UC San Diego

Privacy threats are abundant when a user browses the Web. For example, online tracking code collects information about people for targeted (and potentially discriminatory) advertisements. Governments have surveilled foreign and domestic network traffic. Attackers also forge criminal legal process documents (e.g., search warrants) to steal user data from tech companies. In response to these threats, privacy defenders have created tools that are sometimes widely adopted, but the threats still remain. I argue that this discrepancy can be explained by privacy defenses being built around a model of a system that differs from that system's actual behavior. Furthermore, I argue that empirical analysis can evaluate how well the model and system align, and that when they diverge, widespread privacy harms occur. I examine four privacy defenses across the Web ecosystem. First, we analyze content blockers, which aim to protect users from online tracking. We find that content blockers fail to follow the model of identifying request origins according to the HTML specification. As a result, they are evaded by over half of popular websites, and their users are subjected to online tracking. Next, governments seeking to control the geographic routes of Internet traffic through international agreements may not be aware of how Internet routing policies impact these routes. We conduct measurements to study these paths and find that for the majority of countries studied, local traffic does not stay local. Next, we turn to browser agents (AI-operated browsers) that seek to replace users' default browsers, but disable standard browser security and privacy features. Every studied browser agent had multiple concerns, leading to widespread privacy harms like users being more vulnerable to phishing websites. Finally, we present and evaluate a new system, WarrInt, to restore a privacy model that companies only give user data in response to legitimate legal process documents. Unlike the previous systems, WarrInt was designed around real-world constraints, so its model matches reality. We confirm this with an evaluation of WarrInt on 328 modified legal process documents, and find that WarrInt identifies modifications in every document. Together, these case studies show how empirical analysis can help improve user privacy.