A Summary of Attack Methods and Confidentiality Protection Measures for Fully Automated Remote Analysis Systems

International Statistical Review

Volumn 81, Issue 3, 2013, Pages 426-455

  O'Keefe, Christine M ^a   Chipperfield, James O ^b  

^a CSIRO   (Australia)

^b AUSTRALIAN BUREAU OF STATISTICS   (Australia)

Author keywords

Analysis output checking; Confidentiality; Privacy; Remote analysis; Statistical disclosure control

Indexed keywords

EID: 84888203868     PISSN: 03067734     EISSN: 17515823     Source Type: Journal    
DOI: 10.1111/insr.12021     Document Type: Article

References (65)

1. Australian Bureau of Statistics. (website). available online at http://www.abs.gov.au Accessed 11 June 2013.
2. Barak, B., Chaudhuri, K., Dwork, C., Kale, S., McSherry, F. & Talwar, K. (2007). Privacy, accuracy, and consistency too: a holistic solution to contingency table release. In Proceedings of the 26th ACM SIGMOD-SIGACT-SIGART Symposium on Principles of Database Systems (PODS), Beijing, China, pp. 273-282.
3. Bleninger, P., Drechsler, J. & Ronning, G. (2010). Remote data access and the risk of disclosure from linear regression: An empirical study. In Privacy in Statistical Databases, Vol. 6344 of Lect Notes Comp Sci, Eds. J. Domingo-Ferrer & E. Magkos. Berlin Heidelberg: Springer; pp.220-233.
4. Brandt, M., Franconi, L., Gurke, C., Hundepol, A., Lucarelli, M., Mol, J., Ritchie, F., Seri, G. & Welpton, R. (2010). Guidelines for the Checking of Outputs based on Microdata Research, ESSnet SDC, A Network of Excellence in the European Statistical System in the Field of Statistical Disclosure Control. available online at http://neon.vb.cbs.nl/casc/ESSnet/guidelines_on_outputchecking.pdf. Accessed 11 June 2013.
5. Brandt, M. & Zwick, M. (2010). Improvement of data access. The long way to remote data access in Germany. In Privacy in Statistical Databases Conference PSD, Corfu, Greece, Short paper in CD proceedings.
6. Brownstein, J., Cassa, C., Kohane, I. & Mandl, K. (2006). An unsupervised classification method for inferring original case locations from low-resolution disease maps. Int. J. Health Geogr., 5, 56.
7. Chipperfield, J. & Lucie, S. (2010). Analysis of Micro-Data: Controlling the Risk of Disclosure, Research Paper - Methodology Advisory Committee 1352.0.55.110, Australian Bureau of Statistics.
8. Commonwealth of Australia. (1905). Census and Statistics Act 1905. Available online at http://corrigan.austlii.edu.au/au/legis/cth/consol_act/casa1905241/ Accessed 11 June 2013.
9. Corscadden, L., Enright, J., Khoo, J., Krsinich, F., McDonald, S. & Zeng, I. (2006). Disclosure Assessment of Analytical Output: Statistics New Zealand, Report.
10. Cox, L. (2002). Confidentiality Issues For Statistical Database Query Systems, Invited Paper for Joint UNECE/Eurostat Seminar on Integrated Statistical Information Systems and Related Matters (ISIS2002). Available online at http://www.unece.org/fileadmin/DAM/stats/documents/ces/sem.47/15.s.e.pdf, Geneva, Switzerland Accessed 11 June 2013.
11. Cox, L. (2011). Disclosure risk and data quality. In Proceedings of the 58th Congress of the International Statistical Institute, Dublin, Ireland, 21-26 August 2011, pp. 5.
12. Cox, L. & Sande, G. (1979). Techniques for preserving statistical confidentiality. In Proceedings of the 42nd Meeting fo the International Statistical Institute, Vol. 3. Manila: Philippines Organizing Committee; pp.499-512.
13. Dalenius, T. (1977). Towards a methodology for statistical disclosure control. Statistik Tidskrift, 15, 429-444.
14. Dandekar, R. (2004). Maximum utility-minimum information loss table server design for statistical disclosure control of tabular data. In Privacy in Statistical Databases, Vol. 3050 of Lect Notes Comp Sci, Eds. J. Domingo-Ferrer & V. Torra. Berlin Heidelberg: Springer; pp.121-135.
15. Domingo-Ferrer, J. & Magkos, E. (Eds). (2010). Privacy in Statistical Databases, Vol. 6344 of Lect Notes Comp Sci. Berlin Heidelberg: Springer.
16. Duncan, G., Elliot, M. & Salazar-Gonzàlez, J.-J. (2011). Statistical Confidentiality. New York: Springer.
17. Duncan, G. & Lambert, D. (1989). The risk of disclosure for microdata. J. Bus. Econ. Stat., 7, 207-217.
