Slashdot Mirror

← Back to Stories (view on slashdot.org)

UK Wants To Criminalize Re-Identification of Anonymized User Data (bleepingcomputer.com)

Posted by BeauHD on from the statements-of-intent dept.

An anonymous reader writes: European countries are currently implementing new data protection laws. Recently, despite leaving the European Union, the United Kingdom has expressed intent to implement the law called General Data Protection Regulation. As an extension, the UK wants to to ban re-identification (with a penalty of unlimited fines), the method of reversing anonymization, or pointing out the weakness of the used anonymisation process. One famous example was research re-identifying Netflix users from published datasets. By banning re-identification, UK follows the lead of Australia which is considering enacting similarly controversial law that can lead to making privacy research difficult or impossible. Privacy researchers express concerns about the effectiveness of the law that could even complicate security, a view shared by privacy advocates.

120 comments

  1. Does the "UK" not realize this is their problem? by Anonymous Coward · · Score: -1

    Does the "UK" still not realize this is their problem? They try to tax, control, an profit from every tiny thing in a person's life. This is NOT acceptable. This is why people revolted and they lost their empire. Absolute, 100%, morons.

  2. Privacy researchers express concerns... by fustakrakich · · Score: 2

    Well, they'll just have to work, anonymously...

    --
    “He’s not deformed, he’s just drunk!”
    1. Re:Privacy researchers express concerns... by AHuxley · · Score: 1

      Lots of other nations would be happy to have UK experts work with them and sell better AV products.
      If the UK wants to make network research illegal, find a nation that fully supports science and that respects academic publication.

      --
      Domestic spying is now "Benign Information Gathering"
    2. Re:Privacy researchers express concerns... by fustakrakich · · Score: 2

      find a nation that fully supports science and that respects academic publication.

      On this planet?

      --
      “He’s not deformed, he’s just drunk!”
    3. Re:Privacy researchers express concerns... by AHuxley · · Score: 1

      The UK spent so much of its budget on computers, maths and science education over the last decades.
      Only to consider a ban using some of the network skills?
      Some of the very best AV and malware security researchers seem to still be doing ok in other nations?
      If the UK wants to only allow the gov and mil to do internet research?
      People with a good UK university education that the UK gov no longer wants or supports?
      Find a nation that still respects academic research.

      --
      Domestic spying is now "Benign Information Gathering"
    4. Re:Privacy researchers express concerns... by rtb61 · · Score: 1

      Shhh, it's only a trick to get them into data centres, when ever they want, for what ever reason they want and also it's part of the leverage to force local storage only of local data, no data export and deletion. See, extra sneaky, now all the data will be there for them to get in to see, what ever they want to see it, with the claims of data audit. So the law is kind of rough and ready because it's the wedge in, rather than a law of it's own. The privacy rights of citizens must be protected in the digital era and that means random inspections and audits of data centres with severe penalties for abuses. Corporations have no right to citizens private data without 'sustained' expressed consent (sustained because the citizens has the right at any time they chose to deny that consent and require the data to be deleted).

      --
      Chaos - everything, everywhere, everywhen
    5. Re:Privacy researchers express concerns... by Anonymous Coward · · Score: 0

      That the gov fails computer science 101 and employs monkeys who do not know about data or what a join means, let alone normalization and statistical weightings. I suspect the same morons think SQL is obsolete.

      Credit card companies and US Health records mostly have worked this out with really expensive software. If anonymized properly there is no problem. If a shoddy and uneducated monkey/technician has a 'go' then it is to legalize privacy violations. Bad data auditors need to be sued if they use 'make up'.

      For medical records, yes, some rare conditions can be figured out. I don't have a problem with cleared and vetted medical researchers mining data. A leak from exported bulk data is clearly more of a risk. Knowing which famous politicians had recent STD checks/treatments is always amusing.

      If the UK insists on snooping , put foreign keys and critical indexes in a sparse hash table, on a foreign server that servers another foreign key with an encrypt function. Once you get a 60 line SQL statement, ETL and cubes start to fail, and table scans suggest WHO is up to something naughty.

    6. Re:Privacy researchers express concerns... by AHuxley · · Score: 1

      The UK will face a brain drain again.
      https://en.wikipedia.org/wiki/...

      --
      Domestic spying is now "Benign Information Gathering"
    7. Re: Privacy researchers express concerns... by Anonymous Coward · · Score: 0

      Is that the UK with London as the capital? I don't recognise the spending in education you refer to.

    8. Re:Privacy researchers express concerns... by fustakrakich · · Score: 1

      Some of the very best AV and malware security researchers seem to still be doing ok in other nations?

      We don't know that. *Seem to be* isn't a valid criteria. Maybe I'll believe it when pirate bay finds an invincible fortress for their servers.

      Find a nation that still respects academic research.

      Alright already! Name a single one...

      --
      “He’s not deformed, he’s just drunk!”
  3. Disempowers the masses by aberglas · · Score: 2, Insightful

    The extreme focus on privacy disempowers ordinary people from making their on inquiries. And strongly contrasts with the total access demanded by government. Combined with censorship of the web which has become a major form of communication, this shifts the balance of power away from the common man towards government bureaucrats.

    1. Re:Disempowers the masses by Anonymous Coward · · Score: 4, Insightful

      And anyway, it mostly just makes beneficial security research harder, while doing nothing to protect privacy (since criminals and governments will just do this anyway).

      All they really want to do is punish ordinary people when they discover embarrassing things about politicians using public data. Everything else is just hot air.

    2. Re:Disempowers the masses by Anonymous Coward · · Score: 0

      You get a red card from me, for using the word "privacy" in a nondescript context!

      In the linked article, the word "privacy" is not even mentioned with regard to the proposed idea of such regulation. Why would you use the word "privacy" in this context?

