Quantifying Privacy Risks of Public Statistics to Residents of Subsidized Housing

Overview

• The U.S. Census Bureau is implementing a new disclosure avoidance system that raises privacy concerns.
• Researchers explored how this system could allow identification of subsidized households violating occupancy guidelines.
• Experiments on both public statistics and synthetic data were conducted to assess the privacy risks.
• The findings provide insights for policymakers seeking an accurate and trustworthy census.

Plain English Explanation

The U.S. Census Bureau is rolling out a new system to protect people's privacy when publishing census data. However, researchers explored how this new system might still allow identifying households living in subsidized housing that have more people than allowed.

By combining public data from the Census and the Department of Housing and Urban Development, the researchers found a simple way to potentially figure out which subsidized households were breaking the rules about how many people can live there. This is a concern because people in subsidized housing may be afraid to report all the people actually living there, in case they get in trouble and lose their housing.

The researchers also tested this attack on synthetic data - data that is artificially created to resemble real census data but with the identities removed. They found that the Census Bureau's old privacy protection method didn't do much to stop this attack, but their newer, more advanced method seemed to be more effective.

Overall, this research provides an important example for policymakers who are trying to make the census both accurate and protect people's privacy.

Technical Explanation

The researchers conducted experiments on both published census statistics and synthetic data to explore a specific privacy concern related to the Census Bureau's new disclosure avoidance system.

They focused on the risk that respondents in subsidized housing may deliberately underreport household members, such as unauthorized children, due to fears of eviction. By combining public data from the Decennial Census and the Department of Housing and Urban Development, the researchers demonstrated a simple, low-cost reconstruction attack that could potentially identify subsidized households violating occupancy guidelines in 2010.

Experiments on synthetic data suggested that the Census Bureau's 2010 random swapping disclosure avoidance mechanism did not significantly reduce the precision of this attack. However, a differentially private mechanism similar to their 2020 system appeared to be more effective at mitigating the privacy risks.

Critical Analysis

The paper provides a valuable example of how even well-intentioned privacy protection measures can still leave vulnerabilities that could be exploited. The researchers acknowledge that their attack relies on certain assumptions, such as the availability of public data sources, that may not always hold true.

Additionally, the paper does not address the broader societal implications of this privacy risk, such as how it could further marginalize low-income populations or discourage participation in the census. Policymakers should consider the potential unintended consequences of disclosure avoidance systems and strive for a balanced approach that prioritizes both accuracy and privacy.

Further research could explore alternative privacy-preserving mechanisms or investigate the prevalence and impact of respondents' fears of eviction or other negative consequences from fully participating in the census.

Conclusion

This research highlights the need for robust, multifaceted privacy protections in the census process. The findings provide a valuable case study for policymakers as they work to ensure the U.S. Census Bureau can collect accurate data while also safeguarding the privacy of respondents, particularly those in vulnerable situations. Ongoing collaboration between researchers, policymakers, and the public will be crucial to developing a trustworthy and inclusive census system.