Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Debunking the Myth of "Anonymous" Data

eff.org

Post reply on HN
Print view View original

21–30 of 107 posts

Re: Debunking the Myth of "Anonymous" Data

#21

Post by willseth »

spiffytech wrote: post #13

Every time I hear "anonymous data", I think of that time AOL published anonymized search logs (for academic research). The anonymization was negligent, and an NYT reporter de-anonymized and tracked down one of the users with the local & personal info present in the search queries. https://en.wikipedia.org/wiki/AOL_search_log_release https://web.archive.org/web/20130404175032/http://www.nytime...

Another fun one was the Netflix Prize, where Netflix published an anonymized dataset, but some researchers at UT Austin were able to de-identify many/most of the users in the dataset by linking them to IMDB profiles based on preferences.

Re: Debunking the Myth of "Anonymous" Data

#22

Post by bertil »

jdietrich wrote: post #6

GDPR specifically mentions pseudonymous data in Recital 26: "The principles of data protection should apply to any information concerning an identified or identifiable natural person. Personal data which have undergone pseudonymisation, which could be attributed to a natural person by the use of additional information should be considered to be information on an identifiable natural person. To determine whether a nat…

That broad definition opens itself to so much… Even raw movie rating data was famously partially de-anonymized.

I’m not sure that I could imagine a detailed database with personal activity at a reasonable scale that couldn’t be de-anonymized, at least partly, if one assumes that people use related services and that one has access to them via public social media, mostly.

- Emails: of course;

- social media: easy;

- search queries: LOL;

- transport: through commute;

- any cultural good: you can connect to contemporary commentary;

- fashion shopping: pretty much trivial with OOTD posts;

- medial record: not everyone, but most major diagnostics could be matched to social media for many people;

- https blobs via VNP: most people would connect to the same four sites again and again, but exact timestamps and public statements on social media;

- grocery shopping: harder, but doable as you’d have neighborhood from the store address and a lot of surface…

Is the letter of that law against pseudonymous databases?

Re: Debunking the Myth of "Anonymous" Data

#23

Post by genewitch »

willseth wrote: post #16

I work for a data privacy startup, and this article unfortunately groups all forms of anonymization together. It is specifically criticizing forms of anonymization that only treat direct identifiers like names, addresses, and phone numbers. That is usually referred to as "pseudonymization", and they are correct to point out that an only moderately sophisticated attacker can still link people in the dataset using comb…

In the interest of charitable-ness, can you define "noise" and explain how rudimentary denoising algorithms that have existed since the 1960s can't penetrate it?

Time and time again people think they've anonymized data and they're always proven incorrect.

Just come to grips with the fact you're participating in the sale of my (or whoever's) private data. Hope you sleep well!

Re: Debunking the Myth of "Anonymous" Data

#24

Post by Dayshine »

willseth wrote: post #16

I work for a data privacy startup, and this article unfortunately groups all forms of anonymization together. It is specifically criticizing forms of anonymization that only treat direct identifiers like names, addresses, and phone numbers. That is usually referred to as "pseudonymization", and they are correct to point out that an only moderately sophisticated attacker can still link people in the dataset using comb…

Pseudonymization is creating a new random identifier and keeping a linking table from those new identifiers to the original identifiers.

Pseudonymized data is for all intents and purposes completely anonymous as long as the people you share the data with cannot access the linking table.

That constraint can be enforced technically, contractually, or legally, depending on how important the breach would be.

Re: Debunking the Myth of "Anonymous" Data

#25

Post by genewitch »

c0pium wrote: post #10
Forbo wrote: post #5

Earlier quoted context omitted.

Still sounds potentially problematic. Per wikipedia: "Differential privacy provides a quantified measure of privacy loss and an upper bound and allows curators to choose the explicit trade-off between privacy and accuracy. It is robust to still unknown privacy attacks. However, it encourages greater data sharing, which if done poorly, increases privacy risk. Differential privacy implies that privacy is protected, but…

> …it encourages greater data sharing, which if done poorly, increases privacy risk. This is a really useful argument, because it’s the equivalent of the FDA’s “generally believed to be safe”. If you look into something and this is the risk you find, then it’s safe.

GRAS. Btw.

Re: Debunking the Myth of "Anonymous" Data

#26

Post by genewitch »

bertil wrote: post #22
jdietrich wrote: post #6

GDPR specifically mentions pseudonymous data in Recital 26: "The principles of data protection should apply to any information concerning an identified or identifiable natural person. Personal data which have undergone pseudonymisation, which could be attributed to a natural person by the use of additional information should be considered to be information on an identifiable natural person. To determine whether a nat…

That broad definition opens itself to so much… Even raw movie rating data was famously partially de-anonymized. I’m not sure that I could imagine a detailed database with personal activity at a reasonable scale that couldn’t be de-anonymized, at least partly, if one assumes that people use related services and that one has access to them via public social media, mostly. - Emails: of course; - social media: easy; - se…

Is it funny that it is so broad? People don't want their information leaked! Why is this so hard to understand?

