Privacy & Compliance · Study deck

Privacy Threats: Collection to Profiling

An IoT privacy threat often starts with a device doing its assigned job.

Privacy Priya is your guide for this deck.

privacy-threatsinference-attackre-identification

Privacy Priya, the module guide, in a scene from this chapter.

After studying this chapter

Learning objectives

You will be able to:

explain why a fully secure device can still be a privacy threat
name the five IoT privacy threat families and give an IoT example of each
walk an aggregation scenario to show how "anonymous" per-unit data re-identifies a specific person
distinguish anonymization from pseudonymization and explain why a reversible key defeats the latter

Major section

The Core Idea: Privacy Is Not Security

In the Internet of Things, the harder and more common problem is the opposite: devices that work exactly as designed, quietly collecting and sharing far more about people than anyone intended.

A privacy threat is not mainly about an attacker defeating a lock.
The cleanest way to hold the distinction is a house.
Security is the locks, the alarm, and the strong door that keep intruders out.

Major section

The Core Idea: Privacy Is Not Security (continued)

Privacy is the curtains and the choice of who gets to look inside.

You can have excellent security and poor privacy at the same time: a house with the best locks in the neighborhood and no curtains is perfectly protected from burglars and completely exposed to anyone walking past.
A thermostat that logs the temperature every minute is behaving correctly, yet that same log reveals when you wake, when you leave, and when your home is empty.
If you can explain why a secure device can still be a privacy threat, you have the core idea.

Major section

Practitioner: Five Threat Families

A device that reads contacts or location it never needs for its function.

The landlord already holds the unit-to-tenant mapping in the lease, so a unit number is just a reversible label.
If you can name the family for a given risk and reason through what the combined data reveals, you can stop here.
Unit numbers do not make these readings anonymous; keeping the lease mapping separate with strict access can reduce exposure, but the readings remain personal data.

Major section

Under the Hood: Inference Risks

The deeper layer explains the mechanisms that turn telemetry into a person.

In information terms, the joint information several sources carry about a target can be greater or smaller than the sum of their individual contributions, depending on synergy and redundancy.
"Anonymous" usually means "names removed," which is far weaker than it sounds.
The amounts here are qualitative on purpose; the lesson is the direction, not a fabricated bit count.
Fine-grained records remain unique and re-identifiable.

How ordinary IoT signals expose people through aggregation and inference, re-identification through quasi-identifiers and linkage, and leakage through side channels and passive identifiers.

Major section

Under the Hood: Inference Risks (continued)

Some leakage rides on signals that were never meant to carry content.

The practical consequence is that adding a few "harmless" streams can move an attacker from a rough guess to near-certainty, which is exactly why privacy degrades fast as devices accumulate.
It fails when those quasi-identifiers are left too fine-grained, so a record stands alone (effectively a group of one).
Threat model that assumes the attacker has auxiliary data.

Major section

Under the Hood: Inference Risks (continued)

Address randomization and whether broadcasts are logged.

The fix is to generalize (a city block instead of an intersection, an hour instead of a minute) and to suppress tiny groups.
Raising k alone does not help if precise quasi-identifiers still allow linkage to outside data.
Traffic shape can leak activity even when content is encrypted.

Major section

Under the Hood: Inference Risks (continued)

These channels matter because they bypass the consent and access controls placed on the "real" data path.

Published research has shown that only a handful of time-stamped location points is often enough to single out an individual in a large dataset.
Anonymization aims to make re-identification infeasible even with effort, and truly anonymous data is no longer personal data.
"Anonymized" release is rejoined to a lease or public roll.

Deck summary

Key takeaways

In the Internet of Things, the harder and more common problem is the opposite: devices that work exactly as designed, quietly collecting and sharing far more about people than anyone intended.

Privacy is the curtains and the choice of who gets to look inside.
A device that reads contacts or location it never needs for its function.
The deeper layer explains the mechanisms that turn telemetry into a person.
Some leakage rides on signals that were never meant to carry content.

Retrieval practice

Recall check 1 of 4

Privacy Priya says: answer from memory, then check your reasoning.

Q1A smart speaker uses strong encryption and has never been breached, yet by design it records audio-derived data and shares it with several companies. Why is this still a privacy problem?

AEncryption protects access; privacy asks whether collection and sharing are warranted.

BEncryption makes audio-derived collection private because ciphered data cannot reveal a person's behavior.

CA longer encryption key resolves questions about collection purposes.

DSecurity and privacy coincide whenever the device is not breached.

Show answer

Answer: A Security and privacy are different questions.

Retrieval practice

Recall check 2 of 4

Privacy Priya says: answer from memory, then check your reasoning.

Q2A landlord installs per-unit thermostats, locks, water sensors, and meters and says the data is anonymous because it is labeled only by unit number, not tenant name. Why does this fail to protect privacy?

AIt is adequate, because removing tenant names makes the data anonymous

BThe only issue is that the meter readings should be encrypted in transit

CThe landlord already holds the unit-to-tenant mapping in the lease.

DPrivacy is fine as long as each individual stream is harmless on its own

Show answer

Answer: C Pseudonymous labels do not anonymize data when the controller owns the linking key, and aggregating the streams exposes sensitive routines regardless of names.

Retrieval practice

Recall check 3 of 4

Privacy Priya says: answer from memory, then check your reasoning.

Q3A wearable sends encrypted packets only when a person moves. What privacy risk remains outside the payload?

APacket timing is harmless once payload bytes are encrypted.

BTiming matters only when passwords appear in clear text.

CMovement-linked transmission times can reveal activity patterns.

DTiming matters only if users post their locations online.

Show answer

Answer: C Traffic shape is a side channel around the intended data path.

Retrieval practice

Recall check 4 of 4

Privacy Priya says: answer from memory, then check your reasoning.

Q4A city releases traffic records with k-anonymity (k = 5) over the quasi-identifiers location and timestamp, but one record reads 'Main St & 1st Ave, 14:30, count 1' and is clearly unique. What went wrong?

AThe vehicle count value should have been encrypted before release

Bk-anonymity can never work for IoT data, so only encryption can help

CThe quasi-identifiers were left too fine-grained.

DThe only problem is that k should have been set to exactly 6

Show answer

Answer: C k-anonymity depends on generalizing the quasi-identifiers enough that every record shares its combination with at least k-1 others.

Print reference

Answers

Answer key.

A · Security and privacy are different questions.
C · Pseudonymous labels do not anonymize data when the controller owns the linking key, and aggregating the streams exposes sensitive routines regardless of names.
C · Traffic shape is a side channel around the intended data path.
C · k-anonymity depends on generalizing the quasi-identifiers enough that every record shares its combination with at least k-1 others.