Privacy & Compliance · Study deck
Privacy Threats: Collection to Profiling
An IoT privacy threat often starts with a device doing its assigned job.
Privacy Priya is your guide for this deck.
After studying this chapter
Learning objectives
You will be able to:
- explain why a fully secure device can still be a privacy threat
- name the five IoT privacy threat families and give an IoT example of each
- walk an aggregation scenario to show how "anonymous" per-unit data re-identifies a specific person
- distinguish anonymization from pseudonymization and explain why a reversible key defeats the latter
Major section
The Core Idea: Privacy Is Not Security
In the Internet of Things, the harder and more common problem is the opposite: devices that work exactly as designed, quietly collecting and sharing far more about people than anyone intended.
- A privacy threat is not mainly about an attacker defeating a lock.
- The cleanest way to hold the distinction is a house.
- Security is the locks, the alarm, and the strong door that keep intruders out.
Major section
The Core Idea: Privacy Is Not Security (continued)
Privacy is the curtains and the choice of who gets to look inside.
- You can have excellent security and poor privacy at the same time: a house with the best locks in the neighborhood and no curtains is perfectly protected from burglars and completely exposed to anyone walking past.
- A thermostat that logs the temperature every minute is behaving correctly, yet that same log reveals when you wake, when you leave, and when your home is empty.
- If you can explain why a secure device can still be a privacy threat, you have the core idea.
Major section
Practitioner: Five Threat Families
A device that reads contacts or location it never needs for its function.
- The landlord already holds the unit-to-tenant mapping in the lease, so a unit number is just a reversible label.
- Unit-level pseudonymization gives essentially zero protection when the controller already owns the key that links it back to a person.
- If you can name the family for a given risk and reason through what the combined data reveals, you can stop here.
Major section
Under the Hood: Inference Risks
The deeper layer explains the mechanisms that turn telemetry into a person.
- In information terms, the joint information several sources carry about a target is at most the sum of their individual contributions, and it approaches that sum when the sources are conditionally independent given the target.
- Fine-grained records remain unique and re-identifiable.
Major section
Under the Hood: Inference Risks (continued)
The practical consequence is that adding a few "harmless" streams can move an attacker from a rough guess to near-certainty, which is exactly why privacy degrades fast as devices accumulate.
- The amounts here are qualitative on purpose; the lesson is the direction, not a fabricated bit count.
- "Anonymous" usually means "names removed," which is far weaker than it sounds.
- Threat model that assumes the attacker has auxiliary data.
Major section
Under the Hood: Inference Risks (continued)
It fails when those quasi-identifiers are left too fine-grained, so a record stands alone (effectively a group of one).
- The fix is to generalize (a city block instead of an intersection, an hour instead of a minute) and to suppress tiny groups.
- Raising k alone does not help if precise quasi-identifiers still allow linkage to outside data.
- Some leakage rides on signals that were never meant to carry content.
Major section
Under the Hood: Inference Risks (continued)
Published research has shown that only a handful of time-stamped location points is often enough to single out an individual in a large dataset.
- Anonymization aims to make re-identification infeasible even with effort, and truly anonymous data is no longer personal data.
- Pseudonymization replaces identifiers with a token but keeps a key that can reverse it, so pseudonymous data is still personal data and still regulated.
- Address randomization and whether broadcasts are logged.
Major section
Under the Hood: Inference Risks (continued)
These channels matter because they bypass the consent and access controls placed on the "real" data path.
- Most "anonymized" datasets are really pseudonymized, and they fall to a linkage attack: joining the released data with auxiliary information (a lease, a voter roll, a social profile) to restore identity.
- "Anonymized" release is rejoined to a lease or public roll.
- Traffic shape can leak activity even when content is encrypted.
Deck summary
Key takeaways
In the Internet of Things, the harder and more common problem is the opposite: devices that work exactly as designed, quietly collecting and sharing far more about people than anyone intended.
- Privacy is the curtains and the choice of who gets to look inside.
- A device that reads contacts or location it never needs for its function.
- The deeper layer explains the mechanisms that turn telemetry into a person.
- The practical consequence is that adding a few "harmless" streams can move an attacker from a rough guess to near-certainty, which is exactly why privacy degrades fast as devices accumulate.
Retrieval practice
Recall check 1 of 3
Privacy Priya says: answer from memory, then check your reasoning.
Q1A smart speaker uses strong encryption and has never been breached, yet by design it records audio-derived data and shares it with several companies. Why is this still a privacy problem?
Show answer
Answer: A Security and privacy are different questions.
Retrieval practice
Recall check 2 of 3
Privacy Priya says: answer from memory, then check your reasoning.
Q2A landlord installs per-unit thermostats, locks, water sensors, and meters and says the data is anonymous because it is labeled only by unit number, not tenant name. Why does this fail to protect privacy?
Show answer
Answer: A Pseudonymous labels give no protection when the controller owns the linking key, and aggregating the streams exposes sensitive routines regardless of names.
Retrieval practice
Recall check 3 of 3
Privacy Priya says: answer from memory, then check your reasoning.
Q3A city releases traffic records with k-anonymity (k = 5) over the quasi-identifiers location and timestamp, but one record reads 'Main St & 1st Ave, 14:30, count 1' and is clearly unique. What went wrong, and what is the correct fix?
Show answer
Answer: B k-anonymity depends on generalizing the quasi-identifiers enough that every record shares its combination with at least k-1 others.
Print reference
Answers
Answer key.
- A · Security and privacy are different questions.
- A · Pseudonymous labels give no protection when the controller owns the linking key, and aggregating the streams exposes sensitive routines regardless of names.
- B · k-anonymity depends on generalizing the quasi-identifiers enough that every record shares its combination with at least k-1 others.