Awareness Portal for Individuals

Making Sense of Privacy & InfoSec

As an individual in today’s digital world, each of us in constantly dealing with digital risks – via our devices (smart phones, tablets, laptops, smart devices, etc) as well as the Apps and Online sites we use. The fear of our devices getting attacked, our data getting stolen or misused, our activities and movements being tracked and profiled, and so on… while the list is endless, the risks are real. At the same time, the conveniences and advantages that the usage of these bring into our lives is immeasurable. So how do we balance the two realities?

One way of doing that is by ensuring we become ‘smart’ users. Understand the risks and deal with them accordingly.

This Arrka Awareness Portal has been set up to help you become digitally smart and equip you with content and tools that would help you manage your personal digital risks better.

The first in this series is to help you understand what ‘Tracking and Profiling’ is all about – how it happens, the techniques used for this and how you can be ‘smart’ about it.

Understanding Tracking and Profiling

Imagine this scenario: You want to buy a small coffee table for your living room. You decide to search for such furniture online. You google for it and you get a list of stores that have coffee tables similar to the one that you are looking for. You note the prices offered by one or two sites and get busy with your daily chores. A short while later, you pick up your mobile and you see multiple SMSes from various online furniture stores including the ones you shortlisted. You also receive a call from a nearby store saying that they have a sale of furniture going on and if you are interested, you could walk down and take your pick. In the evening you visit your Facebook page and you start seeing Ads of furniture on the side bar. You are also shown promotional pages of a few furniture sites. Finally, you decide to walk down to the furniture store that has the sale going on and see the choices you have.

Does this sound familiar? Do you feel as though you are being watched?

This happens because the activities that you do online via your laptop or mobile or other devices, are tracked. Each Application that you access collects certain information about you even when you do not enter any personal information online. This Personal Information or data collected from devices is used to build your detailed profile and identity, used to track you, predict your movements and behaviour and to ultimately influence your thoughts, opinions and ideas.

How is this done? Read on to know more.

Device Permissions and Tracking Mechanisms

When you download and install an App or when you run an App on your mobile device, it asks for your permission to access certain data or information on your device. Something like the message below

Whenever any App needs access to your personal data stored on your device such as your contact list, your camera, your location, your SMS etc it needs to take your ‘permission’. This is to ensure that your privacy is maintained and your personal data is not being used by the App without your consent. Apps collect personal data through such ‘permissions’ to provide you their services. Some Apps use permissions as a means to gain access to additional personal data which may not be required by them to provide their core services. For example, a food delivery app could request access to your media files which are not required for providing you its basic service – that of food delivery. Some App Owners have genuine interest of the users in mind and use only the permission they require to provide their service, others try to get access to additional information to store this data for later use or to share this information with their partners and other companies who may be interested in knowing it to sell you their products or services.

In case of Web Applications, cookies and other tracking mechanisms like ETags, web beacons, etc are used to track your online behaviour. These are explained in detail later on this page.

Another important fact we need to know is that it is not just the organization who’s App or Website you access that gets hold of your data. Most of the Apps and websites have other external parties embedded in them. So the personal data collected is not only available with the application owners (first parties) but also with these external parties (third parties). These third parties use the information for their own purposes. Most users are not aware of the presence of these third parties.

Therefore, in order to protect your privacy and have control over your data, you need to be very careful while granting permissions to Applications. The data that they can give away about you is very personal and if it gets into the wrong hands, it can be dangerous for you.

Understanding Important Permissions and Tracking Mechanisms:

Given below is a list of the key permissions on Android and IOS platforms that are used to collect Personal Data.

