Data dissemination and disclosure limitation in a world without microdata: A risk-utility framework for remote access analysis servers

Statistical Science

Volumn 20, Issue 2, 2005, Pages 163-177

  Gomatam, S ^a   Karr, A F ^b   Reiter, J P ^c   Sanil, A P ^b  

^a CENTER FOR DRUG EVALUATION AND RESEARCH   (United States)

^b NATIONAL INSTITUTE OF ENVIRONMENTAL HEALTH SCIENCES   (United States)

^c DUKE UNIVERSITY   (United States)

Author keywords

Data confidentiality; Data utility; Disclosure risk; Microdata; Regression server; Remote access server; Statistical disclosure limitation

Indexed keywords

EID: 24944534544     PISSN: 08834237     EISSN: None     Source Type: Journal    
DOI: 10.1214/088342305000000043     Document Type: Article

References (40)

1. DALENIUS, T. and REISS, S. P. (1982). Data-swapping: A technique for disclosure control. J. Statist. Plann. Inference 6 73-85.
2. DOBRA, A., KARR, A. F. and SANIL, A. P. (2003). Preserving confidentiality of high-dimensional tabulated data: Statistical and computational issues. Statist. Comput. 13 363-370.
3. DOBRA, A., KARR, A. F., SANIL, A. P. and FIENBERG, S. E. (2002). Software systems for tabular data releases. International J. Uncertainty, Fuzziness and Knowledge-Based Systems 10 529-544.
4. DOMINGO-FERRER, J., MATEO-SANZ, J. M. and TORRA, V. (2001). Comparing SDC methods for microdata on the basis of information loss and disclosure risk. Presented at UNECE Workshop on Statistical Data Editing.
5. DUNCAN, G. T., DE WOLF, V. A., JABINE, T. B. and STRAF, M. L. (1993). Report of the panel on confidentiality and data access. J. Official Statistics 9 271-274.
6. DUNCAN, G. T., KELLER-MCNULTY, S. A. and STOKES, S. L. (2002). Disclosure risk vs. data utility: The R-U confidentiality map. Unpublished manuscript.
7. DUNCAN, G. T. and LAMBERT, D. (1986). Disclosure-limited data dissemination (with discussion). J. Amer. Statist. Assoc. 81 10-28.
8. DUNCAN, G. T. and MUKHERJEE, S. (2000). Optimal disclosure limitation strategy in statistical databases: Deterring tracker attacks through additive noise. J. Amer. Statist. Assoc. 95 720-729.
9. FEDERAL COMMITTEE ON STATISTICAL METHODOLOGY (1994). Report on Statistical Disclosure Limitation Methodology. U.S. Office of Management and Budget, Washington.
10. FIENBERG, S. E., MAKOV, U. E. and SANIL, A. P. (1997). A Bayesian approach to data disclosure: Optimal intruder behavior for continuous data. J. Official Statistics 13 75-89.
11. FIENBERG, S. E., MAKOV, U. E. and STEELE, R. J. (1998). Disclosure limitation using perturbation and related methods for categorical data. J. Official Statistics 14 485-502.
12. FIENBERG, S. E., STEELE, R. J. and MAKOV, U. E. (1996). Statistical notions of data disclosure avoidance and their relationship to traditional statistical methodology: Data swapping and log-linear models. In Proc. Bureau of Census 1996 Annual Research Conference 87-105. U. S. Bureau of the Census, Washington.
13. FULLER, W. A. (1993). Masking procedures for microdata disclosure limitation. J. Official Statistics 9 383-406.
14. GOMATAM, S., KARR, A. F. and SANIL, A. P. (2003). Data swapping as a decision problem. Unpublished manuscript.
15. GUTTMAN, I. (1982). Linear Models: An Introduction. Wiley, New York.
16. KARR, A. F., DOBRA, A. and SANIL, A. P. (2003). Table servers protect confidentiality in tabular data releases. Comm. ACM 46(1) 57-58.
17. KARR, A. F., LIN, X., SANIL, A. P. and REITER, J. P. (2004). Analysis of integrated data without data integration. Chance 17(3) 26-29.
