Wirtschaftsuniversität Wien Magisterarbeit - SemanticLab

Internet and areas of common Internet applications which use (sensitive) personal data
will be introduced.
2.2. General privacy on the Internet
This section will deal with general privacy issues on the Internet. For that reason a
common approach to categorize personal data as described in [Sar03] will be used. The
three main categories are financial, medical and political privacy. Although all categories
are generic, they are restricted to the World Wide Web and should introduce these issues
based on examples. Therefore, financial privacy will be discussed on the examples of
fraud and identity theft, medical privacy by discussing the transfer of patient records
over the Internet and seeking medical help online and political privacy will be discussed
by highlighting privacy issues in e-government and free speech on the Internet.
2.2.1. Financial privacy
When it comes to financial privacy, two threats are very common on the Internet: fraud
(such as in online banking and phishing 1 ) and identity theft. According to [Sin07] a huge
rise in online banking fraud could be identified in the last years which mainly is due to
two reasons: first of all, Internet access has become very cheap in most industrialized
countries and banks try to get their customers to use online banking for obvious reasons:
for clients, it is a very convenient way to conduct banking business. For banks, it is a way
to cut costs on a double-digit scale [Tan00]. That means that there are a lot of online
banking accounts which can be attacked. The second reason is the growing number of
phishing mails because there are more and more users with e-mail addresses available.
In most cases, these e-mails look like official e-mails, for example from the customers’
bank, asking them to update their contact details. By including a link which leads to a
fake website (very often a copy of the original website) it is made sure that users send
their sensitive data to the “right” party. In the best case this data (such as address-data)
is sold, more often account data is requested and used to debit money from a banking
account. However, nowadays banks are aware of this problem and try to inform their
customers as much as possible about such phishing mails. Additionally, new security
features are being introduced to make phishing harder and therewith protect customer
data [Hil06].
Identity theft is closely connected to online fraud whereas [Kah08] defines it as “the
malicious use of personal identifying data” and provides several types of identity theft:
new account fraud, existing account fraud and friendly fraud. According to [Kah08] new
account fraud is characterized by the use of personal data such as the social insurance
number, date of birth and address to open a new account. By existing account fraud
the theft of credit cards or other transactional account data is described whereas the
1 “Phishing” describes a methodology to acquire sensitive information such as credit card numbers by
sending users fake e-mails with links to fake websites which try to bring users to enter their sensitive
data
7