Sophina Kio-Lawson, also known as ‘Sophieontech’ across social platforms is currently a platform security analyst at Meta where she focuses on third party apps that pose a threat to abusing Meta (previously Facebook) user data and privacy; she also manages the data abuse bounty program. Sophina has a cybersecurity professional background which stems from years of experience in testing web applications for security vulnerabilities, conducting security audits and training for Fortune 500 companies to SMEs and NGOs across West Africa and Europe. She is the co-founder of SheSecures, a community platform which empowers young African women to pursue careers in tech and cybersecurity. In this interview with IVI PR, she speaks about data privacy and protection concerns for individuals using the internet.
Why is data privacy important especially for individuals who are active online?
I think everyone should care about their data privacy and it does not matter if you are active online or not. In the world today, particularly on social media, people are easily showcasing their vulnerability, authenticity and various versions of ‘living their best lives. People actually claim that they have nothing to hide but I usually say that if you have a curtain in your house, that means you consider privacy important to an extent. Privacy must be applied everywhere and online. You do not have to put everything about you out there and you must think before you share.
Also, the onus should be on everyone, those who manage the data to those who provide the data willingly – in this case active online individuals. Last year in January there was the situation where the National Identification Numbers (NIN) of millions of Nigerians were made easily accessible to hackers and the database got hacked. This is data that could potentially be used to create new identities like your passports, register your SIMs, perform KYCs (Know Your Customers).
Now, this was not just individuals who were active on Twitter or Instagram, this affected everyone. So, we should all consider data privacy important. We have the right to question and hold accountable platforms or institutions not taking good care of our data by enforcing strict security protocols to protect those.
The recent buzz in the Artificial Intelligence (AI) space is been ChatGPT. Are there any known data risks you would like to identify with the AI innovation?
When it comes to ChatGPT and any other AI platform out there, the major thing I can say is do not feed in anything personal or sensitive you would not want the AI model storing about you. Because once your personal information is in there, it is often hard to delete even after you have deleted your account.
As to known security risks, we have seen individuals misusing the AI model to get novel ways to conduct phishing scams down to crafting malignant malware that evades detection. So, I would say for now the security risks definitely outweigh the data risks. Therefore, tread carefully.
Also read: SFS Fund Mobile App records increase in users’ download by 300%
As of January 2022, Nigeria had 32.9 million active social media users. How can social media users in Nigeria keep their social accounts safe from hackers?
It often sounds like cyber security professionals keep saying the same thing repeatedly. But it is genuinely because we care, and we also do not want you waking us at 6am to alert us that your social media account got hacked.
It is the simple things that can be done to keep your social media account safe from hackers. Just like ‘an apple a day keeps the doctor away’, a Strong password, two factor authentication on your social media platforms, that is a password plus an authentication app like Microsoft Authenticator or Duo to generate codes. Also, ensuring that you do not click on suspicious links from both people you know or do not know can keep the hackers away.
What do social media users in Nigeria do when their accounts get hacked?
If your account gets hacked, you should first try to get back control of your account with the help of the official social media account team. Secondly, you should reset all passwords that have been connected to that account; this could include third party apps that you had previously linked, including the account’s password. Thirdly, look out for unauthorised devices or locations that are linked to that social media account and remove them. Lastly, ensure you set up two factor authentication for that account to prevent the hackers from gaining control again.
Beyond social media sites getting hacked, how do individuals mitigate the risk of getting their emails hacked?
I would say, a lot of the techniques from social media security apply here. Do not use the same email for everything. By everything I mean for both professional and even signing up to that deals or discount page, forums, email alerts and what not. Separate them by having dummy emails for separate activities. Have a strong password and enable two factor authentication. Scrutinise every email that comes to your mailbox even if you’re expecting it, that means observe the sender’s address. Do not open links or documents you are not sure of and report to your internal security immediately once you receive anything suspicious.
Is it true that some trending social media challenges can expose users to hackers?
Yes, that’s true! This is because most humans can never be trusted to not use something intended for good for their own malicious gains. I can think of two challenges across TikTok and Instagram where users have participated just for fun and attackers would take advantage of it. For instance, the Silhouette Challenge or the Invisible Challenge can have attackers try to lure people who want to see the faces behind the images by sharing links which promises to reveal these images but once you visit those links, the malware self-activates and can go on to steal sensitive information and even gain access to personal information like their crypto wallets. On the other hand, there are software out there which reveal the underlying image of the nude figure. So, I guess it’s really a ‘pick your poison’ kind of deal or just steer clear of certain challenges entirely.
Nigeria also has a huge population of smartphone users, about 80.93million in 2021. How easy is it to get smartphones hacked and can it also be prevented?
I’d say it is easy for some devices than others. And depending on the user’s relationship with their smartphone too. So, If Apple or Google releases an updated operating system that fixes an issue that they have found to be exploited by hackers, and users keep procrastinating because they think it’s going to take so much time to update or the internet data has limited bandwidth; you open yourself to the possibility that your phone could get hacked. It could happen when you open a vulnerable app from the Google play store or Apple App Store that a malicious developer built and uploaded which relies on the vulnerability of the old mobile operating system and the gullibility of people who are yet to update those.
Nigeria, last year, recorded the most Bitcoin Searches on Google globally. How do investors protect their Bitcoins against theft and hacks?
I guess some of the ways that Nigerian investors can protect their bitcoins or other assets against hackers is by ensuring that first, they use strong and unique passwords. Secondly, use the most secure versions of two factor authentication available for your crypto account. Thirdly, make sure you never give anyone remote or admin access to your accounts. Don’t also share your credentials to people claiming to be account managers. Fourthly, protect your private keys like your life depends on them. Lastly, don’t make yourself an easy target by bragging about investment returns or wins.
Thinking about data privacy and online advertising, are there ways hackers can have access to an individual’s data collected via behavioural tracking for instance and how can this be avoided?
Statistics from Nira.com in 2023 state that it is already estimated that hackers will steal 33 billion records. The ‘how’ this happens, may not be obvious at first glance. I don’t expect hackers to go about investing in screen sensors in devices or identification algorithms on websites just so that they can maliciously retrieve data of individuals. With cyber-theft and data breaches becoming an increasingly common occurrence every day, hackers would focus on the organisations that collect these data. Depending on how robust the security infrastructure of these organisations are, that would determine how much the hackers are able to obtain. Individuals will need to be careful about how much personal data they give off that can be tracked. Use anti-tracking tools, secure browsers or Ad Blockers that help reduce this like Brave, Chrome, DuckDuckGo, UBlock Origin etc.
Do you see the data and privacy narrative taking a more prominent position this year considering the increase in the global statistics of hacking?
Absolutely! This is not the first time that conversations about data and privacy are being sparked, people have been terrified. In 2018, GDPR came into force and privacy and data protection regulators now ensure that businesses or companies who process large amount of personal data regularly; down to those who use it for processing behavioural biometrics strictly do so under guiding privacy rules. So yes! In 2023, we should definitely see more privacy regulators scrutinise companies in Africa and Europe. These regulators examine whether the benefit of a particular technology outweighs the impacts on the privacy of these citizens.