18. KARR, A. F., LIN, X., SANIL, A. P. and REITER, J. P. (2005). Secure regression on distributed databases. J. Comput. Graph. Statist. 14 263-279. Available on-line at www.niss.org/dgii/technicalreports.html.
19. KELLER-MCNULTY, S. and UNGER, E. A. (1998). A database system prototype for remote access to information based on confidential data. J. Official Statistics 14 347-360.
20. LAMBERT, D. (1993). Measures of disclosure risk and harm. J. Official Statistics 9 313-331.
21. LITTLE, R. J. A. (1993). Statistical analysis of masked data. J. Official Statistics 9 407-426.
22. PAASS, G. (1988). Disclosure risk and disclosure avoidance for microdata. J. Bus. Econom. Statist. 6 487-500.
23. PALLEY, M. A. and SIMONOFF, J. S. (1987). The use of regression methodology for the compromise of confidential information in statistical databases. ACM Trans. Database Systems 12 593-608.
24. RAGHUNATHAN, T. E., REITER, J. P. and RUBIN, D. B. (2003). Multiple imputation for statistical disclosure limitation. J. Official Statistics 19 1-16.
25. REITER, J. P. (2002). Satisfying disclosure restrictions with synthetic data sets. J. Official Statistics 18 531-544.
26. REITER, J. P. (2003a). Inference for partially synthetic, public use microdata sets. Survey Methodology 29 81-88.
27. REITER, J. P. (2003b). Model diagnostics for remote access regression servers. Stat. Comput. 13 371-380.
28. REITER, J. P. (2005). Releasing multiply-imputed, synthetic public use microdata: An illustration and empirical study. J. Roy. Statist. Soc. Ser. A 168 185-205.
29. REITER, J. P. and KOHNEN, C. (2005). Categorical data regression diagnostics for remote servers. J. Statist. Comput. Simulation. To appear.
30. ROWLAND, S. (2003). An examination of monitored, remote microdata access systems. Presented at NAS Workshop on Access to Research Data: Assessing Risks and Opportunities, October 16-17, 2003.
31. RUBIN, D. B. (1993). Discussion: Statistical disclosure limitation. J. Official Statistics 9 461-468.
32. SANIL, A. P., KARR, A. F., LIN, X. and REITER, J. P. (2004a). Privacy preserving analysis of vertically partitioned data using secure matrix products. Available on-line at www.niss.org/dgii/technicalreports.html.
33. SANIL, A. P., KARR, A. F., LIN, X. and REITER, J. P. (2004b). Privacy preserving regression modelling via distributed computation. In Proc. 2004 ACM SIGKDD International Conference on Knowledge Discovery and Data Mining 677-682. ACM Press, New York. Available on-line at www.niss.org/dgii/technicalreports. html.
34. SCHOUTEN, B. and CIGRANG, M. (2003). Remote access systems for statistical analysis of microdata. Stat. Comput, 13 381-389.
35. SWEENEY, L. (1997). Computational disclosure control for medical microdata: The Datafly system. In Record Linkage Techniques - 1997: Proc. of an International Workshop and Exposition (W. Alvey and B. Jamerson, eds.) 442-453. U.S. Office of Management and Budget, Washington.
36. TODD, M. J. (2001). Semidefinite optimization. Acta Numer. 10 515-560.
37. VANDENBERGHE, L. and BOYD, S. (1996). Semidefinite programming. SIAM Rev. 38 49-95.
38. WILLENBORG, L. C. R. J. and DE WAAL, T. (1996). Statistical Disclosure Control in Practice. Springer, New York.
39. WILLENBORG, L. C. R. J. and DE WAAL, T. (2001). Elements of Statistical Disclosure Control. Springer, New York.
40. YANCEY, W. E., WINKLER, W. E. and CREECY, R. H. (2002). Disclosure risk assessment in perturbative microdata protection. In Inference Control in Statistical Databases, from Theory to Practice. Lecture Notes in Comput. Sci. 2316 135-152. Springer, London.