It makes your job harder? Tough shit. It makes law enforcement tougher to do? Ohhhh nooo, they might have to work for a living instead of pushing buttons.

Stop trying to defend companies that do this in service of capital. It is heinous. Some, if not most of us, want to be left alone and not have our addresses and medical history and YouTube stats available for the whole world.

There is no such thing as an anonymous dataset. It has been proven again, and again.

Re: Debunking the Myth of "Anonymous" Data

#27

Post by willseth »

Dayshine wrote: post #24
willseth wrote: post #16

I work for a data privacy startup, and this article unfortunately groups all forms of anonymization together. It is specifically criticizing forms of anonymization that only treat direct identifiers like names, addresses, and phone numbers. That is usually referred to as "pseudonymization", and they are correct to point out that an only moderately sophisticated attacker can still link people in the dataset using comb…

Pseudonymization is creating a new random identifier and keeping a linking table from those new identifiers to the original identifiers. Pseudonymized data is for all intents and purposes completely anonymous as long as the people you share the data with cannot access the linking table. That constraint can be enforced technically, contractually, or legally, depending on how important the breach would be.

It's pseudonymization regardless of the replacement data format. It can be a token, a format-consistent value, e.g. "john.smith@example.com", redacted, etc. All of that is considered pseudonymous.

Pseudonymized data is not completely anonymous. For example, your name, address, date of birth, and other identifiable information are likely available in public datasets like property tax records or voter registration data. There are also mostly-legal datasets available for purchase with more complete demographic and personal information. If your birthday, gender, and zipcode are present in the pseudonymized dataset, I have an ~87% chance succeeding in a linkage attack matching you in of those public datasets.

Re: Debunking the Myth of "Anonymous" Data

#28

Post by willseth »

genewitch wrote: post #23
willseth wrote: post #16

I work for a data privacy startup, and this article unfortunately groups all forms of anonymization together. It is specifically criticizing forms of anonymization that only treat direct identifiers like names, addresses, and phone numbers. That is usually referred to as "pseudonymization", and they are correct to point out that an only moderately sophisticated attacker can still link people in the dataset using comb…

In the interest of charitable-ness, can you define "noise" and explain how rudimentary denoising algorithms that have existed since the 1960s can't penetrate it? Time and time again people think they've anonymized data and they're always proven incorrect. Just come to grips with the fact you're participating in the sale of my (or whoever's) private data. Hope you sleep well!

"Denoising" algorithms can't remove this kind of noise. It doesn't work like that. You're simply mistaken.

Generally the state of the art for adding noise to data is differential privacy or microaggregation. In the case of differential privacy it's typically gaussian or laplacian noise, but it is not a trivial application. Noise applied through microaggregation is not a mathematical function because microaggregation targets k in k-anonymity, and the "noise" can only be measured after treatment, through various distortion measures.

My company doesn't sell private data or facilitate the sale of private data. We improve privacy within organizations to reduce the risk of privacy leaks. Data brokers and ad targeters would have no interest in our software. But thanks for the condescending comment!

Re: Debunking the Myth of "Anonymous" Data

#29

Post by jandrewrogers »

jruohonen wrote: post #2

A good popular take, but they, either intentionally or out of ignorance, omit newer, proven techniques like differential privacy.

Techniques like differential privacy do not work for some types of data models, including many of the more interesting/risky ones. I've never seen a technique that can deliver an analytical model at scale that is both analytically effective and anonymous while also robust against sophisticated de-anonymization attacks. There is no good theoretical foundation to suggest that such things are possible.

Most modern techniques for ensuring anonymization make assumptions that won't constrain sophisticated blackhats. They are good policy in a legal ass-covering sense and increase the cost required to de-anonymize but that is about it.

Re: Debunking the Myth of "Anonymous" Data

#30

Post by Dayshine »

willseth wrote: post #27
Dayshine wrote: post #24

Earlier quoted context omitted.

Pseudonymization is creating a new random identifier and keeping a linking table from those new identifiers to the original identifiers. Pseudonymized data is for all intents and purposes completely anonymous as long as the people you share the data with cannot access the linking table. That constraint can be enforced technically, contractually, or legally, depending on how important the breach would be.

It's pseudonymization regardless of the replacement data format. It can be a token, a format-consistent value, e.g. "john.smith@example.com", redacted, etc. All of that is considered pseudonymous. Pseudonymized data is not completely anonymous. For example, your name, address, date of birth, and other identifiable information are likely available in public datasets like property tax records or voter registration data…

If your birthday, gender, and zip code are present in the dataset then it is not Pseudonymized.

By definition in any modern privacy specification, the only difference between anonymous and pseudonymous is that you can recover the true identity.

I believe a decade plus ago Pseudonymized meant simply making something less identifiable, but not any more.

Post reply on HN