Why Anonymized Data Isn't

Ars has a review of recent research, and a summary of the history, in the field of reidentification — identifying people from anonymized data. Paul Ohm's recent paper is an elaboration of what Ohm terms a central reality of data collection: "Data can either be useful or perfectly anonymous but never both." "...in 2000, [researcher Latanya Sweeney] showed that 87 percent of all Americans could be uniquely identified using only three bits of information: ZIP code, birthdate, and sex. ... For almost every person on earth, there is at least one fact about them stored in a computer database that an adversary could use to blackmail, discriminate against, harass, or steal the identity of him or her. I mean more than mere embarrassment or inconvenience; I mean legally cognizable harm. ... Reidentification science disrupts the privacy policy landscape by undermining the faith that we have placed in anonymization."

Comments

Damn voyeurism is all it is

[Ethanol-fueled]

For almost every person on earth, there is at least one fact about them stored in a computer database that an adversary could use to blackmail, discriminate against, harass, or steal the identity of him or her. I mean more than mere embarrassment or inconvenience; I mean legally cognizable harm.

...And this is the first thing that the author(s) though of regarding data-mining? Okay, but how would this happen? Why go through all the trouble to gather all that data when you could just hire a P.I. or know (or bribe) a law-enforcement official or an ISP employee? It Reminds me of a conversation I had with a guy who bragged that he could get anybody's info because a very good friend of his worked at the DMV. There were a couple semi-profile firings at the State Department because some employees snooped through celebrities' records for no reason other than voyeurism..er..curiosity.

Those types, the ones with the direct access to the info, are the weakest link. They're only human. "Hey, Bob, there's this guy I really hate. Look up his IP logs and tell me what you see!"

It all boils down to voyeurism. People would rather bring others down before bring their own lives up. It's the nature of the beast! Pathetic.

Re:Damn voyeurism is all it is

[winkydink]

But the voyeurism slant isn't newsworthy. Oh wait. Neither is this.

Re:Damn voyeurism is all it is

[causality]

But the voyeurism slant isn't newsworthy.

Then how do you explain shows like Entertainment Tonight and all of these magazines and Web sites devoted entirely to completely useless celebrity trivia? Y'know, the ability to obsess over the personal life of someone you have never met and will never personally know, merely because they can sing or act, should be recognized as a pathology. Voyeurism only seems to partly explain it; much of it seems to come from an empty and unsatisfying life that leads to an attempt to live vicariously through some sort of idol which is perceived to be successful, in that sense that "most men lead lives of quiet desperation". However stupid and useless it may be, I can't deny that many do consider it newsworthy and much of "the news" includes such elements.

Re:Damn voyeurism is all it is

[mea37]

Do you mean, you think you could've gotten an individual's medical records in MA for less than $20? Or maybe you can't see why someone would dig up an individual's medical records? (I can think of many... but then my employer was extorted by someone who'd stolen a bunch of medical-related data from them not that long ago.)

I think I hear a bit of "nobody would go to all that trouble" in your message. If in the early days of WiFi networks I described to you in tedius yet vague terms how to compromise WEP encryption, you probably would've thought the same thing. Today anyone who cares to can break WEP using readily available tools - it's really no bother at all if you're even slightly inclined to do it.

I've seen companies with contractual and regulatory obligations to protect data privacy make half-gestures to make it look like they're honoring privacy while still engaging in whatever easy-money scheme or shortcut they want. Shedding light on why those half-gestures don't work is a big deal.

Re:Damn voyeurism is all it is

[Anonymous Coward]

Except that most people who watch Entertainment Tonight and such aren't "obsessed" with celebrity trivia. Interest =/= obsession.

Re:Damn voyeurism is all it is

[R2.0]

"Then how do you explain shows like Entertainment Tonight and all of these magazines and Web sites devoted entirely to completely useless celebrity trivia? Y'know, the ability to obsess over the personal life of someone you have never met and will never personally know, merely because they can sing or act, should be recognized as a pathology. Voyeurism only seems to partly explain it"

But is it really voyeurism if no sex is involved? I mean, it's one thing to know that Lindsay Lohan is a slut, but bid deal.

Show me primetime video of her being bent over a car hood by her boi/gurl/whatever friend, THAT's voyeurism. (And quality TV, to boot.)

Re:Damn voyeurism is all it is

[causality]

Except that most people who watch Entertainment Tonight and such aren't "obsessed" with celebrity trivia. Interest =/= obsession.

Dear AC, perhaps we are using different definitions of "obsession." Here's mine: when something cannot possibly benefit your life in any measurable way whatsoever, and you devote energy to pursuing it anyway, this is something of an obsession. To me, an interest is something different. The RIAA has an interest in strong copyright laws. Why? Because the RIAA is benefitted by strong copyright laws. Therefore, it's not a surprise that the RIAA tries to bring them about. However, it doesn't do a damned thing for me to know that $ACTRESS is thinking of divorcing her husband. I don't benefit from knowing this, therefore I can accurately say that it is not in my interests. Her family and personal friends might have an interest in this, and with good reason, but then they wouldn't need to find out second-hand from a TV show either.

Think about it this way. If we treated all industries equally, in the sense that all industries were treated just like the entertainment industry, then anytime you bought a car or a computer it would come with a big long list containing the names of all the members of management, designers, and factory workers who produced it as well as the truck drivers who shipped it and the advertisers who marketed it. We would then have TV shows and magazines talking about the personal private lives of those people who produced your cars and computers, whom they marry, how many times they divorce and why, what goes on behind closed doors in their homes, and paparazzi would follow them around and try to get "exclusive" or embarassing photos of them. Additionally, average people who never met any of them would talk about them fondly as though they personally knew them.

Now if this happened for the automobile or computer industries, and I said it was obsessive behavior, on what grounds would you dispute that? Real question. I'd like to know.

Re:Damn voyeurism is all it is

[causality]

Do you mean, you think you could've gotten an individual's medical records in MA for less than $20? Or maybe you can't see why someone would dig up an individual's medical records? (I can think of many... but then my employer was extorted by someone who'd stolen a bunch of medical-related data from them not that long ago.)

I think I hear a bit of "nobody would go to all that trouble" in your message. If in the early days of WiFi networks I described to you in tedius yet vague terms how to compromise WEP encryption, you probably would've thought the same thing. Today anyone who cares to can break WEP using readily available tools - it's really no bother at all if you're even slightly inclined to do it.

I've seen companies with contractual and regulatory obligations to protect data privacy make half-gestures to make it look like they're honoring privacy while still engaging in whatever easy-money scheme or shortcut they want. Shedding light on why those half-gestures don't work is a big deal.

That's the thing that I also think people don't understand. With good reason, I am not satisfied merely that someone probably wouldn't want to abuse my information. I am satisfied only when I know that they cannot do so.

I think the solution is to have the concept of "intellectual property" work both ways. Obviously your private information has value, otherwise advertisers and other companies wouldn't go to such great lenghts to obtain and use it. The problem is that they obtain it without your consent and without directly compensating you. For example, if I don't actively block web bugs, cookies, HTTP "ping", analytics tools, and other similar attempts, then that data will be gathered whether or not I like it.

The reason why I actively go out of my way to prevent companies from gathering data on me is simple. No one asked me if I wanted to be data-mined. I refuse to honor agreements in which I did not participate. Why anyone else would do so is a mystery to me.

So make each individual's private data their personal property. They can set whatever value they like, and if that value is more than a company thinks it is worth, the company is free to decline the sale. Most importantly, any attempt to just take that data will be theft, and anyone who does this can be prosecuted in a criminal court. I mean, think about it: why is it "marketing" when a company helps itself to my information against my will and "piracy" or "industrial espionage" if I helped myself to THEIR zeroes and ones against their will?

Re:Damn voyeurism is all it is

[superdana]

Dear AC, perhaps we are using different definitions of "obsession." Here's mine: when something cannot possibly benefit your life in any measurable way whatsoever, and you devote energy to pursuing it anyway, this is something of an obsession.

Sorry, no; an obsession is just a troubling preoccupation. Benefit has nothing to do with it.

Re:Damn voyeurism is all it is

[mbone]

Dear AC, perhaps we are using different definitions of "obsession." Here's mine: when something cannot possibly benefit your life in any measurable way whatsoever, and you devote energy to pursuing it anyway, this is something of an obsession.

Tonight, I spent some time pursing a better view of the beautiful sunset here in Paris, and then observing it, which could not possibly benefit my life in any measurable way whatsoever. I will do it again, the next time such an opportunity arises. I recommend that you should be cautious before you label people obsessed.

Re:Damn voyeurism is all it is

[causality]

Dear AC, perhaps we are using different definitions of "obsession." Here's mine: when something cannot possibly benefit your life in any measurable way whatsoever, and you devote energy to pursuing it anyway, this is something of an obsession. Sorry, no; an obsession is just a troubling preoccupation. Benefit has nothing to do with it.

Arguing semantics is much more useful when you are able to suggest a more suitable word. However, even then it's of little use, because even if I admit that "obsession" was a terrible choice of words, it doesn't do anything to change a single point I have made. Likewise, I can't help but notice you have not addressed any of the points I have made. So, I must conclude that this is the only fault you were able to find with my reasoning, which is pretty good, because it has nothing to do with my reasoning at all.

Re:Damn voyeurism is all it is

[causality]

Dear AC, perhaps we are using different definitions of "obsession." Here's mine: when something cannot possibly benefit your life in any measurable way whatsoever, and you devote energy to pursuing it anyway, this is something of an obsession.

Tonight, I spent some time pursing a better view of the beautiful sunset here in Paris, and then observing it, which could not possibly benefit my life in any measurable way whatsoever. I will do it again, the next time such an opportunity arises. I recommend that you should be cautious before you label people obsessed.

Yes, but you saw the sunset for yourself. You didn't hear second-hand about someone else who saw a beautiful sunset. That's why I know you have missed my point.

I made a clear distinction when I was talking about celebrities. The distinction was between actually personally knowing someone, versus going to lenghts to obtain second-hand information about a person you have not met, do not personally know, and in all likelihood are never going to meet. Tell me, when you read my post did you overlook this part?

However, it doesn't do a damned thing for me to know that $ACTRESS is thinking of divorcing her husband. I don't benefit from knowing this, therefore I can accurately say that it is not in my interests. Her family and personal friends might have an interest in this, and with good reason, but then they wouldn't need to find out second-hand from a TV show either.

Re:Damn voyeurism is all it is

[Anonymous Coward]

When something cannot possibly benefit your life in any measurable way whatsoever, and you devote energy to pursuing it anyway, this is something of an obsession.

Like posting on slashdot?

(I'm a different AC, BTW.)

Re:Damn voyeurism is all it is

[andy_t_roo]

i think i found a new sig (a bit too long for /. unfortunately):
  "why is it "marketing" when a company helps itself to my information against my will and "piracy" or "industrial espionage" if I helped myself to THEIR zeroes and ones against their will?"

Re:Damn voyeurism is all it is

[SocratesJedi]

Dear AC, perhaps we are using different definitions of "obsession." Here's mine: when something cannot possibly benefit your life in any measurable way whatsoever, and you devote energy to pursuing it anyway, this is something of an obsession.

Good point, but I think you might get more mileage out of your definition by framing it in terms like the DSM-IV might: an obsession is an interest that has become maladaptive. (No, I didn't go look it up, but it feels to me like the appropriate spirit.) In this way you might be able to make a distinction between people who have an interest in the social affairs of a subset of humans who interact in strange ways (w.r.t. the rest of human society) and those who have become so interested that it interferes with the conduct of their own lives.

Interesting other points though.

Re:Damn voyeurism is all it is

[aaaaaaargh!]

My solution is simple: I just enter complete bullshit information into any form I have to fill out. This works for most sites and it is completely legitimate. If a stranger asks me about my name, telephone, birthdate, name of my favorite toy when I was a child, and so on I would certainly not give him this information either.

Re:Damn voyeurism is all it is

[bruceslog]

I think the solution is to have the concept of "intellectual property" work both ways. Obviously your private information has value, otherwise advertisers and other companies wouldn't go to such great lenghts to obtain and use it. The problem is that they obtain it without your consent and without directly compensating you. For example, if I don't actively block web bugs, cookies, HTTP "ping", analytics tools, and other similar attempts, then that data will be gathered whether or not I like it.

Agreed.

An example,
Firefox, plus the Ghostery addon = the ability to block the Doubleclick web bug / tracking beacon on slashdot's pages.

P.S. - apologies to /. for reducing your ability to make money. But you're making that money by allowing a sleezy third party to track me online, which ticks me off. Find another way.

But, when you say

The reason why I actively go out of my way to prevent companies from gathering data on me is simple. No one asked me if I wanted to be data-mined. I refuse to honor agreements in which I did not participate. Why anyone else would do so is a mystery to me.

You would be told that just loading, looking at, or using a website, or promotion, or using a store card ( Krogers, Marsh, etc ), means that you have agreed to their terms of service, and said terms of service usually say that in return for the privilege of using their website or promotion or whatever, you give consent to such tracking.
They have themselves covered.

Re:Damn voyeurism is all it is

[orgelspieler]

We would then have TV shows and magazines talking about the personal private lives of those people who produced your cars and computers

You mean like Steve Jobs and Bill Gates? There are others who come to mind: Jack Welch, Richard Branson, Martha Stewart. But really, as a stockholder in several mutual funds, what businessmen and women do in their personal life really does have an effect on me. People are finicky, and stock prices fluctuate upon rumors of what these folks are (or were) up to.

Presumably politicians are fair game because their public life and private life intermingle all too often.

Re:Damn voyeurism is all it is

[Ironica]

The problem is that they obtain it without your consent and without directly compensating you. For example, if I don't actively block web bugs, cookies, HTTP "ping", analytics tools, and other similar attempts, then that data will be gathered whether or not I like it.

When you walk into some brick-and-mortar stores, there's someone standing at the front door counting you as you walk in. Because they can see your face, if you walk out and back in again, they probably won't re-count you. This helps them sell stuff, and possibly make money in other ways, too; for example, Costco does this, and they have their "road show" events where they may collect money from companies that come and sell stuff in the store. They partner with American Express to try to sign you up for a credit card while you're there.

Do you wear a mask and sneak in the back door to avoid them counting you?

I mean, yes, to some extent, you have a point, but blocking EVERYTHING is the same as avoiding having a guy standing at the door to a store counting your head as you walk in. It's not an unreasonable thing for a website to count the folks who visit, and to "recognize" them in some way to avoid counting the same person multiple times in rapid succession.

