Anonymize VoIP and GDPR
For support reasons often Wireshark capture files need to be exchanged with external parties.
In the context of the General Data Protection Regulation (GDPR) this exchange is under more strict regulation.
The anonymizing of the Wireshark capture files helps in avoiding when handling personal or sensitive data.
This anonymization of personal data in Wireshark VoIP traces is performed by the VoIPAnalyzer Tool.
A brief explanation will be given on the relation of processing and handling of VoIP Wireshark capture files and its relation with the General Data Protection Regulation (GDPR).
The General Data Protection Regulation (GDPR) is a regulation in EU law on data protection and privacy in the European Union (EU) and the European Economic Area (EEA).
It also addresses the transfer of personal data outside the EU and EEA areas.
Personal data is information that relates to an identified or identifiable individual.
As such to obtain compliance with the GDPR some measures must be implemented that meet the principles of data protection.
Possible data protection measures are techniques such as Pseudonymization and Data anonymization.
● Pseudonymization is a data management and de-identification procedure by which personally identifiable information fields within a data record are replaced by one or more artificial identifiers, or pseudonyms. A single pseudonym for each replaced field or collection of replaced fields makes the data record less identifiable while remaining suitable for data analysis and data processing.
● Data anonymization is a type of information sanitization whose intent is privacy protection. It is the process of either encrypting or removing personally identifiable information from data sets, so that the people whom the data describe remain anonymous.
Both techniques are used in the VoIPAnalyzer Tool :
● For names and telephone numbers an anonymization is performed
● For IP addresses a pseudonymization technique is used
● The payload of the voice packets is replaced with a tone and is as such anonymized
The final result of anonymizing a Wireshark VoIP capture is a new Wireshark capture file without personal identifiable information inside the VoIP content.
How this is realized is explained in section Anonymize selection .
However an anonymized Wireshark capture file still allows performing a further data analysis such as a VoIPAnalyzer Audit or Merge.
