research-article

Data Protection Law and Multi-Party Computation: Applications to Information Exchange between Law Enforcement Agencies

Authors:

Dirk Müllmann,

Thomas Schneider, and

Indra Spiecker genannt DöhmannAuthors Info & Claims

WPES'22: Proceedings of the 21st Workshop on Privacy in the Electronic Society

November 2022

Pages 69 - 82

https://doi.org/10.1145/3559613.3563192

Published: 07 November 2022 Publication History

Abstract

Pushes for increased power of Law Enforcement (LE) for data retention and centralized storage result in legal challenges with data protection law and courts-and possible violations of the right to privacy. This is motivated by a desire for better cooperation and exchange between LE Agencies (LEAs), which is difficult due to data protection regulations, was identified as a main factor of major public security failures, and is a frequent criticism of LE. Secure Multi-Party Computation (MPC) is often seen as a technological means to solve privacy conflicts where actors want to exchange and analyze data that needs to be protected due to data protection laws. In this interdisciplinary work, we investigate the problem of private information exchange between LEAs from both a legal and technical angle. We give a legal analysis of secret-sharing based MPC techniques in general and, as a particular application scenario, consider the case of matching LE databases for lawful information exchange between LEAs. We propose a system for lawful information exchange between LEAs using MPC and private set intersection and show its feasibility by giving a legal analysis for data protection and a technical analysis for workload complexity. Towards practicality, we present insights from qualitative feedback gathered within exchanges with a major European LEA.

References

[1]

ISO/IEC JTC 1/SC 27 Information security, cybersecurity and privacy protection. 2022a. ISO/IEC CD 4922--2 Information security - Secure multiparty computation - Part 2: Mechanisms based on secret sharing. International Organization for Standardization.

[2]

ISO/IEC JTC 1/SC 27 Information security, cybersecurity and privacy protection. 2022b. ISO/IEC DIS 4922--1 Information security - Secure multiparty computation - Part 1: General. International Organization for Standardization.

[3]

Gilad Asharov, Yehuda Lindell, Thomas Schneider, and Michael Zohner. 2013. More efficient oblivious transfer and extensions for faster secure computation. In ACM SIGSAC Conference on Computer and Communications Security (CCS).

Digital Library

[4]

Kenneth A Bamberger, Ran Canetti, Shafi Goldwasser, Rebecca Wexler, and Evan J Zimmerman. 2022. Verification Dilemmas in Law and the Promise of Zero-Knowledge Proofs. In Berkeley Technology Law Journal, Vol. 37.

[5]

Francesca Bignami. 2007. Privacy and law enforcement in the European union: the data retention directive. In Chicago Journal of International Law, Vol. 8.

[6]

Dor Bitan, Ran Canetti, Shafi Goldwasser, and Rebecca Wexler. 2022. Using Zero-Knowledge to Reconcile Law Enforcement Secrecy and Fair Trial Rights in Criminal Cases. In SSRN Preprint 4074315. Available at https://ssrn.com/abstract=4074315.

[7]

José Cabrero-Holgueras and Sergio Pastrana. 2021. SoK: Privacy-Preserving Computation Techniques for Deep Learning. In Proceedings on Privacy Enhancing Technologies (PoPETs), Vol. 4.

[8]

Nishanth Chandran, Nishka Dasgupta, Divya Gupta, Sai Lakshmi Bhavana Obbattu, Sruthi Sekar, and Akash Shah. 2021. Efficient Linear Multiparty PSI and Extensions to Circuit/Quorum PSI. In ACM SIGSAC Conference on Computer and Communications Security (CCS).

Digital Library

[9]

Nishanth Chandran, Divya Gupta, and Akash Shah. 2022. Circuit-PSI with linear complexity via relaxed batch OPPRF. In Proceedings on Privacy Enhancing Technologies (PoPETs).

[10]

Michele Ciampi and Claudio Orlandi. 2018. Combining private set-intersection with secure two-party computation. In International Conference on Security and Cryptography for Networks (SCN).