Android’s ‘Dangerous’ Permissions
Sl. No. Permission Description
1 Location This permission allows an App to access your device’s location and thereby know exactly where you are at any point in time. Apps like the taxi hailing apps or Apps that provide doorstep delivery of goods need your location information to deliver things to you at the location you are currently at. However, the challenge arises when Apps that don’t require to know where you are to offer their services take this permission and start tracking your location. The reason this is categorised as a dangerous permission is because whichever entity can track your location can, in effect, start understanding and predicting your typical daily movements, thereby building a detailed profile of you.
2 Camera This permission allows Apps to access your camera and capture images/video. There are a number of legitimate reasons for Apps requiring this permission. For example, Apps offering video calling or video conferencing need to access your camera. Or a banking app offering to complete a cheque payment transaction by asking you to take a photo of your cheque and upload it to the bank site. However, this permission can also be misused by apps – and hence is categorised as a dangerous permission
3 Contacts This permission allows the App to read and write into your contacts or address book. For example, instant messaging Apps use this permission to connect you to your contact and write messages to your contact. However, there are Apps that do not require this permission to offer their service to you but take this permission to get access to your contacts whom they could reach out to sell their products and services. By granting them permission not only is your privacy compromised but also of the people in your contact list.
4 Phone This permission allows an App access to six phone specific permissions: 1.     Allows the App to read phone numbers from your contact list.
2.     Allows the App to answer calls on your behalf with standard messages.
3.     Allows the App to initiate a phone call on your behalf without going through the Call Dialer. This means the App will not need additional confirmation from you to place a call through the App. Example, the Auto dialler App that calls selected numbers in case of emergency by the press of a button, uses this feature.
4.     Allows the App to access phone state, including the phone number of the device, current cellular network information, the status of any ongoing calls, and a list of any Phone Accounts registered on the device. This permission can be used to do a range of tasks like
- turning an application's sound off when a call comes in
- verifying the user/phone with IMEI information
- gathering your phone number etc.
5.     Allows the App to add voicemails into your phone system. In such an App, you will be able to record a voicemail and the App will play this to the caller when you are busy or not picking up your phone. It will be able to send voice mails on your behalf.
6.     Allows the App to use SIP (Session Initiation Protocol) service or voice over internet service. Apps that provide device to device call facility use this permission. Going through the list of access an App has when you grant this permission, it is critical that you verify if an App asking this permission provides you with call facility. If not, you have a high risk of losing control over phone calls besides compromising your privacy and of the people in your contacts.
5 Microphone This permission allows an App to record Audio/voice by accessing microphone audio device. Apps that provide voice calls between devices connected using the same App, use this permission. However, Apps with malicious intent, use this permission to get control over your audio recording device to transmit malicious data to your device via your speakers.
6 SMS This permission internally allows Apps five specific permissions:
1.     Allows to read your SMS
2.     Allows to send SMS on your behalf through the App
3.     Allows to receive SMS in the App
4.     Allows the App to monitor incoming MMS messages
5.     Allows the App to receive WAP Push messages. WAP Push messages are specially formatted SMS messages that display an alert message to you, and give you the option of connecting directly to a particular address via your mobile phone's browser. An example of message is shown below:

