internet software privacy gdpr business
How to anonymize network data packets for commercial use?
<p>I am working on a project where I have to identify anomalies in network traffic of business networks with machine learning. The algorithm is feeded with captured network packets from inside of the business LAN. Since the business is located in Europe, constraints by the GDPR have to be considered. </p>

<p>I need a tool that captures, anonymizes and saves data packets with following constraints:</p>

<ol>
<li><p>values should stay unique when anonymized (e.g. the <strong>same IP address</strong>
should always be encrypted to the <strong>same hash value</strong> and any <strong>other IP
addresses</strong> must have a <strong>different hash value</strong>). This is important so the
hash can still be used as a feature for the ML model.</p></li>
<li><p>the process of capturing and saving the packets and the commercial
use of the resulting, partially hashed data packets should comply
with the GDPR guidelines. The packets are recorded on a computer
whose owner has agreed. However, not everyone on the network knows
that it is sniffed.</p></li>
</ol>

<p><strong>What I have tried</strong>: I have been searching for tools specifically to capture network traffic and anonymize source and destination IP and MAC adresses and found <a href="http://www.tm.uka.de/software/pktanon/index.html" rel="nofollow noreferrer">pktanon</a>. Data captured by tcpdump can be piped to pktanon and anonymized, before it is saved. Also, the payload is completely deleted beforehand.</p>

<p><strong>My Question</strong>: Do I have to consider anything else but hashing source and destination IP and MAC adresses? </p>

<p>Apparently it is not sufficient to anonymize IP and MAC addresses. For example, it might be possible to recalculate parts of the payload with the checksum. I'm not 100% sure if this is relevant and also I do not know which encryption algorithms meet the requirements of the GDPR.</p>

<p>In another thread I have found an <a href="https://law.stackexchange.com/a/28609/30533">answer</a> which elaborates the problem. It states, that</p>

<blockquote>
  <p>it is legal to process personal data if processing is necessary for
  the purposes of the legitimate interests pursued by the controller or
  by a third party, except where such interests are overridden by the
  interests or fundamental rights and freedoms of the data subject which
  require protection of personal data</p>
</blockquote>

<p>Does this apply to my problem? Is it possible to argue that it is a legitimate interest to secure our LAN by processing personal data of all incoming data packets? </p>

<p>I think I'm sort of in a gray area when processing (officially) personal data. This can further be divided into packets from employees of my own company, who can be informed, and packets from outside of the LAN.</p>

<p>Thanks in advance!</p>

<h2>This isn’t anonomization under the GDPR</h2>

<p>The reason IP addresses are personal data is because they are unique to an individual. So are your hashes.</p>

<p>I fear that you have 'jumped the gun' - I think you and your colleagues in the legal/compliance department should first meet to discuss your project. You must facilitate their understanding of the project so that you and they can discuss your options and obligations under GDPR and other such rules in your jurisdiction.</p>

<p>It may be the case that this project has a "specified, explicit and legitimate purpose" (and satisfies other principles under Article 5) for collecting and processing data related to IP addresses and it may be in the "legitimate interest" (or another of the lawful bases under Article 6) of the company to do so.</p>

<p>You/they might decide that verbatim IP addresses are OK; you/they might decide that pseudonymisation (your hashing) is sufficient; you/they might decide that it must not be done unless it involves anonymisation. </p>

<p>But you/they must go through that exercise.</p>
