4 ms·

Netflix Prize 2: (Privacy) Apocalypse Now?

16 points by lnguyen 17y ago

jpwagner 17y ago
Does anyone care to keep their movie preferences private? (Let alone the fact that this groups people broadly into demographic clusters and "preferences" are defined vaguely as a rating between 1 and 5.)
- wmf 17y ago
  Some people would be embarrassed to admit that they watched certain movies. Also, maybe Netflix can tell if you're gay.
  - Shamiq 17y ago
    It's a shame that being gay is embarrassing.
    - wmf 17y ago
      That's not what I meant.
    - sofal 17y ago
      There are reasons for wanting to hide that you're gay that don't come from feeling ashamed. For example you could have close friends and family members who have severe homophobia, but whom you actually love and respect (people are multidimensional). It may or may not be inevitable that they'll find out at some point, but you'd rather have some control of when and how. Throwing up your hands and yelling "if you don't accept me for who I am then screw you!" is not the best way to handle these things. I'm not trying to sidetrack the conversation into gay issues. This applies without loss of generality to other personal identity issues that conflict with one's surrounding culture.
- DanielStraight 17y ago
  Yes. I do. I care to keep everything private that I reasonably can. Or rather, I care to be in complete control of what information I release. I decided to use my real name as my screen name. I do so on most sites. If however, I made my screen name aawfafwef but YCombinator was for some weird legal reason required to know my full name, I would not expect to show up on the site identified as Daniel Straight. Any information I provide about which I am not explicitly notified of its publicness I feel should be kept private. I was dissuaded further from trying Mint when I saw that they released aggregated information on customer spending. Even aggregated, they are taking their customers' private banking data and making it available to the public. I don't care if it can't be traced back to the individual. It was a still, in my mind, a breach of privacy. Recent tech history has shown us how un-anonymous anonymized data is. You only have to follow Hacker News or Schneier on Security to know just how often such issues come up. Security and privacy by obscurity are never, NEVER enough. Period.
- nl 17y ago
  It'd be embarrassing if people knew you'd rated "You Got Mail" as 5 stars...
rw 17y ago
This is very convincing. Why did Netflix do it?
- jonmc12 17y ago
  well, they haven't actually started the new contest yet, so the netflix legal dept likely has not put their final stamp of approval.
randomwalker 17y ago
As one of the poeple who broke the anonymity of the first Netflix Prize dataset, here's my take on why this is an issue we should worry about. First, some links: Paul Ohm's paper on the consequences of re-identification for privacy laws and public policy: http://papers.ssrn.com/sol3/papers.cfm?abstract_id=1450006 http://papers.ssrn.com/sol3/papers.cfm?abstract_id=1450006 Ohm's article about Netflix Prize 2: http://freedom-to-tinker.com/blog/paul/netflixs-impending-still-avoidable-multi-million-dollar-privacy-blunder http://freedom-to-tinker.com/blog/paul/netflixs-impending-st... Our FAQ about the re-identification attack on the first dataset: http://www.cs.utexas.edu/~shmat/netflix-faq.html http://www.cs.utexas.edu/~shmat/netflix-faq.html An excerpt from our paper, showing the kind of information you can learn about a person just from movie preferences: First, his political orientation may be revealed by his strong opinions about “Power and Terror: Noam Chomsky in Our Times” and “Fahrenheit 9/11,” and his religious views by his ratings on “Jesus of Nazareth” and “The Gospel of John.” Even though one should not make inferences solely from someone’s movie preferences, in many workplaces and social settings opinions about movies with predominantly gay themes such as “Bent” and “Queer as folk” (both present and rated in this person’s Netflix record) would be considered sensitive. In any case, it should be for the individual and not for Netflix to decide whether to reveal them publicly. A quote from Paul Ohm on why this is problematic even if no one cares about movie privacy: The "accretion problem" is this: once an adversary has linked two anonymized databases together, he can add the newly linked data to his collection of outside information and use it to help unlock other anonymized databases. ... Because of the accretion problem, every reidentification event, no matter how seemingly benign, brings people closer to harm. Had Narayanan and Shmatikov not been restricted by academic ethical standards (not to mention moral compunction), they might have connected people to harm themselves. He then goes on to postulate the "database of ruin": It is as if reidentification and the accretion problem join the data from all of the databases in the world together into one, giant, database-in-the-sky, an irresistible target for the malevolent. At a first reading, this might all sound like science fiction, but it's a lot more plausible than most people think. On my blog http://33bits.org/ http://33bits.org/ I have several more examples of re-identification. And let's not forget that there are companies such as Acxiom and Choicepoint which already specialize in aggregating every available piece of information about people, and then selling it.
- 17y ago
jrockway 17y ago
Sounds like this problem could be eliminated if Netflix simply asked if it was OK to reveal your choices, perhaps in exchange for a free month of service or something. I would be happy to publish my movie preferences -- if someone wouldn't like me because of the movies I've watched and liked, I don't want to know them anyway. (Same goes for anything else; hire me, sleep with me, whatever.)
- frossie 17y ago
  I agree. I think there are really two levels of privacy. I would like to keep my Netflix preferences private in the sense of not posting it on my website (or Facebook or whatever). But, if someone was interested in sinking enough effort to deanonymise me so that they can embarrass me by revealing that despite my sophisticated world-cinema sub-titled exterior I did, in fact, rent Mamma Mia last weekend - well, I would just pity them for not having a life. In other words, privacy through obscurity is probably enough for most people in this case, and so asking people whether they want to opt out of the program is good enough - I think most people would stay in. Netflix can always pick another person in that age/gender/geographical bucket to replace a person who decided to opt out.
  - jrockway 17y ago
    Ah. I would put it on my personal website... but I don't think anyone would actually care enough to read it or investigate it. With 6 billion people on Earth, why would anyone care which movies jrockway watches?
- bdr 17y ago
  Is it possible that this would bias the data so much that it would undermine the contest results?
  - jrockway 17y ago
    Perhaps, but Netflix is already biasing the data. The movies that a user sees depends on their current recommendation algorithm, and that depends on data that is suggested to the user. (When you go to rate a movie, Netflix suggests a rating on top of the widget you use to make your rating. How many users decide to agree with the suggestion instead of making their own decision?)
dfranke 17y ago
My contest entry: 1. Use the given demographic data and LexisNexis to deanonymize the data. 2. Search Facebook, Twitter, message boards, etcetera for movies that they've talked about but haven't rated yet on Netflix. 3. Identify keywords in these posts that indicate positive or negative sentiments. 4. Recommend the movies that they've spoken favorably about.
- JacobAldridge 17y ago
  Or just track down their phone numbers, call them up, and ask them for help. "Hi, this is dfranke. Netflix gave me your details ... kinda ... and I'd like to know what you thought of Napoleon Dynamite?" You could even split the million bucks, and buy them all lattes or something.
  - dfranke 17y ago
    I am so submitting this proposal. In cartoon form.