Re:Damn voyeurism is all it is

[Anonymous Coward]

Dear AC, perhaps we are using different definitions of "obsession."

Yes, and yours is objectively wrong.

The Only Truly Anonymous Data

[Anonymous Coward]

The only way to make sure that data remains truly anonymous if or it to start out as anonymous data. "Scrubbed" data will always be traceable and often will have the source data, non-scrubbed, leak into the wild.

All hail the glorious Hypno-Google.

Re:The Only Truly Anonymous Data

[oodaloop]

That's pretty cowardly.

Re:The Only Truly Anonymous Data

[shentino]

Especially if you're outed by a friend who posts RL info without your permission that you can't retract.

Had this happen to me once.

Re:The Only Truly Anonymous Data

[Anonymous Coward]

It's 2009. If you are still in the closet you NEED to be outed by a friend. He did you a favor, closet-boy.

Re:The Only Truly Anonymous Data

[Anonymous Coward]

Obviously the appropriate response would have been to post your "friend's" phone number on 4chan.

Bonus points if you can come up with a story that actually entices Anon to call en masse, but some are likely to do it anyway just for the lulz.

Re:The Only Truly Anonymous Data

[causality]

Especially if you're outed by a friend who posts RL info without your permission that you can't retract.

Had this happen to me once.

That's why you have to be very careful about who your friends are. I am no longer surprised by someone who "suddenly changed" because it is not really sudden at all, it is merely subtle before it becomes bleedin' obvious. Sorry to hear you got screwed.

And yes, I have trusted people I should not have trusted and gotten screwed. What I learned from it is that I ignored red flags and warning signs that should have tipped me off and so I set myself up for what should have been a predictable outcome. Usually this is because I denied the reality of what that person was telling me about themselves in favor of seeing only what I wanted to see. In that way, the person who meant me harm actually made me sharper, wiser, and more difficult to deceive. That could not have happened if 100% of my reaction was to blame that other person for doing something wrong, because that's for victims. Whether a victim gets screwed or not depends entirely on the other person. Whether I get screwed or not depends entirely on whether I make good decisions.

Victims have another significant disadvantage: they don't profit from their negative experiences, because when everything is someone else's fault, there is no incentive to examine yourself and find out why you should have known better. Thus, where they should be learning and growing they are stagnant. The popularity of this mentality is really amazing.

Re:The Only Truly Anonymous Data

[Anonymous Coward]

you have a strange definition of "friend", friend.

Re:The Only Truly Anonymous Data

[shentino]

By "outing" I mean the publication of ANY personal information that you'd prefer to keep secret.

Sexual orientation, which btw doesn't apply in this case to this 24 year old virgin, is only one of many possible "secrets" that can be blown.

Also, consider if I were an iranian dissident who had hard proof that the elections were rigged? Isn't it foreseeable that, with protesters being deemed to be against Allah by the powers that be, that outing me would put me in grave danger?

Anonymity is a precious thing that should be respected. Whether it protects your ego or your life.

Paul Ohm?

[Yvan256]

Paul Ohm's recent paper is an elaboration of what Ohm terms a central reality of data collection: "Data can either be useful or perfectly anonymous but never both."

Great, another Ohm's law to learn.

Re:Paul Ohm?

[natehoy]

Nonsense, it could be a extension of the current Law:

"In electrical circuits, Ohms' law states that the current through a conductor between two points is directly proportional to the potential difference or voltage across the two points, and inversely proportional to the resistance between them. In data anonymity, the law states that the general usefulness of any set of data that originally contained personally-identifiable information is inversely proportional to the degree of anonymity applied to said data."

See, on simple law to memorize, and now data analysts learn just a teensy bit about electricity and EEs learn just a teensy bit about data anonymization.

Re:Paul Ohm?

[2names]

Could you put that in the form of a car analogy so us laymen can understand it please? :)

Re:Paul Ohm?

[Beardo the Bearded]

Okay, let's take a road. The speed at which traffic can travel depends on the quality of the surface, gradient, camber, zoning, etc. Let's call this the "road conditions", with a lower number being better roads.

The number of cars that want to get through that road is a primary unit, which we can refer to as the "volume of traffic".

The third major criteria is the speed at which the traffic actually flows. This is the "actual flow" of traffic -- in other words, the "influence of other cars" on the traffic congestion.

In other words:
volume = influence of traffic * road conditions

or:
V = IR

Re:Paul Ohm?

[Anonymous Coward]

But with road traffic, the safe following distance is smaller at lower speeds. In my country, they promote a "two second rule". If you note the position of the car ahead, you should pass that position two seconds later. This increases the spacing as speeds increase. It also means that the carrying capacity of any road is approximately equal to 1800 cars per hour per lane, no matter what the speed is. So improving the road so cars can travel faster does not necessarily increase the capacity of the road.

This neglects the length of the car itself, so the capacity does fall off as the speed is reduced. But it is not linear.

Re:Paul Ohm?

[Anonymous Coward]

So is Paul Ohm guilty of plagiarism or reincarnation? :-)

Re:Paul Ohm?

[Anonymous Coward]

I'm so sorry. You forgot to phrase that in the form of a question. But its not a total loss, you get this great consolation prize.

Re:Paul Ohm?

[advocate_one]

sounds more like Heisenberg's Uncertainty Principle...

Re:Paul Ohm?

[Anonymous Coward]

Ohm No!

Oh dammit.

[Anonymous Coward]

They're on to me.

Re:Oh dammit.

[Anonymous Coward]

Are they onto me, too?

Duh.

[SatanicPuppy]

Am I the only one who always gives their birthday as 01/01/1970 and their zip code as 20500?

I mean, seriously. They don't need to know. Why would I give 'em the right numbers? They're lucky I even allow them to have rough demographic data.

Re:Duh.

[Anonymous Coward]

Yes you are. I'm watching you from across the street now.

Re:Duh.

[ColdWetDog]

I just put "No" under sex. I like to tell the truth. Not sure how it helps on the ID end though.

Re:Duh.

[garcia]

Am I the only one who always gives their birthday as 01/01/1970 and their zip code as 20500?

I use 1/1/1979 (it's closer to my real age) and 90210 instead. I get a lot of crosseyed looks and many times the cashier (or whatever human I'm dealing with) will end up entering in a local zip code instead but people are no longer arguing w/me about what I choose to provide them when pressured for information (I always politely reply, "no thanks," when asked for that type of information but will give them false shit when they ask again and whine that they'll be fired).

Why would I give 'em the right numbers? They're lucky I even allow them to have rough demographic data.

Because the majority of people have absolutely no problems handing over any and all information they're prompted for up to and including their e-mail address, phone number or even SSN! Because most people don't even blink, those of us that don't feel like it should be anyone's business (like the scanning of IDs at liquor stores or bars to check age--there is a birthdate listed on IDs for a fucking reason people--not that they can scan my rare earth magnet swiped ID anyway) are looked at like assholes when we refuse to provide information that no one really needs anyway.

Re:Duh.

[Anonymous Coward]

I put "please!" and it doesnt seem to help either.

Re:Duh.

[antifoidulus]

You forgot phone number "867-5309"

Re:Duh.

[Anonymous Coward]

Am I the only one who always gives their birthday as 01/01/1970 and their zip code as 20500?

But be careful. Using the same fake data consistently still allows someone to correlate across different records. For instance the aggregate data from various websites where you've filled-in data would identify you (with reasonably high probability) as being a single person. Then all it takes is one database that has enough info to link back to your real identity for your anonymity to be gone again.

I'm not saying that the average company would go to that much effort. I'm just saying that if you're going to be paranoid about anonymity, you should vary the data you provide somewhat randomly.

Re:Duh.

[interkin3tic]

Yes you are. I always put put 90210. Phone number 867-5309. If anyone tries to find me, they're at least going to have that song stuck in their head and recall with disgust the shows they watched in the early 90's. Hopefully that will demoralize them enough to give up.

Re:Duh.

[compro01]

I would think 90210 is a more common choice for zip code. It's probably the most densely populated area on the planet according to dataminers.

Re:Duh.

[syrinx]

It identifies you as a Slashdotter...?

Re:Duh.

[davester666]

I use 1/1/00, and a zip code of 12345. So, either a fairly young child or a rather old person has quite the interest in porn...

Re:Duh.

[mmkkbb]

(like the scanning of IDs at liquor stores or bars to check age--there is a birthdate listed on IDs for a fucking reason people--not that they can scan my rare earth magnet swiped ID anyway)

That's not to check age; that's to check for counterfeits with mismatched mag data, or mismatched 2-D barcode data, or missing UV ink prints, or missing holograms, etc. etc.

Re:Duh.

[Anonymous Coward]

I usually go by 01/01/1980 and 90210.

I guess I'm about 10 years younger than you. I don't live in the United States.

Re:Duh.

[ACMENEWSLLC]

This makes me think of a probably not unique idea. Most places that ask my my phone number are the same places asking over and over again. Radio Shack, Toys-R-Us, and Sears for example. What would be great is to memorize one of their phone numbers from the phone book and always give them that. Perhaps a number from a different store. Let their telemarketers waste time calling their own stores.

Re:Duh.

[ModifiedDog]

My phone number is always 555-1212.

Re:Duh.

[R2.0]

I always use 20001. Pretty sure it covers the White House and Congress.

Re:Duh.

[plague3106]

I once gave a gamestop employee my zip as 12345. He say "its ok if you don't want to give it." My reply was the no, I am from Schenectady, NY.

Re:Duh.

[ShieldW0lf]

There are 3 different scenarios.

One is where the facts are embarrassing because of hypocrisy. That scenario is alleviated by loss of anonymity and increased transparency.

Another is where the person is engaged in anti-social behavior because they are in a reactionary state and need assistance because they are going off the rails in isolation. That scenario is also alleviated by the loss of anonymity. People will get the help they need to be happy and self-reliant if society at large is aware that they need it.

The third scenario is when people are engaged in premeditated anti-social behavior because they are amoral and vicious or involved in a conspiracy against the best interests of their peers for ideological reasons. Those people belong in the ground, and we should not be protecting their obscurity.

There is no justification for anonymity, nor for secrecy. Anonymity and secrecy preserve and reinforce the hazards that they purport to protect people from. They need to be abolished in a systematic fashion that doesn't expose early adopters to the dangers of hypocrisy, but tears the veils away for everyone all at once.

Re:Duh.

[Beardo the Bearded]

No, I use 90210 because I know that's a valid code.

I've given out random birthdays so many times that I have to check my DL before I order a cake.

Re:Duh.

[TREE]

I use 1/1/1970 often, because it's ZERO in UTC.
Shocked no one has "gotten that" yet, even here.

Re:Duh.

[foniksonik]

Your "account" is indexed under your phone number - they are looking it up to know what offers they should let you in on, check to see if you have a store credit card or should have one and of course to build their profile on you.

They don't care about your phone number other than that it is a unique identifier.

Re:Duh.

[Mycroft_VIII]

Yes because no group or subset of society has ever been wrongly subjected to bias and everyone loves targeted advertising in their mailbox (physical or email).

I know, I know, don't feed the trolls......

Re:Duh.

[fulldecent]

I will take your post at face value.

>> One is where the facts are embarrassing because of hypocrisy. That scenario is alleviated by loss of anonymity and increased transparency.

I have never heard this argument against ones ability to commit hypocrisy. This is interesting, although I do not support it because of believe in free speech.

>> Another is where the person is engaged in anti-social behavior because they are in a reactionary state and need assistance because they are going off the rails in isolation. That scenario is also alleviated by the loss of anonymity. People will get the help they need to be happy and self-reliant if society at large is aware that they need it.

This statement assumes that freedom of religion is a bad thing.

>> The third scenario is when people are engaged in premeditated anti-social behavior because they are amoral and vicious or involved in a conspiracy against the best interests of their peers for ideological reasons. Those people belong in the ground, and we should not be protecting their obscurity.

This statement assumes that all social behavior is moral or in the best interests of ones peers. If true, this statement essentially states that society has reached a point of maximum harmony and should never be changed.

Re:Duh.

[Anonymous Coward]

Why not take a look at the contact pages of fbi.gov or whitehouse.gov ?
Something useful might actually come out of it.

Re:Duh.

[Anonymous Coward]

I would think 90210 is a more common choice for zip code. It's probably the most densely populated area on the planet according to dataminers.

+1. Whenever you code a webapp that requires "zipcode" in 5-numeric-digit format, the entire world enters 90210.

Re:Duh.

[anegg]

Wait - I knew someone who really had that phone number! I met her during winter break at college. She gave me her number so that I could call her when school was back in session. Something happened, though, and I could never get a hold of her after that... oh, wait... damn.

Well, at least she didn't say her name was Jenny.

Re:Duh.

[digitalhermit]

Yah, I do that too. I have AARP invitations on my wall because they mined some database that shows I'm in my 70s. I also have lots of high school age directed mail because other databases show me as a teenager. Oh, and Medicaid and insurance scams and political propaganda targeted at seniors -- I get literally dozens of those a week.

Re:Duh.

[Anonymous Coward]

And after that, it's to keep a list of everyone who has entered the bar for the history of it's operation. Much easier to identify "troublemakers" when you have a list of people who like to have fun once in a while.

Re:Duh.

[Anonymous Coward]

You're a moron. Anonymity is a useful method of protecting yourself from information leaks. The more information you give away (intentionally or by accident), the more likely it will be used to damage you. There's no reason why a clerk in an electronics store needs to have my name, address and phone number when I buy an item; and if I do give those away I will expose myself to annoying and environmentally destructive marketing in the best case, and in the worst burglary by the clerk & his friends who now know I like to buy expensive hi-fi equipment. This is just the most obvious case for anonymity.

Re:Duh.

[Anonymous Coward]

Heh... I told Toys R US that my number was 911 - (something arbitrary) and the store manager in the next row over got pissed that I gave them that number. I say, ask me a stupid question, I'll give you a stupid answer.

Re:Duh.

[fran6gagne]

I give the same birthday but being from Canada the only real zipcode I know is 90210. I miss Brandon and Brenda....

Re:Duh.

[steelfood]

And you wonder why you never get laid when you go to a bar.

Re:Duh.

[steelfood]

The way to defeat this is to use an out-of-state fake ID. Or to use an ID of somebody who looks like you.

The whole ID checking process has gotten asanine really...

Re:Duh.

