Algorithmic Auditing

There is growing concern about the impact of powerful, opaque algorithms on our daily lives. In our work, we are focused on auditing algorithms: we use carefully controlled experiments to understand the data and algorithms used by companies, and assess the impact of these algorithms on normal people. Examples of our work include:

• Examining whether personalization and ranking algorithms on Google Search create partisan "filter bubbles"
• Understanding the role that ranking algorithms play in reinforcing gender and racial bias within gig-economy and traditional labor marketplaces
• Critically examining online price discrimination and algorithmic manipulation in Amazon marketplace
• Examining ridesharing platforms to understand surge price algorithms and accessibility
• Investigating localization and the geopolitics of online maps

Our ultimate goals are to make algorithmic systems more transparent to the public, and to develop tools that help users avoid unwanted or harmful systems. We are actively collaborating with regulators to turn our research findings into practical policy outcomes.

This work has appeared in IMC, CSCW, CHI, and WWW. More information, including source code and data, can be found on the project website.

Tracking and Privacy

Tracking is ubiquitous on the Web today, and yet we have only the most basic understanding of who collects data about us, and how this data is shared with third-parties. We are currently delving inside the tracking ecosystem to answer these questions, including:

• Investigating whether Android apps are surreptitiously taking audio and video recordings of users
• Developing causal methods to uncover the data sharing relationships between trackers and advertisers
• Building models of the tracking ecosystem to understand user's privacy footprint, and the efficacy of tracker-blocking strategies
• Using surveys to determine whether the inferences drawn by trackers about users are correct or valuable
• Investigating techniques used by trackers to circumvent ad blockers

Based on our findings, we plan to empower users with tools to help protect their privacy. Our work on this topic has appeared at Usenix Security, NDSS, IMC, and PETS.

PKI and TLS

Public Key Infrastructure is the root of trust and security on the internet.Prominent examples include the SSL/TLS and DNSSEC PKIs. However, recent events like the Heartbleed vulnerability have demonstrated that critical PKIs are vulnerable to both software and human-induced failures. We are working to understand the threats to modern PKIs, and develop novel systems to address these challenges. Examples of our research include:

• Measuring whether website administrators followed best practices (i.e. patching, reissuing, and revoking certificates) in the wake of Heartbleed
• Analyzing certificate revocation practices on the web from the perspective of website owners and browser vendors
• Understanding how private keys for TLS certificates are shared with and aggregated by hosting providers
• Building new systems to efficiently and proactively push certificate revocation information to web browsers
• Measuring DNSSEC adoption and investigating the root causes behind its low adoption rate
• Investigating whether the web is ready to deploy improved security measures like OCSP Must-Staple

This work has appeared at IEEE S&P, CCS, Usenix Security, and IMC. More information about our SSL/TLS research, including source code and data, can be found on the project website.

Teaching

In Fall 2024 I am teaching CS 4700/CS 5700. In the past I have taught:

• CS 2500: Fundamentals of Computer Science 1
• CY 2550 - Foundations of Cybersecurity
• CS 3700 - Networks and Distributed Systems
• CS 5600: Computer Systems
• CS 4740/6740: Network Security
• CS 5740: Social Computing

I spend an inordinate amount of time animating and tuning my slide decks.

Funding

I am grateful for support from the National Science Foundation, Northwestern University and Underwriters Laboratories, the Sloan Foundation, the Mozilla Foundation, the Russell Sage Foundation, Google, Pymetrics the Democracy Fund, the Anti Defamation League, the Knight Foundation, the Data Transparency Lab, the European Commission, Verisign Labs, and Northeastern University under the TIER 1 grants program.

Service

I recently served as co-General Chair of the Privacy Law Scholars Conference (PLSC) '22. I served as co-Program Committee Chair of the inaugural Fairness, Accountability, and Transparency Conference (FAT*) 2018 (subsequently renamed to ACM FAccT) and I continue to serve on the Steering Committee for FAccT.

Recently, I served on the PETS '22, IEEE S&P '20, and IMC '18 Program Committees. I also regularly present our work to audiences outside academia.