Hacker News Reader

Comment by lb1lf | Hacker News Reader

-Anecdotally, at a former employer we had an annual questionnaire used to estimate how content we were.

The results, we were assured, would only be used in aggregate after having been anonymized.

I laughed quite hard when the results were back - the 'Engineer, female, 40-49yrs, $SITE' in the office next door wasn't as amused. All her responses had been printed in the report. Sample size: 1.

View on HN

At our (fairly large) company, you can query by team (and maybe job role) but it will hide responses where the sample size is smaller than a set number (I think 8 or 10).

So yes it can be done but people have to actually care about it.

The cautionary tale about k-anonymity (from Aaron Schwartz's book I think) is when the behavior of aggregates is also something that should be kept privates - the example was that the morning run of an army base in a foreign country was revealed because enough people did this with their smartwatches on that it formed a neat cluster.

In Germany (I think all of the EU), a dataset can only be published if the sample size is at least >=7.

Just fwiw sample size isn’t a robust defence against this kind of attack. Check out Differential Privacy.

More details on the Strava Run incident: https://www.bbc.com/news/technology-42853072

Isn’t location data particularly easy to de-anonymize? I remember reading some research that because people tend to be so consistent with their location, you could deanonymize most people in a dataset with 3 random location samples through the day

This is likely the paper you are referring to:

https://www.nature.com/articles/srep01376

It states that 95% of people can be identified from just 4 location samples.

Never answer those honestly. More than half the time they aren't there to "help management understand how to do better", rather to purge people who aren't happy. "We don't need employees who don't love it here."

-Oh, we were already deemed beyond redemption - we'd been a small company, quite successful in our narrow niche, only to be bought up by $MEGACORP.

That was a culture clash. Big time.

Nevertheless, I thought the same thing you did and filled in my questionnaire so that my answers created a nice, symmetrical pattern - it looked almost like a pattern for an arts&crafts project...

I always say I am unhappy and would take another offer in a heatbeat, and so far that strategy has worked well for me - I usually get offered a good salary bump amd bonus every year. Obviously YMMV.

Isn't this a trivial example though? You require bucket size >= 10 say.

Full on differential privacy is meant to address harder problems. For example, if you assume that there was a minor bug and people were asked to take the mandatory yearly survey again in a week.

Now if you assume that the responses of people who responded before will stay the same when they re-respond, then by taking the difference between both results you can identify some specific people by looking at which bucket counts changed - this would be how the new guy who joined in that week voted.

Differential privacy techniques are meant to anonymise data in way that you can't even do this.

It's trivial to fix in retrospect, nearly impossible to anticipate all similar corner cases ahead of time, and -- most importantly -- indicative of the type of logical bugs our systems of the world have that permit hacking from script-kiddies to state actors.

It may be nearly impossible to anticipate _all_ corner cases, but come on, GP was talking about there only being a sample size of 1; this is super easy to notice and then just not include in the results.

Can confirm.

I used to have a team and at some point they all had to submit their feedback on my performance. The answers were then fed back to me unattributed, but it was pretty obvious who wrote what.

And - were there "consequences" for these people?

No consequences. There was nothing I didn't know before.

EDIT: I first wanted to say that in any way there would be no consequences, but "there will be no consequences no matter what people write about me" is probably too strong of a statement for anyone to make.

Were there positive comments you didn't expect?

Kinda. I expected some people to leave a good feedback, but theirs was way beyond my expectations.

Even without sample size having these aggregated results makes it very easy to predict who picked what with a modicum of extra information. (Even silly binned personality type.)

Reply on news.ycombinator.com