Netflix Prize 2: (Privacy) Apocalypse Now?
arstechnica.com
arstechnica.com
First, some links: Paul Ohm's paper on the consequences of re-identification for privacy laws and public policy: http://papers.ssrn.com/sol3/papers.cfm?abstract_id=1450006 Ohm's article about Netflix Prize 2: http://freedom-to-tinker.com/blog/paul/netflixs-impending-st... Our FAQ about the re-identification attack on the first dataset: http://www.cs.utexas.edu/~shmat/netflix-faq.html
An excerpt from our paper, showing the kind of information you can learn about a person just from movie preferences:
First, his political orientation may be revealed by his strong opinions about “Power and Terror: Noam Chomsky in Our Times” and “Fahrenheit 9/11,” and his religious views by his ratings on “Jesus of Nazareth” and “The Gospel of John.” Even though one should not make inferences solely from someone’s movie preferences, in many workplaces and social settings opinions about movies with predominantly gay themes such as “Bent” and “Queer as folk” (both present and rated in this person’s Netflix record) would be considered sensitive. In any case, it should be for the individual and not for Netflix to decide whether to reveal them publicly.
A quote from Paul Ohm on why this is problematic even if no one cares about movie privacy:
The "accretion problem" is this: once an adversary has linked two anonymized databases together, he can add the newly linked data to his collection of outside information and use it to help unlock other anonymized databases. ... Because of the accretion problem, every reidentification event, no matter how seemingly benign, brings people closer to harm. Had Narayanan and Shmatikov not been restricted by academic ethical standards (not to mention moral compunction), they might have connected people to harm themselves.
He then goes on to postulate the "database of ruin":
It is as if reidentification and the accretion problem join the data from all of the databases in the world together into one, giant, database-in-the-sky, an irresistible target for the malevolent.
At a first reading, this might all sound like science fiction, but it's a lot more plausible than most people think. On my blog http://33bits.org/ I have several more examples of re-identification. And let's not forget that there are companies such as Acxiom and Choicepoint which already specialize in aggregating every available piece of information about people, and then selling it.
I'm not sure, but is this such a bad thing if this giant database is open? I mean, the most incentivized and most malevolent of people can already buy my information - and they will continue to figure out how to buy more of it as it becomes available.
The important thing to me personally, is that if a company has data about me, they will let me see what it is, and then allow me to correct and (in some cases) redact this information.
I guess what I am saying - put that database in the sky so we can all see it. Then once the info gets tracked back to my identity, have it subject to some kind of regulation so that I can reasonably control what is available. The database should not have any trouble finding my contact information to tell me that it knows something about me.
1. Use the given demographic data and LexisNexis to deanonymize the data.
2. Search Facebook, Twitter, message boards, etcetera for movies that they've talked about but haven't rated yet on Netflix.
3. Identify keywords in these posts that indicate positive or negative sentiments.
4. Recommend the movies that they've spoken favorably about.
"Hi, this is dfranke. Netflix gave me your details ... kinda ... and I'd like to know what you thought of Napoleon Dynamite?"
You could even split the million bucks, and buy them all lattes or something.
In other words, privacy through obscurity is probably enough for most people in this case, and so asking people whether they want to opt out of the program is good enough - I think most people would stay in. Netflix can always pick another person in that age/gender/geographical bucket to replace a person who decided to opt out.
(Let alone the fact that this groups people broadly into demographic clusters and "preferences" are defined vaguely as a rating between 1 and 5.)
Any information I provide about which I am not explicitly notified of its publicness I feel should be kept private.
I was dissuaded further from trying Mint when I saw that they released aggregated information on customer spending. Even aggregated, they are taking their customers' private banking data and making it available to the public. I don't care if it can't be traced back to the individual. It was a still, in my mind, a breach of privacy.
Recent tech history has shown us how un-anonymous anonymized data is. You only have to follow Hacker News or Schneier on Security to know just how often such issues come up.
Security and privacy by obscurity are never, NEVER enough. Period.
I'm not trying to sidetrack the conversation into gay issues. This applies without loss of generality to other personal identity issues that conflict with one's surrounding culture.