[Belial6]

I had an argument (debate?) with my wife and the cashier about Toys R Us collecting data for tracking reasons. It didn't last long, because when they started telling me I was paranoid, I took one step to the left and pointed to the sign that was posted on the wall of the checkout line that specifically said they were collecting the data for the purpose of tracking personal purchases to better server their customers.

Re:Duh.

[causality]

And you wonder why you never get laid when you go to a bar.

Usually it's better to wait until you leave the bar.

Re:Duh.

[RabidMoose]

The only bar I go to is the one my parents built in their basement while I was away at college.

I never pay for drinks, I know the password for the Wi-fi, and it never closes.

Problem is, the only girl who ever shows up is my sister.

Re:Duh.

[causality]

Your "account" is indexed under your phone number - they are looking it up to know what offers they should let you in on, check to see if you have a store credit card or should have one and of course to build their profile on you.

They don't care about your phone number other than that it is a unique identifier.

I have the money, they have the goods, we make an exchange. I like it when it remains that simple. Their mistake is assuming that I want to establish an "account" without first asking me. When it comes to my personal information, everyone is on a need-to-know basis. Almost no one needs to know. If they have an entitlement mentality that prevents them from respecting that, then I have no moral qualms whatsoever about giving them false information.

Re:Duh.

[mmkkbb]

An out-of-state fake ID will not necessarily work. There are interstate standards for the content of mag stripes and 2-D barcodes, for example.

Re:Duh.

[causality]

There is no justification for anonymity, nor for secrecy. Anonymity and secrecy preserve and reinforce the hazards that they purport to protect people from.

So you'll be posting your full name, home address, and telephone number to Slashdot?

Note, I hope you don't do that because it would be a very bad move on your part. However, it would also be consistent with your position.

Re:Duh.

[nitehawk214]

I use this exact same zip code. On web forms I usually put in 123 Fake Street.

Oh and bob@hotmail.com? I am really, really sorry about that man.

Re:Duh.

[deepershade]

Im british so I do it slightly differently. There's a coupla hundred databases that currently list me as:
Bob Bobbington
Bobtown
Bobbington Heights
B06 6OB


DB: 01/01/1901

As for phone number. I always use the phone number for the parents of this kid that used to bully me when I was a kid. He's apparently since moved out, but I figure they deserve continued punishment for raising a little bastage. :)

Re:Duh.

[Anonymous Coward]

Am I the only one who always gives their birthday as 01/01/1970 and their zip code as 20500?

I mean, seriously. They don't need to know. Why would I give 'em the right numbers? They're lucky I even allow them to have rough demographic data.

No you are not the only one. Some don't even login to Slashdot to post comments and refuse to be intimidated by the bullying tactic of adding the apellation 'coward' to the perfectly reasonable and sensible one of just 'anon'.

Of course event that does not help with the privacy situation: ad trackers, web beacons, logging of IP addresses, analysis of writing styles... McNealy wasn't kidding, exagerating or wrong when he said that we no longer have any privacy and must simply accept that reality.

You have the kind of privacy that you do on a nudist beach... i.e. unless you are wearing clothes or have some extraordinary marker that makes you stand out... you are visible but unseen.... for the most part.

Re:Duh.

[Jah-Wren Ryel]

An out-of-state fake ID will not necessarily work. There are interstate standards for the content of mag stripes and 2-D barcodes, for example.

But no where near all states follow those standards. All you gotta do is make a fake-id for one of those states. Even if the state does follow those standards, if you pick a state far enough way you can make up pretty much anything, call it an id card (rather than a driver's license) and the person using the machine will have to make the human decision to accept the id anyway or not. As someone who made such a fake-id for a girl who wanted to appear younger than she was (got tired of the bouncers at the clubs loudly exclaiming "you lookin gooooood for XX years old" and thus informing everyone she was with of her true age) I can say that the card always failed to scan because it was 100% bogus, but the people running the machines always accepted it anyway.

Re:Duh.

[YourExperiment]

You don't want to be better served? There you go then. Paranoid.

Re:Duh.

[Planesdragon]

And after that, it's to keep a list of everyone who has entered the bar for the history of it's operation. Much easier to identify "troublemakers" when you have a list of people who like to have fun once in a while.

You DO know that in many states, a bartender is legally responsible for anything you do while drunk from the moment you take a drink until you're finally sober, right?

Re:Duh.

[Planesdragon]

No you are not the only one. Some don't even login to Slashdot to post comments and refuse to be intimidated by the bullying tactic of adding the apellation 'coward' to the perfectly reasonable and sensible one of just 'anon'.

No, sorry, you're an anonymous coward.

Accoutns on /. allow you to join together a series of comments as "you", even if this /. you has no relation to the actual you. You dont' want to even stand two comments together? You're a coward.

Re:Duh.

[Anonymous Coward]

I get asked for name and phone number just to get a haircut.

My name is now Harry Mann to half the stylists in town. I invite everyone to join Harry Mann in his quest for stylish coifs.

Re:Duh.

[icebraining]

Actually, I think he should post them to /i/, they'll be more than happy to send him something for his trouble :P

Re:Duh.

[ShieldW0lf]

There is no justification for anonymity, nor for secrecy. Anonymity and secrecy preserve and reinforce the hazards that they purport to protect people from. They need to be abolished in a systematic fashion that doesn't expose early adopters to the dangers of hypocrisy, but tears the veils away for everyone all at once.

So you'll be posting your full name, home address, and telephone number to Slashdot?

Note, I hope you don't do that because it would be a very bad move on your part. However, it would also be consistent with your position.

The second sentence clearly demonstrates that you are intentionally misrepresenting my position. That must be why you choose not to quote it.

Did it ever occur to you that if there were no anonymity and no secrets, selective enforcement of law would no longer be possible? Right now, investigation is difficult by design, which means there's no problem with creating laws that the majority of people do not support and do not obey. You need to dig a bit to get the evidence on any one person, but it's generally there. Which means you can be singled out, and it's practical to prove you broke the law, but it's not practical for you to do an investigation and prove that millions of your peers are doing the same thing every day without their causing any harm. If such a defense was practical for individuals, most of us would have a lot less to fear than we do now.

Re:Duh.

[BikeHelmet]

Am I the only one who always gives their birthday as 01/01/1970 and their zip code as 20500?

Yes.

You are actually the only person to use that combination, and thanks to your slashdot comment, that means means you can be spotted anywhere you use it.

Quick! Encourage a bunch of people to use it to hide your tracks! ;)

Re:Duh.

[ShieldW0lf]

I will take your post at face value.

>> One is where the facts are embarrassing because of hypocrisy. That scenario is alleviated by loss of anonymity and increased transparency.

I have never heard this argument against ones ability to commit hypocrisy. This is interesting, although I do not support it because of believe in free speech.

So, your position is that newspapers do not represent free speech because the writers publish their names.

>> Another is where the person is engaged in anti-social behavior because they are in a reactionary state and need assistance because they are going off the rails in isolation. That scenario is also alleviated by the loss of anonymity. People will get the help they need to be happy and self-reliant if society at large is aware that they need it.

This statement assumes that freedom of religion is a bad thing.

So, your position is that religions are anti-social organizations who would have their freedom taken away if the majority of people knew what was going on.

>> The third scenario is when people are engaged in premeditated anti-social behavior because they are amoral and vicious or involved in a conspiracy against the best interests of their peers for ideological reasons. Those people belong in the ground, and we should not be protecting their obscurity.

This statement assumes that all social behavior is moral or in the best interests of ones peers. If true, this statement essentially states that society has reached a point of maximum harmony and should never be changed.

So, you believe in protecting the right of amoral individuals to engage in vicious, pre-meditated anti-social behavior such as murder from obscurity, and you believe in protecting the right of groups of conspirators to act against the interests of their peers from obscurity.

Not only that, but you believe this because you feel that these groups are the sole source of social change, and are the only thing that will lead us towards greater harmony, and therefore must be protected.

You have a very strange way of looking at the world.

Re:Duh.

[Sancho]

Their definition of "better served" is showing you things you didn't even know that you wanted. Generally, I just want to buy what I have decided that I want, and then to be left alone.

Re:Duh.

[ShieldW0lf]

Yes because no group or subset of society has ever been wrongly subjected to bias and everyone loves targeted advertising in their mailbox (physical or email).

If everyone knew what was going on, they wouldn't do that anymore. Their ignorance was the reason for it in the first place, and you don't alleviate ignorance through secrecy.

Re:Duh.

[timeOday]

Am I the only one who always gives their birthday as 01/01/1970 and their zip code as 20500?

I guess that's better than not trying at all, but everybody knows unverified, volunteered information is garbage.

More to the point, do you anonymize your grocery store purchases by going through the checkout separately for each aisle, or buying one of everything and throwing out the "chaff?" Do you rent movies selected at random to conceal your true preferences, and randomize your street address monthly? Avoid prescriptions you need and instead take different drugs at random to conceal your maladies?

Information you volunteer is the tip of the iceberg.

Re:Duh.

[Nero Nimbus]

I tend to prefer using 12345 as my zip code, but will use 1/1 and a random year for my birthday.

Re:Duh.

[Brian Gordon]

even SSN

My Chemistry lab a few weeks ago had a blank at the top for SSN! I left it blank, but I took a peek at the stack when I handed it in and the girl in front of me had actually written in an SSN.

Re:Duh.

[Quothz]

Am I the only one who always gives their birthday as 01/01/1970 and their zip code as 20500?

I mean, seriously. They don't need to know. Why would I give 'em the right numbers? They're lucky I even allow them to have rough demographic data.

That's great until you want, for example, a bank account or a telephone number. At that point, you're pretty much stuck giving 'em correct information.

Re:Duh.

[mmkkbb]

Yes, well, any security system that relies on humans is prone to failure :)

Re:Duh.

[Anonymous Coward]

He did not express anything even remotely resembling those strawmen, which you attacked because you knew you could not argue against the things he actually said. By doing this, you scream at the top of your lungs an unconditional and irrevocable confession to being a lying scumbag.

But then you've been doing that constantly for nearly three months straight, so that comes as no surprise.

Re:Duh.

[Anonymous Coward]

The second sentence clearly demonstrates that you are intentionally misrepresenting my position.

After making this post, you don't EVER get to make that complaint.

Re:Duh.

[Anonymous Coward]

You are not alone. I should consider not giving my correct year of birth as well, just so long as I'm over 18, which is really all this question should be about.

Re:Duh.

[sco08y]

Heh... 90210 is a good one, but 12345 is in Schenectady, NY. Since 12345 is also the combination to my luggage, it's quite convenient.

Re:Duh.

[Hognoxious]

Did it ever occur to you that if there were no anonymity and no secrets, selective enforcement of law would no longer be possible?

How so? The cops could go down the street arresting anyone with skin colour X, wearing a Y coloured shirt or driving a car type Z. Bad luck if they're all three - they're shot on the spot.

Re:Duh.

[Anonymous Coward]

Nah, don't sweat it. I forward everything to bob@bob.bob

Re:Duh.

[Anonymous Coward]

How on earth can that work? What if I drink when I get home, or go to more than one bar?

I can't see how that is enforceable if it's true.

Re:Duh.

[dargaud]

I just put "No" under sex

On written forms I alternate between "yes please", "pink", "big enough" and a few other variants.

Re:Duh.

[Anonymous Coward]

The third scenario is when people are engaged in premeditated anti-social behavior because they are amoral and vicious or involved in a conspiracy against the best interests of their peers for ideological reasons. Those people belong in the ground, and we should not be protecting their obscurity.

So what's your problem, shitcock?

Re:Duh.

[Anonymous Coward]

So....what's the problem?

Re:Duh.

[bvankuik]

I always fill in Donkey or Crocodile in the Sex field. Ever since that Firefox extension came out that lets you edit dropdown lists, I regularly visit dating site homepages and change values. Default is often [Man] looking for [Woman]. Which then becomes [Donkey] looking for [Woman]. I always hope that the admins catch me and put up a dating profile with a donkey.

Re:Duh.

[ShieldW0lf]

He did not express anything even remotely resembling those strawmen

I didn't express anything even remotely resembling his strawmen. So, it's a fair play.

Re:Duh.

[Anonymous Coward]

>Problem is, the only girl who ever shows up is my sister.
Is she hot?

Re:Duh.

[fulldecent]

>> >> >> One is where the facts are embarrassing because of hypocrisy. That scenario is alleviated by loss of anonymity and increased transparency.

>> >> I have never heard this argument against ones ability to commit hypocrisy. This is interesting, although I do not support it because of believe in free speech.

>> So, your position is that newspapers do not represent free speech because the writers publish their names.

That is correct. Several important political publications have been made under pseudonyms, for example the Federalist Papers. More generally, some selfish people may desire to prevent free speech which brings light to their actions, their actions could include intimidation or violence. Their induced chilling effect may be be subverted by pseudonymous publication. See [[anonymous tip lines]], [[whistleblower]], and [[witness protection program]].

>> >> >> Another is where the person is engaged in anti-social behavior because they are in a reactionary state and need assistance because they are going off the rails in isolation. That scenario is also alleviated by the loss of anonymity. People will get the help they need to be happy and self-reliant if society at large is aware that they need it.

>> >> This statement assumes that freedom of religion is a bad thing.

>> So, your position is that religions are anti-social organizations who would have their freedom taken away if the majority of people knew what was going on.

Close. My position is that some religions choose not to live at peace with other religions.

>> >> >> The third scenario is when people are engaged in premeditated anti-social behavior because they are amoral and vicious or involved in a conspiracy against the best interests of their peers for ideological reasons. Those people belong in the ground, and we should not be protecting their obscurity.

>> >> This statement assumes that all social behavior is moral or in the best interests of ones peers. If true, this statement essentially states that society has reached a point of maximum harmony and should never be changed.

>> So, you believe in protecting the right of amoral individuals to engage in vicious, pre-meditated anti-social behavior such as murder from obscurity, and you believe in protecting the right of groups of conspirators to act against the interests of their peers from obscurity.

>> Not only that, but you believe this because you feel that these groups are the sole source of social change, and are the only thing that will lead us towards greater harmony, and therefore must be protected.

This does not logically follow from my statement. Try this: I think it is possible that there is an opportunity to change society for the better. To make such a change, somebody must speak out against the status quo. It is impossible to speak about the "best interests of their peers" in an absolutist sense, unless you subscribe to a literal reading of some of the more popular religious texts. Therefore, some other people, perhaps a majority may be hurt by such a bringing to light. See also [[social security]], [[interest group]], [[democracy]] and [[republic]].

