8 ms·

-Anecdotally, at a former employer we had an annual questionnaire used to estimate how content we were. The results, we were assured, would only be used in agg

• omegalulw 5y ago
  Isn't this a trivial example though? You require bucket size >= 10 say. Full on differential privacy is meant to address harder problems. For example, if you assume that there was a minor bug and people were asked to take the mandatory yearly survey again in a week. Now if you assume that the responses of people who responded before will stay the same when they re-respond, then by taking the difference between both results you can identify some specific people by looking at which bucket counts changed - this would be how the new guy who joined in that week voted. Differential privacy techniques are meant to anonymise data in way that you can't even do this.
  • musingsole 5y ago
    It's trivial to fix in retrospect, nearly impossible to anticipate all similar corner cases ahead of time, and -- most importantly -- indicative of the type of logical bugs our systems of the world have that permit hacking from script-kiddies to state actors.
    • saghm 5y ago
      It may be nearly impossible to anticipate _all_ corner cases, but come on, GP was talking about there only being a sample size of 1; this is super easy to notice and then just not include in the results.
• sqrt17 5y ago
  At our (fairly large) company, you can query by team (and maybe job role) but it will hide responses where the sample size is smaller than a set number (I think 8 or 10). So yes it can be done but people have to actually care about it. The cautionary tale about k-anonymity (from Aaron Schwartz's book I think) is when the behavior of aggregates is also something that should be kept privates - the example was that the morning run of an army base in a foreign country was revealed because enough people did this with their smartwatches on that it formed a neat cluster.
  • teraku 5y ago
    In Germany (I think all of the EU), a dataset can only be published if the sample size is at least >=7.
    • williamtrask 5y ago
      Just fwiw sample size isn’t a robust defence against this kind of attack. Check out Differential Privacy.
  • ocdtrekkie 5y ago
    More details on the Strava Run incident: https://www.bbc.com/news/technology-42853072 https://www.bbc.com/news/technology-42853072
  • pfraze 5y ago
    Isn’t location data particularly easy to de-anonymize? I remember reading some research that because people tend to be so consistent with their location, you could deanonymize most people in a dataset with 3 random location samples through the day
    • morganherlocker 5y ago
      This is likely the paper you are referring to: https://www.nature.com/articles/srep01376 https://www.nature.com/articles/srep01376 It states that 95% of people can be identified from just 4 location samples.
• AstralStorm 5y ago
  Even without sample size having these aggregated results makes it very easy to predict who picked what with a modicum of extra information. (Even silly binned personality type.)
• rotten 5y ago
  Never answer those honestly. More than half the time they aren't there to "help management understand how to do better", rather to purge people who aren't happy. "We don't need employees who don't love it here."
  • lb1lf 5y ago
    -Oh, we were already deemed beyond redemption - we'd been a small company, quite successful in our narrow niche, only to be bought up by $MEGACORP. That was a culture clash. Big time. Nevertheless, I thought the same thing you did and filled in my questionnaire so that my answers created a nice, symmetrical pattern - it looked almost like a pattern for an arts&crafts project...
  • vorpalhex 5y ago
    I always say I am unhappy and would take another offer in a heatbeat, and so far that strategy has worked well for me - I usually get offered a good salary bump amd bonus every year. Obviously YMMV.
• AlexTWithBeard 5y ago
  Can confirm. I used to have a team and at some point they all had to submit their feedback on my performance. The answers were then fed back to me unattributed, but it was pretty obvious who wrote what.
  • vanusa 5y ago
    And - were there "consequences" for these people?
    • AlexTWithBeard 5y ago
      No consequences. There was nothing I didn't know before. EDIT: I first wanted to say that in any way there would be no consequences, but "there will be no consequences no matter what people write about me" is probably too strong of a statement for anyone to make.
      • ipaddr 5y ago
        Were there positive comments you didn't expect?
        • AlexTWithBeard 5y ago
          Kinda. I expected some people to leave a good feedback, but theirs was way beyond my expectations.