<abstract xmlns="http://www.w3.org/1999/xhtml"><p>In the UK, the transparency agenda is forcing data stewardship organisations to review their dissemination policies and to consider whether to release data that is currently only available to a restricted community of researchers under licence as open data. Here we describe the results of a study providing evidence about the risks of such an approach via a simulated attack on two social survey datasets. This is also the first systematic attempt to simulate a jigsaw identification attack (one using a mashup of multiple data sources) on an anonymised dataset. The information that we draw on is collected from multiple online data sources and purchasable commercial data. The results indicate that such an attack against anonymised end user licence (EUL) datasets, if converted into open datasets, is possible and therefore we would recommend that penetration tests should be factored into any decision to make datasets (that are about people) open.</p></abstract>

In the UK, the transparency agenda is forcing data stewardship organisations to review their dissemination policies and to consider whether to release data that is currently only available to a restricted community of researchers under licence as open data. Here we describe the results of a study providing evidence about the risks of such an approach via a simulated attack on two social survey datasets. This is also the first systematic attempt to simulate a jigsaw identification attack (one using a mashup of multiple data sources) on an anonymised dataset. The information that we draw on is collected from multiple online data sources and purchasable commercial data. The results indicate that such an attack against anonymised end user licence (EUL) datasets, if converted into open datasets, is possible and therefore we would recommend that penetration tests should be factored into any decision to make datasets (that are about people) open.

End User Licence to Open Government Data? A Simulated Penetration Attack on Two Social Survey Datasets

School of Social Sciences, University of Manchester, Manchester M13 9PL, UK.

Office for National Statistics, Segensworth Road, Titchfield, Fareham, Hampshire, PO15 5RR, UK.

Journal of Official Statistics

This work is licensed under the Creative Commons Attribution-NonCommercial-NoDerivatives 3.0 License.

In the UK, the transparency agenda is forcing data stewardship organisations to review their dissemination policies and to consider whether to release data...

End User Licence to Open Government Data? A Simulated Penetration Attack on Two Social Survey Datasets

Published Online: May 28, 2016

Page range: 329 - 348

Received: Dec 01, 2014

Accepted: Nov 01, 2015

DOI: https://doi.org/10.1515/jos-2016-0019

© 2016 Mark Elliot et al., published by De Gruyter Open

This work is licensed under the Creative Commons Attribution-NonCommercial-NoDerivatives 3.0 License.