Your Secret is Safe

August 1, 2013

As the manager of information privacy and security at IBM Research in Haifa, [Tamar] Domany began putting together a mechanism that could secure sensitive data for IBM’s customers—and ultimately the entire tech world.

The resulting set of software libraries and tools, being rolled out now within IBM, address privacy requirements through two main techniques: “anonymization” and “screen masking.”

Anonymization is all about changing certain data automatically and consistently so that an individual can’t be identified. Where it gets tricky is when to make the changes. It may seem trivial, for example, to change a birth date, but if the data being shared involves a clinical trial for a new drug, the age of the patient may be relevant.

Laschon Maximillan/ Shutterstock.com How much data needs to be anonymized to keep users safe? Quite a bit, it turns out. Domany points to the 2006 release of 20 million search queries on AOL. No names were released; rather, users were assigned unique ID numbers to go with their queries. Even still, it wasn’t hard to discern the identity of certain users—The New York Times did so with just three to four searches. “Even if they give just their gender, zip code and date of birth, 80% of people can be identified,” Domany points out.