Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Melbourne professor quits after government pressure about reporting data breach

theguardian.com

Post reply on HN
Print view View original

11–20 of 40 posts

Re: Melbourne professor quits after government pressure about reporting data breach

#11

Post by incompatible »

Tecuane wrote: post #9
rs23296008n1 wrote: post #7

Earlier quoted context omitted.

If you're going to start using logic and reason with this issue then that government will simply outlaw those as well. This government has already set a precedent of having overridden the basic limits of mathematics before. See also: anything to do with encryption.

Relevant article, for the curious: https://www.independent.co.uk/news/malcolm-turnbull-prime-mi...

Former prime minister. His mathematics quote was a worded a bit strangely, but I think he was basically saying https://www.xkcd.com/538/

Re: Melbourne professor quits after government pressure about reporting data breach

#12

Post by shakna »

Thorrez wrote: post #3

> The breach so shocked the government, the then attorney general, George Brandis, quickly announced plans to criminalise the act of re-identifying previously de-identified data, although ultimately the legislation never passed before the 2019 election. If Australia makes it illegal to re-identify information, what about information that has been re-identified outside Australia then distributed into Australia?

> If Australia makes it illegal to re-identify information, what about information that has been re-identified outside Australia then distributed into Australia?

The letter sent to the university [0], claims that re-identifying information is actually illegal, according to the department's understanding. (Nevermind that they also admit that particular law is completely irrelevant to the work of the researcher).

[0] https://www.righttoknow.org.au/request/correspondence_on_re_...

Re: Melbourne professor quits after government pressure about reporting data breach

#13

Post by redis_mlc »

DarthGhandi wrote: post #2

This is horrible but not surprising, the government was told beforehand it was a bad idea and within a few months ended up with egg on their faces. Instead of remedying the situation they shoot the messenger. Dr Teague was also part of the team that found flaws in the Swiss e-voting system used in Australia state elections, nothing was done about and she was written off, the attack was deemed impractical as it requir…

> deemed impractical as it required a corrupt official.

Is there any other kind?

Thanks for the smile! :)

Re: Melbourne professor quits after government pressure about reporting data breach

#14

Post by DoofusOfDeath »

When organizations claim to have "anonymized" a data set, what exactly does that mean?

I.e., do they mean that nobody they talked to could think of a way to recover the identity of even one individual in the set with 100% certainty? Or is there some information-theoretical or legal standard of anonymization they're claiming to have met?

Re: Melbourne professor quits after government pressure about reporting data breach

#15

Post by dang »

aschatten wrote: post #10

The title is just horrible.

The best way to complain about a title is to suggest a better one. Better means: more accurate and neutral, preferably using representative language from the article. When someone suggests a better title, we're happy to change it.

Edit: I've taken a crack at fixing it now.

Re: Melbourne professor quits after government pressure about reporting data breach

#16

Post by throwawayjava »

DoofusOfDeath wrote: post #14

When organizations claim to have "anonymized" a data set, what exactly does that mean? I.e., do they mean that nobody they talked to could think of a way to recover the identity of even one individual in the set with 100% certainty? Or is there some information-theoretical or legal standard of anonymization they're claiming to have met?

There are some mathematical definitions [1], but the fundamental problem is that with enough cross-referencing between databases it's hard to say anything for sure [2]. You never know what data other people might publish in the future.

I'm not aware of any legal definitions, but given the thorniness of reidentification I would assume they're insufficient.

[1] https://en.wikipedia.org/wiki/K-anonymity

[2] https://www.wired.com/2007/12/why-anonymous-data-sometimes-i...

Re: Melbourne professor quits after government pressure about reporting data breach

#17

Post by emmelaich »

DoofusOfDeath wrote: post #14

When organizations claim to have "anonymized" a data set, what exactly does that mean? I.e., do they mean that nobody they talked to could think of a way to recover the identity of even one individual in the set with 100% certainty? Or is there some information-theoretical or legal standard of anonymization they're claiming to have met?

In this particular example, they produced a random number which use the real id[0] as a seed, then mixed the result with the original id. It was not enough, and, as Teague et al note:

> Indeed, encryption was not necessary – a randomly chosen unique number for each person would have worked.

Scroll down from here: https://www.oaic.gov.au/privacy/privacy-decisions/investigat...

[0] The data had ids for providers (e.g. doctors) as well as patients.

Re: Melbourne professor quits after government pressure about reporting data breach

#18

Post by MaulingMonkey »

DoofusOfDeath wrote: post #14

When organizations claim to have "anonymized" a data set, what exactly does that mean? I.e., do they mean that nobody they talked to could think of a way to recover the identity of even one individual in the set with 100% certainty? Or is there some information-theoretical or legal standard of anonymization they're claiming to have met?

> When organizations claim to have "anonymized" a data set, what exactly to that mean?

For "organizations" in general? It means approximately nothing, or if you're feeling particularly generous, it means "we probably remembered to drop the column containing your social security number before publishing this data... this time". You're asking exact specifics of a vague and broad category.

There are some legal standards, information theory, and non-legal organization standards that might being met in some cases - involving adding noise or removing data / making it sparse. https://en.wikipedia.org/wiki/Data_re-identification goes into all the ways that it can go wrong despite the best of intentions. My basic take on this all is: data "always" gets more identifying, not less. Two datasets that were successfully anonymized individually can still be correlated to de-anonymize some or all of the data when combined. Even organizations applying information theory with the best of intentions and proper diligence will eventually make a mistake.

Re: Melbourne professor quits after government pressure about reporting data breach

#20

Post by Aeolun »

Thorrez wrote: post #3

> The breach so shocked the government, the then attorney general, George Brandis, quickly announced plans to criminalise the act of re-identifying previously de-identified data, although ultimately the legislation never passed before the 2019 election. If Australia makes it illegal to re-identify information, what about information that has been re-identified outside Australia then distributed into Australia?

This sounds so much like a ‘stick my head in the sand’ policy that it’s unreal. Who the hell would stop doing it because it’s illegal...
Post reply on HN