1 1 00:00:00,360 --> 00:00:02,370 De-identification. 2 2 00:00:02,370 --> 00:00:03,540 Now, in a previous lesson 3 3 00:00:03,540 --> 00:00:04,650 I mentioned the concept 4 4 00:00:04,650 --> 00:00:07,650 of de-identification when we're talking about privacy. 5 5 00:00:07,650 --> 00:00:10,590 In this lesson, we're going to dig a little bit deeper into it. 6 6 00:00:10,590 --> 00:00:12,540 When I'm talking about de-identification 7 7 00:00:12,540 --> 00:00:13,440 this is the methods 8 8 00:00:13,440 --> 00:00:15,896 and technologies that remove identifying information 9 9 00:00:15,896 --> 00:00:19,170 from data before we distribute that data. 10 10 00:00:19,170 --> 00:00:21,510 Now, the real benefit of de-identification here 11 11 00:00:21,510 --> 00:00:24,750 is to be able to take data that may be protected by privacy. 12 12 00:00:24,750 --> 00:00:26,421 And once we do the de-identification 13 13 00:00:26,421 --> 00:00:30,780 that data now becomes usable by us again for other purposes. 14 14 00:00:30,780 --> 00:00:32,670 Now, this doesn't violate anybody's privacy 15 15 00:00:32,670 --> 00:00:35,280 because we are de-identifying the data. 16 16 00:00:35,280 --> 00:00:37,260 Oftentimes, your de-identification 17 17 00:00:37,260 --> 00:00:38,280 is going to be implemented 18 18 00:00:38,280 --> 00:00:40,470 as part of your database design. 19 19 00:00:40,470 --> 00:00:42,570 Now, there are lots of different things that we have to talk 20 20 00:00:42,570 --> 00:00:44,820 about when we talk about de-identification. 21 21 00:00:44,820 --> 00:00:47,970 This includes things like data masking, tokenization 22 22 00:00:47,970 --> 00:00:51,300 aggregation, and banding, and re-identification. 23 23 00:00:51,300 --> 00:00:53,700 Now, when we talk about data masking, this is 24 24 00:00:53,700 --> 00:00:56,640 where a de-identification method is used where a generic 25 25 00:00:56,640 --> 00:00:58,770 or placeholder label is substituted in 26 26 00:00:58,770 --> 00:01:01,200 for real data while preserving the structure 27 27 00:01:01,200 --> 00:01:03,420 or format of the original data. 28 28 00:01:03,420 --> 00:01:07,140 So let's say you're going to gimme all your credit cards. 29 29 00:01:07,140 --> 00:01:08,370 I take all your credit cards 30 30 00:01:08,370 --> 00:01:12,480 and I take away all of the information from your 16 digits 31 31 00:01:12,480 --> 00:01:16,050 and I put XXXX in front of all those 16 digits. 32 32 00:01:16,050 --> 00:01:17,310 That would mask the data. 33 33 00:01:17,310 --> 00:01:19,710 Nobody would be able to identify that credit card anymore 34 34 00:01:19,710 --> 00:01:22,200 as yours because we don't have the credit card. 35 35 00:01:22,200 --> 00:01:24,150 We just have XXXX. 36 36 00:01:24,150 --> 00:01:25,680 That's a form of data masking. 37 37 00:01:25,680 --> 00:01:27,913 So really, when we talk about data masking, we are covering 38 38 00:01:27,913 --> 00:01:31,200 up the data, or maybe I have a database of all my customers 39 39 00:01:31,200 --> 00:01:33,480 and for some reason we collected social security numbers. 40 40 00:01:33,480 --> 00:01:34,313 We would never do that. 41 41 00:01:34,313 --> 00:01:35,490 But let's say we did. 42 42 00:01:35,490 --> 00:01:36,960 Well, that's a nine digit number. 43 43 00:01:36,960 --> 00:01:39,330 Instead of having your unique social security number 44 44 00:01:39,330 --> 00:01:40,740 I might go back through the database 45 45 00:01:40,740 --> 00:01:42,630 and change all your social security numbers 46 46 00:01:42,630 --> 00:01:46,290 to 111 111 111. 