When banks, retailers, hospitals, and other businesses talk about allowing access to data internally and with partners, they're often talking about their customers' personal data: addresses, phone numbers, Social Security numbers, etc. At IBM, distinguished engineer Jeff Jonas has developed technology he says improves data sharing while securing that personal information. It's called anonymization.

Brilliant, earnest, and obsessed with testing himself to the limits--last month he completed his seventh Ironman triathlon in Australia--Jonas has emerged as one of IBM's thought leaders on information management. He came to IBM through the company's June 2005 acquisition of the Las Vegas company he founded, SRD Software. SRD made middleware that casinos use to pull information about specific people from different databases and thereby identify relationships to help spot cheaters and partners in crime. IBM customers use the software, now called DB2 Identity Resolution, to create a single view of a customer account and to detect fraud. A bank that's merged with another, for example, might use the software to recognize two accounts that belong to the same person by spotting commonalities in data.

Jonas is now working to generate interest in another software program he developed while at SRD. It lets organizations analyze and compare personal customer information that's been obfuscated in such a way that it can still be understood by computers but not by humans, thereby "anonymizing" the data, he explains. IBM renamed the software DB2 Anonymous Resolution and sells it out of its Entity Analytics division, headed by Jonas.

Banks typically send customer information to data aggregators, which match it against demographic and lifestyle data about those customers, such as which magazines they subscribe to. The information is sent back to the banks, which use it to profile their customers to help with product up-selling and retention. Banks that use Anonymous Resolution are protecting their customers from hackers and unscrupulous employees of data aggregators, Jonas says.

IBM won't talk about which banks are using this software, and it doesn't seem to be very many. But Jonas is optimistic. "If you can go to a company and share data in anonymized form, and get a good result, why share data any other way?" he says. "There's a big wave coming, including more implementation of anonymization and more vendors of it."

Jonas is a privacy advocate and a critic of the technology industry's laissez-faire attitude toward it. He recently co-authored a Cato Institute report on the ineffectiveness of using data mining technology to predict terrorist attacks.

"One of the things I'm vocal about is that not very many technologists are spending much time with the privacy community, and the privacy community isn't spending much time with technologists," he says. Anonymization will be the bridge between the two, he predicts, letting tech companies help businesses get better value out of their customer data, while removing the real security threat--other humans--from the picture.

Return to the story:
The Fight Against Infoglut