Talk:Mosaic effect

Drating notes

Dissimilar/uniquely different from or to:

• https://en.wikipedia.org/wiki/Mosaic_theory_of_the_Fourth_Amendment
• https://en.wikipedia.org/w/index.php?title=Mosaic_theory_of_intelligence_gathering&oldid=1013033152

This is to see if there's a viable article around the more esoteric legal/security concept of combining enough / sufficient declassified or public-knowledge, or public-domain data, that the new aggregate whole of the collection of that data can instead elevant the concept to the point of being classified, simply on the basis of it's unification.

Although -- this may not be JUST a national security thing; this is a consideration in general intel/counter-intel, as well as in concepts like information technology, network security, likely corporate "security" and more.

May be in some ways similar to or related to the idea of an Information hazard, but in a legal sense.

Very short version

Data points by themselves are safe to consider in isolation, and were likely released properly per all relevant legal and organizational requirements. However, if you combine and look at those data points just right, you've now breached security--even up to the level of national security stuff.

Imagine if you could combine ALL the text from ALL the sources on a given 100 Wikipedia articles about government-related stuff. All that stuff, by itself, in isolation, is safe. Combine it all and maybe that aggregate data would be considered sensitive compartmented information requiring a sensitive compartmented information facility to even review it.

By arranging the mosaic of information just so, you've revealed secrets.

Term mosaic effect

Timeline... x=already in article

1. 1967 - (maybe) https://supreme.justia.com/cases/federal/us/390/39/
2. 1981 - https://www.ojp.gov/pdffiles1/Digitization/92732NCJRS.pdf
3. 1993 - https://www.tbs-sct.canada.ca/pol/doc-eng.aspx?id=25502&section=html
4. 1999 — https://www.federalregister.gov/documents/2000/12/21/00-32565/public-information-and-confidentiality-advance-notice-of-proposed-rulemaking-withdrawal-of-1994
5. 2002 — https://www.energy.gov/data/procedures-public-release-data
6. 2002 — https://www.justice.gov/information-quality
7. 2004 — x https://aspe.hhs.gov/sites/default/files/private/pdf/77196/rpt_Disclosure.pdf
8. 2010 - https://richmurnane.blogspot.com/2011/01/mosaic-effect.html
9. 2013 — x https://obamawhitehouse.archives.gov/sites/default/files/omb/memoranda/2013/m-13-13.pdf
10. 2014 — x https://www.route-fifty.com/cybersecurity/2014/05/worried-about-security-beware-the-mosaic-effect/297335
11. 2014 — x https://www.nextgov.com/digital-government/2014/05/the-mosaic-effect-and-big-data/254461/
12. 2014 — https://www.brookings.edu/wp-content/uploads/2014/11/20141201_health_data_transcript.pdf
13. 2014 — x https://aspe.hhs.gov/sites/default/files/private/pdf/77196/rpt_Disclosure.pdf
14. 2017 — https://dtm.iom.int/sites/g/files/tmzbdl1461/files/07-11-2017%20Humanitarian%20Data%20Protection%20Draft%205.pdf
15. 2019 — https://resources.data.gov/assets/documents/fds-data-ethics-framework.pdf
16. 2019 - https://www2.census.gov/library/publications/decennial/2020/2020-census-disclosure-avoidance-handbook.pdf
17. 2021 — https://www.washingtonpost.com/politics/2021/08/17/cybersecurity-202-sensitive-government-data-could-be-another-casualty-afghan-pullout/
18. 2021 — x https://blogs.icrc.org/law-and-policy/2021/02/09/mosaic-effect-revelation-risks/
19. 2023 — https://www3.weforum.org/docs/WEF_Global_Risks_Report_2023.pdf

To review:

Non-US POV

1. https://www.theguardian.com/uk-news/2023/nov/09/royal-security-cost-guardian-freedom-of-information-tribunal
2. https://www.washingtonpost.com/politics/2021/08/17/cybersecurity-202-sensitive-government-data-could-be-another-casualty-afghan-pullout/
3. https://iapp.org/news/a/beyond-gdpr-unauthorized-reidentification-and-the-mosaic-effect-in-the-eu-ai-act
4. https://rkroundtable.org/2011/12/20/mosaic-theory-universal-surveillance-and-unlimited-recordkeeping/

Classification by compilation

"Classification by compilation" is an older precursor term?

