1.1. PRIVACY VIOLATION INCIDENTS 3
of social networking sites, including Facebook, where users share seemingly innocuous personal
information to the public.
Another well-known privacy incident came from publishing web search logs. In 2006, AOL
released three months of search logs involving 650,000 users. e main privacy protection tech-
nique used is replacing user ids with random numbers. is proved to be a failure. Two New
York Times journalists, Barbaro and Tom Zeller [2006], were able to re-identify elma Arnold,
a 62-year-old women living in Lilburn, GA, from the published search logs. Ms. Arnold’s search
log includes her last name and location names near where she lived. e reporters were able to
cross-reference this information with phonebook entries. After the New York Times article had
been published, the data was immediately retracted by AOL. Later a class action lawsuit was
filed against AOL. is scandal led to the resignation of AOL’s CTO and the dismissal of two
employees.
In 2009, Netflix released a dataset containing the movie rating data from 500,000 users
as part of a one-million dollar challenge to the data mining research community for develop-
ing effective algorithms for predicting users’ movie preferences based on their viewing history
and ratings. While the data was anonymized in order to protect users’ privacy, Narayanan and
Shmatikov [2008] showed that an adversary having some knowledge about a subscriber’s movie
viewing experience can easily identify the subscriber’s record if present in the dataset. For exam-
ple, Narayanan and Shmatikov [2008] showed that, from the profiles of 50 IMDB users, at least
two of them also appear in the Netflix dataset.
Another privacy incident targeted the Genome-Wide Association Studies (GWAS). ese
studies normally compare the DNA sequences of two groups of participants: people with the
disease (cases) and similar people without (controls). Each person’s DNA mutations (single-
nucleotide polymorphisms, or SNPs) at indicative locations are read, and this information is then
analyzed. Traditionally, researchers publish aggregate frequencies of SNPs for participants in the
two groups. In 2008, Homer et al. [2008] proposed attacks that could tell with high confidence
whether an individual is in the case group, assuming that the individual’s DNA is known. e
attack works even if the group includes hundreds of individuals. Because of the privacy con-
cerns from such attacks, a number of institutions, including the U.S. National Institute of Health
(NIH) and the Wellcome Trust in London all decided to restrict access to data from GWAS.
Such attacks need access to the victim’s DNA data and publicly available genomic database to
establish the likely SNP frequencies in the general population.
Another example of the failure of naive “data anonymization” is location-based social
networks that provide friend discovery feature by location proximity, documented by Li et al.
[2014b]. ese social networks try to provide some privacy protection by using a number of
location-obfuscating techniques. One technique is to show to a user only relative distances of
other users to her, instead of their location coordinates. Another is to set a limit on the precision
of the reported information. For example, Skout defines localization accuracy to 1 mile, i.e., users
will be located with an accuracy no better than 1 mile. Similarly, Wechat and Momo set 100 m
我的内容管理
展开