Also, yes I do believe in protecting the right of "amoral individuals" since criminal justice is not 100% accurate. Please see [[http://psychology.wikia.com/index.php?title=Bayesian_inference]] and [[salem witch trials]].

Re:Duh.

[ShieldW0lf]

Hey, it's my stalker! Hi stalker! If I was a stalker, I'd defend anonymity too. If I had as many shameful skeletons in the closet as you do, that would kill your career if anyone knew, I'd defend privacy too. But it's slip-slip-slip-sliding away day by day by day, and nothing's going to stop it. One day, I'll know exactly who and where you are.

Re:Duh.

[Stanislav_J]

Oh and bob@hotmail.com? I am really, really sorry about that man.

I like to use "getlost@noneofyerdamnbusiness.com." I often wonder how many unresolved e-mails to that addy are floating around the Web...

Re:Duh.

[Stanislav_J]

More to the point, do you anonymize your grocery store purchases by going through the checkout separately for each aisle, or buying one of everything and throwing out the "chaff?"

I anonymize my grocery store purchases by paying cash.

Re:Duh.

[Ironica]

Did it ever occur to you that if there were no anonymity and no secrets, selective enforcement of law would no longer be possible?

Did it ever occur to you that there have been and probably will again be times when morality and legality are not aligned?

Once upon a time, it was possible for people to be property. Assisting them to escape was theft. The Underground Railroad depended on anonymity and secrecy.

So did a guy named Schindler, who conspired against his government to save thousands of innocent lives.

Salman Rushdie wrote a boring book, but didn't deserve to die for it, so it's probably a good thing he was able to hide his whereabouts from his countrymen. And look what happened when the word got out that Alan Turing was gay.

Your thesis holds true only so long as those in power share your conscience, which is rarely true at this point in human history. Someday, maybe. Now, no.

Re:Duh.

[Ironica]

Yah, I do that too. I have AARP invitations on my wall because they mined some database that shows I'm in my 70s. I also have lots of high school age directed mail because other databases show me as a teenager. Oh, and Medicaid and insurance scams and political propaganda targeted at seniors -- I get literally dozens of those a week.

Good job on thwarting advertisers with false info. Me, I think I'll try to avoid getting MORE junk if I can possibly help it.

Re:Duh.

[clone53421]

Yeah, well, that's a lot more likely to work for a 40-year-old who wants to be 31 than it is for a 17-year-old who wants to be 21. If she obviously wasn't underaged, there was no reason to keep her out, because that's the only reason they check IDs anyway.

Re:Duh.

[compro01]

What extension is that?

Re:Duh.

[Jah-Wren Ryel]

Yeah, well, that's a lot more likely to work for a 40-year-old who wants to be 31 than it is for a 17-year-old who wants to be 21. If she obviously wasn't underaged, there was no reason to keep her out, because that's the only reason they check IDs anyway.

The point is that she was able to force the decision from the computer to the person at which point the decision was susceptible to other factors. As long as the systems are set up to let the human make the final decision, no amount of "interstate standards for the content of mag stripes and 2-D barcodes" will make a difference.

FYI, she was a 30 year old who looked 20.

Re:Duh.

[Anonymous Coward]

Hey, it's my stalker! Hi stalker! If I was a stalker, I'd defend anonymity too.

Nothing that I've done in any way resembles "stalking". You tell this lie in the vain hope of distracting from the undeniable fact that every single thing I have said about you is absolutely true. It has never worked, not even for yourself.

If I had as many shameful skeletons in the closet as you do, that would kill your career if anyone knew, I'd defend privacy too.

Yeah, it'd really render me unemployable if anyone found out that I occasionally remind some moron on the Internet of his own dishonesty and stupidity. And no, the fact that I post anonymously doesn't prove that I fear that to be the case, and yes, that IS what you were going to say.

But it's slip-slip-slip-sliding away day by day by day, and nothing's going to stop it. One day, I'll know exactly who and where you are.

Like the feigned amusement you started out with, the false bravado you display here isn't even well-stated enough to fool yourself, let alone scare me. We both know perfectly well that your fantasy of finding and destroying me will never be anything more than that.

Re:Duh.

[Doctor O]

I dunno if the parent used it, but you can do that with Firebug. Just right-click onto the dropdown, choose "Inspect Element" and change the source code for the option as desired. Choose, submit, enjoy.

Re:Duh.

[bvankuik]

I believe it's the Web Developer extension.

I'm perfectly anonymous!

[A beautiful mind]

See!

-- Anonymous Coward

Re:I'm perfectly anonymous!

[Anonymous Coward]

You do realize right that you posted that when logged in?

Re:I'm perfectly anonymous!

[hardaker]

You do realize right that you posted that when logged in?

You do realize you could have shortened your post to one word, right: Fail!

Only three bits?

[Yvan256]

[researcher Latanya Sweeney] showed that 87 percent of all Americans could be uniquely identified using only three bits of information: ZIP code, birthdate, and sex.

Holy hell forget about that anonymized data crap, I want to learn how she can compress that much data into three bits!

Re:Only three bits?

[clone53421]

For values of "all" equal to or less than 8, to index a table...

Re:Only three bits?

[Yvan256]

I think you mean equal to or less than 7. You forgot to count zero.

Re:Only three bits?

[Anonymous Coward]

Well if sex = yes then it excludes most of Slashdot posters.

Re:Only three bits?

[clone53421]

No, I mean equal to or less than 8. When counting Americans, zero isn't a useful number, because if we used zero Americans for our research then we wouldn't have anything to publish.

Re:Only three bits?

[clone53421]

...by which I mean, an empty table is != a table with one record, index # 000.

Re:Only three bits?

[An ominous Cow art]

It's not like he's some kind of neuromancer.

Re:Only three bits?

[steelfood]

Why, that's the simple part! You just use very big bits and hope they don't notice!

Re:Only three bits?

[ImprovOmega]

There are 8 distinct elements indexable by a three bit number. I fine you 5 nerd points for attempting to correct an already correct nerdy statement.

Re:Only three bits?

[Anonymous Coward]

index[0] = 1st element ...
index[7] = 8th element

Re:Only three bits?

[bondsbw]

She used to work at Verizon, and of course 300 bits is plenty.

Re:Only three bits?

[Yvan256]

For values of "all" equal to or less than 8, to index a table...

Read what I replied to (quoted again above). You can't fit the value "8" into three bits. Yes there is 8 elements, but they start from zero and go up to seven.

Re:Only three bits?

[Anonymous Coward]

Damn, I wanted to make that joke.

Re:Only three bits?

[Anonymous Coward]

[researcher Latanya Sweeney] showed that 87 percent of all Americans could be uniquely identified using only three bits of information: ZIP code, birthdate, and sex.

Holy hell forget about that anonymized data crap, I want to learn how she can compress that much data into three bits!

Quantum superposition. Are the other 13% same-sex twins sharing a P.O. box?

Re:Only three bits?

[clone53421]

Yes, and you can put 8 Americans' data into a table indexed by 3 bits. Or 0 Americans' data. Or any number in-between.

Mission Impossible

[im_thatoneguy]

I've pretty much given up any hope of being anonymous. It's just going to get exponentially more difficult as time goes on.

I had my credit card stolen once. It was stolen from the CC company. How is a business supposed to entrust me with thousands of dollars in credit if they don't know who I am? How is a credit card company supposed to function without a worldwide network which authorizes transactions.

If someone wants to find me they'll find me.

If someone wants to use my identity to frame me for a crime then they're just going to encounter a mountain of evidence from numerous sources which contradict their fabrication.

"My G1 was on a Starbucks Wifi at the time of the crime. I used my CC to purchase the drink. I received a text from a nearby tower. I posted a comment on breaking news story that is written in my style of writing. I was seen on 8 security cameras walking to the starbucks from my car. I used an automatic toll card 5 miles away from the coffee shop...." Good luck coming up with a large mountain of evidence to put me somewhere else.

Re:Mission Impossible

[Anonymous Coward]

Mission Impossible

You're thinking of the wrong Cruise flick.
Take all that tracking information then add a few heuristics and you've got Minority Report.

Re:Mission Impossible

[Anonymous Coward]

How is a business supposed to entrust me with thousands of dollars in credit if they don't know who I am?

They entrust the credit card company with credit. The credit card company entrusts you with credit, or in the case of prepaid credit cards, the credit card company takes your money and you trust them to relay it to the companies that you do businesses with. Only the credit card company needs to know your name and only if you don't give them the money up front.

"My G1 was on a Starbucks Wifi at the time of the crime. I used my CC to purchase the drink. I received a text from a nearby tower. I posted a comment on breaking news story that is written in my style of writing. I was seen on 8 security cameras walking to the starbucks from my car. I used an automatic toll card 5 miles away from the coffee shop...." Good luck coming up with a large mountain of evidence to put me somewhere else.

That is all volatile information in computer databases, which are unlikely to be cryptographically secured or in any other way tamper-proof. The same databases which put you where you really were can put you near a crime scene and all the traces you mentioned would not be any more trustworthy than the false data.

Re:Mission Impossible

[riqtare]

If access to the evidence you just stated was available to the framer it makes it very easy to find a likely fall guy according to their habits. Makes the alibi of overwhelming evidence evaporate into prime suspicion.
The best lies are those that are mostly truth.

Re:Mission Impossible

[ArsonSmith]

So you're saying you robbed the coffee shop?

Re:Mission Impossible

[Anonymous Coward]

"My G1 was on a Starbucks Wifi at the time of the crime. I used my CC to purchase the drink. I received a text from a nearby tower. I posted a comment on breaking news story that is written in my style of writing. I was seen on 8 security cameras walking to the starbucks from my car. I used an automatic toll card 5 miles away from the coffee shop...." Good luck coming up with a large mountain of evidence to put me somewhere else.

They won't need luck. If they're trying to frame you (and especially if you're helping them by being so cavalier about your privacy), then they'll know all of the above, and thus how to avoid conflicts between their evidence and yours. You'll simply have committed the crime at a time and place for which you have no alibi, or in a way that makes the time and location irrelevant.

Re:Mission Impossible

[Anonymous Coward]

If someone wants to find me they'll find me.

True, that. It's not even worth trying to defend against a targeted attack - the costs are not worth the risk. I want my information not to be available to casual, random 'bots. My identity doesn't need to be secret, it just needs to be harder to find than yours.

Re:Mission Impossible

[lennier]

"You'll simply have committed the crime at a time and place for which you have no alibi, or in a way that makes the time and location irrelevant."

Given the existence of Twitter and GPS location, 'a time and place for which you have no alibi' would have to mean 'more than five minutes after my last tweet'.

I'm having trouble wrapping my head around that concept.

Re:Mission Impossible

[Anonymous Coward]

I once had my identity stolen by my own CC company. In an effort to get them from sending my prefilled paper checks I signed up for their identity guard service. It got me a free credit score, access to info, etc. Anyway, when that info didn't come I called and spent 2 hours on the phone before I realized that they had mistaken me with another person of the same name approximately 1500 miles (4 states) away. I ended up buying him identity protection for 2 months (even after I cancelled it).

Re:Mission Impossible

[pipedwho]

With access to that information, it would be fairly straight forward for a 'shady' party to determine when you've 'gone offline', and insert a couple of extra pieces of 'online' incriminating evidence. Even if you leave your GPS tracker/logger on 24/7, that could be worked around by throwing in an inconvenient tweet the next morning like saying something like "damn, I left my phone at home...".

Without easy access to all your information, it would be much more difficult to do any of this.

Re:Mission Impossible

[BikeHelmet]

I'm more worried about what happens when I'm not on camera.

If someone tech savvy is framing you, they probably already planted a GPS on your car. They'll have a good idea when you're on camera. They might not frame you while you're at starbucks, but rather while you're out having a picnic in a park, or while you're at home alone. (random scenarios, but you get the idea)

Maybe someone saw you, or maybe not. Either way, no cameras or credit card transactions. Just the location of your phone, which doesn't prove a damn thing, does it? Maybe that post was pre-typed and waiting to be sent, since you're tech savvy as well.

And the sad thing is, as stuff like camera footage/surveillance becomes more common, an eye-witness(alibi) that *thinks* she saw you at the park is going to matter less and less to jurors. You're screwed!...

Every protection can be twisted around in a way that harms you. Don't assume anything will be used in your favour when you're getting framed.

Re:Mission Impossible

[Andrew Cady]

If someone wants to use my identity to frame me for a crime then they're just going to encounter a mountain of evidence from numerous sources which contradict their fabrication. "My G1 was on a Starbucks Wifi at the time of the crime. I used my CC to purchase the drink. I received a text from a nearby tower. I posted a comment on breaking news story that is written in my style of writing. I was seen on 8 security cameras walking to the starbucks from my car. I used an automatic toll card 5 miles away from the coffee shop...." Good luck coming up with a large mountain of evidence to put me somewhere else.

This is how it works: $10,000 and 2 months in jail later, your lawyer will offer to hire a private investigator for another $10,000 to try to find the people you need to subpoena to get that information.

Re:Mission Impossible

[Anonymous Coward]

Police: "Your fingerprints were found at the scene of the crime!"
Me (through my attorney): "Someone could have picked up a discarded soda can which my client touched and left it at the scene of the crime. Indeed, the scene of the crime could be at or near a soda can recycling bin. Nonetheless, my client is innocent."

Re:Mission Impossible

[Anonymous Coward]

Well recently in the Netherlands a guy tried to do just that: He wanted to use video tapes to prove he was somewhere else. The problem here was that the DA 'lost' those video tapes. I tried to re-find a link but was unsuccessful. Any other Dutch news finders up to the task?

Re:Mission Impossible

[Anonymous Coward]

So you robbed the Starbucks?

Didn't you know you were caught on 5 different cameras and left your CC at the counter?

At least one fact about them could be used

[RiotingPacifist]

[citation needed]
I can't think of anything I've done online (even my shemale midget fetish on youpron) that could be used to blackmail me, now i get that others are more ashamed about what they do online but "almost everybody"?

Re:At least one fact about them could be used

[interkin3tic]

I did think that was an overstatement that undermined the main point. None of my prescriptions would be embarassing to anyone but a holistic medicine believer, I've told some tasteless jokes online. If someone were to send that information to my family along with what porn I looked at, that would be awkward at most. And that's assuming it's credible, which it wouldn't be.

How exactly would this blackmail work? Bob, the evil co-worker threatens to tell your wife and boss you have had a sex change, a running prescription to anti-psychotic medication, were arrested for something that they don't know about and you weren't legally obligated to inform them of, and look at gay porn aproximately 30% of your waking hours. For this hypothetical situation, assume that information is true. Do you do what he wants? If you don't and he does tell your wife and boss, do they actually believe him?

