Masking and Re-identification Methods for Public-Use Microdata: Overview and Research Problems <s> Background <s> Statistical evaluation of databases which contain personal records may entail risks for the confidentiality of the individual records. The risk has increased with the availability of flexible interactive evaluation programs which permit the use of trackers, the most dangerous class of snooping tools known. A class of trackers, called union trackers, is described. They permit reconstruction of the entire database without supplementary knowledge and include the general tracker recently described as a special case. For many real statistical databases the overwhelming majority of definable sets of records will form trackers. For such databases a random search for a tracker is likely to succeed rapidly. Individual trackers are redefined and counted and their cardinalities are investigated. If there are n records in the database, then most individual trackers employ innocent cardinalities near n /3, making them difficult to detect. Disclosure with trackers usually requires little effort per retrieved data element. <s> BIB001 </s> Masking and Re-identification Methods for Public-Use Microdata: Overview and Research Problems <s> Background <s> The problem of statistical database confidentiality in releasing microdata is addressed through the use of approximate data-swapping. Here, a portion of the microdata is replaced with a database that has been selected with approximately the same statistics. The result guarantees the confidentiality of the original data, while providing microdata with accurate statistics. Methods for achieving such transformations are considered and analyzed through simulation. <s> BIB002 </s> Masking and Re-identification Methods for Public-Use Microdata: Overview and Research Problems <s> Background <s> There has been a longstanding government interest and concern in the United States and elsewhere over the confidentiality of statistical data, especially as gathered in sample surveys and censuses. For example, the U.S. Bureau of the Census operates under Title 13 of the U.S. Code, virtually from its inception in 1929. Such legal guarantees of confidentiality are not only a reflection of the public concerns regarding disclosure but also of the agencies’ desire for high quality data. Even in the absence of legal restrictions on access to data, statistical agencies and survey researchers have always been concerned about the need to preserve the confidentiality of respondents in order to ensure the quality of the data provided, and these concerns have been heightened by the decline in response rates for censuses and surveys over the past two decades (e.g., see Panel on Privacy and Confidentiality as Factors in Survey Response 1979; Fienberg 1993‐1994). At the same time government agencies have an obligation to report their data widely and thus they recognize the need for some balance between strict confidentiality (however it is to be interpreted) and the benefits derived from the release of statistical information. To In this article we develop an approach to data disclosure in survey settings by adopting a probabilistic definition of disclosure due to Dalenius. Our approach is based on the principle that a data collection agency must consider disclosure from the perspective of an intruder in order to efficiently evaluate data disclosure limitation procedures. The probabilistic definition and our attempt to study optimal intruder behavior lead naturally to a Bayesian formulation. We apply the methods in a small-scale simulation study using data adapted from an actual survey conducted by the Institute for Social Research at York University. <s> BIB003 </s> Masking and Re-identification Methods for Public-Use Microdata: Overview and Research Problems <s> Background <s> Microaggregation is a statistical disclosure control technique for microdata disseminated in statistical databases. Raw microdata (i.e., individual records or data vectors) are grouped into small aggregates prior to publication. Each aggregate should contain at least k data vectors to prevent disclosure of individual information, where k is a constant value preset by the data protector. No exact polynomial algorithms are known to date to microaggregate optimally, i.e., with minimal variability loss. Methods in the literature rank data and partition them into groups of fixed-size; in the multivariate case, ranking is performed by projecting data vectors onto a single axis. In this paper, candidate optimal solutions to the multivariate and univariate microaggregation problems are characterized. In the univariate case, two heuristics based on hierarchical clustering and genetic algorithms are introduced which are data-oriented in that they try to preserve natural data aggregates. In the multivariate case, fixed-size and hierarchical clustering microaggregation algorithms are presented which do not require data to be projected onto a single dimension; such methods clearly reduce variability loss as compared to conventional multivariate microaggregation on projected data. <s> BIB004 </s> Masking and Re-identification Methods for Public-Use Microdata: Overview and Research Problems <s> Background <s> The paper proposes a new disclosure