2021 Inria and the CNIL award: European researchers awarded for their work on privacy protection

On 24 May 2022, the co-presidents of the CNIL-Inria Prize Jury, François Pellegrini and Mathieu Cunche, gave the awarded the privacy prize to a Spanish-American research team for their paper "50 Ways to Leak Your Data: An Exploration of Apps' Circumvention of the Android Permissions System". Presented in 2019 at the Unsenix Security conference, this article meticulously analyses how apps on Android circumvent operating system protections and access information without users' knowledge or even against their choices.

The Federal Trade Commission has initiated a 2021 action regarding one of the circumvention methods presented in the article and the actors involved. The award-winning research team's work therefore had a significant impact on the protection of individuals' data.

As such, the jury considered the results presented by this research team to be of great interest to the general public, but also to policy makers, regulators and all stakeholders in the ecosystem.

The jury also wanted to distinguish the runner-up paper: "DatashareNetwork: A Decentralized Privacy-Preserving Search Engine for Investigative Journalists" by Kasra Edalatnejad, Wouter Lueks, Julien Pierre Martin, Soline Ledésert, Anne L'Hôte, Bruno Thomas, Laurent Girod and Carmela Troncoso. This article is based on collaboration with journalists to identify their needs in terms of tools to search for documents within a limited timeframe and while ensuring the confidentiality of the search.

About the CNIL - Inria Data Protection Award

Each year, this prize rewards teams of researchers located at least partly in the European Union who are working to improve the protection of personal data or privacy. Through the recognition of research, it helps to make data protection issues and solutions more visible to the general public. Finally, it offers the opportunity to raise awareness of the scientific community and decision-makers on the subject of data protection.

Acknowledgements

To award the 2022 prize, the CNIL and Inria relied on a jury of 22 internationally recognized researchers whom we would like to thank sincerely for their investment and the time they devoted to evaluating the numerous articles received:

• Nicolas Anciaux, Inria, PETRUS team
• Nataliia Bielova, Inria, PRIVATICS & CNIL team
• Reuben Binns, University of Oxford
• Joe Calandrino, Federal Trade Commission
• Kostas Chatzikokolakis, University of Athens
• Mathieu Cunche (Inria and INSA-Lyon, PRIVATICS team), Co-chair of the Jury
• Josep Domingo-FerrerRovira i Virgil University, UNESCO Chair in Data Privacy
• Sébastien Gambs, Université du Québec à Montréal
• Simone Fischer-Hübner, Karlstad University
• Oana Goga, Grenoble Computer Science Laboratory, CNRS
• Marit Hansen, Data Protection Commissioner of Schleswig-Holstein and Unabhängiges Landeszentrum für Datenschutz (ULD)
• Kévin Huguenin, University of Lausanne
• Francesca Musiani, Deputy Director of the Centre Internet et Société, CNRS
• Benjamin Nguyen, INSA-CVL , Acting Chair of the Jury
• Catuscia Palamidessi (Inria, COMETE team), Vice-Chair of the Jury
• François Pellegrini (CNIL), Co-Chair of the Jury
• Walter Rudametkin, University of Lille and Inria, SPIRALS team
• Reza Shokri, National University of Singapore
• Carmela Troncoso, EPFL
• Narseo Vallina, IMDEA Networks Institute, ICSI and University of California, Berkeley
• Félicien Vallet (CNIL), Vice-Chair of the jury
• Christo Wilson, Northeastern University