NYU researchers find weak spots in Europe's 'Right to be Forgotten' data privacy law

June 07, 2016

BROOKLYN, New York - Under Europe's "Right to be Forgotten" law, citizens there can petition Internet search providers such as Google to remove search results linked to personal information that is negative or defamatory. In many cases, these links lead to information about accusations of criminal activity or financial difficulties, which may be "delisted" if the information is erroneous or no longer relevant.

But "gone" doesn't always mean "forgotten," according to a new study by researchers at the New York University Tandon School of Engineering, NYU Shanghai, and the Federal University of Minas Gerais in Brazil.

"The Right to Be Forgotten has been largely working and is responding to legitimate privacy concerns of many Europeans," said New York University Professor Keith Ross. "Our research shows, however, that a third-party, such as a transparency activist or a private investigator, can discover many delisted links and determine the names of the people who requested the delistings." Ross, the Leonard J. Shustek Professor of Computer Science at NYU Tandon and dean of engineering and computer science at NYU Shanghai, led the research team, which included Professor of Computer Science Virgilio Almeida and doctoral students Evandro Cunha and Gabriel Magno, all of the Federal University of Minas Gerais, and Minhui Xue, a doctoral student at NYU Shanghai.

They focused only on requests to delist content from mass media sites such as online newspapers and broadcast outlets. Although the law requires search engines to delist search links, it does not require newspaper articles and other source material to be removed from the Internet.

A hacker faces a fairly low bar if he or she knows a particular URL has been delisted. Of 283 delisted URLs used in the study, the authors successfully determined the names of the requesters in 103 cases.

But the authors also demonstrated that a hacker can prevail even when the URL is unknown, by downloading media articles about topics most commonly associated with delisting, including sexual assault and financial misconduct; extracting the names from the articles; then sending multiple queries to a European Google search site to see if the articles were delisted.

The researchers estimate that a third party could potentially determine 30 to 40 percent of the delisted mass-media URLs, along with the names of the people who made the delisting requests. Such hackers do exist and have published the names of people who requested delisting, thereby opening them to even more public scrutiny - the so-called "Streisand effect," a phenomenon, named for the reclusive star, whereby an attempt to hide a piece of information has the unintended consequence of publicizing the information more widely.

Their results show that the law has fundamental technical flaws that could compromise its effectiveness in the future.

Demographic analysis revealed that the majority of requesters were men, ages 20-40, and most were ordinary citizens, not celebrities. In accordance with the law, Google delisted links for persons who were wrongfully charged, acquitted, or who finished serving their sentences, among other privacy issues.

The researchers believe that defenses to these privacy attacks are limited. One possible defense would be for Google to never display the delisted URL in its search results. (Currently, Jane Doe's delisted robbery article would not show up when her name is used in a search, but would do so if the name of the bank were searched, for example.) This defense is not only a strong form of censorship, but can also be partially circumvented, they said.

A French data protection authority recently ordered Google to delist links from all of its properties including Google.com, in addition to its search engines with European suffixes. Google has so far refused, and the dispute is likely to end up in European courts. "Even if this law is extended throughout all of the Google search properties, the potential for such attacks will be unchanged and they will continue to be effective," said Almeida of the Federal University of Minas Gerais.

The researchers noted that they will never publicly share the names discovered in association with their analysis. They informed Google of the research results.
-end-
The paper, entitled The Right to be Forgotten in the Media: A Data-Driven Study is available at https://docs.google.com/a/nyu.edu/viewer?a=v&pid=sites&srcid=bnl1LmVkdXxrZWl0aHJvc3N8Z3g6MzA5NmYxOWZlMjcwMzM1NQ. It will be presented the 16th Annual Privacy Enhancing Technologies Symposium in Darmstadt, Germany, in July, and will be published in the proceedings.

The NYU Tandon School of Engineering dates to 1854, when the NYU School of Civil Engineering and Architecture as well as the Brooklyn Collegiate and Polytechnic Institute (widely known as Brooklyn Poly) were founded. Their successor institutions merged in January 2014 to create a comprehensive school of education and research in engineering and applied sciences, rooted in a tradition of invention, innovation and entrepreneurship. In addition to programs at its main campus in downtown Brooklyn, it is closely connected to engineering programs in NYU Abu Dhabi and NYU Shanghai, and it operates business incubators in downtown Manhattan and Brooklyn. For more information, visit http://engineering.nyu.edu.

NYU Tandon School of Engineering

Related Search Engines Articles from Brightsurf:

Independent search engines respect your privacy but give more visibility to misinformation
Anti-vaccine websites, which could play a key role in promoting public hesitancy about a potential COVID vaccine, are far more likely to be found via independent search engines than through an internet giant like Google.

Argonne-led team finds special engines and fuels could cut air emissions and water use
Advanced fuels and new engine designs could reduce emissions and water use over the next 30 years, according for a new study led by Argonne scientists.

Retrofitting of VW Diesel engines was successful
Using exhaust gas measurements taken from the roadside, a team from the University of York and Empa was able to prove the ''Dieselgate'' scandal has led to positive results.

In search of the Z boson
At the Japanese High-energy Accelerator Research Organization, KEK, in Tsukuba, about 50 kilometers north of Tokyo, the Belle II experiment has been in operation for about one year now.

Micromotors get supercharged with three 'engines'
Someday, microscopic robots could perform useful functions, such as diagnostic testing in lab-on-a-chip sensors, micropatterning surfaces or repairing equipment in tight spaces.

Study shows social media and search engines are better than their reputation suggests
A recent study undertaken by researchers from Germany contradicts the assumption that the use of social networks and search engines has had a negative impact on the diversity of news that people access.

Scientists discover how TB puts the brakes on our immune engines
The scientists pinpointed a small mRNA molecule used by TB bacteria to shut down key engines that drive our immune response.

New salt-based propellant proven compatible in dual-mode rocket engines
For dual-mode rocket engines to be successful, a propellant must function in both combustion and electric propulsion systems.

New look at old data leads to cleaner engines
New insights about how to understand and ultimately control the chemistry of ignition behavior and pollutant formation have been discovered in research led by Sandia National Laboratories.

Particulate matter from aircraft engines affects airways
In a unique, innovative experiment, researchers under the leadership of the University of Bern have investigated the effect of exhaust particles from aircraft turbine engines on human lung cells.

Read More: Search Engines News and Search Engines Current Events
Brightsurf.com is a participant in the Amazon Services LLC Associates Program, an affiliate advertising program designed to provide a means for sites to earn advertising fees by advertising and linking to Amazon.com.