11 ms·

I work for a data privacy startup, and this article unfortunately groups all forms of anonymization together. It is specifically criticizing forms of anonymizat

I work for a data privacy startup, and this article unfortunately groups all forms of anonymization together. It is specifically criticizing forms of anonymization that only treat direct identifiers like names, addresses, and phone numbers. That is usually referred to as "pseudonymization", and they are correct to point out that an only moderately sophisticated attacker can still link people in the dataset using combinations of indirect identifiers like age, birthday, and zipcode. Pseudonymization is a weak form of privacy. More sophisticated methods of privacy also anonymize indirect identifiers, and in some cases personal attributes. They do this by adding noise to the data in such a way that the noise has relatively* minimal impact on the results of computations made over the dataset, but a significant impact on the ability to re-identify someone using indirect identifiers or attributes. *There is always a tradeoff between privacy and utility. The only way to achieve 100% private data is 100% noise, but the privacy-utility tradeoff curve isn't linear, and you can still achieve very good utility and very good privacy in many cases, especially with the best tools. Methods are also improving over time, reducing the impact of the tradeoff.

genewitch 3y ago
In the interest of charitable-ness, can you define "noise" and explain how rudimentary denoising algorithms that have existed since the 1960s can't penetrate it? Time and time again people think they've anonymized data and they're always proven incorrect. Just come to grips with the fact you're participating in the sale of my (or whoever's) private data. Hope you sleep well!
- yowlingcat 3y ago
  > Just come to grips with the fact you're participating in the sale of my (or whoever's) private data. Hope you sleep well! I think it's really sad that the open source community has historically cultivated a culture which doesn't recognize this kind of paranoia as a lack of mental wellness. I think it's because the zealotry comports well with the extreme amount of energy needed to bootstrap the ecosystem into existence. You can care about privacy while being unrealistic about why you don't truly have it and never will, because of how much of a risk it is to the powers that be. You can live in a world ruled by proxy wars between gigantic political superpowers and empires who control the upstream levers of the macroeconomy to ensure that the world will always go in a direction opposite to what you'd prefer it to be. It's been like this for thousands if not tens or hundreds of thousands of years. But moreover, you can and likely do live in a society, full of people who will always value convenience over the freedom you seem to cherish. But even you likely are willing to give up some freedom and privacy for some convenience, unless you employ private security personnel to guard your private compound. And my guess is that if you were inclined in that direction, you wouldn't really be posting on HN. Short of that, to live in a modern society is to some degree accept this compromise and to accept one's own hypocrisy -- and my heart goes out to you as much as to myself because the existential anguish of this never goes away. Nonetheless, it is generally historically accepted that as we grow older, we are to develop the ability to constructively manage around this and gain the wisdom to do so. Perhaps the reason you sarcastically asked GP that you "hope you sleep well" is because you are projecting and you know that you yourself do not. My advice to you and those of your ilk: stop obsessing over theoeretical purity and get on with enjoying your life in the scarce time you have left on this planet. You'll have far less regrets at the end. And you will finally sleep well.
  - Forbo 3y ago
    I'd rather work on building alternatives that respect their users than pay corporations to abuse me, thanks.
    - yowlingcat 3y ago
      I see such attempts as well-intentioned, and while benign, ultimately ineffective. Unless you find a way to make the right way the convenient way, social convergence will be a wind always pushing against you rather than at your back.
- southernplaces7 3y ago
  >Just come to grips with the fact you're participating in the sale of my (or whoever's) private data. Hope you sleep well! What an uncharitable response in that it forecloses on the original commentator even explaining their argument better or clarifying. I mean what? Fuck a bit more honest debate and just jump to pre-assumed moral judgement?
