Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Algorithm can pick out almost any American in supposedly anonymized databases

nytimes.com

Post reply on HN
Print view View original

61–70 of 101 posts

Re: Algorithm can pick out almost any American in supposedly anonymized databases

#61

Post by Shaanie »

q-base wrote: post #56
AlexandrB wrote: post #46

Earlier quoted context omitted.

> That for me is not anonymized data. What matters is that this is what most online companies (and their terms of service) would call anonymized data.

If they operate in Europe then I am pretty sure that the GDPR legislation is pretty straight forward here. If you can de-anonymize the data then it is by definition not anonymized.

That seems correct.

From an article on the subject:

>Recital 26 of the GDPR defines anonymized data as “data rendered anonymous in such a way that the data subject is not or no longer identifiable.” Although circular, this definition emphasizes that anonymized data must be stripped of any identifiable information, making it impossible to derive insights on a discreet individual, even by the party that is responsible for the anonymization.

Re: Algorithm can pick out almost any American in supposedly anonymized databases

#64

Post by dalbasal »

rzwitserloot wrote: post #10

I'm a programmer in the GP data analysis world. We use the term 'pseudonymization' for this kind of data. 'Anonymization' is used solely to refer to, say, 'the sum total of diabetes patients this practice has' (that would be anonymous patient data; it would not be anonymous relative to the GP office this refers to): Aggregated data that can no longer be reduced to a single individual at all. The term raises questions…

A related/derivative concept that ties into the existing lexicon is name Vs pseudonym.

Bitcoin for example, uses pseudonyms... not anonymity. A pen name or a hn username is a pseudonym. A voting system needs to be anonymous not pseudo-anonymous^, by using a pseudonym. If each voter had a secret number that is attached to each vote, that is a pseudonym.

"L is 32 years old. She works as a nurse in Moscow." - L is a pseudonym. It isn't anonymous even though the name is ommitted.

^This can get grey, as even a piece of paper with an X on it will carry certain metadata or related data: which voting booth, etc. But, the goal is anonymity. IE, the X cannot be tied to anything else.

Re: Algorithm can pick out almost any American in supposedly anonymized databases

#65

Post by shusson »

Shaanie wrote: post #61
q-base wrote: post #56

Earlier quoted context omitted.

If they operate in Europe then I am pretty sure that the GDPR legislation is pretty straight forward here. If you can de-anonymize the data then it is by definition not anonymized.

That seems correct. From an article on the subject: >Recital 26 of the GDPR defines anonymized data as “data rendered anonymous in such a way that the data subject is not or no longer identifiable.” Although circular, this definition emphasizes that anonymized data must be stripped of any identifiable information, making it impossible to derive insights on a discreet individual, even by the party that is responsible…

it is not clear to me if this covers re-identifying.

Re: Algorithm can pick out almost any American in supposedly anonymized databases

#66

Post by samfriedman »

shalmanese wrote: post #60

While things like this sound scary, deanonymization turns out to be not exceedingly impactful in practice. Most entities have no desire to deanonymize you, to them, the most useful format is to treat you as a GUID with a bag of attributes attached to it. Of the entities that remain, they fall into two buckets: Ones powerful enough that they already have personally identifiable data without the need to deanonymize ano…

I think there are still threats that come from improperly anonymized data, beyond my own government or a single stalker/harasser.

For one, that this data is improperly anonymized would make it an easy avenue for malicious nation-state actors to use to track/analyze/destabilize the population. If I am a government with an interest in freaking out the US public, I could quite easily de-anonymize sensitive datasets and begin using them for wide-scale harassment, identity theft, etc. on an automated basis.

The lowering of the bar makes it easier for Johnny Troublemaker to start harassing people based on their PII as well. Instead of paying for the data, just download some datasets and run a Julia notebook against them. Maybe not much changes for the targeted stalking case, but now you can cast a wide net when looking for someone to mess with.

