The Logical Structure of Intentional Anonymity

– Michał Barcz –

– Jarek Gryz –

– Adam Wierzbicki –1

Abstract. It has been noticed by several authors that the colloquial understanding of anonymity as mere unknownness is insufficient. This common sense notion of anonymity does not recognize the role of the goal for which the anonymity is sought. Starting with the distinction between intentional and unintentional anonymity (which are usually taken to be the same) and the general concept of the non-coordinatability of traits, we offer a logical analysis of anonymity and identification (understood as de-anonymization). In our enquiry, we focus on the intentional aspect of anonymity and develop a metaphor of an “anonymity game” between “perpetrator” and “detective”. Starting from common sense intuitions, we provide a formalized, critical notion of anonymity.

Keywords: anonymity, identification, intentional vs. unintentional, K.A. Wallace, H. Nissenbaum.

Published online: XX June 2019

1. Introduction

Etymologically, “anonymity”, from the Greek ἀνωνυμία (ἀν-, without; ωνυμα, name), means namelessness, (being) without a name. Wallace noticed, however, that this etymological understanding of anonymity does not suffice and it “should be understood to mean, more broadly, non-identifiability rather than simply ‘unnameability’ or ‘namelessness’.” Nissenbaum also made this point.2

The term “anonymous” is related to philosophical problems about naming, definite descriptions, and identity. We will not engage directly in these discussions, as our goal is more modest: starting with Wallace’s and Nissenbaum’s intuitions, we provide a logical reconstruction of the concepts of anonymity and identification. In particular, we will question a naïve understanding of anonymity according to which it is just a simple, absolute property closely related to personal identity. We will argue instead that anonymity is a context-dependent relation that could also cover group membership or, in fact, any other property of a person.

The key premise of the argument is the distinction between intentional (‘deliberate’ in Wallace) and unintentional (‘natural’, ‘spontaneous’ in Wallace) anonymity; often one seeks anonymity to achieve some goal yet this is different from anonymity itself. In other words, anonymity is not an end in itself but rather a means to achieve other ends. For instance, being anonymous is not the goal of a man who attends Alcoholics Anonymous; his reason is rather to receive help and avoid some of the consequences (feeling ashamed, say) of his illness being revealed. Similarly, being anonymous is not an end in itself for a criminal, whose goal in being anonymous is to avoid punishment. Anonymity is a tool which is usually used in an adversarial environment; someone who seeks anonymity believes that others will try to prevent him from achieving his goals or ends.

We will show the utility of our analysis by solving a puzzle related to the following fictional event in French history:

On August 25, 1963, a professional assassin with the code-name “The Jackal” fired at the French president Charles de Gaulle. The French police who had been on his trail for several months were just catching up with him. Before he managed to fire again, he was shot and killed by the police instead. The French president survived; the Jackal’s mission failed. Neither the police nor the underground terrorist organization who hired the Jackal knew his real name. Interestingly, his identity (that is, his name) could not even be established after the failed assassination attempt.3

Was the Jackal anonymous? We are all likely to agree that he was anonymous prior to August 25, 1963. But did he remain anonymous after that day? We will argue that he did not. The police caught him and averted the assassination, thus preventing the Jackal from achieving the goal for which he sought to hide his identity in the first place. We will argue that in some important sense the assassin had been identified. Although his personal details remained unknown, another crucial piece of information about him was discovered by the police, namely his exact location. The goal for which the anonymity is sought – as we claim following Wallace, Nissenbaum and Ponesse – is constitutive of anonymity.4 At the same time, in some important sense the goal determines the conditions under which the anonymity is broken and when the act of identification takes place. It was precisely the identification of the Jackal that enabled the police to prevent the assassination. The connection between the identification and prevention of an anonymous person from reaching their goals will be examined in more detail.

Throughout the paper, we will be talking about anonymity and identification (de-anonymization; vide the next section) as two sides of the same coin. We propose understanding the relation between anonymity and identification in terms of the metaphor of a game: when anonymity is protected from one side (the anonymous person, we will call him the ‘perpetrator’) and attacked from another (his adversary, the ‘detective’) it initiates some kind of game. The purpose of this game is – again – not anonymity itself (protecting vs. breaking it) but the goals for which it was sought. The success of identification lies then not in just naming the anonymous person but also acquiring sufficient information to prevent him from achieving his goals.

