4 ms·

> In a [court filing](https://storage.courtlistener.com/recap/gov.uscourts.almd.75040/gov.uscourts.almd.75040.41.1.pdf https://storage.courtlistener.com/recap/g

by _Nat_ 5y ago

> In a [court filing](https://storage.courtlistener.com/recap/gov.uscourts.almd.75040/gov.uscourts.almd.75040.41.1.pdf https://storage.courtlistener.com/recap/gov.uscourts.almd.75... ) last April, Abowd wrote that “our simulated attack showed that a conservative attack scenario using just 6 billion of the over 150 billion statistics released in 2010 would allow an attacker to accurately re-identify at least 52 million 2010 Census respondents (17% of the population) and the attacker would have a high degree of confidence in their results with minimal additional verification or field work.” What would "re-identification" expose? For example, say Alice is re-identified: what does the attacker then know about Alice?

snarkerson 5y ago
Would like to talk about an extended warranty for your car? Or end of life care for your 78yo family member? Or super awesome student loans for your 16yo family members? That is just low hanging fruit. Imagine cross referencing other data sources to get more complete images of everyone in 52m responder households.
- quitit 5y ago
  A census is only useful if the participants can fill out the paperwork honestly. I actually don't understand the people who don't see this being a problem, nor why they would believe layered privacy protections aren't useful. It would seem irresponsible to release accurate or detailed census data to the general public. To use an example that I'm aware of: in the USA (but likely exists in other places), there are groups of individuals which seek out and target interracial couples. These couples are then harassed and violence is not uncommon. Approaches such as Differential Privacy exist to address this specific privacy weakness. The act of fuzzying the data this way is an accepted method for the data to only be useful for its intended purpose. As you and others have noted it's trivial to build up various use cases, from the commercially annoying to the dangerous: the assumption that individuals and companies are never going to try to exploit this data or break the law is perhaps dangerously naive.
  - lupire 5y ago
    The problem is that the census should not be collecting this information in the first place, because it undermines the mission.
    - quitit 5y ago
      I'm not a statistician so I can't possibly get into a discussion about what is worthwhile information for collection. I am aware that a lot of planning goes into such questions to avoid potential abuse (even by the government), the goal being to ask the minimum needed to provide governance while also providing a historically meaningful snapshot. I don't think there is a strong argument against having a census, it's a more privacy preserving approach to planning than other forms of data collection such as mandatory registers or combining existing government databases - medical, births/deaths/marriages, automotive, postal, taxation, education and so on (in this example the resulting database has too much information about the population, governments are mindful to keep these databases separate on purpose.) Back to your point though: Arguably a lot of needed and seemingly benign information can still be problematic. As one commenter noted, merely indicating childrens' presence can be a problem, while such information is clearly beneficial for governance. Ultimately protections should be in place regardless of the kinds of information that is sought, since one can't foresee all potential forms of abuse such data collection can bring, nor how such information can be merged with additional data sources to reveal more accurate profiles (as is the contemporary issue of online privacy.)
- deathanatos 5y ago
  > Would like to talk about an extended warranty for your car? … the people making these calls don't give a rat's ass about census data, accurate or otherwise. It's fraud, all of it. I get these all. the. time.; my current car is 25 years old, I guarantee you its warranty is not "about" to expire. I got these before I ever owned a car. They're not going to sell you an extended warranty, they're going to take the money and run. Accurate targeting doesn't matter. Unless the census data has a column "is_sucker", but even then, I doubt it. You could maybe alter that argument to be like "well but reputable ads then" … but, no, I doubt that too. Even with the tech we have, ads shown to eyeballs still making incredibly questionable "there is no way this has positive ROI" choices, like running the same ad twice in every commercial break. YT clearly has ~1 ad right now, that stupid game one whose name I cannot remember.
  - lupire 5y ago
    Many of these marketers absolutely use accurate information such as public car registration, mortgages, etc. > YT clearly has ~1 ad right now, that stupid game No it doesn't. That's a personalized ad for you.
  - drewzero1 5y ago
