Feature/OPED

Ericsson: Smart Home Privacy: How to Avoid ‘Data Paparazzi’

Published

4 years ago

25/01/2021

The paparazzi are known for often taking covert photographs of celebrities and selling them to tabloids or gossip magazines.

In a similar vein, could the increasing number of smart, connected devices coming into our lives start acting like covert “data paparazzi”? And what can we do to avoid it? Find out here.

Today, our devices collect and forward information to all sorts of external parties: our home security alarm provider, our electricity supplier, our fitness watch vendor, our car manufacturer, our security needs to be good enough that it deters attackers and so on. Smart assistants listen to our voice commands and take that information to the internet to execute our orders.

But smart devices go beyond the obvious too – they can be anything from a connected toaster to a washing machine, sewing machine, or a toothbrush!

Data from one device may not be a problem, but combining data from several devices could create a pattern that may reveal unwanted information about a user or a business. And with more devices coming into homes, concerns around the way personal data is managed, controlled and used by devices and organizations are increasingly being raised.

Each new device may introduce a new security risk, if not properly managed through its life cycle. The security risks must be handled by all actors in the value chain, including the device owner, regardless if devices are used by consumers, industries, or smart cities.

So what will be important to think about to ensure that users benefit and get value from devices and their related services, but avoid adding security issues? Should we risk unintentionally becoming surrounded by data paparazzi with their viewfinder aimed at us?

In this blog post, we’ll bring some light on to what these factors mean for the device owner and what can be done to confront it.

Smart devices and privacy: the big picture

Many of us already interact with at least 3 to 5 devices daily – a smartphone or even two, a smart watch, a tablet PC, a work laptop, and maybe a smart TV. One estimate is that by 2030, each of us will own 15 connected devices. Some devices, like a connected car or smart meter, are connected by default and typically managed by the company the user is a customer of. They typically rely on cellular connectivity. For many other devices, the users themselves select and provide the connectivity, often Wi-Fi or cellular, and are personally responsible for the management of the devices.

Above all, the network infrastructure and devices need to be secure. It’s important for us all that we can trust how our devices operate and handle data. It will also be important to ensure device security through the life cycle of the devices. With the fast growth and wide of range of smart and connected devices from different brands – that come with different user interfaces and functions – it might be cumbersome to keep all devices up to date in terms of firmware and security status, for example, from the day the device is purchased until its recycled. However, this is a key requirement for enabling a secure and trustworthy IoT environment.

GDPR and similar efforts have raised more attention to privacy from the general public. As people become more informed and want to know how their devices and information are used and managed, there will be an increased need for tools that enable identifying, verifying, and controlling the data the devices are collecting and sharing.

The data paparazzi problem

Let’s now go into some issues that celebrities have to deal with, regarding paparazzi and stalkers, and how similar situations can also occur in the IoT world. We’ll also reveal if similar mitigation strategies can work for both regular, and data paparazzi.

Information availability

While the saying goes that “all publicity is good publicity”, many celebrities wouldn’t agree. They want to be in control of the information shared about them, to build a relevant public image but avoid revealing private relations, unattractive personal habits, or similar.

The same thinking is behind IoT security; information that’s needed to complete the intended tasks of an IoT device should be made available, while the rest of the information should be kept private. However, for IoT there’s often a more fine-grained approach as the information made available should in many cases only be made available to a restricted group of observers on a need-to-know basis.

The stalker problem

Many celebrities might also have to deal with stalkers – individuals who are overly interested in them and may try to gain as much information about them as possible, even using illegal means.

In the IoT space, the same phenomenon could happen to the average Joe. A smart home that doesn’t restrict access to the information it generates can easily become a lucrative target for an attacker; the information generated by the home can be used to gather different information about the inhabitants, which could later be leveraged to commit a cyber attack. Information about when various appliances are used, such as when doors are opened, lights are switched on/off, energy consumption fluctuates, can be a real treasure trove. This also means that potential attackers might not skip a house just because there’s some security applied, rather the security needs to be good enough that it deters attackers from trying, or stops them in their tracks.

Mitigation strategies

Celebrities tend to take precautions to hinder paparazzi and stalkers from invading their privacy. This can be in the form of living in gated communities or at least having access control to their property, through walls and gates for example. They might also apply surveillance measures such as motion sensors and surveillance cameras, and even security measures such as guards or guard dogs. When moving about in public, they might have a security guard with them to keep interested parties at least at arm’s length.

The same things need to be considered in the IoT world. For example, in smart homes, access to the internal network and the data generated and stored there should be controlled and protected, monitoring should be applied to pick up on suspicious behaviour, and reactive security measures, such as blocking and logging, should be taken when a breach is detected.

