Every day, more organizations, companies, individuals, and entities need to generate, collect, use, process, disclose, and so on, personal information to carry out their processes and business. A growing and significant level of misuse of individuals' personal information has been observed among numerous organizations that prefer to pay fines for violating data protection laws. These organizations offer countless excuses, such as lack of knowledge, management costs, outsourcing, insufficient employee training, and the use of modern technologies like the industrial metaverse, high-performance search engines, social networks, cloud/edge computing, generative AI, digital twins, and so on. In recent years, there has been a global increase in interest in protecting information privacy through the use of technologies that operate both at the organizational and systems end and at the end of the personal data flow from the individual/entity. Modern versions of Privacy Enhancing Technologies (PETs) offer ways to block, limit, and control privacy intrusions. They help data controllers comply with privacy laws and principles, preserve anonymity and confidentiality, provide physical security for data, and offer individuals greater control and choice. It's time to properly protect the reputation and rights of all individuals (natural and legal persons) and entities (generally: machines, AI entities, etc.) regarding privacy protection. Personal information is any subjective or factual information, recorded or unrecorded, that relates to an identifiable individual. Examples include name/age, identification numbers, sexual orientation, ethnic origin, blood test results, opinions, evaluations, comments, social status, disciplinary actions, employee files, income, medical records, the existence of consumer-vendor disputes, loan records, etc. PII (Personally Identifiable Information) is any data that uniquely correlates or links an individual to other pieces of data. Examples include PINs (Personal Identification Numbers), access cards, passwords, fingerprint/retina scans, biometric data, email addresses, IP or MAC addresses, GPS/G2G coordinates of a residence (e.g., 43°10′2″N, 2°40′10″W), etc. This type of information should be treated in the same way as personal information collected in any online or offline environment. Privacy is the fundamental right of every individual to decide on the custody, transfer, and processing of their personal data, as well as to protect all aspects of their privacy.

XNG PROTECTION STRUCTURE TO EMPOWER PRIVACY.
XNG Protection creates a massive, proactive, and disruptive defense that not only protects in-situ/fixed-presence but everywhere, moving nomadically to predictively, preventively, and proactively block/neutralize all possible forms of cyberattack in a self-orchestrated, autonomous, extended, and redundant manner, blending multiple dimensions/planes/AI-ZT-ZK-B/AD—regardless of the attacker's sophistication. At the core of XNG Protection to empower privacy is the most advanced, mature, defense-in-depth, by-design, certified, and cyber-resilient cybersecurity. Without integrated cybersecurity, there can be no privacy (for example, if identities, content, etc., are not protected, there will be no privacy). Privacy protection can never be achieved solely through: words, meetings, intentions, recommendations, awareness, laws (e.g., GDPR, LOPD, etc.), soliciting user/entity opinions using misleading or ambiguous interfaces, etc. What is needed are multidimensional, structured (by blocks, zones, etc.) and unstructured, overlapping networks with elastic redundancy of "nomadic, self-orchestrated privacy protectors" (which are multi-layered systems based on cyber-resilient automated mechanisms with observation/monitoring capabilities and the ability to proactively take self-orchestrated, predictive defense actions that are automatically deployed as nomadic privacy protectors (AI-based mobile privacy defense malware such as DAIM/MIAD, everywhere privacy protection processes, etc.) to achieve protection that truly empowers privacy in depth, efficiently, and effectively. Therefore, entities/individuals/organizations alone cannot achieve privacy protection because our technological, digitized, hyperconnected world incorporates countless new devices every day. comprised of: satellite/nanosatellite networks, multiple communication systems (WiFi, Bluetooth, Sigfox, Zigbee, 6LoWPAN, LoRaWAN, ultra-wideband/BUA, ISM, DECT-NR+/ETSI, 2G/GSM-2.5G/GPRS-3G-4G-5G, 6G, cloud/fog/edge computing, telecommunications companies that are cyber-attacked, etc.), smartphones, tablets, PCs, smartwatches, IoMT devices (such as pacemakers, insulin pumps, etc.), IoT objects (in connected vehicles/smarthomes/smartcities/smart appliances, streets, businesses, portals, fields, cyber-attacked stores/supermarkets, cyber-attacked banks, etc.), IIoT in Industry (with digital twins and industrial metaverse, etc.), surveillance cameras and microphones in more and more places, lack of updates to Drivers, operating system and registry problems, roaming malware that monitors everything, animals equipped with microphones/microcameras (insects, birds, etc.). We also encounter data capture on social media, instant messaging, drones/satellites, cookies, video calls, etc. Some reasons why privacy is not adequately protected in our (analog-digital-quantum) world, where money/power rules, are malicious individuals and cyber attackers who exploit vulnerabilities that are growing exponentially every day in the hardware, firmware, and software (apps/APIs, programs/operating systems, etc.) that are developed without key methodologies such as DevSECOps/DevPRIVACYOps. The processes for identifying, authenticating, authorizing, access control, account management, and identity management are deficient. There is a tendency to try to contain everything on a single device (this is an aberration since it aids cyber