    Some Apps request for this permission to reduce your effort in drafting and sending SMS to concerned person or read you SMS to pick up required information and use it in the App. For example, some Apps pick up the OTP received from your banks and paste them in the App for further processing of transactions through the App. However, there are Apps that request this permission with an intent to gain access to your SMS data. They scan through your SMS and get access to sensitive information in the SMSs, like the OTP of bank in the earlier example. Hence it is categorised as dangerous permission.
7 Storage This permission allows an App to read or write to your external storage device like your SD Card. For example, Apps that allow you to access and store online documents request for this permission. Apps could also misuse this permission to go through all the data stored in your external storage and build a profile about you. They could also write malwares to your devices leading to corruption of data on these devices. Therefore, this permission is categorised as dangerous permission.
8 Calendar This permission allows an App to read or write to your calendar. For example, email Apps take this permission to access your calendar. Apps that do not require this permission to provide their service, request this permission to get information about your daily activities, schedules and build a profile about you.
9 Sensors This permission allows an App to access data from sensors that could measure what is happening inside your body, such as heart rate, your blood pressure, blood sugar levels etc. Apps that help monitor your health, like your heart condition and blood sugar levels, use this permission. This permission provides access to very sensitive information about your health that you would not like to be public information. Or be targeted by marketing mailers or calls from companies that sell health care products. Therefore, it is categorised as dangerous permission and you need to be very careful when you grant this permission to an App.  
10 Call Logs This permission grants an app three permissions:
1.     Allows the App to read your call log. That is, it allows the App to go through your call history. With this permission, it can identify number of calls made or received from a particular number.
2.     Allows the App to write to call log.
3.     Allows processing of outgoing calls. It allows the App to see the number being dialled during an outgoing call with the option to redirect the call to a different number or abort the call altogether.
Apps that provide call dialer facility use this permission. However, other Apps could also request this permission with an intent to get information about whom you call frequently, how long your calls last, which caller you avoid speaking to etc. This information helps them to know who are your favourites and their numbers. These people could be contacted to influence your opinions and views or be targets for their own products and services using you as a pawn.
      IOS Permissions  
Sl. No. Permission Description
1 Contacts This permission allows access to your contacts from the phone book or sends messages to your phone contacts. Apps that provide instant messaging services, request this permission. However, there are Apps that do not require this permission to offer their service to you but take this permission to get access to your contacts whom they could reach out to sell their products and services. By granting them permission not only your privacy is compromised but also of the people in your contact list.
2 Calendars This permission allows Apps to save event details in your calendar and give automatic calendar reminders. Apps that provide Email service require this permission. However, there are Apps that seek this permission to get information about your daily activities, schedules and build a profile about you.
3 Reminders This permission allows Apps access to read reminder section of calendar. These Apps may not be able to save events in calendar. For example, Apps that provide you with ‘To do List’ or Reminders facilities, use this permission. This is another permission that could be used by some Apps purely to get information about your daily activities, schedules and build a profile about you.
4 Photos This permission allows access to photo storage library to access and store photos. Apps that allow photo share or allow you to click photos, use this permission. As this permission allows access to your photos, any App that is granted this permission could use it to analyse and build your profile based on your likes, dislikes, the places you visit or people you hang out with. Apps with malicious intent could misuse your photo to harm you or your reputation.
5 Speech Recognition This permission allows an App to recognise user speech. Smart speakers that are voice controlled, use this permission. Apps with malicious intent could use your speech to unlock any device that you might have locked using your voice command. Therefore, you need to be very careful about the App that you give permission to.
6 Media and Apple Music This permission allows an App to access your media library to save and retrieve media files. Apps that allow you to download and save music or audio/video files require this permission. You need to be careful when you grant this permission as access to your media folder gives access to your taste in music, movies, what programs you like to watch etc. This data when collected helps to build a profile about you and when further analysed provides more information about you that could be used to shape your views, for targeted advertisements to nudge you to download or buy media products.