      If "privacy" = "something secret" to you, I'd argue that you end up kicking the legs off any sensible attempt at identifying with 'privacy' as a term in the event of you or other regular people having to demand or acquire privacy, as opposed to simply be given "privacy" as a product or service (which is probably based on preying and "attacking" your privacy in the first place when this involves collecting/handling/monitoring/storing/processing personal data in general), because.. in this way of simply juxtaposing "privacy" with "secrecy", you use what I like to call "a pragmatic approach" to an poorly understood philosophical problem (any problem really that aren't meant to be solved in a pragmatic manner), which unfortunately would be based on deeply flawed assumption on what 'privacy' should be, in relation to personal data (data/metadata about you and/or your life) in whatever form.

    3. Re:Disempowers the masses by Anonymous Coward · · Score: 0

      I should add that to what I wrote above just now, that there are ofc pragmatic issues in society (that could also be thought of as ideal philosophical issues to be understood and resolved in other ways as problems, but somehow there is a need to be pragmatic in society for good reasons, so you accept having your name being associated with your car's license plates, to name one example). ..this in turn leads to a SECOND way of thinking about "anything pragmatic", because, just like privacy would be best understood as A NEED, whenever something pragmatic isn't based on A NEED, then "being pragmatic" about something, take on a different tone, things like: pushing a talking point, pretending that it is important, pushing an issue, insisting that it is important (when it really wouldn't be, or couldn't be important for the stated reasons). ..so pragmatism, would be tantamount to political bs, that simply is meant to be a catalyst for the political process and all the invested interests involved, for simply pushing and resolving issues, for purely political reasons that doesn't merit a real need, or a clear need, or an important need, or something that is in good taste and being proportional to other means of resolving the concern in question.

      Cue discussion about praxis and theory, being pretty much the same thing.

    4. Re:Disempowers the masses by dunkelfalke · · Score: 2

      How exactly can collecting user names from data be used for beneficial security research? Security research is fine with anonymous data, re-identification is only interesting for advertisers.

      Also, your logic is very cute because it works for basically everything. I mean, why forbid murder/rape/whatever, criminals and government will just do this anyway.

      --
      "It's such a fine line between stupid and clever" -- David St. Hubbins, Spinal Tap
    5. Re: Disempowers the masses by Entrope · · Score: 1

      Your analogy fails badly. Where is the harm when someone is de-anonymized? Other laws already prohibit publication of private information, defamation, and other bad uses of the unmasked data. It doesn't seem to me that de-anonymization itself causes any harm, whereas the harm is obvious for murder, rape, theft, and so forth.

    6. Re: Disempowers the masses by dunkelfalke · · Score: 1

      You can ask people in witness protection where the harm is. Just to give you an obvious example. Privacy is very important in the modern always connected world.

      --
      "It's such a fine line between stupid and clever" -- David St. Hubbins, Spinal Tap
    7. Re: Disempowers the masses by Entrope · · Score: 1

      That is, frankly, pants-on-head stupid. This law isn't about lists of people in witness protection programs, and it isn't limited to protecting their status as witnesses.

    8. Re: Disempowers the masses by dunkelfalke · · Score: 3, Insightful

      The law is about all people who don't want unneeded intrusion in their lives. Americans don't get it and this is why they get dozens of robocalls a week. I get one a year in worst case.

      --
      "It's such a fine line between stupid and clever" -- David St. Hubbins, Spinal Tap
    9. Re: Disempowers the masses by Entrope · · Score: 1

      What are you saying? That the only way you (Europeans) are protected from robocalls is that it has been made illegal to talk about weaknesses in data anonymization?

      Robocalls are a problem in the US mostly because of the First Amendment, not because it's legal to talk about how to de-anonymize a data set.

    10. Re: Disempowers the masses by Anonymous Coward · · Score: 0

      security research into if a dataset can be reversed would be banned under unlimited fines.

      thats the problem. that pointing out that some supposedly anonymized data isnt. this actually matters because a bad company could keep anonymized data, while it really wasnt anonymized at all.

      this matters for data collectioning.

    11. Re: Disempowers the masses by Wootery · · Score: 1

      Where is the harm when someone is de-anonymized?

      Depends on the data. Could be blackmail, for instance, or an increase in insurance premiums.

    12. Re: Disempowers the masses by Entrope · · Score: 1

      My point, which was apparently too subtle for you, was that those harms come from how the unmasked data is used, not from the mere unmasking, and much less from the disclosure of weaknesses in the masking procedures.

    13. Re: Disempowers the masses by Anonymous Coward · · Score: 0

      We do have a large contingent of the population (not there should be no inference of suggested political affiliation from this statement) that eschew logic and reason, and politicians that largely ignore the interests of(most of) the population; however, please try not to make it sound like all 300-something million of us live with our heads rammed up our asses.

    14. Re:Disempowers the masses by Carewolf · · Score: 1

      Nonsense. It empowers them. Remember this only applies to systematic reversal of implied privacy, not manual. Also it is already illegal in the EU, this seems to just a UK backup law for once the leave the protection of EU privacy laws.

    15. Re: Disempowers the masses by Wootery · · Score: 1

      Fair point. It's not 'for nought' though - it would prohibit some things which are currently legal. Research, say. (Whether academic research, or market research.)

    16. Re: Disempowers the masses by Anonymous Coward · · Score: 0

      If the data allows for de-anonymization of someone in witness protection, then that needs to be explored and corrected. Because the bad actors aren't going to care that it's against the law to de-anonymize.

      You have made the stupidest fucking slashdot post I've seen in my life. APK copypasta, cow copypasta, fucking goatse is less retarded than the retarded shit you've written here.

    17. Re: Disempowers the masses by JohnFen · · Score: 1

      Where is the harm when someone is de-anonymized?

      Have we really degenerated to the point where it's only valid to assert personal rights if you can show there is harm involved if they aren't asserted?

    18. Re: Disempowers the masses by Anonymous Coward · · Score: 0

      The fact that usernames and names in general can be found from "anonymized" data is security research in itself. If the data *can* be deanonymized, that means someone should be legally allowed to research it and make such flaw be (publicly) known. The law they're proposing would make it illegal to make such discoveries, which is absolutely moronic.

