Connected Vehicle Privacy Assessment – Geotrack De-Identification Algorithm

Abstract

Global positioning technology has become integrated into our daily lives in a way no one would have imagined a generation ago. Intelligent transportation systems will use the precise position information this technology furnishes to save lives. Positioning technology provides undeniable benefits; however, it can be exploited to learn the movements of individuals. Examination of high fidelity vehicle track information by entities other than the vehicle’s driver can be a significant invasion of privacy. The cell phone industry continues to evolve their privacy strategies to ease the tension between individuals, the private sector, and the public sector. Connected vehicle technology is less mature and arguably more complex. Research, innovation, and development in this space can benefit from open data resources. Facilitating open access research while preserving individual privacy is a challenge. Designing privacy protections for deployed connected vehicle systems is a broader challenge. The de-identification algorithm outlined in this report attempts to address some of these concerns. Personally Identifiable Information (PII) is any information that uniquely identifies an individual or that is linkable to an individual’s identifier(s) [GAO2008]. Data that describes a specific aspect of an individual’s activities and is traceable to that individual can also be considered PII. The de-identification algorithm attempts to remove data that could be traced to addresses, vehicle identifiers, or other sensitive information about an individual’s movements to include employment location. Ultimately, each individual must define which locations they consider private; these definitions usually vary over time. This report introduces a language for discussing trip de-identification. The sensitive trip segments people wish to protect are called critical intervals. Critical intervals are protected from re-identifiers by surrounding them with privacy intervals; they introduce sufficient uncertainty to make re-identification unreasonable. Batch de-identification cannot address individual critical interval definitions, so a general set of assumptions must be made concerning what people would like to protect. Researchers and malicious parties share a common interest when it comes to driver trip information (geotracks): they want as much of the original data as possible. A de-identification algorithm seeks to satisfy the researcher’s interest, but deny the interest of the malicious party. From the range of data release strategies, trip truncation strikes a balance between not releasing anything and releasing too much; the de-identification algorithm employs trip truncation, but parameterizes the process to generate results that can span the data utility anonymity spectrum, if desired. This report outlines the design, development, and testing of a new algorithm for de-identifying trip data generated by connected vehicles. It uses latitude, longitude, heading, speed, and timestamp from each Basic Safety Message (BSM) that define a trip. Each trip can also be characterized as a collection of features derivable from subsequences of BSMs. Geotrack de-identification techniques identify features whose removal obfuscates the generator’s identity. It integrates map data to improve de-identification precision. Two high-level goals drove the design of this de-identification algorithm: modularity and configurability. The de-identification process can be separated logically into a sequence of steps that translate into code modules: map preprocessing, fitting trips to maps, detection of privacy sensitive locations within a trip called critical intervals, generation of privacy protection regions called privacy intervals, and ultimately de-identification through critical interval and privacy interval removal. This algorithm has been used to de-identify connected vehicle pilot data; it may be applicable to the wider challenge of protecting privacy in deployed connected vehicle technology. Many of the technical details of the algorithm are described including efficient map searching, a method to fit geopoints to road networks, the function of four critical interval detectors, and the truncation process. The algorithm was designed with efficiency and parallelization in mind. The code has been reviewed by multiple developers and tested extensively; however, the capabilities of the algorithm are still being improved. Numerous configuration parameters are provided to customize the de-identification process. One set selects and tunes critical interval detectors; another governs how privacy intervals are constructed. During de-identification, several measurements are taken from each trip to determine when privacy intervals should be terminated; these conditions are also configurable. Using an ensemble of features like the number of exiting roads at intersections, road type, and various distance calculations, privacy interval generation adjusts to the road networks encountered in urban and rural environments. The process of step-wise de-identification is discussed as a means to investigate de-identification parameter settings. A technique for automating parameter optimization is also introduced. The final chapter of this report discusses validating the code’s effectiveness. Two de-identification trials were run over approximately 460,000 trips from the Ann Arbor Safety Pilot Model Deployment. Three hundred and eighty four trips were randomly selected and visually inspected from each trial. None of the sampled trips included directly identifiable residential locations. Less than ten trips from each trial contained features the algorithm failed to identify. Upon inspection, these features were judged to present little to no risk to re-identification.