attackers and generates (poor availability), clouds are often not properly protected (there are leaks between virtual machines/VMs (a hypervisor controls several operating systems on a server), which are not always watertight and belong to unrelated entities. Cloud applications are built using containers (containerization uses a single operating system that provides user spaces called containers for the applications it runs) and are composed of numerous microservices. They are orchestrated by platforms such as Kubernetes (for container orchestration), which manages the deployment and scaling of containerized applications, and Docker (for creating containerized applications). Encryption and digital signatures are flawed, passwords are reused, have very low entropy, and are captured at the sender and receiver (e.g., with keyloggers, webcams, sniffers, malware, and API vulnerabilities) and during their journey through intermediate communication service providers. ZK-ZT technology is not used, and biometrics can be spoofed by various mechanisms. AI/Deep-fake, updates (e.g., OTA/Over-The-Air) are not adequately protected, etc. All of this leaves privacy absolutely unprotected and vulnerable to cyberattacks if there is no dense multi-level network of "nomadic privacy-protectors" that are autonomous systems (of processes and mechanisms based on multi-level-redundant AI with accreditation (e.g., Security Integrity Level 3 (SIL3) defined in IEC-61508/62061), CC-L7) of observation and defensive action operating proactively/predictively in a fixed and mobile/nomadic manner.

PRIVACY PROTECTION IN THE AREA OF EM EMISSIONS.
All electrical and electronic devices radiate electromagnetic (EM) signals during operation. These emitted signals carry valuable information that must be protected with regard to privacy. Cyber ​​attackers attempt to capture these radiated signals (at short, medium, and long ranges, even using antennas and amplifiers) to obtain the original information, so the targeted entity/user never knows that someone intercepted their signals and obtained confidential data from them. Similarly, emitted EMI interference signals can damage the integrity of legitimate signals (by confusing the correct data) and can even trigger DoS/DDoS cyberattacks. EM emissions are a privacy vulnerability that allows for the malicious remote capture of confidential data via EM/RF signals. These EM emissions originate from many sources, such as signal cables, pressed keyboard keys, microprocessors/controllers, radiation from TV, PC, smartphone, and tablet screens, sound circuits, EEPROM power analysis (side-channel), smartcards, electrical power line leaks, and power circuits that leak RF signals carrying sensitive data, etc. Cyberattacks based on capturing EM emissions can be: (1) Passive cyberattacks. These use EM emissions to surreptitiously obtain sensitive information from all types of entities/users. For example, (a) Wardriving. Equipment installed on moving vehicles/drones is used to capture emitted EM signals in order to maliciously obtain valuable/sensitive information, such as passwords and information transmitted via WiFi, Bluetooth, 4G, 5G, 6G, satellite networks, etc. (b) Unauthorized EM eavesdropping. For example, cyberattacks on ATMs (Automatic Teller Machines). (c) Secret eavesdropping on smart toys. These are capable of maliciously recording and transmitting everything they hear and see, for example, dolls with speaking/listening/viewing capabilities. (d) Espionage using cameras and microphones integrated into smart TVs, PCs, mobile phones, tablets, vehicles, and all types of premises, allowing them to illegally obtain everything said and all videos. (2) Active cyberattacks. These include, among others: Cyberattacks on Tempest technology (for protection against EM emissions); Glitching/Side-channel attacks (used to cyberattack smart cards by introducing useful errors); Bugs (in radio microphones, via RF such as Bluetooth); Using spy microphones near transmitters can allow data to be modulated by the microphone and transmitted. Among the countermeasures against EM emissions, the following can be highlighted: (1) Attenuation. (1) Reduce signal power during transmission. This reduces the radiation perimeter and forces the cyber attacker to get closer to the signal source they intend to steal. (2) Interact with frequency bands. This involves restricting information to a specific frequency band and randomly varying it over time. This forces the cyber attacker to first determine which frequency band to scan (if they choose the wrong band, they will capture nothing or only fragments). (3) Encryption, steganography, and subliminal channels. This involves ensuring that all signals carry encrypted/tokenized information, using steganography or unintelligible subliminal messages. Post-quantum or multi-nested ciphers with robust encryption should be used. (4) Faraday cages/Tempest technology (using conductive metallic and/or plastic materials that create electromagnetic shielding). This involves enclosing computers, chip bank cards (to prevent access by malicious card readers hidden in backpacks and theft of funds from the cards; Faraday cages are used), data centers, critical infrastructure, mobile/NFC devices, etc., within sealed metal or conductive plastic enclosures (the conductive plastics are thermoplastic polymer alloys of PC/ABS filled with carbon fibers, NiC, etc.) that prevent the entry and exit of electromagnetic emissions and block electromagnetic interference (EMI). (5) RF inhibitors and EM noise generators. This involves using devices that conceal, interfere with, inhibit, or corrupt EM emissions with synthesized noise to prevent the disclosure of the data they carry. (6) Blinding satellite optical sensors to prevent malicious data capture. Using terrestrial lasers against spy satellites. Prevent the illegal capture of satellite data from ground stations and intermediate signals.

