Anonymous data sharing debuts

Sharing data among government agencies is easier said than done. Many groups want or need to protect the confidentiality of their information.Systems Research and Development Corp. of Las Vegas, a developer of identity recognition software, has come up with an application that lets organizations share and compare data without compromising individual privacy.SRD's Anonymous Entity Resolution software, dubbed Anna, uses a hashing algorithm to create a unique identifier for each piece of personal data in a file. Identifiers from different lists can be compared for matches without revealing the identity of the underlying individual."In the last two years we have seen the need for sharing more information while protecting privacy," said John Slitz, chief executive officer of SRD. "This is a technique that allows us to look at large quantities of data, and only evaluate the data that is common to both sets."Slitz said about 70 percent of SRD's revenue comes from government, and he expects government, along with the financial and health care industries, to be among the early adopters of the product. Anna is now in beta testing, and SRD expects to release it commercially in January. Pricing has not been determined.While it was still in the prototype stage, SRD's technology attracted the attention of In-Q-Tel, the CIA's technology investment incubator. The group partially funded development of the Anna technology, said Gilman Louie, CEO of In-Q-Tel.Louie said homeland security programs depend on the ability of agencies to share data and use private-sector information securely while assuring the public that privacy is not being compromised."Unless there is a technical solution to enable the policies, we are not going to get there," he said. "In some places, we're at a logjam."Louie cited the discontinued Total Information Awareness program at the Defense Advanced Research Program Agency and the Homeland Security Department's Computer Aided Passenger Prescreening System II, both of which fell victim to privacy concerns. "There is no perfect technology," he said, "but this could be a critical enabling technology, providing a degree of comfort."Anna builds on two previous SRD products: the Erik Identity Recognition Architecture, which standardizes names, cleanses personal data and puts it into a common format for comparison; and Non-Obvious Relationship Awareness (Nora), which looks for bits of information that could link people, such as shared telephone numbers and addresses.Anna adds anonymization to the mix and a tool to compare anonymous lists of hashed data.A hashing algorithm creates a unique signature when it runs against any piece of digital data. The process cannot be reversed to reveal the original data, but two identical pieces of data will produce the same hash signature. Identical names, Social Security numbers and other identifying data each produce the same hash if the holders of the data use the same hashing tools. This would let airport screeners, for instance, compare anonymized passenger data with government no-fly lists without releasing identifying data from either list. When matches are found, the appropriate parties could be notified for further action.Slitz envisions an infrastructure in which a trusted third party, either a government agency or a private organization, would compare anonymized data from other parties. The third party would not have access to any identifiable data."They're not doing anything but providing computer space where the hashed values are compared," he said.The encryption technology of hashing algorithms is not a complete solution to maintaining anonymity, said Peter Swire, professor of law at Ohio State University and former chief counselor for privacy in the Office of Management and Budget during the Clinton administration."Every encryption technique is subject to constant challenge. Something that works today is likely to be broken in the future," Swire said. "But having state-of-the-art security is much better than no security at all."Swire said political will is the greatest obstacle to the adoption of Anna and similar technologies. Many agencies might still prefer to use identifiable information for security applications. Even if the technology works as hoped, "there are still many policy hurdles to overcome," Louie said. How many and what types of data fields must be identical before identities can be matched will vary depending on the application.Ultimately, however, surveillance policies should not be tailored for the convenience of agencies, Swire said. "The ability of data mining to explode personal privacy is terrifying to many citizens," he said.William Jackson is a senior editor for Government Computer News. He can be reached at wjackson@postnewsweektech.com.