Summary: a woman wrote something like this...<a href="http://bit.ly/8BLUAw" rel="nofollow">http://bit.ly/8BLUAw</a> (describing her sexual orientation in an "anonymous" (imdb) forum), and then, based on her other reviews and data in the Netflix contest, a couple of hackers (security/privacy researchers) put 2 + 2 together to find out her identity (not their intended purpose, but as a side effect.) She blames Netflix.<p>I'm actually unclear as to who's right and wrong here. Clearly, it seems unjust that she unknowingly outed herself, but how responsible is she of her online personas? I also wouldn't be surprised if Netflix has something in their ToS relating to this kind of "anonymous" release of information.<p>This is a complicated scenario.
Notably, <i>Arvind Narayanan</i>, one of the deanonymizers is our very own randomwalker:<p><a href="http://news.ycombinator.com/user?id=randomwalker" rel="nofollow">http://news.ycombinator.com/user?id=randomwalker</a>
I wonder how many mothers of multiple children with Netflix subscriptions and IMDB accounts from Franklin County, Ohio, will be traveling to the location of the court in which the suit is being made on the date of the trial and have also visited the offices of the lawyer representing "Jane Doe". It seems as though perhaps the lawsuit may be insufficiently anonymizing her personal data.<p>I don't know that it was necessarily a good or a legal decision for Netflix to release the contest data, but it doesn't help the plaintiffs' case when they quote where the privacy policy of Netflix specifically states that they may disclose the information disclosed in the contest and immediately claim that the policy states no such thing.
<i>[The researchers] identified several NetFlix users by comparing their “anonymous” reviews in the Netflix data to ones posted on the Internet Movie Database website</i><p>So why sue netflix instead of IMDB? Additionally, is there an expectation of privacy when posting movie reviews to public websites?
It's a little off topic, but I'm intrigued by the '87% of Americans can be uniquely identified by DOB, gender and zip code'. Given the size of the US's population and the relative scarcity of zip codes, this seems an incredible claim. The link in the article is broken so I can't read the paper. Even just thinking about the big cities, where I imagine virtually no one would be identifiable, that figure sounds impossibly high. Maybe the figure actually refers to just working adults or something like that. Does anyone have any more information about this, or access to the original paper?
<i>“a privacy blunder that could cost millions of dollars in fines and civil damages.”</i><p>Since they considered the knowledge gained from the original contest cheap at $1 million, I'm sure the bigwigs at Netflix are wondering, "How <i>many</i> millions?"
I actually saw this lady at a bar once kissing another woman. But I had no idea she was a lesbian until I wrote a deanonymizer on a dataset of millions of rows and then combed through her IMDB posts to find one very suggestive comment.<p>Give me a break.<p>> The lead attorney on the new suit recently reached a multimillion-dollar settlement with Facebook over its failed Beacon program<p>It really annoys me when attorneys try to make millions when honest people trying to improve the world make a mistake.<p>So Beacon was a bad idea. Netflix should have asked for permission before releasing a user's anonymized data. But I think they learned their lessons.<p>Why should some random attorney who builds nothing get paid millions and obstruct these companies from continually trying to innovate?<p>Sigh.
I think this demonstrates why people should be more careful about what they post in public forums, under their own names. The ability to make associations like this is only going to become easier.