    19. Re:Disempowers the masses by Anonymous Coward · · Score: 0

      Found the idiot or the shill. Nothing you said is close to reality. You're claiming all of human history up until the last several decades has, "disempowered ordinary people."

      Shut the fuck up you idiot.

    20. Re: Disempowers the masses by kwbauer · · Score: 1

      "Because the bad actors aren't going to care that it's against the law to de-anonymize." Are you absolutely sure about that. I've heard a few people, rich people even, telling me that criminals will stop selling guns to each other in the US if only US law would require permission from the government before any gun is sold. I don't see this de-anonymizing thing being any different.

      Yes, people really are that stupid and it is not generally the ones that voted against Hillary and others of a similar ilk.

    21. Re: Disempowers the masses by kwbauer · · Score: 1

      No, it just doesn't go far enough. it is not enough to simply tell people they can't do something because bad people will ignore that. We need to pass laws that tell us we cannot even think about doing something bad and then people will start to follow the law.

    22. Re: Disempowers the masses by JohnFen · · Score: 1

      Robocalls are a problem in the US mostly because of the First Amendment

      Not really. There are laws restricting robocalls in the US. The reason they remain a problem is that those laws are extremely hard to enforce.

    23. Re: Disempowers the masses by Entrope · · Score: 1

      Which personal right are you referring to? This is data that is already in the hands of someone else. They've just somehow masked bits of it.

  4. Make being bad unlawful... by XSportSeeker · · Score: 2

    Let's just criminalize being bad in general, since it seems these politicians think it'll solve all the problems in the world.

    A law is useless if there is no way to enforce it.

    1. Re:Make being bad unlawful... by jandersen · · Score: 2

      It seems to be a common misunderstanding, that laws are there to stop people from doing things; they aren't. The laws are meant to be:

      - a toolset for for the police and the courts: under the rule of law, the police and judges can only act as the law prescribes. This means they cannot arrest people on a whim, at least in principle, and a judge cannot pronounce a sentence that is contrary to the law.

      - a ruleset to guide everybody, when they are in doubt. Most of the time, people know what is right and don't need the law to tell them, but sometimes one person's idea of right clashes with another's, at which point they can consult the rules to see who is right.

      And sometimes a law is little more than a statement of intent or an invitation to debate, that says "we have identified this as a problem, now let us find a solution". This is the way a society - especially a democratic one - evolves, by trying to organise itself, agreeing on common rules, identifying and solving problems. If you know a better way, please tell.

    2. Re:Make being bad unlawful... by AmiMoJo · · Score: 1

      Why would it be impossible to enforce?

      Laws like this are usually designed so that people can whistleblow or interested parties (like journalists) who discover evidence of de-anonymization can present evidence to the police, who can investigate. It's similar to other data protection laws, which generally don't involve inspections but where infractions are still regularly detected and punished.

      In this case they are targeting companies that abuse anonymized data for profit, which can be quite difficult to hide. If they buy some data and then start advertising to some of the supposedly anonymous members of that data set, well it looks pretty suspicious.

      --
      const int one = 65536; (Silvermoon, Texture.cs)
      SJW, n: "Someone I don't like, and by the way I'm a fuckwit" - AC
    3. Re:Make being bad unlawful... by ZecretZquirrel · · Score: 1

      Worse than that, it inspires cynicism and disrespect for government as a whole.

    4. Re:Make being bad unlawful... by kwbauer · · Score: 1

      Wait, we are not allowed to discuss whether doing something is good or bad or both depending on what happens after that something unless we pass a law imposing an infinite fine for doing the first something first?

      When was the law passed that made it illegal to pass a law about de-anonymizing so that we could debate passing the de-anonymizing law?

  5. Except by nitehawk214 · · Score: 1

    Except for the government, of course.

    --
    I'm a good cook. I'm a fantastic eater. - Steven Brust
    1. Re:Except by Anonymous Coward · · Score: 0

      Then the researchers have no problem as they are all employed by the government. Right? ;)

    2. Re:Except by Carewolf · · Score: 1

      Except for the government, of course.

      Nope, except for manual cases. Which means it can be done with warrent.

  6. If it's possible to re-identify... by Anonymous Coward · · Score: 1

    ...then it's not anonymous data. How about make it illegal to collect enough info to make connecting the dots even possible?

    1. Re:If it's possible to re-identify... by Anonymous Coward · · Score: 0

      But that would be the opposite of a law making it illegal to point out the flaws in so-called "anonymizing" algorithms...

  7. What the what? by Anonymous Coward · · Score: 5, Insightful

    . As an extension, the UK wants to to ban re-identification...or pointing out the weakness of the used anonymisation process.

    There is this persistent undercurrent from governments that security researchers are the enemies. As if weaknesses don't exist until someone points them out. The apparent opinion is that we'd be safer if only people weren't free to point out the flaws in the system. The actual reality is the reverse.

    1. Re:What the what? by Anonymous Coward · · Score: 1

      You seem to believe that the proposed law is meant to protect privacy. Given the often and loudly expressed views of the current UK government, it seems far more likely that weakening privacy protection by banning pointing out flaws is the actual purpose, with the rest being obfuscating fluff added because no one could figure out how to spin it as an anti-terrorist measure.

    2. Re:What the what? by coastwalker · · Score: 2

      Given the fun everybody is having shouting at each other about how leftist SJW are going to die and the alt-right are ignorant swine it is refreshing to find the most significant comment buried down here in the noise. Of course the purpose is to prevent any research into potential government methods in identifying opponents. The government is often accused of being stupid and ignorant of the function and behavior of the internet and its inhabitants. Nothing could be further from the truth, they understand it entirely too well. They just don't care what internet "experts" think, they take their council from tabloid newspapers because that is how they get elected.

      Businesses don't worry about dropping cookies on you these days because they can identify you without them. The government can do the same and research into this and similar methods has been made a criminal offense so you will not be able to take mitigating actions. The government is not entirely evil, it believes that this will protect the children and catch terrorists. Meanwhile Facebook owns your soul whether you use it or not. A bit of a dilemma really.