Digital Library

[11]

Emiliano De Cristofaro and Gene Tsudik. 2010. Practical private set intersection protocols with linear complexity. In International Conference on Financial Cryptography and Data Security (FC).

Digital Library

[12]

Daniel Demmler, Thomas Schneider, and Michael Zohner. 2015. ABY-A framework for efficient mixed-protocol secure two-party computation. In Network and Distributed System Security Symposium (NDSS).

[13]

Joan Feigenbaum. 2017. Multiple objectives of lawful-surveillance protocols (transcript of discussion). In Cambridge International Workshop on Security Protocols.

[14]

Joan Feigenbaum. 2019. Encryption and surveillance. In Communications of the ACM, Vol. 62.

Digital Library

[15]

Joan Feigenbaum and Daniel J Weitzner. 2018. On the incommensurability of laws and technical mechanisms: Or, what cryptography can't do. In Cambridge International Workshop on Security Protocols.

[16]

Free Software Foundation. 1991. The GNU Multiple Precision Arithmetic Library. https://gmplib.org/.

[17]

Jonathan Frankle, Sunoo Park, Daniel Shaar, Shafi Goldwasser, and Daniel Weitzner. 2018. Practical Accountability of Secret Processes. In USENIX Security Symposium (USENIX Security).

[18]

Michael J Freedman, Kobbi Nissim, and Benny Pinkas. 2004. Efficient private matching and set intersection. In International Conference on the Theory and Applications of Cryptographic Techniques (EUROCRYPT).

[19]

Gayathri Garimella, Mike Rosulek, and Jaspal Singh. 2022. Structure-Aware Private Set Intersection, With Applications to Fuzzy Matching. In Annual International Cryptology Conference (CRYPTO).

Digital Library

[20]

Oded Goldreich, Silvio Micali, and Avi Wigderson. 1987. How to play any mental game. In ACM Symposium on Theory of Computing (STOC).

Digital Library

[21]

Shafi Goldwasser and Sunoo Park. 2017. Public accountability vs. secret laws: can they coexist? A cryptographic proposal. In Workshop on Privacy in the Electronic Society (WPES).

Digital Library

[22]

Matthew Green, Gabriel Kaptchuk, and Gijs Van Laer. 2021. Abuse resistant law enforcement access systems. In International Conference on the Theory and Applications of Cryptographic Techniques (EUROCRYPT).

Digital Library

[23]

Lukas Helminger and Christian Rechberger. 2022. Multi-Party Computation in the GDPR. In Privacy Symposium - Data Protection Law International Convergence and Compliance with Innovative Technologies (DPLICIT).

[24]

Brett Hemenway Falk, Daniel Noble, and Rafail Ostrovsky. 2019. Private set intersection with linear communication from general assumptions. In Workshop on Privacy in the Electronic Society (WPES).

Digital Library

[25]

Yan Huang, David Evans, and Jonathan Katz. 2012. Private set intersection: Are garbled circuits better than custom protocols?. In Network and Distributed Systems Security Symposium (NDSS).

[26]

Bundesministerium des Innern. 2018. Polizei 2020 - White Paper -. Available at https://www.bmi.bund.de/SharedDocs/downloads/DE/veroeffentlichungen/2018/polizei-2020-white-paper.html.

[27]

Yuval Ishai, Joe Kilian, Kobbi Nissim, and Erez Petrank. 2003. Extending oblivious transfers efficiently. In Annual International Cryptology Conference (CRYPTO).

[28]

Seny Kamara. 2014. Restructuring the NSA metadata program. In International Conference on Financial Cryptography and Data Security (FC).

[29]

Murat Kantarcio^glu and Chris Clifton. 2003. Assuring privacy when big brother is watching. In ACM SIGMOD Workshop on Research Issues in Data Mining and Knowledge Discovery (DMKD).