What has been normal for celebrities should now also become the standard for anyone in an IoT environment. When it comes to privacy, active measures should be taken to maintain it. While this might sound scary – and without proper actions, it would be – it’s not something that’s difficult to achieve. Rather it’s about having the right mindset and recognizing that security needs to be built in and considered more and more in the connected world, even for private citizens.

What to protect?

IoT is very much about the data generated and consumed by IoT devices. At first, this data may be seen as producing no risk, but even simple data in a certain context may be sensitive. For example:

Power consumption data recorded by a smart meter can provide a lot of information about what’s happening in a home. For example, based on the power consumption profile of TVs, switching on the TV will be visible from the data and if it’s possible to match the time the TV is turned on with the TV guide, that will provide a good indication as to what people at home are watching.
Any competent smart lock manufacturer will make sure that the communication with the lock is encrypted and its integrity protected. However, this might not be enough; by observing the traffic generated by a smart lock, one could potentially deduce whether the lock has been opened from the inside or the outside and thereby predict if there’s anyone in the house at any given moment. Other data generated by a smart home, including power consumption and light switch data, can be used to improve the prediction.
It’s inevitable that, at some point, an electric device will reach the end of its lifetime and will need to be disposed of. If the information stored on the device isn’t properly removed, a hacker who retrieves the device from a waste bin or who purchases it from a second-hand store could dig out data or credentials, as well as information about the services the device has been connected to. This is information that could be used to spy on the owner in a more efficient way, or even control or modify other devices belonging to the owner from the backend.

The question, therefore, shouldn’t be, “what do I need to protect?”, rather, “what don’t I need to protect?”, meaning “what do I actually need to share?”.

How to avoid unauthorized use of private data

There’s no silver bullet solution to this problem and the complexity is proportional to the number of devices and services that we as individuals interact with. Applying the best security practices is the responsibility of many entities. Device manufacturers and service providers need to provide secure devices/services, with proper control and maintenance for future proof device security.

But there are some rules of thumb that each of us can follow to minimize security and privacy issues related to our devices. By following these recommendations, one can build a system that will withstand a great deal of malicious intent, and deter the vast majority of attackers and opportunists. A few highly skilled and well-connected groups or individuals might be able to get past even the most secure systems, often through social engineering and phishing, that is, human weakness, rather than by technical security exploits. However, with the effort required, “average Joe” is maybe not the typical target.

End-user responsibilities include selecting suitable and secure solutions, and installing and configuring them in a secure way. Well-designed products should make this a relatively easy task, but it can also be done with the help of professionals. Furthermore, there are initiatives such as the Finnish Cybersecurity Label providing security labels for IoT devices, which aim to help consumers select products for which security has been verified.

Another important thing is to remember to update the software of the device.

And based on statistics regarding how a system’s security most often fails, a crucial task for the end-user is to remember to change the default password of all and any devices that are installed.

What can I do as a device owner?

Check whether the device manufacturer/service provider offers firmware/software upgrades in case of security issues.
Consider what data is generated and how it’s used and stored, for example, locally and/or in the cloud.
Check user terms and conditions to find out how data is used.
Remember to change the default device password.
Remember to keep device software up to date.
Remember to wipe the device before recycling.

And remember to consider the trustworthiness of a device and its services before purchase!

Feature/OPED

Hidden Extra Tax ‘Tie’ for Parents Visiting Children Studying in the UK

Published

5 days ago

06/03/2025

Business Post Contributor

By Julie Howard and Annabella King

There is a significant overhaul in UK tax legislation coming into effect come April of this year and going forwards exposure to UK tax will focus more closely on the length of an individual’s UK residence status. HNW Nigerians whose children are studying in the UK may not be aware that they could be UK resident on the basis of fewer days spent in the UK than expected. This will be dependent on their connections to the UK, including the time their children spend in the UK during school holidays and how much the parents see their children in the UK. It is vital that HNW Nigerians with connections to the UK clue up on this to avoid being caught out.

The new rules and UK residence

From 6 April 2025, the current “non-dom” regime will be replaced with a new residence-based regime.The concept of domicile will be abolished as a connecting factor for UK tax purposes and the remittance basis of taxation will be abolished from 6 April 2025.

Individuals moving to the UK from Africa, who have not been UK resident in any of the previous 10 years, will be eligible to claim a new favourable regime for those first 4 years whereby they will not pay UK tax on foreign income and foreign chargeable gains (known as FIG) even if these are brought into the UK. For individuals who have been UK tax resident for fewer than 4 tax years from 6 April 2025, they will be able to claim this favourable regime for the balance of their first 4 years of UK residence– assuming they meet the requirement of non-residence in the 10 years before they moved to the UK. The UK tax year runs from 6 April to the following 5 April.

