PA232 Privacy and Anonymity Technologies

Fakulta informatiky
podzim 2026
Rozsah
2/1/0. 3 kr. (plus ukončení). Ukončení: zk.
Vyučováno kontaktně
Vyučující
RNDr. Valdemar Švábenský, Ph.D. (přednášející)
Jiří Pastrňák (pomocník)
Garance
RNDr. Valdemar Švábenský, Ph.D.
Katedra počítačových systémů a komunikací – Fakulta informatiky
Dodavatelské pracoviště: Katedra počítačových systémů a komunikací – Fakulta informatiky
Předpoklady
SOUHLAS

Before enrolling, students are expected to understand the areas below. In case of knowledge gaps, catching up through self-study is necessary. Formal prerequisites are not enforced to accommodate students coming from outside FI MU.

Area Expected knowledge Relevant courses
Networking TCP/IP stack, common protocols (e.g., HTTPS, DNS), and Wireshark PB156 and PB156cv
Linux command line User-level operations (e.g., navigating the filesystem, running applications) PV004
Cybersecurity CIA triad, risk modeling, and attack vectors PV080 or PB177
Cryptography  Symmetric/asymmetric encryption, hashing, and signatures PV080
Law and ethics Essentials of the Czech Criminal Code, GDPR, and ACM Code of Ethics PV080
⚠️ When applying for enrollment:
  • Please read this course catalog page fully.
  • This is the first (pilot) run of the course. Some of the topics, especially the practical assignments, are experimental. While the instructors are doing their best to ensure everything works perfectly, you may encounter technical difficulties. If you are bothered by this, please wait until the next year of the course.
  • Next year, the course capacity will triple to 108, so don't worry if you can't get in this year :)
  • Next year, students in certain study programs will have priority for enrollment. This year, there are no limitations for the study programs.
  • In your enrollment application, describe:
    1. Your experience and completed courses in the areas above.
    2. Your motivation for studying this course and helping improve it for future students.
    3. (Optional) Any other information relevant to selection.

⚖️ The tools and practices studied in this course are essential for cybersecurity professionals. However, like all technologies, they can be misused by people with malicious intent. By enrolling, you agree to follow all legal, regulatory, and ethical requirements. These include, but are not limited to, the local criminal code and the operational rules for technology at FI MUNI. Any use of the knowledge and skills from this course beyond the instructors' explicit instructions is at your own risk and responsibility. You also agree to use what you learn only for legal and ethical purposes.

Omezení zápisu do předmětu
Předmět je otevřen studentům libovolného oboru.
Předmět si smí zapsat nejvýše 36 stud.
Momentální stav registrace a zápisu: zapsáno: 0/36, pouze zareg.: 74/36, pouze zareg. s předností (mateřské obory): 0/36
Anotace
The EU Charter of Fundamental Rights defines privacy and personal data protection as essential freedoms. The goal of the PA232 course is to teach how to protect these freedoms. The course explores tools and practices that enable private and/or anonymous communication, focusing on their ethical applications (e.g., investigative journalism, whistleblowing, or simple protection against commercial surveillance), while cautioning against their misuse for cybercrime. Through hands-on labs and case studies, students gain a practical understanding of privacy-preserving protocols, anonymity networks, and secure technologies, including their limitations and weaknesses. These topics are especially relevant today in the context of mass surveillance, information censorship, and adversarial cyber operations.
Výstupy z učení
The course prepares students for the following work roles from the NIST NICE Workforce Framework for Cybersecurity:
These areas are relevant in the cybersecurity industry, academic research, and law enforcement. Beyond work-related goals, the course aims to strengthen students' daily cybersecurity practices and their digital citizenship.

