A s databases grow more prevalent and comprehensive, database administrators seek to limit disclosure of confidential information while still providing access to data. Practical databases accommodate users with heterogeneous needs for access. Each class of data user is accorded access to only certain views. Other views are considered confidential, and hence to be protected. Using illustrations from health care and education, this article addresses inferential disclosure of confidential views in multidimensional categorical databases. It demonstrates that any structural, so data-value-independent method for detecting disclosure can fail. Consistent with previous work for two-way tables, it presents a data-value-dependent method to obtain tight lower and upper bounds for confidential data values. For two-dimensional projections of categorical databases, it exploits the network structure of a linear programming (LP) formulation to develop two transportation flow algorithms that are both computationally efficient and insightful. These algorithms can be easily implemented through two new matrix operators, cellmaxima and cell-minima. Collectively, this method is called matrix comparative assignment (MCA). Finally, it extends both the LP and MCA approaches to inferential disclosure when accessible views have been masked.

Alternative advertising strategies Advertising has often been categorized according to adopted media (e.g. newspaper versus television), targeted audience (e.g. consumers versus businesses), targeted region (national versus regional), purpose (image versus product promotion), and type of advertiser (public versus commercial companies) (see e.g. Bovee and Arens, 1992). However, these classifications are

Senior centers provide a variety of supportive services for independent elderly adults. In many metropolitan areas, the elderly population is growing and redistributing from central cities to suburbs, where accessibility to senior centers is limited. Policy analysts need to locate senior centers to best meet changing demands for service. We present alternative hierarchical facility location models for senior centers applied to Allegheny County, Pennsylvania. We find that a model that minimizes consumer disutility and unserved demands is preferred to one that maximizes utility alone, and that the former model is well-behaved in response to changes in structural parameters.

MEASURES USED TO PROTECT SUBJECTS in publicly distributed microdata files often have a significant negative impact on key analytic uses of the data. For example, it may be important to analyze subpopulations within a data file such as racial minorities, yet these subjects may present the greatest disclosure risk because their records tend to stand out or be unique. Files or records that are linkable create another type of disclosure risk-common elements between two files can be used to link files with sensitive data to externally available files that disclose identity. Examples of disclosure limitation methods used to address these types of issues include blanking out data, coarsening response categories, or withholding data altogether. However, the very detail that creates the greatest risk also provides insight into differences that are of greatest interest to analysts. Restricted-use agreements that provide unaltered versions of the data may not be available, or only selectively so. The public-use version of the data is very important because it is likely to be the only one to which most researchers, policy analysts, teaching faculty, and students will ever have access. Hence, it is the version from which much of the utility of the data is extracted and often it effectively becomes the historical record of the data collection. This underscores the importance that the disclosure review c ommittee s trikes a g ood b alance b etween protection and u tility. In this paper we d escrib e our disclosure review committee's (DRC) analysis and resulting data protection plans for two national studies and one administrative data system. Three distinct disclosure limitation methods were employed, taking key uses of the data into consideration, to protect respondents while still providing statistically accurate and highly useful public-use data. The techniques include data swapping, microaggregation, and suppression of detailed geographic data. We describe the characteristics of the data sets that led to the selection of these methods, provide measures of the statistical impact, and give details of their implementations so that others may also utilize them. We briefly discuss the composition of our DRC, highlighting what we believe to be the important disciplines and experience represented by the group.

No abstract