- willseth 3y ago
  "Denoising" algorithms can't remove this kind of noise. It doesn't work like that. You're simply mistaken. Generally the state of the art for adding noise to data is differential privacy or microaggregation. In the case of differential privacy it's typically gaussian or laplacian noise, but it is not a trivial application. Noise applied through microaggregation is not a mathematical function because microaggregation targets k in k-anonymity, and the "noise" can only be measured after treatment, through various distortion measures. My company doesn't sell private data or facilitate the sale of private data. We improve privacy within organizations to reduce the risk of privacy leaks. Data brokers and ad targeters would have no interest in our software. But thanks for the condescending comment!
  - Xelynega 3y ago
    Who do you think "data brokers and ad targets" purchase data from? I don't understand how you could help companies protect the private data they collect from users and think that you're not facilitating the collection and sale of it.
    - ImPostingOnHN 3y ago
      From sources that don't use differential privacy to mask the relevant features. Can you maybe share your mathematical opposition to differential privacy? It's provably effectively.
    - willseth 3y ago
      Almost literally every company with human customers collects user data because it’s necessary to run a business. Very few of those have a business model where the purpose is to profit from the sale of that data. Every one of our customers is treating first party data for first party use cases, which is far more common than buying or selling data. How many companies have prod user data and developers that need an up to date prod-like database? A ton. Many just copy prod and distribute to devs. The good ones try to keep scripts for populating the database with test data up to date, but that’s a nightmare. Anonymization is an elegant solution to this problem. There are countless other use cases where organizations need to use their customer data internally and (should) want to protect identities. Most companies don’t want to sell their user data because they consider it competitive, and most data brokers don’t want to anonymize because why would they if they’re already selling raw data? They aren’t interested in our software because we prevent singling out of identities.
- c0pium 3y ago
  > they're always proven incorrect This is pretty obvious survivorship bias. You think that they’re wrong because you only hear about the cases when they were. There are tons of examples of breaches where the anonymization held up, it’s just that it’s not interesting so nobody talks about it.
  - JohnFen 3y ago
    Umm, yes? If I have a lock on my door that successfully prevented 99 people from breaking in, but one skilled lockpicker subverted it, then my lock has failed.
    - c0pium 3y ago
      That’s the wrong analogy. If 99% of locks are resistant to picking but yours wasn’t, it’s ridiculous to then say that locks don’t work.
      - JohnFen 3y ago
        The analogy isn't that one out of a hundred locks don't work, but the none of the locks work in the face of a skilled attacker that may comprise 1% of the attackers. This isn't saying that locks are worthless, but it is saying that thinking of them as secure is a false confidence. This sort of truth is why there's a saying in the security field that you're at the greatest risk the moment that you think you're secure. In terms of data security, the only way to be actually secure from data leakage is to not be in possession of the data.
        c0pium 3y ago
        That’s simply incorrect. Edit: my source for this is that I have been involved with hundreds of data breaches where the EU was satisfied that the privacy controls were sufficient to say that no personal data was compromised.
        JohnFen 3y ago
Dayshine 3y ago
Pseudonymization is creating a new random identifier and keeping a linking table from those new identifiers to the original identifiers. Pseudonymized data is for all intents and purposes completely anonymous as long as the people you share the data with cannot access the linking table. That constraint can be enforced technically, contractually, or legally, depending on how important the breach would be.
- willseth 3y ago
