5 ms·

I think it makes a lot of sense to start a register of data providers. I.e. so that if you want to sell user data you have to register as a provider and specify

I think it makes a lot of sense to start a register of data providers. I.e. so that if you want to sell user data you have to register as a provider and specify where the data comes from and what it contains. That'd make it so much easier to critique the possibilities and to further legislate. It'll also allow for independent control of how anonymous data is and independent attempts and de-anonymising the data. I think it's still not well understood by most people just how much can be known about you and it's potential for misuse. I think an initiative like this would go a long way to bridging that gap and to better legislating for it.

gcp 9y ago
It's worth looking at the actual presentation. It looks like they didn't buy the data, but used social engineering attacks.
- usgroup 9y ago
  No they bought the click-through data and then used social engineering attacks and other sources (YouTube, Google, etc) to connect it to other identities.
  - ThePhysicist 9y ago
    Researcher here, `gcp` is correct in that the NDR acquired the clickstream data from a data provider as part of an investigative story (the data was provided as a free sample), the deanonymization was demonstrated by linking individual URLs with publicly available information from various sources (Twitter, Youtube, Google+, ...), though this often wasn't necessary as many users had URLs that contained direct identifiers (e.g. their full name) as part of the URL and that we could use for efficient de-anonymization.
PeterisP 9y ago
That's nothing new, the EU does it this way.
- usgroup 9y ago
  I live in the EU and work in data; there is no requirement to register as a data provider if you're working with customer data. Further, there will not be such as requirement under the GDPR either to my knowledge.
  - simpleigh 9y ago
    If you're a "data controller," then you may be required to register with the local DPA (Data Protection Authority). In the UK, for example [1]: "The Data Protection Act 1998 requires every data controller (eg organisation, sole trader) who is processing personal information to register with the ICO, unless they are exempt. More than 400,000 organisations are currently registered." Whether this registration achieves anything useful is another question. [1] https://ico.org.uk/for-organisations/register/ https://ico.org.uk/for-organisations/register/

gcp 9y ago

It's worth looking at the actual presentation. It looks like they didn't buy the data, but used social engineering attacks.

usgroup 9y ago
No they bought the click-through data and then used social engineering attacks and other sources (YouTube, Google, etc) to connect it to other identities.
- ThePhysicist 9y ago
  Researcher here, `gcp` is correct in that the NDR acquired the clickstream data from a data provider as part of an investigative story (the data was provided as a free sample), the deanonymization was demonstrated by linking individual URLs with publicly available information from various sources (Twitter, Youtube, Google+, ...), though this often wasn't necessary as many users had URLs that contained direct identifiers (e.g. their full name) as part of the URL and that we could use for efficient de-anonymization.

PeterisP 9y ago

That's nothing new, the EU does it this way.

usgroup 9y ago
I live in the EU and work in data; there is no requirement to register as a data provider if you're working with customer data. Further, there will not be such as requirement under the GDPR either to my knowledge.
- simpleigh 9y ago
  If you're a "data controller," then you may be required to register with the local DPA (Data Protection Authority). In the UK, for example [1]: "The Data Protection Act 1998 requires every data controller (eg organisation, sole trader) who is processing personal information to register with the ICO, unless they are exempt. More than 400,000 organisations are currently registered." Whether this registration achieves anything useful is another question. [1] https://ico.org.uk/for-organisations/register/ https://ico.org.uk/for-organisations/register/