skip to main content
10.1145/3485447.3512223acmconferencesArticle/Chapter ViewAbstractPublication PagesthewebconfConference Proceedingsconference-collections
research-article

Et tu, Brute? Privacy Analysis of Government Websites and Mobile Apps

Published: 25 April 2022 Publication History

Abstract

Past privacy measurement studies on web tracking focused on high-ranked commercial websites, as user tracking is extensively used for monetization on those sites. Conversely, governments across the globe now offer services online, which unlike commercial sites, are funded by public money, and do not generally make it to the top million website lists. As such, web tracking on those services has not been comprehensively studied, even though these services deal with privacy and security-sensitive user data, and used by a significant number of users. In this paper, we perform privacy and security measurements on government websites and Android apps: 150,244 unique websites (from 206 countries) and 1166 Android apps (from 71 countries). We found numerous commercial trackers on these services—e.g., 17% of government websites and 37% of government Android apps host Google trackers; 13% of government sites contain YouTube cookies with an expiry date in the year of 9999. 27% of government Android apps leak sensitive information (e.g., user/device identifiers, passwords, API keys) to third parties, or any network attacker (when sent over HTTP). We also found 304 government sites and 40 apps are flagged by VirusTotal as malicious. We hope our findings to help improve privacy and security of online government services, given that governments are now apparently taking Internet privacy/security seriously and imposing strict regulations on commercial sites.

