Papers

Sustainable Privacy How to stop information leaks from sinking the ship Samuel M. Smith Ph.D. sam@keri.one https://keri.one 2023/06/17

Whitepapers Sustainable Privacy https://github.com/SmithSamuelM/Papers/blobjmaster/whitepapers/SustainablePrivacy.pdf Secure Privacy, Authenticity, and Confidentiality https://github.com/SmithSamuelM/Papers/blob/master/presentations/SPAC_Overview.web.pdf

Sustainable Privacy Sustainable privacy refers to the maintenance and preservation of personal data privacy over time. There are two sides to sustainable privacy: «How a person maintains their personal data privacy over time. «How a holder of personal data respects and supports personal data privacy over time. The difficulty of sustainable privacy is that any information gathering, usage, and sharing system is leaky. Information leaks out over time, thereby gradually eroding the privacy of any data being managed. The sharing of data is intentional leakage and is, therefore, problematic when viewed from the perspective of sustainable privacy.

Privacy

There are also two fundamentally different but complementary definitions of privacy relevant to this discussion.

« The first definition is about the recipient respecting the data privacy concerns of the sender w.r.t. the content. disclosed to the recipient. The protection comes from the recipient protecting the data privacy rights of the sender once the recipient has received that data. This first type of privacy protection may be achieved independently of the privacy of the communications channel itself that conveys the content to the receiver.

• The second definition is about the correlatability of the publicly viewable metadata included in the communication. This is called non-content meta-data by the surveillance community. This definition distinguishes between confidential data (meta-data or otherwise) that is not viewable by any third party, not a party to the conversation. Typically confidentiality protection comes from encryption (i.e., cipher text vs. plain text). But an out-of-band (OOB) exchange of information is confidential (not viewable) by a third-party surveillor of the in-band (1B) channel, thus making the 00B exchange itself confidential without encryption.

• Cryptographic solutions alone cannot sustainably protect privacy, w.r.t. either individual data rights or surveillance.

• A comprehensive approach that combines cryptography and legal liability is required.

• Ultimately, accountability on the receiver is necessary to protect the privacy of the discloser in a sustainable fashion.

PAC Theorem One can have any two of the three (privacy, authenticity, confidentiality) at the highest level but not all three. Authentic Tradespace 3 % & Trade-offs required!

Practical Elaborations Authentic and Authenticity The origin and content of any statement by a party to a conversation are provable to any other party. Authenticity is primarily about control over the key state needed to prove who said what in the conversation via digital signatures. In other words, it is about secure attribution. Confidential and Confidentiality All statements in a conversation are only known by the parties to that conversation. Confidentiality is primarily about control over the disclosure of what (content data) was said in the conversation and to whom it was said (partitioning). Confidentiality is about control over the key state needed to hide content via encryption vis-a-vis the intended parties. Private and Privacy The parties to a conversation are only known by the parties to that conversation. Privacy is primarily about control over the disclosure of who participated in the conversation (non-content meta-data = identifiers). More specifically, privacy is about managing exploitably correlatable identifiers, not merely identifiers of who but also any other type of identifier in non-content metadata, including conversation (interaction) identifiers.

The 1st and 2nd parties represent the parties to a conversation or

exchange. ] e

The 15t party discloses data to a 2nd party.

The 1st and 2nd parties have knowledge of each other via their

identifiers. The 15t party as discloser has knowledge of the disclosed | thid pary

data (content). ¢ ¢ Asaresult of the disclosure the nd party as disclosee also has st party 4 second pary knowledge of the disclosed data (content). A Iy The identifiers are non-content meta-data, and the disclosed datals g po, || content data. A 3rd party is any party that is not either a 1st or 2nd support support party. An intermediary may be considered a 1st, 2nd, or 3rd party

depending on how and by whom it s trusted or not.

Privacy with respect to the 3rd party is protected if the 3rd party has no

knowledge of the identifiers used by the 1st and 2nd parties for the %% intemediary |<——————

conversation (disclosure).

Confidentiality with respect to the 3rd party s protected if the 3rd party

has no knowledge of the disclosed data (the content data disclosed). |t arty

A3rd party may directly break privacy by directly observing messages v v

that contain the identifiers of the 1st and 2nd parties. Trtpory > secondpary

A3rd party may directly break confidentiality by directly observing the A Iy

content of messages between the 1st and 2nd parties. —— —L g . i st pery second party

The 3rd party may indirectly break both privacy and confidentiality by | suppart support

collusion with the 1st or 2nd party or via collusion with an intermediary.

Erosion of 1st Party Data Privacy Rights * Exploitive use of 1st party data by 2nd parties. * Sharing of 1st party data by 2nd parties with 3rd parties either overtly or inadvertently.