47 47 00:01:46,290 --> 00:01:48,930 And by doing that, I have now genericized it 48 48 00:01:48,930 --> 00:01:51,390 across all my students to have the same number. 49 49 00:01:51,390 --> 00:01:54,090 It keeps the same format, it keeps the same structure 50 50 00:01:54,090 --> 00:01:56,640 but it doesn't actually take any personal information 51 51 00:01:56,640 --> 00:01:59,550 from you because I've erased that social security number. 52 52 00:01:59,550 --> 00:02:02,190 The next one we have is what's known as tokenization. 53 53 00:02:02,190 --> 00:02:03,900 Now, this is a de-identification method where 54 54 00:02:03,900 --> 00:02:07,526 a unique token is substituted in for real data. 55 55 00:02:07,526 --> 00:02:09,570 Now, when you do tokenization, one 56 56 00:02:09,570 --> 00:02:11,370 of the things you have to worry about is 57 57 00:02:11,370 --> 00:02:14,460 if you have the ability to go back and be reversible. 58 58 00:02:14,460 --> 00:02:16,650 And usually with tokenization it is. 59 59 00:02:16,650 --> 00:02:19,590 So again, let's say I had your social security numbers. 60 60 00:02:19,590 --> 00:02:21,840 Instead of changing them all to one 61 61 00:02:21,840 --> 00:02:24,690 I assign a random number to each of my students. 62 62 00:02:24,690 --> 00:02:26,340 That's now their student ID. 63 63 00:02:26,340 --> 00:02:28,500 That student ID is now substituted in for that 64 64 00:02:28,500 --> 00:02:29,970 social security number field. 65 65 00:02:29,970 --> 00:02:33,270 But I might have a master list in my safe that says 66 66 00:02:33,270 --> 00:02:36,480 this student ID matches this social security number. 67 67 00:02:36,480 --> 00:02:38,310 That's what we're talking about with tokenization. 68 68 00:02:38,310 --> 00:02:41,010 We're using another number to represent the information. 69 69 00:02:41,010 --> 00:02:42,000 So if any of my staff go 70 70 00:02:42,000 --> 00:02:44,430 into the database and look at your social security number 71 71 00:02:44,430 --> 00:02:46,290 they would just see the made up student number. 72 72 00:02:46,290 --> 00:02:47,940 They wouldn't get your real social security number 73 73 00:02:47,940 --> 00:02:49,500 because that's stored in my vault. 74 74 00:02:49,500 --> 00:02:51,960 But if I had some real business case where I needed it 75 75 00:02:51,960 --> 00:02:53,280 I could then do the matching 76 76 00:02:53,280 --> 00:02:54,930 and then re-identify you that way. 77 77 00:02:54,930 --> 00:02:57,720 So it's a little bit more dangerous to do tokenization. 78 78 00:02:57,720 --> 00:03:01,110 The next one we want to talk about is aggregation and banding. 79 79 00:03:01,110 --> 00:03:04,356 Now, aggregation and banding is where you de-identify people 80 80 00:03:04,356 --> 00:03:06,090 by gathering the data 81 81 00:03:06,090 --> 00:03:09,120 and generalizing it to protect the individuals involved. 82 82 00:03:09,120 --> 00:03:10,987 So if we were using aggregation and banding 83 83 00:03:10,987 --> 00:03:13,950 we might take all of our subjects in a medical trial 84 84 00:03:13,950 --> 00:03:15,436 and instead of identifying them 85 85 00:03:15,436 --> 00:03:18,572 as the person or the subject number, we would say 86 86 00:03:18,572 --> 00:03:21,570 out of the 100 people who participated in this trial 87 87 00:03:21,570 --> 00:03:24,060 90% of them didn't have side effects. 88 88 00:03:24,060 --> 00:03:24,900 Now, that doesn't mean any 89 89 00:03:24,900 --> 00:03:26,790 of those 90 quickly identifies as you. 90 90 00:03:26,790 --> 00:03:28,890 It just means somebody didn't have side effects. 