[30]

Vladimir Kolesnikov, Ranjit Kumaresan, Mike Rosulek, and Ni Trieu. 2016. Efficient batched oblivious PRF with applications to private set intersection. In ACM SIGSAC Conference on Computer and Communications Security (CCS).

Digital Library

[31]

Joshua Kroll, Edward Felten, and Dan Boneh. 2014. Secure protocols for accountable warrant execution. In White Paper. Available at https://www.cs.princeton.edu/felten/warrant-paper.pdf.

[32]

Tobias Kussel, Torben Brenner, Galina Tremper, Josef Schepers, Martin Lablans, and Kay Hamacher. 2022. Record Linkage based Patient Intersection Cardinality for Rare Disease Studies using Mainzelliste and Secure Multi-Party Computation. In Research Square Preprint 1486673. Available at https://europepmc.org/article/ppr/ppr476493.

[33]

Yehuda Lindell and Benny Pinkas. 2009. A proof of security of Yao's protocol for two-party computation. In Journal of Cryptology (JoC), Vol. 22.

Digital Library

[34]

Catherine Meadows. 1986. A more efficient cryptographic matchmaking protocol for use in the absence of a continuously available third party. In IEEE Symposium on Security and Privacy (S&P).

[35]

Torin Monahan. 2009. The murky world of ?Fusion Centres' Torin Monahan critiques the emergence of data-sharing "Fusion Centres' intended to reduce crime and prevent terrorism. In Criminal Justice Matters, Vol. 75.

[36]

NIST. 2021. Toward a PEC use-case suite (preliminary draft). NIST White Paper (Draft). Available at https://csrc.nist.gov/publications/detail/white-paper/2021/01/21/toward-a-pec-use-case-suite-preliminary-draft/draft.

[37]

Benny Pinkas, Thomas Schneider, Gil Segev, and Michael Zohner. 2015. Phasing: Private set intersection using permutation-based hashing. In USENIX Security Symposium (USENIX Security).

[38]

Benny Pinkas, Thomas Schneider, Oleksandr Tkachenko, and Avishay Yanai. 2019. Efficient circuit-based PSI with linear communication. In International Conference on the Theory and Applications of Cryptographic Techniques (EUROCRYPT).

Digital Library

[39]

Benny Pinkas, Thomas Schneider, Christian Weinert, and Udi Wieder. 2018b. Efficient circuit-based PSI via cuckoo hashing. In International Conference on the Theory and Applications of Cryptographic Techniques (EUROCRYPT).

[40]

Benny Pinkas, Thomas Schneider, and Michael Zohner. 2014. Faster private set intersection based on OT extension. In USENIX Security Symposium (USENIX Security).

[41]

Benny Pinkas, Thomas Schneider, and Michael Zohner. 2018a. Scalable private set intersection based on OT extension. In ACM Transactions on Privacy and Security (TOPS), Vol. 21.

Digital Library

[42]

Peter Rindal and Phillipp Schoppmann. 2021. VOLE-PSI: Fast OPRF and circuit-PSI from vector-OLE. In International Conference on the Theory and Applications of Cryptographic Techniques (EUROCRYPT).

Digital Library

[43]

James Scheibner, Jean Louis Raisaro, Juan Ramón Troncoso-Pastoriza, Marcello Ienca, Jacques Fellay, Effy Vayena, Jean-Pierre Hubaux, et al. 2021. Revolutionizing medical data sharing using advanced privacy-enhancing technologies: Technical, legal, and ethical synthesis. In Journal of Medical Internet Research (JMIR), Vol. 23.

[44]

Aaron Segal, Joan Feigenbaum, and Bryan Ford. 2016. Privacy-Preserving Lawful Contact Chaining: [Preliminary Report]. In Workshop on Privacy in the Electronic Society (WPES).

Digital Library

[45]

Aaron Segal, Bryan Ford, and Joan Feigenbaum. 2014. Catching Bandits and Only Bandits: Privacy-Preserving Intersection Warrants for Lawful Surveillance. In USENIX Workshop on Free and Open Communications on the Internet (FOCI).