For UK tax purposes, liability to inheritance tax has historically been based on the concept of domicile, which is essentially where someone regards their permanent home. From 6 April 2025, domicile will cease to be a connecting factor for inheritance tax purposes. Instead, it will be based on UK residence with an individual becoming subject to inheritance tax on their worldwide estate once they have been UK tax resident for 10 of the previous 20 tax years, known as a “long term resident”.

Whether or not an individual is UK resident will therefore be extremely important under the new rules.The UK has a statutory residence test (the SRT) to determine an individual’s residence status for UK tax purposes. The SRT breaks down into three tests which must be considered in order: firstly, the automatic non-residence test; secondly, the automatic UK residence test; and finallythe sufficient ties test. Whilst the SRT sets out a clear test to determine an individual’s residence, there are still some areas of uncertainty. For example, many of the definitions used, such as “work” and “home” are specific to the legislation and not straightforward and there are specific pitfalls to be aware of such as the hidden extra “tie” for parents visiting children who are studying in the UK.

Hidden extra tax “tie”

For individuals who are not automatically UK resident or automatically non-UK resident under the automatic tests of the SRT, whether they are UK resident will depend on the number of “ties” (i.e. links) that they have with the UK. There are five different ties:

Family tie – your spouse/civil partner or common law equivalent or minor child/children are UK resident

Work tie – you work in the UK for at least 40 days (and this applies if you work for more than three hours a day)

Accommodation tie – you have a place to live in the UK (i.e. a home, a holiday home or accommodation otherwise available to you) which is available for a continuous period of at least 91 days in the tax year and you spend at least one night there in that year. This can include accommodation owned by relatives if certain conditions are met and also rental properties

90 day tie – you spent more than 90 days in the UK in either of the previous two tax years

Country tie – you spent more days in the UK in that tax year than in any other single country (this tie only applies to “leavers” – i.e. individuals who are ceasing UK residence).

African parents with minor children studying in the UK may have a “family tie” on top of other ties and this will reduce the number of days that they are able to spend in the UK without becoming UK resident under the SRT.

Parents witha child under the age of 18 who is in full-time education in the UK should be aware that they may acquire a “family tie” by reason of their childbeing educated in the UK. This will occur iftheir child spends 21 days or more in the UK outside of term time, for example, during the main Christmas, Easter and Summer holidays (the half-term breaks are regarded as term-time); and they see their children on 61 days or more in the UK during the tax year.

If, for example, a child was to spend a week in the UK before term started in September and two weeks in the UK during the Christmas holidays (rather than returning to Africa or going on holiday somewhere outside the UK), this 21 day limit could easily be exceeded and then it would be important for the parent to keep below the 61 day limit to avoid a family tie.

If the parent did acquire a family tie as a result of the above limits being exceeded, they could end up being UK tax resident on the basis of a lower number of days spent in the UK than expected if, for example, they also have available accommodation in the UK and work for more than 3 hours a day on 40 days or more during the tax year– giving a total of 3 ties.

Nigerian parents with children studying in the UK should take advice on their UK residence position if they are unsure as to how much time they can spend in the UK without becoming UK resident.

Julie Howard is a Private Client and Tax Partner at Boodle Hatfield and Annabella King is an Associate

Annabella King

Feature/OPED

The Economic Importance of Abraka-Oben Road Rebuilt by NDDC

Published

1 week ago

03/03/2025

Business Post Contributor

By Jerome-Mario Utomi

For the good people of Delta and other adjoining states, Saturday, February 22, 2025, will remain an indelible date. The reason for this assertion is simple. It was on that day that the Minister of Regional Development, Engr. Abubakar Momoh, has commissioned the 9.6- kilometre Abraka-Oben Road reconstructed by the Niger Delta Development Commission, NDDC, in Abraka, Ethiope East Local Government Area of Delta State. He also launched the reconstruction of the Abraka-Agbor Road.

Indeed, there are reasons why the people, particularly the road users, are happy with the latest feat achieved by the NDDC Governing Board and Management.

Aside from preventing accidents and loss of lives as a result of its formerly deplorable state, it is globally acknowledged that infrastructure enables development and also provides the services that underpin the ability of people to be economically productive, for example via transport. “The transport sector has a huge role in connecting populations to where the work is,”.

