Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Debunking the Myth of "Anonymous" Data

eff.org

Post reply on HN
Print view View original

31–40 of 107 posts

Re: Debunking the Myth of "Anonymous" Data

#31

Post by hasoleju »

Anonymization of personal data is a very tricky thing. It is so tricky that the GDPR even doesn't really mention it. I even don't know of any official SOP for doing it.

Of course k-anonymity and differential privacy can help you with a closed data set, but once you add records to a dataset over time everything breaks down.

I once tried to find a way to anonymize data on different clients and then connect the records of the same entity on the server. This method had the main problem that one could artificially generate a new non-identifying data point for an individual and then see in which record it will end up in the central data base.

Re: Debunking the Myth of "Anonymous" Data

#32

Post by jandrewrogers »

Dayshine wrote: post #24
willseth wrote: post #16

I work for a data privacy startup, and this article unfortunately groups all forms of anonymization together. It is specifically criticizing forms of anonymization that only treat direct identifiers like names, addresses, and phone numbers. That is usually referred to as "pseudonymization", and they are correct to point out that an only moderately sophisticated attacker can still link people in the dataset using comb…

Pseudonymization is creating a new random identifier and keeping a linking table from those new identifiers to the original identifiers. Pseudonymized data is for all intents and purposes completely anonymous as long as the people you share the data with cannot access the linking table. That constraint can be enforced technically, contractually, or legally, depending on how important the breach would be.

Many red-teaming attacks don't rely on the identifiers at all, they are essentially "duck typing" the entities in the data model. Same approach is commonly used for dealing with data where a single identity may have multiple pseudonymized identifiers.

There are a bunch of regulatory box-checking exercises like this that don't actually provide anonymization if the attacker is sophisticated.

Re: Debunking the Myth of "Anonymous" Data

#33

Post by willseth »

Dayshine wrote: post #30
willseth wrote: post #27

Earlier quoted context omitted.

It's pseudonymization regardless of the replacement data format. It can be a token, a format-consistent value, e.g. "john.smith@example.com", redacted, etc. All of that is considered pseudonymous. Pseudonymized data is not completely anonymous. For example, your name, address, date of birth, and other identifiable information are likely available in public datasets like property tax records or voter registration data…

If your birthday, gender, and zip code are present in the dataset then it is not Pseudonymized. By definition in any modern privacy specification, the only difference between anonymous and pseudonymous is that you can recover the true identity. I believe a decade plus ago Pseudonymized meant simply making something less identifiable, but not any more.

That's not how the term typically used. Most people will assume you have only protected direct identifiers if you tell them data has been pseudonymized.

https://csrc.nist.gov/glossary/term/pseudonymization

Re: Debunking the Myth of "Anonymous" Data

#34

Post by mbork_pl »

willseth wrote: post #27
Dayshine wrote: post #24

Earlier quoted context omitted.

Pseudonymization is creating a new random identifier and keeping a linking table from those new identifiers to the original identifiers. Pseudonymized data is for all intents and purposes completely anonymous as long as the people you share the data with cannot access the linking table. That constraint can be enforced technically, contractually, or legally, depending on how important the breach would be.

It's pseudonymization regardless of the replacement data format. It can be a token, a format-consistent value, e.g. "john.smith@example.com", redacted, etc. All of that is considered pseudonymous. Pseudonymized data is not completely anonymous. For example, your name, address, date of birth, and other identifiable information are likely available in public datasets like property tax records or voter registration data…

For the curious: more about the 87% figure, with a link to the source paper: https://www.johndcook.com/blog/2018/12/07/simulating-zipcode.... (Not the author, just a fan of John D. Cook's blog.)

Re: Debunking the Myth of "Anonymous" Data

#35

Post by Dayshine »

willseth wrote: post #33
Dayshine wrote: post #30

Earlier quoted context omitted.

If your birthday, gender, and zip code are present in the dataset then it is not Pseudonymized. By definition in any modern privacy specification, the only difference between anonymous and pseudonymous is that you can recover the true identity. I believe a decade plus ago Pseudonymized meant simply making something less identifiable, but not any more.

That's not how the term typically used. Most people will assume you have only protected direct identifiers if you tell them data has been pseudonymized. https://csrc.nist.gov/glossary/term/pseudonymization

https://en.m.wikipedia.org/wiki/Pseudonymization

See section about the new definition under GDPR.

Like I said, modern privacy standards. The US is still quite far behind: I've had to do HIPAA training and it shows.

I'd advise you to set your bar a lot higher than your national standards if you ever plan to do international products: nobody in the US will complain if you use stricter definitions but you'll instantly be rejected in Europe if you call that pseudonymization.

