3 ms·

Do you have opinions on/is there research regarding how much "fuzzing" you have to do to get substantial rewards in making space/time data anonymous? That is,

Do you have opinions on/is there research regarding how much "fuzzing" you have to do to get substantial rewards in making space/time data anonymous? That is, if my legitimate use for a space/time dataset can stand that data being handled at the resolution of "hours" and "within 100 meters," does it win me significant privacy benefits to scrub out more significant figures?

ProblemFactory 12y ago
There is plenty of good work on anonymising and fuzzing location data. But unfortunately the results show that the amount of fuzzing required for anonymity is huge. "Hours and 100m" are far from enough, only something like "year and state" might work. Some of the notable results are: * Golle and Partridge 2009 (http://xenon.stanford.edu/~pgolle/papers/commute.pdf http://xenon.stanford.edu/~pgolle/papers/commute.pdf) - Just the home and work location at city block level is enough to uniquely identify 50% of the US population. Home and work at zip code level is enough to uniquely identify 5% of US population. Home and work county is still enough to identify 1% of people to a set of 6 candidates. * Montjoye et. al. 2013 (http://www.nature.com/srep/2013/130325/srep01376/full/srep01376.html http://www.nature.com/srep/2013/130325/srep01376/full/srep01...) - If you have a time-location dataset of people with hourly accuracy of time and cell tower accuracy for location (100m in cities, a few km in rural areas), then four randomly picked points for each person uniquely identify 95% of them. Just two randomly picked points for each person uniquely identify 50% of people. The main conclusion is that it is not possible to release an "anonymised" location dataset of people that is still useful for mobility research. The only realistic approach seems to be to have strict privacy regulations and NDAs with people who are given access to this data. But more generally, all research into anonymisation and preventing de-anonymisation is difficult because it's not known what other data sources the attacker has access to. If I have a time-location dataset of anonymous people, and if I see from Facebook when a friend visited Paris and Barcelona, then it becomes trivial to match these dates and cities against the location traces, and find their full movement trace. Similarly, if I can get an anonymous dataset of phone calls, then I can make 20 missed calls at 4am to a friend, and later look for that pattern in the data to find their other calls. The best example of this was from the Netflix dataset of anonymous movie ratings ( http://en.wikipedia.org/wiki/Differential_privacy#Netflix_Prize http://en.wikipedia.org/wiki/Differential_privacy#Netflix_Pr... ) - people were anonymous in their dataset, but some people also rated movies with visible identities on IMDB. Correlating the two datasets allowed researchers to discover the identities of people in the Netflix dataset.

ProblemFactory 12y ago

There is plenty of good work on anonymising and fuzzing location data. But unfortunately the results show that the amount of fuzzing required for anonymity is huge. "Hours and 100m" are far from enough, only something like "year and state" might work. Some of the notable results are: * Golle and Partridge 2009 (http://xenon.stanford.edu/~pgolle/papers/commute.pdf http://xenon.stanford.edu/~pgolle/papers/commute.pdf) - Just the home and work location at city block level is enough to uniquely identify 50% of the US population. Home and work at zip code level is enough to uniquely identify 5% of US population. Home and work county is still enough to identify 1% of people to a set of 6 candidates. * Montjoye et. al. 2013 (http://www.nature.com/srep/2013/130325/srep01376/full/srep01376.html http://www.nature.com/srep/2013/130325/srep01376/full/srep01...) - If you have a time-location dataset of people with hourly accuracy of time and cell tower accuracy for location (100m in cities, a few km in rural areas), then four randomly picked points for each person uniquely identify 95% of them. Just two randomly picked points for each person uniquely identify 50% of people. The main conclusion is that it is not possible to release an "anonymised" location dataset of people that is still useful for mobility research. The only realistic approach seems to be to have strict privacy regulations and NDAs with people who are given access to this data. But more generally, all research into anonymisation and preventing de-anonymisation is difficult because it's not known what other data sources the attacker has access to. If I have a time-location dataset of anonymous people, and if I see from Facebook when a friend visited Paris and Barcelona, then it becomes trivial to match these dates and cities against the location traces, and find their full movement trace. Similarly, if I can get an anonymous dataset of phone calls, then I can make 20 missed calls at 4am to a friend, and later look for that pattern in the data to find their other calls. The best example of this was from the Netflix dataset of anonymous movie ratings ( http://en.wikipedia.org/wiki/Differential_privacy#Netflix_Prize http://en.wikipedia.org/wiki/Differential_privacy#Netflix_Pr... ) - people were anonymous in their dataset, but some people also rated movies with visible identities on IMDB. Correlating the two datasets allowed researchers to discover the identities of people in the Netflix dataset.