    The car warranty amuses/annoys me for the same reason, I drive two cars over 25, well past 200K and both from defunct manufacturers, so I really doubt any warranty would touch them. Same thing with the "student loan forgiveness hotline"-- I haven't had any for years. I used to have a bit of fun with the "Microsoft tech support" calls, since we didn't have a Windows computer in the house. Recently I've had a few calls that just said "I'm actually calling to inform him now," so I think the callers don't really care what the content of the call is as long as they can get you to call them back. And maybe if you're gullible enough to call them back, you're gullible enough to give them money.
- mannerheim 5y ago
  I get those calls, and I don't even have a car or drive.
shoeboxam 5y ago
Consider Alice's census response as a row in a table of responses. You can reconstruct every attribute/column for which a sufficiently large number of summary statistics are released. Names are not a part of the statistics the Census releases, so you won't be able to reconstruct the name. Make a fingerprint out of some of the reconstructed attributes and run a database join against another dataset with names. You've now enriched your data with any remaining attributes that were not a part of your fingerprint. I'm grateful no one has attacked and shared the 2010 decennial census, or ACS, which has considerably more questions. If it seems far-fetched... well, you only need one person to do it, there's an existence proof, and the attack is basically just a convex optimization problem. As to what can specifically be in those columns, it's pretty narrow for the decennial, but the ACS is more broad. Check out the ACS summary data: https://data.census.gov/cedsci/table?q=United%20States https://data.census.gov/cedsci/table?q=United%20States Extra: I've written some reconstruction attacks like this myself. One approach is to find the least squares solution to |Ax - b|. Let b be a vector of Census statistics. A is a query matrix. An attacker has both. Solve for x, which is a column in the dataset. If b is long enough, then the system is fully determined, and you can solve for x exactly. In practice, b can be much smaller than x for the system to reconstruct x with high accuracy. Repeat for each column. There are more efficient approaches, like SAT solvers, for large systems. Happy to talk more about the general approaches used to privatize census data if anyone is curious. I don't work on the Census mechanisms, but I do privacy research and am familiar with DP hierarchical histogram mechanisms. See also Abowd's summary of the attack: https://blogs.cornell.edu/abowd/special-materials/245-2/ https://blogs.cornell.edu/abowd/special-materials/245-2/
drfuchs 5y ago
If Alice's household Census data is re-identified, the attacker may learn that she's in a single-sex relationship. Sure, her neighbors may know, but now some organizations that maybe don't have her best interests at heart are able to easily and automatically locate her and everyone like her, so as to be able to harass them or worse. Or the attacker may learn that Alice is relatively young, has a kid, and doesn't seem to be living with anyone. Sounds like a bastard child, which is a sin. The neighbors are accepting, but now anyone else can find out. Or, maybe Alice is part of a racial or religious minority group that tends to vote Democratic. Now attackers can make a list from afar of individual houses to visit on election day to more efficiently intimidate folks in that group from voting. Or, maybe with a bit of cross-referencing with commercial data, it sure is looking like Alice is not a citizen. This time, the neighbors don't even know, but now the folks who are trying hard to have everyone like her rounded up and expelled ASAP do. Or, maybe a special-interest pedophile group that has a thing for certain age kids in a certain racial group can now make a list of which houses are worth staking out. And, if any of these things happen even on a small scale, and word gets out that it was due to Census data being insufficiently protected, it will mean that in the next census, all these groups of folks will think twice before participating, with the result that they will lose representation at the federal level as well as federal funding for their communities. If this all sounds far-fetched, what do you make of the fact that of the 16 State Attorneys General who sued the Census Bureau over Differential Privacy, 14 were Republicans? With additional briefs from Republican lawmakers from 4 states? (By the way, they lost so resoundingly, and the written rulings by the three-judge panel delivered such a thumping to the attorneys involved, it seems that they slunk away and didn't dare to tarnish themselves any further by taking the next step and appealing to the Supreme Court, where the embarrassment would have been yet worse.)
- lupire 5y ago
  While selectively accusing Republican governments of being criminal racists, you are ignoring the opposition to DP from Mexican American Legal Defense and Educational Fund ("Voting Rights Act and its enforcement could be adversely affected by differential privacy"), and Native American Rights Fund https://www.npr.org/2021/05/19/993247101/for-the-u-s-census-keeping-your-data-anonymous-and-useful-is-a-tricky-balance https://www.npr.org/2021/05/19/993247101/for-the-u-s-census-...

