Feeds

Scrubbed geo-location data not so anonymous after all

Your commute = your fingerprint

Remote control for virtualized desktops

Anonymized data collected from GPS-enabled devices may not be as anonymous as you think, according to researchers who show that knowing someone's general home and work locations can be enough to identify an individual uniquely.

The findings, by Philippe Golle and Kurt Partridge of PARC, or the Palo Alto Research Center, are significant, given the proliferation of devices that monitor a user's geographic location using global positioning system and other technologies. At the same time, a growing number of websites monitor user location to offer restaurant recommendations and other services.

Frequently, those offering services based on geo-location give assurances that users' privacy is safe because identifying characteristics will be scrubbed from any data stored. Meanwhile, their cell phones, vehicle navigation systems, and even laptops continue to log their comings and goings almost continuously and divulge them to online services.

Of course, one of the two most common locations any person frequents are those of his home and work. What Golle and Partridge found is that attempts to anonymize, or obfuscate, personally identifying information may fall woefully short if a user's residence and office can be deduced.

"Obfuscation techniques which prevent re-identification based on (approximate) home location alone may not be adequate if the subject's (approximate) work location is also known," they write. "In fact, we show that home and work locations, even at a coarse resolution, are often sufficient to uniquely identify a person."

Once a subject's home and work are known, snoops can use data compiled by the US Census Bureau's LEHD, or Longitudinal Employer-Household Dynamics, program, which tracks where people live and work. Although only "privacy-preserving synthetic data" is publicly available for download, Bayesian techniques can be used to work around this limitation.

The findings are reminiscent of the wake-up call that resulted in 2006 when AOL released 20 million search queries from 658,000 users. Although the company took care to remove names and other personal information, the disclosure proved a debacle after privacy advocates showed the data could still be used to identify the people making the searches.

Geo-location data, it seems, might end up being a similar land mine, according to the 33 Bits of Entropy blog, which provides further analysis of the findings. A PDF of the original paper is available here. ®

Internet Security Threat Report 2014

More from The Register

next story
'Regin': The 'New Stuxnet' spook-grade SOFTWARE WEAPON described
'A degree of technical competence rarely seen'
You really need to do some tech support for Aunty Agnes
Free anti-virus software, expires, stops updating and p0wns the world
You stupid BRICK! PCs running Avast AV can't handle Windows fixes
Fix issued, fingers pointed, forums in flames
Regin: The super-spyware the security industry has been silent about
NSA fingered as likely source of complex malware family
Privacy bods offer GOV SPY VICTIMS a FREE SPYWARE SNIFFER
Looks for gov malware that evades most antivirus
Patch NOW! Microsoft slings emergency bug fix at Windows admins
Vulnerability promotes lusers to domain overlords ... oops
HACKERS can DELETE SURVEILLANCE DVRS remotely – report
Hikvision devices wide open to hacking, claim securobods
prev story

Whitepapers

Why cloud backup?
Combining the latest advancements in disk-based backup with secure, integrated, cloud technologies offer organizations fast and assured recovery of their critical enterprise data.
Forging a new future with identity relationship management
Learn about ForgeRock's next generation IRM platform and how it is designed to empower CEOS's and enterprises to engage with consumers.
5 critical considerations for enterprise cloud backup
Key considerations when evaluating cloud backup solutions to ensure adequate protection security and availability of enterprise data.
Reg Reader Research: SaaS based Email and Office Productivity Tools
Read this Reg reader report which provides advice and guidance for SMBs towards the use of SaaS based email and Office productivity tools.
Beginner's guide to SSL certificates
De-mystify the technology involved and give you the information you need to make the best decision when considering your online security options.