Table of Links
3. Theoretical Lenses
4. Applying the Theoretical Lenses and 4.1 Handoff Triggers: New tech, new threats, new hype
4.2. Handoff Components: Shifting experts, techniques, and data
4.3. Handoff Modes: Abstraction and constrained expertise
5. Uncovering the Stakes of the Handoff
5.1. Confidentiality is the tip of the iceberg
6.2 Lesson 2: Beware objects without experts
6.3 Lesson 3: Transparency and participation should center values and policy
8. Research Ethics and Social Impact
Acknowledgments and References
4.2 Handoff Components: Shi ing experts, techniques, and data
The sociotechnical ecosystem surrounding the handoff of the DAS has many actor-components, many of which remained largely unchanged throughout the transition to DP. For instance, the stakeholders and users who depend upon Census data products and the external agencies and groups (demographers, community groups, etc.) with whom the Bureau collaborates remained relatively stable throughout the handoff. However, the handoff also introduced new components, shifting the experts and technologies involved in delivering the DAS’s confidentiality function. Below we compared those DAS components before and after the shift from SDL to DP.
4.2.1 Technical Methods. A key shift in the DAS was the substitution of SDL tools with DP mechanisms, a new set of confidentiality-preserving tools built on a definition of privacy from theoretical computer science. Under the previous SDL methods, Bureau statisticians protected census response data through methods like suppressing and swapping individual records. Under DP, however, randomly generated “noise” is algorithmically added to census data to preserve confidentiality. This transition introduced two new subcomponents of particular note. First, the tunable epsilon (휀) parameter is a direct measure of privacy loss in DP, in which small 휀 reflects low privacy loss (i.e., high privacy, low accuracy) while large 휀 reflects high privacy loss (i.e., low privacy, high accuracy). Second is post-processing, a new step added to the data pipeline under DP to further modify the confidential data after the injection of randomized noise. This step ensures all final data products are non-negative integers, in order to assuage human interpreters who might be confused or put off by, for instance, a table reporting -48.12 people residing within a particular geography
4.2.2 Data Invariants. The Census’s outputs have significant consequences: because certain statistics inform resource allocation, accurate representation of population is important to a number of stakeholders, including voting rights advocates, state and municipal governments, tribal leadership, and even disaster recovery and public health personnel [95, 97, 137]. For the 2010 census and those prior, some particularly significant counts (such as total state populations) were held invariant under the DAS;[2] in other words, they were not manipulated from their value ‘as counted’ [93, 94]. However, invariants are incompatible with traditional DP – zero noise requires an infinite privacy budget – meaning that any count held invariant complicates DP’s confidentiality guarantees [3, 93]. [3] As a result, the 2020 DAS reduced the number of counts that would be held invariant, most notably no longer publishing the population of census blocks as counted. Thus, the reported population - as well as demographic characteristics such as race and age - of all geographies smaller than a state would be altered with DP before publication.
4.2.3 Experts. Finally, the adoption of DP thus meant the introduction of a new class of experts to the DAS: theoretical computer scientists, specifically those well-studied in DP formulations. As a result, computer scientists were slotted into DAS design processes, for instance: serving alongside social scientists, policy researchers, political advocates, and corporate leaders on DP working groups for two census oversight committees; and completing contractual work to directly assist in implementing DP for the 2020 Demographic and Housing Characteristics tabulations [55].
Authors:
(1) AMINA A. ABDU, University of Michigan, USA;
(2) LAUREN M. CHAMBERS, University of California, Berkeley, USA;
(3) DEIRDRE K. MULLIGAN, University of California, Berkeley, USA;
(4) ABIGAIL Z. JACOBS, University of Michigan, USA.
This paper is
[2] Specifically, we know that “total population, voting-age population, number of housing units, number of occupied housing units, and number and type of group quarters were all invariants at the block level in 2000 and 2010 Census publications” [4]. Blocks are the smallest unit of geography recorded by the Census [7] In 2010, for instance, the Census divided the country into over 11 million blocks.
[3] We note that Bureau messaging regarding invariants is inconsistent. Officials have said in some instances that invariants can be reconciled with DP but that they “eat[...] the privacy-loss budget” [93, p. 27], but in others that invariants “fundamentally violate[...] the central promise of differentially private solutions to controlling disclosure risk”[6, p. 32]. As such, it is unclear whether invariant values should or should not be considered within the scope of the DAS.
