3 ms·

Why don't you include a step where you ask patients if they're ok with their medical history being put in a public s3 bucket? I'm fully supportive of the right

Why don't you include a step where you ask patients if they're ok with their medical history being put in a public s3 bucket? I'm fully supportive of the right to pseudonymous speech, but it strikes me that you are in an awfully awkward position of speaking anonymously while demanding that you should have access a trove of patient history without signing any sort of data use agreement and without even the most basic step of getting permission from the people whose patient history you insist on seeing.

rvnx 5y ago
Ok, why not, this is what I propose: Asking the user: "This record is going to be shared publicly, do you agree to share this information (without revealing your name and address) ? > [...] This information can help researchers, doctors and people interested into science to discover new information about drugs and diseases interaction."
- ceejayoz 5y ago
  Cool. Now you’ve got a whopping pile of selection bias added to the dataset.
  - rvnx 5y ago
    Yeah, useful selectors for researchers, and still no identity. We learnt that somewhere there is a man/woman that is depressed and has weight management issue. We can take policy actions in order to improve the situation and monitor how this affects life of people (e.g. how much antidepressants are used in a year, are the food policies effective, what conditions are often linked to sudden cardiac arrest, etc). And "Rebecca", nobody knows it's her, except herself, and those to whom she decide to publicly disclose her conditions (e.g. on social networks or to specialists).
    - ceejayoz 5y ago
      No, you’re missing the point. Asking people in the study if it’s OK to release their data means the resulting data set is skewed. People with certain conditions and other variables will be more or less likely to agree, leaving a non-representative sample of the actual study. It will no longer be random.
      - throwawaygh 5y ago
        Exactly. Actually, set aside consent entirely. The problem is NOT "how do we de-anonymize". That is super easy. The problem is "how do we de-anonymize IN A WAY THAT LEAVES RESULTS OF RELEVANT STATISTICAL TESTS INVARIANT". Much harder. Remove a bunch of probably non-random points and make any logisitic regression on that dataset return the same result within some delta. There are trivial impossibility theorems. Really, really trivial. "Left as freshman exercise and if you can't some up with an example maybe step back and stop talking about this topic" trivial. Now, add back consent. "how do we delete a subset of data that is likely not uniformly distributed with respect to risk variables and also de-anonymize the remaining subset of data.... AGAIN, IN A WAY THAT LEAVES RESULTS OF RELEVANT STATISTICAL TESTS INVARIANT". The position is untenable.
- throwawaygh 5y ago
  And how do you ensure that statistical tests on the original data set are INVARIANT TO THE DE-ANONMYIZATION PROTOCOL WITH RESPECT TO ANY RELEVANT QUERY? That is WAY harder that it sounds. When you add public disclosure of mismatch between results on public data and private (full) data things are even harder. Specifically: suppose an independent researcher determines X is true via statistical test Y on the public dataset. Officials must respond, and say "True" or "False". A small number of queries via this process can be used to infer data that makes re-identification possible. And there will be many more than a small number of queries, including from adversarial agents specifically designing queries to maximize information gain based on previous (public) revelations. This is a game, in the game theory sense, in which the goal is to exploit the mathematical properties of statistical tests and social dynamics to force public revelations of binary assessments that yield information about individual cells or sets of cells and make re-id possible. Have you actually studied this stuff, designed de-anonymization protocols, developed re-id threat models, thought about privacy budgets in public disclosure mandates, and at last put your reputation and your customer's privacy on the line when asserting that your statistical methods are resilient against attacks? Or are you just a jawboning know-it-all anonymous coward without any actual experience balancing privacy against public disclosure? To be honest, all of your posts read like "just stop writing vulnerable software and then there will be no more hackers mmmkay?"

rvnx 5y ago

Ok, why not, this is what I propose: Asking the user: "This record is going to be shared publicly, do you agree to share this information (without revealing your name and address) ? > [...] This information can help researchers, doctors and people interested into science to discover new information about drugs and diseases interaction."

ceejayoz 5y ago
Cool. Now you’ve got a whopping pile of selection bias added to the dataset.
- rvnx 5y ago
  Yeah, useful selectors for researchers, and still no identity. We learnt that somewhere there is a man/woman that is depressed and has weight management issue. We can take policy actions in order to improve the situation and monitor how this affects life of people (e.g. how much antidepressants are used in a year, are the food policies effective, what conditions are often linked to sudden cardiac arrest, etc). And "Rebecca", nobody knows it's her, except herself, and those to whom she decide to publicly disclose her conditions (e.g. on social networks or to specialists).
  - ceejayoz 5y ago
    No, you’re missing the point. Asking people in the study if it’s OK to release their data means the resulting data set is skewed. People with certain conditions and other variables will be more or less likely to agree, leaving a non-representative sample of the actual study. It will no longer be random.
    - throwawaygh 5y ago
      Exactly. Actually, set aside consent entirely. The problem is NOT "how do we de-anonymize". That is super easy. The problem is "how do we de-anonymize IN A WAY THAT LEAVES RESULTS OF RELEVANT STATISTICAL TESTS INVARIANT". Much harder. Remove a bunch of probably non-random points and make any logisitic regression on that dataset return the same result within some delta. There are trivial impossibility theorems. Really, really trivial. "Left as freshman exercise and if you can't some up with an example maybe step back and stop talking about this topic" trivial. Now, add back consent. "how do we delete a subset of data that is likely not uniformly distributed with respect to risk variables and also de-anonymize the remaining subset of data.... AGAIN, IN A WAY THAT LEAVES RESULTS OF RELEVANT STATISTICAL TESTS INVARIANT". The position is untenable.
throwawaygh 5y ago
And how do you ensure that statistical tests on the original data set are INVARIANT TO THE DE-ANONMYIZATION PROTOCOL WITH RESPECT TO ANY RELEVANT QUERY? That is WAY harder that it sounds. When you add public disclosure of mismatch between results on public data and private (full) data things are even harder. Specifically: suppose an independent researcher determines X is true via statistical test Y on the public dataset. Officials must respond, and say "True" or "False". A small number of queries via this process can be used to infer data that makes re-identification possible. And there will be many more than a small number of queries, including from adversarial agents specifically designing queries to maximize information gain based on previous (public) revelations. This is a game, in the game theory sense, in which the goal is to exploit the mathematical properties of statistical tests and social dynamics to force public revelations of binary assessments that yield information about individual cells or sets of cells and make re-id possible. Have you actually studied this stuff, designed de-anonymization protocols, developed re-id threat models, thought about privacy budgets in public disclosure mandates, and at last put your reputation and your customer's privacy on the line when asserting that your statistical methods are resilient against attacks? Or are you just a jawboning know-it-all anonymous coward without any actual experience balancing privacy against public disclosure? To be honest, all of your posts read like "just stop writing vulnerable software and then there will be no more hackers mmmkay?"