5 ms·

There is a possibility to share statistical analysis of data privately. This is the subfield of computer science known as differential privacy, and I bet compan

by j2kun 12y ago

There is a possibility to share statistical analysis of data privately. This is the subfield of computer science known as differential privacy, and I bet companies just looking for trend data (not specific targeting) would be able to benefit from user data without compromising user privacy. In other words, there are good and bad ways to use user data, some of the good ones are provably private, and we shouldn't rule out all data sharing as inherently evil.

rqebmm 12y ago
>we shouldn't rule out all data sharing as inherently evil. I agree. However, that's going to be the knee-jerk reaction for a while precisely because huge entities like Google, NSA, AT&T, Verizon, etc have been doing that data sharing while doing an abysmal job of notifying users about what was happening. Eventually I think we'll settle into a happy medium, but we're in the pushback phase at the moment.
cheatsheet 12y ago
> provably private citation?
- j2kun 12y ago
  http://research.microsoft.com/pubs/74339/dwork_tamc.pdf http://research.microsoft.com/pubs/74339/dwork_tamc.pdf They define the mathematical guarantees on privacy, which are computational guarantees against a polynomial-time adversary trying to distinguish between the analyses of two databases that differ in a single record. I.e., nobody can reasonably tell whether your information is included in the analysis.
  - cheatsheet 12y ago
    I am not particularly looking for a debate today; but this seems to be a disagreement of terms when using the word "provable". Just because a polynomial time algorithm can not be constructed to distinguish a single record does not mean private information can not be derived. I still would prefer a choice in the matter - a required small check box that says "record my data" or "do not record my data" XOR "erase my data". The term 'reasonably' has a very different meaning to me (assuming many unknowns in the future) over the long term. It is either that, or people should literally stop making such a hard line distinguishing person A from person B. If the data is going to be used to make an inference from the collective to the individual, and it doesn't matter whether my data is included or not, well, shrug and thumbs up. It really depends on the context of the application. Does it determine whether my imaginary future children get to go to college or not? The problem with data and private organizations is that we do not know what the data analysis is being used for, and as private citizens we do not have any control over how that data is mathematically reasoned about and qualitatively assessed aside from forging the data itself it (garbage in, garbage out).
    - j2kun 12y ago
      They define what they mean by the word private, and then prove their mechanisms satisfy that definition. It's not a disagreement about the word "provable," it's that you don't agree that their definition of privacy is a good definition of privacy. That's fine, but your reason seems suspicious. If they could determine any information about you, then such an algorithm would fail if your data were not collected in the first place. Being able to derive private information implies the ability to distinguish. And I misspoke about polynomial time adversaries. Reading closer it looks like an information theoretic guarantee.
      - cheatsheet 12y ago
        > That's fine, but your reason seems suspicious. I prefer to avoid living my life in a fishbowl. > provably private This does not have a mathematics definition. Private means not accessible to anyone aside from the owner. That is something that is provably private. > information theoretic guarantee This sounds like hand waving to get rid of actual concerns.
        j2kun 12y ago
        Again, you are disagreeing with their chosen definition for a word you prefer to think of in a different way. Maybe you should study the issue instead of griping about how lame their version is. What does accessible mean? Who is the owner of a piece of data? For example, just because of our interaction here, I could probably get a pretty good estimate of your occupation, age, and gender. Is that "accessing" something? If so, does that mean speaking is enough to break privacy? Do you "own" your age and gender? If this conversation is enough for me to determine your age and gender, do you own this conversation?
        cheatsheet 12y ago
        Definitions of words matter when people skim text as to determine how they communicate their opinions, form their opinions, and take action, including writing legislation. If I was actually typing out the opinions of my spouse word for word: whose age combined with my own is divisible by 3, how would that change your view?
oconnore 12y ago
That's all fine, but there is zero evidence that any company is doing that. Furthermore, even if a company was using differential privacy to anonymize data between the collection and the processing step, there is no way to prove that the data is being handled appropriately before and during the collection step. Also, there is no way for a company to prove that they continue to handle data appropriately over time. These tools are super useful for releasing data sets to the public from a trusted source (such as a healthcare provider assisting researchers by releasing cancer data), but that's not what we're talking about here.
- j2kun 12y ago
  It is a new field, I admit, but it shows there's a false dichotomy between privacy and stopping all data collection and analysis. LeapYear Innovations [1] looks like they have some clients who care about differential privacy. [2] [1]: http://www.leapyearinnovations.com/ http://www.leapyearinnovations.com/ [2]: http://www.leapyearinnovations.com/shroudbase http://www.leapyearinnovations.com/shroudbase
  - oconnore 12y ago
    It's not a false dichotomy: most of the time data collection and analysis does not preserve privacy. In all cases, you can't guarantee that. You also didn't respond to this: > Furthermore, even if a company was using differential privacy to anonymize data between the collection and the processing step, there is no way to prove that the data is being handled appropriately before and during the collection step. Also, there is no way for a company to prove that they continue to handle data appropriately over time. Any company using shroudbase can choose to stop using shroudbase at any time, or accidentally introduce a bug into their collection method, or start also saving the data in MySQL at collection time. Tools like that are useful to distribute data from trusted to non-trusted parties. You still have to trust the analytics and advertising companies doing the collection.
    - j2kun 12y ago
      You also can't prove that someone won't poison your soup before, during, or after it was prepared from raw ingredients. But you don't claim either to avoid all soup or die. This is because you can give very good guarantees that if the correct process is followed then that won't happen. This is pretty much how we get by in all areas of life. Trust is a default and it has to be for society to function. If we can back up that trust by provably good protocols, then one must be malicious in order to break the system.

