In what follows, we provide recommendations on the quasi-identifiers level of granularity that will ensure low re-identification risk for both the highly motivated and mildly motivated adversaries (and hence all the motivation levels between the two).
For each one of these examples, the degree of motivation can vary from highly motivated, to mildly motivated.
At the urging of our producers, we found it on "Make Me Move," a site for mildly motivated sellers to sort of list their house without actually listing it.
A mildly motivated adversary might only attempt one verification: M j = 1.
For the simulation, we focused on the two extreme cases of a mildly motivated adversary, and a highly motivated one.
Under the first scenario we considered, the adversary is mildly motivated to the extent that they would be prepared to make M = 1 attempts at verification.
This will ensure that the overall risk of re-identification is quite low under the scenario of a mildly motivated adversary.
This number depends on how motivated the adversary is: a mildly motivated adversary might stop after one verification attempt, while a highly motivated adversary might persist and verify as many potential matches as possible, limited only by financial or practical considerations.
Two adversary scenarios were considered: (a) a mildly motivated adversary who will stop after one verification attempt, and (b) a highly motivated adversary who will attempt to verify all the potential matches and is only limited by practical or financial considerations.
We did not use values below 0.5 because we know from the ADE dataset and the national broadcaster example that verification is doable relatively easily, which makes it difficult to justify a lower value for p. For the number of attempts, M j, we use M j =1 for a mildly motivated adversary, and M j = F j for an adversary who will exhaust all matching records in the obituary.
