In the area of information sharing, everyone loves or wants to be involved in information sharing, and they basically said, “go ahead and send me all your data”. But the challenge is everyone wants to protect the data they have. I see three models of information sharing, two of which really won ¹t work. One is everybody has to take all of their data and give it to everybody else. But you can ¹t keep it current and there are many other problems. Another requires everybody to ask everybody else every question everyday. Otherwise, how would you know with whom to share the data? It just does not work either. The third model, which I ¹m finding quite practical, is the use of directories. This is much how libraries work. One does not roam the halls to find a book. Rather, one goes to the card catalog (i.e., the directory), and the directory provides you pointers. So, each data holder gets to hold their data and know who ¹s asking for it, and better yet it is discoverable because somebody has gone to a directory. And this is a model that I think can work. But questions arise from this model: What are the policies around such a directory? Who will hold the directory? What data do you put in the directory? How do you govern how people use the directory? This is where our thinking needs to be directed.

With regard to anonymization, the main point is the government is seeking large swaths of data to find a few bad guys by working from watch lists which they cannot release (unlike No Fly or Selectee lists which are released on a restricted basis to the airlines). When policy requirements preclude watch list sharing and where legal mechanisms can be used to collect all of the data that a company holds, anonymization enables one to discover what five records they have in common in a more privacy-preserving manner. So, information transfer contains the fewest number of records. I think that is exceedingly practical. And I think it is a huge step forward in terms of privacy enhancing ways government can get its job done.