Anonymous phone records are not anonymous. European researchers showed this week that individuals can be tracked based on their interaction pattern Nature Communications. They concluded that the current practice of anonymity is no longer compatible with European privacy law.
The content of messages and chats is subject to strict privacy legislation. It may not be offered, sold or distributed. More is allowed with metadata, and if anonymous even much more. Metadata is data about messages, conversations, and app usage: what time a message was sent or the app was opened, where it happened, what other device was connected and for how long. This data also tells a lot about our actions. For example, location data reveals where you live and work. Algorithms can predict anything based on metadata, such as who someone’s partner is or someone’s spending pattern.
If the metadata is stripped of traceable information, it may be circulated without the consent of the persons concerned. But sometimes anonymous metadata can also be returned to people. Now a group of computer scientists from the UK, Switzerland and Italy are demonstrating it using a technique called geometry deep learning It is possible to trace a person on the basis of their interactions.
Two “handshake” ver
The researchers built a model showing the weekly interactions. In a data set containing anonymized phone records of 43,000 people, the model was able to correctly identify a person 52 percent of the time based on face-to-face interactions and the interactions of people with whom they interacted — two “handshakes” so far. If only direct interactions are considered, a person can be correctly identified about 15 percent of the time. Interactions remain fairly stable over time, after 20 weeks, 24 percent were correctly identified by data on interactions from the two versions of the ‘handshake’.
They have also applied their model to Bluetooth proximity data, which is used, among other things, to monitor Covid-19 infection. It showed that in 26 percent of cases, the model correctly predicted the identity of the person relying on direct contacts only.
“These researchers have found another way to trace individuals back,” says Friedrich Zwerdervin Borgesius, professor of information and communications technology and law at Radboud University Nijmegen. “They can’t yet paste a name or address on phone data, but it’s no longer completely anonymous, and it’s often claimed. Personal data limits and what falls under [Europese privacywet] AVG is declining, thanks to these kinds of technologies, it’s moving more and more.”
I think lawyers for European telecoms companies will be disappointed with this investigation. “These companies are happy to trade such data,” says Zwerdervin-Burgess. “They can now anonymize their data more, but they can also manipulate it more accurately by doing their own analysis, about how crowds are spreading across a city, for example, and selling the results.”
A version of this article also appeared on NRC on the morning of January 27, 2022
