Going deeper with personally identifiable information

The monthly volume of Internet traffic is on the order of _billions_ of gigabytes. To put this number into perspective, every word ever spoken can fit into five billion gigabytes!

What types of data flow through the Internet? One type is numerical such as a city’s temperature. Another type is categorical such as a movie genre. An extremely useful type of data is **personally identifiable information** (**PII**). PII refers to any data that can help identify you, such as your address or name.

Organizations use PII to improve users' online experiences.

For example, an e-commerce website like Amazon stores PII (my shopping history) so that it can make better item recommendations. As you can see below, Amazon learned from my prior purchases that I love tea and pens and decided to recommend more kinds of teas and pens.

[[☃ image 1]]

Let's look at another example: Google Discover, a personalized dashboard for mobile phones. It's an application that helps plan my daily commute and surprisingly, it even knows where I parked my family’s car!

[[☃ image 3]]

Because parking locations and other forms of PII can be very sensitive, we want companies to keep our PII private and prevent it from falling into the wrong hands.

So then, how do companies keep PII private if it flows through a public, open Internet? How do attackers steal PII and how do companies defend against it?

We'll answer these questions in this unit about online data security.

First, we’ll cover PII in more detail and see the different ways it's collected. Then, we’ll see the different ways attackers steal PII via phishing, rogue access points, or computer malware.

We’ll then show how cryptography can help keep PII private with encryption and also prevent PII from falling into the wrong hands with authentication. We’ll see how encryption sends “locked” PII over the public Internet and unlocks it only if someone presents the correct key. We’ll also see how authentication verifies someone’s identity before sending over PII.

Finally, we’ll see how the Internet incorporates these cryptographic techniques into the TLS and HTTPS protocols.

Let’s begin!

[[☃ explanation 1]]

Personally identifiable information (PII) refers to data that can directly or indirectly identify individuals.

Direct identification

The following PII directly identify an individual:

PII type | Example

• | - | -
  Name | Kavita Hawkins
  Social Security number | 123-45-6789
  Biometric data | [[☃ image 4]]

Indirect identification

A name or a thumbprint are obvious examples of PII. It's not always that straightforward, however.

Consider a phone number: (408)-930-0000

Using just the phone number, could you directly identify a person? Probably not. Yet, if you also had a phone book for the 408 area code, you probably could.

In other words, the phone number when linked with the phone book could indirectly identify someone.

This example highlights another form of PII: linkable PII, which refers to data that can be combined from separate sources to identify individuals.

Common examples include:

PII type | Example

• | - | -
  Age | 25
  Race | American Indian
  Location | 116 Broadway, NYC, NY, 10027
  Medical data | Date of visit: March 12, 2020, Diagnosis: Flu

Is X considered PII?

Classifying information as PII is challenging. For example, one view of IP addresses suggests they are not PII since they identify computers instead of individuals. On the other hand, IP addresses could be considered PII since they often identify geographical locations and act as linkable PII. The correct classification is unclear.

Even if data is not considered to be PII in the present, it may be in the future. If a future government law enforces that an individual owns a set of IP addresses, then IP addresses will become PII by definition. The classification of data as PII can change over time.

Linkable PII makes this classification even more difficult. For example, you can use the timestamps from someone's social media posts to infer the timezone they live in. If that person also posts a photo of a restaurant they ate at, you can use the timezone to figure out where the restaurant could be located. At this point, you could form an approximate idea of where a person lives or who they are! All from linking timestamps with a restaurant photo.

🤔 In this fictional example, do you think the linkable PII was the restaurant photo or the timestamps? What are other examples of data that could be classified as direct PII or linkable PII?

PII theft

Attackers can steal PII from companies, often known as a data breach.

In 2017, the consumer credit agency Equifax was the victim of a data breach, and attackers had access to the PII of 143 million Americans. The PII included Social Security numbers and credit card numbers. $^1$

Once attackers had access to that data, they could use the Social Security numbers to impersonate people or use the credit card numbers to make unauthorized purchases.

How would you know if you were a victim of a data breach? The breached organization will hopefully notify you, but services like HaveIBeenPwned can also provide an answer.

Here's an example from HaveIBeenPwned for a generic email address:

[[☃ image 1]]

PII regulations

Because PII falling into the wrong hands can hurt the lives of its owners, laws regulate how institutions store and process PII.

For instance, in the United States, the Health Insurance Portability and Accountability Act (HIPAA) regulates medical PII, whereas the Children's Online Privacy Protection Act (COPPA) regulates the PII of children. In Europe, most forms of PII are regulated under a law called General Data Protection Regulation (GDPR). If you ever develop a website or app that deals with PII of users in those jurisdictions, you’ll have to follow these regulations.

Recommendations

As users, it's best to only give out our PII to online services when it's necessary—and it's almost never necessary to give out government identifiers like a Social Security number.

We should also be careful about our posts on social media. Even if our posts are not clearly PII now, there could be things about that data that we don't yet understand that make it linkable PII in the future.

[[☃ explanation 1]]