7 Social media accounts, such as Twitter and Facebook This permission allows an App to access your social media accounts like Twitter and Facebook, Instagram within the App. Apps that help you to share your posts or views on your social media accounts, use this permission. However, there is high risk in granting this permission. When you allow Apps to access your social media accounts, you allow them to read through content in your social media accounts and also expose people in your connections on the social media. Apps with such access have exposure to your social media activities that could be analysed to build a profile about you and your connections.
8 Location Services This permission allows App to access your device location. For example, Apps that provide cab services or door step delivery of goods, request this permission. You can set the permission to
1.     ‘While using App’, so that an App can ask your permission when you run the App or
2.     ‘Always’ to allow an App to use the permission when it runs without explicitly taking your consent each time it runs or
3.     ‘Never’ to not allow an App to use this permission. You need to be careful about Apps you grant this permission to as Apps that don’t require to know where you are to offer their services could take this permission and start tracking your location. Whichever entity can track your location can, in effect, start understanding and predicting your typical daily movements, thereby building a detailed profile of you.
9 Camera This permission allows Apps to access your Camera. You can set the permission to
1.     ‘While using App’, so that an App can ask your permission when you run the App or
2.     ‘Always’ to allow an App to use the permission when it runs without explicitly taking your consent each time it runs or
3.     ‘Never’ to not allow an App to use this permission.   Apps offering video calling or video conferencing services, need to access your camera. Since the camera can also be used to monitor you when you are using the device and collect your behavioural data, it is prone to misuse by some Apps. Therefore, grant this permission to Apps cautiously.
10 Microphone This permission allows use of microphone for voice chat or sound recording through the microphone. You can set the permission to
1.     ‘Read and Write’ to allow an App to record and save sound or
2.     ‘Never’ to not allow an App to use this permission.   Apps that provide voice calls between devices connected using the same App, use this permission. However, Apps with malicious intent, use this permission to get control over your audio recording device to transmit malicious data to your device via your speakers. Therefore, you need to be cautious when granting this permission.
11 Bluetooth Sharing This permission allows an App to access Bluetooth feature of the device. Headphones, Speakers etc. that connect through Bluetooth to Apple devices need this permission. Bluetooth technology is based on pairing of devices and is prone to high security and privacy risk. The data being transferred or shared could be intercepted by other unintended Apps and could be used to get further details about you and your behaviour. This data could then be used to target you for other product and services.
12 Homekit If an App is smart home product and needs to provide user control on home blinds, doors and coffee through the App with the help of other Apple devices, Homekit permission is required by this App. This is a high risk permission and you need to be careful when granting this permission. An App that has this permission has full information about all connected devices at your home, your daily activities related to these devices. This information when monitored, collected and analysed gives insights into the behaviour of the entire family and not just you. This a very sensitive information with high risk of being misused to shape your and your family’s views.
13 Motion and Fitness Gives permissions to monitor motion and fitness activity of a person through the App. For example, Apps that provide fitness products uses this permission to track your activities, heart rate, quality of sleep and other personal metrics involved in fitness. This permission provides access to very sensitive information about your health that you would not like to be public information. Or be targeted by marketing mailers or calls from companies that sell health care products. Therefore, you need to be very careful when you grant this permission to an App.
14 HealthKit This permission allows App to connect, use and share data with Apple HealthKit (Health App). It lets you share your health record data, including allergies, conditions, labs, medications, vitals, and more saved in Health App with other Apps. For example, you could allow a Fitness App to connect to Health App through this permission. Just like with the Motion and Fitness permission, as you allow the App to access your sensitive health information, the App could misuse or share the information with other interested parties. Therefore, you need to be careful about which App you grant this permission to.
15 General Privacy Settings  
15.1 Advertising In privacy settings on your device, Apple provides you with option to either have a Limited Ad tracking or no tracking. In case you opt for Limited Ad Tracking you will see targeted advertisements that is, advertisements that may be relevant to you. However, both in case of Limited Ad tracking and no tracking, you will see same number of ads.
15.2 Analytics This privacy setting allows analytics information to be sent to Apple to help improve their products and services. You can see the data that is being sent by opening the log files listed below the settings. It also allows crash related analytical information to be sent to Apple developers.