We will not attempt to explain the psychological or social aspects of anonymity here but rather isolate what we see as the logical structure of anonymity. We will start by presenting the linguistic approach towards the problem of identification and showing that it is insufficient (§2). Next, we will put forward the commonly made assumptions constituting what we call a common-sense notion of anonymity and provide a critical analysis of it (§3, 4, 5, 6). Having done so, a definition of identification – understood as de-anonymization – (§7) will be formulated. Then we will offer a recapitulation of assumptions underlying the critical sense of anonymity and show how it covers the colloquial sense as a special case (§8) with some open problems discussed. We conclude the paper by answering the question stated in the Introduction: whether the Jackal has been identified (§9).

2. Background and Motivation

The concept of anonymity has recently been studied by Nissenbaum and Wallace.5 Both authors claim that the common-sense understanding of anonymity as a mere unknownness fails to capture the whole complexity of this social phenomenon. Wallace proposes a different definition of anonymity as “noncoordinatability of traits”, which we would like to develop. This account, however insightful, could still benefit from the further formalisation which we offer in this paper.

Another crucial point made by Nissenbaum and Wallace is the distinction between intentional (or deliberate) and unintentional (or natural, spontaneous) anonymity. We embrace this distinction but believe it to be of more importance than suggested before.

Identification is a philosophically loaded term so let us dismiss one meaning of the term at the outset that is beyond the scope of this paper. Identification can be understood as the epistemological counterpart of the metaphysical concept of identity or, in particular, personal identity. In this context, identification can be seen as the process through which one determines whether an object or person at time t1 is identical to an object or person at time t2. We have nothing to add to the discussion on identification in this sense of the word.

There is another meaning of “identification” that is more relevant to our project. In ordinary language, identification often means providing an answer to the question “Who is X?”, where X is the person we are trying to identify. Logical analysis of plausible answers to this general question turned out to be surprisingly hard. The question may receive a meaningful answer in three different ways:

1. X is G, where G is an attributive definite description.

2. X is B, where B is a proper name.

3. X is D, where D is a demonstrative pronoun.6

In Case 1, one may truthfully respond to the question “Who is A?” by saying, for example, “A is the tallest man on Earth”. But if I do not know who the tallest man on Earth is, I will ask again “But who is the tallest man on Earth?” Clearly, the syntactic form of Case 1 is not sufficient for identification. Similarly, for Case 2. If I ask, “Who is Cicero?” and you answer, “Cicero is Tully”, your answer does not identify Cicero for me unless I know who Tully is. In both cases, we may run into infinite regress. Case 3 does not fare any better. When you answer the question “Who is A?” by pointing to someone in the room and saying, “That is A!” you have provided me with a way of fixing the reference for A. I now know what A refers to; I have grounded its reference.7 But is this always sufficient for knowing who A is? Imagine the situation as described above but now I only get a brief glimpse of A (whom I do not recognize as anyone I have seen before) who then disappears, and I never see him/her again. I still do not know who A is.

Boer and Lycan recognized that purely linguistic analysis of the problem of identification (in the sense described above) is insufficient. To stop the regress of answers to the question “Who is X?” one needs some information about the purpose for which the answer is sought. Often, our background knowledge about the questioner and the context of utterance provides a clue as to his purpose in asking; otherwise we ask a follow up question “Why do you want to know?” to provide that very context.

This last observation sets out the framework for our paper. We will not discuss the problem of identification in general but limit ourselves to the identification of a person in the respect in which the person wants to remain anonymous. In this context, identification cannot be defined generally but will depend on each particular case of the purpose for which anonymity was sought. Thus, we provide a necessary context in which the question “Who is X?” can be successfully answered. In a sense, we pick up where Boer and Lycan left off.

3. Intentional versus Unintentional Anonymity

According to Webster, “anonymous” means “not named or identified” and, by this definition, almost everyone in a crowd of people at a large sport event is anonymous. Indeed, the classic example of anonymity in this sense is conveyed by the phrase “anonymous in a crowd”. Now consider another quintessential example of anonymity. When Rob Roy was first published, its author was also anonymous because his name did not appear on the cover of the book.8 Are both a person in the crowd and the author of Rob Roy (Walter Scott) anonymous in the same sense? We will argue that they are not.

Someone who is anonymous in the crowd does not make any effort to hide her identity, that is, does not perform any intentional action towards achieving anonymity. On the other hand, when Rob Roy was first published, its author refused to put his name on the cover of the book. Here, anonymity involves an intention to remain unidentified (pseudonyms are often used for that purpose). The conversational notion of anonymity is indifferent to the distinction between intentional and non-intentional cases.

In this paper we will go beyond the common sense understanding of this concept. We find the distinction between unintentional (a person in the crowd) and intentional (Walter Scott) anonymity crucial in our analysis. In particular, we will take the property “not identified” or “not known” as a necessary but not sufficient condition for anonymity.