  It's pseudonymization regardless of the replacement data format. It can be a token, a format-consistent value, e.g. "john.smith@example.com", redacted, etc. All of that is considered pseudonymous. Pseudonymized data is not completely anonymous. For example, your name, address, date of birth, and other identifiable information are likely available in public datasets like property tax records or voter registration data. There are also mostly-legal datasets available for purchase with more complete demographic and personal information. If your birthday, gender, and zipcode are present in the pseudonymized dataset, I have an ~87% chance succeeding in a linkage attack matching you in of those public datasets.
  - Dayshine 3y ago
    If your birthday, gender, and zip code are present in the dataset then it is not Pseudonymized. By definition in any modern privacy specification, the only difference between anonymous and pseudonymous is that you can recover the true identity. I believe a decade plus ago Pseudonymized meant simply making something less identifiable, but not any more.
    - willseth 3y ago
      That's not how the term typically used. Most people will assume you have only protected direct identifiers if you tell them data has been pseudonymized. https://csrc.nist.gov/glossary/term/pseudonymization https://csrc.nist.gov/glossary/term/pseudonymization
      - 3y ago
__MatrixMan__ 3y ago
I'm usually the first to defend the EFF but I agree that they've gone a bit far here. The anonymization script which I wrote for my company just replaces every string in the customer's database with a cryptographic hash--except a list of strings like "failed" and "success". So unless your city is named "success", it's going to be missing from the dataset. It's a bit bewildering to actually run the app in this mode, but here's a lot of diagnostically relevant information you can get out of a database like that. You can even confirm bug fixes. Meanwhile, somebody looking to harm the user would need to already know quite a lot about that user before they could make any use out of such a thing. Good faith efforts to protect user privacy exist, is not helpful to lump them in with the rest like this: > Sometimes companies say our personal data is “anonymized,” implying a one-way ratchet where it can never be dis-aggregated and re-identified. But this is not possible—anonymous data rarely stays this way. Is it not possible, or not common? People need to be informed about how to apply scrutiny to anonymization techniques, not scared into assuming ill intent when they see one.
- candiddevmike 3y ago
  These scripts always have the best intentions but typically end up neglected and suddenly production data is on a dev laptop (at least, in my experience, both as an employee and a customer). Make mock data inputs or snapshot data based on internal/QA usage, please!
- ralferoo 3y ago
  > replaces every string in the customer's database with a cryptographic hash > So unless your city is named "success", it's going to be missing from the dataset. You've made the typical mistake of thinking that just because you've made it harder, you've also made it anonymous. For instance, you might have replaced "Chicago" with 9cfa1e69f507d007a516eb3e9f5074e2, but if for instance a lot of people with that tokenised city name also have transactions for a store that only exists in Chicago, you can infer with a reasonable degree of accuracy the reverse mapping. A couple such data points, and you can be almost certain. If you know when you made a couple of transactions that are in the database, and you can find a set of likely options for each time, and then see what fields they have in common. Once you know your data, you can infer a whole load of the reverse mappings for various fields. If those transactions involve another user, you can start to correlate those mappings with data you know about them, and start to build up a web of transactions that person had even if you don't necessarily know yet who the other users they interact with yet. All this is possible without the use of rainbow tables, but chances are your hash function is a standard one, so with a single known mapping you can work out which hash function you chose, and look for speculative entries in the data. e.g. let's just look for MD5("Chicago"), SHA1("Chicago"), SHA256("Chicago") and see if there are any matches. If there are, we can use that hash function and trivially create a rainbow table for every city in the US, first names, surnames, etc.
chaps 3y ago