Re: Debunking the Myth of "Anonymous" Data

#36

Post by __MatrixMan__ »

willseth wrote: post #16

I work for a data privacy startup, and this article unfortunately groups all forms of anonymization together. It is specifically criticizing forms of anonymization that only treat direct identifiers like names, addresses, and phone numbers. That is usually referred to as "pseudonymization", and they are correct to point out that an only moderately sophisticated attacker can still link people in the dataset using comb…

I'm usually the first to defend the EFF but I agree that they've gone a bit far here. The anonymization script which I wrote for my company just replaces every string in the customer's database with a cryptographic hash--except a list of strings like "failed" and "success".

So unless your city is named "success", it's going to be missing from the dataset.

It's a bit bewildering to actually run the app in this mode, but here's a lot of diagnostically relevant information you can get out of a database like that. You can even confirm bug fixes. Meanwhile, somebody looking to harm the user would need to already know quite a lot about that user before they could make any use out of such a thing.

Good faith efforts to protect user privacy exist, is not helpful to lump them in with the rest like this:

> Sometimes companies say our personal data is “anonymized,” implying a one-way ratchet where it can never be dis-aggregated and re-identified. But this is not possible—anonymous data rarely stays this way.

Is it not possible, or not common?

People need to be informed about how to apply scrutiny to anonymization techniques, not scared into assuming ill intent when they see one.

Re: Debunking the Myth of "Anonymous" Data

#37

Post by bertil »

genewitch wrote: post #26
bertil wrote: post #22

Earlier quoted context omitted.

That broad definition opens itself to so much… Even raw movie rating data was famously partially de-anonymized. I’m not sure that I could imagine a detailed database with personal activity at a reasonable scale that couldn’t be de-anonymized, at least partly, if one assumes that people use related services and that one has access to them via public social media, mostly. - Emails: of course; - social media: easy; - se…

Is it funny that it is so broad? People don't want their information leaked! Why is this so hard to understand? It makes your job harder? Tough shit. It makes law enforcement tougher to do? Ohhhh nooo, they might have to work for a living instead of pushing buttons. Stop trying to defend companies that do this in service of capital. It is heinous. Some, if not most of us, want to be left alone and not have our addres…

No need to be snarky or insulting: I was trying to ask for a sincere assessment of that law.

> do this in service of capital

Sir, this is ycombinator.com

If the intent is that no database with an individual-level breakdown falls under GDPR IID protections, I presume that far more processes and declarations would have to be applied to circumstances where there never was an intent or a credible option to de-anonymize them. This is not how it is enforced, understood, or applied today.

The large companies that you criticize so readily would have an issue automating the paperwork or building hashing solutions that divert the problem, but their privacy-respecting competitors would fall under a lot more paperwork and legal risk than they could handle.

Thankfully, there are solutions: a lot of people are now handling internal data processes with the same open-source tool, dbt. That platform could help change standards if they knew current patterns do not respect the letter of the law. But their lawyers seem to think otherwise.

Re: Debunking the Myth of "Anonymous" Data

#39

Post by jeffbee »

willseth wrote: post #21
spiffytech wrote: post #13

Every time I hear "anonymous data", I think of that time AOL published anonymized search logs (for academic research). The anonymization was negligent, and an NYT reporter de-anonymized and tracked down one of the users with the local & personal info present in the search queries. https://en.wikipedia.org/wiki/AOL_search_log_release https://web.archive.org/web/20130404175032/http://www.nytime...

Another fun one was the Netflix Prize, where Netflix published an anonymized dataset, but some researchers at UT Austin were able to de-identify many/most of the users in the dataset by linking them to IMDB profiles based on preferences.

There's no way most of the users in the Netflix data had IMDb accounts.

Re: Debunking the Myth of "Anonymous" Data

#40

Post by willseth »

Dayshine wrote: post #35
willseth wrote: post #33

Earlier quoted context omitted.

That's not how the term typically used. Most people will assume you have only protected direct identifiers if you tell them data has been pseudonymized. https://csrc.nist.gov/glossary/term/pseudonymization

https://en.m.wikipedia.org/wiki/Pseudonymization See section about the new definition under GDPR. Like I said, modern privacy standards. The US is still quite far behind: I've had to do HIPAA training and it shows. I'd advise you to set your bar a lot higher than your national standards if you ever plan to do international products: nobody in the US will complain if you use stricter definitions but you'll instantly b…

What bar are you talking about? We use the state of the art to treat indirect identifiers without pseudonymization, but we pseudonymize as needed if that’s overkill. The bar is set very high for our service. Sadly, very few companies are actually interested in treating indirect identifiers or consider anything besides direct identifiers a problem.

I’m familiar with GDPR, we work with EU companies, and all the ones we work with use original definition. NIST link aside, these terms are hardly standards anyway. They are nearly colloquial vocabulary, which unfortunately in this space I expect to remain imprecise and vague. This why we generally only use it in marketing and comms, while in the actual product we drill down into specifications for direct and indirect identifiers, distortion, and risk.

Post reply on HN