Masking and Re-identification Methods for Public-Use Microdata: Overview and Research Problems <s> Analytic Properties of Microdata <s> The security of organizational databases has received considerable attention in the literature in recent years. This can be attributed to a simultaneous increase in the amount of data being stored in databases, the analysis of such data, and the desire to protect confidential data. Data perturbation methods are often used to protect confidential, numerical data from unauthorized queries while providing maximum access and accurate information to legitimate queries. To provide accurate information, it is desirable that perturbation does not result in a change in relationships between attributes. In the presence of nonconfidential attributes, existing methods will result in such a change. This study describes a new method (General Additive Data Perturbation) that does not change relationships between attributes. All existing methods of additive data perturbation are shown to be special cases of this method. When the database has a multivariate normal distribution, the new method provides maximum security and minimum bias. For nonnormal databases, the new method provides better security and bias performance than the multiplicative data perturbation method. <s> BIB001 </s> Masking and Re-identification Methods for Public-Use Microdata: Overview and Research Problems <s> Analytic Properties of Microdata <s> With the rapid increase in the ability to store and analyze large amounts of data, organizations are gathering extensive data regarding their customers, vendors, and other entities. There has been a concurrent increase in the demand for preserving the privacy of confidential data that may be collected. The rapid growth of e-commerce has also increased calls for maintaining privacy and confidentiality of data. For numerical data, data perturbation methods offer an easy yet effective solution to the dilemma of providing access to legitimate users while protecting the data from snoopers (legitimate users who perform illegitimate analysis). In this study, we define a new security requirement that achieves the objective of providing access to legitimate users without an increase in the ability of a snooper to predict confidential information. We also derive the specifications under which perturbation methods can achieve this objective. Numerical examples are provided to show that the use of the new specification achieves the objective of no additional information to the snooper. Implications of the new specification for e-commerce are discussed. <s> BIB002 </s> Masking and Re-identification Methods for Public-Use Microdata: Overview and Research Problems <s> Analytic Properties of Microdata <s> Many organizations require detailed individual-level information, much of which has been collected under guarantees of confidentiality. However, simple anonymization procedures, i.e. removing names and addresses, are insufficient for this to be ensured. The records belonging to certain individuals have a high probability of being identified (as their contents, or attributes, are unusual) and therefore have the potential to be recognized spontaneously - such records are referred to as special uniques. Consider, for example, a sixteen-year-old widow in a population survey. Confidentiality of a given dataset cannot be enabled until all special unique records are identified and either disguised or removed. However, to the knowledge of the authors, no exhaustive automated analysis of this nature has been conducted due to the demanding levels of computation and data storage that are required. This paper introduces a new algorithm that locates 'risky' records in discrete data by first identifying all unique attribute sets (up to a user-specified maximum size) and secondly by grading the 'risk' of each record by considering the number and distribution of unique attribute sets within each record. Empirical tests indicate that the algorithm is highly effective at picking out 'risky' records from large samples of data. <s> BIB003 </s> Masking and Re-identification Methods for Public-Use Microdata: Overview and Research Problems <s> Analytic Properties of Microdata <s> In previous work by Domingo-Ferrer et al., rank swapping and multivariate microaggregation has been identified as well-performing masking methods for microdata protection. Recently, Dandekar et al. proposed using synthetic microdata, as an option, in place of original data by using Latin hypercube sampling (LHS) technique. The LHS method focuses on mimicking univariate as well as multivariate statistical characteristics of original data. The LHS-based synthetic data does not allow one to one comparison with original data. This prevents estimating the overall information loss by using current measures. In this paper we utilize unique features of LHS method to create hybrid data sets and evaluate their performance relative to rank swapping and multivariate microaggregation using generalized information loss and disclosure risk measures. <s> BIB004 </s> Masking and Re-identification Methods for Public-Use Microdata: Overview and Research Problems <s> Analytic Properties of Microdata <s> The paper proposes a new disclosure limitation procedure based on simulation. The key feature of the proposal is to protect actual microdata by drawing artificial units from a probability model, that is estimated from the observed data. Such a model is designed to maintain selected characteristics of the empirical distribution, thus providing a partial representation of the latter. The characteristics we focus on are the expected values of a set of functionss these are constrained to be equal to their corresponding sample averagess the simulated data, then, reproduce on average the sample characteristics. If the set of constraints covers the parameters of interest of a user, information loss is controlled for, while, as the model does not preserve individual values, re-identification attempts are impaired-synthetic individuals correspond to actual respondents with very low probability. ::: ::: Disclosure is mainly discussed from the viewpoint of record re-identification. According to this definition, as the pledge for confidentiality only involves the actual respondents, release of synthetic units should in principle rule out the concern for confidentiality. ::: ::: The simulation model is built on the Italian sample from the Community Innovation Survey (CIS). The approach can be applied in more generality, and especially suits quantitative traits. The model has a semi-parametric component, based on the maximum