Ever gotten an ad that seemed too precisely targeted? Was it selling you something you’d just told a friend about? Did you wonder whether your phone, computer, or smart speaker was listening to you more than their manufacturers let on?

Well, microphones may be the only method of data collection you don’t need to worry about—for now.

“That’s a common urban legend that we hear. We investigated apps that can record audio and found that they don’t seem to be recording your conversations when they shouldn’t,” said David Choffnes, associate professor at the Khoury College of Computer Sciences. “But many other things you do online leak plenty of information for targeting. We don’t always know why you see the ads that are displayed. Some are coincidences, some are pervasive online tracking that allows hyper-targeted advertisement.”

At a time when our data is frequently collected, leveraged, and stolen, Choffnes has studied the devices in our homes, pockets, and purses to find out how they compromise us. Now, as the new executive director of Northeastern’s Cybersecurity and Privacy Institute, his goal remains the same.

“I realized by turning over rocks and looking in dark places, there were all kinds of creepy-crawly things,” he said. “I’m particularly focused on things that we use every day, the risks of using those systems, and how we can make them better for consumers as opposed to the companies or bad actors who are trying to access or steal our data.”

Researching the things companies would rather we didn’t know

Choffnes’s path wasn’t always a straight line. After pivoting from undergraduate study of physics and French to a networking and distributed systems specialization, he says he “tripped and fell into security and privacy.” He became interested in mobile devices as cell phones became more ubiquitous, with Edward Snowden’s 2013 revelations further spurring his interest in privacy.

“With these phones, unlike our PCs or laptops, we had almost no visibility into what they were doing with our data, and the data they had was more personal than ever,” Choffnes explained. “I started looking at network traffic as an internet user wanting to make things better for myself … It started me down this path of asking ‘What are these apps doing with our data? How many other people are getting access to it?’”

These questions have underlined much of the research Choffnes has undertaken since joining Khoury College in 2013. Chief among those is ReCon, which uses machine learning to detect personal information leaks in network traffic, then alerts users.

“We came up with ways to automatically detect when your personal data was being sent by these apps without you having to tell us what your data is,” Choffnes said. “And then allow people to tell our system to change or block that data. Our analysis substantially improved mobile app security and privacy.”

After a 300-user study demonstrated ReCon’s efficacy, Choffnes and his team passed their findings to app developers, regulators, and app stores. App developers fixed cases where passwords were sent over the internet without encryption, regulators used ReCon to investigate potentially deceptive business practices, and the Apple and Google Play app stores banned third-party app code that recorded users’ screens without their knowledge.

ReCon is a rarity among computer science research efforts in that it provided the foundation for Harvest, a 2017 documentary that appeared at several prestigious film festivals. But if that wasn’t enough, another of Choffnes’s projects is big enough that it has its own apartment. Literally.

Tucked within Northeastern’s Interdisciplinary Science and Engineering Complex is a custom-built, one-of-a-kind lab designed like a small studio apartment. It’s called The Mon(IoT)r Lab (pronounced “monitor lab”) as a nod to the Internet of Things devices researchers monitor for privacy issues. CPI personnel can use the space and interact with its devices, which are connected to a router with packet-recording software.

“We monitor all of the network traffic, and we observe potential privacy and security concerns that arise when you’re completely surrounded by devices … that share data with third parties,” Choffnes explained. “In many cases, you have to actually interact with these devices to see what the risks are, so it’s essential to have a ‘living’ lab scenario.”

One example is their smart fridge, replete with interior cameras, a tablet interface, and Android apps. Over the four years they’ve owned it, the fridge has made increased use of its cameras to scan food items and make recommendations. It leveraged an existing feature for a new data-sharing purpose.

Another example is Amazon’s Ring doorbell, which, when accessed via phone app, shows a green light to indicate that it’s recording. But Choffnes’ team found that it would also record when it detected motion, this time without displaying the green light. There was no mechanism to make it stop, and accessing the resulting videos at all required a more expensive subscription.

These often-invisible shifts, Choffnes said, point to a worrying reality.

“It ends up that you’re not buying the product,” he concluded. “In this case the product is you, and the companies are putting the smart features in so they can record what you’re doing and monetize that data.”

How can we protect ourselves online?

In many respects, Choffnes notes, “we’re unfortunately at the whims of these companies that collect data as disclosed in their fine print.”