Also, Infrastructure investments help stem economic losses arising from problems such as traffic congestion. The World Bank estimates that in Sub-Saharan Africa closing the infrastructure quantity and quality gap relative to the world’s best performers could raise GDP growth per head by 2.6 per cent annually.

In addition to the highlighted importance of infrastructures to the nation’s economic development, a glance through the commentaries by dignitaries present at the commission further reveals that NDDC as a commission has done well.

Delta State Governor, Rt. Hon. Sheriff Oborevwori commended the Niger Delta Development Commission, NDDC for the initiative to reconstruct the all-important access road from Abraka to Oben, saying that Mr President picked very good people in managing different ministries, departments and agencies for the good of Nigerians.

Governor Oborevwori, who made remarks at the inauguration of the reconstructed road, also thanked Mr President for picking very good people in managing different ministries departments and agencies for the good of Nigerians, Delta State Governor reiterated the state government’s willingness to partner with the Federal Government for the overall socio-economic development of the state.

Represented by the State Commissioner for Works (Highways and Urban Roads), Comrade Reuben Izeze, Governor Oborevwori said his administration remained irrevocably committed in its partnership with the President Bola Tinubu-led federal government for the transformation of the state.

He said the Oborevwori governance philosophy believes that if the Federal Government succeeds, it would dovetail in the success of the subnational governments.

He commended the Niger Delta Development Commission, NDDC for the initiative to reconstruct the all-important access road from Abraka to Oben and called for the completion of the road to Benin.

“I thank the board of the NDDC for the vision and for acknowledging the challenges and for giving the policy guideline for the execution of this laudable project. I am glad that the NDDC is giving special attention to reconstruction of failed portions on roads across the region. The Government of Delta State believes very strongly and firmly that we are partners in progress with the Federal Government led by President Bola Tinubu.

“We believe in the success of the Federal Government because of the nature of our Constitution and its operations, the success of the Federal Government will naturally translate to the success of the states as well. Governor Oborevwori therefore wishes to commend President Bola Tinubu for his support for the board of the NDDC thus far and urging him to continue to do more for the people of the Niger Delta,” he added. “I thank Mr President for picking very good people in managing different ministries, departments and agencies for the good of Nigerians,” he concluded.

Similarly, speaking at the inauguration ceremony, Engr. Momoh, said that the road projects were further demonstrations of the determination of the Federal Government to develop the Niger Delta region. The Minister commended the NDDC Board and Management for responding appropriately to the directives of President Bola Tinubu’s charge to turn things around in the Niger Delta region positively.

In his remarks, the Chairman of the NDDC Governing Board, Mr Chiedu Ebie, said that the project was a reflection of the President Tinubu administration’s desire to transform the Niger Delta Region into a zone of peace and development. He said, “Since we assumed office, this is the first landmark project being commissioned in Delta State. I commend the management team for continuously implementing the board’s policies and following President Bola Ahmed Tinubu’s directives.

“Today, we are commissioning the re-constructed Abraka-Oben Road and flag-off the reconstruction of the Abraka-Agbor Road. These are landmark projects, and I am happy with the work being done. As a Delta State indigene, I am proud that my people are well represented.”

For his part, the NDDC Managing Director, Dr Samuel Ogbuku, affirmed that the NDDC was dedicated to advancing the implementation of the President’s Renewed Hope Agenda. “We are determined to make the Renewed Hope Agenda of the Federal Government a reality in the Niger Delta region, and we remain committed to the mandate given to the Commission to change the narrative in Nigeria’s oil-producing region.

“Today, there is peace in the NDDC and the region. The youths and other stakeholders are happy with our efforts. That is the success we have toiled so hard to achieve for our people. We thank our stakeholders for their support and encouragement, which has boosted our desire to ensure that we give them what they deserve. We appreciate the state governments for supporting us and partnering with us in several areas of development. We believe that in partnership with stakeholders, we will achieve more, and development in our region will be faster and more holistic. We are not competing with any state government; we only complement their efforts.”

The NDDC Executive Director of Projects, Sir Victor Antai, gave the project brief and explained that the scope included the construction of a 9.6 km asphalt pavement with an 8m carriage width.

He noted: “The restoration of this critical infrastructure required replacing over 80,000m3 of unsuitable material and the dilapidated sections of the Araka-Oben Alignment. Before now, the road was not motorable and became a hot spot for kidnapping and armed robbery activities.

“This important interstate road project connects various industrial and agricultural communities in Delta and Edo States, facilitating the transportation of goods and services”

Also speaking at the ceremony, the Chairman of the House Committee on NDDC, Erhiatake Ibori-Suenu, congratulated the NDDC management for significantly impacting her Federal Constituency.