by _Nat_ 5y ago

snarkerson 5y ago

Would like to talk about an extended warranty for your car? Or end of life care for your 78yo family member? Or super awesome student loans for your 16yo family members? That is just low hanging fruit. Imagine cross referencing other data sources to get more complete images of everyone in 52m responder households.

quitit 5y ago
A census is only useful if the participants can fill out the paperwork honestly. I actually don't understand the people who don't see this being a problem, nor why they would believe layered privacy protections aren't useful. It would seem irresponsible to release accurate or detailed census data to the general public. To use an example that I'm aware of: in the USA (but likely exists in other places), there are groups of individuals which seek out and target interracial couples. These couples are then harassed and violence is not uncommon. Approaches such as Differential Privacy exist to address this specific privacy weakness. The act of fuzzying the data this way is an accepted method for the data to only be useful for its intended purpose. As you and others have noted it's trivial to build up various use cases, from the commercially annoying to the dangerous: the assumption that individuals and companies are never going to try to exploit this data or break the law is perhaps dangerously naive.
- lupire 5y ago
  The problem is that the census should not be collecting this information in the first place, because it undermines the mission.
  - quitit 5y ago
    I'm not a statistician so I can't possibly get into a discussion about what is worthwhile information for collection. I am aware that a lot of planning goes into such questions to avoid potential abuse (even by the government), the goal being to ask the minimum needed to provide governance while also providing a historically meaningful snapshot. I don't think there is a strong argument against having a census, it's a more privacy preserving approach to planning than other forms of data collection such as mandatory registers or combining existing government databases - medical, births/deaths/marriages, automotive, postal, taxation, education and so on (in this example the resulting database has too much information about the population, governments are mindful to keep these databases separate on purpose.) Back to your point though: Arguably a lot of needed and seemingly benign information can still be problematic. As one commenter noted, merely indicating childrens' presence can be a problem, while such information is clearly beneficial for governance. Ultimately protections should be in place regardless of the kinds of information that is sought, since one can't foresee all potential forms of abuse such data collection can bring, nor how such information can be merged with additional data sources to reveal more accurate profiles (as is the contemporary issue of online privacy.)
deathanatos 5y ago
> Would like to talk about an extended warranty for your car? … the people making these calls don't give a rat's ass about census data, accurate or otherwise. It's fraud, all of it. I get these all. the. time.; my current car is 25 years old, I guarantee you its warranty is not "about" to expire. I got these before I ever owned a car. They're not going to sell you an extended warranty, they're going to take the money and run. Accurate targeting doesn't matter. Unless the census data has a column "is_sucker", but even then, I doubt it. You could maybe alter that argument to be like "well but reputable ads then" … but, no, I doubt that too. Even with the tech we have, ads shown to eyeballs still making incredibly questionable "there is no way this has positive ROI" choices, like running the same ad twice in every commercial break. YT clearly has ~1 ad right now, that stupid game one whose name I cannot remember.
- lupire 5y ago
  Many of these marketers absolutely use accurate information such as public car registration, mortgages, etc. > YT clearly has ~1 ad right now, that stupid game No it doesn't. That's a personalized ad for you.
- drewzero1 5y ago
  The car warranty amuses/annoys me for the same reason, I drive two cars over 25, well past 200K and both from defunct manufacturers, so I really doubt any warranty would touch them. Same thing with the "student loan forgiveness hotline"-- I haven't had any for years. I used to have a bit of fun with the "Microsoft tech support" calls, since we didn't have a Windows computer in the house. Recently I've had a few calls that just said "I'm actually calling to inform him now," so I think the callers don't really care what the content of the call is as long as they can get you to call them back. And maybe if you're gullible enough to call them back, you're gullible enough to give them money.
mannerheim 5y ago
I get those calls, and I don't even have a car or drive.

