Building an Automated Machine for Discovering Privacy Violations at Scale

Note: Presentation times are in Pacific Standard Time (PST).

Thursday, January 26, 2023 - 11:30 am12:00 pm

Suchakra Sharma, Privado Inc.

Abstract: 

While the most advanced digital watch in 1980 asked us to manually enter and store our phone book on the watch, modern smartwatches are sending our GPS location pings and heartbeat each second to unknown cloud machines which you know nothing about! To tackle this information void of where our data flows, various regulations and privacy frameworks have been developed. While there are multiple stakeholders such as lawyers and privacy officers in privacy conversations, the onus falls on the developers to eventually write code that respects those regulations - or fix issues that got introduced. In this talk we discuss how tried and tested static analysis techniques such as taint tracking and dataflow analysis can be used on large code bases at scale to help fix privacy leaks right at the source itself. What does it take to build such tooling? What challenges would we face and how can you, a developer or a privacy engineer fix privacy bugs in code!

Suchakra Sharma, Privado Inc.

Suchakra Sharma is the Chief Scientist at Privado where he helps build code analysis tools for data privacy and data security. He completed his Ph.D. in computer engineering from École Polytechnique de Montréal where he worked on eBPF technology and hardware-assisted tracing techniques for OS analysis. For the last six years, Suchakra has been working on enhancing static analysis tooling for fixing security bugs at scale. He has delivered talks and trainings at venues such as USENIX LISA, SCALE, RSA Conference, BlackHat, Papers We Love, etc. When not playing with computers, he develops film photographs and writes poems.
BibTeX
@conference {285643,
author = {Suchakra Sharma},
title = {Building an Automated Machine for Discovering Privacy Violations at Scale},
year = {2023},
address = {Santa Clara, CA},
publisher = {USENIX Association},
month = jan,
}