# The Privacy Flag Observatory: A Crowdsourcing Tool for Real Time Privacy Threats Evaluation
## 4 Implementation and Operation of the Observatory
### Mobile Applications Permissions
An application might need this information to help users optimize their daily mobility plans, to suggest nearby shops, restaurants and bars. However, location-related information is considered sensitive and, therefore, it should be adequately protected [52]. * The percentage of evaluated applications that use permissions which belong to the Microphone group: Accessing the microphone implies that it is possible, for an application, to capture all discussions and sounds in the proximity of the user's mobile phone. This is entirely normal for applications that provide real-time communication capabilities, but it can also be very risky since a malware can turn a mobile device into a powerful spying machine [53]. * The percentage of evaluated applications that use permissions which belong to the Phone group: A very limited number of legitimate applications that provide real-time communication capabilities might need to access a mobile phone's telephony subsystem. A malware, however, may use this functionality for initiating and receiving calls towards spying on users or calling premium toll numbers [54]. * The percentage of evaluated applications which use permissions that belong to the Sensors group: Smart devices are equipped with a variety of sensors to enable them to monitor the mobile phone's motion and orientation as well as various environmental parameters and conditions. If an application has access to the data of these sensors, it is possible to infer users' behavior patterns and launch privacy breach attacks related to users' physical activity and perform user profiling and tracking [55]. * The percentage of evaluated applications that use permissions that belong to the SMS group: Only a limited number of applications should require access to the SMSfunctionality, since the exchanged messages usually contain private and, sometimes, sensitive information. Therefore, if an application needs to use this functionality on the user's behalf should clearly state the purpose of doing that and receive the user's consent. Otherwise, the information contained in the exchanged messages may become available to, perhaps, malicious third parties. In addition to this, malware may send SMS messages to premium toll numbers and, thus, increase a user's mobile phone bill [56]. * The percentage of evaluated applications that use permissions which belong to the Storage group: If an application accesses the external (e.g., SD card) storage of a mobile device, it can read, write or modify the user's documents, photographs and data. This can lead to privacy violation if the user stores private or sensitive information in the mobile device's external memory [57]. Of course, for maintenance applications that need to periodically organize the contents of the mobile phone, access to the external storage should be granted. The Privacy Flag Observatory summarizes the findings of the Privacy Flag SmartApp in a set of detailed graphs. A limited number of them, due to space limitations, are shown in Figure 6. However, all the graphs are available in the Privacy Flag Observatory website ([[http://app.privacyflag.eu:2080/privacy/addon/observatory.php](http://app.privacyflag.eu:2080/privacy/addon/observatory.php)]([http://app.privacyflag.eu:2080/privacy/addon/observatory.php](http://app.privacyflag.eu:2080/privacy/addon/observatory.php)), accessed on 30 November 2022). Figure 6: Example of the graphical information provided for the mobile applications permissions section. Additionally, in Figure 7, we see an important information item provided by the platform, namely, the number of applications using permissions in each dangerous group of mobile phone components.