18. Duncan, G. T., Keller-McNulty, S. A. & Stokes, S. L. (2001). Disclosure Risk vs Data Utility: The R-U Confidentiality Map. Technical Report LA-UR-01-6428, Los Alamos National Laboratory.
19. Dwork, C. & Lei, J. (2009). Differential privacy and robust statistics. In Proceedings of the 41st ACM Symposium on Theory of Computing (STOC), Bethesda, Maryland, pp. 371-380.
20. Dwork, C., McSherry, F., Nissim, K. & Smith, A. (2006). Calibrating noise to sensitivity in private data analysis. In 3rd IACR Theory of Cryptography Conference, New York, pp. 265-284.
21. Dwork, C. & Smith, A. (2009). Differential privacy for statistics: What we know and what we want to learn. J. Priv. Confid., 1, 135-154.
22. Elliot, M., Mackey, E. & Purdam, K. (2011). Formalizing the selection of key variables in disclosure risk. In Proceedings of the 58th Congress of the International Statistical Institute, ISI 2011, Dublin, Ireland.
23. Fienberg, S. & Makov, U. (1998). Confidentiality, uniqueness and disclosure limitation for categorical data. J. Off. Stat., 14, 385-397.
24. Fraser, B. & Wooton, J. (2005). A proposed method for confidentialising tabular output to protect against differencing, Paper presented to the Joint UNECE/Eurostat work session on statistical data confidentiality, 9-11 November: Geneva, Switzerland.
25. Giessing, S. & Höhne, J. (2011). Eliminating small cells from census counts tables: empirical vs. design transition probabilities. In SORT Special Issue: Privacy in Statistical Databases, pp. 59-66.
26. Gomatam, S., Karr, A., Reiter, J. & Sanil, A. (2005). Data dissemination and disclosure limitation in a world without microdata: A risk-utility framework for remote access systems. Stat. Sci., 20, 163-177.
27. Honinger, J., Pattloch, D. & Voshage, R. (2010). On-Site Access to Micro Data: Preserving the Treasure, Preventing Disclosure. Accessed 23 January 2013.
28. Hundepool, A., Domingo-Ferrer, J., Franconi, L., Giessing, S., Lenz, R., Naylor, J., Nordholt, E., Seri, G. & DeWolf, P.-P. (2010). Handbook on Statistical Disclosure Control. available online at http://neon.vb.cbs.nl/casc/SDC_Handbook.pdf. Accessed 23 Jan 2013.
29. Hundepool, A., Domingo-Ferrer, J., Franconi, L., Giessing, S., Nordholt, E., Spicer, K. & de Wolf, P.-P. (2012). Statistical Disclosure Control, Wiley series in survey methodology. United Kingdom: John Wiley & Sons.
30. Karr, A., Dobra, A. & Sanil, A. (2003). Table servers protect confidentiality in tabular data releases. Commun. ACM, 46, 57-58.
31. Karr, A., Lee, J., Sanil, A., Hernandez, J., Karimi, S. & Litwin, K. (2002). Web-based systems that disseminate information but protect confidentiality. In Advances in Digital Government: Technology, Human Factors and Public Policy, Eds. W. McIver & A. Elmagarmid pp.181-196. Amsterdam: Kluwer.
32. Kifer, D. & Machanavajjhala, A. (2011). No free lunch in data privacy. In Proceedings of the SIGMOD '11, Athens, Greece, pp. 193-204.
33. Lucero, J., Zayatz, L., Singh, L., You, J., DePersio, M. & Freiman, M. (2011). The current stage of the microdata analysis system at the U.S. Census Bureau. In Proceedings of the 58th Congress of the International Statistical Institute, ISI 2011, Dublin, Ireland.
34. Marsh, C., Skinner, C., Arber, S., Penhale, B., Openshaw, S., Hobcraft, J., Lievesley, D. & Walford, N. (1991). The case for samples of anonymized records from the 1991 census. J. Roy. Stat. Soc. Ser. A, 154, 305-340.
35. McCullagh, P. & Nelder, J. (1989). Generalized Linear Models, 2nd ed. Monographs on Statistics and Applied Probability University Press. Cambridge: Chapman and Hall.
36. Office for National Statistics. (website). Available online at http://.statistics.gov.uk. Accessed 11 June 2013.
37. O'Keefe, C. M. (2012). Confidentialising exploratory data analysis output in remote analysis. J. Off. Stat., 28, 591-613.
38. O'Keefe, C. M. & Good, N. (2009). Regression output from a remote analysis system. Data Knowl. Eng., 68, 1175-1186.
39. O'Keefe, C. M., Sparks, R., McAullay, D. & Loong, B. (2012). Confidentialising survival analysis output in a remote data access system. J. Priv. Confid., 4, 127-154.
40. Palley, M. & Simonoff, J. (1986). Regression methodology based disclosure of a statistical database. In Proceedings of the Section on Survey Research Methods. American Statistical Association; pp.382-387.