by j2kun 12y ago

rqebmm 12y ago

>we shouldn't rule out all data sharing as inherently evil. I agree. However, that's going to be the knee-jerk reaction for a while precisely because huge entities like Google, NSA, AT&T, Verizon, etc have been doing that data sharing while doing an abysmal job of notifying users about what was happening. Eventually I think we'll settle into a happy medium, but we're in the pushback phase at the moment.

cheatsheet 12y ago

> provably private citation?

j2kun 12y ago
http://research.microsoft.com/pubs/74339/dwork_tamc.pdf http://research.microsoft.com/pubs/74339/dwork_tamc.pdf They define the mathematical guarantees on privacy, which are computational guarantees against a polynomial-time adversary trying to distinguish between the analyses of two databases that differ in a single record. I.e., nobody can reasonably tell whether your information is included in the analysis.
- cheatsheet 12y ago
  I am not particularly looking for a debate today; but this seems to be a disagreement of terms when using the word "provable". Just because a polynomial time algorithm can not be constructed to distinguish a single record does not mean private information can not be derived. I still would prefer a choice in the matter - a required small check box that says "record my data" or "do not record my data" XOR "erase my data". The term 'reasonably' has a very different meaning to me (assuming many unknowns in the future) over the long term. It is either that, or people should literally stop making such a hard line distinguishing person A from person B. If the data is going to be used to make an inference from the collective to the individual, and it doesn't matter whether my data is included or not, well, shrug and thumbs up. It really depends on the context of the application. Does it determine whether my imaginary future children get to go to college or not? The problem with data and private organizations is that we do not know what the data analysis is being used for, and as private citizens we do not have any control over how that data is mathematically reasoned about and qualitatively assessed aside from forging the data itself it (garbage in, garbage out).
  - j2kun 12y ago
    They define what they mean by the word private, and then prove their mechanisms satisfy that definition. It's not a disagreement about the word "provable," it's that you don't agree that their definition of privacy is a good definition of privacy. That's fine, but your reason seems suspicious. If they could determine any information about you, then such an algorithm would fail if your data were not collected in the first place. Being able to derive private information implies the ability to distinguish. And I misspoke about polynomial time adversaries. Reading closer it looks like an information theoretic guarantee.
    - cheatsheet 12y ago
      > That's fine, but your reason seems suspicious. I prefer to avoid living my life in a fishbowl. > provably private This does not have a mathematics definition. Private means not accessible to anyone aside from the owner. That is something that is provably private. > information theoretic guarantee This sounds like hand waving to get rid of actual concerns.
      - j2kun 12y ago
        Again, you are disagreeing with their chosen definition for a word you prefer to think of in a different way. Maybe you should study the issue instead of griping about how lame their version is. What does accessible mean? Who is the owner of a piece of data? For example, just because of our interaction here, I could probably get a pretty good estimate of your occupation, age, and gender. Is that "accessing" something? If so, does that mean speaking is enough to break privacy? Do you "own" your age and gender? If this conversation is enough for me to determine your age and gender, do you own this conversation?
        cheatsheet 12y ago
        Definitions of words matter when people skim text as to determine how they communicate their opinions, form their opinions, and take action, including writing legislation. If I was actually typing out the opinions of my spouse word for word: whose age combined with my own is divisible by 3, how would that change your view?

oconnore 12y ago

That's all fine, but there is zero evidence that any company is doing that. Furthermore, even if a company was using differential privacy to anonymize data between the collection and the processing step, there is no way to prove that the data is being handled appropriately before and during the collection step. Also, there is no way for a company to prove that they continue to handle data appropriately over time. These tools are super useful for releasing data sets to the public from a trusted source (such as a healthcare provider assisting researchers by releasing cancer data), but that's not what we're talking about here.

j2kun 12y ago
It is a new field, I admit, but it shows there's a false dichotomy between privacy and stopping all data collection and analysis. LeapYear Innovations [1] looks like they have some clients who care about differential privacy. [2] [1]: http://www.leapyearinnovations.com/ http://www.leapyearinnovations.com/ [2]: http://www.leapyearinnovations.com/shroudbase http://www.leapyearinnovations.com/shroudbase
- oconnore 12y ago
  It's not a false dichotomy: most of the time data collection and analysis does not preserve privacy. In all cases, you can't guarantee that. You also didn't respond to this: > Furthermore, even if a company was using differential privacy to anonymize data between the collection and the processing step, there is no way to prove that the data is being handled appropriately before and during the collection step. Also, there is no way for a company to prove that they continue to handle data appropriately over time. Any company using shroudbase can choose to stop using shroudbase at any time, or accidentally introduce a bug into their collection method, or start also saving the data in MySQL at collection time. Tools like that are useful to distribute data from trusted to non-trusted parties. You still have to trust the analytics and advertising companies doing the collection.
  - j2kun 12y ago
    You also can't prove that someone won't poison your soup before, during, or after it was prepared from raw ingredients. But you don't claim either to avoid all soup or die. This is because you can give very good guarantees that if the correct process is followed then that won't happen. This is pretty much how we get by in all areas of life. Trust is a default and it has to be for society to function. If we can back up that trust by provably good protocols, then one must be malicious in order to break the system.