16 points by lnguyen 17y ago

Does anyone care to keep their movie preferences private? (Let alone the fact that this groups people broadly into demographic clusters and "preferences" are defined vaguely as a rating between 1 and 5.)

wmf 17y ago
Some people would be embarrassed to admit that they watched certain movies. Also, maybe Netflix can tell if you're gay.
- Shamiq 17y ago
  It's a shame that being gay is embarrassing.
  - wmf 17y ago
    That's not what I meant.
  - sofal 17y ago
    There are reasons for wanting to hide that you're gay that don't come from feeling ashamed. For example you could have close friends and family members who have severe homophobia, but whom you actually love and respect (people are multidimensional). It may or may not be inevitable that they'll find out at some point, but you'd rather have some control of when and how. Throwing up your hands and yelling "if you don't accept me for who I am then screw you!" is not the best way to handle these things. I'm not trying to sidetrack the conversation into gay issues. This applies without loss of generality to other personal identity issues that conflict with one's surrounding culture.
DanielStraight 17y ago
Yes. I do. I care to keep everything private that I reasonably can. Or rather, I care to be in complete control of what information I release. I decided to use my real name as my screen name. I do so on most sites. If however, I made my screen name aawfafwef but YCombinator was for some weird legal reason required to know my full name, I would not expect to show up on the site identified as Daniel Straight. Any information I provide about which I am not explicitly notified of its publicness I feel should be kept private. I was dissuaded further from trying Mint when I saw that they released aggregated information on customer spending. Even aggregated, they are taking their customers' private banking data and making it available to the public. I don't care if it can't be traced back to the individual. It was a still, in my mind, a breach of privacy. Recent tech history has shown us how un-anonymous anonymized data is. You only have to follow Hacker News or Schneier on Security to know just how often such issues come up. Security and privacy by obscurity are never, NEVER enough. Period.
nl 17y ago
It'd be embarrassing if people knew you'd rated "You Got Mail" as 5 stars...

rw 17y ago

This is very convincing. Why did Netflix do it?

jonmc12 17y ago
well, they haven't actually started the new contest yet, so the netflix legal dept likely has not put their final stamp of approval.