I think privacy is good for privacy's sake, overstatements such as this undermine the point.

Re:At least one fact about them could be used

[5KVGhost]

I'm skeptical about that claim, too, but I think the author also intended it to include real-world activities. For example, you've called in sick to work, but records of your activity suggest that you were actually at a job interview / romantic liaison / midget convention over on the other side of town.

Re:At least one fact about them could be used

[mdf356]

I can't think of anything I've done online (even my shemale midget fetish on youpron) that could be used to blackmail me

Same here. However, the next bit of text is more relevant:

discriminate against, harass, or steal the identity of him or her. I mean more than mere embarrassment or inconvenience; I mean legally cognizable harm.

There's almost certainly something that can be used to discriminate against you, harass you, or steal your identity, causing legally cognizable harm. Blackmail is just for the people ashamed of what they do; the rest affects everyone.

Re:At least one fact about them could be used

[mbone]

Or, maybe, Bob, the evil co-worker, threatens to tell my wife and boss that I am a Nigerian prince who has obtained $ 1 billion USD in oil money that needs a US bank account to be successfully deposited...

(Unfortunately, I know that there is a fair amount of spam sent in my name. I get the backscatter from it.)

Re:At least one fact about them could be used

[interkin3tic]

Really that sounds like a good investment. You could use my bank account for a small fee. I don't have my account number handy, just look it up in the anonymized data~!

Re:At least one fact about them could be used

[Anonymous Coward]

If you give me six lines written by the hand of the most honest of men, I will find something in them which will hang him.
-- Cardinal Richlieu

Bah, humbug.

[jdgeorge]

Forget anonymity. I'm better off living in a glass house, so it's easier for me to know when I need to yell "Get off my lawn!"

Re:Bah, humbug.

[robinesque]

Just don't throw any bricks?

Re:Bah, humbug.

[Anonymous Coward]

Besides: It's easy to get them to look away. Just undress and start jacking off including all your kinks! :P

Re:Bah, humbug.

[Stanislav_J]

Forget anonymity. I'm better off living in a glass house, so it's easier for me to know when I need to yell "Get off my lawn!"

That's what they make electric fences for. A far better deterrent, and you don't get hoarse yelling at the little bastards...

Let's see

[ceoyoyo]

"Ohm terms a central reality of data collection: 'Data can either be useful or perfectly anonymous but never both.'"

Okay, I just got finished anonymizing some data. What's going out is ID (incremented, starting at 1), total voxels, voxels increasing and voxels decreasing. The people who are getting the data think it is highly useful. According to Ohm's "law" that means it is not anonymous.

Unless someone (including Ohm) pipes up with a plausible means for identifying the original subjects, I call BS on Ohm's "law."

Re:Let's see

[RetroGeek]

Unless someone (including Ohm) pipes up with a plausible means for identifying the original subjects, I call BS on Ohm's "law."

Is EVERYTHING anonymized? Did you leave in real eye colour, hair colour, height, sex and so on? Did you anonymize city names? States?

Enough correlation and you can start matching to real people. I did some similar work, including free form entry fields. For a name of "Prince" which was anonymized to, say, "NAME001" and "Albert" to NAME002", the city name "Prince Albert" became "NAME001 NAME002". A little reading around the free form text and you could equate NAME001 to Prince, then go back through the name column and make the changes. I had to put in an exception list for common phrases (slow as hell).

Any sort of real analysis of information must include real world information. You cannot hide everything. And once you have real information you can start correlation. Do this across enough data and you can find real people and suddenly you know that Joe Blow has cancer and you can reject him for health insurance.

This is not new.

Re:Let's see

[ceoyoyo]

There ISN'T any data but what I mentioned. No eye colours, height, sex, city names, states. Nothing but what I said.

Anonymization is quite possible, and the data is still very useful. Perhaps not useful for datamining but that's about it.

Sure, if you want a dataset that you can mine for things you don't know you want yet, anonymization is going to be tricky. Otherwise, no problem.

Re:Let's see

[Ironica]

There ISN'T any data but what I mentioned. No eye colours, height, sex, city names, states. Nothing but what I said.

And it totally depends on what you're looking at. For example, in disease research, age is a pretty important statistic. You want to be able to compare ages pretty exactly; it may be important that one person is a month older or younger than another. So, you need not just birthdays, but birthdates.

Geographical information is pretty important, too, to look at the effects of pollution, power plants, fires, etc. ZIP code is a good enough proxy for this. Of course, you *could* just work up a profile of each ZIP code on all the variables you expect to be important... but (1) you may not know what to look for until you know where to look for it; and (2) what are the chances that you wouldn't be able to figure out the ZIP code from that profile?

Gender, of course, is VERY important. You don't want your data on ovarian cancer rates thrown off by testicles, for example.

So, it may be impossible to do certain kinds of research without the data mentioned specifically in the article. ALL of it. That is a real issue.

anonymization is bullshit

[Anonymous Coward]

Even if the data is completely and unreversably anonymized, it is still invasive. Look at the story yesterday about the marketers data-mining kids' online private conversations for consumer gadget preferences. Even if there's no way from that data to infer the preferences of any particular kid, they should still be able to talk to each other without having their conversation be part of a marketing survey.

Think also of a cafe that sells two kinds of food: apple pie (eaten by freedom-loving patriots), and felafel (eaten by terrorists and their supporters and sympathizers). Of course it would be invasive for the cafe to disclose which of its customers ordered which kind of food. But even releasing aggragate statistics is bad. An increase in felafel sales can led to a bullshit fbi investigation even if individual customers aren't identified.

People sitting on private data constantly search for self-searching justifications to disclose as much as they can without getting clobbered by the sources of the data. It is bullshit. Private should mean no disclosure, not anonymized disclosure, not aggregate disclosure, just plain no disclosure period.

Re:anonymization is bullshit

[blahplusplus]

"Private should mean no disclosure, not anonymized disclosure, not aggregate disclosure, just plain no disclosure period."

The profit motive and privacy are at odds, trying to make the most money and sell the most stuff means you want to know everything about everyone so that you can one up you competitors, it's a race to the bottom. Ideals in the real world always submit to the pragmatic concerns of making money in a capitalist society.

Re:anonymization is bullshit

[Anonymous Coward]

It is a GOOD thing if people have a better understanding of people as a whole. And that is all aggregate stats give you (assuming they're done right of course).

Your real complaint is with FBI profiling large groups of people based on aggregate data. They're going to do that anyway, they're going to use their own data for it not the stuff you're complaining about, and even if you could force them to have worse data, it helps nobody. That would just turn their mostly worthless crackdowns into totally worthless crackdowns without addressing any of the underlying problems.

PS: Won't somebody think of the kids? I'm shocked, shocked to find out retail companies are trying to understand their young customers better. Eeeeeeevil.

Re:anonymization is bullshit

[causality]

"Private should mean no disclosure, not anonymized disclosure, not aggregate disclosure, just plain no disclosure period."

The profit motive and privacy are at odds, trying to make the most money and sell the most stuff means you want to know everything about everyone so that you can one up you competitors, it's a race to the bottom. Ideals in the real world always submit to the pragmatic concerns of making money in a capitalist society.

Is all of that really so much easier than attracting customers by having the best product at the best price point? The way I see it, if we pass strong pro-privacy laws that take such data-mining off the table entirely, and companies are instead forced to, y'know, actually be competitive, it would be to everyone's benefit. I know I'd much rather buy a product or a service because it's one of the best available, instead of buying a product/service because some clever scheme convinced me to do so.

Re:anonymization is bullshit

[blahplusplus]

"Is all of that really so much easier than attracting customers by having the best product at the best price point?"

The problem is customers are stupid and undiscriminating twits, who will say one thing but do another. There's a difference between what someone thinks they want or says they want and what they actually end up doing. Kind of like how most people believe they are above average intelligence. I agree that to some extent a great product at a great price will sell but it's not always the case. Take the x86 cpu's for instance, there are certain products that are "black boxes" to end users and end users only care about the software, the best hardware in teh world is irrelevant to most people without great software be it entertainment or otherwise they want to use.

This is why console companies can sell crappy hardware and push the software envelope. The PS2 was totally inferior platform for games and it ended winning the console race because 'it was good enough' and thats where developers focused their energies when making games. If developers had abandoned the PS2 for the cube or xbox, the PS2 would have died but the PS1 took advantage of Nintendo's big mistake with the n64 and the limited cartridge based storage and it's clock cleaned.

MP3 players are a case in point, there were better players with more functionality and whatnot but most people are simple minded twits and things like style or image (ipod) can win out over substance. ipod was "good enough", there is a point where people will buy whatever is good enough, but this also has a tendency for companies to target or exploit this averageness or mediocrity, and this is why many products tend towards mediocrity as a whole (see: films like trasnformers 2).

Also see this article on the "good enough" revolution:

http://www.wired.com/gadgets/miscellaneous/magazine/17-09/ff_goodenough

It has a point in that targeting peoples price points for simple to use mediocre products (like video cameras for making home movies, etc). But this goes to prove the adage - profit gives way to medicority, things like planned obselescene, trying to find cheaper (less longer lasting) components for things reducing their durability and whatnot.

"The way I see it, if we pass strong pro-privacy laws that take such data-mining off the table entirely, and companies are instead forced to, y'know, actually be competitive,"

Laws are irrelevant against insiders with lots of money, if you are well off go check out private investigators and see what kind of shit they can find on you despite so called "privacy laws". There are guys that can come up with shit that will surprise the living fuck out of you.

Knowledge about people is a commodity like any other, privacy laws cannot stop the end of privacy since to exist in the world one can deduce your actions through economic transactions and computer camera tracking (i.e. whenever you walk into a store your habits aren't just being taped for anti theft measures, this shit is studied for how to best exploit subconscious processes or flaws in human minds to get them to buy stuff).

Companies with enough cash and political currency basically get to do whatever they damn well please, those that can't get away with it are those without sufficient financial or political currency.

Remeber "Mother Earth" and the Espionage Act

[RevWaldo]

If you ever wonder why people view the privacy of your records in the hand of third parties is important, and don't just hop on the "privacy is dead" bandwagon, this is the sort of scenario they have in mind.

http://en.wikipedia.org/wiki/Mother_Earth_(magazine)

Mother Earth was an anarchist journal that described itself as "A Monthly Magazine Devoted to Social Science and Literature," edited by Emma Goldman. Alexander Berkman, another well-known anarchist, was the magazine's editor from 1907 to 1915. It published longer articles on a variety of anarchist topics including the labor movement, education, literature and the arts, state and government control, and women's emancipation, sexual freedom, and was an early supporter of birth control. Its subscribers and supporters formed a virtual "who's who" of the radical left in America in the years prior to 1920.

In 1917, Mother Earth began to openly call for opposition to American entry into World War I and specifically to disobey government laws on conscription and registration for the military draft. On June 15, 1917, Congress passed the Espionage Act. The law set punishments for acts of interference in foreign policy and espionage. The Act authorized stiff fines and prison terms of up to 20 years for anyone who obstructed the military draft or encouraged "disloyalty" against the U.S. government. After Emma Goldman and Alexander Berkman continued to advocate against conscription, Goldman's offices at Mother Earth were thoroughly searched, and volumes of files and detailed subscription lists from Mother Earth, along with Berkman's journal The Blast, were seized. As a Justice Department news release reported:

"A wagon load of anarchist records and propaganda material was seized, and included in the lot is what is believed to be a complete registry of anarchy's friends in the United States. A splendidly kept card index was found, which the Federal agents believe will greatly simplify their task of identifying persons mentioned in the various record books and papers. The subscription lists of Mother Earth and The Blast, which contain 10,000 names, were also seized."

Mother Earth remained in monthly circulation until August 1917.[1] Berkman and Goldman were found guilty of violating the Espionage Act, (imprisoned for two years) and were later deported.

Re:Remeber "Mother Earth" and the Espionage Act

[Archangel Michael]

anarchist topics including the labor movement

Labor organization is not Anarchism.

Most Anarchists aren't really Anarchists, they just oppose the current form of governance and want to replace it with something else.

20500

[jDeepbeep]

Any particular reason you chose District of Columbia?

Re:20500

[natehoy]

Because everyone knows that EVERYONE in DC lies.

Re:20500

[BassMan449]

Good thing I don't have mod points. I would have a very hard time deciding if that should be modded Funny or Insightful

Re:20500

[Sponge Bath]

That sounds like a setup for a joke:
Bill Clinton, Marion Barry, and Scooter Libby walk into a bar...

Re:20500

[SatanicPuppy]

The White House
1600 Pennsylvania Avenue NW
Washington, DC 20500 ;)

Just three bits?

[Anonymous Coward]

I understand that one bit alone will do to specify the sex but, how does one specify ZIP code with just one bit? One bit will tell you whether or no somebody has a ZIP code but, in order to specify a ZIP code completely we need - what, 16 bits?

Re:Just three bits?

[Anonymous Coward]

You are being too literal.

When someone says: "Let me give you a bit of advice." they don't continue by saying: "One" or "Zero", they give you advice.

In this case bit is being used to describe individual datum, {Zipcode, sex, birthdate}

Damnit, I fed the troll...sigh.

Re:Just three bits?

[Anonymous Coward]

Oh, come on, you need at least three bit for sex alone - Male, Female, Both, Neither, Other, Unknown, Unspecified and File Not Found.

This parallels encryption

[DontLickJesus]

All persons whom understand encryption also understand that there is no such thing as perfect encryption. Anonymizing(sp?) data works using roughly the same methods as encryption, and there is no such thing as an unbreakable encryption. We can only hope for "acceptable". I'd assume the most acceptable means of anonymizing data would be to allow the user to first choose what gets scrubbed out, followed by a sort of data "blacklist" compiled by experts. The real problem here is that companies selling this data have a vested interest in never getting it quite right.

Re:This parallels encryption

[ichimunki]

http://en.wikipedia.org/wiki/Who

http://en.wikipedia.org/wiki/One_time_pad

Three things? Really?

[Applekid]

So, despite the Birthday Paradox, they can still identify 87% of Americans? For some reason I'm under the impression that there are a lot more zip codes with more than 366 people (heck, even 1000 to call upon 3 or 4 duplicates that should cover gender differences) than there are zip codes under that amount.

Re:Three things? Really?

[Daniel_Staal]

That Paradox ignores the year. Add that in and it starts to become harder.

