Do Your Smartphone Apps Invade Your Privacy?

Carnegie Mellon Offers an Online Report Card

PrivacyGrade.org Profiles More Than One Million Android Apps

News provided by

Nov 06, 2014, 10:18 ET

PITTSBURGH, Nov. 6, 2014 /PRNewswire-USNewswire/ -- Smartphones wouldn't be so smart without their apps, yet many free apps pinpoint a user's location to deliver targeted ads or share contact lists with third parties without alerting the user. Which apps behave themselves and which don't? A new Carnegie Mellon University project, PrivacyGrade.org, can help sort them out.

The site assigns letter grades to more than one million free Android apps, ranging from an A+ for the puzzle game Lazors to a D for the Despicable Me: Minion Rush game. The grades are assigned automatically using a privacy model that the researchers developed based on the preference ratings of 725 users.

"These apps access information about a user that can be highly sensitive, such as location, contact lists and call logs, yet it often is difficult for the average user to understand how that information is being used or who it might be shared with," said Jason Hong, associate professor in the Human-Computer Interaction Institute, who is leading the research project in the Computer Human Interaction: Mobility Privacy Security (CHIMPS) Lab.

"Our privacy model measures the gap between people's expectations of an app's behavior and the app's actual behavior," he said. "Most people expect apps such as Google Maps to be able to access their location, but most are surprised and troubled to learn that a game accesses their location."

In many cases, location information might be sold to companies that use it to target advertising or to analyze consumer behavior.

The final grade is based in part on an automated analysis of how an app uses sensitive data — whether it is essential for the app operation or whether it is shared with advertisers and marketers. And part of the grade is based on survey information about how comfortable users are with information being used in those ways.

Google Play, the site where Android apps can be downloaded, requires developers to specify what resources, such as location or device ID, each app uses. But even if consumers review that information, few are equipped to understand when such access is reasonable and necessary and when it might compromise their privacy.

PrivacyGrade goes further by examining which third-party code libraries make use of the resources tapped by the app. For instance, if the app accesses location data, PrivacyGrade checks to see if it is used by a library such as Google Maps, suggesting it is simply being used for mapping, or if it is being used by an advertising library, an indication that it will be used for targeted ads.

PrivacyGrade doesn't include paid apps because they receive much of their income from sales and therefore are less likely to seek income by selling user data to third parties. The CHIMPS team is considering adding iOS, Windows Mobile and Blackberry apps to the site as funding permits.

In addition to Hong, the research team included Song Luan, a Ph.D. student in electrical and computer engineering; Jialiu Lin, a former Ph.D. student in computer science who is now a privacy engineer at Google; Mike Villena, research programmer; and former research assistant Richmond Wong.

This research is support by the National Science Foundation (CNS-1228813), the Army Research Office (DAAD19-02-1-0389 and W911NF-09-1-0273), NQ Mobile and a Google Faculty Research Award.

Follow the school on Twitter @SCSatCMU.

About Carnegie Mellon University: Carnegie Mellon (www.cmu.edu) is a private, internationally ranked research university with programs in areas ranging from science, technology and business, to public policy, the humanities and the arts. More than 12,000 students in the university's seven schools and colleges benefit from a small student-to-faculty ratio and an education characterized by its focus on creating and implementing solutions for real problems, interdisciplinary collaboration and innovation. A global university, Carnegie Mellon has campuses in Pittsburgh, Pa., California's Silicon Valley and Qatar, and programs in Africa, Asia, Australia, Europe and Mexico.