Originally published at: https://boingboing.net/2019/07/24/algorithm-can-identify-99-98.html
…
2 Likes
https://www.nature.com/articles/s41467-019-10933-3
Haven’t read it completely yet, but summary doesn’t seem correct. They actually made an algorithm to check if combinations of characteristics are likely to be unique or not. The most important characteristics are stuff like ZIP code and birth date. (If you live in a fairly small town, you are fairly likely to be the only one in that locality born on that exact year/month/day)
7 Likes
They had to publish because to do the research is to realize that criminals and governments already did the research.
Criminals and governments and corporations. In some countries, all three at the same time.
9 Likes
It’s the first thing I think of when I read about “anonymized” data online.
I’ve always been amazed on how accurate these things are.
4 Likes
I’m surprised they bothered with the year. Earlier research on deanonymization didn’t use it. IIRC, it was something like 80% with just birth day, gender, zipcode.
2 Likes
Birthday is much more specific that a lot of other indicators. I feel like in a list of “15 attributes” throwing in birth day among other is like saying we could pick you out of a crowd based if we had “hair color, foot shape and a picture of your fucking face.” There are very few datasets that should be disseminated with birth date. For research and marketing a 1-to-2 year birth range should be plenty to put you in a statistical bucket.
2 Likes
Although the number of attributes is misleading, it helps lay people understand easily how it works.
I guess they are using something similar to this:
https://wiki.mozilla.org/Fingerprinting
Each of the attributes can separate the users, and some of them carry much more information and can discriminate more.
But, even the more inoffensive ones can be enough when combined.
Nothing really new here, beyond a significant speedup to the process.
Custodians of anonymised medical data has recognised this problem for decades. Once you’ve given someone an anonymised data set, you rely on formal agreements to keep it anonymised, rather than the fiction that anonymised data can’t be linked back to individuals.
I did a demonstration many years ago that showed how to take “anonymised” datasets from three geographically related medical institutions and and link these together to produce individually identified data. This re-linkage was actually done live in a 90 minute presentation.
It shocked a lot of people.
2 Likes
This topic was automatically closed after 5 days. New replies are no longer allowed.
