4 ms·

That's basically all it took to de-anonymise trips for celebrities using the NYC taxi data[1]. There was some poorly anonymized driver information in there but

That's basically all it took to de-anonymise trips for celebrities using the NYC taxi data[1]. There was some poorly anonymized driver information in there but that wasn't used for tracking the celebrities themselves. [1]: https://gawker.com/the-public-nyc-taxicab-database-that-accidentally-track-1646724546 https://gawker.com/the-public-nyc-taxicab-database-that-acci...

setr 7y ago
Reading your article, that doesn't appear to be a very correct description; The de-anonymization seems to have occurred through two primary aspects: 1. The taxi medallions were extracted due to poor crypto choice (and simple structure of medallion IDs), so you can map from reality -> dataset 2. The celebrities were photographed entering/exiting the taxi, with the medallion captured. If you broke the link -- the taxi medallion -- you wouldn't have de-anonymized trips. And NYC anonymization process clearly (and correctly) intended for that link to not exist. That is, start, end and length was not the key motivators in de-anonymization in this case. However, you can still imagine this data is sufficient to de-anonymize when usage is rare (and you've captured either start or end destination), but otherwise, the taxi data is not indicative of anonymization futility but rather implementation failure.
- morganherlocker 7y ago
  This is not quite incorrect. Some of the NYC taxi re-id demonstrations relied on reversing the hash for medallions, but most have not. In particular, the celebrity tracking did not require the medallion, since each record contains an origin and a destination. The identity of the driver across trips is irrelevant, since it is the passenger who is being tracked. The way this attack worked was to match an origin in the trip dataset to the timestamp on the celebrity photo. This revealed the destination of the trip. In other cases, no photo is necessary (trips originating or ending at a residential address, linked to another sensitive location such as an abortion clinic). There is a lot of research available on this topic. "Unique in the Crowd"[1], published in 2013, found that it takes only 4 GPS locations/timestamps to de-anonymize 95% of the population, with no other metadata. With 2 GPS pings, 50% of trips can be de-anonymized. [1] https://www.nature.com/articles/srep01376 https://www.nature.com/articles/srep01376

setr 7y ago

Reading your article, that doesn't appear to be a very correct description; The de-anonymization seems to have occurred through two primary aspects: 1. The taxi medallions were extracted due to poor crypto choice (and simple structure of medallion IDs), so you can map from reality -> dataset 2. The celebrities were photographed entering/exiting the taxi, with the medallion captured. If you broke the link -- the taxi medallion -- you wouldn't have de-anonymized trips. And NYC anonymization process clearly (and correctly) intended for that link to not exist. That is, start, end and length was not the key motivators in de-anonymization in this case. However, you can still imagine this data is sufficient to de-anonymize when usage is rare (and you've captured either start or end destination), but otherwise, the taxi data is not indicative of anonymization futility but rather implementation failure.

morganherlocker 7y ago
This is not quite incorrect. Some of the NYC taxi re-id demonstrations relied on reversing the hash for medallions, but most have not. In particular, the celebrity tracking did not require the medallion, since each record contains an origin and a destination. The identity of the driver across trips is irrelevant, since it is the passenger who is being tracked. The way this attack worked was to match an origin in the trip dataset to the timestamp on the celebrity photo. This revealed the destination of the trip. In other cases, no photo is necessary (trips originating or ending at a residential address, linked to another sensitive location such as an abortion clinic). There is a lot of research available on this topic. "Unique in the Crowd"[1], published in 2013, found that it takes only 4 GPS locations/timestamps to de-anonymize 95% of the population, with no other metadata. With 2 GPS pings, 50% of trips can be de-anonymized. [1] https://www.nature.com/articles/srep01376 https://www.nature.com/articles/srep01376