Data exhaust is all the information that is generated as a byproduct of our online activities. It is the data that is not part of what we are doing online but generated because of it, often without us realizing it. In an era where internet of things (IoT) devices—from virtual assistants and smartphones to coffee makers and washing machines—are ubiquitous, data exhaust is particularly troublesome. Many IoT device users have no idea how much data is being generated, how it is being collected and what it is being used for. This comes with significant risks.

The Challenge

“Data exhaust is an area where we are all at risk, from the largest corporations to individuals at home and governments all over the world,” says Kevin de Snayer, Director of Technology Solutions and Critical Infrastructure at Calian. “We have all experienced the situation where you Google something you are interested in—new shoes, a book, a car—and then, boom, your ads on all media are based on those searches, on devices and applications you believed to be completely unconnected to your search. And maybe that is not all bad. If I am searching for new shoes, well then great, I am getting ads from shoe companies and not watch companies.”

But de Snayer warns that this collection of your data could also be used to create a digital profile of you, your company, your friends, family, co-workers, etc., to be used for nefarious purposes. “A company could access that data to make a hiring/promotion decision on information that they are not supposed to have—your current health, your political affiliations, your hobbies,” he warns.

From a corporate or public sector perspective, data exhaust can be an even larger risk, says de Snayer. Data exhaust can be used for social engineering, tricking employees into sharing their credentials to gain access to a company’s network and data.

It’s not just companies and individuals who are at risk. This data can then be used to raise funds to support rogue nations or fund crime circuits, and then nationstates can use the data as a path to beat national and international security, adds de Snayer. Data exhaust poses significant risks to the world at large.

The Solution

Recognizing that more research needs to be done to address these risks, Calian and Dalhousie University are collaborating on a three-year research project to study data exhaust from IoT devices and find solutions to mitigate the risks associated with it. The goal of the project is to understand how much information a malicious person will be able to access through leaked data, says Nur Zincir-Heywood, Distinguished Research Professor and Associate Dean of Research in the Faculty of Computer Science at Dalhousie University, and the chief researcher on the project. The project team also includes two post-graduate students from Dalhousie, and de Snayer and Terri Dougall, (who is Vice President, ESG and Industrial Development) from Calian.

Once the researchers gain a better understanding of the data collection ecosystem, they will create recommendations for how to use and how not to use IoT devices and try to predict what type of data is leaking and at what times. “If we can predict that, then maybe it can help us to choose how and when to connect, what to buy and what not to buy,” says Zincir-Heywood. The team will also try to develop recommendations on how to connect IoT devices more safely.

The Result

“As we get a better understanding of data exhaust of what is being leaked, how is it accessed, who is using it, what devices and applications are at most risk and how to protect against the problem, we can use this information to educate people, improve processes and better understand technologies,” says de Snayer. “We can ultimately pass that information on to others to create an overall improved security posture in Canada and beyond.”

Calian is providing funding, but also bringing real-world experience to the project. “It’s been wonderful working with Calian,” says Zincir-Heywood. “At every step of this research there is a wonderful collaboration. And they are giving us the flexibility to be able to explore all the different things that we are identifying.”

The partnership with Dalhousie University has provided a new discussion path for Calian and its customers who are keen to understand the risks of IoT applications and how to best plan for a future that includes gateways for intruders to exploit their data.