Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Algorithm can pick out almost any American in supposedly anonymized databases

nytimes.com

Post reply on HN
Print view View original

21–30 of 101 posts

Re: Algorithm can pick out almost any American in supposedly anonymized databases

#21

Post by TadaScientist »

rzwitserloot wrote: post #10

I'm a programmer in the GP data analysis world. We use the term 'pseudonymization' for this kind of data. 'Anonymization' is used solely to refer to, say, 'the sum total of diabetes patients this practice has' (that would be anonymous patient data; it would not be anonymous relative to the GP office this refers to): Aggregated data that can no longer be reduced to a single individual at all. The term raises questions…

Pseudo and psuedo are derived from the greek work ψεμα psema, which literally means lie. It's synonym is 'untrue' which indicates that your term is the right term to use when anonymizing-but-not-really-anonymizing

Re: Algorithm can pick out almost any American in supposedly anonymized databases

#22

Post by majos »

polskibus wrote: post #20

Would differential privacy fix this problem? I heard that new US census will use it.

Yes, in the sense that the output of a differentially private protocol has mathematical guarantees against re-identification, regardless of the computational power or side information an adversary has.

There are caveats. The exact strength of the privacy guarantee depends on the parameters you use and the number of computations you do, so simply saying "we use a differentially private algorithm" doesn't guarantee privacy in isolation.

Re: Algorithm can pick out almost any American in supposedly anonymized databases

#23

Post by [deleted] »

pfortuny wrote: post #13

In any database whose fields have at least 4 meaningful ranges, 16 fields give 4.000.000.000 possibilities. Now I am on my iphone. As long as ranges are meaningful (i.e. they do divide the group in somewhat even parts), the individuating possibilities are HUGE. And fields do have usually many more than 4 ranges. Anonymizing datasets is a weasel term. The database is secure or it is not. As any database is quite likel…

[deleted]

Re: Algorithm can pick out almost any American in supposedly anonymized databases

#24

Post by gervu »

cheez wrote: post #14
rzwitserloot wrote: post #10

I'm a programmer in the GP data analysis world. We use the term 'pseudonymization' for this kind of data. 'Anonymization' is used solely to refer to, say, 'the sum total of diabetes patients this practice has' (that would be anonymous patient data; it would not be anonymous relative to the GP office this refers to): Aggregated data that can no longer be reduced to a single individual at all. The term raises questions…

It doesn't roll off the tongue, perhaps pseudo-anonymization is enough.

Pseudonymization already refers to reference by pseudonym.

Pseudonimization is bad terminology in that it's indistinct from the above, to the point that parent has already mixed the two up while in the process of recommending it. And it'd be worse verbally.

"Pseudo-anonymization" could work, but something like "breakable anonymization" or "partial anonymization" might be better in that it's more obvious to a reader and doesn't rely on familiarity with technical terminology to convey the idea.

I'd go with breakable, myself, since it's most to the point about why it's a problem.

Pseudo is etymologically correct, but that doesn't necessarily help us much when the goal is ratio and ease of understanding by a wide population of readers.

Partial could work in the sense that you did part of the job, which people would hopefully understand is a bit like having locked the back door for the night while leaving the front propped wide open.

And there are probably other good options. If I was writing about this topic often, I'd strongly consider brainstorming a few more and running a user test where I ask random people to explain each term, then go with what consistently gets results closest to what I'm trying to discuss.

Re: Algorithm can pick out almost any American in supposedly anonymized databases

#25

Post by contravariant »

TadaScientist wrote: post #21
rzwitserloot wrote: post #10

I'm a programmer in the GP data analysis world. We use the term 'pseudonymization' for this kind of data. 'Anonymization' is used solely to refer to, say, 'the sum total of diabetes patients this practice has' (that would be anonymous patient data; it would not be anonymous relative to the GP office this refers to): Aggregated data that can no longer be reduced to a single individual at all. The term raises questions…

Pseudo and psuedo are derived from the greek work ψεμα psema, which literally means lie. It's synonym is 'untrue' which indicates that your term is the right term to use when anonymizing-but-not-really-anonymizing

In this case it might not be 'pseudo'-anonymization but rather 'pseudonym'-ization. At least that seemed to be the intent when I last heard the term.

Re: Algorithm can pick out almost any American in supposedly anonymized databases

#26

Post by abcc8 »

rzwitserloot wrote: post #10

I'm a programmer in the GP data analysis world. We use the term 'pseudonymization' for this kind of data. 'Anonymization' is used solely to refer to, say, 'the sum total of diabetes patients this practice has' (that would be anonymous patient data; it would not be anonymous relative to the GP office this refers to): Aggregated data that can no longer be reduced to a single individual at all. The term raises questions…

We refer to such data as deidentified.

Re: Algorithm can pick out almost any American in supposedly anonymized databases

#27

Post by shusson »

majos wrote: post #22
polskibus wrote: post #20

Would differential privacy fix this problem? I heard that new US census will use it.

Yes, in the sense that the output of a differentially private protocol has mathematical guarantees against re-identification, regardless of the computational power or side information an adversary has. There are caveats. The exact strength of the privacy guarantee depends on the parameters you use and the number of computations you do, so simply saying "we use a differentially private algorithm" doesn't guarantee pri…

do you have some examples?

Re: Algorithm can pick out almost any American in supposedly anonymized databases

#28

Post by nobrains »

gervu wrote: post #24
cheez wrote: post #14

Earlier quoted context omitted.

It doesn't roll off the tongue, perhaps pseudo-anonymization is enough.

Pseudonymization already refers to reference by pseudonym. Pseudonimization is bad terminology in that it's indistinct from the above, to the point that parent has already mixed the two up while in the process of recommending it. And it'd be worse verbally. "Pseudo-anonymization" could work, but something like "breakable anonymization" or "partial anonymization" might be better in that it's more obvious to a reader a…

Its not partial. Its pseudo.

Re: Algorithm can pick out almost any American in supposedly anonymized databases

#29

Post by majos »

rectang wrote: post #3

The great contribution of Differential Privacy theory is to quantify just how little use you can get out of aggregate data before individuals become identifiable. Unfortunately, Differential Privacy proofs can be used to justify applications which turn out to leak privacy when the proofs are shown to be incorrect after the fact, when the data is already out there and the damage already done. Nevertheless, it is instr…

> Unfortunately, Differential Privacy proofs can be used to justify applications which turn out to leak privacy when the proofs are shown to be incorrect after the fact, when the data is already out there and the damage already done.

You are right that some differential privacy proofs have later been found to be wrong. For example, there is an entire paper about bugs in initial versions of the sparse vector technique [1].

However, I imagine this will evolve the way cryptographic security has evolved: at some point, enough experts have examined algorithm X to be confident about its differential privacy proof; then some experts implement it carefully; and the rest of us use their work because "rolling [our] own" is too tricky.

[1] https://arxiv.org/abs/1603.01699

Re: Algorithm can pick out almost any American in supposedly anonymized databases

#30

Post by al2o3cr »

stiffCompetitor wrote: post #9

I'm giving less and less of a fuck about this shit. Mostly because there's a point at which you refuse to be put on the run and don't want to hide. So maybe this is where the fight begins. At some point people make up their mind about dying not being a very big deal, and to become masters of their fate. To die on your feet, looking your accusers in the eye. Who would be so bold as to accuse me? Could I dare entertain…

Sir, this is an Arby's
Post reply on HN