Workshop preview: Putting Disclosures to the Test
By: Lorrie Cranor, FTC Chief Technologist | Aug 29, 2016 11:32AM

Continue Reading Workshop preview: Putting Disclosures to the Test
Workshop preview: Putting Disclosures to the Test
By: Lorrie Cranor, FTC Chief Technologist | Aug 29, 2016 11:32AM

Continue Reading Workshop preview: Putting Disclosures to the Test
A deep dive into mobile app location privacy following the InMobi settlement
By: Nithan Sannappa and Lorrie Cranor | Aug 9, 2016 12:55PM
In June, the Commission announced its first settlement with a mobile advertising network, InMobi. Among other things, the Commission’s complaint challenges the company’s location tracking practices. In this post, we explain the mechanism that the Commission alleges InMobi used to track users’ location without permission, and discuss technical steps that mobile operating systems have taken to try to address this practice.
Continue Reading A deep dive into mobile app location privacy following the InMobi settlement
By: Lorrie Cranor, FTC Chief Technologist | Aug 1, 2016 5:18PM
In order to protect consumers in our tech economy, we could use the help of some smart and creative technologists. That’s why I’m headed to Las Vegas this week with members of the Office of Technology Research and Investigation and other FTC folks to attend BSidesLV and DEF CON. We want to learn from security and privacy researchers and let them know about our research interests.
National Privacy Research Strategy outlines US privacy research agenda
By: Lorrie Cranor, FTC Chief Technologist | Jul 19, 2016 1:16PM
The White House recently released the first ever United States “National Privacy Research Strategy,” which identifies priorities for privacy research funded by the Federal government. While focused on government, the strategy is also intended to spur similar private sector efforts. I participated in the working group that developed the strategy and am excited to see it published.
Continue Reading National Privacy Research Strategy outlines US privacy research agenda
Your mobile phone account could be hijacked by an identity thief
By: Lorrie Cranor, FTC Chief Technologist | Jun 7, 2016 11:38AM
A few weeks ago an unknown person walked into a mobile phone store, claimed to be me, asked to upgrade my mobile phones, and walked out with two brand new iPhones assigned to my telephone numbers. My phones immediately stopped receiving calls, and I was left with a large bill and the anxiety and fear of financial injury that spring from identity theft.
Continue Reading Your mobile phone account could be hijacked by an identity thief
Tell us About Your Experiences “Putting Disclosures to the Test”
By: Lorrie Cranor | Jun 1, 2016 5:04PM
As we recently announced, the Federal Trade Commission will host a public workshop on September 15, 2016 to examine the testing and evaluation of disclosures that companies make to consumers about advertising claims, privacy practices, and other information. Our goal is to encourage and improve the evaluation and testing of disclosures by industry, academics, and the FTC.
Continue Reading Tell us About Your Experiences “Putting Disclosures to the Test”
Open Police Data Re-identification Risks
By: Lorrie Cranor, FTC Chief Technologist | Apr 27, 2016 3:31PM
Last week I spoke at a White House event “Opportunities & Challenges: Open Police Data and Ensuring the Safety and Security of Victims of Intimate Partner Violence and Sexual Assault.” This event brought together representatives from government agencies, police departments, and advocacy groups to discuss the potential safety and privacy impact of open police data initiatives.
Four upcoming opportunities to submit your research to the FTC
By: Lorrie Cranor, FTC Chief Technologist | Apr 8, 2016 2:02PM
Researchers, the FTC is interested in hearing from you! Last week we announced our Fall Technology Series on emerging consumer technology issues, and this week we announced our second PrivacyCon event. Both the technology series and PrivacyCon offer opportunities for researchers to submit work that informs questions the FTC is exploring.
Continue Reading Four upcoming opportunities to submit your research to the FTC
Time to rethink mandatory password changes
By: Lorrie Cranor, Chief Technologist | Mar 2, 2016 10:55AM

