How privacy is vanishing online, a little bit at a time
Published 5:00 am Wednesday, March 17, 2010
If a stranger came up to you on the street, would you give him your name, Social Security number and e-mail address?
Probably not.
Yet people often dole out all kinds of personal information on the Internet that allows such identifying data to be deduced. Services like Facebook, Twitter and Flickr are oceans of personal minutia — birthday greetings sent and received, school and work gossip, photos of family vacations, movies watched and books read.
Computer scientists and policy experts say that such small, seemingly innocuous bits of self-revelation can increasingly be collected and reassembled by computers to help create a complete picture of a person’s identity, sometimes down to the Social Security number.
“Technology has rendered the conventional definition of personally identifiable information obsolete,” said Maneesha Mithal, associate director of the Federal Trade Commission’s privacy division. “You can find out who an individual is without it.”
In a class project at the Massachusetts Institute of Technology that received some attention last year, Carter Jernigan and Behram Mistree analyzed more than 4,000 Facebook profiles of MIT students, including links among online friends.
The pair created software that predicted, with 78 percent accuracy, whether a profile belonged to a gay male.
The technique was verified using a group of students who had freely identified themselves as gay.
So far, this type of powerful data mining, which relies on sophisticated statistical correlations to build individual dossiers, is mostly in the realm of university researchers, not identity thieves and marketers.
But the FTC is worried that laws and regulations to protect privacy have not kept up with changing technology, and the agency is convening today the third of three workshops on the issue.
Its concerns are hardly far-fetched. Last fall, Netflix awarded $1 million to a team of statisticians and computer scientists who won a three-year contest to analyze the movie rental history of 500,000 subscribers and improve the predictive accuracy of Netflix’s recommendation software by at least 10 percent.
On Friday, Netflix said that it was shelving plans for a second contest — bowing to privacy concerns raised by the FTC and a private litigant.
In 2008, a pair of researchers at the University of Texas showed that the customer data released for that first contest, despite being stripped of names and other direct identifying information, could often be “de-anonymized” by statistically analyzing an individual’s distinctive pattern of movie ratings and recommendations.
In social networks, people can increase their defenses against identification by adopting tight privacy controls on information in personal profiles.
Yet an individual’s actions, researchers say, are rarely enough to protect privacy in the interconnected world of the Internet.
You may not disclose personal information, but your online friends and colleagues may do it for you, referring to your school or employer, gender, location and interests. Patterns of social communication, researchers say, are revealing.
“Personal privacy is no longer an individual thing,” said Harold Abelson, the computer science professor at MIT.
Even more unnerving to privacy advocates is the work of two researchers from Carnegie Mellon University.
In a paper published last year, Alessandro Acquisti and Ralph Gross reported that they could accurately predict the full, nine-digit Social Security numbers for 8.5 percent of the people born in the United States between 1989 and 2003 — nearly 5 million individuals.
Technology is redefining online privacy, said Acquisti, an associate professor of information technology and public policy at Carnegie Mellon.
“We have made ourselves the participants in a grand, new social experiment that will change our collective sense of what is private and public, our very ability to keep anything private, and ultimately the balance of power between you and what others know about you,” Acquisti said.