Politically obligated sharing of Google-scale data for “academic research” & “anti-monopolistic” purposes is a ridiculous, dangerous privacy nightmare, and Lukasz has proven it:
Under the EU Commission’s scheme, search queries are to be handed in a way to make it impossible to identify individual searches … The Commission argues that this makes users “indistinguishable from each other”. I verified this, and found ways to violate these.
Tweet
Tweet Text
The European Commission is ordering Google to share the search data of all Europeans with other companies (AI chatbot makers, search engines, etc.), after a kind of “anonymisation”. I tested it on the real Google data, hundreds of billions of search records. I broke it.
Findings. I singled out the people behind half a million searches, and that only for few countries over one month of August (record isolation). I joined the pieces of search history beyond the defined cap of 3, more than 200,000 sets just for Germany and only in August (linkage). I also confirm that it is possible to perform inference on the dataset, for example concerning health, religion or political opinions. This moves us beyond data protection, and in the national security direction.
Blog
https://lukaszolejnik.com/reports/alone-in-thousand-final.pdf
Previously on Deanonymisation
- https://blogs.lse.ac.uk/impactofsocialsciences/2014/07/16/nyc-improperly-anonymized-taxi-logs-pandurangan/
- https://petrieflom.law.harvard.edu/2013/05/13/online-symposium-on-the-law-ethics-science-of-re-identification-demonstrations/
- https://www.theguardian.com/technology/2006/aug/09/news.usnews
- https://web.stanford.edu/class/cs245/readings/netflix-deanonymization.pdf
- https://www.theguardian.com/technology/2019/jul/23/anonymised-data-never-be-anonymous-enough-study-finds
- …and basically much of the work of the late Prof Ross Anderson: https://www.cl.cam.ac.uk/archive/rja14/
Leave a Reply