Due to the broad coverage of practical topics and the inclusion of hands-on labs, the course substantially exceeds the Privacy knowledge unit standardized by the US National Centers of Academic Excellence in Cybersecurity.
Klíčová témata
Dates Lecture Lecture content overview Seminar (+ mini-test topic) Homework / project
Week 1
14.9. ⁠⁠–⁠⁠ 20.9.		 L1 – Foundations and motivation Who uses data and how, LINDDUN threat modeling S1 – Tech. intro, LINDDUN (L1) —
Week 2
21.9. ⁠⁠–⁠⁠ 27.9.		 L2 – OSINT (Open Source Intelligence) Data and intelligence frameworks, OSINT tools, legal aspects S1 – Tech. intro, LINDDUN (L1) HW assigned (OSINT)
Week 3
28.9. ⁠⁠–⁠⁠ 4.10.		 L3 – Web tracking and defense Tracking, VPNs, encrypted DNS, hardened browsers, ... S2 – Custom VPN setup (L3) —
Week 4
5.10. ⁠⁠–⁠⁠ 11.10.		 L4 – Tor (The Onion Router) Anonymity networks and darknets, onion routing, applications S2 – Custom VPN setup (L3) HW due (OSINT)
Week 5
12.10. ⁠⁠–⁠⁠ 18.10.		 L5 – I2P (Invisible Internet Project), torrents Garlic routing, applications, case study on BitTorrent S3 – Using Tor (L4) —
Week 6
19.10. ⁠⁠–⁠⁠ 25.10.		 L6 – High-latency anonymity networks Mixnets (Sphinx packets, Nym), Hyphanet (formerly Freenet) S3 – Using Tor (L4) —
Week 7
26.10. ⁠⁠–⁠⁠ 1.11.		 No lecture: national holiday Self-study for the midterm exam S4 – I2P and torrenting (L5) —
Week 8
2.11. ⁠⁠–⁠⁠ 8.11.		 Midterm exam (written) In-person exam on lectures L1–L6 and seminars S1–S3 S4 – I2P and torrenting (L5) —
Week 9
9.11. ⁠⁠–⁠⁠ 15.11.		 L7 – Internet censorship circumvention Censorship mechanisms, methods for censorship evasion S5 – Anti-censorship (L7) —
Week 10
16.11. ⁠⁠–⁠⁠ 22.11.		 L8 – Attacks on anonymity networks Network and application attacks, operational security S5 – Anti-censorship (L7) Project assigned
Week 11
23.11. ⁠⁠–⁠⁠ 29.11.		 L9 – Secure operating systems Desktop (Tails, Qubes, Whonix) and mobile (GrapheneOS, iOS) S6 – OS and files (L9) —
Week 12
30.11. ⁠⁠–⁠⁠ 6.12.		 L10 – Information hiding, file handling Steganography, covert channels, metadata auditing S6 – OS and files (L9) —
Week 13
7.12. ⁠⁠–⁠⁠ 13.12.		 L11 – Secure email and chat messaging Email for daily operations, chat apps (Signal, Matrix, Briar) S7 – Secure messaging (L11) Report due
Week 14
14.12. ⁠⁠–⁠⁠ 20.12.		 Christmas special session Team presentations of topics not covered in any other lecture S7 – Secure messaging (L11) Slides due
All submissions (weekly feedback, homework, and both parts of the project) are due always on Sunday 23:59 (CET) in the given week.
Studijní zdroje a literatura
Přístupy, postupy a metody používané ve výuce
  • Lectures with real-world case studies, explanations of concepts, demonstrations, and interactive activities.
  • Practical seminars (lab exercises) involving the hands-on usage of relevant tools in Linux.
  • Practical homework involving the deployment of tools and experimentation.
Způsob ověření výstupů z učení a požadavky na ukončení

The total of 100 points towards the grade can be gained across two phases: (a) the semester teaching period and (b) the exam period. The table below summarizes all components; details follow beneath.