The distinction seems to exist even if it is a somewhat murky one in ordinary language. If I see a stranger at a party, I may say that he is anonymous to me, but all I mean is that I do not know him. If I say that the author of Rob Roy was anonymous to his contemporaneous readers, not only am I saying that he was unknown to them, but also that he did not want to be known. Indeed, some people would be reluctant to say that the stranger at a party was anonymous (unless he really wanted to remain unknown), just as they would find it awkward to say that the majority of the world’s population is anonymous to them. The reluctance to use the term “anonymous” where the referent is just unknown seems to indicate that at least some of us understand anonymity as intentional. Notwithstanding the nuances of ordinary language, we will always use the term “anonymous” to mean “intentionally anonymous”; otherwise, we will simply use the term “unknown”.

The distinction between intentional and unintentional anonymity has been recognized by several authors,9 however it was not considered to be important for the logical analysis of anonymity. For instance, Matthews claims: “There is a loose partition between desiring one’s anonymity and simply being anonymous without really thinking too much about it.”10 Wallace, who introduces the distinction between intentional (or deliberate) and unintentional (or natural, spontaneous) anonymity, claims:

Anonymity may be chosen or adopted as a deliberate strategy or it may be a kind of spontaneous, natural or social anonymity that is the byproduct of complex social forces and arrangements. The former may serve distinct purposes and have different felt consequences from those of the latter. However, in so far as each is non-identifiability of a person or persons, the underlying structure of anonymity is fundamentally the same.11

As anonymity is described as the noncoordinatability of traits, the structure of intentional and unintentional anonymity appears to be the same. However, if we ask what exactly these traits are, a significant difference between the structure of intentional and unintentional anonymity emerges. The source of this difference is that in the case of intentional anonymity, the agent’s goals, intentions, or decisions play a vital role, while they are not relevant in the case of unintentional anonymity. The importance of the agent’s goals, intentions or decisions was noticed by Ponesse, who also calls intentional anonymity a “paradigmatic case”.12 Agreeing with this observation we suggest that unintentional anonymity should be viewed as a separate phenomenon, requiring
a separate analysis; this will be the subject of our further studies.

It is commonly assumed that whenever there is an intentional action, there must be a reason for that action.13 Indeed, anonymity has also been sought for a variety of reasons. They could be commendable, such as acts of charity, deplorable, such as tax evasion via anonymous off-shore banking, or morally neutral, such as publishing a book under a pseudonym to avoid unwanted publicity. Anonymity may encourage freedom of expression and prevent discrimination in a hostile environment. It can also promote hate speech and allow criminal behaviour with impunity. The value of anonymity in all these cases “lies (...) in the possibility of acting or participating while remaining out of reach, remaining unreachable. Being unreachable means that no-one will come knocking on your door demanding explanations, apologies, answerability, punishment
or payment.”14

Thus, anonymity is not an end in itself but rather a means to achieve other ends. By the same token, identification of an anonymous person also enables preventing her from achieving the goals for which the anonymity was sought in the first place. Consider the particular case of the Unabomber,15 a serial killer. Being anonymous made him unreachable by law enforcement officials thus allowing him to (1) carry on his bombing campaign; and (2) avoid punishment. Anonymity, hence unreachability, is not by itself constitutive of some value for the Unabomber, but provides conditions under which other values or goals, such as (1) and (2), can be secured.

4. Anonymity as a Relation

The linguistic use of the term ‘anonymity’ (‘X is anonymous’) suggests that anonymity is a property. However, from the logical point of view, anonymity should rather be understood as a ternary relation: X is not just anonymous, but anonymous for Y (a prospective identifier) under some description P. Moreover, the description P under which X is known to Y is under X’s control; it is the way that X presents himself to Y. We attribute this idea to Wallace:

[…] anonymity is noncoordinatability of traits in a given respect. In other words, one has anonymity or is anonymous when others are unable to relate a given feature of the person to other characteristics. For example, the Unabomber was anonymous when he was known only as ‘sender-of bombs-to-computer-scientists’ and that trait could not be related to (coordinated with) other traits such as name, address, social security number, and so on, such that the person as such could be identified.16

Similarly, “the author of Rob Roy” was unknown to the general public, but he was known at least to himself (Walter Scott) and his publisher. The description17 P under which the public knew “the author of Rob Roy” contained just that, the fact that he wrote Rob Roy. Indeed, anyone who wants to remain anonymous presents himself or herself under a description that contains as little information as possible in order to hide as much information as possible. Of course, the recipients of this information are able to infer some additional facts about X but for anonymity to be successful their scope is very limited. Thus, readers of Rob Roy could probably infer that he was a contemporary Scottish writer and – in time – that he was also the author of Waverly and a few other historical novels. The point is that for a person X to be anonymous there must be a nonempty description P under which X is known to somebody; the description must contain at least the information that X is the agent of a certain action;18 there is no anonymity in absolute isolation.19

