Big Data, Plainly Spoken (aka Numbers Rule Your World)

Statistical reasoning in sports

With the Olympics well under way, I've had some fascinating conversations with friends and coworkers, in which we mulled over causal reasoning frequently heard over the airwaves.

Here are a couple of examples:

• Growth stunting: there is this belief that training in certain sports like gymnastics from an early age may "stunt" one's growth. The proof is: almost all top-tier gymnasts have short figures!

Can gymnastics training invert one's genetic disposition of height? We wonder. Another explanation  is that taller people (or people with figures not optimal for top-tier gymnastics) have been weeded out by the competitive processes. Perhaps it's not the gymnastics training that has capped the gymnasts' heights, but shorter gymnasts have an advantage when performing gymnastics routines. This advantage could even be made more trivial - hypothetically, if judges held a preference for shorter gymnasts, so that they consistently scored them better, then the taller ones would eventually get weeded out, leaving just the shorter ones in competition.

• Effect of steriods/PEDs: One friend relates a conversation with another friend, who's an ice skating coach: the coach claimed that she could tell that a certain skater was doping by noticing some unnatural movement in her body, and later, she felt vindicated when that athlete tested positive for something.

This chain of reasoning requires an unproven step - that the substance the skater tested positive for in fact has the desired effect of improving her performance. What we observed are two things: a) the athlete did something amazing, perhaps beyond human ability; b) the athlete tested positive for a substance. We actually don't know that the latter caused the former. It may be likely but it by no means is certain. Given that these outlawed substances are rarely used, and any usage will be secretive, I'm not sure how these commentators are so confident in making the connection.

 

 

 

Know your data 39: everyone's doing it

Techcrunch did an investigation which uncovered that USPS (US Postal Office) is sending some private data of customres to social-media sites.

This news concerns USPS's "Informed Delivery" service, which allows customers to view images of their parcels en route. The website uses "tracking pixels" by companies such as Meta, Snap and Linkedin. So when users log on, the website requests the pixels (tiny images) from the servers of those companies, and in so doing, it is instructed to send data over. Techcrunch found that the data transmitted include physical addresses, user ids, computer and browser versions, etc. Those social-media companies then use the collected data to service advertisers and other partners.

***

I'm glad Techcrunch brought attention to this type of data collection. It's a bit odd that they single out USPS which is a government agency for having these tracking pixels. Pretty much every website we visit has these pixels, if they have any relationship with those social-media companies. For example, if you schedule a doctor's appointment online, if the web form has these pixels, everything you type into the form might be captured by those companies.

When you visit a site, there may be a popup asking your approval for sharing data. It would say something like we work with [insert some large number like 948] partners. That tells you how prevalent this sort of thing is. If you haven't seen these pop-ups, your browser probably accepts everything.

It's also odd to point the finger at the USPS developers because it's the social-media companies that want the tracking, and they are the ones who direct the behavior of those pixels.

Know your data 38: the script of the data leak theater

Every American has now watched the same script in the same theater several times. You know, when yet another big corporation announced that they have lost customer data that should be private. Then, after much delay, they publish some legally-vetted mumbo-jumbo, which contains a lot of words but nothing useful. (The latest example is this masterpiece by AT&T.) This is a script without plot or character development: indeed, in this theater, all characters remain nameless, hidden from the audience, not even on stage.

The script will definitely say that they have notified customers (for AT&T, over 100 million!), which is akin to the security company sending you a note after a burglar took everything from your home (and all your neighbors). The security company will have washed their hands off of this fiasco by sending such a note while accepting zero legal, or moral responsibility (such is our politics!). The note will turn congratulatory, like a script needing a happy ending: it will let customers know they have been involuntarily enrolled into some third-party's credit monitoring service - which, mind you, does not promise to stop further theft, rather that they would also notify you after another burglar cleaned out whatever still remains in your home.

Think twice about that for a moment. It would have been hard to live in the U.S. without having already been enrolled in such a credit monitoring service due to prior data leaks. So, one of the following two scenarios applies to the recent case of AT&T: either the credit monitoring service notified the customer of the AT&T leak before AT&T did, or AT&T's note arrived first. It almost surely can't be the former since the entire post-leak operation is so carefully scripted - this just shows why the credit monitoring service is lip service: it is as if the home owner's association is sending a note to your emptied home, after the security company's note has already landed.

After the year of "free" credit monitoring is over, you realized that you have become a prospective customer of the credit monitoring agency. By this one act, AT&T has transferred the contact information of 100 million customers to some third party - to the absolute delight of the marketing division responsible for generating sales leads.

***

Here are some of my working assumptions about data leaks that I want to share with you. (They aren't in the official scripts, of course).

