An article review.
A recent article from the Associated Press highlights a study that reviewed ‘anonymized’ credit card data. The MIT researchers were able to identify individuals based on their credit card actions alone.
With over ninety percent accuracy, the researchers were able to identify a person based on four credit card transactions, or only three transactions if the prices were available. The transactional metadata alone was enough of a trail that other time-stamped data could be used to positively identify the owner.
Fun Facts about the MIT study:
- Included 1.1 million people
- Three months of data were examined
- Data was collected from 10,000 shops
- Conducted in an undisclosed developed country
The article highlights the power of metadata along with the false sense of security that’s often present when ‘anonymized’ data is shared.
This article helps illustrate why we need to slow down and think about the implications of what we’re doing in light of both how the technology has changed and how the technology is used.
You might want to add this as a consideration in your vendor management as well.
The above is what we call an “Article Review.” It is part of our attempt to help our readers find excellent reading materials to back up important technology risk management concepts. We try not to include articles that are merely news or additional news about mainstream issues. Instead, we try to highlight articles that our “typical clients” should be sure to read, or that are about concepts “outside the mainstream media.” infotex does not intend to endorse views represented by the writers of the articles we review, nor do we try to keep our Clients aware of EVERYTHING. For example, if a particular story concept is being reported upon in many different media sources, infotex usually chooses to ignore the story concept altogether, unless we can find a “unique take” on the story concept.
Original article by Seth Borenstein and Jack Gillum, Associated Press. Published by U.S. News & World Report.