entropy principle, and, here, a parametric component, based on regression. The maximum entropy principle is exploited to match data traitss moreover, entropy measures uncertainty of a distribution: its maximisation leads to a distribution which is consistent with the given information but is maximally noncommittal with regard to missing information. ::: ::: Application results reveal that the fixed characteristics are sustained, and other features such as marginal distributions are well represented. Model specification is clearly a major points related issues are selection of characteristics, goodness of fit and strength of dependence relations. <s> BIB005 </s> Masking and Re-identification Methods for Public-Use Microdata: Overview and Research Problems <s> Analytic Properties of Microdata <s> The paper presents an illustration and empirical study of releasing multiply imputed, fully synthetic public use microdata. Simulations based on data from the US Current Population Survey are used to evaluate the potential validity of inferences based on fully synthetic data for a variety of descriptive and analytic estimands, to assess the degree of protection of confidentiality that is afforded by fully synthetic data and to illustrate the specification of synthetic data imputation models. Benefits and limitations of releasing fully synthetic data sets are discussed. Copyright 2005 Royal Statistical Society. <s> BIB006
There are several issues with regards to the production of microdata with analytic properties. The first issue is whether the analytic properties of the masked data are justified. Does the masked microdata allow a user to approximately reproduce one or two analyses that could be performed on the original microdata other than simple tabulations (that are often in published tables)? Is there sufficient detail so that the user can be aware of any potential discrepancies that may occur in an analysis that the producer has stated can be performed with the masked microdata? The second issue is whether the public-use microdata yield analytic results that differ significantly from results that would be obtained using the original microdata. For instance, in an econometric analysis, an economist might not find relationships between certain masked variables where relationships exist between the variables in the original microdata. Additionally, there may be too many or too few individuals in high income categories in comparison with the original microdata. With the exception of additive noise and synthetic microdata, there has seldom been much work that describes the analytic properties of the masked microdata. Generally, additive noise produces masked microdata that can quite accurately reproduce regression analyses (even on arbitrary subdomains that are reasonably large). If the constant c used with additive noise is close to zero, then additive noise will often not distort the original data much and allow other statistical analyses. A deficiency of additive noise as suggested by Fuller  and shown by Kim and Winkler  is that small proportions of records (0.5% -3%) might be re-identified. Kim and Winkler  applied additional masking procedures to avoid disclosure and somewhat decrease valid analytic properties of the public-use microdata. We observe that it is possible that re-identification rates go up as more analytic restrictions are placed on the masked data. For instance, many users want to do analyses on subdomains. If the microdata have detailed geographic identifiers (Elliot et al. BIB003 ,  ) or subdomains associated with sparse age-race-sex categories are created, then re-identification rates can increase. Creation of synthetic data from valid models is appealing because it potentially can preserve some analytic properties. It is assumed that synthetic data cannot be reidentified. An intuitive difficulty of synthetic data, as shown by Reiter BIB006 ,  , is that any analytic properties that are not included in the model will not be in the synthetic data. Reiter BIB006 has shown that some of the analytic properties that are in the model may not be in the synthetic microdata due to problems with the original microdata. For instance, the nature of the random number generation process and sample sizes, the type of modeling procedures used, outliers, and errors in the original microdata can all affect the quality of the produced microdata. Additionally, it is not possible to have greater accuracy for analytic purposes in the masked microdata than in the original, confidential microdata. Reiter  , BIB006 has used standard modeling methods that are often used in the multiple imputation literature for creating models for the data. Polettini BIB005 has used maximum entropy methods for creating models of the data. Muralidhar et al. BIB001 , BIB002 and Sarathy et al.  have used copolas to model distributions. Due to the difficulty (both theoretically and computationally) of creating models for data, Thibaudeau and Winkler  have suggested using Bayesian Networks because high quality software is available for (semi-)automatically creating models of the data. The Bayesian Network methods can be used only with discrete data or with models in which some of the continuous data can be reasonably approximated by a discrete data representation. Although the models are likely to have lower quality than those of Reiter BIB006 and Polettini BIB005 , they are much easier for the statistical agencies to implement. Dandekar et al. BIB004 ,  use Latin Hypercube methods for creating synthetic data. They have demonstrated that the methods can rapidly produce large synthetic data sets with a considerable number of variables. Further, when the Latin Hypercube methods do not produce synthetic data with the desired accuracy for some analyses, they have iterative refinement methods for improving the analytic properties. With other masking methods for producing microdata, there is often no justification that the masking methods produce masked microdata with one or two of the analytic properties of the original microdata. The superficial exceptions are when the producers of the masked microdata demonstrate that the masked microdata reproduces several of the tabulations of the original microdata. The producers may also include reproduction of tabulations on a few subdomains. At a minimum, we would hope that the masked microdata allow reproducing tabulations on the entire file and on certain subdomains. Fuller  and Lambert  have indicated that masked microdata should preserve the first two moments of the original, confidential microdata and at least one other statistical property. Van 