Topic (ii): Disclosure risk, information loss and usability of data

Statistical database protection is a part of information security which tries to prevent published statistical information (tables, individual records) from disclosing the contribution of specific respondents. This paper shows how to use information-theoretic concepts to measure disclosure risk

The prevalence of categorical observations that are unique in a sample and also still unique in the population are usually taken as the measure of the overall risk of disclosure in the sample data. Samuels (1998) suggested adopting evolutionary processes and their associated urn models as a

This series contains research reports, written by or in cooperation with staff members of the Statistical Research Division, whose content may be of interest to the general statistical research community. The views reflected in these reports are not necessarily those of the Census Bureau nor do they necessarily represent Census Bureau statistical policy or practice. Inquiries may be addressed to the author(s) or the SRD

Summary. The paper describes a new method for assessing disclosure risk for tables of counts; the subtraction-attribution probability (SAP) method. The SAP score is the probability of an intruder recovering a ‘risky’ subpopulation table given a quantity of information about the individuals in a

Protection against disclosure is important for statistical agencies releasing microdata files from sample surveys. Estimates of simple measures of disclosure risk can provide useful evidence to support decisions about release. We propose a new measure of disclosure risk: the probability that a

, the aggregations of the cell values are not considered sensitive, thus can be released or pub-lished for their uses in applications. Though appears nonsensitive, the aggregated information may be used by some data snoopers to infer sensitive information about cell values. The latent risk of disclosure should

Information organizations (IOs) must provide data products that are both useful and have low risk of confidentiality disclosure. Recognizing that deidentification of data is generally inadequate to protect their confidentiality against attack by a data snooper, concerned IOs can apply disclosure

with the assessment of the disclosure risk associated to the release of tabular data.

Statistical Disclosure Control is part of the usual process, necessary for the dissemination of microdata. Usually, direct identifiers are removed and variables that can be used to re-identify certain records are recoded or suppressed. For certain surveys these methods are inadequate to produce