Balancing individual privacy with national security needs will continue to be a major challenge in the years to come. Annie Antón has been working on these dual objectives since the 1990s, when she was a graduate student at Georgia Tech.

“I realized then that security and privacy were both essential goals for modern computing systems,” said Antón, who returned to Georgia Tech in 2012 as chair of the School of Interactive Computing.

Antón, who presented her first privacy and security papers before the 9/11 attacks, is part of a National Research Council committee on Foundational Science in Cybersecurity. She is on security and privacy advisory boards for major corporations and has served on the Department of Homeland Security Data Privacy and Integrity Advisory Committee. She recently appeared on C-SPAN for her testimony on the role of technology and privacy in fighting terrorism.

Antón’s current research focuses on how to create systems that actually comply with regulatory, security, and privacy requirements. 

This work is particularly relevant today, considering the rapid growth of the Internet of Things, which allows for communication among everyday devices such as Fitbit Trackers, smart thermostat systems, and washers/dryers that use Wi-Fi for remote monitoring.

As information for these devices is collected and stored, big data analytics will process this information and infer things about us.

“Security and privacy will need to be baked in from the start,” she said.

—​​Annie Antón chairs the School of Interactive Computing in the College of Computing.

 

Securing the new cyberspace revolution

We are in the midst of a revolution in cyberspace that could be as transformative as the emergence of the Internet. The most significant difference between this revolution and that of the emergence of the Internet is that the current revolution gives computing systems an unprecedented amount of control over individuals and critical infrastructure.  As such, computer engineers play a key role in ensuring maximum benefit from technologies while also ensuring that systems operate safely.

One goal of the Georgia Tech Communications Assurance and Performance Group is to develop algorithms that enable a more secure and efficient current and future network infrastructure, with computer systems that are more accountable and less vulnerable to attacks and abuse.  

Our efforts focus on areas that are critical to the success and security of the so-called Internet of Things (IoT) and cyber physical systems (CPS), says Raheem Beyah, an associate professor in the School of Electrical and Computer Engineering who leads the Communications Assurance and Performance Group.

IoT is comprised of everyday devices — such as irons, toasters, and thermostats — that are wirelessly connected and work to improve our quality of life. CPS deals with the use of cyberspace to manage and monitor existing physical systems, such as power grids, oil and gas generation, and distribution systems.

To improve security in these areas, we are working to understand the behavior of these systems to prevent misuse, secure the wireless networks IoT devices use to communicate, and ensure information is exchanged in a manner that preserves privacy, Beyah said. The impact of IoT and CPS on society will be tremendous, which is why we must keep it secure, he added.

—​Raheem Beyah, an associate professor in the School of Electrical and Computer Engineering, leads the Communications Assurance and Performance Group.

 

Attacking botnets before they attack the Internet

Large-scale attacks on the Internet are typically launched using a botnet, which is a large number of infected machines under the control of an attacker.

Wenke Lee, who directs the Georgia Tech Information Security Center, and his research group are leaders in botnet detection, and were among the first to work on this problem starting in 2005.

They have focused on the key characteristics of botnets — for example, the need for a command-and-control infrastructure — that separate them from the previous generations of Internet-based attacks. They have developed and deployed several algorithms and have demonstrated their effectiveness in early-warning, detection, and attribution of Internet-scale attacks.

More importantly, their work has had a significant practical impact. In 2006, Lee co-founded Damballa Inc., which focuses on delivering anti-botnet technologies to enterprises, and now has about 90 employees. It counts all major Internet service providers in the U.S. and many Fortune 500 companies as its customers.

Lee’s group was the first to conduct a systematic study of the security of iOS as well as Apple’s app review and management process. While many in the industry and academia believe that iOS is (almost) immune to malicious programs, their work showed that it is possible to inject malicious code on iOS devices, and even create an iOS botnet. Their work revealed a number of vulnerabilities in iOS and has led Apple to implement several security improvements. 

—​Wenke Lee, a professor of Computer Science in the College of Computing, directs the Georgia Tech Information Security Center.

 

In August 2013, less than a week after joining the faculty at Georgia Tech, Peter Swire was tapped to serve on President Barack Obama’s Review Group on Intelligence and Communications Technology. Swire became one of the five authors of a major report that was issued that December.

The work on the Review Group is part of Swire’s two decades of research and government service on issues of cybersecurity and privacy. He previously served as chief counselor for privacy under President Bill Clinton, where cybersecurity topics included encryption, intrusion detection for federal systems, and how to update wiretap laws for the Internet age. In the subsequent decade, Swire served on security advisory boards.

This year, he is teaching a privacy course and one on “Information Security Strategies and Policy.” Among his multiple research projects, he’s looking at how to refine the debate about when information sharing should take place for cybersecurity. 

“As personal data flows everywhere, security issues are everywhere as well,” Swire said.

He’s also looking at how well secrets will be kept in the future, noting the effect of the “declining half-life of secrets” on the workings of intelligence agencies.

“Today’s cyber realities mean people and government on the outside can find out what the agencies are doing,” Swire said. “We’re going to have to get used to a world where we can’t keep things classified for 25 or 50 years and assume they are going to stay hidden.”

—​​Peter Swire is the Nancy J. and Lawrence P. Huang Professor of Law and Ethics in the Scheller College of Business.