Re:Three things? Really?

[clone53421]

Your birthdate includes the year. Your birthday does not (at least for this discussion).

The party trick of finding two people with the same birthday (a good probability in any group of 30 people or more) doesn't require them to have the same year of birth (although in most gatherings there's a good chance of this as well since often it's already somewhat segregated by age).

Re:Three things? Really?

[bdleonard]

A birthdate and a birthday are not the same thing...

Re:Three things? Really?

[OrigamiMarie]

Perhaps they meant zip + 4. Which gets you down to very few households, but most people can't rattle off their zip + 4, so this information wouldn't actually apply to the questions posed by cashiers. On the other hand, I have heard that data mining on web-surfing habits can usually pick up your zip + 4, so yeah, it would be pretty trivial to put that together with birth date (which is asked for a various places to determine that you're of-age -- though of course you can lie) and sex, which can probably be guessed at even if you don't click one of the radio buttons.

Re:Three things? Really?

[ArsonSmith]

Date of Birth != Annual Birthday

one being month/day/year the other being just month/day.

Re:Three things? Really?

[Actually, I do RTFA]

So, despite the Birthday Paradox, they can still identify 87% of Americans? For some reason I'm under the impression that there are a lot more zip codes with more than 366 people (heck, even 1000 to call upon 3 or 4 duplicates that should cover gender differences) than there are zip codes under that amount.

Well, as other people have pointed out, adding the year limits the number of collisions. So factor in year and maybe you need 80x the people to get the same obscurity. And you said 366 people. That enough to ensure that at least one birthday (not date) coincides (apparently ignoring Feb 29th). If that was true, and there was exactly one collision, than 364/366 of them could be uniquely identified by birthdate and zip code.

If you do the math on birthdates (assuming that every date over the last 80 years is equally likely), you end up with 29,219 people being necessary to get below the 87% threshold. Double that (again, rough maths) to account for two genders and you get 58,438. There are ~300 Million people in the US, so you would need to have at least 5,134 zip codes to divide people into these is small enough chunks. There are over 40,000 zip codes in the US. So it seems quite reasonable to assume that level of specificity once you take into account the oversimplifications I made in the back of the envelope math.

Re:Three things? Really?

[Mr. Slippery]

So, despite the Birthday Paradox, they can still identify 87% of Americans?

Birthdate. There might be 50 or 100 men and boys with birthday January 12 in zip code 21228, but how many of them were born in 19xx?

Re:Three things? Really?

[14erCleaner]

There are, more or less, 100 people per birthday per zip code in the US (300 million people, a bit less than 100 thousand zip codes), so sex+birthday+zip would identify 50 people, on average. Odds are good that they have a few year collision, but most would be in separate years. 87% sounds about right. The real question is: who cares? How often will somebody have those identifiers tagged to a single person's data?

Re:Three things? Really?

[Anonymous Coward]

How often will somebody have those identifiers tagged to a single person's data?

Try signing up for just about anything. Most places ask for all three of those identifiers. Most people (not anonymous coward) accurately answer all three.

Re:Three things? Really?

[Ironica]

The real question is: who cares? How often will somebody have those identifiers tagged to a single person's data?

Try doing research on disease, like cancer rates. You need to look at age cohorts, and when you're trying to determine statistical significance, you do need to know if two people are a day apart in age, a month apart, a year apart, etc. You need gender, since many cancers (and other diseases) are specific to or far more prevalent among one gender. And ZIP code lets you take geography into account; aside from just urban/rural, east coast/west coast, if you find spikes in certain ZIP ranges, you can look at what they're near... like airports, power plants, gravel mines, etc.

Couple of things..

[hansraj]

Potential nitpick, but here goes.

The summary (not surprisingly for a /. summary) omits a couple of details that give the reader a rather partial picture.

For one, Paul Ohm is an Assistant Professor of law, and although the summary makes it sounds like the linked article would be from a technical perspective, (mostly) it is not.

A quote like:

"Data can either be useful or perfectly anonymous but never both."

needs a bit of background about the qualification of the person making that claim. Why? Simply because it sounds like a rather technical remark. If some computer science researcher made this claim, I would tend to take it more on the face value, otherwise I would take it with a grain of salt.

Now obviously this statement was not meant to be taken quite literally because the notion of "useful" is not precise. I can get reasonably useful information like "most of the people in my country like to buy branded stuff" or "most people who rent videos of actor X regularly, also rent the videos of actor Y regularly" without needing the underlying data to contain *any* personally identifiable information. The fact that extra data is store is a different thing.

I personally believe that instead of claiming that some researcher has argued X, it can be more informative to actually say what kind of researcher it is who made a claim. Not because only researchers in a certain area can be trusted, but because a little bit of background puts the claims in right perspective.

Re:Couple of things..

[Anonymous Coward]

I can get reasonably useful information like "most of the people in my country like to buy branded stuff" or "most people who rent videos of actor X regularly, also rent the videos of actor Y regularly" without needing the underlying data to contain *any* personally identifiable information.

I bet that knowing the top-10 actors of each person will uniquely identify each and every person in US.

Re:Couple of things..

[Anonymous Coward]

Hansraj,

Sure the claim was an overstatement. But a useful takeway, at least for me, was that the data that companies often claim has been anonymized, has not been sufficiently anonymized and the risk from the publishing of such data is needs to be unmasked as a public service.

It doesn't matter to me if the the person making the statement is a college drop out, a carpet seller, or a politician. The statement / thought / insight is valuable on its own merit, or not.

While I prefer statements be dispassionate, accurate, clear, and euphonious, but if they require a little work to extract the value out of them, that's ok too. It will have been worth the effort.
   

Re:Couple of things..

[ImprovOmega]

I bet that knowing the top-10 actors of each person will uniquely identify each and every person in US.

That's an interesting statement. If ranking matters then you need a very small pool of actors/actresses to be sufficient to uniquely address 300 million people with a top 10 list (google calculator helpfully informs me that a pool of 13 celebrities will be sufficient to do so). However if ranking is ignored (and admittedly I think you'll find collisions even with a ranked system) you'll need...hmm... 37 choose 10 = 348,330,136 So a minimum pool of 37 celebrities. I believe we can safely say that there are more than that in the world. However I think that you're going to find heavy collisions even when ranked though. Teenage girls are likely to list the same boys over and over in their lists (most especially when geographically concentrated and in the same peer group), and sports fans are likely to list local sports heroes on their own. Still interesting from a mathematical perspective, even if just in theory.

Re:Couple of things..

[baboonlogic]

A quote like:

"Data can either be useful or perfectly anonymous but never both."

needs a bit of background about the qualification of the person making that claim. Why? Simply because it sounds like a rather technical remark. If some computer science researcher made this claim, I would tend to take it more on the face value, otherwise I would take it with a grain of salt.

Paul Ohm has degrees in CS and EE. Quoting his rather impressive CV[pdf]:

Yale University, B.S., Computer Science, B.A., Electrical Engineering, 1994

Paul is also a hobbyist Perl hacker. IMHO, this paper is a great example of people in the law community understanding what is going on. We need more people in law who understand tech.

Err..

[Kokuyo]

English is not my first language, so I probably didn't catch the whole meaning, but...

The idea was that everyone can be identified with only the birth date, gender and ZIP code? So... err... There is, in fact, not even one ZIP code that has two people living there of the same gender that happen to share a birthday? Sure, to have the year coincide would take a bit more than just the date itself but it's hard for me to imagine that this could be true.

So... what did I miss?

Re:Err..

[Anonymous Coward]

When I lived in Atlanta, there was a person who shared my gender, birthday, first and last name, and our middle initial was the same. Our zip code was different, but I could have moved into his!

Re:Err..

[Anonymous Coward]

That's a good point. Doing rough calculations, 2 (genders) * 120 (Maximum lifespan - I said it was rough) * 366 (maximum days in a year) = 87840 That means, thanks to our good old friend the Pigeonhole Principle, any zip code containing 87841 people is guaranteed a collision. And, generally speaking, the collision rate is going to be much higher (there aren't all that many 120 year olds walking around). I don't see how this 87% figure was arrived at, but I'm fairly certain it was fabricated.

Re:Err..

[clone53421]

You missed the 87% figure. For 13%, this data is insufficient. (6.5% will share their birthdate, zip, and gender with another 6.5%)

365*2 = 730 children per day per zip code could be uniquely identified using this information. If I understand this correctly, it implies that 730 / 93.5% = about 781 babies born per day per zip code (on a national average).

Re:Err..

[snspdaarf]

English is not my first language, so I probably didn't catch the whole meaning, but...

The idea was that everyone can be identified with only the birth date, gender and ZIP code? So... err... There is, in fact, not even one ZIP code that has two people living there of the same gender that happen to share a birthday? Sure, to have the year coincide would take a bit more than just the date itself but it's hard for me to imagine that this could be true.

So... what did I miss?

It takes more than just these three items. What was meant was that if you take these three items, and run them against a database of known items, you end up knowing more from the combination than from the two separately. In this case, if you have a database with redacted information, and a second, non related, database that happens to have the redacted elements from the first, by selecting a good set of common keys to run a union of the two, you can "un-redact" the missing information. Nothing new here. The point is that confidential information is that way for a reason, and should not be released at any level of sanitization.

Re:Err..

[ArsonSmith]

perhaps the 87% part?

Re:Err..

[Actually, I do RTFA]

The idea was that everyone can be identified with only the birth date, gender and ZIP code? So... err... There is, in fact, not even one ZIP code that has two people living there of the same gender that happen to share a birthday? Sure, to have the year coincide would take a bit more than just the date itself but it's hard for me to imagine that this could be true.

Well, there is some collision, 13% of the people have one. But 87% don't. You pass the 87% likelihood that there will be at least one pair (assuming equal birthdates over the last 80 years and equal gender ratios) at 58,438 people in a zip code. Since there are ~300,000,000 people in the US, this would require 5,134 zip codes (if people were distributed evenly). There are over 40,000 zip codes, so even taking into account underpopulated zip codes, that seems pretty reasonable to me.

Re:Err..

[Actually, I do RTFA]

Sorry to respond to myself... but "You pass the 87% likelihood that there will be at least one pair (assuming equal birthdates over the last 80 years and equal gender ratios) at 58,438 people in a zip code." is a mistake.

SHould be: You pass the 87% likelihood that there will be at most one pair (assuming equal birthdates over the last 80 years and equal gender ratios) at 58,438 people in a zip code.

Re:Err..

[Caetel]

Nothing. Apparently it is that uncommon to share a ZIP code with someone of the same gender who has the same date of birth

Re:Err..

[dmartin]

You missed that these three pieces of information only identify 87% of Americans:

"...in 2000, [researcher Latanya Sweeney] showed that 87 percent of all Americans could be uniquely identified using only three bits of information: ZIP code, birthdate, and sex."

For the other 13% there are the sorts of collisions you mentioned

Re:Err..

[Ironica]

The idea was that everyone can be identified with only the birth date, gender and ZIP code? So... err... There is, in fact, not even one ZIP code that has two people living there of the same gender that happen to share a birthday?

Aside from the 87% part that others have pointed out, there may be some linguistic confusion about birthdate and birthday. A birthday is just month and day. A birthdate is month, day, and year... which dramatically increases the keyspace.

Anonymous can be useful..

[EasyTarget]

Data can either be useful or perfectly anonymous but never both

What a load of bolaks....

Supposing you have a list of -just- birth dates for every citizen at the census. You -only- have only been given one piece of data per person, the date, nothing more. Just a huge list of dates, sorted chronologically.
1) The data has been totally anonymised.
2) You can do all kinds of meaningful analysis on the age demographics of the population. And make policy decisions based on that.

Fully anonymous data producing useful results.

Re:Anonymous can be useful..

[Abcd1234]

Well, I think what your example demonstrates is that *application-specific* anonymization and, in your case, aggregation, can produce data that's both useful and actually anonymous. But I happen to agree with the article that, in the *general* case, it's impossible to take data and anonymize it in a way that retains it's usefulness across a large domain of potential applications while simultaneously protecting the anonymity of those in the database.

'course, when you think about it, that's common sense: To anonymize data effectively, as this article points out, you can't just throw in new identifiers, as enough detail correlated together is enough to identify individuals. Instead, if you really want to anonymize data, you have to throw out some of those details, so that the correlations are no longer possible. But if you do that, you lose information, which limits usefulness.

So, what you really need is the ability for an outside individual to submit a request to a database to obtain some cross-section of aggregated/anonymized data that's useful to them specifically, but isn't sufficiently detailed to allow individual identification. 'course, how you determine a given query is "too detailed", I don't know...

Re:Anonymous can be useful..

[Anonymous Coward]

In the example you gave the data is not *perfectly* anonymous. For example, suppose that I knew the birthday of everybody in the census except for person i. Given the list of dates, I *could* recover your DOB so the list may not be *perfectly* anonymous.

However, I still agree with you that you can do lots of use analysis on anonymous data. You just have to define your notion of anonymity. The notion of k-anonymity, proposed by Sweeney, allows you to blend in with "k-1" other people.

My favorite definition of anonymity is a concept called Differential Privacy. Basically, the idea is that anything I could learn about you from the data set D, I could learn even if your records are not contained in D. For example, the mean age of the worlds population is close to being Differentially Private because the answer doesn't really change if I leave your age out of the average.

Re:Anonymous can be useful..

[Anonymous Coward]

Yes, but suppose you gave the census to one elementary school classroom full of students and their teacher. You could identify the teacher's birthdate from the data.

Re:Anonymous can be useful..

[Anonymous Coward]

Strictly speaking, the data in your example is not fully anonymous, since from the data one can still find bounds for an individual's age, for example.

However, I agree with you that this is a load of bolaks, because data will in practice never be perfectly anonymous.

Re:Anonymous can be useful..

[Anonymous Coward]

Here is one potential measure:

Notation: Lets think of a database as a table and name our database D, now let D[i] denote each row in the table. Let D'[i]:=D-D[i] be the database D minus row i. Finally lets denote a query (Q) of the database D by Q(D).

Clearly, Q(D'[i]) cannot reveal any information about the individual row i in D. Consider the distribution over a random choice of i of the query Q(D'[i]). If the distribution has "low" variance then we are probably not giving away much information about any individual row. This is very informal (cough, incorrect) but the intuition (similar to the intuition behind cryptographic techniques such as zero-knowledge proofs) can be used to formalize the notion of Differential Privacy.

Re:Anonymous can be useful..