[46]

Sebastian Stammler, Tobias Kussel, Phillipp Schoppmann, Florian Stampe, Galina Tremper, Stefan Katzenbeisser, Kay Hamacher, and Martin Lablans. 2022. Mainzelliste SecureEpiLinker (MainSEL): Privacy-preserving record linkage using secure multi-party computation. In Bioinformatics, Vol. 38.

[47]

Council of the European Union. 2019. Information Management Strategy (IMS) action No 2 -- Action EPRIS-ADEP - final evaluation report -- ADEP Technology - Services and Applications. Note 7886/19.

[48]

Volker Ullrich, Fritz Felgentreu, Stefan Keuter, Benjamin Strasser, Martina Renner, and Irene Mihalic. 2021. Beschlussempfehlung und Bericht des 1. Untersuchungsausschusses der 19. Wahlperiode gemäß Artikel 44 des Grundgesetzes. Deutscher Bundestag. Available at https://dip.bundestag.de/drucksache/beschlussempfehlung-und-bericht-des-1-untersuchungsausschusses-der-19-wahlperiode-gem%C3%A4%C3%9F/255728.

[49]

Erkam Uzun, Simon P Chung, Vladimir Kolesnikov, Alexandra Boldyreva, and Wenke Lee. 2021. Fuzzy Labeled Private Set Intersection with Applications to Private Real-Time Biometric Search. In USENIX Security Symposium (USENIX Security).

[50]

Dinusha Vatsalan, Ziad Sehili, Peter Christen, and Erhard Rahm. 2017. Privacy-preserving record linkage for big data: Current approaches and research challenges. In Handbook of Big Data Technologies.

[51]

Abraham Waksman. 1968. A permutation network. In Journal of the ACM (JACM), Vol. 15.

Digital Library

[52]

Charles V Wright and Mayank Varia. 2018. Crypto crumple zones: Enabling limited access without mass surveillance. In IEEE European Symposium on Security and Privacy (EuroS&P).

[53]

Andrew Chi-Chih Yao. 1982. Protocols for secure computations. In Symposium on Foundations of Computer Science (SFCS).

[54]

Andrew Chi-Chih Yao. 1986. How to generate and exchange secrets. In Symposium on Foundations of Computer Science (SFCS).

[55]

Qiao Zhang, Chunsheng Xin, and Hongyi Wu. 2021. Privacy-Preserving Deep Learning Based on Multiparty Secure Computation: A Survey. In IEEE Internet of Things Journal, Vol. 8. io

Cited By

Lemieux VWerner J(2024)Protecting Privacy in Digital Records: The Potential of Privacy-Enhancing TechnologiesJournal on Computing and Cultural Heritage 10.1145/363347716:4(1-18)Online publication date: 8-Jan-2024
https://dl.acm.org/doi/10.1145/3633477
Conway DGarimella K(2024)Multi-party Computation: Privacy in CoopetitionHuman Privacy in Virtual and Physical Worlds10.1007/978-3-031-51063-2_7(141-155)Online publication date: 25-May-2024
https://doi.org/10.1007/978-3-031-51063-2_7
Brüggemann AHundt RSchneider TSuresh AYalame H(2023)FLUTE: Fast and Secure Lookup Table Evaluations2023 IEEE Symposium on Security and Privacy (SP)10.1109/SP46215.2023.10179345(515-533)Online publication date: May-2023
https://doi.org/10.1109/SP46215.2023.10179345

Index Terms

Data Protection Law and Multi-Party Computation: Applications to Information Exchange between Law Enforcement Agencies

Recommendations

The Law Enforcement in Cyberspace Criminal: Focusing on the Experience between Taiwan and the United States
MINES '11: Proceedings of the 2011 Third International Conference on Multimedia Information Networking and Security