That is usually referred to as "pseudonymization" For your world, maybe. For most things with a public face, "anonymization" is what's used, not "pseudonymization". So yes, this article is referring to its more-common use.
Taek 3y ago
> *There is always a tradeoff between privacy and utility. The only way to achieve 100% private data is 100% noise, but the privacy-utility tradeoff curve isn't linear, and you can still achieve very good utility and very good privacy in many cases, especially with the best tools. Methods are also improving over time, reducing the impact of the tradeoff. This is the crux of the problem. In every situation where I've seen it deployed, "anonymization" is as far up the utility curve as the corporate interest can get while still credibly calling their data anonymized. The standards and rules that are in place for restricting what types of data can be called "anonymized" to the public are so far up the utility curve that there's functionally no privacy at all. I don't know what your startup does or what steps it takes to make that tradeoff responsibly, but assuming that you are responsible, you are one of the few, and most of the customers in the world would rather use a client that is using the word "anonymous" more irresponsibly because: 1. they can get away with it 2. there's a lot more business value in obfuscating data as little as possible The EFF article is bang-on here, because the majority of the "anonymization" in the space isn't being done by responsible folks (like yourself, presumably), it's being done by psychopathic business interests.
- willseth 3y ago
  My experience is no different and in fact it’s hard to convince anyone to treat indirect identifiers at all. Everyone wants the bare minimum, which is unfortunate, but understandable for someone trying to run a business. All of our current customers are only using their data internally and anonymizing to protect identities as that data is shared across other internal groups, mostly for testing and analysis. Even protecting only direct identifiers is far more responsible than the vast majority of businesses, though we push for indirect treatment. If you treat indirect identifiers with our system, the minimum level of anonymization would ensure that there are always a minimum of two matching combinations of indirect identifiers, i.e. k=2, for every record in the dataset. This is far from foolproof for preventing data leakage, but it does prevent singling out and provides a lot of protection in the case of breach.
lsh123 3y ago
Re adding noise: https://en.wikipedia.org/wiki/Differential_privacy https://en.wikipedia.org/wiki/Differential_privacy
rendaw 3y ago
The article suggests but does not explicitly describe adding noise, but it doesn't matter because the conclusion is the same: > There is always a tradeoff between privacy and utility. The only way to achieve 100% private data is 100% noise The point is that the people whose data is being "protected" rarely have a say that their data is in the data set in the first place, and to what level their data is noised when it is.
m000 3y ago
Sorry to break you the news, but your employer is probably selling snake oil. And this is exactly the point of the TFA: > However, in practice, any attempt at de-identification requires removal not only of your identifiable information, but also of information that can identify you when considered in combination with other information known about you. So, anonymization may be well intended and sophisticated, but is only effective as long as you control and anonymize all the data available to your adversary. Which you obviously cannot. The best you can achieve with anonymized data is to allow non-malicious users to run some analysis on your data in a controlled environment without exposing them to information they should not see. If that's your employer's business model, well, there may be a market niche for that.
- willseth 3y ago
  I designed our anonymization systems. You clearly have a misunderstanding of the threat model and the treatment methods.
  - m000 3y ago
    Of course I have a misunderstanding. You only shared some very vague statements. Could you share some insight on your threat model and your envisioned use case? TFA is obviously referring to the general case where you can't really put arbitrary restrictions to the adversary.
frankyg 3y ago
> More sophisticated methods of privacy also anonymize indirect identifiers, and in some cases personal attributes. The original datasets are brokered anyway. [citations disclosed]