The description P under which X is known to the public is the flip side of what X wants to hide or conceal. In fact, X’s goal is to make sure that a certain description that is true about him, call it R, is not associated with P by the public. In the majority of cases X wants to hide as much as possible because the less the world knows about him the less likely it is that he will be prevented from achieving his goals. It is not surprising that in all standard cases of anonymity R contains all identifying information (name, address, fingerprints, etc.) about X. Once Y gets a hold of such identifying information all the rest of publicly available data about X can usually be easily accessed.

Note that Y may very well know that R is true about some individual Z who in Y’s opinion is different from X. Thus, inhabitants of Lincoln, where Theodore Kaczynski lived, knew him (Z) and they knew about the Unabomber (X); what they did not know was that it was the same person (that is, that X=Z).

5. Results reached so far and some methodological remarks

To summarize our discussion so far, we will say that X is anonymous to Y under the description P iff

• • X wants to achieve goal G
• • X believes that Y may prevent him from achieving G
• • X believes that Y will be able to prevent him from achieving G if Y knows X under description R
• • X presents himself under another description P to Y
• • X takes action20 to prevent Y from coordinating descriptions P and R

To coordinate descriptions P and R is to identify X. We formalize the notion of identification in Section 7.

How are the descriptions in R determined? Is it always the case that the perpetrator knows what descriptions he needs to hide to remain anonymous? Furthermore, must the perpetrator conceal a description, since sometimes he just does something without conscious thought (for example, hides instinctively around a corner)?

Our proposal deals with the logic of the concept of anonymity/identification and is therefore an idealization or, to use a traditional positivist term, a rational reconstruction of a certain social phenomenon rather than its empirical analysis. Thus, we speak of descriptions and relations between descriptions rather than, for example, thoughts or associations. We do not claim that an anonymous person makes detailed plans and acts accordingly. The way in which an anonymous person perceives and sustains her status and what she does to achieve her goals is beyond the scope of this paper. What is important for our analysis is that in each case of anonymity a certain logical framework is present: a description of the goal(s) of anonymity, a description of an anonymous person as an agent of a certain action and the description she chose to conceal.

The perpetrator does not have to be fully aware of the description he conceals at the moment of performing actions which secure his anonymity. In most cases, a short period of reflection might lead him to identify those descriptions in detail, but we can also think of some situations which do not meet this condition. Imagine a knuckleheaded thug who breaks into someone’s house but puts on gloves before doing so, simply because he saw a professional criminal doing so in a Hollywood movie. He is oblivious to the fact that his bare hands could have left fingerprints but he nevertheless efficiently conceals this information.

6. The Colloquial Sense of Anonymity and Its Critical Reconstruction

The following three implicit assumptions are made in the conversational use of “anonymity” and “identification” (understood as “de-anonymization”):

A1. There is a fixed, well defined set of properties which, if hidden, make someone anonymous. The set of these properties includes attributes such as name, address, social security number, fingerprints, DNA, etc. Disclosing one or more (depending on the type) of these properties is sufficient for identification, hence they are usually called identifiers.21

A2. The revealed properties described in A1 are true for one person only. This is not to say that one cannot identify more than a single person at a time - for example, we may be looking for all members of an underground terrorist organization. But when that happens, each of the identified people is identified by virtue of properties true only about him or her.

A3. The process of identification is psychological in nature. There must be someone who, when provided with appropriate evidence, performs a conscious reasoning that leads to identification. Identification takes place when someone completes this process and is aware of the identity of the anonymous person.

As we will see, all three of these assumptions shall be rejected. This is not to say that these assumptions are never correct when describing anonymity and the process of identification bur rather that they constitute a special case – let us call it a narrow or trivial case – of identification. We will argue, however, that they cannot be consistently applied beyond this case thus obstructing the way to a more revealing analysis of the concepts in question. To set the stage for the analysis, let us start with counterexamples for each of these three assumptions.