      --
      Facts are history now plebs have politics for religion on social media.
    3. Re:What the what? by Anonymous Coward · · Score: 0

      Yes, because they want GCHQ and NSA to have zero day loopholes to last longer.

    4. Re:What the what? by Anonymous Coward · · Score: 0

      Look, the Emperor has no clothes on!

  8. UK is confused by Rick+Schumann · · Score: 0

    On the one hand they want to ruin encryption, spy on everyone on the internet, censor the living hell out of everything, and there's no end to how many cameras they install all over the place. On the other hand there's this. Make up your mind, UK.

    1. Re:UK is confused by Anonymous Coward · · Score: 0

      don't point out their inconsistency. this could be a sign that there is still a sliver of hope left on the isles.

    2. Re:UK is confused by AHuxley · · Score: 1

      Could be to protect the new GCHQ methods?
      The days of passive nation wide collect it all is over.
      The security services will be moving down networks and into networks at a user level.
      What happened when AV or malware detection starts getting too smart at reporting back about all detected network issues in real time?
      Suddenly the security services need a unique ip rage for all the interesting people they are trying to watch?
      Re-identification done with enough funding and skill might show contractors for the security services all appearing from the same staging servers.
      Ban re-identification and the security services can still use existing methods.
      No need to worry about real time AV efforts or security researches if they can only look at code litter rather than uncover entire malware pushing networks.

      --
      Domestic spying is now "Benign Information Gathering"
  9. Like ROT-13 is encryption by Kjella · · Score: 4, Insightful

    The biggest problem I see with this is that it flips the responsibility over to the one who says the emperor has no clothes. While it is difficult to create truly anonymous data and it would be nice to stop large law-abiding companies from trying to break down any compartmentalization you've done, I fear the effect will be quite the opposite. Because now if you call anyone out on poor anonymization it must be because you've tried exactly what this law prohibits, so white hats will be silenced. The companies will get lazier, because it's cheaper. And the black hats will have a field day with it.

    --
    Live today, because you never know what tomorrow brings
    1. Re:Like ROT-13 is encryption by Anonymous Coward · · Score: 0

      You see it as a problem, May and her ilk see it as a solution.

  10. Bono? #2? by Anonymous Coward · · Score: -1

    What is up with Took a crap? Leave a crap, okay.

  11. So I can do it, and use it for evil... by tlambert · · Score: 2, Funny

    So I can do it, and use it for evil... so long as the UK government doesn't find out about it?

    Got it.

    So when I write that paper on "de-anonymization made easy", all I have to do is anonymize my authorship of the paper, and I'll be safe, because the U.K. government won't break their own laws ... correct?

    1. Re:So I can do it, and use it for evil... by Richard_at_work · · Score: 0

      I don't get why people make these kind of posts - its not as if a government being exempt from a lot of domestic laws is a new thing, so why wouldn't they be able to investigate your breach of this law? Its like saying that the police cannot legally detain you, because thats illegal for you to do to someone else.

      This is another thing they can charge you with when they arrest you, thats it.

    2. Re:So I can do it, and use it for evil... by skovnymfe · · Score: 1

      The police aren't supposed to shoot you dead, but they do on occasion murder people anyway.

      It would be unfortunate if you had a concealed weapon on you during a police raid, and you had to die because of it.

    3. Re: So I can do it, and use it for evil... by Entrope · · Score: 1

      When the government exempts itself from the laws that it applies to other people, that's a pretty strong clue that those laws are unjust.

    4. Re:So I can do it, and use it for evil... by AmiMoJo · · Score: 1

      Yes, like all laws you can get away with breaking them if your crime is not detected.

      And no, the government has given itself specific exemptions, e.g. for the police and security services, so the law doesn't apply to it when investigating you.

      --
      const int one = 65536; (Silvermoon, Texture.cs)
      SJW, n: "Someone I don't like, and by the way I'm a fuckwit" - AC
  12. Hide it under the carpet? by Anonymous Coward · · Score: 1

    Anonymized data is fake anonimized. They leave enough selectors in the data to simply match it to the person.

    The crime here is the disclosure of personal data fake-anonymized.

    Making it a crime, won't stop an attacker (e.g. Putin) from deanoymizing data (e.g. MP's surfing habits, their research, their family data) from fake anonymized sources.

  13. Another "Amazon" Law by seoras · · Score: 5, Interesting

    I interviewed with Amazon a few years ago and, coming from Cisco, their engineers were very keen to pick my brains on how to identify individuals using network trickery.
    It was very obvious during the interview that this was their holy grail, the identification of individuals for targeted marketing particularly in the EU/UK where stiff laws on cookie usage had recently come into effect.
    One wonders if this too is another political swipe at Amazon?
    It's certainly not in the public interest what with the UK Gov's repeated statement of war on person encryption.

    1. Re:Another "Amazon" Law by Anonymous Coward · · Score: 0

      At first I read your past employment as "...coming from Costco..." and continued reading- thoroughly entertained that their engineers were so interested.
      Did enjoy!!

  14. Nothing to do with privacy by Anonymous Coward · · Score: -1

    If it was to do with privacy they'd disallow selling 'anonymized' data on private citizens.

    Instead they want to continue letting companies sell that data, knowing its not really anonymous. If anyone says ... here look how trivial it is to deanoymize the data.... that will be a prosecutable offence.

    I guess this is an Amber Rudd thing, she will have been told there is a problem with anonymous data, and will have 'tackled' the effect not the cause. UK hasn't had a man Home Secretary since GCHQ obtained powers to spy on brits. Since then, its been a string of inoffensive, GCHQ friendly, women.

  15. Thoughtcrime by mysidia · · Score: 1

    This is basically a thought crime.... Banning the Mining and Analysis of data from multiple sources in order to derive more facts about an event or piece of information?

    1. Re:Thoughtcrime by gurps_npc · · Score: 2

      No. Thought crime does not mean what you think it means.

      Thought crime refers to the practice of making thoughts themselves illegal, not actions. You are arrested not for protesting but instead for not applauding the dear leader and telling him how great he is.