genewitch 3y ago

In the interest of charitable-ness, can you define "noise" and explain how rudimentary denoising algorithms that have existed since the 1960s can't penetrate it? Time and time again people think they've anonymized data and they're always proven incorrect. Just come to grips with the fact you're participating in the sale of my (or whoever's) private data. Hope you sleep well!

yowlingcat 3y ago
> Just come to grips with the fact you're participating in the sale of my (or whoever's) private data. Hope you sleep well! I think it's really sad that the open source community has historically cultivated a culture which doesn't recognize this kind of paranoia as a lack of mental wellness. I think it's because the zealotry comports well with the extreme amount of energy needed to bootstrap the ecosystem into existence. You can care about privacy while being unrealistic about why you don't truly have it and never will, because of how much of a risk it is to the powers that be. You can live in a world ruled by proxy wars between gigantic political superpowers and empires who control the upstream levers of the macroeconomy to ensure that the world will always go in a direction opposite to what you'd prefer it to be. It's been like this for thousands if not tens or hundreds of thousands of years. But moreover, you can and likely do live in a society, full of people who will always value convenience over the freedom you seem to cherish. But even you likely are willing to give up some freedom and privacy for some convenience, unless you employ private security personnel to guard your private compound. And my guess is that if you were inclined in that direction, you wouldn't really be posting on HN. Short of that, to live in a modern society is to some degree accept this compromise and to accept one's own hypocrisy -- and my heart goes out to you as much as to myself because the existential anguish of this never goes away. Nonetheless, it is generally historically accepted that as we grow older, we are to develop the ability to constructively manage around this and gain the wisdom to do so. Perhaps the reason you sarcastically asked GP that you "hope you sleep well" is because you are projecting and you know that you yourself do not. My advice to you and those of your ilk: stop obsessing over theoeretical purity and get on with enjoying your life in the scarce time you have left on this planet. You'll have far less regrets at the end. And you will finally sleep well.
- Forbo 3y ago
  I'd rather work on building alternatives that respect their users than pay corporations to abuse me, thanks.
  - yowlingcat 3y ago
    I see such attempts as well-intentioned, and while benign, ultimately ineffective. Unless you find a way to make the right way the convenient way, social convergence will be a wind always pushing against you rather than at your back.
southernplaces7 3y ago
>Just come to grips with the fact you're participating in the sale of my (or whoever's) private data. Hope you sleep well! What an uncharitable response in that it forecloses on the original commentator even explaining their argument better or clarifying. I mean what? Fuck a bit more honest debate and just jump to pre-assumed moral judgement?
willseth 3y ago
"Denoising" algorithms can't remove this kind of noise. It doesn't work like that. You're simply mistaken. Generally the state of the art for adding noise to data is differential privacy or microaggregation. In the case of differential privacy it's typically gaussian or laplacian noise, but it is not a trivial application. Noise applied through microaggregation is not a mathematical function because microaggregation targets k in k-anonymity, and the "noise" can only be measured after treatment, through various distortion measures. My company doesn't sell private data or facilitate the sale of private data. We improve privacy within organizations to reduce the risk of privacy leaks. Data brokers and ad targeters would have no interest in our software. But thanks for the condescending comment!
- Xelynega 3y ago
  Who do you think "data brokers and ad targets" purchase data from? I don't understand how you could help companies protect the private data they collect from users and think that you're not facilitating the collection and sale of it.
  - ImPostingOnHN 3y ago
    From sources that don't use differential privacy to mask the relevant features. Can you maybe share your mathematical opposition to differential privacy? It's provably effectively.
  - willseth 3y ago
    Almost literally every company with human customers collects user data because it’s necessary to run a business. Very few of those have a business model where the purpose is to profit from the sale of that data. Every one of our customers is treating first party data for first party use cases, which is far more common than buying or selling data. How many companies have prod user data and developers that need an up to date prod-like database? A ton. Many just copy prod and distribute to devs. The good ones try to keep scripts for populating the database with test data up to date, but that’s a nightmare. Anonymization is an elegant solution to this problem. There are countless other use cases where organizations need to use their customer data internally and (should) want to protect identities. Most companies don’t want to sell their user data because they consider it competitive, and most data brokers don’t want to anonymize because why would they if they’re already selling raw data? They aren’t interested in our software because we prevent singling out of identities.
c0pium 3y ago
> they're always proven incorrect This is pretty obvious survivorship bias. You think that they’re wrong because you only hear about the cases when they were. There are tons of examples of breaches where the anonymization held up, it’s just that it’s not interesting so nobody talks about it.
- JohnFen 3y ago
  Umm, yes? If I have a lock on my door that successfully prevented 99 people from breaking in, but one skilled lockpicker subverted it, then my lock has failed.
  - c0pium 3y ago
    That’s the wrong analogy. If 99% of locks are resistant to picking but yours wasn’t, it’s ridiculous to then say that locks don’t work.
    - JohnFen 3y ago
      The analogy isn't that one out of a hundred locks don't work, but the none of the locks work in the face of a skilled attacker that may comprise 1% of the attackers. This isn't saying that locks are worthless, but it is saying that thinking of them as secure is a false confidence. This sort of truth is why there's a saying in the security field that you're at the greatest risk the moment that you think you're secure. In terms of data security, the only way to be actually secure from data leakage is to not be in possession of the data.
      - c0pium 3y ago
        That’s simply incorrect. Edit: my source for this is that I have been involved with hundreds of data breaches where the EU was satisfied that the privacy controls were sufficient to say that no personal data was compromised.
        JohnFen 3y ago

