A Note on the Misinterpretation of the US Census Re-identification Attack

Francis, Paul

doi:10.1007/978-3-031-13945-1_21

Cited by 9 publications

(5 citation statements)

References 8 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…If the U.S. Census Bureau were to stick to the so-called CD-model and produced locally protected or input-protected data (e.g., using RR or microdata masking discussed in Hundepool et al (2012), or the methods used in the 2010 Census), then reconstruction would not be a real danger: at most the attacker would be able to reconstruct the locally protected or the input-protected data, rather than the original data. Differential privacy is also an option, but it may add more noise than strictly required to counter reconstruction, thereby leading to unnecessary utility loss (Dove 2021, Hotz et al 2022, Bach 2022, or it may offer less protection than previous approaches (Francis 2022).…”

Section: Discussionmentioning

confidence: 99%

“…5 In fact, even if the threat to confidentiality was credible, it is unclear that the Census's new DP-based TDA algorithm offers the best protection. In Francis (2022) it is shown that race and ethnicity can be inferred with more precision and less prior knowledge from TDA outputs than from the outputs of the Census previous protection algorithm.…”

Section: Misinterpreting Reconstruction As Reidentification May Overs...mentioning

confidence: 99%

See 1 more Smart Citation

Database Reconstruction Is Not So Easy and Is Different from Reidentification

Muralidhar¹,

Domingo‐Ferrer²

2023

Preprint

View full text Add to dashboard Cite

In recent years, it has been claimed that releasing accurate statistical information on a database is likely to allow its complete reconstruction. Differential privacy has been suggested as the appropriate methodology to prevent these attacks. These claims have recently been taken very seriously by the U.S. Census Bureau and led them to adopt differential privacy for releasing U.S. Census data. This in turn has caused consternation among users of the Census data due to the lack of accuracy of the protected outputs. It has also brought legal action against the U.S. Department of Commerce. In this paper, we trace the origins of the claim that releasing information on a database automatically makes it vulnerable to being exposed by reconstruction attacks and we show that this claim is, in fact, incorrect. We also show that reconstruction can be averted by properly using traditional statistical disclosure control (SDC) techniques. We further show that the geographic level at which exact counts are released is even more relevant to protection than the actual SDC method employed. Finally, we caution against confusing reconstruction and reidentification: using the quality of reconstruction as a metric of reidentification results in exaggerated reidentification risk figures.

show abstract

Section: Discussionmentioning

confidence: 99%

Section: Misinterpreting Reconstruction As Reidentification May Overs...mentioning

confidence: 99%

Database Reconstruction Is Not So Easy and Is Different from Reidentification

Muralidhar¹,

Domingo‐Ferrer²

2023

Preprint

View full text Add to dashboard Cite

show abstract

“…This consideration is essential given the paramount importance of the decennial census in policymaking. Even if the Census Bureau, the public, and other external stakeholders agree on differential privacy as an appropriate privacy framework, the right amount of noise to inject should be informed by the specific privacy harms the Bureau wants to protect against, as well as the 'base rate' accuracy of statistical inference of protected attributes (Francis, 2022).…”

Section: Concluding Remarks: Trade-off Between Data Utility and Priva...mentioning

confidence: 99%

Comment: The Essential Role of Policy Evaluation for the 2020 Census DisclosureAvoidance System

Kenny¹,

Kuriwaki²,

McCartan³

et al. 2023

Harvard Data Science Review

View full text Add to dashboard Cite

In "Differential Perspectives: Epistemic Disconnects Surrounding the U.S. Census Bureau's Use of Differential Privacy," boyd and Sarathy argue that empirical evaluations of the Census Disclosure Avoidance System (DAS), including our published analysis (Kenny et al., 2021b), failed to recognize that the benchmark data against which the 2020 DAS was evaluated is never a ground truth of population counts. In this commentary, we explain why policy evaluation, which was the main goal of our analysis, is still meaningful without access to a perfect ground truth. We also point out that our evaluation leveraged features specific to the decennial census and redistricting data, such as block-level population invariance under swapping and voter file racial identification, better approximating a comparison with the ground truth. Lastly, we show that accurate statistical predictions of individual race based on the Bayesian Improved Surname Geocoding, while not a violation of differential privacy, substantially increases the disclosure risk of private information the Census Bureau sought to protect. We conclude by arguing that policymakers must confront a key trade-off between data utility and privacy protection, and an epistemic disconnect alone is insufficient to explain disagreements between policy choices.

show abstract

“…Several analysts have published critiques of the Census Bureau Database Reconstruction Experiment (Ruggles et al 2019;Ruggles and Van Riper 2022;Muralidhar 2022;Francis 2022;Muralidhar andDomingo-Ferrer 2023a, 2023b;Sanchez, Domingo-Ferrer, and Muralidhar 2023). They contend that the experiment was neither a reconstruction nor a reidentification as those terms have been previously understood in the literature.…”

Section: Disclosure Control In Machine-readable Data 1960-2020mentioning

confidence: 99%

“It's None of Their Damn Business”: Privacy and Disclosure Control in the U.S. Census, 1790–2020

Ruggles¹,

Magnuson²

2023

Population & Development Rev

View full text Add to dashboard Cite

The U.S. Census has grappled with public concerns about privacy since the first enumeration in 1790. Beginning in the mid‐nineteenth century, census officials began responding to concerns about privacy with promises of confidentiality. In recent years, escalating concerns about confidentiality have threatened to reduce the usability of publicly accessible population data. This paper traces the history of privacy and disclosure control since 1790. We argue that controlling public access to census information has never been an effective response to public concerns about government intrusion. We conclude that the Census Bureau should weigh the costs of curtailing access to reliable data against realistic measures of the benefit of new approaches to disclosure control.

show abstract

A Note on the Misinterpretation of the US Census Re-identification Attack

Cited by 9 publications

References 8 publications

Database Reconstruction Is Not So Easy and Is Different from Reidentification

Database Reconstruction Is Not So Easy and Is Different from Reidentification

Comment: The Essential Role of Policy Evaluation for the 2020 Census DisclosureAvoidance System

“It's None of Their Damn Business”: Privacy and Disclosure Control in the U.S. Census, 1790–2020

Contact Info

Product

Resources

About