      In this case, if they made it illegal for you to know HOW to de-anonymize, that would be a thought crime. But this law does not do that, it criminalizes acting on those thoughts, something very different.

      --
      excitingthingstodo.blogspot.com
    2. Re:Thoughtcrime by Anonymous Coward · · Score: 0

      This is basically a thought crime

      Though not in the Orwellian sense of 'thoughtcrime' obviously.

    3. Re:Thoughtcrime by Anonymous Coward · · Score: 0

      Then what is the meaning behind mysidia's point that: "This is bascially a thought crime"?

    4. Re:Thoughtcrime by Anonymous Coward · · Score: 0

      While I have a moderately good understanding of the writing and thought of George Orwell, the hermeneutics of mysidia's slashdot posts, sadly, falls outside any of my areas of academic expertise.

    5. Re:Thoughtcrime by amorsen · · Score: 1

      if you are sufficiently smart, it criminalizes looking at a bunch of data and thinking about it hard.

      The set of sufficiently smart people is likely to be empty in most cases, but I don't think there's a lower bound on the quality of the anonymization.

      --
      Finally! A year of moderation! Ready for 2019?
    6. Re:Thoughtcrime by Anonymous Coward · · Score: 0

      if you are sufficiently smart, it criminalizes looking at a bunch of data and thinking about it hard.

      No, there's no actus reus, which even strict liability offences --which, jurisprudentially, are already highly suspect if occasionally necessary --require.

      I have not seen the provision in question, It might make collecting and looking at the data you look a crime, more likely it might make reducing the end result of your thought processes to material form a crime, but merely thinking about it, however hard, cannot of itself be a crime.

      The point of 'thoughtcrime' is that it was not a 'crime' (doublethink) in the sense the Law understands that term. Remember one of the main themes in 1984 is the lack of Law. Big Brother represents the executive power of the State, freed from judicial and even legislative oversight. This is a Bill the government is aiming to legislate and is exposing to public comment. However ineffective (looks to be very ineffective), whatever the negative impacts might be (maybe some, but there will be security research exemptions), to describe it as 'thoughtcrime' is silly.

    7. Re:Thoughtcrime by mysidia · · Score: 1

      Thought crime refers to the practice of making thoughts themselves illegal, not actions.

      Right.... And de-anonymizing someone is a thought process. CAUSING IT TO BE KNOWN TO YOU the author behind an anonymized record.

      The action of gathering, analyzing, and writing facts down is not otherwise capable of being a crime.

      My understanding is if you analyze some data through whatever method, and the police interview you, and you admit that you KNOW or have thought out the real name of the person behind any one record, Or you have written down a personal note evidencing your Thoughtcrime, then you could be prosecuted under the new law.

    8. Re:Thoughtcrime by gurps_npc · · Score: 1

      You continue to mistake the evidence for the crime.

      This law makes it illegal to use the de-anonymizer software, an action not knowledge. The knowledge itself is not a crime, it is merely evidence.

      Here is a current law, existing similarlity.

      It is the equivalent of making it illegal to use a password cracker, rather than making it illegal to know someone else's password.

      There is no difference between this and the identity laws being considered.

      The knowledge of the people's identities is merely proof that they used the de-anonymizer. As proof of this, if I gave you an anonymized data about one person, that happens to be me, I have not committed a crime merely by knowing that the data is about me. Nor would you if I told you it was me.

      But if you applies a de-anonymizer to the data and said, "HA!, that person is YOU!", then you have committed a crime.

      But not a thought crime.

      --
      excitingthingstodo.blogspot.com
    9. Re:Thoughtcrime by Capsaicin · · Score: 1

      And de-anonymizing someone is a thought process

      For you perhaps. Most of us mere mortals would use computers and data processing (specifically to be criminalised in the proposed legislation).

      CAUSING IT TO BE KNOWN TO YOU

      There mere fact of an identity becoming, by the unaided powers of mental deduction, known to you is unlikely of itself to attract any liability. Don't fear ... you're safe Sherlock. ;)

      You may, however, commit an offence were you actually to identify (i.e. publish the identity of) any de-anonymised individual (in connection with de-anonymised data). Of course if the idenity became known to you because of data processing you conducted for the purposes of de-anonymisation then you might be guilty of the processing offence.

      Among the new offences proposed there are two relevant for present purposes: 1) intentionally or recklessly re-identifying an individual from anonymised or pseudo-anonymised data (the 'publication' offence) and 2) knowingly handling (a legal term more commonly associated with handling stolen goods) or processing anonymised data for the purposes of de-anonymisation (the 'processing' offence). That at least, in the absence of statutory text, is what I would take from the Minister's statement of intent.

      The "unlimited fine" is remarkable, but is probably intended to capture likely players such as Google.

      --
      Better to be despised for too anxious apprehensions, than ruined by too confident a security. --Edmund Burke
  16. Police state UK by Anonymous Coward · · Score: 1

    So UK wants to expand its plethora of persecution powers.. ..what crime is this criminalization really about, and are they just making shit up? No, this seems to be a rule. A behavior modification.

    I suspect that UK is NOT into privacy rights, but instead, is into policing secrecy, or more to the point, enforcing persecution powers and scheming to control society. Making me think this is just some police state bs.

  17. Murder, Rape and Larceny by Anonymous Coward · · Score: 1

    Let's just criminalize being bad in general

    Yup, that's kinda the whole idea of the criminal law.

  18. This might be a problem for Facebook... by __aaclcg7560 · · Score: 2, Interesting

    From what I read in "Chaos Monkeys: Obscene Fortune and Random Failure in Silicon Valley" by Antonio Garcia Martinez, Facebook takes its own data and combines it with third-party data to create profiles on every user, whether logged in or browsing anonymously.

    1. Re:This might be a problem for Facebook... by Anonymous Coward · · Score: 1

      Don't upmod. Look at the damn link. It's an obfuscated affiliate link, again.

      This is against the terms of use and the CFAA. It's a damn redirection attack. This user really needs to be banned.

    2. Re:This might be a problem for Facebook... by Anonymous Coward · · Score: 0

      Here's the direct link!!