Re: Algorithm can pick out almost any American in supposedly anonymized databases

#67

Post by hiccuphippo »

gervu wrote: post #24
cheez wrote: post #14

Earlier quoted context omitted.

It doesn't roll off the tongue, perhaps pseudo-anonymization is enough.

Pseudonymization already refers to reference by pseudonym. Pseudonimization is bad terminology in that it's indistinct from the above, to the point that parent has already mixed the two up while in the process of recommending it. And it'd be worse verbally. "Pseudo-anonymization" could work, but something like "breakable anonymization" or "partial anonymization" might be better in that it's more obvious to a reader a…

ESL here, what's wrong with pseudonymization as a derivative of pseudonym? I think it brings the point across. But if we want to stop beating around the bush, what about "nameless identification"?

Re: Algorithm can pick out almost any American in supposedly anonymized databases

#68

Post by mcintyre1994 »

rzwitserloot wrote: post #10

I'm a programmer in the GP data analysis world. We use the term 'pseudonymization' for this kind of data. 'Anonymization' is used solely to refer to, say, 'the sum total of diabetes patients this practice has' (that would be anonymous patient data; it would not be anonymous relative to the GP office this refers to): Aggregated data that can no longer be reduced to a single individual at all. The term raises questions…

We covered this in a DB course with the term k-anonymity which seems to be standard in the literature, where a dataset is k-anonymous if every combination of characteristics (that can identify users) has at least K users. So in your case that dataset has only the 1-anonymity property, but you can set a k>1 and change the data set to satisfy it and improve the anonymity. Eg. if age was just stored as 90+ and there's at least 10 90+ year olds in each wide area then you'd get 10-anonymity.

I guess then the interesting question is how high does k have to be to call it anonymous vs pseudonymous.

Also cool: this is how Have I been Pwned v2 works - if you send only the first 5 characters of a hash then it's guaranteed there's hundreds of matches and the server doesn't know the real password that had that hash prefix: https://www.troyhunt.com/ive-just-launched-pwned-passwords-v...

Re: Algorithm can pick out almost any American in supposedly anonymized databases

#69

Post by shalmanese »

samfriedman wrote: post #66
shalmanese wrote: post #60

While things like this sound scary, deanonymization turns out to be not exceedingly impactful in practice. Most entities have no desire to deanonymize you, to them, the most useful format is to treat you as a GUID with a bag of attributes attached to it. Of the entities that remain, they fall into two buckets: Ones powerful enough that they already have personally identifiable data without the need to deanonymize ano…

I think there are still threats that come from improperly anonymized data, beyond my own government or a single stalker/harasser. For one, that this data is improperly anonymized would make it an easy avenue for malicious nation-state actors to use to track/analyze/destabilize the population. If I am a government with an interest in freaking out the US public, I could quite easily de-anonymize sensitive datasets and…

Malicious nation state actors can easily access PII without the need for deanonymization, simply by buying it on the open market.

The number of Johnny Troublemakers who are randomly spraying hate based on PII is about the same as the rate of people throwing rocks off highway overpasses onto cars below. It's simply not a significant enough problem to be worth worrying about.

Re: Algorithm can pick out almost any American in supposedly anonymized databases

#70

Post by specialist »

rectang wrote: post #3

The great contribution of Differential Privacy theory is to quantify just how little use you can get out of aggregate data before individuals become identifiable. Unfortunately, Differential Privacy proofs can be used to justify applications which turn out to leak privacy when the proofs are shown to be incorrect after the fact, when the data is already out there and the damage already done. Nevertheless, it is instr…

The part I can't wrap my head around is how to mitigate (future proof) unforeseen leakage and correlations. The example I keep going back to is deanonymizing movie reviews (chronologically correlating movie rentals and reviews). And, frankly, I'm just not clever enough to imagine most attacks.

If nothing else, I appreciate the Differential Privacy effort, if only to show the problem space is wicked hard.

I worked in medical records and protecting voter privacy. There's a lot of wishful thinking leading to unsafe practices. Having better models to describe what's what would be nice.

Post reply on HN