Advances in technology come with countless benefits for society, but these advances sometimes introduce new risks as well. Various characteristics of technology, including its increasing complexity, may present novel challenges in understanding its impact and addressing its risks. Regulatory agencies have broad jurisdiction to protect consumers against certain harmful practices (typically called "deceptive and unfair" practices in the United States), but sophisticated technical analysis may be necessary to assess practices, risks, and more. Moreover, consumer protection covers an incredibly broad range of issues, from substantiation of claims that a smartphone app provides advertised health benefits to the adequacy of practices for securing sensitive customer data.
The Workshop on Technology and Consumer Protection (ConPro '19) will explore computer science topics with an impact on consumers. This workshop has a strong security and privacy emphasis, with an overall focus on ways in which computer science can prevent, detect, or address the potential for technology to deceive or unfairly harm consumers. Participants will consist heavily of academic and industry researchers but are also expected to include researchers from the Federal Trade Commission—the U.S. government’s primary consumer protection body—and other government agencies with a consumer protection mission. Research advances presented at the workshop may help improve the lives of consumers, and discussions at the event may help researchers understand how their work can best promote consumer welfare given laws and norms surrounding consumer protection.

Deep learning and security have made remarkable progress in the last years. On the one hand, neural networks have been recognized as an essential tool for security in academia and industry. On the other hand, the security of deep learning has gained focus in research, and different attacks against neural networks have been recently proposed. This workshop strives for bringing these two complementary views together by (a) exploring deep learning as a tool for security as well as (b) investigating the security of deep learning. Deep learning for security: In the past, machine learning and security researchers have lacked suitable collaborative outlets and opportunities for knowledge transfer. This has hindered progress in fundamental challenges surrounding the detection and analysis of malicious code and security threats. As a result, the research pace in this area has been limited.
The workshop aims at bringing practitioners from both fields together and exploring novel opportunities for improving the detection and analysis of attacks as well as applying novel learning architectures and concepts. Security of deep learning: Deep learning has originally not been designed with security in mind, and many learning algorithms suffer from vulnerabilities that enable thwarting their successful application. As a consequence, the workshop will also investigate the security of deep learning and discuss novel attack and defense mechanisms. Only if both views are jointly considered, the application of deep learning can have a long-lasting effect on security and bring forth novel paradigms in security applications. The workshop is aimed at academic and industrial researchers interested in deep learning and security. We are planning to invite distinguished speakers who will present recent advantages in both areas and pinpoint promising directions for research. We believe that closer interaction between both research areas will overcome current joint problems and ultimately enable a bidirectional and fruitful knowledge transfer.

Privacy engineering research has never been a timelier endeavor. Ongoing news reports regarding global surveillance programs, massive personal data breaches in corporate databases, and notorious examples of personal tragedies due to privacy violations have intensified societal demands for privacy-friendly systems. In response, current legislative and standardization processes worldwide are seeking to strengthen individuals’ privacy by introducing legal and organizational frameworks that personal data collectors and processors must follow. As a result, engineers are increasingly expected to build and maintain systems that preserve privacy and comply with data protection standards in different domains (such as health, energy, transportation, social computing, law enforcement, and public services) and on different infrastructures and architectures (such as cloud, grid, or mobile computing). Although there is a consensus on the benefits of an engineering approach to privacy, few concrete proposals exist for models, methodologies, techniques and tools to support engineers and organizations in this endeavor. Work that focuses on helping organizations and software developers to identify and adopt appropriate privacy engineering methods, techniques and tools in their daily practices is also missing. Furthermore, it is difficult to systematically evaluate whether the systems developed using privacy engineering methodologies comply with legal frameworks, provide necessary technical assurances, and fulfill users’ privacy requirements. Clearly, more research is needed in developing methods that can help translate legal and normative concepts, as well as user expectations, into systems requirements. There is also a growing need for techniques and tools to support organizations and engineers in developing and maintaining (socio-)technical systems that meet these requirements. In an effort to close the gaps in research, the topics of IWPE'19 include all aspects of privacy engineering, ranging from its theoretical foundations, engineering approaches and support infrastructures to its practical application in projects of different scales.

As the traditionally segregated systems are brought online for next-generation connected applications, we have an opportunity to significantly improve the safety of legacy systems. For instance, insights from data across systems can be exploited to reduce accidents, improve air quality and support disaster events. Cyber-physical systems (CPS) also bring new risks that arise due to the unexpected interaction between systems. These safety risks arise because of information that distracts users while driving, software errors in medical devices, corner cases in data-driven control, compromised sensors in drones or conflicts in societal policies. Accordingly, the Internet of Safe Things workshop (or SafeThings, for brevity) seeks to bring researchers and practitioners that are actively exploring system design, modeling, verification, authentication approaches to provide safety guarantees in the Internet of Things (IoT). The workshop welcomes contributions that integrate hardware and software systems provided by disparate vendors, particularly those that have humans in the loop. As safety is inherently linked with the security and privacy, we also seek contributions in these areas that address safety concerns. With the SafeThings workshop, we seek to develop a community that systematically dissects the vulnerabilities and risks exposed by these emerging CPSes, and create tools, algorithms, frameworks, and systems that help in the development of safe systems. SafeThings workshop covers safety topics as it relates to an individual’s health (physical, mental), the society (air pollution, toxicity, disaster events), or the environment (species preservation, global warming, oil spills). The workshop considers safety from a human perspective, and thus, does not include topics such as thread safety or memory safety in its scope.

Computers and open communication networks have become increasingly interwoven with our daily lives and have profoundly changed our societies. While this has significantly increased people’s well being, our growing dependence on an increasingly pervasive, complex, and ever evolving network infrastructures also poses a wide range of cybersecurity risks with potentially large socio-economic impacts. From this perspective, network traffic measurements and monitoring have become a crucial line of research. It enables to enhance our understanding of cybersecurity threats and use this knowledge to further develop new ways to detect and mitigate them. Network traffic measuring and monitoring can, for example, enable the analysis of the spreading of malicious software and its capabilities or can help to understand the nature of various network threats including those that exploit users’ behavior and other user’s sensitive information. On the other hand network traffic investigation can also help to assess the effectiveness of the existing countermeasures or contribute to building new, better ones. Recently, traffic measurements have been utilized in the area of economics of cybersecurity e.g. to assess ISP "badness" or to estimate the revenue of cyber criminals. The aim of this workshop is to bring together the research accomplishments provided by the researchers from academia and the industry. The other goal is to show the latest research results in the field of cybersecurity and understand how traffic measurements can influence it. This workshop presents some of the most relevant ongoing research in cybersecurity seen from the traffic measurements perspective. The workshop will be accessible to both non-experts interested in learning about this area and experts interesting in hearing about new research and approaches.