References

[1]
Gunes Acar, Steven Englehardt, and Arvind Narayanan. 2020. No boundaries: data exfiltration by third parties embedded on web pages. PoPETs 2020, 4 (2020), 220–238.
[2]
Eman Salem Alashwali, Pawel Szalachowski, and Andrew Martin. 2020. Exploring HTTPS Security Inconsistencies: A Cross-Regional Perspective.Computers & Security 97(2020). Article number 101975.
[3]
Alexa.com. 2021. Alexa Top Sites. https://aws.amazon.com/alexa-top-sites/.
[4]
Abdullah Ahmed Ali and Mohd Zamri Murah. 2018. Security Assessment of Libyan Government Websites. In Cyber Resilience Conference (CRC’18). Putrajaya, Malaysia.
[5]
Omar Alrawi, Chaoshun Zuo, Ruian Duan, Ranjita Pai Kasturi, Zhiqiang Lin, and Brendan Saltaformaggio. 2019. The Betrayal At Cloud City: An Empirical Analysis Of Cloud-Based Mobile Backends. In USENIX Security Symposium’19. Santa Clara, CA, USA.
[6]
Android. 2021. Permissions on Android. Online article (2021). https://developer.android.com/guide/topics/permissions/overview.
[7]
Muhammad Ahmad Bashir, Sajjad Arshad, William K. Robertson, and Christo Wilson. 2016. Tracing Information flows between Ad exchanges using retargeted Ads. In USENIX Security Symposium’16. Austin, TX, USA.
[8]
BBC. 2019. Tracking tools found on EU government and health websites. Online article (2019). https://www.bbc.com/news/technology-47624206.
[9]
Reuben Binns, Ulrik Lyngs, Max Van Kleek, Jun Zhao, Timothy Libert, and Nigel Shadbolt. 2018. Third party tracking in the mobile ecosystem. In ACM WebSci’18. Amsterdam, Netherlands.
[10]
businesswire. 2018. 62% of enterprises exposed to sensitive data loss via Firebase vulnerability. Online article (2018). https://www.businesswire.com/news/home/20180619005540/en/62-of-Enterprises-Exposed-to-Sensitive-Data-Loss-via-Firebase-Vulnerability.
[11]
BusinessWire.com. 2018. 62% of Enterprises Exposed to Sensitive Data Loss via Firebase Vulnerability. News article (June 19, 2018). https://www.businesswire.com/news/home/20180619005540/en/62-of-Enterprises-Exposed-to-Sensitive-Data-Loss-via-Firebase-Vulnerability.
[12]
CDN Planet. 2021. Content Delivery Networks per country. Online article (2021). https://www.cdnplanet.com/geo/.
[13]
Hyunghoon Cho, Daphne Ippolito, and Yun William Yu. 2020. Contact tracing mobile apps for COVID-19: Privacy considerations and related trade-offs. arXiv preprint arXiv:2003.11511(2020).
[14]
Cisco. 2020. Cisco Umbrella 1 Million. Online article (2020). https://umbrella.cisco.com/blog/cisco-umbrella-1-million.
[15]
Clym. 2021. How The CCPA Affects The Cookie Policy. Online article (2021). https://www.clym.io/how-the-ccpa-affects-the-cookie-policy/.
[16]
Cookiebot. 2019. Ad tech surveillance on the public sector web. Online article (2019). https://www.cookiebot.com/media/1121/cookiebot-report-2019-medium-size.pdf.
[17]
Balázs Csontos and István Heckl. 2021. Accessibility, usability, and security evaluation of Hungarian government websites. Universal Access in the Information Society 20, 1 (2021), 139–156.
[18]
Cyble. 2021. Android Trojan Malware Disguised As Syrian E-Gov Android App. Online article (2021). https://blog.cyble.com/2021/05/27/android-trojan-malware-disguised-as-syrian-e-gov-android-app/.
[19]
Martin Degeling, Christine Utz, Christopher Lentzsch, Henry Hosseini, Florian Schaub, and Thorsten Holz. 2019. We Value Your Privacy... Now Take Some Cookies: Measuring the GDPR’s Impact on Web Privacy. In NDSS’19. San Diego, CA, USA.
[20]
die.net. 2010. nslookup. Online article (2010). https://linux.die.net/man/1/nslookup.
[21]
die.net. 2021. curl. Online article (2021). https://linux.die.net/man/1/curl.
[22]
Digital.gov. 2021. GSA govt-urls. https://github.com/GSA/govt-urls.
[23]
EasyList. 2020. EasyList. Online article (2020). https://easylist.to/.
[24]
Steven Englehardt and Arvind Narayanan. 2016. Online tracking: A 1-million-site measurement and analysis. In CCS’16. Vienna, Austria.
[25]
Kristin R Eschenfelder, John C Beachboard, Charles R McClure, and Steven K Wyman. 1997. Assessing US federal government websites. Government Information Quarterly 14, 2 (1997), 173–189.
[26]
Europa.eu. 2016. EU GDPR. Online article (2016). https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32016R0679&from=EN.
[27]
Marjan Falahrastegar, Hamed Haddadi, Steve Uhlig, and Richard Mortier. 2014. The Rise of Panopticons: Examining Region-Specific Third-Party Web Tracking. In Traffic Monitoring and Analysis (TMA’14). London UK.
[28]
Nathaniel Fruchter, Hsin Miao, Scott Stevenson, and Rebecca Balebako. 2015. Variations in tracking in relation to geographic location. In Web 2.0 Security and Privacy (W2SP’15). San Jose, CA, USA.
[29]
FullStory. 2021. How does FullStory recording work to recreate my users’ experience?Online article (2021). https://help.fullstory.com/hc/en-us/articles/360032975773-How-does-FullStory-recording-work-to-recreate-my-users-experience-.
[30]
G. Anzinger. 2002. Worldwide Governments on the WWW. http://www.gksoft.com/govt/en/world.html.