  Web Application Permissions (Settings)  
Sl. No. Permission Description
1 Location This permission allows an application to access your device location. Applications that provide web mapping service, door step delivery of services etc, use this permission. In your browser settings, you have option to block a website from accessing your location information or make the website seek your permission before using the location information.
2 Camera This permission allows web applications to access camera of your device. For example, applications that allow facilitate you to make video calls need access to your camera when you do using these applications. In your browser settings, you have option to block a website from accessing your camera or make the website seek your permission before using the camera.
3 Microphone This permission allows applications to record Audio/voice by accessing microphone audio device. Applications that facilitate voice calls for this permission.
4 Notifications A notification is a message, email, icon or another symbol that appears when an application wants you to pay attention. An application can use notifications to let you know things that are happening when you're not using it, so you don't miss important information or activity that's taking place in the application. For example, you get email notification from your email application whenever you receive an email. Some applications track your activities through notifications. They monitor whether you have seen the notification, discarded the notification or accessed the content of the notification. This way they can build a profile about what type of notifications you view. This is useful information for them (or their associates) to determine what type of products or services could be targeted to you. In your browser settings, you have option to block a website from sending you notifications or make the website seek your permission before sending notification.
    Tracking Mechanisms  
Sl No. Tracking tool Description
1 Cookies Cookies are small amounts of data that are stored in separate files within your computer's Internet browser. Cookies are accessed and recorded by the websites you visit, and by the companies that show advertisements on these websites, so that they can recognize the same browser. Sometimes these cookies also contain personal information about you like your user id, your preferences of colour themes, options selected by you on a page etc. These information help to uniquely identify you and improve your experience when you visit the site again.   In cookie world, a first-party cookie refers to a cookie created by the domain that a web user is visiting. When a you access abc.com site from your web browser, for example, that browser sends a web request to abc.com as the first party. The web browser subsequently saves cookies to your computer under the “abc.com” domain.   The third party cookies owe their creation to a domain name that is not the principal domain name (the website in the address bar, abc.com in the above example). Advertising networks are the most common owners of third-party cookies. They use them to track a user across multiple websites, activities which they can then use to tailor their ads.  
2 ETags ETags or Entity Tags are part of HTTP, the protocol by which information is communicated from application server to browser. They exist to help browsers avoid loading the same data repeatedly. If you visit a webpage with an image, it will be downloaded and stored on your computer. If that image never changes, there is no need to download it again, but the browser needs some way of determining if the image has changed before it downloads the image. When the image is sent the first time, the server can send an ETag along with it, which the browser stores. The ETag is simply a number in an HTTP header field that identifies a unique version of the image. If the image stays the same, so does the ETag. ETag could also be used to track users by some companies. As ETag is a unique identification number, the company and other companies in its network can uniquely identify the user’s system that is visiting their sites. Just as in case of cookies, the information about the visits of the user collected over a period could be used to create a profile about the user.
3 Web Beacon A web beacon or web bug allows an application to check if a user has accessed some content. Common uses are email tracking and page tagging for web analytics.  Web beacon is a tiny graphic image that surveys a user's web activity. A web beacon is often contained in a 1X1-pixel graphic image found within an email or a website designed to track the internet activity of a targeted user. When a user visits a website or sends an email that contains a web beacon, that information is recorded for analytical purposes. On websites, it records a user’s IP address, how long a particular page was viewed and at what time, etc.   In an email, the web beacon records information whether the email was opened and viewed. Email marketers as well as phishers and spammers use web beacons to analyse who is clicking on what emails and to collect other email tracking details.  
Android - High-Risk Permissions   Android has classified some permissions as Normal as they have little impact on user’s privacy or on operations of other Apps. Unlike dangerous permissions, these permissions do not require user’s consent to use them and are granted on request by Android itself. However, there are few of these permissions that can still lead to device inefficiencies and security issues. Arrka has classified these permissions as High-Risk Permissions. Table below lists each permission, its description and why we consider it a High-Risk Permission.