PbDD: K-Anonymity De-identification « Current accept “best” practice for de-identification is K-anonymity. Arelease of data is said to have the k-anonymity property if the information for each person contained in the release cannot be distinguished from at least k-1 individuals whose information also appears in the release. mspsienwidpectorgucixcanonymity The guarantees provided by K-anonymity are aspirational, not mathematical. *K-anonymity is broken. *Privacy washing personal data (safe harbor): If your personal data as been de-identified using K-anonymity is it no longer considered personal data and my be freely shared. (read the terms-of-use).

K-Anonymity De-identification Continued *K-anonymity is broken.

Privacy Washing De-identification provides a personal data safe harbor. If your personal data as been de-identified using K-anonymity is it no longer considered personal data and may be freely shared. (read the terms-of-use). «Splitting data set into multiple K-anonymous data sets prior to release may be used to privacy wash the data, yet trivially merging the split re-identifies the data.

De-identification Terminology Attributes in each record of a data set may be classified as Identifiers (personally identifying information Pll attributes) Quasi-identifiers (vector of attributes where each alone is not identifying but together may be identifying) Nonvidentifiers (attributes alone or in combination that are not identifying) Auxiliary attributes (information not in the data set release)

K-Anonymity is Broken: Re-identification Attacks K-Anonymity is an NP-Hard problem due to the combinatorics data sets and/or potential auxiliary attributes.

QI Linkage Attack: Interaction Profiling Attack: Contextual Linkability Attack:

Quasi-ldentifier Linkage Reidentification Attack Merge Attack

Re-inject identifiers by combining de-identified data sets

Create identifying quasi-identifiers by combining data sets

Create identifying quasi-identifiers by combining auxiliary attributes mupsinandeneizsoss)

Cpsimnntur conaticesivepe76)

Generative Al (upsimsssaurs somridesarsszans-osss30

Down-coding Attack: tusimwasensorgiconterencetsenseciyapresenasionicones)

Hierarchical K-anonymity up-coding to create herds may be systematically down-coded to recreate identifying data even when all attributes are quasi-attributes. Undoes hierarchical generalization. (street, zip, city, state, country) -> (state, country) -> (zip, city, state, country)

Complex Predicate Singling Out (PSO) Attack (GDPR): trpsiiwmwascrixargicontrencefusenisssartysipresetatonionen)

Interaction Profiling Reidentification Attack Deep learning: Pseudonym of the two individuals, a timestamp, the type of interaction (i.e., call or text), its direction (i.e., which party initiated it), and the duration for calls in 2-hop interaction network re-identifies over 50% of the individuals. [ ———————

Contextual Linkability Reidentification Attack Uses the statistical correlation of auxiliary attributes obtained from the disclosure context to re-identify the discloser. A verifier may apply the re-identification correlation techniques described above with auxiliary data obtained at the time of presentation of any selectively disclosed attributes. Thereby the selective disclosure, whether via Zero-Knowledge-Proof (ZKP) or not, of any 1st party data disclosed to a 2nd party may be potentially trivially exploitably correlatable. A set of non-selectively disclosed attributes (auxiliary data) obtained from the context of the disclosure may be sufficient to re-identify the discloser despite selective disclosure. A contextual linkability attack may thereby trivially defeat the cryptographic unlinkability provided by selective disclosure mechanisms, including those that use ZKPs.

Contextual Linkability Reidentification Continued The vulnerability stems from the fact that the verifier may structure the context of the presentation to provide sufficient auxiliary data that the combination of contextual auxiliary data and selectively disclosed data is identifying. Verifier control over the context of a selective disclosure presentation and the associated capture of auxiliary attributes may create quasi-identifiers or even identifiers that may be combined with selectively disclosed attributes in such a way as to re-identify the associated subject of the selectively disclosed attributes. Thus, selective disclosure mechanisms (including ZKPs), by themselves, are inadequate for privacy protection. Any unconstrained use of a selectively disclosed set of attributes may be re-identifiable unless the discloser takes care to both protect from contextual linkability and impose a contractual liability on any use of that data. Bare selective disclosure implicitly grants the disclosee (verifier) a safe harbor to use, assimilate, and re-identify the disclosed data.

Bare Selective Disclosure Because most presentation contexts are under the control of the 2nd party (verifier), the verifier needs merely to structure that context with enough quasi-identifier attributes (auxiliary data) to re-identify the presenter, which in turn would enable the 2nd party to link the de-identified presenter back to the issuer with the presentation details thereby defeating cryptographic unlinkability. Cryptographic unlinkability is the unique reason to use a ZKP in the presentation in the first place. This does not mean that there are no corner conditions where the presentation context is sufficiently under the control of the presenter (1st) party such that the presenter can structure the context to prevent the verifier from correlating any other quasi-identifiers, but none of the standard use cases for cryptographic unlinkability satisfy that condition. Bare selective disclosure as a privacy mechanism is relegated to the narrow corner conditions where there is zero contextual linkability by the 2nd party disclosee (verifier) at the time of presentation.