Speaking earlier during a courtesy visit by the NDDC team led by the Minister of Regional Development, the traditional ruler of Oruarivie-Abraka Kingdom, King Akpomeyoma Majoroh, commended the Commission for its commitment to regional development. He emphasised the strategic importance of the road project, stating: “As a serious agricultural area, most of our people are farmers. This road has facilitated the easy movement of people and agricultural produce, fostering thriving commercial activities. It is important to us, and we are very grateful for it’.’

The royal father noted that the road served as a regional link, connecting Abraka to Benin, and expressed gratitude for connecting the community to their ancestral home.

Utomi, a media specialist, writes from Lagos, Nigeria. He can be reached via [email protected] or 08032725374

Feature/OPED

Bybit Crypto Heist: Five Key Lessons to Prevent a Repeat

Published

1 week ago

03/03/2025

Business Post Contributor

Dubai-based cryptocurrency exchange Bybit was the victim of what is being widely reported as the single largest digital theft in history. Hackers extracted approximately $1.5bn (£1.2bn) from an Ethereum wallet and transferred the contents to a new, unlocatable address.

The platform has assured users of its liquidity—despite a significant increase in the volume of withdrawals in the wake of the breach—promising refunds to all affected users even if the stolen money is not recovered.

According to Osama Bari, Chief Technology Officer at D24 Fintech Group, exchanges that comply with a core set of rules will drastically reduce their chances of suffering a similar breach.

1. Multi-party approval systems

The Bybit security breach was primarily caused by vulnerabilities in multi-signature authorization and UI spoofing tactics, where attackers manipulated the interface to display different addresses. Bari said: “Even experienced professionals might overlook such discrepancies without a thorough investigation. Typically, such issues often go unnoticed during routine exchange operations.

“To mitigate such risks, exchanges should implement a threshold-based, multi-party approval system for all transactions.

“Additionally, secure platforms require real-time monitoring systems to analyze deposits and withdrawals, with automated cross-checks for unusual spikes. If required, large transactions must be manually verified with a comprehensive report. Each withdrawal should undergo a transaction audit score assessment before being processed.”

2. Ensure two-factor authentication is in place

Two-factor authentication (2FA) is a security method that requires a second form of identification to access any account information or funds.

Bari: “2FA is no new phenomenon, but its importance as a tool for verifying users and ensuring only the right personnel can manage and withdraw balances or view confidential information cannot be understated.

“This is a basic form of protection that exchanges should absolutely be offering to their customers and can be a vital deterrent for hackers as it increases the difficulty of breaching gated accounts. All financial providers have a duty to protect their users and 2FA is a guaranteed way of raising the level of in-built security they provide.”

3. Custodians are valuable third parties

Custodians safeguard assets for fellow financial institutions to reduce the risk of loss, theft, or damage.

Bari continued: “Exchanges should not underestimate the level of responsibility that comes with holding considerable volumes of assets on behalf of customers. Failure to put the appropriate measures in place to protect these funds, as we’ve just seen with the Bybit hack, could result in disastrous consequences for both the company attacked and the users impacted.

“Turning to external organizations to bolster security is a viable option for exchanges that lack the infrastructure and liquidity to manage millions, or even billions, worth of currency. Partnering with a trusted custodian will ensure that customer investments stay safe, allowing exchanges to focus on other important activities such as enhancing user experience and increasing the financial literacy of their customers.”

4. Perform a liveness check

A liveness check verifies a user’s identity through a biometric measure, for example, their face or fingerprint. 40% of banks have implemented this precaution to tackle fraud, up from 26% five years ago.

Bari: “For crypto exchanges, and financial institutions more generally, a liveness check adds that final layer of protection to dissuade hackers from attempting an attack. Having access to passwords, secure keys, or even primary devices is no longer enough to successfully bypass security measures—customers are protected as their face, fingerprints, and even voices are all unique.”

5. Make security CEXy

Centralized cryptocurrency exchanges (CEXs) are regulated intermediaries that facilitate the trading of fiat and digital currencies.

Bari concluded: “A pivotal element of cryptocurrency’s appeal throughout its history has been its decentralized nature, with many early adopters drawn to this form of tender by its anonymity. However, as crypto has become increasingly mainstream and a viable investment for individuals globally, it’s important to reshape our thinking and start putting security at the top of the list of priorities.

“Due to Bybit’s centralized approach, the exchange was able to freeze $42.85 million in stolen assets within 48 hours through collaborations with other platforms. This highlights the increased resilience of CEXs and how trusted partnerships with other organizations in the crypto field can limit the damage inflicted in a hack.”