Dayshine 3y ago

Pseudonymization is creating a new random identifier and keeping a linking table from those new identifiers to the original identifiers. Pseudonymized data is for all intents and purposes completely anonymous as long as the people you share the data with cannot access the linking table. That constraint can be enforced technically, contractually, or legally, depending on how important the breach would be.

willseth 3y ago
It's pseudonymization regardless of the replacement data format. It can be a token, a format-consistent value, e.g. "john.smith@example.com", redacted, etc. All of that is considered pseudonymous. Pseudonymized data is not completely anonymous. For example, your name, address, date of birth, and other identifiable information are likely available in public datasets like property tax records or voter registration data. There are also mostly-legal datasets available for purchase with more complete demographic and personal information. If your birthday, gender, and zipcode are present in the pseudonymized dataset, I have an ~87% chance succeeding in a linkage attack matching you in of those public datasets.
- Dayshine 3y ago
  If your birthday, gender, and zip code are present in the dataset then it is not Pseudonymized. By definition in any modern privacy specification, the only difference between anonymous and pseudonymous is that you can recover the true identity. I believe a decade plus ago Pseudonymized meant simply making something less identifiable, but not any more.
  - willseth 3y ago
    That's not how the term typically used. Most people will assume you have only protected direct identifiers if you tell them data has been pseudonymized. https://csrc.nist.gov/glossary/term/pseudonymization https://csrc.nist.gov/glossary/term/pseudonymization
    - 3y ago

__MatrixMan__ 3y ago

I'm usually the first to defend the EFF but I agree that they've gone a bit far here. The anonymization script which I wrote for my company just replaces every string in the customer's database with a cryptographic hash--except a list of strings like "failed" and "success". So unless your city is named "success", it's going to be missing from the dataset. It's a bit bewildering to actually run the app in this mode, but here's a lot of diagnostically relevant information you can get out of a database like that. You can even confirm bug fixes. Meanwhile, somebody looking to harm the user would need to already know quite a lot about that user before they could make any use out of such a thing. Good faith efforts to protect user privacy exist, is not helpful to lump them in with the rest like this: > Sometimes companies say our personal data is “anonymized,” implying a one-way ratchet where it can never be dis-aggregated and re-identified. But this is not possible—anonymous data rarely stays this way. Is it not possible, or not common? People need to be informed about how to apply scrutiny to anonymization techniques, not scared into assuming ill intent when they see one.

candiddevmike 3y ago
These scripts always have the best intentions but typically end up neglected and suddenly production data is on a dev laptop (at least, in my experience, both as an employee and a customer). Make mock data inputs or snapshot data based on internal/QA usage, please!
ralferoo 3y ago
> replaces every string in the customer's database with a cryptographic hash > So unless your city is named "success", it's going to be missing from the dataset. You've made the typical mistake of thinking that just because you've made it harder, you've also made it anonymous. For instance, you might have replaced "Chicago" with 9cfa1e69f507d007a516eb3e9f5074e2, but if for instance a lot of people with that tokenised city name also have transactions for a store that only exists in Chicago, you can infer with a reasonable degree of accuracy the reverse mapping. A couple such data points, and you can be almost certain. If you know when you made a couple of transactions that are in the database, and you can find a set of likely options for each time, and then see what fields they have in common. Once you know your data, you can infer a whole load of the reverse mappings for various fields. If those transactions involve another user, you can start to correlate those mappings with data you know about them, and start to build up a web of transactions that person had even if you don't necessarily know yet who the other users they interact with yet. All this is possible without the use of rainbow tables, but chances are your hash function is a standard one, so with a single known mapping you can work out which hash function you chose, and look for speculative entries in the data. e.g. let's just look for MD5("Chicago"), SHA1("Chicago"), SHA256("Chicago") and see if there are any matches. If there are, we can use that hash function and trivially create a rainbow table for every city in the US, first names, surnames, etc.

chaps 3y ago

That is usually referred to as "pseudonymization" For your world, maybe. For most things with a public face, "anonymization" is what's used, not "pseudonymization". So yes, this article is referring to its more-common use.