91 91 00:03:28,890 --> 00:03:29,970 It's one of those 90. 92 92 00:03:29,970 --> 00:03:31,680 And if we knew that you didn't have side effects 93 93 00:03:31,680 --> 00:03:33,000 well you're just one of 90. 94 94 00:03:33,000 --> 00:03:34,680 We don't know you individually 95 95 00:03:34,680 --> 00:03:36,990 and that's where we're able to protect your privacy. 96 96 00:03:36,990 --> 00:03:38,190 Now, let me give you another example 97 97 00:03:38,190 --> 00:03:39,570 of the dangers of some of these things 98 98 00:03:39,570 --> 00:03:42,060 and when you have to think about de-identification 99 99 00:03:42,060 --> 00:03:45,210 in terms of when somebody tries to re-identify people. 100 100 00:03:45,210 --> 00:03:47,100 So let's say that I went 101 101 00:03:47,100 --> 00:03:49,710 and did a corporate survey of my company. 102 102 00:03:49,710 --> 00:03:50,850 We went ahead and we sent 103 103 00:03:50,850 --> 00:03:52,410 out a survey to everybody and we say 104 104 00:03:52,410 --> 00:03:54,990 don't tell us your name because we don't want to identify you. 105 105 00:03:54,990 --> 00:03:56,430 We want you to feel comfortable giving us 106 106 00:03:56,430 --> 00:03:57,600 your honest feedback. 107 107 00:03:57,600 --> 00:03:59,370 And we ask 'em a whole bunch of questions about the company. 108 108 00:03:59,370 --> 00:04:00,300 How do you like it here? 109 109 00:04:00,300 --> 00:04:01,530 Is the pay competitive? 110 110 00:04:01,530 --> 00:04:02,490 Do you enjoy your job? 111 111 00:04:02,490 --> 00:04:03,600 Do you like helping the students? 112 112 00:04:03,600 --> 00:04:04,740 All that kind of stuff. 113 113 00:04:04,740 --> 00:04:06,570 But then on the final question 114 114 00:04:06,570 --> 00:04:08,740 we ask something like, what is your age? 115 115 00:04:08,740 --> 00:04:10,620 What is your sex? 116 116 00:04:10,620 --> 00:04:12,000 Are you married or not? 117 117 00:04:12,000 --> 00:04:13,590 And we get that kind of information. 118 118 00:04:13,590 --> 00:04:15,930 So, okay, that seems innocuous enough because we 119 119 00:04:15,930 --> 00:04:18,600 didn't ask for things like your social security number 120 120 00:04:18,600 --> 00:04:20,520 or your employee ID or your name. 121 121 00:04:20,520 --> 00:04:22,170 So we still shouldn't be able to identify you. 122 122 00:04:22,170 --> 00:04:23,808 So we take all the results of the survey 123 123 00:04:23,808 --> 00:04:25,110 we shuffle 'em all together 124 124 00:04:25,110 --> 00:04:26,220 and we start reading through 'em. 125 125 00:04:26,220 --> 00:04:27,150 This one's a five star. 126 126 00:04:27,150 --> 00:04:27,990 This one's a five star. 127 127 00:04:27,990 --> 00:04:29,340 This is a four and a half star. 128 128 00:04:29,340 --> 00:04:30,390 This one's a one. 129 129 00:04:30,390 --> 00:04:31,710 Hmm, well, now I'm upset. 130 130 00:04:31,710 --> 00:04:33,330 I want to know who this one is, right? 131 131 00:04:33,330 --> 00:04:34,890 Can't I re-identify them? 132 132 00:04:34,890 --> 00:04:36,330 Well, let's say I look at them and I read 133 133 00:04:36,330 --> 00:04:37,920 through their comments, and I get to the last page. 134 134 00:04:37,920 --> 00:04:39,660 I says, this is a woman. 135 135 00:04:39,660 --> 00:04:42,330 This is somebody who's between the ages of 30 and 40. 136 136 00:04:42,330 --> 00:04:44,670 This is somebody who is married, huh? 137 137 00:04:44,670 --> 00:04:46,752 Well, based on that, and my small staff 138 138 00:04:46,752 --> 00:04:49,560 I know that's only one person in my company. 