[Ironica]

2) You can do all kinds of meaningful analysis on the age demographics of the population. And make policy decisions based on that.

Fully anonymous data producing useful results.

What kind of useful age demographics analysis can you do on the population with only that piece of data? You might use it to allocate Medicare spending, but it would work much better if you had income and health insurance information along with it, since not everyone over X age is dependent on Medicare. You might use it to allocate money to elementary schools, except those are in fixed locations, and you don't even know which STATE the children are in; the percentage of the population who is school age varies dramatically from one location to another. If you had the data from two points in time, you could make inferences about lifespan, birth rates, and health, but you don't; you just have ONE data point for everyone. You can't use it to allocate resources towards maternal/child health, because you don't know how many of those people in their childbearing years are women.

Seriously, give me ONE decent use for a distribution of ages without a single other piece of information. I really can't think of one that wouldn't have any good analyst cringing at the lack of control.

Perfectly?

[peterwayner]

This is much too extreme. There are many good examples of useful data that is for almost all intents and purposes anonymous. Consider the example of anonymous lending libraries from my book, Translucent Databases.

The simplest version just pushes the book title through a one-way function. The more complex version also hides the name in a similar way.

Can the anonymity be stripped away? There are coincidences and connections as Sweeney's examples and the Netflix examples show, but they can be fought by adding some salt/nonce to the one-way function. We can also add passwords.

There are so many different ways to add bits of complexity to the results that there are many tradeoffs we can make between effective privacy and the complexity of using the systems. I think it's good to keep the weaknesses in mind, but I think it's more of a feasible engineering problem than something that should be dismissed out of hand. (The law review piece is also worth reading in its entirety because it's more concerned with the legal issues created by the existence of privacy-enhanced databases. It would be simpler for some issues if they didn't exist and so it helps to argue seriously.)

Levels of anonymity?

[Burning1]

Data can either be useful or perfectly anonymous but never both

I'm not sure I entirely agree with this statement. While it's tecnically correct, I believe it's misleading...

It's perfectly possible to hash personally identifiable information into an MD5 sum, to ensure that your records are unique, and then to generate useful statistics based on the resulting aggregate data without releasing significant personal information.

For instance:

Key = Hash(Your name + Your Zip + Your Birthday)
Zipcode
Birth Decade
Hobbies
Household income (Averaged to the nearest $20K increment.)

This information is significantly anonymous, and still highly valuable market research. If you happen to submit your information twice, it will be caught by the unique hash.

Of course, the author describes 'perfect' anonymity. It's technically possible that you're the only person in your zip who is between the ages of 21 - 30, enjoys playing video games, and makes $60K-$80K a year... However, it's generalized enough to provide a great deal of plausible deniability.

The same basic statement about anonymity could be made for a person standing in a crowd: given enough detail, you could identify that person by their appearance, without knowing any unique identifying information about them.

What should you get from this? You aren't as anonymous online as you might expect. Who's really surprised?

Re:Levels of anonymity?

[Mprx]

That hash is too easily reversible. Brute force search in order of name popularity.

Re:Levels of anonymity?

[snspdaarf]

Right, but not on target. The issue is that if databases include enough data, and seemingly trivial data at that, by selecting good common elements and good databases to generate union result sets, I can show that it really was you at the Game Store that bought Bitchslap III, Nun Terror At The Vatican for PS3 at 7:30 PM last Tuesday, and you were not at the bar watching football like you claim.

Re:Levels of anonymity?

[Abcd1234]

Yeah, but the whole point is, given a zip code, birth date, household income, and hobbies, I can probably figure out who you are.

Fundamentally, the issue is very simple: Given some sort of identifier, and a series of properties about that identifier, if you have enough dimensions of detail, you end up narrowing down your sample so much that you end up with a population of one, that being the person the identifier "hides". It's just that simple.

The only way to prevent this is to generate crosscuts of data where you eliminate those correlations. ie, given an identifier, you only provide a limited set of dimensions which, by themselves, aren't enough to get down to a single person. But, of course, that process destroys information.

Re:Levels of anonymity?

[Burning1]

Fundamentally, the issue is very simple: Given some sort of identifier, and a series of properties about that identifier, if you have enough dimensions of detail, you end up narrowing down your sample so much that you end up with a population of one, that being the person the identifier "hides". It's just that simple.

We go through the same basic process to find information through a search engine -- we attempt to find ways to narrow down the data in such a way that the information we are looking for exist within a sufficiently limited set.

I'm sure we both have experience searching for relatively generic information, where the number of possible matches unrelated to our target is so great that the information is effectively unavailable. Anonymization is the same basic principle - genericize the data to the point that it is useful in aggregate, but valueless for targeting individual users, based on a preponderance of possible matches.

Re:Levels of anonymity?

[Burning1]

At what point is it cheaper and more effective to hire a PI to follow me around and root through my garbage?

Re:Levels of anonymity?

[Abcd1234]

Anonymization is the same basic principle - genericize the data to the point that it is useful in aggregate, but valueless for targeting individual users, based on a preponderance of possible matches.

Good luck with that. Unlike a fuzzy search where you're performing textual matches to infer properties of a document, the whole point of a database is to provide concrete properties about entities. And if you can concretely say entity X has properties 1 through 99, then odds are good you can use that information to gain a very good idea of who entity X actually is. And if you perform some transformation such that you can no longer say entity X has properties 1 through 99 so that you can hide the identity of the individual X corresponds with, then you've destroyed information during your transformation, and as such, made the data less useful in order to anonymize it effectively. Which is, of course, the entire point of the article.

Re:Levels of anonymity?

[Ironica]

There are a lot of people in my ZIP born in the 1970s. There are probably very few that would list my hobbies, which you can cross-reference in other places. Don't forget you need gender too, in order to do useful market research... that will keep people from confusing me with my husband. Still, even being able to narrow down to a household compromises privacy.

Anonymous != De-identified

[Anonymous Coward]

I think the article should differentiate between an 'anonymous' dataset and one that is 'de-identified.' Anonymous as defined in the article is not the same thing as de-identified as defined by HIPAA. If a dataset is de-identified, you cannot include date of birth (except year), date of visit/service (except year), or anything more than the first three digits of the zip code (there's 15 other identifiers that aren't allowed, either).

The attack described in the article wouldn't work if the dataset were de-identified, or at the very least, would have been a lot more difficult.

nonsense

[junglebeast]

" 87 percent of all Americans could be uniquely identified using only three bits of information: ZIP code, birthdate, and sex." I'll be generous and overlook the gross misuse of the term "bits" in this context and pretend that the author wrote "tidbits" instead. That said, I do not for a second believe that 87 percent of Americans were the only person of the same gender born in their particular zip code on the same day. That's just ludicrous. Now if "birthday" is actually referring to a more specific point in time, such as the exact second of birth, then sure...but that's not really common knowledge.

Re:nonsense

[nedlohs]

It isn't a computer science article.

"Bits" is being used perfectly correctly for English, given the "a small piece or quantity of anything" definition my dictionary has.

Re:nonsense

[harlows_monkeys]

There are around 11000 births in the US each day, so yes, on average, there is less than 1 birth per zip code per day per gender. The 87 percent figure is quite believable.

Another way to look at it: it takes about 15 bits to encode a zip code, and about 16 bits to encode a birthdate, and 1 bit to encode gender. We are distributing 300 million people into 4 billion bins. The distribution is not uniform, but it is certainly plausible that a lot of people will have their bin all to themselves.

Uniquely ID 87% of 300 million Americans?

[SPickett]

"in 2000, [researcher Latanya Sweeney] showed that 87 percent of all Americans could be uniquely identified using only three bits of information: ZIP code, birthdate, and sex"

That doesn't seem right. IIRC, there are somewhere around 60,000 zipcodes. (Obviously there are under 100000.) If the population is 300 million, that's an average of about 5000 people per zipcode. Male/female splits it in half, so you have 2500 birthdates to distribute uniquely over 365 days.

Looked at another way, 365 days *times* 2 sexes *times* 60000 zipcodes totals less than 44 million. How do you uniquely ID 300 million people?

Add the problem that many people could have given you either their work or home zipcode. How does she do that?

Re:Uniquely ID 87% of 300 million Americans?

[SPickett]

Whoops. Birthdate (not birthday). Never mind.

Re:Uniquely ID 87% of 300 million Americans?

[CheddarHead]

There may be only 365 possible birthdays, but birth *date* normally include the year of birth as well as the day.

Re:Uniquely ID 87% of 300 million Americans?

[nedlohs]

Everyone was not born in the same year...

You have about 30,000 birth dates (that's about 80 years, so it's even bigger since people live longer than that often enough), 60,000 zip codes, and 2 sexes. So 3,600,000,000 combinations, 12 times the number of people.

Of course given demographics (see the baby boomers...) there's not exactly a good distribution of those birth dates. Far fewer living people were born on 1/1/1910 than on 1/1/1970.

Some perspective please.

[mosb1000]

How is this any different than articles about rockets and space travel (after all, most of us will never travel into space, or work for NASA)? Or any other in a myriad of technical subjects that most of us are not, and will not be directly involved in or use directly.

People are curious. They are curious about everything. It's an exercise in futility to pick and chose useful information over non-useful information since none of us knows what tomorrow holds. If someone want's to read celebratory gossip more power to them. In truth, the gossip is more likely to be both true and useful than news about an new process that may produce titanium at half the cost or an article about NASA's next big toy. We on slashdot find the technical news more interesting, normal people who are interested in interpersonal relationships find the gossip more interesting. It's two sides of the same coin.

Re:Some perspective please.

[Vardamir]

A more apt comparison would be between Obama's (or some other politician) personal life and that of an actress. Now, some would argue that we still have no business in thinking about our leaders' personal lives, but I'll neglect this point. Also, I can hardly speculate whether the average politician is better than the average actor... either way, slim pickins.

At least political figures do have more of a direct effect on society, as will space exploration at some point if it continues to progress. The same is not true for actors outside of the movies - I just want good movies, and maybe the occasional biography or wikipedia entry about the actor will suffice. To sensationalize everything they do is a bit ridiculous. On the other hand, a leader who we can confirm as being hypocritical (which is usually the case) should be much more relevant to our interests ...

Re:Some perspective please.

[mosb1000]

I would say that the average actor has as much influence on us as the average politician. Perhaps more so. Both are only capable of saying words, which then may or may not cause listeners to take action. People are more willing to listen to words spoken by actors than politicians, and the people who write the words for the actors generally do a better job of making their point. On the other hand, millions of people across the world have sworn to give their lives and take the lives of others to defend and carry out the words spoken by politicians. I think it's a wash.

Re:Some perspective please.

[causality]

How is this any different than articles about rockets and space travel (after all, most of us will never travel into space, or work for NASA)? Or any other in a myriad of technical subjects that most of us are not, and will not be directly involved in or use directly.

That's not really a valid question and I'll explain why. The difference is that rockets and space travel are about the actual technology. If the entertainment industry operated that way, then all of the discussion would be about photography/camera work, lighting, audio recording, film editing, and other such techniques. That information is useful to anyone who wonders how these things are done, or who wants to do such things themselves. That's why your question is like comparing an apple to an orange.

For a real comparison you would have to ask why we don't have paparazzi following scientists around and invading their privacy and digging up dirt on them for public consumption. You'd have to ask why we talk about Firefox the browser and its features instead of the personal lives of the programmers who created it.

People are curious. They are curious about everything. It's an exercise in futility to pick and chose useful information over non-useful information since none of us knows what tomorrow holds. If someone want's to read celebratory gossip more power to them. In truth, the gossip is more likely to be both true and useful than news about an new process that may produce titanium at half the cost or an article about NASA's next big toy. We on slashdot find the technical news more interesting, normal people who are interested in interpersonal relationships find the gossip more interesting. It's two sides of the same coin.

Most of the time that you point out that something makes no sense whatsoever, some (possibly well-meaning) apologist will come out of the woodwork and respond with an attempt to portray all possible choices as equally viable. That way everything is just a personal preference with no objective criteria whatsoever. There needs to be something like "Godwin's law" for this. It's often an effective way to halt all useful discussion, and I'm not buying it. It's fine when you are talking about what kind of music you listen to or what kind of food you like to eat. However, it doesn't apply here.

Knowing that a scientist named John Doe just married his third wife doesn't do a damned thing for anybody. It's useless trivia. No one can take that information and produce a useful product from it. No one can grow as a person or improve their quality of life by learning this. However, knowing that a scientist named John Doe has invented and published a big improvement on how we produce titanium benefits everyone who produces titanium and everyone who purchases products containing it (anything from white paint to rockets). It is not useless trivia. The two types of information are therefore not on equal footing -- one is objectively useful, while the other is not. Ergo, this is not a mere preference or matter of taste, and it's intellectually dishonest to pretend like it is.

It's just that when someone can sing or dance or act, we pretend like this trivia is somehow profound or meaningful or useful. There's a certain desperation behind that if you look deeply into it. The people who do it don't want to so much as they need to. They have to have some kind of excitement, to make a big deal out of something, because otherwise they must address the emptiness of their own lives. There's nothing wrong with finding interpersonal relationships interesting, because interpersonal relationships are a big and important part of the whole life experience. However, there is something deeply wrong with such a strong interest in interpersonal relationships that don't involve you and in which you cannot participate, particularly when they involve some of the most immature, unenlightened, and superficial people that our society has to offer (i.e Paris Hilton, Brittney Spears).

Re:Some perspective please.

[vakuona]

One could also argue that scientists learning about Galaxies that are millions of light years away are also engaging in useless trivia. We will never reach them, and whatever knowledge we gain is less likely to be of use to them that knowing about Lindsay Lohan's personal life. I mean, they have a better chance of getting in on with Lindsay than of ever finding anything useful about a Galaxy a million light years away.

Re:Some perspective please.

[mosb1000]

Relationships between people are important. They are much more important than distant galaxies, both personally and communally we would not be able to survive without them. Watching other people tells us something about ourselves.

If you you think that an enlightened discussion of cinema and pop-culture should revolve around the technical aspects of producing such media, then you've missed the point entirely. People discuss movies and pop-culture because it says something about our lives. It reaches out to us personally and tells us something about who we are.

You may think that an interest in science is the result of an analytical mind, but in reality the opposite is true. We associate with tales of adventure in space or conquests in manufacturing titanium because they stir us emotionally in the same way. We play out what if scenarios in our heads and fantasize about that the world could be like. This common desire for a better or more adventurous future is what brings us together here. In the same way a desire for stronger or more exciting relationships is what causes people to be obsessed with media stars.

