4.1k VIEWS
Pinterest LinkedIn LINE

We are entering a summer at the height of the My Number compliance bubble. How is everyone doing?

As it happens, pension numbers have leaked on a massive scale1 People say this might also affect My Number, but I feel uneasy about treating the leakage of an “identifier number” as an even greater crisis than the leakage of personal information such as an address, name, and date of birth. In terms of leakage, the privacy impact is “identifier number” < “address, name, and date of birth” << “associated information.” For simplicity, the discussion below focuses on “identifier number” < “address, name, and date of birth.”

1. Harm from Impersonation

An identifier number itself should have no capability beyond distinguishing one person’s data from another’s. In the United States, misunderstanding led people to use Social Security numbers themselves for identity verification, causing major impersonation incidents2. Japan’s My Number and pension numbers should not be used that way. For My Number, such use is explicitly prohibited by law. Meanwhile, requests such as “For identity verification, please provide your name, address, and date of birth” are everywhere. In this social-media era, it is surprising that more incidents have not occurred. This alone should demonstrate that the direct risk of harm from impersonation is “identifier number” < “address, name, and date of birth.” Routes through which impersonation can cause harm include:

  1. Disclosure of unwanted information, particularly “associated information”
  2. Blackmail or interference with a person’s decisions using acquired “associated information”
  3. Financial loss caused by conducting financial transactions through impersonation

and others.

2. Possibility of Relief Through Change

Next, consider the possibility of obtaining relief by changing what was leaked.

Leaked “associated information” is difficult to recover, and “bad actors” gather it for profiling. The information used as a “key” to match different pieces of associated information and aggregate data is technically called an identifier or identifying information3. Both an “identifier number” and an “address, name, and date of birth” are identifying information. Incidentally, the principal identifying information on the Internet is an email address or mobile-phone number. Telephone numbers are also often used as identifying information at ordinary shops.

When “associated information” leaks, it often leaks as an “identifying-information–associated-information” pair. A bad actor aggregates “identifying information–associated information A” and “identifying information–associated information B” to create “identifying information–associated information A–associated information B,” then tries to infer what the person is like. This is called “profiling unwanted by the individual,” and it is a representative privacy violation.

In such a case, whether the identifying information can be changed affects resistance to future incidents.

Suppose “identifying information A–associated information A” leaks at a particular time. At that point, the person’s “identifying information A” is switched to “identifying information B.” No subsequent associated information will then be linked to “identifying information A,” preventing post-incident data from being matched and aggregated with the leaked data. This is the benefit of changing identifying information.

An “identifier number” can be changed, as currently proposed for leaked pension numbers4. By contrast, a date of birth cannot be changed, a name is extremely difficult to change, and changing an address is nearly hopeless for a homeowner, though perhaps feasible for a renter. Thus, in terms of the possibility of relief from future data aggregation through change, an “identifier number” is far superior to a “name, address, and date of birth,” and the privacy impact is “identifier number” < “address, name, and date of birth.”

3. Value of the Information Itself

Next, consider the value of the information itself. If operated correctly, an “identifier number” can only be used as identifying information to distinguish one record from another, so it should be worthless to anyone other than the individual and the administrator. An “address and name,” by contrast, provides what might be called “reachability.” Thus, the value of the information is “identifier number” << “address, name, and date of birth.” It can also be abused: at the less serious end, to send direct mail; at the gravest end, to let an abuser attack and kill a domestic-violence victim. Likewise, the value of information is “identifier number” << “associated information.” Without associated information, aggregation and profiling are meaningless.

4. Conclusion

For the reasons above, an “identifier number” presents fairly low information risk. In a leakage incident, attention should therefore focus not on the “identifier number” but on the “associated information.” Public understanding is misaligned here. Reports on the Japan Pension Service leak often say, “The leaked information is believed to include basic pension numbers, names, dates of birth, addresses, and so on.” Wait—the “and so on” is what matters.

Regarding My Number, I repeatedly stated in the technical sub-working group that “the system should be prepared to make changes easy.” I of course trust that it has been designed that way. I would truly be astonished if it had not.

 

 

 

Footnotes

  1. From the Nikkei article “Personal pension information for 1.25 million cases leaked through unauthorized access: Japan Pension Service” (2015/6/1), http://www.nikkei.com/article/DGXLASDG01HB5_R00C15A6000000/ retrieved 2015/6/9.
  2. The myth that private-sector use of US Social Security numbers (SSNs) is unrestricted
  3. In ISO/IEC 24760 and similar standards, “identifying information” refers to the “value” in an “identifier-name: value” name-value pair, so some caution is required.
  4. My Number is apparently intended to remain unchanged for life, but, as I have long said, it should be made easy to change. Technically, this is not a major issue.

Related posts