Feeds

Database anonymity at risk, warns researcher

Prof Ohm resists data safety claims

High performance access to file storage

People might be more identifiable than previously thought from supposedly anonymised information contained in large databases, according to a technology law expert. New research recommends that privacy practices and even privacy laws need to change.

Increasing amounts of personal information are collected by organisations and stored in massive databases. That information is sometimes used or released after being stripped of elements that could identify individuals in a process called 'anonymisation'.

University of Colorado Law School Associate Professor Paul Ohm, though, has said that the techniques used no longer work and that it is now possible to identify people from the release of supposedly anonymised records.

"With the supposed power of anonymisation you can share the data with anyone you want, you can store the data for as long as you like," Ohm told podcast OUT-LAW Radio. "And traditionally it has been a conversation stopper. Once you assert anonymisation everyone nods their heads and says 'that's fine, privacy is protected here, let's focus on something else'."

"But even though you are deleting many of the identifying fields of information, everything you leave behind retains identifying power," he said.

Ohm said that research has shown that a combination of increasingly powerful computers and the prevalence of large databases has made it possible to "re-identify" people whose records have been anonymised.

One researcher in Massachusetts about 15 years ago discovered that 87% of Americans are uniquely identified by three pieces of information: their date of birth, their sex and their zip [post] code," he said. "Now the problem was that until she announced her findings, zip code, birth date and sex were three pieces of information that we presumed were privacy-protecting, were anonymised. So they appeared in all sorts of databases."

Ohm told OUT-LAW Radio that the problem was huge because such trust had been placed in anonymisation that it was enshrined in legislation. "Virtually every privacy law allows you to escape the strictures and requirements of the privacy law completely once you've anonymised your data," he said. "Every policy maker who has ever encountered a privacy law, and that's in every country on earth, will need to re-examine the core assumptions they made when they wrote that law."

Ohm said that the problem was hard to solve because the very pieces of information that identify a person are the pieces which are useful to researchers.

He proposed, though, that in some fields of research, such as health, it would be possible to open up much more data than is currently permitted as long as you controlled access to it.

"We can't trust technology any more but at the same time we don't want to keep this information from researchers. So my solution is that we shift our trust from the technology to the people," he said. "We write down the rules of trust among health researchers... [we say] you can get my data but only on a need to know basis."

The anonymisation research can be seen here.

An interview with Prof Paul Ohm can be heard on OUT-LAW Radio here.

Copyright © 2009, OUT-LAW.com

OUT-LAW.COM is part of international law firm Pinsent Masons.

High performance access to file storage

More from The Register

next story
Windows 8.1, which you probably haven't upgraded to yet, ALREADY OBSOLETE
Pre-Update versions of new Windows version will no longer support patches
Android engineer: We DIDN'T copy Apple OR follow Samsung's orders
Veep testifies for Samsung during Apple patent trial
OpenSSL Heartbleed: Bloody nose for open-source bleeding hearts
Bloke behind the cockup says not enough people are helping crucial crypto project
Microsoft lobs pre-release Windows Phone 8.1 at devs who dare
App makers can load it before anyone else, but if they do they're stuck with it
Half of Twitter's 'active users' are SILENT STALKERS
Nearly 50% have NEVER tweeted a word
Windows XP still has 27 per cent market share on its deathbed
Windows 7 making some gains on XP Death Day
Internet-of-stuff startup dumps NoSQL for ... SQL?
NoSQL taste great at first but lacks proper nutrients, says startup cloud whiz
US taxman blows Win XP deadline, must now spend millions on custom support
Gov't IT likened to 'a Model T with a lot of things on top of it'
prev story

Whitepapers

Mainstay ROI - Does application security pay?
In this whitepaper learn how you and your enterprise might benefit from better software security.
Five 3D headsets to be won!
We were so impressed by the Durovis Dive headset we’ve asked the company to give some away to Reg readers.
3 Big data security analytics techniques
Applying these Big Data security analytics techniques can help you make your business safer by detecting attacks early, before significant damage is done.
The benefits of software based PBX
Why you should break free from your proprietary PBX and how to leverage your existing server hardware.
Mobile application security study
Download this report to see the alarming realities regarding the sheer number of applications vulnerable to attack, as well as the most common and easily addressable vulnerability errors.