Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Melbourne professor quits after government pressure about reporting data breach

theguardian.com

Post reply on HN
Print view View original

21–30 of 40 posts

Re: Melbourne professor quits after government pressure about reporting data breach

#21

Post by Aeolun »

DarthGhandi wrote: post #2

This is horrible but not surprising, the government was told beforehand it was a bad idea and within a few months ended up with egg on their faces. Instead of remedying the situation they shoot the messenger. Dr Teague was also part of the team that found flaws in the Swiss e-voting system used in Australia state elections, nothing was done about and she was written off, the attack was deemed impractical as it requir…

> she was written off, the attack was deemed impractical as it required a corrupt official

I think that hit a bit too close to home for most of the government.

Re: Melbourne professor quits after government pressure about reporting data breach

#22

Post by forkexec »

Pardon my ignorance, but it seems like there should be standard ways of irrevocably anonymizing data and reversible means given a private key.

Off the top of my head, only the latter is necessary if throwing away a random key for the previous to be equivalent (or run the plaintext through SHA-3 20 times in feedback instead.). Say 100 rounds of AES-256 in feedback. Fixed integer-only fields could be XORed with a private key of the length of the field (OTP).

Any other ideas, please add a comment.

Re: Melbourne professor quits after government pressure about reporting data breach

#25

Post by akiselev »

forkexec wrote: post #22

Pardon my ignorance, but it seems like there should be standard ways of irrevocably anonymizing data and reversible means given a private key. Off the top of my head, only the latter is necessary if throwing away a random key for the previous to be equivalent (or run the plaintext through SHA-3 20 times in feedback instead.). Say 100 rounds of AES-256 in feedback. Fixed integer-only fields could be XORed with a priva…

Yes, turning data into a bunch of (ideally) random bits using encryption is an effective way of annonimizing.

Re: Melbourne professor quits after government pressure about reporting data breach

#26

Post by emmelaich »

basicplus2 wrote: post #23

There needs to be Australian Standards developed that everyone must comply with to annonymise personal data

There was a guideline: "Process for Publishing Sensitive Unit Record Level Public Data as Open Data"

and now a standard: "Privacy (Australian Government Agencies – Governance) APP Code 2017"

See https://www.oaic.gov.au/privacy/privacy-decisions/investigat...

Re: Melbourne professor quits after government pressure about reporting data breach

#27

Post by tastroder »

shakna wrote: post #12
Thorrez wrote: post #3

> The breach so shocked the government, the then attorney general, George Brandis, quickly announced plans to criminalise the act of re-identifying previously de-identified data, although ultimately the legislation never passed before the 2019 election. If Australia makes it illegal to re-identify information, what about information that has been re-identified outside Australia then distributed into Australia?

> If Australia makes it illegal to re-identify information, what about information that has been re-identified outside Australia then distributed into Australia? The letter sent to the university [0], claims that re-identifying information is actually illegal, according to the department's understanding. (Nevermind that they also admit that particular law is completely irrelevant to the work of the researcher). [0] h…

Fascinating read, thank you. Another kicker in there seems to be bottom of page 2, start of page 3. They basically assert that now that the data has been taken down no harm can be done anymore and to top it off, suggest that presenting the findings a GovData conference because there subsequently is "no public interest" anymore.

Re: Melbourne professor quits after government pressure about reporting data breach

#28

Post by yoloClin »

forkexec wrote: post #22

Pardon my ignorance, but it seems like there should be standard ways of irrevocably anonymizing data and reversible means given a private key. Off the top of my head, only the latter is necessary if throwing away a random key for the previous to be equivalent (or run the plaintext through SHA-3 20 times in feedback instead.). Say 100 rounds of AES-256 in feedback. Fixed integer-only fields could be XORed with a priva…

Just because the primary key is gone doesn't mean other data can't be cross referenced. Birth dates with external sources, addresses with public registers, etc.

Re: Melbourne professor quits after government pressure about reporting data breach

#29

Post by DEADBEEFC0FFEE »

oska wrote: post #4

Vanessa Teague: > I can't believe @healthgovau is still saying "The dataset does not contain the personal information of patients." We have shown many of the patients' records can be easily and confidently identified from a few points of medical or childbirth info. https://twitter.com/VTeagueAus/status/1236402085974798336

She might be referring to something link the SLK581 statistical linking method.

I did some work with it a few years ago, and you easily generate the key.

Re: Melbourne professor quits after government pressure about reporting data breach

#30

Post by DEADBEEFC0FFEE »

DoofusOfDeath wrote: post #14

When organizations claim to have "anonymized" a data set, what exactly does that mean? I.e., do they mean that nobody they talked to could think of a way to recover the identity of even one individual in the set with 100% certainty? Or is there some information-theoretical or legal standard of anonymization they're claiming to have met?

In hwalthcare there usually an ethics panel, that will look at the data, and look for way to reduce re-identification.

The common example is the one-legged child with cancer from a remote town. You can remove a the PII columns and it's pretty easy to find that person.

Post reply on HN