de-anonymization (deanonymization)

De-anonymization is a data mining strategy in which anonymous data is cross-referenced with other data sources to re-identify the anonymous data source. Any information that distinguishes one data source from another can be used for de-anonymization. 

As the United States government and other nations move forward with open government initiatives, more data is becoming publicly available over the Internet. Much of this data has been scrubbed to create what the government calls “limited data sets.”  Personally identifiable information (PII) such as names, addresses and social security numbers are removed from limited data sets so that the specific source of the data remains anonymous. This assurance of anonymity protects the source's privacy and allows the government to legally share limited data sets with third parties without requiring written permission. Such data has proved to be very valuable for researchers, particularly in health care. Privacy advocates, however, are concerned that even though the data has been scrubbed, so much of it is available that a specific individual’s identity could be re-discovered.

Although the concept of de-anonymization is not new, the term made headlines in 2006 when Arvind Narayanan and Vitaly Shmatikov entered a contest hosted by Netflix, a popular movie-rental service. Narayanan and Shmatikov applied their de-anonymization methodology to a data set that contained the anonymous movie ratings of 500,000 members and were able to successfully identify Netflix data for a number of specific members. According to Narayanan and Shmatik, de-anonymization requires data that is abundant, granular and fairly stable across time and context.

See also: association rules, business intelligence, opinion mining, OLAP, fuzzy logic

Continue reading about de-anonymization

Arvind Narayanan and Vitaly Shmatikov have published a paper called Privacy and Security Myths and Fallacies of “Personally Identifiable Information.”

SearchSecurity.com has an overview of data privacy laws.