“Given the lack of strong privacy regulations that protect consumers in the US, there’s a lot of burden on us as individuals to protect our privacy,” he said. “And that is often too much of a burden for us to bear. Most of the time we just click ‘okay’ and accept whatever they’re asking for.”

But Choffnes notes that we can take some protective steps.

“It’s hard to use the services we know and love without giving up a lot of our data; these services were designed that way,” he conceded. “So when it comes to installing an app, just think twice. Do you really need that app? Do you need yet another company to get access to your data? When you get data requests, can you use the app without honoring those requests?”

Choffnes also recommends a password manager, which is usually free and enables you to change your passwords often.

“The idea is that you should never have to write down your passwords,” he said. “Ideally you have software that generates random, strong passwords and fills out the password fields for you.”

Backing up the manager with multi-factor authentication, he added, should thwart most attacks.

“If you have multi-factor authentication, the attacker still needs something else—like your phone or a phone app that generates a unique code—to fully compromise your account,” Choffnes said. “At some point, we’re all going to be victims of some form of cyberattack. These techniques limit the damage that anyone compromised credential could have.”

Choffnes also wants the study of computer security and data protection to be taught to kids in the same way other types of safety are, so that they can understand the necessity and methods of shielding themselves.

“What I’m talking about is not rocket science,” he said. “Cybersecurity awareness is just something you get better at over time and it becomes second nature.”

What’s next?

Much of Choffnes’ recent work falls within the five-year-old Cybersecurity and Privacy Institute. With 17 core and affiliate faculty spanning Khoury College, the School of Law, CAMD, and the College of Engineering, the CPI collaborates on interdisciplinary cybersecurity research topics including mobile devices, cryptography, cloud security, malware analysis, and machine learning. It also offers undergraduate, graduate, and doctoral degrees in cybersecurity, and integrates with other universities, technology companies, and defense contractors. In July, Choffnes became the CPI’s third executive director, a position he expects to hold for two years.

On top of his directorial responsibilities, Choffnes is continuing with some highlight-reel research endeavors. One, a multi-university project funded by $10 million from the National Science Foundation’s Secure and Trustworthy Cyberspace Frontiers program, is a collaboration with Khoury College Interim Dean Alan Mislove and School of Law affiliate CPI member Woody Hartzog.

“It’s about developing a stronger understanding of how data collection over the internet affects individual privacy, and developing new software, hardware, and policy recommendations focused on safeguarding personal data,” Choffnes explained. “The award sends a strong message that we need this kind of multidisciplinary approach to solve our online privacy and security issues.”

READ: We know companies are collecting and sharing our data. Is there anything we can do about it?

Another project, powered by a five-year, $15.7 million NSF grant, is on the horizon. Led by the Network Science Institute’s David Lazer, and in collaboration with Choffnes and CPI colleague Christo Wilson, the team is planning to build what Choffnes calls “an observatory like Hubble, but instead of looking at the stars, to look into how people interact with the internet and how those interactions influence society.” It will provide a platform for open and ethical data collection that allows researchers to study important aspects of online human behavior, including the political and social impact of misinformation, disinformation, and social media content algorithms.

“We’re building infrastructure that is not just for us to research things,” Choffnes explained, “but to allow other researchers to deploy their own experiments to see what people are seeing online, what the implications are, survey people’s opinions about the things that they’re seeing, and get a much richer understanding of what people are doing online and what the impacts of it are.”

These large efforts allow Choffnes to focus on his passion: improving internet performance, privacy, and security. He strives for a world where internet users can better control their data.

“I think people are becoming more aware of online privacy and security,” Choffnes said. “Our mission since starting CPI has been to safeguard critical technology and to create partnerships with experts, industry, government, and academia worldwide. The recent NSF grants are helping us to substantially move the needle on these topics, with the potential for enormous impact.”

With twin passions for learning and helping others, Taryn Tessari is constantly improving her understanding of issues surrounding equity and inclusion to help faculty succeed. As manager of faculty affairs for Khoury College, Tessari works with a team to manage the tenure and promotion processes for faculty, and she also organizes faculty meetings and programming. In this interview, she dives into her focus on equity in higher education and goals to create a stronger faculty community.

What led to your passion for faculty development?
I sort of fell into faculty affairs initially. When I first started at Northeastern as an administrative assistant for Bouvé College in 2017, I was fortunate to have really good mentors, both faculty and staff, some of whom had been at the university for over 30 years. I was in awe of my first boss’ passion for faculty affairs, specifically her passion for helping faculty succeed, and am truly grateful to have learned that from her.