[31]
Manaf Gharaibeh, Anant Shah, Bradley Huffaker, Han Zhang, Roya Ensafi, and Christos Papadopoulos. 2017. A look at router geolocation in public and commercial databases. In ACM Internet measurement conference (IMC’17). London, United Kingdom.
[32]
Alejandro Gómez-Boix, Pierre Laperdrix, and Benoit Baudry. 2018. Hiding in the crowd: An analysis of the effectiveness of browser fingerprinting at large scale. In WWW’18. Lyon, France.
[33]
Google. 2020. Android Debug Bridge (adb). Online article (2020). https://developer.android.com/studio/command-line/adb.
[34]
Google. 2020. monkeyrunner. Online article (2020). https://developer.android.com/studio/test/monkeyrunner.
[35]
Google. 2021. Firebase. Online article (2021). https://firebase.google.com/.
[36]
Google Play. 2021. ProxyDroid. Online article (2021). https://play.google.com/store/apps/details?id=org.proxydroid&hl=en_CA&gl=US.
[37]
Government of Canada. 2020. Bill C-11: An Act to enact the Consumer Privacy Protection Act and the Personal Information and Data Protection Tribunal Act and to make related and consequential amendments to other Acts. Proposed legislation: 2020; https://www.justice.gc.ca/eng/csj-sjc/pl/charter-charte/c11.html.
[38]
Government of Canada. 2020. Personal Information Protection and Electronic Documents Act. Enacted: 2000, last amended: 2019; https://laws-lois.justice.gc.ca/ENG/ACTS/P-8.6/index.html.
[39]
howtoremove.guide. 2020. Trojan.Malware.300983.susgen. Online article (2020). https://howtoremove.guide/trojan-malware-300983-susgen/.
[40]
Xuehui Hu, Guillermo Suarez de Tangil, and Nishanth Sastry. 2020. Multi-country Study of Third Party Trackers from Real Browser Histories. In IEEE EuroS&P’20. Online.
[41]
India Times. 2018. Hackers mined a fortune from Indian websites. Online article (2018). https://economictimes.indiatimes.com/small-biz/startups/newsbuzz/hackers-mined-a-fortune-from-indian-websites/articleshow/65836088.cms.
[42]
Information and Communication Technology for Development (ICTD) Lab. 2020. HTTPS Adoption Measurement in Governments Worldwide. Online article (2020). https://github.com/uw-ictd/GovHTTPS-Data.
[43]
Internet Society. 2018. Personal Data Protection Guidelines for Africa. Online article (2018). https://www.internetsociety.org/resources/doc/2018/personal-data-protection-guidelines-for-africa/.
[44]
Internet world stats. 2021. World country list. Online article (2021). https://www.internetworldstats.com/list1.htm.
[45]
Arjaldo Karaj, Sam Macbeth, Rémi Berson, and Josep M Pujol. 2018. WhoTracks.Me: Shedding light on the opaque world of online tracking. arXiv preprint arXiv:1804.08959(2018).
[46]
L. Stephens. 2020. Hakrawler. Online article (2020). https://github.com/hakluke/hakrawler.
[47]
Victor Le Pochat, Tom Van Goethem, Samaneh Tajalizadehkhoob, Maciej Korczyński, and Wouter Joosen. 2019. Tranco: A Research-Oriented Top Sites Ranking Hardened Against Manipulation. In NDSS’19. San Diego, CA, USA.
[48]
M. Richt. 2020. German Government Domains. Online article (2020). https://github.com/robbi5/german-gov-domains/.
[49]
M. Zi’ang. 2020. LiteRadar. Online article (2020). https://github.com/pkumza/LiteRadar.
[50]
Max Maass, Pascal Wichmann, Henning Pridöhl, and Dominik Herrmann. 2017. Privacyscore: Improving privacy and security via crowd-sourced benchmarks of websites. In Annual Privacy Forum (APF’17). Vienna, Austria.
[51]
mitmproxy. 2021. mitmproxy. Online article (2021). https://mitmproxy.org/.
[52]
mitre. 2021. Cobalt strike. Online article (2021). https://attack.mitre.org/software/S0154/.
[53]
MobSF. 2020. Mobile Security Framework (MobSF). Online article (2020). https://github.com/MobSF/Mobile-Security-Framework-MobSF.
[54]
Trung Tin Nguyen, Michael Backes, Ninja Marnau, and Ben Stock. 2021. Share First, Ask Later (or Never?)-Studying Violations of GDPR’s Explicit Consent in Android Apps. In USENIX Security Symposium (USENIX Security’21). Online.
[55]
Joshua D Niforatos, Alexander R Zheutlin, and Jeremy B Sussman. 2021. Prevalence of Third-Party Data Tracking by US Hospital Websites. JAMA Network Open 4, 9 (2021), e2126121–e2126121.
[56]
OECD.org. 2011. Classification of the Functions of Government (COFOG). Online article (2011). https://www.oecd.org/gov/48250728.pdf.
[57]
Office of the auditor general western Australia. 2021. Local Government General Computer Controls. Online article (2021). https://audit.wa.gov.au/wp-content/uploads/2021/05/Report-23_Local-Government-General-Computer-Controls.pdf.
[58]
OneSpan. 2021. Fraud Analytics. Online article (2021). https://www.onespan.com/topics/fraud-analytics.
[59]
Emmanouil Papadogiannakis, Panagiotis Papadopoulos, Nicolas Kourtellis, and Evangelos P. Markatos. 2021. User Tracking in the Post-cookie Era: How Websites Bypass GDPR Consent to Track Users. In WWW’21. Ljubljana, Slovenia.
[60]
Peng Peng, Limin Yang, Linhai Song, and Gang Wang. 2019. Opening the Blackbox of VirusTotal: Analyzing Online Phishing Scan Engines. In IMC’19. Amsterdam, Netherlands.