Privacy Day, internships, and a shout out to computer scientists
By: Lorrie Cranor, Chief Technologist | Feb 1, 2016 4:01PM
This year I celebrated Data Privacy Day on January 28 by attending the Privacy Day events at Carnegie Mellon University (CMU). It was a great opportunity for people to talk about privacy issues, hear about privacy research, and learn about some steps they can take to protect their privacy.
Continue Reading Privacy Day, internships, and a shout out to computer scientists
Some key takeaways from PrivacyCon
By: Lorrie Cranor, Chief Technologist | Jan 22, 2016 11:19AM
We had a great turnout both in person and online for the FTC PrivacyCon event last week. About 400 people attended in person and over 1,500 people streamed the video online. I enjoyed the opportunity to talk in person with a large number of participants.
Saying hello from the FTC's new Chief Technologist
By: Lorrie Cranor, Chief Technologist | Jan 13, 2016 4:19PM
I’m Lorrie Cranor, and I wanted to briefly introduce myself as the FTC’s new Chief Technologist and the new custodian of the Tech@FTC blog.
I’m excited to be joining Chairwoman Ramirez and the FTC team, and I’m looking forward to serving the FTC and consumers by helping to advance the agency’s understanding of evolving tech, privacy, and data security issues.
Continue Reading Saying hello from the FTC's new Chief Technologist
The virtues of strong enduser device controls
By: Ashkan Soltani, Chief Technologist | Aug 26, 2015 4:22PM

Continue Reading The virtues of strong enduser device controls
Enhancing permissions through contextual integrity
By: Nithan Sannappa, Division of Privacy and Identity Protection | May 21, 2015 1:25PM
This is the third post in my series on privacy and security in mobile computing, which builds on the Commission’s 2013 mobile security workshop. In my last post, I concluded that – despite a history of usability concerns – permissions in mobile operating systems are clearly an improvement over the opacity of traditional operating systems.
Continue Reading Enhancing permissions through contextual integrity
Usability and transparency considerations of permission-based access controls
By: Nithan Sannappa, Division of Privacy and Identity Protection | May 14, 2015 9:16AM
This is the second post in our series on privacy and security in mobile computing, which builds on the Commission’s 2013 mobile security workshop.
Continue Reading Usability and transparency considerations of permission-based access controls
Secure APIs and the principle of least privilege
By: Nithan Sannappa, Division of Privacy and Identity Protection | May 7, 2015 1:12PM
Editor’s Note: As noted in a previous post, Tech@FTC is expanding to include posts by other technically minded staff at the Commission. This is the first in a series of blog posts by Nithan Sannappa, an attorney in the Division of Privacy and Identity Protection, that will explore several important issues regarding user privacy and security in mobile computing.
Continue Reading Secure APIs and the principle of least privilege
Privacy trade-offs in retail tracking
By: Ashkan Soltani, Chief Technologist | Apr 30, 2015 11:59AM

Booting up a new research office at the FTC
By: Ashkan Soltani, Chief Technologist | Mar 23, 2015 11:00AM
Calling all Technologists! The FTC has job opportunities available in its newly formed Office of Technology Research and Investigation (OTRI), an office designed to expand the FTC’s capacity to protect consumers in an age of rapid technological innovation.
Continue Reading Booting up a new research office at the FTC
FTC.gov is now HTTPS by default
By: Ashkan Soltani, Chief Technologist | Mar 6, 2015 11:00AM
In another step to enhance the FTC’s website, I'm pleased to announce that our agency has enabled encryption by default (HTTPS) for ftc.gov, our primary public domain, and home of the Tech@FTC blog. Ironically, as I was preparing this post, the entire internet has been FREAKing out about another vulnerability in SSL.
What’s the security shelf-life of IoT?
By: Ashkan Soltani, Chief Technologist | Feb 10, 2015 5:08PM
The FTC released a staff report in late January that took a comprehensive look at the emerging “Internet of Things” and security, including secure APIs, authentication, and product updates, was a key theme.
I’d like to briefly explain why I believe IoT security is so important and why the IoT ecosystem presents a unique set of factors that give rise for special attention to security.