Faculty are truly amazing—they persist through so many obstacles, especially in the early years of their career as they balance research, teaching, service, and many other things. So I became really passionate about working with faculty and guiding the process by which they advance their careers.

How has your position evolved since you first became manager of faculty affairs in 2019?
I feel really fortunate to be in Khoury, specifically because computer science as a field is growing so much. One way that my job has changed is that we’ve hired so many more faculty, which is amazing because then we can serve our student population better. With the significant growth of faculty, my position has expanded to assisting with faculty hiring and creating more faculty development programming. As we move into the network campuses, we need more faculty programming to continue to increase everyone’s sense of belonging and support.

I also went from learning how Khoury operates to identifying areas where we can improve processes and make them more efficient for faculty. I’m now in a position where I can really make suggestions for improvements and find ways we can connect faculty more with one another and the Northeastern community as a whole.

What has been your proudest accomplishment in this role so far?
My proudest and most favorite accomplishment has been helping faculty every year through the tenure and promotion process. There are 10 to 12 faculty that go through this process every year, and it is such a joy for me to assist them through this. Every year in May, it’s so great to see the faculty being tenured and promoted, and they can really see the fruitfulness of their work as they advance their careers. So if I can play a small role in ensuring effective communication and support, then it’s something I’m grateful for every year.

What sparked your career in higher education?
I joined higher education so that I could be a student forever. It sounds so cliché, but I really am a lifelong learner. So, to me, education was a natural progression as I was starting my undergraduate career. Originally, I thought I was going to be an elementary ed school teacher, so sometime after college, I ended up working for an elementary school where I managed a before-school/after-school program. But as I was in this program, I felt there was not as much creativity at this level in teaching because the curriculums can be so strict from the state.

Then I decided that I really wanted to go back to school to get my master’s, and so I thought, “How can I do this in a cost-effective way?” With my desire to pursue a master’s degree and continue as a life-long learner, Northeastern was a natural fit.

Why did you choose Northeastern?
I was really drawn to the Master of Education program because it marries education and real-world experience. That’s a big piece of what education should be: giving you the tools to succeed in the career that you want to have. That was a unique aspect of Northeastern that I didn’t find anywhere else. Also, my dad was a Northeastern alum, and I was always inspired by his drive to pursue future education while working full-time. So everything was pointing me to Northeastern in different ways.

What do you enjoy doing outside of work?
Spending time with friends and family is the number one thing I love to do. I also have two ragdoll kitties, Ollie and Luna, that are floppy, fun, and still a little rambunctious. Pre-pandemic, I loved to travel, go to new places, and meet new people. I especially would want to go back to Greece at the earliest opportunity—I’m a huge history buff. Also, whole-body health, like working out, learning, and self-care, is definitely a passion of mine.

Finally, I’m hoping to start my doctorate of education in 2022. I want to dive into research, figure out what the best practices are, and learn what the obstacles are and how to combat them. I also definitely want to zero in on equity issues in faculty affairs. But I’m still in the application process, so fingers crossed!

Recently, you completed a Diversity and Inclusion Certificate from Cornell and a Cultural Competence in Computing Fellows Program at Duke. What inspired you to pursue this?
Creating and cultivating authentic diversity, equity, and inclusion is vital to education. While it is collective work, it is also individual work. Decolonizing our own minds and taking accountability for our thoughts and actions can really help us connect better and more safely with everyone. Once we admit to the many privileges we benefit from, that is when we can begin to dismantle systems of oppression within our organizations. This is where the real work begins in creating authentic and equitable campus spaces.

In terms of faculty affairs, there is a huge focus on recruiting, developing, and retaining faculty, and that’s a priority for Khoury and Northeastern as a whole. But the only way we can do that is by increasing the sense of belonging for our faculty. Developing equitable and sustainable practices for our faculty is at the heart of why I chose to pursue these opportunities.

What have you learned from those two experiences?
Engaging in antiracism work and recognizing our own privileges is a step we should all be taking to be consciously aware of our own biases. In order to create faculty programming, we need to have self-awareness, as well as an awareness of others’ perspectives, to create safe spaces for faculty. That’s the biggest takeaway that I’ve come across.

Also, specifically when getting my certificate from Cornell, my professor, Dr. Mikaila Brown, was very affirming in the way she teaches and facilitates courageous conversation, and the number one thing that she taught me was how to be my authentic self.

