Poster: The impact of public data during de-anonymization: a case study Kevin De Boeck, Jenno Verdonck, Michiel Willocx, Jorn Lapon, Vincent Naessens imec-DistriNet KU Leuven Ghent, Belgium firstname.lastname@kuleuven.be Abstract—Many companies, non-profit organizations and governmental bodies collect personal information during service interactions. However, releasing sensitive personal data may impose huge privacy risks. First, an increasing amount of sensitive personal information becomes publicly available online after user consent. Moreover, data breaches may result in huge data dumps that can contain personal records of millions of individuals. Hence, malicious entities are able to scrape, collect and combine personal data from multiple sources in order to compile detailed profiles of many individuals. This paper demonstrates the impact of publicly available data during de-anonymization by means of a concrete case study. Journalists are often reluctant or even prohibited to release the identity of suspects or victims in criminal cases. They do, however, often release initials and background (such as their age and residential location). Through a large scale study of over 132.000 news articles, this paper demonstrates that currently applied privacy measures are often insufficient and straightforward re-identification strategies can de-anonymize individuals. Index Terms—Privacy, re-identification, data breaches 1. Introduction Today, many companies and services we interact with in our daily lives collect data about individuals. Based on the acquired data, companies are able to offer personalized advertisements to customers and to build models to im- prove their service. Online service providers store prefer- ences and personal interests for recommendations. While this is very convenient to end-users, huge data sources pose serious risks to our privacy. Besides data sources that are already publicly available online (e.g. social media and the whitepages), huge data breaches occur frequently. These breaches often result in huge amounts of personal data collected by services and companies being dumped on the internet. Entities with doubtful or malicious intents can compile these dumps and scrape publicly available data in order to gain information on a large set of individuals. These data sources can in their turn be applied as background knowledge to perform large-scale re-identification attacks. For example, an anonymized dataset can be linked to the aforementioned publicly available datasets to support de- anonymization. This work presents a practical use-case in which the negative impact of public data on the privacy of individ- uals is demonstrated. In news articles about crime-related cases, journalists are often reluctant or even prohibited to release the exact name and details of potential subjects or victims. They do however often opt to provide the reader with contextual information about these individuals. Ex- amples are (partial) initials, the age and their residential location. If only the information in the newspaper was publicly available, only relatives would be able to de- anonymize individuals based on the info included in the article. However, due to the multiple publicly available data sources, interested readers can often quite easily re- identify a large set of individuals. Contribution. This paper assesses the impact of pub- lic data for re-identification purposes. Firstly, this work categorizes publicly available data sources. Next, the neg- ative impact of these data sources is assessed by means of a large-scale case study, namely the automatic re- identification anonymized individuals in news articles. Experimental results are presented and evaluated. The remainder of this work is structured as follows. Section 2 points to related work. Section 3 provides a general overview of public data sources. Next, our case study is presented in more detail. Preliminary results are discussed in section 5. This p