6.1. Rejection of A1

Consider assumption A1 and imagine that a crime has been committed and a forensic team has recovered fingerprints of the perpetrator. The particular set of fingerprints belongs to a single person and uniquely “identifies” him. Yet if this person has never been fingerprinted by the police before and is not a likely suspect in this case, there is no way to truly identify this person as there is no mechanism to reach him. The fact that a given description is true about a single person is not sufficient to reach that person. Nissenbaum termed such descriptions ‘opaque identifiers’. An opaque identifier is “a sign linking reliably to a person (...) that, on the face of it, carries no information about the person. That is, the opaque identifier holds no clue, by itself, as to the real identity of the person.”22 Opaque identifiers may include social security numbers, fingerprints, DNA profiles, and – indeed – names and addresses. Many of them – such as social security numbers – are routinely used to refer to people in a reliable way, yet anonymously.

In fact, even names may not be sufficient to identify a person. When I am told that Walter Scott wrote Rob Roy, it may seem that I have identified the author of the book. However, if I know nothing whatsoever about Walter Scott (and have no way of finding any information about him) I don’t really know who that person is, what he looks like, where he lives, etc. If I have never heard of Walter Scott before, learning that it is him who wrote Rob Roy carries no information for me, I learn nothing new when I acquire this information. Names or other identifiers are useful only when they can be easily linked to other information about the person in question. They usually serve well in that role, but they are neither sufficient nor necessary for identification. Thus, we reject assumption A1 that there is a fixed, well defined set of properties which if hidden make someone anonymous. Instead, we claim that the character of the concealed information is dependent on the purpose for which someone seeks anonymity and can differ widely between various cases. Wallace and Nissenbaum reject this
assumption as well.23

6.2. Rejection of A2

Does the description revealed in the process of identification have to be true about only a single object (A2)? Indeed, even in conversational use, identification is sometimes understood as categorization rather than individuation, e.g. one can be identified rather in terms of group identifiers than individual identifiers. We often use the expression “X has been identified as P”, where P is a predicate true of many objects. Thus, we say “Jones has been identified as African-American” or “Jones has been identified as a member of the Ku-Klux-Klan”. In cases like these, we intend to categorize X by gender, ethnicity, religion, sexual orientation, etc. Conversely, one may want to remain anonymous under a certain description. Let us assume that X who is homosexual undergoes a test for HIV. When asked to fill out a standard health form X decides to hide his sexual orientation, believing that a positive test result could solidify stereotypes about homosexuals and HIV. X wants to be anonymous as homosexual; he does not want to be identified as a member of that group. In this case “being HIV positive” is the revealed description, while “being a homosexual” is the concealed one. Therefore, anonymity is not necessarily about hiding the identity of a person (understood as the standard set of identifiers), it can also conceal other facts about him (for instance, his group affiliation). Thus, we reject assumption A2 that the revealed properties are true about one person only. Instead, we claim that one may also be anonymous as a member of a group.

6.3. Rejection of A3

The story of the Jackal presented in Section 1 is not yet complete. At some point during the investigation, the French police were tipped off by the Scotland Yard that the Jackal was one Charles Calthrop. From that point on, the police searched for that man and when they eventually killed the assassin, they still believed it was Charles Calthrop. They were wrong. Charles Calthrop had nothing to do with the planned assassination of de Gaulle. It was a lucky coincidence that the man the police were chasing and believed to be Charles Calthrop was indeed the Jackal. How does this twist in the story change our view in terms of the anonymity of the Jackal? It is clear that the police’s belief that Charles Calthrop was the Jackal had no influence on their ability to reach the assassin and prevent the killing (which should be the case according to A3). So how did the police manage to identify the right man as the assassin if their beliefs about his identity were mistaken? The Jackal was identified by the police, however not at the very moment that the police believed the identification was made; or better: the identification was not made by joining the very descriptions the police believed to identify the Jackal (‘Charles Calthrop’ and ‘the assassin’).

Thus, we reject assumption A3 that the process of identification is psychological in nature. The psychological understanding of identification assumes that the detective is always fully aware of the process which leads to identification, and that identification consists in explicit articulation (either mental or oral) of the discovered connection. By rejecting the psychological aspect of identification, we do not deny, of course, that the process of identification involves certain mental states. Nonetheless, the act of identification does not imply that the detective is aware of it. We argue that identification is informational in nature: identification takes place when information leading to the concealed description has been collected by the detective(s). In our example, the police’s beliefs concerning the process of identification were not synomous with the actual logical structure of identification. The police believed that describing the assassin as ‘Charles Calthrop’ was crucial to his identification, while it turned out to be completely irrelevant. Therefore, assumption A3 fails.

7. Identification

Identification is the process of updating one’s set of beliefs. In colloquial language, to identify X as Y is to determine that X and Y are the same person. The success of identification is usually expressed by statements of the type “Walter Scott is the author of Rob Roy” or “Theodore Kaczynski is the Unabomber”. As we stated in Section 2, we would like to enrich the concept of identification to include categorization as well.

