Privacy-concerned consumers desperately want a magic bullet, some simple thing they can use that will protect their identities and their web activity. And although there are a plethora of offerings today that make such a claim — VPNs, privacy-focused browsers such as Tor, privacy search engines such as DuckDuckGo, quite a few services that claim to anonymize anyone’s activity — the practical realities of human behavior make such privacy claims bogus.
Let me stress that almost all of these services do indeed help a person remain anonymous from the casual, untrained observer (the typical roommate, spouse, co-worker, boss, etc.). But any consumer who thinks that these tools will thwart a law enforcement agent, motivated cyberthief or identity thief, or anyone who is willing to spend the time to track you down is in for unhappiness.
This point was made even more unavoidable in a new paper from researchers at Stanford and Princeton universities.
“Each person has a distinctive social network and, thus, the set of links appearing in one’s feed is unique. Assuming users visit links in their feed with higher probability than a random user, browsing histories contain tell-tale marks of identity. To gauge the real-world effectiveness of this approach, we recruited nearly 400 people to donate their web browsing histories, and we were able to correctly identify more than 70 percent of them,” the report said. “Our theoretical contribution applies to any type of transactional data and is robust to noisy observations, generalizing a wide range of previous de-anonymization attacks. Since our attack attempts to find the correct Twitter profile out of over 300 million candidates, it is, to our knowledge, the largest-scale demonstrated de-anonymization to date.”
In short, the point of this report is that people are creatures of habit. Their face/IP address/phone number/CRM number/etc. may be obscured, but their behavior often can’t be.
A few years ago, there was a law enforcement effort to track suspects by their grocery shopping patterns. Here’s how it worked. Let’s say that you have a suspect who had no reason to hide in her local community. She used payment cards, had a library card and sought discounts at her local grocery store by participating in a loyalty and CRM program. Then she killed some people and decided to go deep into hiding. She cleared out her bank account (so she could live entirely on cash for as long as possible), destroyed her mobile devices, purchased bogus identification documents and drove thousands of miles away. She would try to live off the grid, if you will.
Armed with years of the suspect’s grocery purchase habits, law enforcement identified repeated patterns. What kind of fruit did she buy? Which flavors and brands of cereal? Which precise beverages? Even though the suspect would presumably not get a CRM card in her hideout community, anonymous basket analysis would suffice. Retail chains across the country would be asked to check their sales against the patterns of the suspect. It proved frighteningly accurate at finding someone.
Sign up for CIO Asia eNewsletters.