Perturbation Methods for Protection of Sensitive Location Data: Smartphone Travel Survey Case Study

Abstract

Smartphone based travel data collection has become an important tool for the analysis of transportation systems. Interest in sharing travel survey data has gained popularity in recent years as “open data initiatives” by governments seek to allow the public to use these data, and hopefully to contribute their findings and analysis to the public sphere. The public release of such precise information, particularly location data such as place of residence, opens the risk of privacy violation. At the same time, in order for such data to be useful, as much spatial resolution as possible is desirable for utility in transportation applications and travel demand modeling. This paper evaluates the efficacy of two geographic random perturbation methods—geo-indistinguishability and donut geomask—in protecting the privacy of respondents whose residential location may be published. The study measures the performance of location privacy methods, preservation of utility, and randomness in the distribution of perturbation distances with varying parameters. It is found that both methods produce distributions of spatial perturbations that conform closely to common probability distributions and, as a result, that the original locations can be inferred with little information and a high degree of precision. It is also found that while achieved k -estimate anonymity increases linearly with desired anonymity for the donut geomask, geo-indistinguishability is highly dependent upon its privacy budget factor and is not very effective at assuring desired achieved k -estimate anonymity.

Blockchain-based privacy and security model for transactional data in large private networks

“…The most difficult aspect of these techniques is striking a balance between data value and privacy protection. Ideally, both are necessary; however, these requirements are inverse, hence complete privacy protection and optimal data usefulness cannot coexist 30 .…”

Discrete choice modeling with anonymized data

“…Some of these techniques involve aggregation, spatial cloaking, or random perturbation [for a detailed overview of different mechanisms, please refer to Krumm (2009)]. A typical example is perturbation of residential locations of surveyed individuals, where the anonymization procedure aims to maintain the usefulness of the data (Badu-Marfo et al 2019). The authors of Badu-Marfo et al (2019) focus on analyzing the performance of different perturbation mechanisms for protecting the privacy of survey respondents.…”

“…A typical example is perturbation of residential locations of surveyed individuals, where the anonymization procedure aims to maintain the usefulness of the data (Badu-Marfo et al 2019). The authors of Badu-Marfo et al (2019) focus on analyzing the performance of different perturbation mechanisms for protecting the privacy of survey respondents. They also point out that current methods mainly deal with the anonymization of single points and that further research is needed in developing methods for multi-point data.…”

Travel time errors caused by geomasking might be different between transportation modes and types of urban area

“…For example, to detect the spatial clusters of a disease, it would be important to preserve the spatial patterns of the original locations as much as possible after geomasking (e.g., Cassa, Grannis, Overhage, & Mandl, 2006; Kwan et al., 2004). Besides, to investigate the effects of the built environment on behavioral and health outcomes (e.g., travel mode choice behaviors), it would be crucial to preserve the built‐environment characteristics of the original locations as much as possible after geomasking (e.g., Badu‐Marfo, Farooq, & Patterson, 2019; Clifton & Gehrke, 2013; Elkies, Fink, & Bärnighausen, 2015).…”

“…Particularly, when calculating transit‐based travel times, these errors can be critical because a transit‐based travel time for a specific transit route may be changed in terms of the departing station (Badu‐Marfo et al., 2019; Elkies et al., 2015). Specifically, geomasking may have altered the original locations in a dataset to the extent that different departing stations (compared with the original departing stations) may be selected for calculating transit‐based travel times.…”