To make our discussion of identification more suggestive, let us imagine a scenario where an anonymous perpetrator (for example, the Unabomber) commits a crime and the investigation is conducted by a detective (for example, an FBI agent). The initial description P under which the perpetrator is known to the detective contains just the information that someone has committed a crime (for example, the first mail bomb has exploded). The goal of the detective is to apprehend the perpetrator in order to prevent him from committing further acts of violence and to bring him to justice. During the investigation the detective establishes new facts by discovering new evidence and by deductive reasoning.24 This results in enriching the initial description P to the point when the detective can tie it to the concealed description R, which in the common cases includes the perpetrator’s name, address, appearance, etc.

We can think about the progress of an investigation as an increasing scope of knowledge acquired by the detective so far (enriching the initial description P). The detective gathers new evidence in the form of sets of descriptions P1, P2, and P3 true about the perpetrator. We claim that identification takes place at the moment when the detective acquires description R. Formally, the process can be described as follows.

A single description of a person is an existential formula:

I ∃X (P1 (X) ∧ P2 (X) ∧ P3 (X) … Pn (X))

Formula I represents a fact about some person which is not necessarily (indeed, quite unlikely) to be known by anyone. Thus, a detective may know25 just a weaker formula, for example:

II ∃X1, X2, X3, … Xn (P1 (X1) ∧ P2 (X2) ∧ P3 (X3) … Pn (Xn))

or equivalently

III ∃X (P1 (X)) ∧ ∃X (P2 (X)) ∧ ∃X (P3 (X)) … ∃X (Pn (X))

It is now straightforward to define what it means to coordinate two descriptions. Let us assume that a detective knows III and let us refer to the first two descriptions (the first two conjuncts) in this formula as p1 and p2. We say that the detective coordinated descriptions p1 and p2 iff he gets to know that

IV ∃X (P1 (X) ∧ (P2 (X))

Now, a detective can also deduce new descriptions from the ones he already knows and his background knowledge (for example, from the fact that a perpetrator lives in Boston, he can deduce that he lives in New England). Let us refer to the set of common knowledge as K and the descriptions known by the detective so far as A. Thus, the detective can deduce a description pk iff the following holds:

V A ∪ K ⊨ pk

It is now straightforward to state what it means to identify the perpetrator. Let the description under which the perpetrator has revealed himself to the detective be p0 , the set of descriptions concealed by the perpetrator be R, and pr be one of these descriptions. The detective has identified the perpetrator iff:

VI A ∪ K ⊨ ∃X (P0 (X) (Pr (X))

The above formalization could be viewed as relying on the common misconception about detective’s work as engaging in deductive reasoning sensu stricto. Confusion about the term ‘deduction’ comes from its excessive use in detective novels, such as the famous series about Sherlock Holmes. Let us not confuse the colloquial meaning of the term with its logical sense. We describe identification as ‘deductive’ in the latter sense, but of course the real-world detectives rarely rely on purely deductive reasoning. Our conception is a form of idealization of the actual process. Introducing the background knowledge (K) allows us to reconstruct some fallible, non-deductive reasonings as deductive. For example, knowing that someone’s fingerprints or DNA has been discovered at the crime scene does not allow one to deduce that the person was actually present there. However, it is commonly believed to be sufficient evidence for such claim. Therefore, the following assumption (or similar) is part of K: “If there are X’s fingerprints or DNA in place Z, X was in Z”. Now the detective’s reasoning (from “X’s fingerprints are in Z” to “X was in Z”)
can be described as purely deductive.

8. Conclusions and Discussion

Our goal in this paper was to show the concept of anonymity as intentional and context-dependent. The following conditions, contrasted with the conditions of the naive notion of anonymity, sum up our position.

B1. A person is anonymous, if she hides some description true about her, by actively preventing a potential unmasker from coordinating this description with another description under which she is known to him. The character of the concealed information is dependent on the purpose for which she seeks anonymity and can differ widely between various cases.26

B2. The description mentioned in B1 does not have to be true about one person only. One may also be anonymous as a member of some group and protect his anonymity for the good of this group, not his own. Identification in such cases does not require reaching him personally.

B3. Identification is informational in its nature. The crucial moment in this process is not that of conscious acknowledgement, but the gathering of all the necessary information. This information can be distributed among several minds.27

It is worth mentioning that the colloquial sense of anonymity (A1-A3) can be reformulated as a special case of our critical notion. Regarding B1, the information hidden by the perpetrator may belong to the commonly recognized identifiers (while in A1 they must belong to this group). The concealed description does not have to be true about a single person only (as in A2), but such a possibility is also allowed by B2 (we only exclude descriptions with empty extensions).