[61]
Pew Research center. 2002. The rise of the e-citizen: How people use government agencies’ web sites. Online article (2002). https://www.pewresearch.org/internet/2002/04/03/the-rise-of-the-e-citizen-how-people-use-government-agencies-web-sites/.
[62]
Pierluigi Paganini. 2017. US Government website was hosting a JavaScript downloader delivering Cerber ransomware. Online article (2017). https://securityaffairs.co/wordpress/62629/hacking/us-government-website-malware.html.
[63]
Princeton University. 2020. OpenWPM. Online article (2020). https://github.com/citp/OpenWPM.
[64]
Gaston Pugliese, Christian Riess, Freya Gassmann, and Zinaida Benenson. 2020. Long-Term Observation on Browser Fingerprinting: Users’ Trackability and Perspective. PoPETs 2020, 2 (2020), 558–577.
[65]
R. Alam. 2020. gplaydl. Online article (2020). https://github.com/rehmatworks/gplaydl.
[66]
Reuters. 2021. France embraces Google, Microsoft in quest to safeguard sensitive data. Online article (2021). https://www.reuters.com/technology/france-embraces-google-microsoft-quest-safeguard-sensitive-data-2021-05-17/.
[67]
Frantz Rowe. 2020. Contact tracing apps and values dilemmas: A privacy paradox in a neo-liberal world. International Journal of Information Management 55 (2020), 102178.
[68]
S. Sahni. 2019. Firebase scanner. Online article (2019). https://github.com/shivsahni/FireBaseScanner.
[69]
Nayanamana Samarasinghe and Mohammad Mannan. 2019. Towards a global perspective on web tracking. Computers & Security 87(2019). Article number 101569.
[70]
Iskander Sanchez-Rola, Matteo Dell’Amico, Davide Balzarotti, Pierre-Antoine Vervier, and Leyla Bilge. 2021. Journey to the Center of the Cookie Ecosystem: Unraveling Actors’ Roles and Relationships. In IEEE Symposium on Security and Privacy (SP’21). Online.
[71]
Iskander Sanchez-Rola and Igor Santos. 2018. Knockin’on trackers’ door: Large-scale automatic analysis of web tracking. In 18. Saclay, France.
[72]
SecureIca. 2020. Exploring Google Hacking Techniques using Dork. Online article (2020). https://medium.com/nassec-cybersecurity-writeups/exploring-google-hacking-techniques-using-google-dork-6df5d79796cf.
[73]
Sudheesh Singanamalla, Esther Han Beol Jang, Richard Anderson, Tadayoshi Kohno, and Kurtis Heimerl. 2020. Accept the Risk and Continue: Measuring the Long Tail of Government HTTPS Adoption. In ACM Internet measurement conference (IMC’20). Online.
[74]
Softpedia news. 2013. Hacked Turkish Government website used to distribute malware. Online article (2013). https://news.softpedia.com/news/Hacked-Turkish-Government-Website-Used-to-Distribute-Malware-389937.shtml.
[75]
Konstantinos Solomos, John Kristoff, Chris Kanich, and Jason Polakis. 2021. Tales of Favicons and Caches: Persistent Tracking in Modern Browsers. In NDSS’21. Online.
[76]
State of California Department of Justice. 2021. California Consumer Privacy Act (CCPA). Online article (2021). https://oag.ca.gov/privacy/ccpa.
[77]
The Guardian. 2018. Government websites hit by cryptocurrency mining malware. Online article (2018). https://www.theguardian.com/technology/2018/feb/11/government-websites-hit-by-cryptocurrency-mining-malware.
[78]
Caroline J Tolbert and Karen Mossberger. 2006. The effects of e-government on trust and confidence in government. Public administration review 66, 3 (2006), 354–369.
[79]
Andrew Tolley and Darren Mundy. 2009. Towards workable privacy for UK e-government on the web. International Journal of Electronic Governance 2, 1 (2009), 74–88.
[80]
Vice.com. 2020. Hackers turned Virginia government websites into elaborate eBooks scam pages. Online article (2020). https://www.vice.com/en/article/88947x/hackers-virginia-government-websites-ebooks-scam.
[81]
Virginia.gov. 2021. SB 1392 Consumer Data Protection Act; establishes a framework for controlling and processing personal data. Online article (2021). https://lis.virginia.gov/cgi-bin/legp604.exe?211+sum+SB1392.
[82]
VirusTotal. 2021. VirusTotal. Online article (2021). https://www.virustotal.com.
[83]
weareprivacy.com. 2021. Policy Highlights. Online article (2021). https://github.com/weareprivacy/policy-highlights.
[84]
Wikipedia. 2021. .gov. Online article (2021). https://en.wikipedia.org/wiki/.gov.
[85]
Wikipedia. 2021. List of sovereign states. Online article (2021). https://en.wikipedia.org/wiki/List_of_sovereign_states.
[86]
Wired. 2019. How Cambridge Analytica Sparked the Great Privacy Awakening. Online article (2019). https://www.wired.com/story/cambridge-analytica-facebook-privacy-awakening/.
[87]
World mail & express americas conference. 2021. Cookie policy. Online article (2021). https://www.wmxamericas.com/cookie-policy/.
[88]
Z. Wang. 2020. googler. Online article (2020). https://github.com/jarun/googler.
[89]
Chaoshun Zuo, Zhiqiang Lin, and Yinqian Zhang. 2019. Why Does Your Data Leak? Uncovering the Data Leakage in Cloud from Mobile Apps. In IEEE Symposium on Security and Privacy (SP’19). San Fransisco, CA, USA.

