IEEE Consumer Electronics Magazine - November/December 2019 - 115

inspected using Google Earth. Our algorithm
deidentified 334 trips correctly. Four were incorrectly deidentified due to data quality issues. Forty
locations were falsely identified as loitering, and
eight loitering locations were missed or insufficiently hidden. The false negatives included loops
through parking lots, and procedure termination
on single-destination roads. For these latter cases,
a lack-of-alternative-paths attack was investigated.
None of these examples allowed us to associate a
trip with a residence.

Performance and Data Retention
On average, our deidentification algorithm
removes 52% of the trip points. Vehicles usually
travel slowly in privacy intervals; therefore,
these intervals contain more points per unit distance. Some trips were completely suppressed
by our procedure. In most cases, these trips
cover little or no distance, so their elimination
has minimal effect on the usefulness of the data.
Erroneous GPS measurements are sometimes
recorded during start-up calibration or when the
satellite signal is degraded. For the points in our
data set, 6% were erroneous points, 14% were
in critical intervals, and 39% were in privacy
intervals.
Data Utility
The types of research that releasable data
supports depends on how the data was modified. Numerous applications for connected vehicle data are under investigation (e.g., traffic
management and analysis), so our algorithm is
application agnostic. We analyzed traffic at two
intersections within the data collection region
using original and deidentified data. The entry
and exit time, entry and exit heading, and average velocity were recorded or computed. Traffic
density, velocity profile, and turning profile statistics were compared.
Unique trips were counted in 1-hour blocks
across a 24-hour period. The deidentified data
distribution remained similar to the original.
The model distribution appears to be a mixture
model, so simple statistics are not the best way
to compare the two data sets. By treating the
deidentified data as a model of the original data,
Kullback-Leibler (KL) divergence quantifies the
information lost when the deidentified data set

November/December 2019

is used in place of the original data set. For the
traffic density analysis, the divergence is minimal: 0.0009 bits in the urban environment and
0.0008 bits in the rural environment.
Driver turn behavior was analyzed at two
intersections. KL divergence remained low, but a
large proportion of right turns were suppressed.
Average vehicle velocity in these two intersections was analyzed in a similar way. In this
comparison, the summary statistics are more
consistent. Across all statistics less than 1% difference was observed. KL divergences were also
small, 0.004 and 0.002, respectively.
Data analyses are sensitive to deidentification
method. Our method always suppresses trip
beginning and end points, so analysis near residential areas will be affected by our method.
However, when more general queries are made
(e.g., when is traffic most dense) a more accurate
answer can be provided.

CONCLUSION
Individuals understand the risks in releasing
sensitive GPS data, such as the location of their
home.8 However, the same individuals may not
fully understand data interrelationships and the
inference attacks such relationships facilitate.
This article attempts to deepen understanding
of location privacy controls while increasing
awareness of the relationships between public
data sets, location, and privacy.
The deidentification procedure introduced in
this article has been applied to data on the Federal Highway Administration's Research Data
Exchange and extends to other types of locationbased data sources. Our procedure incorporates
map data so locations can be protected in
an information-theoretic way. It does not modify
individual locations; these features are valuable
in many types of transportation research. Ultimately, this efforts seeks to promote responsible
sharing of connected vehicle data, so researchers can develop technologies that will help
reduce roadway deaths to zero.

ACKNOWLEDGMENTS
The authors would like to thank the USDOT
Intelligent Transportation Systems Joint Program Office for sponsoring this work.

115

IEEE Consumer Electronics Magazine - November/December 2019

Table of Contents for the Digital Edition of IEEE Consumer Electronics Magazine - November/December 2019