      Don't feed the whale, folks. It needs to learn to hunt on its own.

    3. Re:This might be a problem for Facebook... by AmiMoJo · · Score: 1

      I've long been interested in fighting back by poisoning these commercial databases with fake profiles and misinformation, but it's hard to know what is effective because it's all trade secrets.

      If a company you target goes bust, it's very hard to know if it was because their database became worthless due to pollution or if they were just incompetent or had a worthless product.

      --
      const int one = 65536; (Silvermoon, Texture.cs)
      SJW, n: "Someone I don't like, and by the way I'm a fuckwit" - AC
    4. Re:This might be a problem for Facebook... by Anonymous Coward · · Score: 0

      You're almost as delusional as creimer. What do you think your ppb or at best ppm-level "poison" will achieve? Go back to sleep.

    5. Re:This might be a problem for Facebook... by Anonymous Coward · · Score: 0

      you sound bitter, honey bunny

    6. Re:This might be a problem for Facebook... by Anonymous Coward · · Score: 0

      you sound autistic, Rain Man

    7. Re:This might be a problem for Facebook... by Anonymous Coward · · Score: 0

      I've read it too; I think that's where you got your erroneous definition of "fuck you money". You might want to work on your reading comprehension. With your obvious lack of skill in writing, maybe you have an equal lack of skill in reading.

    8. Re:This might be a problem for Facebook... by Carewolf · · Score: 1

      From what I read in "Chaos Monkeys: Obscene Fortune and Random Failure in Silicon Valley" by Antonio Garcia Martinez, Facebook takes its own data and combines it with third-party data to create profiles on every user, whether logged in or browsing anonymously.

      At already is, this has already been illegal in all of the EU for 20 years. This is just a UK specific version of it. So nothing really changes.

    9. Re:This might be a problem for Facebook... by Anonymous Coward · · Score: 0

      you sound bitter, honey bunny

  19. This empowers the Individual. by Anonymous Coward · · Score: -1

    The extreme focus on privacy disempowers ordinary people from making their on inquiries.

    Leftist hysteria! All this is about it us making good on our election promises ... because that's what we Conservatives do. This was part of the Manifesto upon which we were elected and the purpose is the very opposite of your fevered misinterpretation. Did you even bother to read the Bill's SoI (linked to in the summary)?

    We will protect privacy, strengthen rights and empower individuals to have more control over their personal data by providing easier access. Individuals will generally have more control over their digital footprint, their personal data, how it is used and passed on by companies. Specifically, UK citizens will be better protected by a combination of new and strengthened existing rights: Privacy ... Improved data access ... Data portability ... Right to be forgotten ... Profiling ...

    This gives the Individual real control over what can be done online with their personal information: it gives the Individual access to information about what kind of personal data is being used, how that data is being used, and the means to limit such use, --while still recognising the need for commercial and scientific data sharing as we move forward.

    It has not been easy, but this Bill strikes the ideal balance between the needs of the digital economy, upon which our future prosperity depends, and the Rights of Individuals to have their privacy and specifically personal data respected, to be protected from identity theft and other potential misuse. It is the gold standard for data use and data protection globally. I'm terribly sorry, but the real world is a little more complicated than your simplistic socialist (or is it anarchist?) world-view might allow. This is what good government looks like.

    Now back to your previously scheduled cyber-anarchist group think ...

    1. Re:This empowers the Individual. by mrthoughtful · · Score: 2

      Your assumption that the views of the parent are leftist do more to betray your own ideology than cast any light on the author.
      Meanwhile, the lack of technical content and complete lack of reasoning in your narrative, mixed with declarative rhetorical statements strongly suggests that the Conservatives suit you down to the ground.

      Regardless, and in light of your fascination with politics, I strongly recommend you read Jonathon Haidt's well-received book "The Righteous Mind: Why Good People are Divided by Politics and Religion". Not because I want you to shift your political views - but merely so that you can understand why some great thinkers, scientists, philosophers, (and yes, morons) vote Left. The book is ingenious in that it allows us to empathise and relate to each side of the political (and religious) divide in a meaningful and well structured manner.

      As for the business of criminalising reversing anonymisation, I agree, it's a good idea in principle, but it is essentially a straw man: The exemptions will include the police and intelligence services, who don't break domestic laws by spying on their neighbours, but then swap the data over. Meanwhile, big business (e.g., the likes of Facebook, etc) don't need to even try to reverse anonymity - they already know more about you than your mother does, and for all the wrong reasons.

      One of the difficulties facing the challenge of modern PI obfuscation is that it's pretty trivial to reverse anonymity, which itself makes it very hard to develop clinical environments for social and medical research. Take, for instance, a clinical trial: If the sponsor (the pharmaceutical company) is able to identify an individual patient engaged in the trial, then the trial has, essentially, failed (Why? Because there is no way of subsequently demonstrating that the sponsor has then not used a back-channel to skew the data), which can be very expensive indeed.

      This set of laws does very little to address those issues - because it's making it illegal to reverse anonymity - a bit like locking the door after the horse has bolted.

      Instead, it would be far more useful to develop and publish a set of standards for anonymising data (and many other aspects of the IT industry), just as we find in e.g. the construction industry. The difficulty with that is that the big players (the likes of Oracle, Microsoft, and so on) use their significant lobbying power to provide standards that implicitly require a lock-in to their own platforms. (We can see analogous examples of this in, for instance, MOD field and operations computers which are often stuck to running Windows 95).

      It's early days - we are still very much in the cowboy era of the 'new frontier'. Legislation, and the legislative process altogether is ineffective and inefficient as a means of mitigation, because technology is changing far too rapidly for legislation to ever catch up. Try Charlie Stross' text: Accelerando as a great (and entertaining) source for this. (Free, as in beer, copy: http://www.antipope.org/charli... )

      --
      This comment was written with the intention to opt out of advertising.
    2. Re:This empowers the Individual. by Anonymous Coward · · Score: 1

      ... suggests that the Conservatives suit you down to the ground.