Cited By

View all
  • (2024)Third-Party Data Leaks and Dark Patterns in Finnish Political WebsitesProceedings of the International Conference on Computer Systems and Technologies 202410.1145/3674912.3675248(43-50)Online publication date: 14-Jun-2024
  • (2024)Of Choices and Control - A Comparative Analysis of Government HostingProceedings of the 2024 ACM on Internet Measurement Conference10.1145/3646547.3688447(462-479)Online publication date: 4-Nov-2024
  • (2024)SoK: Technical Implementation and Human Impact of Internet Privacy Regulations2024 IEEE Symposium on Security and Privacy (SP)10.1109/SP54263.2024.00206(673-696)Online publication date: 19-May-2024
  • Show More Cited By

Recommendations

Comments

Information & Contributors

Information

Published In

cover image ACM Conferences
WWW '22: Proceedings of the ACM Web Conference 2022
April 2022
3764 pages
ISBN:9781450390965
DOI:10.1145/3485447
Permission to make digital or hard copies of all or part of this work for personal or classroom use is granted without fee provided that copies are not made or distributed for profit or commercial advantage and that copies bear this notice and the full citation on the first page. Copyrights for components of this work owned by others than ACM must be honored. Abstracting with credit is permitted. To copy otherwise, or republish, to post on servers or to redistribute to lists, requires prior specific permission and/or a fee. Request permissions from [email protected]

Sponsors

Publisher

Association for Computing Machinery

New York, NY, United States

Publication History

Published: 25 April 2022

Permissions

Request permissions for this article.

