We feel we can’t exist without our mobile phones, yet we’re risking our privacy while using them. What interests me is dealing directly with these technical issues and trying to resolve the complications for society,” says Levine.

The recent legal wrangling between the Department of Justice and Apple to unlock the iPhone of one of the attackers in the 2015 San Bernardino, California, shooting rampage is an example of the problem. It’s a case where the right to privacy, data ownership, and corporate responsibility bump up against the government’s need to investigate crimes. Throw in the Fourth Amendment, which protects people, their property, and their personal effects from unreasonable search and seizure by the government, and you have a perfect storm of opposing positions.

“The whole iPhone issue is a very complicated one where few people knew all the details,” says Levine. “On the one hand, people have qualms about the government’s demand that Apple unlock the phone. On the other hand, the government has a responsibility to protect society. The facts are that people were murdered and the person who carried the phone has died. It was an employer-issued phone. That employer was the federal government. The government was asking Apple to give them access to their own phone,” says Levine.

Though difficult, Levine has experience reaching middle ground on Internet privacy. Building on his early research in peer-to-peer networking and file-sharing privacy, Levine began working with law enforcement to develop tools for criminal digital forensics, specifically research and technology that is used to thwart online sharing of child pornography and Internet-based child sexual abuse. With support from the Department of Justice and the National Science Foundation (NSF), his lab has produced a number of novel methods for forensic investigation.

“We’ve built tools for use by law enforcement that abide by the Fourth Amendment while allowing investigators to measure how big this problem is on a global scale. For example, we’ve found that over 600,000 unique computers are sharing child pornography per month worldwide,” says Levine.

According to CICS Dean Bruce Croft, investigators in every state make use of Levine’s research daily. “At least 350 children have been rescued from sexually abusive situations by U.S. law enforcement in the last three years using tools developed at UMass. Brian’s work has helped quantify the problem and has brought attention to this crime for policy makers, law enforcement, and the public,” says Croft.

The impact of Levine’s work is also felt worldwide. Thanks to collaborations with the Department of Justice and the Internet Crimes Against Children Task Force (ICAC), the tools developed in Levine’s lab are being used by law enforcement agencies in 24 other countries.

Levine’s recognition for his work is wide-ranging as well. He’s received over $2 million in funding from the Department of Justice during the last four years for research to thwart Internet-based sexual exploitation of children. Recently, he was awarded $150,000 from Operation Underground Railroad to assist law enforcement internationally in the hindrance of online child trafficking and the dissemination of child exploitation material. He’s also a sought-after speaker, having been invited to the office of the National Coordinator for Child Exploitation Prevention and Interdiction, where he spoke to a group of the country’s top federal law enforcement officials who investigate such crimes. Levine also gave a keynote address on Internet-based crimes against children at the 2015 Yahoo! Tech Pulse, an annual employees-only event of the company’s researchers and engineers.

Though criminal forensics is a large part of Levine’s current focus, privacy continues to be a research priority. Next on his radar: Internet mosaics.

“If someone were to follow you for say, 30 days, they can piece together this mosaic about your private life. They might see you visit one location and then several others. Put together, the observer can infer something about you that they couldn’t learn from a single trip,” says Levine.

The problem is that now they don’t need to physically follow you. Whether it’s the phone company that does it by analyzing your data, or whether it’s an advertiser whose ads follow you online and perhaps get your GPS information, digital mosaics raise privacy issues. It’s a legal issue right now according to Levine.

“Courts don’t know exactly what to do about it. If these mosaics, which are increasingly easy to discover because of technology, deserve privacy protections, there will be complications. We need to be thinking ahead on these issues” says Levine.

According to Levine, finding good solutions for Internet privacy and security requires an interdisciplinary approach. The need to cross disciplines, combined with the campus’s deep and broad expertise in data sciences, spurred creation of the UMass Amherst Cybersecurity Institute, which he directs. The Institute brings together dozens of internationally recognized faculty to address both the critical need for innovative security research as well as well-trained cybersecurity professionals.

“The institute is where we’re linking it all together. The goal is to increase our reach, our impact, and our visibility,” says Levine.

A $4.5-million grant from the National Science Foundation and $3 million from the Massachusetts-based MassMutual Foundation to support the institute will help Levine and his colleagues reach their goals. The federal money is being used to bring a CyberCorps® Scholarship for Service (SFS) program to the campus. In partnership with the Department of Homeland Security, CyberCorps SFS supports the educational and professional development of domestic students who will help the nation address threats to national security including critical infrastructure such as utilities, defense systems, and refineries. UMass Amherst is the first public university in New England to receive such an award. The private funds will support new research and education activities, such as the institute’s new Trust, Assurance and Cybersecurity Certificate program offered at the MassMutual Foundation/UMass Springfield Center for Training in Cybersecurity. The funds include support for new faculty hires to develop and teach the classes and to bring more research to campus.

“We are offering training to people in security, expecting they’ll come with backgrounds ranging from management to statistics. We are offering classes on policy, risk management, and computer science to broaden the government’s and industry’s ability to address cybersecurity challenges. Problems in security and privacy are no longer only technical gaps that can be solved with a better algorithm,” says Levine.

Karen J. Hayes '85