Our method is adversarial. We attack real systems and real data releases to find out what they leak, then design defences against the attacks that worked.
Take systems and data releases as they are deployed, and try to break the privacy they promise.
Quantify what actually leaks, on real data and at realistic scale, not just in theory.
Design protections against the attacks that worked, and turn results into guidance people can use.
India now runs some of the world's largest digital systems: payments, health IDs, public transport, telecom. The Digital Personal Data Protection Act, 2023 sets new obligations for anyone who handles this data, but the evidence for what actually counts as anonymous in Indian data, at Indian scale, is still thin.
We want to supply that evidence: measured attacks, open tools, and practical guidance that data publishers, regulators and engineers in India can use.
Trajectories, origin–destination matrices and cellular records are routinely released after coarse “anonymisation”. We test those releases with re-identification and reconstruction attacks, and develop anonymisation that keeps data useful at the scale of millions of users.
Phones, earbuds and tags broadcast constantly. We show how Wi-Fi probe requests, MAC randomisation, BLE trackers and LoRaWAN identifiers can be linked back to a device, and build detection tools for people being tracked.
Many privacy guarantees are stated without being tested. We evaluate anonymisation and differential privacy against realistic adversaries, check the statistics behind privacy claims, and contribute to regulatory guidance on what anonymisation should mean.
We study the privacy implications of health data sharing, including the risks of re-identification and the effectiveness of anonymisation techniques.
Work in progress
Our first results on health data are under way. Papers will be listed here once published.
We work closely with researchers at these institutions, and welcome collaborations with Indian institutions, agencies and companies that hold or publish personal data.
Interested in working together? Write to abhishek.mishra@iitjammu.ac.in.