Check for updates

Author Tags

  1. Android
  2. Government services
  3. privacy
  4. security
  5. tracking
  6. web

Qualifiers

  • Research-article
  • Research
  • Refereed limited

Funding Sources

Conference

WWW '22
Sponsor:
WWW '22: The ACM Web Conference 2022
April 25 - 29, 2022
Virtual Event, Lyon, France

Acceptance Rates

Overall Acceptance Rate 1,899 of 8,196 submissions, 23%

Contributors

Other Metrics

Bibliometrics & Citations

Bibliometrics

Article Metrics

  • Downloads (Last 12 months)119
  • Downloads (Last 6 weeks)11
Reflects downloads up to 08 Mar 2025

Other Metrics

Citations

Cited By

View all
  • (2024)Third-Party Data Leaks and Dark Patterns in Finnish Political WebsitesProceedings of the International Conference on Computer Systems and Technologies 202410.1145/3674912.3675248(43-50)Online publication date: 14-Jun-2024
  • (2024)Of Choices and Control - A Comparative Analysis of Government HostingProceedings of the 2024 ACM on Internet Measurement Conference10.1145/3646547.3688447(462-479)Online publication date: 4-Nov-2024
  • (2024)SoK: Technical Implementation and Human Impact of Internet Privacy Regulations2024 IEEE Symposium on Security and Privacy (SP)10.1109/SP54263.2024.00206(673-696)Online publication date: 19-May-2024
  • (2024)Privacy at Risk: An Investigation of Data Collection Practices and Tracking Scripts on Government Websites in Java2024 Seventh International Conference on Vocational Education and Electrical Engineering (ICVEE)10.1109/ICVEE63912.2024.10823899(188-193)Online publication date: 30-Oct-2024
  • (2024)How Many Hands in the Cookie Jar? Examining Privacy Implications of Popular Apps in India2024 IEEE 9th European Symposium on Security and Privacy (EuroS&P)10.1109/EuroSP60621.2024.00046(741-757)Online publication date: 8-Jul-2024
  • (2024)CAWALInformation Processing and Management: an International Journal10.1016/j.ipm.2023.10361761:3Online publication date: 1-May-2024
  • (2024)Privacy practices of popular websites in Saudi ArabiaJournal of Umm Al-Qura University for Engineering and Architecture10.1007/s43995-024-00085-x16:1(19-29)Online publication date: 11-Dec-2024
  • (2024)Transparency in Open Government Data Portals: An Assessment of Web Tracking Practices Across EuropeElectronic Participation10.1007/978-3-031-70804-6_14(209-222)Online publication date: 3-Sep-2024
  • (2023)I Refuse if You Let Me: Studying User Behavior with Privacy Banners at Scale2023 7th Network Traffic Measurement and Analysis Conference (TMA)10.23919/TMA58422.2023.10198936(1-9)Online publication date: 26-Jun-2023
  • (2023)Assessing Security, Privacy, User Interaction, and Accessibility Features in Popular E-Payment ApplicationsProceedings of the 2023 European Symposium on Usable Security10.1145/3617072.3617102(143-157)Online publication date: 16-Oct-2023
  • Show More Cited By

View Options

Login options

View options

PDF

View or Download as a PDF file.

PDF

eReader

View online with eReader.

eReader

HTML Format

View this article in HTML Format.

HTML Format

Figures

Tables

Media

Share

Share

Share this Publication link

Share on social media