limitation procedure based on simulation. The key feature of the proposal is to protect actual microdata by drawing artificial units from a probability model, that is estimated from the observed data. Such a model is designed to maintain selected characteristics of the empirical distribution, thus providing a partial representation of the latter. The characteristics we focus on are the expected values of a set of functionss these are constrained to be equal to their corresponding sample averagess the simulated data, then, reproduce on average the sample characteristics. If the set of constraints covers the parameters of interest of a user, information loss is controlled for, while, as the model does not preserve individual values, re-identification attempts are impaired-synthetic individuals correspond to actual respondents with very low probability. ::: ::: Disclosure is mainly discussed from the viewpoint of record re-identification. According to this definition, as the pledge for confidentiality only involves the actual respondents, release of synthetic units should in principle rule out the concern for confidentiality. ::: ::: The simulation model is built on the Italian sample from the Community Innovation Survey (CIS). The approach can be applied in more generality, and especially suits quantitative traits. The model has a semi-parametric component, based on the maximum entropy principle, and, here, a parametric component, based on regression. The maximum entropy principle is exploited to match data traitss moreover, entropy measures uncertainty of a distribution: its maximisation leads to a distribution which is consistent with the given information but is maximally noncommittal with regard to missing information. ::: ::: Application results reveal that the fixed characteristics are sustained, and other features such as marginal distributions are well represented. Model specification is clearly a major points related issues are selection of characteristics, goodness of fit and strength of dependence relations. <s> BIB005 </s> Masking and Re-identification Methods for Public-Use Microdata: Overview and Research Problems <s> Background <s> The paper presents an illustration and empirical study of releasing multiply imputed, fully synthetic public use microdata. Simulations based on data from the US Current Population Survey are used to evaluate the potential validity of inferences based on fully synthetic data for a variety of descriptive and analytic estimands, to assess the degree of protection of confidentiality that is afforded by fully synthetic data and to illustrate the specification of synthetic data imputation models. Benefits and limitations of releasing fully synthetic data sets are discussed. Copyright 2005 Royal Statistical Society. <s> BIB006
This section gives a framework that is often used in disclosure avoidance research and brief descriptions of a variety of methods that are in use for masking microdata. Other specific issues related to some of the masking procedures are covered in subsequent sections. The framework is as follows. An agency (producer of public-use microdata) may begin with data X consisting of both discrete and continuous variables. The agency applies a masking procedure (some are listed below) to produce data Y. The masking procedure is intended to reduce or eliminate re-identification and provide a number of the analytic properties that users of the data have indicated that they need. The agency might create data Y and evaluate how well it preserves a few analytic properties and then perform a re-identification experiment. A conservative re-identification experiment might match data Y directly with data X. Because the data Y correspond almost precisely (in respects to be made clearer later), some records in X may be reidentified. To avoid disclosure, the agency might apply additional masking procedures to data X to create data Y'. It might also extrapolate or investigate how well a potential intruder could re-identify using data Y'' that contain a subset of the variables in X and that contain minor or major distortions in some of the variables. After (possibly) several iterations in which the agency determines that disclosure is avoided and some of the analytic properties are preserved, the agency might release the data. Global Recoding and Local Suppression are covered by Willenborg and De Waal  . Global recoding refers to various global aggregations of identifiers so that reidentification is more difficult. For instance, the geographic identifiers associated with national US data for 50 States might be aggregated into four regions. Local suppression covers the situation when a group of variables might be used in reidentifying a record. The values of one of more of the variables would be blanked or set to defaults so that the combination of variables cannot be used for re-identification. In each situation, the provider of the data might set a default k (say 3 or 4) on the minimum number of records that must agree after global recoding and local suppression. Swapping (Dalenius and Reiss  , Reiss BIB002 , Schlörer BIB001 ) refers to a method of swapping information from one record to another. In some situations, a subset of the variables is swapped. In variants, information from all