randomwalker 17y ago

As one of the poeple who broke the anonymity of the first Netflix Prize dataset, here's my take on why this is an issue we should worry about. First, some links: Paul Ohm's paper on the consequences of re-identification for privacy laws and public policy: http://papers.ssrn.com/sol3/papers.cfm?abstract_id=1450006 http://papers.ssrn.com/sol3/papers.cfm?abstract_id=1450006 Ohm's article about Netflix Prize 2: http://freedom-to-tinker.com/blog/paul/netflixs-impending-still-avoidable-multi-million-dollar-privacy-blunder http://freedom-to-tinker.com/blog/paul/netflixs-impending-st... Our FAQ about the re-identification attack on the first dataset: http://www.cs.utexas.edu/~shmat/netflix-faq.html http://www.cs.utexas.edu/~shmat/netflix-faq.html An excerpt from our paper, showing the kind of information you can learn about a person just from movie preferences: First, his political orientation may be revealed by his strong opinions about “Power and Terror: Noam Chomsky in Our Times” and “Fahrenheit 9/11,” and his religious views by his ratings on “Jesus of Nazareth” and “The Gospel of John.” Even though one should not make inferences solely from someone’s movie preferences, in many workplaces and social settings opinions about movies with predominantly gay themes such as “Bent” and “Queer as folk” (both present and rated in this person’s Netflix record) would be considered sensitive. In any case, it should be for the individual and not for Netflix to decide whether to reveal them publicly. A quote from Paul Ohm on why this is problematic even if no one cares about movie privacy: The "accretion problem" is this: once an adversary has linked two anonymized databases together, he can add the newly linked data to his collection of outside information and use it to help unlock other anonymized databases. ... Because of the accretion problem, every reidentification event, no matter how seemingly benign, brings people closer to harm. Had Narayanan and Shmatikov not been restricted by academic ethical standards (not to mention moral compunction), they might have connected people to harm themselves. He then goes on to postulate the "database of ruin": It is as if reidentification and the accretion problem join the data from all of the databases in the world together into one, giant, database-in-the-sky, an irresistible target for the malevolent. At a first reading, this might all sound like science fiction, but it's a lot more plausible than most people think. On my blog http://33bits.org/ http://33bits.org/ I have several more examples of re-identification. And let's not forget that there are companies such as Acxiom and Choicepoint which already specialize in aggregating every available piece of information about people, and then selling it.

17y ago

jrockway 17y ago

Sounds like this problem could be eliminated if Netflix simply asked if it was OK to reveal your choices, perhaps in exchange for a free month of service or something. I would be happy to publish my movie preferences -- if someone wouldn't like me because of the movies I've watched and liked, I don't want to know them anyway. (Same goes for anything else; hire me, sleep with me, whatever.)

frossie 17y ago
I agree. I think there are really two levels of privacy. I would like to keep my Netflix preferences private in the sense of not posting it on my website (or Facebook or whatever). But, if someone was interested in sinking enough effort to deanonymise me so that they can embarrass me by revealing that despite my sophisticated world-cinema sub-titled exterior I did, in fact, rent Mamma Mia last weekend - well, I would just pity them for not having a life. In other words, privacy through obscurity is probably enough for most people in this case, and so asking people whether they want to opt out of the program is good enough - I think most people would stay in. Netflix can always pick another person in that age/gender/geographical bucket to replace a person who decided to opt out.
- jrockway 17y ago
  Ah. I would put it on my personal website... but I don't think anyone would actually care enough to read it or investigate it. With 6 billion people on Earth, why would anyone care which movies jrockway watches?
bdr 17y ago
Is it possible that this would bias the data so much that it would undermine the contest results?
- jrockway 17y ago
  Perhaps, but Netflix is already biasing the data. The movies that a user sees depends on their current recommendation algorithm, and that depends on data that is suggested to the user. (When you go to rate a movie, Netflix suggests a rating on top of the widget you use to make your rating. How many users decide to agree with the suggestion instead of making their own decision?)

dfranke 17y ago

My contest entry: 1. Use the given demographic data and LexisNexis to deanonymize the data. 2. Search Facebook, Twitter, message boards, etcetera for movies that they've talked about but haven't rated yet on Netflix. 3. Identify keywords in these posts that indicate positive or negative sentiments. 4. Recommend the movies that they've spoken favorably about.

JacobAldridge 17y ago
Or just track down their phone numbers, call them up, and ask them for help. "Hi, this is dfranke. Netflix gave me your details ... kinda ... and I'd like to know what you thought of Napoleon Dynamite?" You could even split the million bucks, and buy them all lattes or something.
- dfranke 17y ago
  I am so submitting this proposal. In cartoon form.