      With all due respect, having written that opening paragraph you could scarcely proceed to pen the next without exposing yourself to a charge of hypocrisy. Your objection to a party making good on its election promises, however, is noted. To put invective to one side and proceed to matters of substance ...

      As for the business of criminalising reversing anonymisation ...

      At the risk of drifting off-topic, I was not addressing that point in particular, but rather OP's assertion that: "The extreme focus on privacy disempowers ordinary people from making their o[w]n inquiries" The quote at the head of my post ought to have made that clear.

      Even without consulting the authoritative document linked to in the summary, that is relying instead on the 'bleepingcomputer' article, OP would have been made aware the the present Bill makes provision, inter alia, to:

      > Make it simpler to withdraw consent for the use of personal data
      > Make it easier and free for individuals to require an organization to disclose the personal data it holds on them
      > Allow people to ask for their personal data held by companies to be erased
      > Require ‘explicit’ consent to be necessary for processing sensitive personal data
      > Enable parents and guardians to give consent for their child’s data to be used
      > Expand the definition of ‘personal data’ to include IP addresses, internet cookies and DNA
      > Make it easier for customers to move data between service providers

      In light of those proposed changes, even a hyper-partisan Corbynite would need to recognise the accusation of "disempower[ing] ordinary people from making their o[w]n inquiries" is breathtakingly absurd.

      I do take your point, however, and it is perhaps instead a cowboy mentality we are dealing with here. Of one thing we can be certain: The moderation of this counterfactual twaddle as 'Insightful' evidences the most remarkable groupthink here at this 'new-frontier.'

    3. Re:This empowers the Individual. by AmiMoJo · · Score: 2

      This isn't about privacy really, it's to help facilitate business. The government sees big data as a growth area, but there are legal problems with sharing the data. By making de-anonymization illegal they can give their usual "don't worry, safeguards are in place" message and then let the orgy of personal data mining commence.

      In other words, it's actually anti-privacy.

      --
      const int one = 65536; (Silvermoon, Texture.cs)
      SJW, n: "Someone I don't like, and by the way I'm a fuckwit" - AC
    4. Re:This empowers the Individual. by Bongo · · Score: 1

      Thanks for the book ref. From the wiki summary it sounds similar to the issue that, as minds develop, they take on the habit of looking at multiple perspectives (and some psychologists/philosophers call this "vision-logic"), where no one perspective is right or wrong, so what you do is take as many perspectives as you can, and then integrate them (so arriving at a more useful perspective -- rather than postmodernism which gets stuck in, "well if all perspectives could be taken, then none are true, and so there are no truths" (not integrating but disintegrating/deconstructing)).

      As for banning de-anonymisation, well surely that needs to apply to the methods used for anonymising, which can be awful -- take for example people who happen to live in a very remote area, so their postcode alone identifies them.

      As one of the replies said, this sounds more like it is about providing "procedures" which show "compliance" whilst continuing to hoover everything up.

  20. You won't believe who submitted this artice! by Anonymous Coward · · Score: 0

    "An anonymous reader writes: "

    Actually, they're not anonymous, it's really easy to show that they're...

    Hang on, there's a black helicopter landing in my garden, be right back

  21. "despite leaving the European Union" by Anonymous Coward · · Score: 1

    The UK is still a full member of the EU. We're not due to leave for at least another 18 months, assuming it doesn't get delayed, or the decision to leave reversed.

  22. Irony by Rande · · Score: 2

    And just the other day, the head of GCHQ was complaining that he couldn't hire hackers with previous experience and that the schools weren't turning out students who knew how to do unexpected things with computers.

  23. This has the usual issue by Chrisq · · Score: 1

    A UK user could be re-identified in another country. For some reason the UK government can't get its head round the fact that the internet is international. Looking at the crimes which can be tried in the UK when committed abroad I think that someone from the UK could even just pop over to France or Ireland, identify somebody, then pop back and they couldn't do anthing

    1. Re:This has the usual issue by dunkelfalke · · Score: 1

      Americans simply don't get privacy, preferring to jizz over their firearm and free speech laws instead.

      Your example is stupid because
      1) France and Ireland both have reasonably strong privacy laws.
      2) Advertisers that have a business in the UK who would target a UK citizen using re-identified data, would break the law, hence even if they had re-identified a UK user abroad, this data would not do them any good.

      --
      "It's such a fine line between stupid and clever" -- David St. Hubbins, Spinal Tap
  24. On her Majesty's secret service ... by Anonymous Coward · · Score: 1

    ... this is actively used to identify persons of interest. So criminalize re-identification of anonymized user data would become a state privilege?

  25. 'despite leaving the EU' by Anonymous Coward · · Score: 3, Informative

    We haven't left yet. We won't leave til 2019 at the earliest.

  26. You can tell this is an American site by Anonymous Coward · · Score: 5, Informative

    "Recently, despite leaving the European Union"

    Fucking ignoranace at the highest level

    1. Re:You can tell this is an American site by Ryanrule · · Score: 0

      fuck you brit fuckwit.

    2. Re:You can tell this is an American site by Anonymous Coward · · Score: 0

      Leave is a verb. The UK is leaving the EU. The UK has not left. The sentence is grammatically correct. It might be a little misleading, but there's no need to go full douchenozzle.

  27. If it weren't for those meddling kids... by dyfet · · Score: 1

    ...and their dog too. Oh, if only there was a law to make uncovering illegal.

  28. Criminalizaing showing vulnerabilies? by evolutionary · · Score: 1

    Sounds a lot like the UK government actually WANTS to keep those weaknesses. Wonder if some were built in. Hmmm.

    It may sound far fetched, but what other sane reason would you try to prevent people finding weakness, thus enabling them to be fixed? Unless this is a conspiracy to keep "backdoors" in the process of anonymizing data, it's just encouraging people to find those vulnerable points and NOT report them. Hackers much be laughing their butts off.