• If my data exist in any server not under my control, they have been, or will be stolen. If any of my data reside in the cloud, they have been or will be taken. If any business secretly moves any of my data (held on my devices) to the cloud, they have been or will be leaked. If I use any cloud-based services, what I do there are effectively public - regardless of logins, passwords, authentication schemes, encryption, https, or whatever other cosmetic countermeasures.
• Whatever you think these businesses know about you, they know more. (For example, when AT&T claimed the thieves didn't take contents of calls and messages, they have tacitly admitted that they have records of the contents. You might recall that some time ago, they denied that they held such records, claiming that they only gave our government access to "metadata" i.e. who called whom, in those controversial domestic spying programs.)
• Most (probably over 90 percent) of all data leak incidents have never been detected, and therefore, are not known or reported.
• The harms of these data leaks are inconspicuous. Thieves sell the data to others who use the data to influence our behavior or take actions (such as setting your healthcare premiums). By observing the actions taken, and/or their outcomes, you can't infer the source of the data. You almost never get a straight answer for what data were used (trying asking OpenAI what they used to create ChatGPT!) Because the dots can't be connected, we are vastly underestimating the harms of data leaks.
• If our data security were finally improved, then we should notice technologies becoming more inconvenient and less efficient. Conversely, if new technologies are more convenient or efficient, our data security has been further compromised.

 

 

 

 

Know your data 37: one billion passwords

Quartz reported that anyone who has money can buy one billion plain-text passwords from someone anonymous.

This news tells us some things about cybersecurity, or the impossibility of it.

***

What have we been told about passwords?

We are told that if we make it super complicated, it will be much harder for bad players to guess it. Here is one recent set of rules that made my stomach churn ... from laughter.

This business wants the password to have between eight and ten characters. That by itself is not funny but after that requirement, it wants at least one letter, at least one number, at least one special character, and at least one capital letter. Soon, I found myself solving a puzzle.

If I were a machine that could remember any set of nine characters randomly generated, then it'd not be laughable; but I'm a human who wants to embed cues that make it easier to remember the password!

(Don't get me started on the head start given to any hacker by telling them that every one of the passwords has between eight and ten characters! Why not restrict it to nine characters exactly?)

Recently, we are told that if we put all our passwords in one place behind a password manager, it would be safe.

We are also told that websites and companies encrypt our passwords, so that they can't be intercepted and read.

We are told that no responsible company should store passwords in plain text.

The hacker has just exposed the reality that none of those measures work as advertised. If businesses aren't storing passwords in plain text, then how did the hacker get a hold of the plain-text passwords? Suppose the hacker found only masked passwords, and somehow was able to convert them to plain text, what does that say about various masking techniques, such as encryption, hashing, salting...? If hackers can buy plain-text passwords online, are they really guessing our passwords until they find the correct one?

The reporter rightly connects the surge in scams to technologies such as cloud servers and AI. People love these technologies because they bring convenience and efficiency - but as everyone who has taken their shoes off at airport security knows, security measures are neither convenient nor efficient.

A paradox of big data

One of the challenges in the age of big data is having too much information. Information paralysis. Not enough time to look at all the data. Too many contradictions in the data. And so on.

***

But there is something else that's been bothering me. The more information is collected, the less data we have at our disposal. This is a paradox of the big data age. What many of us face is not actually too much information but not enough data, and not the right data.

I have many examples of this paradox. Let me focus on one recent experience.

Recently, I tried using the OMNY card to ride the New York subway. This is a new card technology that will eventually replace the iconic swipe cards. It's a chip card that you place on a screen and if ithe transaction succeeds, the screen's border lights up green and you walk through the turnstile. The first time I used it, the green light didn't come on so I attempted again, and then the green light appeared.

At that moment, I realized that I wasn't sure if I was charged once or twice. Do I know fore sure that the first transaction didn't succeed? Other than the green signal, the new technology gave me zero information.

Contrast this with the existing swipe cards: for every successful swipe, the display indicates how much was charged, and how much stored value still remains in the card. The former confirms the transaction while the latter helps me plan when to refill the card's value store.

With the OMNY tech, I just have to "trust" the system.

The next day, I transferred from the train to the bus. According to the rules, the second leg should be free, since the transfer happened within a few minutes. With existing swipe cards, the display confirms immediately that I have used a free transfer.

With OMNY, I had no idea: the screen sent the same signal – green light – as for a paid trip.

I later checked the stored value on the OMNY card. I was indeed charged twice on that first trip while the transfer was not charged as expected.

***

What's the paradox? A lot more data are being collected by new tech, and yet users are provided less information than before.

This isn't hard to explain though. Businesses are aware that information has competitive value, and they are hoarding the data, even hiding them from the data's owners (you and I).