Reidentification ban is not a solution • Hacker News Board

Re: Reidentification ban is not a solution

#11

Post by mpeg » Mon, Aug 07, 2017, 2:59 PM UTC

orangecat wrote: post #9

wildmusings wrote: post #2

The details are very important here. Would the proposed ban really affect researchers proving that anonymization schemes don't work, or would it just apply to attempts to reidentify real people in real user data? It seems reasonable that a company be prohibited from actively trying to ascertain the identity of users who have tried to remain anonymous. The ease of doing it is rather irrelevant. I'm kind of tired of th…

Would the proposed ban really affect researchers proving that anonymization schemes don't work, or would it just apply to attempts to reidentify real people in real user data? There's not a clear line between the two. If a company publishes a list of "anonymized" email addresses, should I be arrested for putting one of the strings into Google to see if it's just an MD5 hash? The ease of doing it is rather irrelevant.…

As far as I understand the GDPR, email hashes wouldn't be "anonymous" data at all, they'd be considered pseudo-anonymous (and therefore still PII)

I mean the problem is that this makes good-willed sites like haveibeenpwned.com illegal in the UK (with criminal sanctions) as they attempt to re-identify data that comes from a breach.

But on the other hand, I don't see why processing PII that comes from a data breach with the intent of de-anonymising it should be legal.

Maybe protections should be in place for security researchers, but how do you distinguish between them and malicious actors?

Re: Reidentification ban is not a solution

#12

Post by wildmusings » Mon, Aug 07, 2017, 3:23 PM UTC

orangecat wrote: post #9

wildmusings wrote: post #2

The details are very important here. Would the proposed ban really affect researchers proving that anonymization schemes don't work, or would it just apply to attempts to reidentify real people in real user data? It seems reasonable that a company be prohibited from actively trying to ascertain the identity of users who have tried to remain anonymous. The ease of doing it is rather irrelevant. I'm kind of tired of th…

Would the proposed ban really affect researchers proving that anonymization schemes don't work, or would it just apply to attempts to reidentify real people in real user data? There's not a clear line between the two. If a company publishes a list of "anonymized" email addresses, should I be arrested for putting one of the strings into Google to see if it's just an MD5 hash? The ease of doing it is rather irrelevant.…

>The full argument is of the form "X is easy to do and hard to detect, so it would require police state tactics to have any hope of enforcing a law against it".

Plenty of crimes go unsolved in most cases. Littering, for example.

When you do catch an internet marketing company deanonymizing data, you can throw the book at them though. Strong penalties can serve as sufficient discouragement to others even if they are unlikely to get caught.

Re: Reidentification ban is not a solution

#13

Post by timthorn » Mon, Aug 07, 2017, 3:26 PM UTC

al2o3cr wrote: post #7

wildmusings wrote: post #2

The details are very important here. Would the proposed ban really affect researchers proving that anonymization schemes don't work, or would it just apply to attempts to reidentify real people in real user data? It seems reasonable that a company be prohibited from actively trying to ascertain the identity of users who have tried to remain anonymous. The ease of doing it is rather irrelevant. I'm kind of tired of th…

Anything that attempts to ascribe intention to code is going to run into a lot of corner cases; see the long history of "copying" programs vs copyright law. "Knowingly" is similarly vague: are you knowingly running every line of code executing on your machine right now? How would you be sure?

> "Knowingly" is similarly vague: are you knowingly running every line of code executing on your machine right now? How would you be sure?

That's exactly the point. If you perform the act unknowingly, you're innocent of the offence.

Re: Reidentification ban is not a solution

#14

Post by aub3bhat » Mon, Aug 07, 2017, 3:27 PM UTC

The author is clearly mistaken. There are several things that are possible in the physical world yet illegal, e.g. forging signatures, breaking doors open, breaking into parked car, sending spam emails etc. Specifying reindentification as illegal is a great step since it let's legal machinery to do its job.

The reality of data privacy is that it's impossible to guarantee anonymity while keeping data useful.

Reindentification ban enshrine coherent guidelines into the law. It's a good step forward.

I am saying this as a researcher who has signed several agreements with US government agencies which had reindentification ban clause and penalty of felony offense if found violated.

Re: Reidentification ban is not a solution

#15

Post by Zak » Mon, Aug 07, 2017, 3:56 PM UTC

wildmusings wrote: post #2

The details are very important here. Would the proposed ban really affect researchers proving that anonymization schemes don't work, or would it just apply to attempts to reidentify real people in real user data? It seems reasonable that a company be prohibited from actively trying to ascertain the identity of users who have tried to remain anonymous. The ease of doing it is rather irrelevant. I'm kind of tired of th…

> I'm kind of tired of this tech culture meme, that something should be allowed because it is easy.

It's not just that it's easy; it's that it can be done merely by thinking in a particular way about information that's public or that was freely given to the person doing it. I'm not sure the fact that the thinking is done mainly with the aid of an algorithm changes the fundamental concept.

It probably shouldn't be illegal to think about things or to process data you've obtained legitimately whether it's easy or hard.