This article is discussing the Cyberspace Crime from the point of view to law enforcement. From the observation of this article, it indicates that the trans-bordering and hard-to-trace are two prominent characteristics in the field of Cyberspace Crime ...
Read More
A rigorous approach to formalising the technical investigation stages of cybercrime and criminality within a UK law enforcement environment

As the Internet evolves and continues to become a compelling part of our everyday lives, individuals, communities and nations alike are becoming increasingly exposed to the growing threat of the cybercriminal. The aim of this paper is to widen the ...
Read More
Cryptography, Law Enforcement, and Mobile Communications

In this issue's installment of Crypto Corner, we review the handset-related methods law enforcement agencies can use to gather evidence during criminal investigations. This article's goal is twofold: explain how law enforcement agencies gather handset-...
Read More

Comments

Information & Contributors

Information

Published In

cover image ACM Conferences

WPES'22: Proceedings of the 21st Workshop on Privacy in the Electronic Society

November 2022

227 pages

ISBN:9781450398732

DOI:10.1145/3559613

Program Chairs:
Yuan Hong
University of Connecticut, USA
,
Lingyu Wang
Concordia University, Canada

Copyright © 2022 ACM.

Permission to make digital or hard copies of all or part of this work for personal or classroom use is granted without fee provided that copies are not made or distributed for profit or commercial advantage and that copies bear this notice and the full citation on the first page. Copyrights for components of this work owned by others than the author(s) must be honored. Abstracting with credit is permitted. To copy otherwise, or republish, to post on servers or to redistribute to lists, requires prior specific permission and/or a fee. Request permissions from [email protected].

Sponsors

SIGSAC: ACM Special Interest Group on Security, Audit, and Control

Publisher

Association for Computing Machinery

New York, NY, United States

Publication History

Published: 07 November 2022

Permissions

Request permissions for this article.

Request Permissions

Check for updates

Author Tags

Qualifiers

Research-article

Funding Sources

German Federal Ministry of Education and Research and the Hessen State Ministry for Higher Education, Research and the Arts
Deutsche Forschungsgemeinschaft
European Research Council

Conference

CCS '22

Sponsor:

SIGSAC

CCS '22: 2022 ACM SIGSAC Conference on Computer and Communications Security

November 7, 2022

CA, Los Angeles, USA

Acceptance Rates

Overall Acceptance Rate 106 of 355 submissions, 30%

Upcoming Conference

CCS '24

Sponsor:
sigsac

ACM SIGSAC Conference on Computer and Communications Security

October 14 - 18, 2024

Salt Lake City , UT , USA

Contributors

Other Metrics

View Article Metrics

Bibliometrics & Citations

Bibliometrics

Article Metrics

3
Total Citations
View Citations
195
Total Downloads

Downloads (Last 12 months)95
Downloads (Last 6 weeks)7

Other Metrics

View Author Metrics

Citations

Cited By

Lemieux VWerner J(2024)Protecting Privacy in Digital Records: The Potential of Privacy-Enhancing TechnologiesJournal on Computing and Cultural Heritage 10.1145/363347716:4(1-18)Online publication date: 8-Jan-2024
https://dl.acm.org/doi/10.1145/3633477
Conway DGarimella K(2024)Multi-party Computation: Privacy in CoopetitionHuman Privacy in Virtual and Physical Worlds10.1007/978-3-031-51063-2_7(141-155)Online publication date: 25-May-2024
https://doi.org/10.1007/978-3-031-51063-2_7
Brüggemann AHundt RSchneider TSuresh AYalame H(2023)FLUTE: Fast and Secure Lookup Table Evaluations2023 IEEE Symposium on Security and Privacy (SP)10.1109/SP46215.2023.10179345(515-533)Online publication date: May-2023
https://doi.org/10.1109/SP46215.2023.10179345

View Options

Get Access

Login options

Check if you have access through your login credentials or your institution to get full access on this article.

Full Access

Get this Publication

View options

PDF

View or Download as a PDF file.

eReader

View online with eReader.

Media

Figures

Other

Tables

View Table of Contents