XNG PROTECTION MECHANISMS AND TECHNOLOGIES TO EMPOWER PRIVACY.
Some of the main technologies present in XNG privacy protectors that empower privacy from different areas, perspectives, and dimensions are:
(1) All types of digital signatures (conventional, blind, single or multi-signature, hash, etc.). These are used to authenticate all types of messages, documents, files, updates, etc. Digital signatures protect against forgery, spoofing, and manipulation of objects/messages, but some signatures offer little privacy since they allow the originator to be identified. Blind digital signatures of all types provide the same authentication as a conventional digital signature but do not reveal the originator's identity. The advantage is that they preserve the authentication and integrity characteristics of conventional digital signatures while protecting the entity's privacy. Technically, these are mathematical sequences based on asymmetric cryptography that allow users to conduct electronic transactions anonymously while the service provider can verify the user's authenticity. In a group signature, a set of entities signs the same message/document/file for greater protection and control. If RSA is used, they must sign in order of increasing value of the modulo n in RSA.
(2) Digital pseudonyms, anonymity, mimicry, DT and OT. Digital pseudonyms allow the identification of entities/individuals through an alternative digital pseudo-identity created for a specific purpose, which a user can assume to conduct a transaction, communication, or use a specific service anonymously. The user can select a different pseudonym for each service provider or to use each time they use a specific service. This allows users to preserve their anonymity by avoiding revealing their true identities. The use of pseudonyms as identifiers enables anonymity in identity management. Two essential factors for the effectiveness of pseudonyms are the lack of correlation between the pseudonym and its user, and the fact that pseudonyms cannot be correlated with each other. There are different types of pseudonyms depending on: (i) Knowledge of the correlation between a pseudonym and its user. The greatest degree of anonymity is achieved with no knowledge of the correlation between the user of a pseudonym and their pseudonym. The greater the knowledge about the correlation between the pseudonym and its user, the weaker the anonymity. The lower and upper limits on the anonymity scale are occupied by public pseudonyms and uncorrelated pseudonyms. (ii) The correlation due to the use of pseudonyms in different contexts. The robustness of anonymity decreases with the increasing number of times the pseudonym is used in general, and especially in different contexts. The degree of anonymity increases if the pseudonyms are changed every two or three times. The highest degree of anonymity is achieved through one-time transaction pseudonyms. Transaction pseudonyms can be unambiguous if they correlate with the identity of a shared secret involved in the transaction pseudonym generation process. Anonymity makes it impossible to identify and locate an entity/person, as well as all their actions and the individuals they interact with. Mimicry allows for the concealment of content, identities, etc., of entities by blending them into the background. Deception technology allows for the deception of potential cyber attackers, confusing them when trying to identify protected entities, their content/positions, their activities, and their contacts. Transaction transfer technology conceals what content an entity captures from a server.