Taek 3y ago

> *There is always a tradeoff between privacy and utility. The only way to achieve 100% private data is 100% noise, but the privacy-utility tradeoff curve isn't linear, and you can still achieve very good utility and very good privacy in many cases, especially with the best tools. Methods are also improving over time, reducing the impact of the tradeoff. This is the crux of the problem. In every situation where I've seen it deployed, "anonymization" is as far up the utility curve as the corporate interest can get while still credibly calling their data anonymized. The standards and rules that are in place for restricting what types of data can be called "anonymized" to the public are so far up the utility curve that there's functionally no privacy at all. I don't know what your startup does or what steps it takes to make that tradeoff responsibly, but assuming that you are responsible, you are one of the few, and most of the customers in the world would rather use a client that is using the word "anonymous" more irresponsibly because: 1. they can get away with it 2. there's a lot more business value in obfuscating data as little as possible The EFF article is bang-on here, because the majority of the "anonymization" in the space isn't being done by responsible folks (like yourself, presumably), it's being done by psychopathic business interests.

willseth 3y ago
My experience is no different and in fact it’s hard to convince anyone to treat indirect identifiers at all. Everyone wants the bare minimum, which is unfortunate, but understandable for someone trying to run a business. All of our current customers are only using their data internally and anonymizing to protect identities as that data is shared across other internal groups, mostly for testing and analysis. Even protecting only direct identifiers is far more responsible than the vast majority of businesses, though we push for indirect treatment. If you treat indirect identifiers with our system, the minimum level of anonymization would ensure that there are always a minimum of two matching combinations of indirect identifiers, i.e. k=2, for every record in the dataset. This is far from foolproof for preventing data leakage, but it does prevent singling out and provides a lot of protection in the case of breach.

lsh123 3y ago

Re adding noise: https://en.wikipedia.org/wiki/Differential_privacy https://en.wikipedia.org/wiki/Differential_privacy

rendaw 3y ago

The article suggests but does not explicitly describe adding noise, but it doesn't matter because the conclusion is the same: > There is always a tradeoff between privacy and utility. The only way to achieve 100% private data is 100% noise The point is that the people whose data is being "protected" rarely have a say that their data is in the data set in the first place, and to what level their data is noised when it is.

m000 3y ago

Sorry to break you the news, but your employer is probably selling snake oil. And this is exactly the point of the TFA: > However, in practice, any attempt at de-identification requires removal not only of your identifiable information, but also of information that can identify you when considered in combination with other information known about you. So, anonymization may be well intended and sophisticated, but is only effective as long as you control and anonymize all the data available to your adversary. Which you obviously cannot. The best you can achieve with anonymized data is to allow non-malicious users to run some analysis on your data in a controlled environment without exposing them to information they should not see. If that's your employer's business model, well, there may be a market niche for that.

willseth 3y ago
I designed our anonymization systems. You clearly have a misunderstanding of the threat model and the treatment methods.
- m000 3y ago
  Of course I have a misunderstanding. You only shared some very vague statements. Could you share some insight on your threat model and your envisioned use case? TFA is obviously referring to the general case where you can't really put arbitrary restrictions to the adversary.

frankyg 3y ago

> More sophisticated methods of privacy also anonymize indirect identifiers, and in some cases personal attributes. The original datasets are brokered anyway. [citations disclosed]