We state that the character of the identification is informational (B3), but it is of course possible for the actual (psychological) way of reasoning to mirror the logical relations holding between descriptions. Also, the moment of identification in the informational sense may be the same as the moment of identification in the psychological sense.

Several issues deserve further discussion here.

1. Is the sole possibility of inferring (via deduction) the concealed description sufficient for identification of an anonymous person? Consider a situation when the detective dies right after discovering some crucial piece of evidence and does not even have the chance to begin the line of reasoning that would lead him to R.

Obviously, we do not want to claim that a futile collection of evidence could constitute an identification which would be successful in a practical sense. Putting the practical issues of finding the person aside, we single out two aspects or conditions of this process: the psychological and the logical. According to the psychological condition of (successful) identification, the detective must be aware of (i.e. must have a true belief concerning) the connection between the initial description of an anonymous person (P) and the description that the anonymous person attempted to conceal (R). This condition constitutes the naive notion of identification (vide Section 6). We assume its intuitive sense and distinguish it, as stated above, from the logical or informational condition of identification which was analysed formally in the previous section. From the formal point of view, the identification takes place when the detective can deduce the description concealed by perpetrator. From the psychological (or common-sense) point of view, the identification takes place when the detective is aware of the connection between the initial description of perpetrator and the description he concealed; the subjective character of this process puts the psychological criterion of identification beyond the scope of formal analysis. As far as the relation between these two conditions is concerned, we would say that if the detective identified a person in the psychological sense, then he has identified her deductively, but not vice versa. It might be the case that the detective had all of the information necessary to identify the perpetrator long before he eventually became aware of it.

2. Our claim that the goal of the perpetrator constitutes the conditions of the breaking of his anonymity may be mistaken for a stronger position: namely, that there is some logical connection between identification and reaching the perpetrator. Let us now consider what kind of relation it would be. Is the identification necessary to reach the perpetrator? It is not, because the detective may prevent the perpetrator’s goals purely by accident, without discovering any information. A police officer could arrest a terrorist for some minor offence, preventing him from carrying out a bomb attack whilst not knowing that he was a terrorist. Is then the identification sufficient for reaching the perpetrator? It is not. A perpetrator may slip through a clumsy detective’s hands despite being properly identified. The identification often enables one to reach the perpetrator, however this connection is not of a logical nature; it is a casual, contingent relation.

3. One may wonder if our formalization of identification is not too weak in a logical sense. This is because we use de dicto formulas which are traditionally regarded as insufficient for an identification.28 We cannot engage here in a discussion about de dicto and de re beliefs but would like to make a few comments on it. Firstly, one should note that the examples present in the literature on this topic adhere to a very narrow understanding of identification, closely connected to the practical aspects such as reaching the identified person: “But this last should presage an arrest and not the mere certification of homicide.”29 This approach obviously differs greatly from our view, on which identification is seen rather from a logical perspective. Therefore, we see no reason to strengthen our formalization. Yet it could easily be done by placing the quantifiers outside the scopes of modal operators or replacing bound variables with logical constants. Whether such modifications would be accurate, depends mostly on constraints which one imposes on ascriptions of de re beliefs. The nature of these constraints has been a topic of a prolonged philosophical debate. Some thinkers state that any definite description is sufficient for exportation (that is, inferring de re belief ascription from de dicto ascription).30

4. In Section 2 we rejected assumption A2, which allowed identification to be performed on a single person only. We claimed that identification may also mean categorization, that is, recognizing someone as a member of a group of people. How far can we extend this broad meaning of identification?

Consider a case of a terrorist plot investigated by the police. The police know that the perpetrator is planning to set off a bomb but successfully locate him and surround the building where he is staying. They prevent the terrorist attack, but they still do not know the identity of the perpetrator (other than he is among the people in the building). Has the perpetrator been identified?

There is definitely a description of (the location) where the terrorist was hiding which was discovered by the police. This discovery led to the frustration of the terrorist’s plans. Such a situation fits our schema of identification (i.e. coordinating the revealed and the concealed description). On the other hand, it would be against common-sense intuitions to call this a proper case of identification. One of the goals of the perpetrator – the terrorist attack – has been prevented, but he has not been “properly” identified (certainly he was not identified in the traditional or naive sense).

One reason for which one may be reluctant to admit that a proper identification took place here is that it is natural to think about another goal of the terrorist, which is to avoid punishment. It would be impossible to put the bomber in jail knowing only his imprecise address31 and the police did not discover any information which would enable them to do it. Therefore, as long as we stay in the legal context, the bomber remained anonymous.