    --
    "Imagination is more important than knowledge" - Einstein
  29. Re:Does the "UK" not realize this is their problem by Applehu+Akbar · · Score: 2

    Why is UK law relentlessly criminalizing everything except actual criminality? One of the major things the UK does criminalize is fighting back against criminals. Small wonder that gangs of kids on mopeds are ripping down London's sidewalks, snatching phones, purses and briefcases from pedestrians - and there's nothing that people can do about them.

  30. How. Literally how. by sandbagger · · Score: 1

    If someone posts something on-line and it contains enough information to make identification likely if not probably, how is a third party reading it somehow culpable for making an elementary inference or deduction?

    Moreover, are they seriously going make illegal the cross referencing of public information?

    --
    ---- The above post was generated by the Turing Institute. Maybe.
    1. Re:How. Literally how. by bluefoxlucid · · Score: 1

      It's a "don't-peek" law I guess.

      I like it. It needs a clause to exempt all attempts to break the anonymization "by any party for the purpose of research into anonymization and the validation of strength of anonymization itself" so as to ensure re-identification to identify (and retention of re-identified data) is an offense whereas re-identification to show that it can be done and how is perfectly-legal.

      --
      Support my political activism on Patreon.
  31. Is there anything the UK won't try to criminalize? by OneHundredAndTen · · Score: 1

    That country seems to be in the hands of yahoos, nitwits and tinpot despots wannabees these days.

  32. Old as time by Anonymous Coward · · Score: 0

    Time and again neuronally challenged "law makers" dive into the same cesspit: outlaw xxx and only outlaws will have xxx.

  33. I'll Do Any Math I Want To by Anonymous Coward · · Score: 0

    Thanks, and fuck off.

  34. This is why by JohnFen · · Score: 1

    Any time someone talks about how some data collection is OK because it's "anonymized", the only logically correct reaction is laughter.

    Modern databases and analytics has ensured that it is literally impossible to effectively anonymize data while still retaining the usefulness of the data.

  35. uh oh by micahraleigh · · Score: 1

    Does Susan Rice know about this?

    How is the government supposed to help the democratic process?

    Why can't we build wonderful countries like Venezuela?

  36. Brilliant idea! by ilsaloving · · Score: 1

    Now the crooks can continue doing what they're doing unimpeded, meanwhile security professionals get their hands tied behinds their backs and anonymization techniques can be used regardless of how flaws they are.

    I have this great method for anoymization, based on the tried and true ROT13 encryption algorithm. And if anyone cracks it, I can lay charges instead of wasting time wondering if my entire process is horribly broken.

  37. This is to protect the MPs themselves I think by Anonymous Coward · · Score: 0

    .. imagine their embarrassment when a security research might de-anonymize their own browsing history, correspondence with corporate oligarchs for kickbacks, etc.. if unmasking them by network traffic is made a distinct crime, it'll be harder to expose corruption in politics.

  38. Re:Does the "UK" not realize this is their problem by ckatko · · Score: 4, Insightful

    Guess you guys shouldn't have given up your guns, eh?

    I'll never be able to figure out how liberals think gun ownership is pointless when you have a police force (actual US supreme court justice dissenting opinion in D.C. v Heller), but at the same time think the police force is inept and the bastion of racism and sexism.

    Which is it? Can we depend on them or not? Why would you take all the guns away from people, and then give them to the people accused of shooting blacks for fun? Wouldn't it make more sense to give citizens the right to defend themselves--even from corrupt cops and corrupt "institutions"?

  39. How odd... by fish_in_the_c · · Score: 1

    Let me think this out a minute.
    Someone points out that something can be done by criminals and should be fixed.
    So you make it illegal for them to point it out?
    Is that kind of like making it illegal to speak up about 'the emperor's new cloths'(https://en.wikipedia.org/wiki/The_Emperor%27s_New_Clothes).

    seriously, let's make it illegal then only criminals can do it.
    (I guess it makes it easier for the black ops guys that you own ) .

    --
    âoeTolerance applies only to persons, but never to truth. Intolerance applies only to truth, but never to persons.
  40. Good Concept, Backdoored Implementation by EndlessNameless · · Score: 1

    Prohibiting re-identification for profit, political, etc purposes is an excellent idea. I was actually excited when I saw the headline.

    But if they block researchers and disclosure of methods, then how will anyone ever know if re-identification is happening or even possible? How could we assess the risk of re-identification by malicious actors? What can we do to protect our personal privacy, our users, and our networks without detailed technical information?

    The proposed law may protect citizens from corporate abuse, assuming it is enforced uniformly. But it also gives government agencies and organized criminals considerable leeway to develop capabilities without public oversight or defensive barriers/mitigations.

    The only thing worse than no law is a backdoored law.

    --

    ---
    According to the latest ruleset, this post should be modded as Vorpal Flamebait +5.
  41. Re:Does the "UK" not realize this is their problem by JohnFen · · Score: 1

    Why is UK law relentlessly criminalizing everything except actual criminality?

    Fraud isn't criminality?

    If I agree to share personal data because I was told it was anonymized, and it is later de-anonymized, I have been defrauded.

  42. tearing a page from the Hermit Kingdom by epine · · Score: 1

    Tear a page from the Hermit Kingdom, and what you end up building will have the same level of intrinsic merit: a privacy shroud that could be broken by an ambitious elementary school kid.

    I, for one, welcome our new mules.

  43. This is a GOOD idea by mrwireless · · Score: 1

    I am a privacy researcher.

    Aside from the "not even research is allowed" bit, this is a good idea.

    Currently most people believe anonymisation is possible. Just the noise around this law might help most policymakers understand that the real question is 'for how long do we believe we can make this anonymous'.

    This post almost feels like a hit job: the idea is placed in a very negative light with a lot and mostly negative comments straight away.

    You'd think the people on Slashdot would also understand the problem this law tries to address. Big databrokers are bringing together so many datasets that, once overlapped, the k-anonymity levels of each of those datasets might not be sufficient.

    Any privacy solution will have to be a combination of both technological AND judicial protections. (And public awareness)

  44. Re:Does the "UK" not realize this is their problem by Anonymous Coward · · Score: 0

    Thinking critically is hard for them.