Search

Responsible disclosure limitation is an iterative exercise in risk assessment and mitigation. From time to time, as disclosure risks grow and evolve and as data users' needs change, agencies must consider redesigning the disclosure avoidance system(s) they use. Discussions about candidate systems often conflate inherent features of those systems with implementation decisions independent of those systems. For example, a system's ability to calibrate the strength of protection to suit the underlying disclosure risk of the data (e.g., by varying suppression thresholds), is a worthwhile feature regardless of the independent decision about how much protection is actually necessary. Having a principled discussion of candidate disclosure avoidance systems requires a framework for distinguishing these inherent features of the systems from the implementation decisions that need to be made independent of the system selected. For statistical agencies, this framework must also reflect the applied nature of these systems, acknowledging that candidate systems need to be adaptable to requirements stemming from the legal, scientific, resource, and stakeholder environments within which they would be operating. This paper proposes such a framework. No approach will be perfectly adaptable to every potential system requirement. Because the selection of some methodologies over others may constrain the resulting systems' efficiency and flexibility to adapt to particular statistical product specifications, data user needs, or disclosure risks, agencies may approach these choices in an iterative fashion, adapting system requirements, product specifications, and implementation parameters as necessary to ensure the resulting quality of the statistical product.

The use of formal privacy to protect the confidentiality of responses in the 2020 Decennial Census of Population and Housing has triggered renewed interest and debate over how to measure the disclosure risks and societal benefits of the published data products. Following long-established precedent in economics and statistics, we argue that any proposal for quantifying disclosure risk should be based on pre-specified, objective criteria. Such criteria should be used to compare methodologies to identify those with the most desirable properties. We illustrate this approach, using simple desiderata, to evaluate the absolute disclosure risk framework, the counterfactual framework underlying differential privacy, and prior-to-posterior comparisons. We conclude that satisfying all the desiderata is impossible, but counterfactual comparisons satisfy the most while absolute disclosure risk satisfies the fewest. Furthermore, we explain that many of the criticisms levied against differential privacy would be levied against any technology that is not equivalent to direct, unrestricted access to confidential data. Thus, more research is needed, but in the near-term, the counterfactual approach appears best-suited for privacy-utility analysis., Comment: 47 pages, 1 table

This chapter examines the motivations and imperatives for modernizing how statistical agencies approach statistical disclosure limitation for official data product releases. It discusses the implications for agencies' broader data governance and decision-making, and it identifies challenges that agencies will likely face along the way. In conclusion, the chapter proposes some principles and best practices that we believe can help guide agencies in navigating the transformation of their confidentiality programs., Comment: Forthcoming CRC Handbook of Formally Private and Synthetic Data Approaches for Statistical Disclosure Control

In an era where external data and computational capabilities far exceed statistical agencies' own resources and capabilities, they face the renewed challenge of protecting the confidentiality of underlying microdata when publishing statistics in very granular form and ensuring that these granular data are used for statistical purposes only. Conventional statistical disclosure limitation methods are too fragile to address this new challenge. This article discusses the deployment of a differential privacy framework for the 2020 US Census that was customized to protect confidentiality, particularly the most detailed geographic and demographic categories, and deliver controlled accuracy across the full geographic hierarchy., Comment: Version 2 corrects a few transcription errors in Tables 2, 3 and 5. Version 3 adds final journal copy edits to the preprint

The Dark Energy Spectroscopic Instrument (DESI) is a Stage IV ground-based dark energy experiment that will measure the expansion history of the Universe using the Baryon Acoustic Oscillation technique. The spectra of 35 million galaxies and quasars over 14000 square degrees will be measured during the life of the experiment. We describe the installation of the major elements of the instrument at the Mayall 4m telescope, completed in late 2019. The previous prime focus corrector, spider vanes, and upper rings were removed from the Mayall's Serrurier truss and replaced with the newly-constructed DESI ring, vanes, cage, hexapod, and optical corrector. The new corrector was optically aligned with the primary mirror using a laser tracker system. The DESI focal plane system was integrated to the corrector, with each of its ten 500-fiber-positioner petal segments installed using custom installation hardware and the laser tracker. Ten DESI spectrographs with 30 cryostats were installed in a newly assembled clean room in the Large Coude Room. The ten cables carrying 5000 optical fibers from the positioners in the focal plane were routed down the telescope through cable wraps at the declination and hour angle axes, and their integral slitheads were integrated with the ten spectrographs. The fiber view camera assembly was installed to the Mayall's primary mirror cell. Servers for the instrument control system replaced existing computer equipment. The fully integrated instrument has been commissioned and is ready to start its operations phase.