To put it another way, there were two “interleaved” instances of anonymity here: (i) the bomber hiding his location (and every other information which could possibly lead to the prevention of the bombing) from the police in order to carry out the attack successfully; (ii) the bomber hiding his precise location, name, appearance, etc. from the police to avoid being captured and punished. The consequence of our conception is a maximalist view on anonymity instantiation: every goal of the perpetrator could constitute a separate case of anonymity.

5. Let us take the case described above even further. Consider a vicious but thin-skinned despot who one day receives an insulting anonymous letter. He tries to identify the author in order to punish him but fails to do so. Instead he punishes the entire population of the country in some way – obviously including the author of the letter. Has the identification taken place in this case? According to our analysis it has not, since the despot was not able to discover any of the concealed descriptions of the author (the author’s nationality was known to the despot before).

6. Some cases of imposed anonymity may be raised as not fitting properly our account. Take, for instance, a manufacturer of some goods which are resold by third-party sales agents. The manufacturer is anonymous to the customers buying his products, but he does not really intend that. His anonymity is enforced by the salesmen who do not want the customers to be supplied directly. Hence, this is the case of intentional anonymity, because it is clearly intended by the agents. What is unusual about such situation is that the intending person is different from the one being anonymous. Another popular case of imposed anonymity is the process of the peer review of academic papers.32

We did not include this possibility in our formalization presented in §4 to leave it as clear as possible. But the definition could be easily extended to cover third-person intentions by introducing a new variable “Z” and replacing the appropriate occurrences of “X”. In the situation described above Z would be different from X, but in standard cases both variables would designate the same person (Z=X, see below). Z makes X anonymous to Y under the description P iff,

• • X presents himself under the description P to Y
• • Z wants to achieve goal G
• • Z believes that Y may prevent him from achieving G
• • Z believes that Y will be able to prevent him from achieving G if Y knows X under some other description R
• • Z takes action to prevent Y from coordinating descriptions P and R.

9. Epilogue

Let us return to the Jackal and his failed assassination attempt. We can now provide a detailed analysis of that case using our account of anonymity and identification. What was the goal for which he wanted to remain anonymous? It was certainly to ensure that the planned assassination of de Gaulle remained undisturbed and to secure the Jackal’s escape from the crime scene. Under what description was he known to the police? As someone who was planning the assassination of the French president. What kind of description was he hiding? We can list a lot of information here: his name, address, appearance, etc., and also his location before and during the assassination. The last description is the very information that was discovered by the police officer when he heard a sound coming from the room where the Jackal was hiding. This is when the identification took place. A particular piece of information about the Jackal that he tried to conceal was coordinated with his description as a potential assassin and that led to his identification.33 34

References

Anscombe G.E. (1957), Intention, Blackwell, Oxford.

Boer S.E., Lycan W.G. (1975). “Knowing Who,” Philosophical Studies 28 (5): 299–344.

Davidson D. (1980), Actions and Events, Oxford University Press, Oxford.

Dennett D. (1982), “Beyond Belief,” [in:] Thought and Object, A. Woodfield (ed), Clarendon, Oxford.

Donnellan K. (1966), “Reference and Definite Descriptions,” Philosophical Review 75: 281–304.

Forsyth F. (1971), The Day of the Jackal, The Viking Press, New York.

Frankfurt H. (1978), “The Problem of Action,” American Philosophical Quarterly 15: 157–162.

Kaplan D. (1968), “Quantifying In,” Synthese 19 (1–2): 178–214.

Matthews S. (2010), “Anonymity and the Social Self,” American Philosophical Quarterly 47: 351–363.

Nissenbaum H. (1999), “The Meaning of Anonymity in an Information Age,” The Information Society 15: 141–144.

Ohm P. (2010), “Broken Promises of Privacy: Responding to the Surprising Failure of Anonymization,” UCLA Law Review 57: 1701–1777.

Ponesse J. (2013), “Navigating the Unknown: Towards a Positive Conception of Anonymity,” The Southern Journal of Philosophy 51 (3): 320–344.

Quine W.V. (1956), “Quantifiers and Propositional Attitudes,” Journal of Philosophy 53 (5): 177–187.

Sajjad T. (2013), Transitional Justice in South Asia: A Study of Afghanistan and Nepal, Routledge, London and New York.

Sosa E. (1970), “Propositional Attitudes De Dicto and De Re,” Journal of Philosophy 67 (21): 883-896.

Wallace K.A. (1999), “Anonymity,” Ethics and Information Technology 1 (1): 23–35.