On May 25, 2018 the European Union's General Data Protection Regulation (GDPR) came into effect, bringing with it the most expansive governmental effort to regulate data security and privacy to date. Among the GDPR's many provisions is the "Right of Access," which states that individuals have the right to access their personal data. This provision can be easily abused by social engineers to steal sensitive information that does not belong to them.
My research centers on a practical case study wherein I attempted to steal as much information as possible about my fiancé (with her consent) using GDPR Subject Access Requests. In a survey of more than 150 companies, I demonstrate that organizations willingly provide highly sensitive information in response to GDPR right of access requests with little or no verification of the individual making the request. This ranges from typical sensitive identity data like addresses and credit card information to esoteric data such as a history of train journeys or a list of domains owned. While far too often no proof of identity is required at all, even in the best cases the GDPR permits someone capable of stealing or forging a driving license nearly complete access to your digital life. Moreover, the highly standardized nature of GDPR requests makes it possible to automate this process at immense scale and provides one of the most reliable general phishing attack typologies to date.
This is a solvable problem, and one which could have been incorporated into the initial GDPR if regulatory legislation were subjected to security assessments like those used for modern software. The presentation suggests possible remediations and offers a cautionary tale for future policymakers designing GDPR-inspired privacy legislation. It also suggests short-term ways in which individuals and businesses seeking to protect themselves against these attacks.
James Pavur is a Rhodes Scholar working on a DPhil in cybersecurity at Oxford University's Department of Computer Science. His academic research focuses on threats to satellite systems. Prior to Oxford, he attended Georgetown University where he graduated in 2017 as valedictorian from the Walsh School of Foreign Service with a degree in Science, Technology, and International Affairs. In addition to various D.C. internship experiences in cybersecurity ranging from fighting cyber-crimes with the US Postal Service to auditing air-conditioners for the General Services Administration, he also served as the principle security decisionmaker for Students of Georgetown Inc., the world's largest entirely student run non-profit. He is an avid hackathon competitor and recently won first place at the EOS Global Hackathon in London for a security platform that protects distributed blockchain applications and their users from malicious exploitation. Outside of computers, James enjoys flying kites and collecting rare and interesting teas.