Phase Component Format Submission Max. points
(a) Semester
(max. 60) 		📊 Mini-tests (best 6 of 7) 5 single-choice Qs, 5 min, in class IS MU ROPOT ("Odpovědník") 15 (6 × 2.5 pts)
✍ Homework assignment PDF report with screenshots IS MU Vault ("Odevzdávarna") 7
📝 Midterm exam (L1–L6, S1–S3) 20 multiple-choice Qs, 80 min Paper, scanned answer sheets 20
👥 Team project PDF report + presentation IS MU Vault + in-class 10 (5 + 5 pts)
💬 Feedback (16 of 18 sessions) Substantive comments (500+ char.) IS MU ROPOT ("Odpovědník") 8 (16 × 0.5 pts)
Semester subtotal Attend 6 of 7 seminars and get 30+ points to advance 60, need 30+
(b) Exam period
(max. 40 + 5 bonus) 		📝 Final exam (L1–L11, S1–S7) 40 multiple-choice Qs, 120 min Paper, scanned answer sheets 40, need 20+
🌟 Optional bonus homework Technical report IS MU Vault ("Odevzdávarna") +5
Semester and exam period total 100 (+5), need 60

The final grade is determined based on this point scale (exact, no rounding for decimal points):

A B C D E F
≥ 92 ≥ 84 ≥ 76 ≥ 68 ≥ 60 < 60
(a) During the semester teaching period (click to show or hide details):
  • Attendance is mandatory for any 6 of 7 seminars (i.e., 1 unexcused absence is allowed).
  • Up to 60 points can be gained via the following:
    • Mini-tests at the start of each seminar (S1–S7), to practice the content from previous lectures — 15 points (max. 2.5 per test, counting the best 6 of 7 results).
      • Format: 5 single-choice questions (four answer choices, exactly one choice is correct).
      • Grading: 0.5 pts for a correct answer, 0 pts for a missing or incorrect answer.
    • One practical homework assignment, requiring the deployment of tools and writing an experience report with screenshots — 7 points.
      • Format: PDF, from 2 to 4 A4 pages.
      • An exact deadline will be assigned. Late submissions will not be accepted (except for excused absences).
    • Midterm exam, testing the knowledge from lectures L1–L6 and seminars S1–S3 — 20 points.
      • Format: 20 multiple-choice questions (four answer choices, one or more are correct).
      • Grading: Each question is worth 1 point. For each question, let K = the number of correct choices (i.e., 1, 2, 3 or 4). Selecting a correct choice scores +1/K (i.e., 0.25, 0.5, 0.75, or 1 point). Selecting an incorrect choice scores −0.25 (always). Not selecting a choice scores 0.
    • A team project: research a topic and present it at the Christmas special session — 10 points (5 for a written report due 3 days before, awarded to all members; 5 for presenting it, awarded individually).
      • Students self-select teams in an IS MU discussion forum. Students without a team two weeks before the session will be assigned one by the instructor.
      • Standard team size: 2. One trio is allowed only if the class has an odd number of students.
      • In the event of unequal contributions or if a team member drops out, students may submit a confidential contribution statement to request individualized grading.
    • Detailed, constructive feedback after each lecture and seminar, to help shape the course in future years — 8 points (0.5 points after each lecture L1–L11 or seminar S1–S7, totaling 18 possible feedback opportunities, of which 2 can be skipped).
      • Each submission must be a substantive comment of at least 500 characters addressing a specific aspect of the session (e.g., clarity of explanation, relevance of examples, or suggested improvements). Generic comments (e.g., 'good lecture') will not be awarded points.
      • The 0.5 points will be awarded automatically upon submission. The points may be nulled by the instructor during manual review if the feedback is deemed insufficient.
  • Students need at least 30 points in total across all semester components (50% of 60) to advance to the exam period; otherwise, grade X is assigned.
(b) During the exam period (click to show or hide details):
  • Final exam, testing the knowledge from all lectures L1–L11 and seminars S1–S7 — 40 points.
    • Format: 40 multiple-choice questions (same question format as in the midterm).
    • Grading: Same as the midterm.
  • Passing grade: At least 20 points from the final exam (50% of 40) and 60 points total (60% of 100 for the semester + final exam).
  • After achieving the passing grade, students may complete an optional homework for 5 bonus points.
    • Bonus points are added before the final grade is determined and can improve the grade (e.g., B → A) but do not affect the passing threshold.
    • Deadline: January 31.
    • Homework topics:
      • Improving one's own privacy/anonymity by deploying specific tools and writing a technical report (threat model, motivation, countermeasures).
      • Creating practical educational materials relevant to the course and documenting their use for both students and instructors.
(c) If you miss grade checkpoints due to medical or other serious reasons (click to show or hide details):
Missed checkpoints (e.g., seminar attendance, mini-test, homework or report submission, presentation, exam) can be replaced only with an officially excused absence recorded in the IS MU by the Faculty study department. To ensure fairness, individual requests are not allowed; please do not request special exceptions from the instructor (unless they have been officially approved by your Faculty study department first). The grade checkpoint replacement must be completed by the end of the exam period. If you have an excused absence of N days, your deadline is extended by additional N days, e.g., if you are excused on Nov 10 and 11 (2 days), and the homework deadline is Nov 12, you can submit on Nov 14. The following rules apply for excused absences:

  • Seminar: Attending a replacement seminar is optional. If you wish to attend (e.g., to take the mini-test), arrive at the start of another seminar group's session and identify yourself to the instructor in-person. Note that the instructor cannot guarantee a free seat. Emailing the instructor in advance is not needed because the seminar group's capacity is usually maxed out, and the instructor cannot know whether there will be a free spot.
  • Mini-test: Can only be taken during its scheduled week (e.g., you cannot complete a mini-test from the seminar S4 on a seminar S5). If your excused absence prevents taking a mini-test during that week, the "best 6 of 7" rule applies. If you have two or more excused absences for mini-tests and cannot replace them in another seminar group, contact the instructor to discuss alternatives.
  • Homework or team project report: If your excused absence prevents submission by the deadline, the instructor will extend your personal deadline in the IS MU Vault by N days. Submit via Vault as usual.
  • Midterm: Email the instructor within 1 week of the original midterm date to request a backup. The backup midterm will be scheduled by the instructor within 2 weeks of the request. To maintain fairness, the backup midterm will use a different set of questions from the original.
  • Team project presentation: Upload a video recording of your presentation to your personal IS MU repository ("Úschovna") and email the link to the instructor. The presenting teammate is responsible only for their own portion of the live presentation.
  • Feedback: You can miss 2 feedback options for free, since feedback is required for up to 16 of 18 sessions. If you miss more than that due to excused absences, the points are awarded automatically.
(d) Note for grading changes next year (click to show or hide details):
This is the pilot run of the course. Next year, the assessment structure will be adjusted as follows: the feedback component will be reduced from 8 to 4 points, and the homework and team project components (currently 7 + 10 points) will be reorganized into three homework assignments, each worth 7 points.

Vyučovací jazyk
Angličtina
Navazující předměty
Odkaz a informace vyučujících
Students are expected to attend a 2-hour lecture weekly and a 2-hour exercise session bi-weekly (i.e., the seminar groups alternate every other week).

All study materials, tools, and literature are in English. The default spoken language of instruction is English for all lectures and seminars. If all attendees of a particular seminar group speak Czech or Slovak, the group may agree to switch to either language.

Many other relevant topics cannot fit into this course and are covered in other courses:
  • Privacy and data security related to AI — PV302
  • Bitcoin and cryptocurrencies, Signal protocol in low-level detail, trusted boot, Android security modules — PV204
  • PGP/GPG email encryption and signing — PV181 
  • Hardware security modules — PV079
  • Network traffic analysis — PV280
  • Legislative aspects — Institute of Law and Technology
Další komentáře
Studijní materiály
Předmět je vyučován každoročně.
Výuka probíhá každý týden.
  • Statistika zápisu (nejnovější)
  • Permalink: https://is.muni.cz/predmet/fi/podzim2026/PA232