What have you learned in the past school year in COVID-19 that has informed your work in the future?
The number one thing that I’ve thought about in relation to COVID-19 is accessibility. For example, providing closed captioning for meetings is something that I unfortunately didn’t include in pre-COVID times, and it is so important that we provide this moving forward. It provides transparency and also support for everyone. Ensuring everyone has access to materials, Zoom calls, and everything in between is a big focus of mine moving forward.

Relationships are another focus as well. Providing support for faculty mentors and mentees, while also giving folks guidance to be able to have successful relationships, is really important moving forward.

How do you hope to advance Khoury’s mission through your work?
“CS for all” isn’t just about admitting students from underrepresented groups, and same with faculty. It really begins at creating equitable processes for everyone to excel to their fullest potential and creating opportunities where it’s okay to ask for help or propose an idea. Creating that psychological safety in our community is really important and makes everybody better faculty, better students, and better people. And it’s through faculty programming and support where I’m pushing forth that mission.

It was extraordinary, but you had to look closely to spot it.

Tucked into the June 20, 2019 issue of Nature was a paper titled “De novo protein design by citizen scientists.” Among its 21 authors was one credited as “Foldit Players.” And if you were wondering what sort of hipster parents would name a child that, it turns out something far more fascinating was going on.

Those researchers earned the credit by playing Foldit, an online game in which they fold proteins into new and more efficient shapes. In July, the structures they built were featured in a popular feature by Protein Data Bank, a database of protein structures used by researchers.

“The players were really excited to be Molecule of the Month,” said Seth Cooper, assistant professor at the Khoury College of Computer Sciences  and Foldit’s original lead designer. “Seeing the players involved in other aspects of the scientific process and get recognized for the work—or play—that they did, that’s really fun and exciting.”

If Cooper and his doctoral student, Josh Aaron Miller, have their way, it won’t be the last time it happens. Through their continued work on Foldit and on scientific discovery games, the pair aim to turbocharge scientific discovery by harnessing and developing the creativity and knowledge of the gaming world. And they know it has educational potential, too.

“Games tend to provide experiential learning, which Northeastern is huge on,” Miller noted. “You’re interacting with the medium, you’re experiencing it, and that opens up a lot of potential for active learning.”

Crowdsourcing science through video games
As a scientific discovery game, Foldit falls into the larger category of citizen science, in which the contributions of amateur scientists are crowdsourced and combined with those of professionals. It’s as fertile a ground as any for innovation and unconventional research methods, and it offered a natural path for a budding computer scientist inspired by his childhood love of video games.

“As an undergrad I got into computer graphics, interactive simulations,” Cooper recalled. “Then I went to grad school, and in a way, computer graphics was as close as you could get to game-related things in an academic setting at that time.”

At the University of Washington, Foldit presented itself as an ideal doctoral opportunity. The idea, Cooper said, “was to take human reasoning, problem-solving, and spatial abilities, then apply them to solving challenging computational problems.”

Though the team didn’t know exactly whether or how Foldit would work, they knew that protein folding was an ideal game candidate. There was a community of people interested in Foldit’s screensaver-based precursor, Rosetta@home. The complex three-dimensional nature of protein folding demanded human creativity, not computational brute force and number crunching. And, as Cooper noted, “people could think about and solve the puzzles without necessarily knowing the exact biochemistry behind it.”

What they produced was a platform to which professional scientists uploaded unfinished folding puzzles, which players manipulated following rules for stabilizing interactions. The computer would refine the fit, then researchers would examine the best solutions, looking for configurations they could apply to real proteins. The result, ideally, would be scientific innovation.

Getting there required threading multiple needles. Foldit needed to be interesting, fun, and accurate enough that player contributions would be scientifically useful. It also, Cooper noted, required a method of quickly translating biologically sound structures into scores to entice players. Do that, and they could unlock the educational and scientific potential unique to games.

“The instructional method is responsible for how much you learn and how much you’re motivated to learn,” Miller explained. “But the power of the medium is the efficiency of delivering that, the ease of access, and the cost of doing that instruction.”

And Miller knew from experience just how fluid game-related learning could be. He recalled taking an undergraduate neuroscience course where the presentation style made otherwise understandable material tricky to absorb.

“It got me thinking, ‘Why is it so hard to learn in class when I can still remember dungeons from Legend of Zelda from 10 years ago?’” he said. “All of these video game things are ingrained in my memory.” He noted that the prospect of making scientific contributions can draw players, but only entertaining gameplay can retain them.