Sl. No. High-Risk Permission Description
1 WAKE_LOCK This permission allows an App to prevent the device from going to sleep. Malicious Apps could use this permission to prevent devices from going into sleep mode so that they can continuously run malicious routines in the background. This could also lead to battery drainage. Therefore, this permission is classified as High-Risk permission.
2 DOWNLOAD_WITHOUT_NOTIFICATION When an App takes this permission, it can download without displaying any Notification to the user. Apps with malicious intent can download malware in background without the user knowing anything about it. Therefore, this permission is a High-Risk permission.
3 ACCESS_NETWORK_STATE This permission allows an App to view information about network connections such as which networks exist and are connected. Malicious Apps use it to spot available network connections so that they can perform other routines, like downloading a malware or sending malicious text messages over the other networks. This is the reason to classify this permission as High-Risk permission.
4 CHANGE_NETWORK_STATE This permission allows Apps to change network connectivity state. Malicious Apps can switch on these connections without your knowledge, draining your battery and adding to data charges. Therefore, this permission is classified as High-Risk permission.
5 GOOGLE_AUTH This permission allows Apps to view configured Google accounts. That is, it allows Apps to see the usernames (email addresses) of the Google account(s) you have configured. Apps can use this permission to get the email address used for Google accounts and create a database of email addresses. These email ids could then be used to contact for marketing of their own or third-party products and services. Therefore, this permission is classified as High-Risk permission.
6 GOOGLE_AUTH.wise This permission allows Apps to sign into Google Spreadsheets using the account(s) stored on your mobile device. This means that an App with malicious intent can secretly sign into Google Spreadsheets without informing you and collect any sensitive information like your financial information available in the spreadsheet. Therefore, this permission qualifies as High-Risk permission.
7 GOOGLE_AUTH.writely This permission allows Apps to sign into Google Docs using the account(s) stored on the Android device. This means that an App with malicious intent can secretly sign into Google Docs without informing you and collect any information from the documents. It is High-Risk if there is any sensitive information available in the Docs.
8 ACTIVITY_RECOGNITION This permission allows an app to receive periodic updates of your activity level from Google. For example, if you are walking, driving, cycling or still, the App could receive this information at defined periodic intervals. An App that takes this permission can, for example, collect this information over a period of time, analyse the data collected, build profile, identify patterns that could be used to target you to advertise and sell fitness products or services. Therefore, it is a High-Risk permission that uses personal information of an individual.
9 KILL_BACKGROUND_PROCESSES This permission allows App to kill any background process that it wants to. For example, when an App goes in a loop and is hanging for a long time, the App can initiate kill process stop process and release device resources. The problem here is, if the App does not carry out proper impact analysis of kill activity, it can lead to crash of other apps. Also, malicious Apps can kill any running process, including any anti-virus or anti-malware and then launch an attack. Thus it qualifies as a High-Risk permission.
10 launcher.WRITE_SETTINGS This permission allows an App to change the settings and shortcuts on your device Home screen. Apps with this permission can modify the settings of Android’s Launcher & icons. This is a High-Risk permission as, for example, an App could use this permission to place misleading icons on your Home screen to trick you to click on it. Once you click a malware could be downloaded on your device.
11 READ_SYNC_SETTINGS This permission allows an App to read the sync settings for an account. This means it can read how much synchronisation of data is completed/pending between the App and its server for an account. The App can also read the sync settings for any background sync to Facebook or Gmail, including the history of sync events and how much data is synchronized of an account.
12 WRITE_SYNC_SETTINGS This permission allows an App to modify the sync settings for an account. This means that an App can modify any sync settings of an account. This is High-Risk permission because an App can change the sync settings of various applications on the device. This means it can stop an antivirus application from updating its definitions from an online database or can stop an email App from showing you certain important mails.
13 REORDER_TASKS This permission allows App to reorder, reprioritise tasks. This permission is High-Risk because it could be used to display ads or malicious links on top of any App. It allows Apps to bring itself to foreground if running in the background. For example, suddenly an App running an ad can bring itself to foreground to force user to see it.
14 READ_USER_DICTIONARY Allows the app to read all words, names and phrases that the user may have stored in the user dictionary. This permission allows the application to read the stored words in the user's dictionary. As such this permission is not a High-Risk permission. But if a mobile user has saved sensitive information in dictionary, then it becomes High-Risk. For example, a mobile user could save his card numbers in dictionary to avoid the hassle of carrying the card around. In such case it would become a High-Risk permission.
15 WRITE_USER_DICTIONARY Allows the app to write new words into the user dictionary. This permission allows App to add custom words to your dictionary which can be used during auto-correct.
16 USE_CREDENTIALS This permission allows an App to request authentication tokens. An app with this permission can access an online service (such as Google, Facebook, or Twitter) in your name. This is a High-Risk permission as you could potentially lose control over your social media and other accounts.
17 MANAGE_ACCOUNTS This permission allows an App to perform operations like adding and removing accounts, and deleting their password. The Application with this permission can add, delete or edit the accounts in the Account Manager API (Application Program Interface) which stores account credentials and is used for auto-login feature. Such a powerful permission if misused can log you out of your device and can make all data on your device inaccessible. Therefore, it qualifies as a High-Risk permission.
18 READ_LOGS This permission allows an App to read from various system log files. This allows it to discover general information about various activities you do with your mobile device. This could potentially include your personal data. The system log files also include logs from other Apps installed on the device. This is a High-Risk permission as an App could get details of your activities through the log files and could use it to build information about you – what programs you watch, what other Apps you use etc. – to help them understand what they can sell to you. Or they could sell the information collected and analysed to interested third party.
19 WRITE_SETTINGS This permission allows an App to modify the system's settings data. Malicious Apps may corrupt your system's configuration by changing system settings as they please. Therefore, this is a High-Risk permission.
20 SUBSCRIBED_FEEDS_READ  Allows the app to get details about the currently synced feeds. An App can analyse the types of feed that you have subscribed to, this could help them understand your taste in reading and could be a useful information for promoting books and other materials in line with your interests. Hence it qualifies as a High-Risk permission.
21 DISABLE_KEYGUARD This permission allows an App to disable the keylock and any associated password security. For example, your mobile phone disables the keylock when receiving an incoming phone call and re-enables the keylock when the call is finished. This is a High-Risk permission as an App can request this permission and disable the keylock and any associated password security. In such situation, you will not be able to use your device as the keys will not work and the App would have total control of your mobile.