Not a long time ago, I was invited to take part in an online survey related to COVID-19. The survey had a bunch of questions that asked me about my knowledge about the Pandemic, and the Corona Virus in general. The title looked legit at the first glance – “Knowledge, Attitudes and practices of the public towards the novel COVID-19 Pandemic“. Not so legit, to be honest; the inconsistent capitalization of the words and the phrase “novel COVID-19” made me raise my eyebrows.
Unsurprisingly, the survey form was created using Google Forms, and it required me to sign in to my Google Account just to be able to fill it up.
This form is anonymous, and we don’t steal personal information, we promise.Some random form on the internet.
Once more time – I needed to be signed in to fill that form up. At first, I thought that means coughing up my email address. But later I discovered that if the form is not collecting email addresses, the email address is not shared with the person who created the form. It was only a mechanism to protect the form from anonymous submissions. There’s an option in Google Forms that you must enable to restrict responses from people who aren’t signed in. By default, that option is disabled, but the person who created the form went extra steps to have people sign in.
I gave it a thought, and didn’t think there’s any risk in filling up the form; after-all my response could help someone come up with a finding. I started answering the questions. The first few questions were simply asking for my consent, which is a normal practice in any health related survey. After asking a bunch of questions about Corona Virus and COVID-19, it started asking my gender, age, and my current address. I thought that information could be volunteered because this form was not asking for any identifying information other than that.
Then came a question which asked what the yearly income of my family was, and if someone from the family works abroad. Wait a minute.
Is this form really anonymous? Is there any way a person who created a Google Forms survey know that I filled this form? How can I be sure that my information gets anonymized? The information that I submitted will only be anonymous if a lot of other people submitted the form. And the only way to be sure of it is to know whether other people also participated in the survey.
I don’t know whether other people were participating in that survey. I didn’t ask the person who sent me that link. I politely replied that I didn’t want to take part in the survey, and she was cool with it. But I discovered how easy it is to harvest personal information using fake surveys. This could be one of the several social engineering tactics people use to obtain personal information.
Anyone can create a form asking for people’s private information like their religious or political beliefs, and financial information like their income. Then they could clone the form 99 times, and send different forms to 100 different people for the same survey, and claim that the form is anonymous.
When you don’t need to enter your personal information, it’s easy to get convinced that the information will be anonymized. That does not happen if you are the only person filling up the form. I will be more skeptical about survey forms from now on.