(3) Data encryption (symmetric, asymmetric, and identity-based asymmetric IBC-post-quantum), steganography, subliminal channels, data tokenization, and differential privacy. Communications, storage areas, transit channels, and execution areas must be encrypted with robust post-quantum multi-layer encryption. Numerous programs exist for encrypting and digitally signing files/emails, but newer versions of PGP (Pretty Good Privacy), SSL/TLS-VPN/SSH, etc., should be used. IBC encryption uses asymmetric or public-key cryptography and employs the recipient's identity as the public key, for example, their email address or, better yet, another more secure identifier. Steganography and subliminal channels allow for the concealment of private information (data, metadata, codes, etc.). Data tokenization consists of replacing sensitive/valuable data with non-sensitive information that has no value but allows for the process to be reversed. Other privacy aids include VPNs (Virtual Private Networks) with infinite proxy networks, VLANs (Virtual Local Area Networks), NAT (Network Address Translation), authentication with digital certificates, store-and-forward authentication and encryption, HSE (Hardware Security Engine) with root of trust at processor boot, etc. Differential privacy technology involves introducing noise, randomness, and chaos into data/information, altering it to protect it and render it useless if stolen; integrating deception technologies such as honeytraps/honey pots/honey nets.

FINAL CONSIDERATIONS.
The protection of privacy—which has recently emerged to empower privacy—is becoming increasingly urgent, necessary, and important (since the capture of secret structured/unstructured data/information generates a lot of money). Furthermore, "information is power," it is "the oil of the 21st century," and "analytics is the combustion engine"; "information is the fuel of the new economy"; if you are offered something for free, "your lack of privacy is the reward." Therefore, more and more malicious entities are trying to steal data/metadata and sell it (e.g., on the Deep/Dark Web). The theft of sensitive/private information from connected vehicles and smartphones involves capturing all kinds of private data: our conversations, the contents of our phone contact lists, and the collection of information to facilitate kidnappings, track routes, driving/walking habits, schedules, GPS/G2G routes, radio stations we like to listen to, where we park to steal the vehicle, and where the owner lives to activate the remote keyless entry and start system, etc. Some of the persistent, stealthy cyberattacks on privacy include: (1) Information capture/collection. This uses mass surveillance, interrogation/web crawlers, social engineering/phishing, social networks/instant messaging (WhatsApp/Telegram), fake information/fake news/fake biometrics, vulnerable operating systems/apps/APIs, etc. (2) Information processing. This refers to the use, transfer, storage, manipulation, etc., of all data—structured or unstructured—metadata, information, knowledge, and wisdom that has been stolen or captured. Techniques such as aggregation, connection, correlation, identification, data mining, Big Data/Analytics, insecurity, secondary use, exclusion, etc., are used. (3) Dissemination of information. This refers to maliciously revealing or spreading stolen data. Techniques such as cyber intrusions/confidentiality breaches, disclosure, exposure, increased accessibility, blackmail, appropriation, distortion, etc., are used. (4) Invasion of the individual. This is based on subliminal and nested intrusions, decisional inference, etc.

REFERENCES.
- Areitio, J. “Information Security: Networks, Computing and Information Systems”. Cengage Learning-Paraninfo-2023.
- Areitio, J. “Early Cancellation by DAIM/MIAD of Singularities and Techniques Generating Insidious Cyberattacks”. Conectronica Magazine. No. 256. May-2023.
- Gupta, I. “Expectations vs Realities of Information Privacy and Data Protection Measures: A Machine-Generated Literature Overview”. Springer-2023.
- Blokdyk, G. “Data-Privacy and Protection: A Complete Guide”. The Art of Service - Data Privacy and Protection Publishing-2023.
- Doss, AF “Cyber-Privacy: Who Has Your Data and Why You Should Care”. BenBella Books-2020.
- Sanjay S. “Cybersecurity and Privacy-Protection: Security”. Ed. Sanjay S-2023.
- Carissa, V. “Privacy is Power”. Ed.‎-Random House UK-2021.
- Yu, S. and Cui, L. “Security and Privacy in Federated-Learning”. Springer-2023.
- Knijnenburg, BP, Page, X., Wisniewski, P. (Editor), Lipford, HR et al. “Modern Socio-Technical Perspectives on Privacy.” Springer-2022.
- Goldmann, J. et al. “Data-Privacy Deception & Abuse: Uncovering the Misuse of Personal-Information by the Tech Giants.” Ed. Customer Privacy Publishing-2023.
- MS Geetha P. “Privacy-Protection in Big Data Analytics”. Ed. Vikatan Publishing Solutions-2023.
- Cofone, I. “The Privacy Fallacy: Harm and Power in the Information Economy.” Cambridge-University-Press-2024.

Author: Prof. Dr. Javier Areitio Bertolín – Director of the Networks and Systems Research Group.