shoeboxam 5y ago

Consider Alice's census response as a row in a table of responses. You can reconstruct every attribute/column for which a sufficiently large number of summary statistics are released. Names are not a part of the statistics the Census releases, so you won't be able to reconstruct the name. Make a fingerprint out of some of the reconstructed attributes and run a database join against another dataset with names. You've now enriched your data with any remaining attributes that were not a part of your fingerprint. I'm grateful no one has attacked and shared the 2010 decennial census, or ACS, which has considerably more questions. If it seems far-fetched... well, you only need one person to do it, there's an existence proof, and the attack is basically just a convex optimization problem. As to what can specifically be in those columns, it's pretty narrow for the decennial, but the ACS is more broad. Check out the ACS summary data: https://data.census.gov/cedsci/table?q=United%20States https://data.census.gov/cedsci/table?q=United%20States Extra: I've written some reconstruction attacks like this myself. One approach is to find the least squares solution to |Ax - b|. Let b be a vector of Census statistics. A is a query matrix. An attacker has both. Solve for x, which is a column in the dataset. If b is long enough, then the system is fully determined, and you can solve for x exactly. In practice, b can be much smaller than x for the system to reconstruct x with high accuracy. Repeat for each column. There are more efficient approaches, like SAT solvers, for large systems. Happy to talk more about the general approaches used to privatize census data if anyone is curious. I don't work on the Census mechanisms, but I do privacy research and am familiar with DP hierarchical histogram mechanisms. See also Abowd's summary of the attack: https://blogs.cornell.edu/abowd/special-materials/245-2/ https://blogs.cornell.edu/abowd/special-materials/245-2/

drfuchs 5y ago

If Alice's household Census data is re-identified, the attacker may learn that she's in a single-sex relationship. Sure, her neighbors may know, but now some organizations that maybe don't have her best interests at heart are able to easily and automatically locate her and everyone like her, so as to be able to harass them or worse. Or the attacker may learn that Alice is relatively young, has a kid, and doesn't seem to be living with anyone. Sounds like a bastard child, which is a sin. The neighbors are accepting, but now anyone else can find out. Or, maybe Alice is part of a racial or religious minority group that tends to vote Democratic. Now attackers can make a list from afar of individual houses to visit on election day to more efficiently intimidate folks in that group from voting. Or, maybe with a bit of cross-referencing with commercial data, it sure is looking like Alice is not a citizen. This time, the neighbors don't even know, but now the folks who are trying hard to have everyone like her rounded up and expelled ASAP do. Or, maybe a special-interest pedophile group that has a thing for certain age kids in a certain racial group can now make a list of which houses are worth staking out. And, if any of these things happen even on a small scale, and word gets out that it was due to Census data being insufficiently protected, it will mean that in the next census, all these groups of folks will think twice before participating, with the result that they will lose representation at the federal level as well as federal funding for their communities. If this all sounds far-fetched, what do you make of the fact that of the 16 State Attorneys General who sued the Census Bureau over Differential Privacy, 14 were Republicans? With additional briefs from Republican lawmakers from 4 states? (By the way, they lost so resoundingly, and the written rulings by the three-judge panel delivered such a thumping to the attorneys involved, it seems that they slunk away and didn't dare to tarnish themselves any further by taking the next step and appealing to the Supreme Court, where the embarrassment would have been yet worse.)

lupire 5y ago
While selectively accusing Republican governments of being criminal racists, you are ignoring the opposition to DP from Mexican American Legal Defense and Educational Fund ("Voting Rights Act and its enforcement could be adversely affected by differential privacy"), and Native American Rights Fund https://www.npr.org/2021/05/19/993247101/for-the-u-s-census-keeping-your-data-anonymous-and-useful-is-a-tricky-balance https://www.npr.org/2021/05/19/993247101/for-the-u-s-census-...