3 ms·

Your statement about privacy is already suspect since your opening comment talks about sharing that data. The two are mutually exclusive. As soon as your system

by drakaal 14y ago

Your statement about privacy is already suspect since your opening comment talks about sharing that data. The two are mutually exclusive. As soon as your system is sharing, rather than me sharing I have no privacy.

pyre 14y ago
It depends on the level of 'sharing.' If it's just statistics (e.g. 10% of people that use our service have discovered X disease), then I don't know how much of your privacy is pierced.
- _ihaque 14y ago
  Yes, you have the right idea. Check out our (open-access) paper from last fall: http://www.nature.com/gim/journal/v15/n3/full/gim2012114a.html http://www.nature.com/gim/journal/v15/n3/full/gim2012114a.ht...
- drakaal 14y ago
  I do data mining. Ready here we go. 10% of people who used service discovered they have BrandonWirtz's Disease. Requirements: Male. Primarily Caucasion as primarily limited to Arian Descent. Symptoms onset at 55. Not symptomatic for those with BMI under 22. With this information I can take the 100% and cut the list to 50% that are male. 50% that are caucasion. (25%) Would have already know if they were over 55 so we cut another 25% Strip last names for ones that would not be of the right heritage. Suddenly the eligible candidates are only 12% of the total. I know that 80% of those are the people on that list. That's how mining works. You can't share data anonymously becuase each facet of data allows me more information to piece things together. Sharing has to be opt in. But if it is opt in then it is no longer statiscitally relevant. Because just as an example. People are going to be less apt to share data if they have a disease associated with a stigma. Which will skew the results. [Brandon Wirtz's Disease is an imaginary disease used for demonstration only. I don't have any genes shared with other humans as I am from another planet.]
  - lightcatcher 14y ago
    I'm currently taking a class in data privacy, which is about assessing privacy risks using a mathematically rigorous formalization (differential privacy, see http://en.wikipedia.org/wiki/Differential_privacy http://en.wikipedia.org/wiki/Differential_privacy ) and developing algorithms to allow for minimal risk release of private databases and avoid attacks like yours above. Your post makes it seem like you might enjoy reading more about the field; you should check out this survey of the field: http://www.cs.ucdavis.edu/~franklin/ecs289/2010/dwork_2008.pdf http://www.cs.ucdavis.edu/~franklin/ecs289/2010/dwork_2008.p...
    - drakaal 14y ago
      Those formula's assume the creator knows all the variables. I have data on things like Probablity a First name is of which race. When names started to appear for determining maximum Age. Search data for identifying people who were worried they had a disease. Often a single piece of data will cause the intersection of two traits to be 80% accurate. You can't mathmatically predict these things because you don't know how many factors I have. There are zip codes where only 1 in 100 people are of a given race. There are diseases that only 1 in 100k people have done a search for and only 1 in 500k people have. These kinds of things you can't formulaize.
      - lightcatcher 14y ago
        This is not true at all. Differential privacy works to counteract EXACTLY these types of attacks. There are some very basic proofs that the privacy guarantees of a differential private release mechanism is not at all weakened by external data, such as what you've listed. Differential privacy attempts to minimize the risk of being a row in a database given that the attacker knows the values of every other row (and has whatever external data he wants).
  - pyre 14y ago
    Maybe I'm missing something. How does "10% of our customers have X disease" allow you to get down to a specific person? | With this information I can take the 100% and cut the list | to 50% that are male. 50% that are caucasion. (25%) Would | have already know if they were over 55 so we cut another | 25% Strip last names for ones that would not be of the right | heritage. Suddenly the eligible candidates are only 12% of | the total. | I know that 80% of those are the people on that | list. What list? Are you somehow taking a list of names from outside and correlating them based just on 'X%'?

by drakaal 14y ago

pyre 14y ago

It depends on the level of 'sharing.' If it's just statistics (e.g. 10% of people that use our service have discovered X disease), then I don't know how much of your privacy is pierced.

_ihaque 14y ago
Yes, you have the right idea. Check out our (open-access) paper from last fall: http://www.nature.com/gim/journal/v15/n3/full/gim2012114a.html http://www.nature.com/gim/journal/v15/n3/full/gim2012114a.ht...
drakaal 14y ago
I do data mining. Ready here we go. 10% of people who used service discovered they have BrandonWirtz's Disease. Requirements: Male. Primarily Caucasion as primarily limited to Arian Descent. Symptoms onset at 55. Not symptomatic for those with BMI under 22. With this information I can take the 100% and cut the list to 50% that are male. 50% that are caucasion. (25%) Would have already know if they were over 55 so we cut another 25% Strip last names for ones that would not be of the right heritage. Suddenly the eligible candidates are only 12% of the total. I know that 80% of those are the people on that list. That's how mining works. You can't share data anonymously becuase each facet of data allows me more information to piece things together. Sharing has to be opt in. But if it is opt in then it is no longer statiscitally relevant. Because just as an example. People are going to be less apt to share data if they have a disease associated with a stigma. Which will skew the results. [Brandon Wirtz's Disease is an imaginary disease used for demonstration only. I don't have any genes shared with other humans as I am from another planet.]
- lightcatcher 14y ago
  I'm currently taking a class in data privacy, which is about assessing privacy risks using a mathematically rigorous formalization (differential privacy, see http://en.wikipedia.org/wiki/Differential_privacy http://en.wikipedia.org/wiki/Differential_privacy ) and developing algorithms to allow for minimal risk release of private databases and avoid attacks like yours above. Your post makes it seem like you might enjoy reading more about the field; you should check out this survey of the field: http://www.cs.ucdavis.edu/~franklin/ecs289/2010/dwork_2008.pdf http://www.cs.ucdavis.edu/~franklin/ecs289/2010/dwork_2008.p...
  - drakaal 14y ago
    Those formula's assume the creator knows all the variables. I have data on things like Probablity a First name is of which race. When names started to appear for determining maximum Age. Search data for identifying people who were worried they had a disease. Often a single piece of data will cause the intersection of two traits to be 80% accurate. You can't mathmatically predict these things because you don't know how many factors I have. There are zip codes where only 1 in 100 people are of a given race. There are diseases that only 1 in 100k people have done a search for and only 1 in 500k people have. These kinds of things you can't formulaize.
    - lightcatcher 14y ago
      This is not true at all. Differential privacy works to counteract EXACTLY these types of attacks. There are some very basic proofs that the privacy guarantees of a differential private release mechanism is not at all weakened by external data, such as what you've listed. Differential privacy attempts to minimize the risk of being a row in a database given that the attacker knows the values of every other row (and has whatever external data he wants).
- pyre 14y ago
  Maybe I'm missing something. How does "10% of our customers have X disease" allow you to get down to a specific person? | With this information I can take the 100% and cut the list | to 50% that are male. 50% that are caucasion. (25%) Would | have already know if they were over 55 so we cut another | 25% Strip last names for ones that would not be of the right | heritage. Suddenly the eligible candidates are only 12% of | the total. | I know that 80% of those are the people on that | list. What list? Are you somehow taking a list of names from outside and correlating them based just on 'X%'?