Reidentification ban is not a solution
blog.lukaszolejnik.com
Reidentification ban is not a solution
1–10 of 15 posts
Re: Reidentification ban is not a solution
#2The details are very important here. Would the proposed ban really affect researchers proving that anonymization schemes don't work, or would it just apply to attempts to reidentify real people in real user data?
It seems reasonable that a company be prohibited from actively trying to ascertain the identity of users who have tried to remain anonymous. The ease of doing it is rather irrelevant. I'm kind of tired of this tech culture meme, that something should be allowed because it is easy. How easy it is to do something is really irrelevant to how legal it should be. As an extreme example, killing a man is rather easy.
EDIT:
Here is the bit from the source document that the blog author is responding to:
>Create a new offence of intentionally or recklessly re-identifying individuals from anonymised or pseudonymised data. Offenders who knowingly handle or process such data will also be guilty of an offence. The maximum penalty would be an unlimited fine.
"intentionally or recklessly re-identifying individuals" seems to limit this to real user data, not researchers evaluating anonymization schemes. As with any law, it is important to see what the eventual proposed legislation looks like, but I don't think there's anything to worry about here for legitimate security research.
Re: Reidentification ban is not a solution
#3Sounds good to me. Following the authors login why make anything an offence? It doesn't stop people from doing it anyway.
It seems like this is intended to stop dodgy marketing companies re-identifying data not hackers. And there doesn't need to be some technical way to know if they've done it. Any company can do illegal stuff and get away with it. They don't because if they are caught (and all that takes is one employee to come forward - and making it an offence to knowingly handle that data makes that more likely) they are in a lot of trouble (in this case an unlimited fine).
Why can't researchers work with fake data sets? If my data has been anonymised I don't care who the person is, I don't want them re-identifying it. Maybe I'm not seeing the necessity for this, and, if it exists I'm sure when the final Act comes around there will be an exception for researchers. Seems like panic over nothing for now.
Re: Reidentification ban is not a solution
#4I was reading about the UK's upcoming GDPR implementation on the BBC earlier, and I assumed the ban on reidentification would apply to service providers and businesses etc., and not to researchers or private individuals with legitimate intentions.
Is this not the case?
Re: Reidentification ban is not a solution
#5As far as I can tell the Statement of Intent[1] references this only in the following paragraph:
[We will:] "Create a new offence of intentionally or recklessly re-identifying individuals from anonymised or pseudonymised data. Offenders who knowingly handle or process such data will also be guilty of an offence. The maximum penalty would be an unlimited fine."
Following that there is also:
"Create a new offence of altering records with intent to prevent disclosure following a subject access request. The offence would use section 77 of the Freedom of Information Act 2000 as a template. The scope of the offence would apply not only to public authorities, but to all data controllers and processors. The maximum penalty would be an unlimited fine in England and Wales or a Level 5 fine in Scotland and Northern Ireland."
"Widen the existing offence of unlawfully obtaining data to capture people who retain data against the wishes of the controller (even if the they initially obtained it lawfully)."
"Protection for journalists and whistleblowers - The important role of journalists and whistleblowers in holding organisations to account and underpinning our free press will be protected by exemptions."
Which seems more like creating clear legal charges for activity that is already illegal.
[1] https://www.gov.uk/government/uploads/system/uploads/attachm...
Re: Reidentification ban is not a solution
#6Watch this be used selectively to prevent the public from finding out how capital flows and which politicians it buys.
Publish the name of the owner of the company who built the bridge that collapsed due to cost-cutting? Now now, he didn't want that public, that's reidentification! He even hid behind several shell companies, so you can't claim you didn't know he wanted to stay anonymous.
Re: Reidentification ban is not a solution
#7The details are very important here. Would the proposed ban really affect researchers proving that anonymization schemes don't work, or would it just apply to attempts to reidentify real people in real user data? It seems reasonable that a company be prohibited from actively trying to ascertain the identity of users who have tried to remain anonymous. The ease of doing it is rather irrelevant. I'm kind of tired of th…
Anything that attempts to ascribe intention to code is going to run into a lot of corner cases; see the long history of "copying" programs vs copyright law.
"Knowingly" is similarly vague: are you knowingly running every line of code executing on your machine right now? How would you be sure?
Re: Reidentification ban is not a solution
#8The details are very important here. Would the proposed ban really affect researchers proving that anonymization schemes don't work, or would it just apply to attempts to reidentify real people in real user data? It seems reasonable that a company be prohibited from actively trying to ascertain the identity of users who have tried to remain anonymous. The ease of doing it is rather irrelevant. I'm kind of tired of th…
Anything that attempts to ascribe intention to code is going to run into a lot of corner cases; see the long history of "copying" programs vs copyright law. "Knowingly" is similarly vague: are you knowingly running every line of code executing on your machine right now? How would you be sure?
[deleted]
Re: Reidentification ban is not a solution
#9The details are very important here. Would the proposed ban really affect researchers proving that anonymization schemes don't work, or would it just apply to attempts to reidentify real people in real user data? It seems reasonable that a company be prohibited from actively trying to ascertain the identity of users who have tried to remain anonymous. The ease of doing it is rather irrelevant. I'm kind of tired of th…
Would the proposed ban really affect researchers proving that anonymization schemes don't work, or would it just apply to attempts to reidentify real people in real user data?
There's not a clear line between the two. If a company publishes a list of "anonymized" email addresses, should I be arrested for putting one of the strings into Google to see if it's just an MD5 hash?
The ease of doing it is rather irrelevant. I'm kind of tired of this tech culture meme, that something should be allowed because it is easy.
The full argument is of the form "X is easy to do and hard to detect, so it would require police state tactics to have any hope of enforcing a law against it". The war on drugs is the classic example for this. Murder isn't; killing someone may be relatively easy, but it's usually obvious when it happens and it's hard to avoid leaving evidence of your involvement.
Re: Reidentification ban is not a solution
#10The details are very important here. Would the proposed ban really affect researchers proving that anonymization schemes don't work, or would it just apply to attempts to reidentify real people in real user data? It seems reasonable that a company be prohibited from actively trying to ascertain the identity of users who have tried to remain anonymous. The ease of doing it is rather irrelevant. I'm kind of tired of th…
And what of the examples in the article about reidentifying Netflix users from public data, or reidentifying people from Australian census data? These two incidents could no longer, legally, be publically written about. We'd be left discussing only theoretical applications (ie "this is why MD5 is weak" vs "this is how you can deanonymize this real-world complete example"), which simply never has the same impact.
Do we have to start posting these on Pastebin instead of Medium now? Can 3rd parties report them during a security audit?
Even if this has all the good intentions of preventing scummy marketers from scraping data, the execution, if history is any indicator, will likely result in a law can be used to throw people in jail for reversing an MD5 hash.