Page 52 - the SyI Quarterly 15

Cyber Updates

Data aggregation and

mining risks. by Andy Smith CSyP FSyI

One of the key issues online and in the modern world
is the ability for organisations, including sales and
marketing departments, advertising companies and
serious organised crime, to use data aggregation
and data mining to their advantage and to target
individuals. This is now being supplemented with
Machine Learning (ML) and Artificial Intelligence (AI)
methods to weaponise data.

Aggregation is the collecting together of individual
items of data, datasets or databases to form large
sets of data, for example, bring together social media
accounts, Internet searches, shopping preferences,
emails and even dark web data for millions of people.

Data mining is taking a large data set and using
tools (including AI and ML) to search for particular words or phrases, then refining the search
with combined search terms to find individual records of interest. For example, starting with a car
registration plate, say for a car in long-term parking at Heathrow and using the results to search for
travel details and school databases for other people living at the address. From that, working out the
house should be empty and an easy target.

Targeted online marketing can be aggressive and unwanted. We are all victims of spam, ad-ware,
spyware and other unwelcome methods of trying to separate us from our money. However, most
online marketing is actually much better than blanket marketing. Targeted marketing can be very
useful for the marketeers, but to achieve this, the advertising organisations need to track and hold a
significant amount of personal information about you and your preferences.

Some of this can be personal such as age and where you live. When they are tracking spending
profiles and the types of products people buy this can become very sensitive. Basically they are
gathering (aggregating) huge amounts of information and then mining this for marketing purposes.
But this data can also be misused for nefarious purposes in the wrong hands.

In Europe, there are laws to protect the public from aggressive marketing, invasion of privacy and
to ensure data protection, e.g. The General Data Protection Regulation (GDPR) and the European
Convention on Human Rights (ECHR) Article 8. These laws cover the type of data that is held and
ensure it is properly protected, and to a certain extent, not misused. But this only applies to reputable
companies and those in jurisdictions covered by such laws.

52