41. Reiter, J. (2003). Model diagnostics for remote-access regression systems. Stat. Comput., 13, 371-380.
42. Reiter, J. (2004). New approaches to data dissemination: A glimpse into the future (?). Chance, 17, 12-16.
43. Reiter, J. & Kohnen, C. (2005). Categorical data regression diagnostics for remote systems. J. Stat. Comput. Sim., 75, 889-903.
44. Reuter, W. & Museux, J.-M. (2010). Establishing an infrastructure for remote access to microdata at eurostat. In Privacy in Statistical Databases, Vol. 6344 of Lect Notes Comp Sci, Eds. J. Domingo-Ferrer & E. Magkos, pp.249-257. Berlin Heidelberg: Springer.
45. Reznek, A. (2003). Disclosure risks in cross-section regression models. In American Statistical Association 2003 Proceedings of the Section on Government Statistics and Section on Social Statistics, CD, pp. 3444-3451.
46. Reznek, A. (2006). Recent confidentiality research related to access to enterprise microdata. In Prepared for the Comparative Analysis of Enterprise Microdata (CAED) Conference, Chicago IL, USA.
47. Reznek, A. & Riggs, T. (2005). Disclosure risks in releasing output based on regression residuals. In American Statistical Association 2005 Proceedings of the Section on Government Statistics and Section on Social Statistics, CD, pp. 1397-1404.
48. Reznek, A. & Riggs, T. L. (2004). Disclosure risks in regression models: Some further results. In American Statistical Association 2004 Proceedings of the Section on Government Statistics and Section on Social Statistics, CD, pp. 1701-1708.
49. Ritchie, F. (2006). Disclosure Controls for Regression Outputs. London: Mimeo, Office of National Statistics.
50. Ritchie, F. (2007). Disclosure detection in research environments in practice. In Supporting paper for the UNECE/Eurostat work session on statistical data confidentiality. Manchester, UK, 17-19 December. Available online at http://.unece.org/stats/documents/2007/12/confidentiality/wp.37.e.pdf. Accessed 11 June 2013.
51. Ritchie, F. (2011). Disclosure Detection in Research Environments in Practice. Accessed 13 January 2011.
52. Shlomo, N. (2007). Statistical disclosure control methods for census frequency tables. Int. Stat. Rev., 75, 199-217.
53. Skinner, C. & Elliot, M. (2002). A measure of disclosure risk for microdata. J. Roy. Stat. Soc. B, 64, 855-867.
54. Skinner, C. & Shlomo, N. (2008). Assessing identification risk in survey microdata using log-linear models. J. Amer. Statist. Assoc., 103, 989-1001.
55. Smith, A. (2008). Efficient, differentially private point estimators. ArXiv:0809.4794v1.
56. Smith, A. (2009). Asymptotically optimal and private statistical estimation. In Proceedings of the CANS 2009, LNCS 5888, Eds. J. Garay, A. Miyaji & A. Otsuka. Berlin Heidelberg: Springer-Verlag; pp. 53-57.
57. SORT. (2011). Special Issue: Privacy in statistical databases, SORT-Stat Oper Res T. Available online at http://www.idescat.cat/sort/artpublished.html. Accessed 6 Feb 2013.
58. Sparks, R., Carter, C., Donnelly, J., O'Keefe, C., Duncan, J., Keighley, T. & McAullay, D. (2008). Remote access methods for exploratory data analysis and statistical modelling: Privacy-preserving analytics™. Comput. Meth. Prog. Bio., 91, 208-222.
59. Spruill, N. (1983). The confidentiality and analytic usefulness of masked business microdata. In Proceedings of the Section on Survey Research Methods. American Statistical Association; pp.382-387.
60. Tan, S.-M. (2009). Editorial: Official statistics and microdata - access and confidentiality. Stat. J. IAOS, 26, 55-56.
61. UK Data Archive. (website). Secure Data Service. Available online at securedata.data-archive.ac.uk. Accessed 11 June 2013.
62. United States Census Bureau. (website). Available online at http://www.census.gov. Accessed 11 June 2013.
63. University of Chicago. (website). NORC. Available online at www.norc.org. Accessed 11 June 2013.
64. Wooton, J. (2006). Measuring and Correcting for Information Loss in Confidentialised Census Counts. Technical Report Tech. Rep., Australian Bureau of Statistics.
65. Wooton, J. & Fraser, B. (2005). A Review of Confidentiality Protections for Statistical Tables - With Special Reference to the Differencing Problem. Tech. Rep., Australian Bureau of Statistics.