Selective Disclosure as Naive K-anonymity Correctly understood, selective disclosure is a naive form of K-anonymity performed by the discloser (presenter). The discloser is attempting to de-identify their own data. Unfortunately, such naive de-identified disclosure is not performed with any statistical insight into the ability of the verifier (receiver) to re-identify the selectively disclosed attributes given the contextual attributes that are also disclosed (inadvertently) at the time of presentation and under the control of the verifier. Because most if not all standard use cases for selective disclosure assume a presentation context that is under the control of the verifier, a malicious verifier can restructure that context to statistically guarantee correlation and defeat the selective disclosure with or without a ZKP. As aresult, many of the standard use cases for selective disclosure (with or without ZKPs) in verifiable credential (VC) presentations are examples of anti-patterns for the use of selective disclosure. The discloser may have a false sense of protection from selective disclosure that results in much more promiscuous disclosure.

Examples of Anti-patterns for Bare Selective Disclosure Any presentation where the discloser is in a location controlled by the verifier. Mobile phone tracking data. Security cameras with facial recognition (or any camera) (ussinewspsnssonic comgiossissarississ) Credit Card Payment Facial biometric with facial recognition Parking lot automated license plate recognition (psibonvausoesk omineusieshnolopias2asarsiaforia dghat fecesepates acsed) Any presentation at a website that is controlled by the verifier IP source address and routing data Any purchases on website Any presentation on a social application with a social graph of interactions Contact tracing apps tupsiwwensturecomaricessisronazris)

Summary of Contextual Linkability Vulnerability The core defect of any K-anonymity-like approach, including selective disclosure, is that there is no apriori way for the discloser to establish if any selectively disclosed attribute is an identifier, quasi-identifier, or non-identifier because all attributes are potentially identifying given auxiliary data, especially, that obtained from the context of the disclosure. Any non-aggregated 1st party data shared with a 2nd party may be easily re-identifiable because there is no herd privacy. The data is directly attributable to the one and only one 1st party. The act of sharing forms a sharing disclosure context that may be structured by the 2nd party to provide easily correlatable contextual auxiliary data that enables re-identification via a contextual linkage attack. Therefore, naive K-anonymity-based mechanisms such as selective disclosure, including ZKPs, that provide so-called cryptographic unlinkability may be trivially linkable by statistical re- identification methods using contextual auxiliary data. As aresult, bare (naive) selective disclosure alone provides no guarantee of privacy protection to the discloser.

Trade Space Selective disclosure mechanisms are not free, especially ZKPs. This induces a trade-space between friction of adoption and privacy protection. Any verifier sophisticated enough to verify a ZKP is sophisticated enough to defeat it using contextual linkability.

Comprehensive Protection Mechanism The only practically viable protection against the 2nd-party correlation of non-aggregated 1st-party data is pre-disclosure contractual protection by imposing liability on the 2nd party disclosee and strict post-disclosure chain-link confidentiality on any downstream disclosees or other users of that data, including any later assimilation or aggregation. Chain-link confidentiality requires that 2nd parties not aggregate 1st party data, de- identified or not (selectively disclosed or not), without the consent of the 1st party. The only sustainable privacy protection mechanism of 1st party data disclosed to a 2nd party, even when selectively disclosed (via ZKP or not), is contractually protected disclosure via chain-link confidentiality. Any selective disclosure is ineffective unless performed within the confines of a contractually protected disclosure that incentivizes the disclosee (verifier) to protect that disclosure (counter-incentive against the exploitation of that discloser).

In general, privacy dissipates over time. This is because digtal information is inherently leaky, and those leaks become more correlatable as the body of leaks grows over time,

The primary exploitable time value of correlated information for data aggregators s thatit can be used to predict behavior.

Advertisers want to predict who will most likely be receptive to their marketing campaigns.

The predictive accuracy of aggregated behavioral information of potential participants for any given market-related behavior is largely a function of the nearness in time of that market-related behavior when used to make the prediction.

We can ascribe a time constant to a given market for the exploitable predictive potential of market-related behavior where information older than the time constant no longer has net predictive value over the cost of aggregating .

Information that exceeds this time constant is considered stale because there is no longer any incentive to aggregate and correlate it. Therefore, even though privacy dissipates over time, the value of correlation also diminishes over time so that cost-effective privacy protection mechanisms can focus resources on near-term correlatability.

This provides a sweet spot for sustainable privacy protection governed by the time constant of the time value of exploitable correlation. Likewise, the cost of privacy protection can be weighed against the cost due to the harm of exploitation.

If the cost of protection exceeds the cost due to the harm of exploitation, then t's not worth protecting (., it's counterproductive to the protector),

If the cost of correlation to exploit exceeds the time value return of exploitation, then it's not worth exploiting (.. it's counterproductive to the exploiter).

Therefore, the diminishing exploitable time value of correlated information can be used to balance the inherent leakiness of information.