139 139 00:04:49,560 --> 00:04:51,450 And so I know the person who thinks Jason's the 140 140 00:04:51,450 --> 00:04:52,680 worst boss ever. 141 141 00:04:52,680 --> 00:04:54,960 And lo and behold, it's my wife. 142 142 00:04:54,960 --> 00:04:56,310 Tamara went and filled out the survey 143 143 00:04:56,310 --> 00:04:57,780 and leaves me a one star review. 144 144 00:04:57,780 --> 00:04:58,680 Thanks, honey. 145 145 00:04:58,680 --> 00:05:00,210 You know, this is the kind of stuff that happens. 146 146 00:05:00,210 --> 00:05:01,043 But again 147 147 00:05:01,043 --> 00:05:03,240 if you have this where you can re-identify somebody 148 148 00:05:03,240 --> 00:05:06,210 then all that anonymization doesn't really help. 149 149 00:05:06,210 --> 00:05:07,590 Now, why does this happen? 150 150 00:05:07,590 --> 00:05:10,470 Well, because we're a small company, we only have 10 people. 151 151 00:05:10,470 --> 00:05:12,660 And so if we ask a question like that on the last page 152 152 00:05:12,660 --> 00:05:15,750 and we don't be honest, but if we did, it would be very easy 153 153 00:05:15,750 --> 00:05:18,480 for me to identify because we only have a handful 154 154 00:05:18,480 --> 00:05:19,950 of employees, we have 10 people. 155 155 00:05:19,950 --> 00:05:22,380 And so if I ask things like 10 year age bands, like, are you 156 156 00:05:22,380 --> 00:05:25,170 between 20 and 30, 30 and 40, 40 and 50? 157 157 00:05:25,170 --> 00:05:27,750 And if you're a male or female and if you're married or not 158 158 00:05:27,750 --> 00:05:30,422 that tells me pretty much I can identify everybody down 159 159 00:05:30,422 --> 00:05:32,490 based on that result. 160 160 00:05:32,490 --> 00:05:34,080 And so that would take away the ability 161 161 00:05:34,080 --> 00:05:36,090 of having that de-identification. 162 162 00:05:36,090 --> 00:05:38,520 So this is the concept of re-identification, right? 163 163 00:05:38,520 --> 00:05:41,580 Re-identification is an attack that combines de-identified 164 164 00:05:41,580 --> 00:05:44,640 data sets and with other data sources, things that you 165 165 00:05:44,640 --> 00:05:48,060 know to discover how secure the de-identification method is. 166 166 00:05:48,060 --> 00:05:50,040 And so if we use that system in our company 167 167 00:05:50,040 --> 00:05:51,360 that would not be secure. 168 168 00:05:51,360 --> 00:05:53,940 Now, if I used that same system in my last job 169 169 00:05:53,940 --> 00:05:55,980 where I worked with 400 other people, 170 170 00:05:55,980 --> 00:05:57,060 it would've been very secure 171 171 00:05:57,060 --> 00:05:59,310 Because there was a lot more people who might have 172 172 00:05:59,310 --> 00:06:02,520 been a woman who was married between 30 and 40 years old. 173 173 00:06:02,520 --> 00:06:04,290 And so it'd be very easy for them to hide 174 174 00:06:04,290 --> 00:06:07,080 in the bulk out of those 400 people of that company. 175 175 00:06:07,080 --> 00:06:09,840 That probably signifies about 50 or 60 people. 176 176 00:06:09,840 --> 00:06:11,550 And so I wouldn't be able to identify you 177 177 00:06:11,550 --> 00:06:13,080 individually asking those questions. 178 178 00:06:13,080 --> 00:06:15,480 So when you're building out surveys and when you're building 179 179 00:06:15,480 --> 00:06:18,390 out systems to have a de-identification in place 180 180 00:06:18,390 --> 00:06:19,620 you need to think these things 181 181 00:06:19,620 --> 00:06:21,600 through because sometimes something that seems 182 182 00:06:21,600 --> 00:06:24,150 like it would work because it works at a large company 183 183 00:06:24,150 --> 00:06:26,793 won't work at a small company or vice versa.