• Example: https://web.archive.org/web/20221006204246/https://www.secretsdeclassified.af.mil/Questions/Laws-and-Executive-Orders-Governing-Declassification/

Legal and policy definition

• Classification by compilation (EO 13526, DOJ FOIA Guide)

Technical parallels

• Aggregation risk, inference attacks, re-identification, open-source fusion

Origins in intelligence policy

• Early case law (Halkin v. Helms, CIA v. Sims)

Post-9/11 expansion

• FOIA Exemption 1 jurisprudence
• David Pozen’s Yale Law Journal analysis

National security and government transparency

• FOIA exemptions, Glomar responses
• Executive training (DoD, ISOO, DOJ)
• Compilation doctrine under classification law

Personal privacy and data re-identification

• Latanya Sweeney’s k-anonymity research
• Netflix deanonymization case
• Wired and mainstream coverage
• Privacy law responses

Geospatial and location intelligence

• Strava heatmap incident
• OMB M-13-13 and the “mosaic effect” test
• Satellite imagery + public geodata risks

Financial markets and corporate compliance

• Analyst mosaic theory (Reg FD guidance)
• Insider trading enforcement cases (e.g., Galleon)
• Hedge fund legal guidance and critiques

Critical infrastructure and smart-city data

• Open utility shapefiles + imagery
• RSA and SANS OSINT examples
• CISA/HIFLD data disclaimers

Criticisms and limitation

• Over-classification
• Unfalsifiability concerns
• Transparency vs. security tensions

Policy and regulatory responses

• Open-data withdrawal cases (Data.gov, Afghan data)
• HHS and DoD data-minimization protocols
• Differential privacy, redaction frameworks

Impacted domains and industries etc

High level read from article draft, to see from other searching what is being overlooked as possible angles to cover.

1. Advertising & behavioral targeting
2. Artificial intelligence & machine learning
3. Biometric identification systems
4. Corporate competitive intelligence & analysis
5. Criminal investigations & law enforcement
6. Data privacy & anonymization law
7. Finance & securities investment analysis
8. Fraud detection & identity theft
9. Government open-data initiatives
10. Humanitarian aid & social-protection programs
11. Intelligence & national-security operations
12. Legal transparency (FOIA) & classification
13. Medical & public-health analytics
14. Oil & gas infrastructure monitoring
15. Reproductive-health data investigations
16. Sensor-based environmental data (e.g., NOAA)

Saving a point in time archive

July 23: http://archive.today/2025.07.23-173316/https://en.wikipedia.org/wiki/User:Very_Polite_Person/draft/Mosaic_effect

Just to have a clear marker of unused as of today URLs; that may spillover to other related articles as useful sources. There may be more culling of URLs at this point than additions going in. TBD. -- Very Polite Person (talk) 17:36, 23 July 2025 (UTC)

Did you know nomination

The following is an archived discussion of the DYK nomination of the article below. Please do not modify this page. Subsequent comments should be made on the appropriate discussion page (such as this nomination's talk page, the article's talk page or Wikipedia talk:Did you know), unless there is consensus to re-open the discussion at this page. No further edits should be made to this page.

The result was: promoted by Darth Stabro talk 17:28, 1 August 2025 (UTC)

(

• Comment or view
• Article history

)

An example of DNA, depicted in a mosaic style of art from unique pieces of maize. The mosaic data concept is named for the art style.

• ... that the mosaic effect is the act of combining seemingly unrelated data to reveal sensitive or classified information that individual pieces of data would not disclose?

• Source: https://en.wikipedia.org/wiki/Mosaic_effect#cite_note-Rosenzweig_Mosaic_Lawfare_2017-3

• • Reviewed:

Created by Very Polite Person (talk). Number of QPQs required: 0. Nominator has fewer than 5 past nominations.

-- Very Polite Person (talk) 22:28, 28 July 2025 (UTC).

General: Article is new enough and long enough
New enough: Long enough:

Policy: Article is sourced, neutral, and free of copyright problems
Adequate sourcing: Neutral: Free of copyright violations, plagiarism, and close paraphrasing:

Hook: Hook has been verified by provided inline citation
Cited: Interesting:

Image: Image is freely licensed, used in the article, and clear at 100px.
Freely licensed: Used in article: Clear at 100px:

QPQ: Done.

Overall: A truly fascinating and vital article. Great writing and mosaic-ing of disparate sources. No Swan So Fine (talk) 13:35, 1 August 2025 (UTC) No Swan So Fine (talk) 13:35, 1 August 2025 (UTC)

A Commons file used on this page or its Wikidata item has been nominated for speedy deletion

The following Wikimedia Commons file used on this page or its Wikidata item has been nominated for speedy deletion:

• LPR Process.JPG

You can see the reason for deletion at the file description page linked above. —Community Tech bot (talk) 18:36, 3 September 2025 (UTC)

If anyone wants to help out on this expansive subject... global scale

What's here is primarily from an American/western POV, but there's plenty of coverage of this globally. This can be great example article to really harden up to be truly global in scale (or as much as the volume/value of sources go, but language/country of origin is an invalid criteria, so!).

That's why I tagged the page! — Very Polite Person (talk/contribs) 04:15, 23 May 2026 (UTC)