The High-School Profiling Attack: How Online Privacy Laws Can Actually Increase Minors' Risk

Lawmakers, children's advocacy groups and mod- ern society at large recognize the importance of protecting the Internet privacy of minors (under 18 years of age). Online Social Networks, in particular, take precautions to prevent third parties from using their services to discover and profile min ors. These precautions include banning young children from joining, not listing minors when searching for users by high school or city, and displaying only minimal information in registered minors' public profiles, no matter how they configure their privacy settings. In this paper we show how an attacker, with modest crawl- ing and computational resources, and employing simple data mining heuristics, can circumvent these precautions and create extensive profiles of tens of thousands of minors in a targete d geographical area. In particular, using Facebook and for a given target high school, we construct an attack that finds most of t he students in the school, and for each discovered student infers a profile that includes significantly more information than i s available in a registered minor's public profile. An attacke r could use such profiles for many nefarious purposes, includi ng selling the profiles to data brokers, large-scale automated spear- phishing attacks on minors, as well as physical safety attacks such as stalking, kidnapping and arranging meetings for sexual abuse. Ironically, the Children's Online Privacy Protection Act (COPPA), a law designed to protect the privacy of children, indirectly facilitates the attack. In order to bypass restr ictions put in place due to the COPPA law, some children lie about their ages when registering, which not only increases the exposure for themselves but also for their non-lying friends. Our analysis strongly suggests there would be significantly less privacy leakage in a world without the COPPA law. I. I NTRODUCTION