Foldit has succeeded beyond its makers’ wildest dreams, attracting hundreds of thousands of players across its 13 years. Cooper attributes the success partly to players sharing strategies, collaborating, and discussing the game on forums. Miller recently won a Rosetta Service Award—awarded by the group that created the modeling software Foldit is based on—for his community building.

“I created a Discord for Foldit which now has over 2200 members,” Miller said. “In July 2020, I started writing a weekly newsletter and sending it to anyone who wanted to subscribe. We have about 100 subscribers, plus more read it once it’s posted to the forums a week later. The newsletter shares weekly tips and the top solutions players come up with.”

Some of those top solutions have turned heads. A handful have matched or bested algorithmically computed solutions and player efforts could help to improve the algorithms. Players have created 56 unique synthetic proteins from scratch. And, in arguably the most remarkable case, scientists turned to Foldit players for help solving the structure of a protein that causes AIDS in rhesus monkeys. An accurate shape would have given scientists a better chance at designing antiretroviral drugs.

The scientists, using traditional methods, had worked for more than ten years without solving the problem. Foldit players solved it in ten days and when it came time for research credit, the players who spearheaded the solve, true to citizen science form, asked that they be credited not as individuals, but by their Foldit team name.

The future of the field
In 2020, Google’s DeepMind debuted AlphaFold 2, an artificial intelligence program that predicts protein folding. Co-founder Demis Hassabis noted that Foldit inspired him to wonder if AI could mimic the gamers’ intuitive capability.

“AlphaFold 2 is a big deal in terms of the quality of the structures it produces compared to previous methods,” Cooper said. “Machine learning has been increasingly looked at in bioinformatics and protein structure prediction in the past few years.”

But Cooper also noted that there is still room for AlphaFold to progress, and that Foldit has spent the last few years moving from protein structure prediction—what AlphaFold does—toward the design of novel proteins. And as long as there’s a role for Foldit, Cooper and Miller are resolved to continue improving it.

The tutorial is a huge focus of this effort, and when Miller arrived at Khoury College in 2017, he went to work on it. It’s a three-pronged approach, he said, in which the tutorial makes a positive impression on new players, improves the odds of retaining them, and helps them understand the game and its goals.

“To make a useful contribution, you need to understand what you’re doing and build up expertise,” Miller said, before pivoting to Pixar’s Ratatouille as an example. “‘Anyone can cook’ means a great cook can come from anywhere. To play these games, you don’t need to know the biochemistry. But by playing, you intuitively understand the rules of the biochemistry, learn your own expertise, and learn to fold proteins based on that … I’m researching how to make that learning easier, how to onboard people better. Because sometimes it can take years for people to get enough expertise to make meaningful contributions. We want to shorten that gap.”

For his doctorate, Miller plans to overhaul the Foldit tutorial using the four-component instructional design model. He’ll conduct a skill-based cognitive task analysis of how users play and what the experts do, then develop a curriculum teaching new players to understand the game like the experts.

Cooper added that they are trying to leverage player data to make the tutorial levels more interesting, possibly by customizing their difficulty to each player’s demonstrated skill level.

“A lot of people come in, look around a bit, and leave,” he noted. “So, we’re trying to help new players get involved and not get discouraged by the relatively challenging problems they have to work up to.”

They also want to overcome the barriers that confine citizen science games to what Miller called a “quiet indie space.”

“Developing citizen science games is a strongly interdisciplinary practice; it requires a lot of expertise from a lot of distinct fields,” he explained. “You need scientists working on it, but you also need professional software developers, game designers, producers, marketers, journalists, community managers, QA testers.”

Combine that with the differences in funding models—grants for science, sales for game studios—and you get underfunded, understaffed citizen science games.

“They suffer in several ways: unfinished game design, unpolished gamification, software issues, technical issues, bugs, crashes,” Miller said. “The scientists don’t have time to communicate, and they’re not working with science journalists who can help them describe what’s happening in a way that’s accessible.”

But Cooper and Miller remain hopeful for the field’s future. Each pointed to the inclusion of citizen science components in mainstream blockbuster games—Miller named EVE Online and Borderlands 3—as evidence that something bigger could be on the horizon. And Cooper cited similar citizen science games dealing with neuron tracing, RNA folding, genomic sequence alignment, and image categorization as standouts.

And they know just how valuable it will be for scientists to bring quality game designers into the fold.

“I don’t think making something a game inherently makes it easier or more fun to learn,” Miller says. “It really is about the execution.”

---