records, a purposively chosen subset of records, or a randomly selected subset of records may be swapped. The purposively chosen sample of records may be chosen because they are believed to have a greater risk of re-identification. The advantages of swapping are that it is easily implemented and it is one of the best methods of preserving confidentiality. Its main disadvantage is that, even with a very low swapping rate, it can destroy analytic properties, particularly on subdomains. Rank Swapping (Moore  ) is another easily implemented masking procedure. With basic single-variable rank swapping, the values of an individual variable are sorted and swapped in a range of k-percent of the total range. A randomization determines the specific values of variables that are swapped. Swapping is typically without replacement. The procedure is repeated for each variable until all variables have been rank swapped. If k is relatively small, then analytic distortions on the entire file may be small (Domingo-Ferrer and Mateo-Sanz  , Moore  ) for simple regression analyses. If k is relatively large, there is an assumption that the reidentification risk may be reduced. Micro-aggregation (Defays and Answar  , Domingo-Ferrer and Mateo-Sanz BIB004 ) is a method of aggregating values of variables that is intended to reduce reidentification risk. For single-ranking micro-aggregation in which each variable is aggregated independently of other variables, it is easily implemented. The values of a variable are sorted and divided into groups of size k. In practice k is taken to be 3 or 4 to reduce analytic distortions. In each group, the values of the variable are replaced by an aggregate such as the mean or the median. The micro-aggregation is repeated for each of the variables that are considered to be usable for re-identification. Domingo-Ferrer and Mateo-Sanz BIB004 provided methods for aggregating several variables simultaneously. The methods can be based on multi-variable metrics for clustering variables into the most similar groups. They are not as easily implemented because they can involve sophisticated optimization algorithms. For computational efficiency, the methods are applied to 2-4 variables simultaneously whereas many public-use files contain 12 or more variables. The advantage of the multi-variable aggregation method is that it provides better protection against re-identification. Its disadvantage is that analytic properties can be severely compromised, particularly if two or three uncorrelated variables are used in the aggregation. The variables that are not micro-aggregated may themselves allow re-identification. Additive Noise was introduced by Kim [32},  and investigated by Fuller  , Kim and Winkler  , and Yancey et al.  . Let X be an n×k data vector consisting of n records with k variables (fields). If we generate random noise X 1 with mean 0 and cov(X 1 ) = cov(X), then we can replace X and use Y = X + ε where cov(ε) = c cov(X 1 ) for 0<c<0.5. Further, we can do a linear transform of Y to Z so that the mean of Z equals the mean of X, and the correlation of Z equals correlation of X. Kim [26] also showed that it is theoretically possible to recover means and covariances of X on arbitrary subdomains. Kim  ,  and Fuller  both showed that the additivenoise procedures provide good analytic properties such as regression analyses with masked data Z that closely reproduce regression analyses of the unmasked data X. Because additive noise can yield files with moderate re-identification rates (Fuller [28] ], Kim and Winkler  ), Roque  introduced methods that applied mixtures of additive noise that reduced re-identification rates by a factor of 10. Yancey et al.  provided much simpler computational procedures that eliminated the nonlinear optimization procedures of Rogue  . One criticism has been the need of specialized software for producing and analyzing the data that is (partially) alleviated by high quality software that was developed for Yancey et al.  . Synthetic Microdata from Probabilistic Models (Fienberg et al.  , BIB003 ,  , Raghunathan et al.  , Reiter BIB006 , Little and Liu  ,  , and Polettini BIB005 ) provide methods for building an accurate statistical model M of data X. The statistical model M is generally based on estimates of joint and conditional distributions of the underlying probability densities. The estimation of densities is simplified because the models typically only target one set of analyses. Artificial or synthetic data Y are created by randomly drawing records from the model M. The intent is that some of the analytic properties of M are preserved in the artificial data Y. It is generally assumed that re-identification is impossible even when a number of analytic restraints are placed on the data. A clear disadvantage of synthetic data is the amount of modeling expertise that is needed for developing a reasonable model M of the data with suitable analytic properties. Another disadvantage is that a moderate-to-large amount of high quality data may be needed in the modeling. If there are errors in the original data, then there is a possibility that the errors will be approximately reproduced in the synthetic data. An advantage is that the one or two potential analytic uses of the data can be clearly described.