Re:Some perspective please.

[blackest_k]

I don't think slashdot is immune from trivia, when you said scientists i immediately thought of hans reiser , steve jobs medical problems and various other personalities some even well known enough to be referred to by initials. maybe even a few regular posters on here. (anyone noticed New york country lawyer seems to have gone quiet recently).

Ok outside of slashdot these names mean nothing to most people but then we are interested in what they do and most people are not.
We my not show any interest in personalities on the telly but we all have ideas what various personalities are like on the net.

I know you feel righteous about this cause, but...

[Anonymous Coward]

what if your family members lives become endangered if you "come out"?
true fucking story, Jack, of a friend of mine that was a lesbian. Someone
threw her out of a second story window for even hinting at coming out.
Parents were very important government officials of a not so understanding
government. Details left out so they can all live.

Ohm is overwrought

[feenberg]

I have worked with anonymized government data extensively, and birthdate and zipcode are always considered personally identifiable information. Sometimes birth year is available, and sometimes state or (rarely) county is available, but I have never even heard of a dataset with both. Datasets with month and day of birth are never considered to be anonymized, and are not released. The author of the paper is much overwrought.

Re:Ohm is overwrought

[Anonymous Coward]

I am an employee of a government stats organization from another english speaking country (i.e. not America).

Around here: birthdate is a bogglesomely fine classification. I can think of *one* form that collects birthdate - it's the Census; it asks for birthdates only for children under 1 year of age; this is because few people are prepared to report that their child is 0 years old, so we kept finding that there were too few 0-year-olds and too many 1-11 year olds. (People put child's age in months in the "age" box.) We convert this to "0 years" and drop the birth date.

For most surveys we don't even ask for age in years - five year bands are good enough for anything except young-people-specific topics like education.
That's 18 age categories (stopping at "85+" for health surveys, others 75+ or 65+.). Not 365 * 100.

And zip code? The local equivalent covers areas of around three thousand households. For release purposes, an area with fewer than 200K people in it is excessively fine; we check carefully before releasing even state level data.

And that's for publications of summary statistics. We do release unit level data occasionally - but it's confidentialised to a fare-thee-well; and is, in fact, notoriously useless for a wide range of purposes users would love to put it to. You want to do analyses W, X, Y, or Z? X can be done on *our* computers - not on yours! Y can be done by *our* staff - not by yours. And the results of Z breach confidentiality, so that's never going out the door under any circumstances. It's The Law here. You can only do W with the unit level data we actually release.

(In other words, Ohm is at least partly right. Confidentiality and Utility do conflict.)

What you Americans are doing releasing such fine data to corporations all the time, I don't know. Your Census Bureau takes much better care with your data. (I read the original paper from 2000. Although they started with US Census data, they simulated birth date information because there was none on the data they had.)

(Bonus points to any reader who can identify my country from the above. It's probably possible.)

Re:Ohm is overwrought

[herojig]

Let me guess AC, India? How did I know? I in Nepal. (But if I was wrong, oh well, it was just a guess). But whatever, I really enjoyed Ohm's article, even if it read like a well-researched rant:

"What has startled observers about the new results, however, is that researchers
have found data fingerprints in pools of non-PII data, with much
greater ease than most would have predicted. It is this element of surprise
that has so disrupted the status quo."

Well, I was not surprised at all. Seems this should be the case (but I am just a guesser). Your point about Americans releasing find data is connected to this point. There is no real surprise because of course everyone knows that there are data fingerprints in pools of non-PII data - that's why they are using them as barter and hoarding the huge stockpiles for future sales.

It's just another case of the American and European slave being raped for every vital juice contained in their bodies, or on their hard drives.

anon sez:

[Anonymous Coward]

not your personal army.

Re:anon sez:

[Anonymous Coward]

Unless you feel like it. Yeah, I know how this works. That's where the story comes in.

Hello I was born

[assemblerex]

01/01/1901

solution hidden in suggestion- mandate obfuscation

[Anonymous Coward]

What if anonymizer software is mandated to thoroughly replace with random details - random names where names are not important, random IPs where IPs are not important, or blanking out.
This ought to be mandated and audited.

This can be done publicly - if the data is random, a public dump should not be able to harm anyone because there is proof that at that time, the said person was in altogether different place doing something totally unrelated.
This is a rule that should be made compulsory for any system that holds public records that can leak onto the internet.
Sale of people's records will become that much more difficult if regular audits are needed or public dumps are needed.

Although all of this can be circumvented, the legal costs it ties to the operation are now multiple times meer accidental breach of privacy - not obfuscating data you do not need becomes a crime for corporations

A law that helps the people should make sense given this obvious problem.

I don't have the problem you suckers have

[microbee]

I have a twin brother living with me. Now try to identify me, Haha!

A bit alarmist

[slagell]

I do research in the field of anonymization and can say that I agree with a lot of his points, but he takes each of them too far and sounds very alarmist. He seems to see things in a very binary way. One can have anonymization that is effective at preventing reversal for 99% of indviduals or certain types of attacks. For example, I may be able to release a data set that has almost a 0% chance of revealing any particular user but a 100% chance that someone could be revealed.

Anyway, one of the good points he brings out is how stupid the requirements in HIPAA are. One can anonymize with the safe harbor rules (from EU I think) which basically destroy information needed for most kinds of analysis, or they can get a statistician to certify that it has been statistically de-identified without any specific standard for what that means. So in practice you can get anything released if you hire the right statistician.

Hash

[AthleteMusicianNerd]

If the collector of data did something like an MD5 hash to verify an identity, that's very difficult to do an inverse operation on.

Greed

[rtechie]

Individuals simply aren't capable of securing this information and protecting themselves. They aren't given the power to actually do anything.

The responsibility lies SOLEY with the businesses collecting this information and with law enforcement. They're greedy and stupid, which is why problems occur.

Business:

They're cheap. This is almost the SOLE reason security problems exist. If they actually paid for network hardening, dedicated security staff, BONDING for key individuals and customers, and most importantly, tight restrictions on selling information, these problems would disappear. It's actually pretty easy, it just costs you money (especially in opportunity cost as you can't sell to anyone who is even slightly suspicious). Certain businesses (like ChoicePoint) would be completely unprofitable under such rules, so should be regulated out of existence.

Law enforcement:

Law enforcement has completely dropped the ball on cybercrime because it's a little bit difficult to enforce and isn't "sexy" enough. It requires technical expertise and many of the worst offenders are overseas. Overseas, the problem has to be dealt with through trade sanctions. Sanctions should be imposed on the Brazil, Russia, and China until they do something about cybercrime or let US law enforcement operate freely. All of these countries refuse to extradite, which is the core problem.

Violation of Liberties

[AthleteMusicianNerd]

Collecting sensitive information like addresses, birthdays, etc.... is a HUGE violation of individual liberties anyway. In almost all cases the collector should be told to F OFF!

Where are all the GameLock Specialists?

[TaoPhoenix]

This decade is seriously becoming a game with all the types of rules we used to play for fun 10-15-20-25 years ago.

Does anyone else notice that a Patent Turbo-Troll who offers to report you to a legal thug, deliberately making data easy to steal, and "descrubbing" anonymous data all in the same few HOURS?

Come on gang, that's the TimeTwister Combo from MTG.

RIAA got grumpy because record data (songs) was "easy to (infringe)". Phish emails are ... (your verb here) your digital data from the less savvy types.

Someone appoint Richard Garfield as Special Consultant to the President so when stupid new "calls for X" show up on he President's desk, Garfield can take a 30 minute look at it and abuse the hell out of it so bad that it makes Goatse looks like a Victorian Picnic.

Re:Where are all the GameLock Specialists?

[causality]

That's an interesting use of the "Reply" button.

CT scans

[Cajun Hell]

Have you ever thought about how a "cat" scan works? Forget the 3D aspects and let's just think about how the cross-sectional pictures work.

Every given reading, is just shooting a ray through the target, and getting a single number out. This is analogous to aggregate summaries are personal details in data. You know the average income of people in zip code 12345, but no specifics. The trick is, later, just as that CT scan is going to shoot a ray through a certain point again from a different direction, your personal details are going to be summarized again by someone else, in a different way.

A picture will emerge. The CT scan is going to "see" the bone as distinct from the tissue right here at this pixel, and this person's data will be un-summarized. It just takes enough rays, and eventually all ambiguity goes away.

A long time ago (about 20 years ago, I think?) there was a neato explanation of a cat scan algorithm in Scientific American. I wish I could find it. Because I bet you could show that article to any "database guy" these days, and they'd nod and smile.

so they can identify 87% of me

[bugs2squash]

I don't care, it's the remaining 13% of me that's special.

For almost every person on Earth?

[Anonymous Coward]

Even Nigerians?

My life history is a work of art.

[herojig]

>>I think the solution is to have the concept of "intellectual property" work both ways.

I think u are absolutely right! But then that property would be abused just like every other companies. But at least it would give a person a legal standing. My life history (as partially divulged on Facebook) is a work of art and should be protected just like a painting or Hollywood film. It should be inherit and explicit that my persona should be protected under copyright laws, and anything stemming from that would fall under intellectual property rights jurisdiction. The only problem with all of this is that the entire concept of intellectual property is flawed, as we are all pooled from a collective consciousness that can't be dissected so easily. But in the relative world, having intellectual property law extend to any record created by our lives would be an improvement.

"I think, therefore I can't be."
-- TTNH

Re:My life history is a work of art.

[Anonymous Coward]

any picture you take or text you write IS copyrighted automatically.

There is no such thing as "intellectual property rights jurisdiction."

The interesting question is can your zip code, date of birth, and gender be considered copyrighted when they are presented together?

Re:My life history is a work of art.

[herojig]

Point taken, but that's what i meant to say: if i fill out a form that uniquely describes myself by zip/birth date/gender, that is really no different then if i wrote a poem about where i live and who i am, which IS automatically covered. So I say it's already copyrighted material and anyone using that personal information without my permission is in violation of applicable code. I guess we need Lionel Hutz to argue that case.

Re:My life history is a work of art.

[Anonymous Coward]

Facts cannot be copyrighted.

Re:My life history is a work of art.

[herojig]

Every autobiography I ever read had a copyright!

Sorry, I don't believe it!

[Anonymous Coward]

I just don't believe 87% of people can be uniquely identified by {zip,dob,sex} or 18% by {county,dob,sex}. dob only creates 366 bins. Adding sex makes it 732 bins. Even if all 100000 possible zip codes contained a population of 732, that would make for only 73 million people or less than 1/4th of the actual population. And date of birth will not be even close to being uniformly distributed.
From Census Bureau data, the median county population across the U.S. in 2008 was 26,000+. Again, without doing a more intensive analysis to be certain, it still seems unlikely that 18% of individuals would be uniquely identifiable by {county,dob,sex}.

18%? NO FRIGGIN' WAY!!!!!

[Anonymous Coward]

Upon further inspection, 19 counties out of 3193 in the U.S. were estimated to have populations less than 732 in 2008.
NO FRIGGIN' WAY would 18% of all U.S. citizens be uniquely identifiable by {county,dob,sex}. NOT EVEN 1% would be so identifiable.

Easy to frame you

[aepervius]

"" Good luck coming up with a large mountain of evidence to put me somewhere else."

Wait that you sleep somewhere alone, steal your CC, and if you really want to do in the not-too subtil, steal some clothing they jsut used but did not wash. Go use the CC near crime scene. Use old clothing to rip small part on nail or other ragged surface. One should suffice. Steal the mobile phone too, and the driving license. Commit your crime. "lose" the driving licence nearby. Send text message. Replace everything as quickly as possible in the apartement of the sleeping person. Et voila. You have no aliby, and your super system to show where you are just turned agaisnt you.

Privare Companies are different

[Anonymous Coward]

I worked for a big insurance company in Europe, and our testing data sets ought to be anonymized. Well, one quick google search revealed they weren't. The company that did the anonymization thought it would be enough if the phone numbers and emails were false. Thank god the data sets where only used for internal development, but nevertheless we had access to very personal data, since the company also did health insurance. If we hadn't intervened, they would have used the same method to create data sets for load testing, and that would have meant hundreds of thousands of insurance records barely scrambled available to developers (well, we had NDAs and stuff) and also to lots of testers, usually underpaid students.

And this is only one of a few occasions I encountered such things. Don't get me started about banks and IT...

AC for a reason.

Re:Interesting Use...

[TaoPhoenix]

But is it Sufficiently Innovative and Non-Obvious?

Centralized personal data *could* solve everything

[ZuBsPaCe]

Fact: The more information you give away about yourself, the more useful it will be to the one having access to it but the potential for abuse increases.

The huge problem we already experience today is the loss of control you have over your provided data. Who has access to what information? Right now, do you know on how many servers your birth date is stored? I certainly do not, but in my case I estimate it goes into the hundreds. How many of these copies of my birth date are actually used/needed on those servers? I guess the number is very low.

I don't really care about my birthdate, but what about my name, home address, credit card number, social security number? Do you know?

Hypothesis: In a perfect world without corrupted minds a secure, centralized server (or server farm) where all your data is stored (including personal data like bank account balance), never given away and accepts verification/change requests from the outside could solve all problems at once. The only public data would be Unique ID's associated with 1) personal data and 2) an operational code, eg verify age is >18 and decrease account balance by 100. Only you are able to approve associations and give away those UID's. There you go, centralized control over your data and what happens to it. Problem solved.

Unfortunately we're already too far down the road and have to life with the current mess, probably forever.

Ever use Facebook?

[gr8_phk]

They (and many other "social" web sites") ask for exactly those 3 things. They have millions of users who post all sorts of stuff (mostly crap).

Could use just birth year, rather than birth date

[Anonymous Coward]

This presumes that one has to store the full birthdate. If the research requirement calls for knowing a person's age, then storing only the birth year would presumably take an enormous amount of precision out of the data, and make actual identification much harder.

The end is near

[Logibeara]

Watch out 4chan

Resistance is Futile

[srobert]

Who could have seen it coming that Dr. Ohm would meet with so much ... resistance? "rimshot".

Welcome to the 21st century

[professorguy]

I send hundreds of patient records OUTSIDE our hospital every day. These records INCLUDE admission time and date, patient's town, state, zipcode, and birthDATE (with year).

How do I get around all those pesky HIPAA laws? I don't--I'm pretty sure this system is illegal. It is however REQUIRED by our state's government.

Oh, you thought laws to limit government power are actually followed? Now I see your confusion....