<abstract xmlns="http://www.w3.org/1999/xhtml">

<p>In recent years, it has been claimed that releasing accurate statistical information on a database is likely to allow its complete reconstruction. Differential privacy has been suggested as the appropriate methodology to prevent these attacks. These claims have recently been taken very seriously by the U.S. Census Bureau and led them to adopt differential privacy for releasing U.S. Census data. This in turn has caused consternation among users of the Census data due to the lack of accuracy of the protected outputs. It has also brought legal action against the U.S. Department of Commerce. In this article, we trace the origins of the claim that releasing information on a database automatically makes it vulnerable to being exposed by reconstruction attacks and we show that this claim is, in fact, incorrect. We also show that reconstruction can be averted by properly using traditional statistical disclosure control (SDC) techniques. We further show that the geographic level at which exact counts are released is even more relevant to protection than the actual SDC method employed. Finally, we caution against confusing reconstruction and reidentification: using the quality of reconstruction as a metric of reidentification results in exaggerated reidentification risk figures.</p>
</abstract>

In recent years, it has been claimed that releasing accurate statistical information on a database is likely to allow its complete reconstruction. Differential privacy has been suggested as the appropriate methodology to prevent these attacks. These claims have recently been taken very seriously by the U.S. Census Bureau and led them to adopt differential privacy for releasing U.S. Census data. This in turn has caused consternation among users of the Census data due to the lack of accuracy of the protected outputs. It has also brought legal action against the U.S. Department of Commerce. In this article, we trace the origins of the claim that releasing information on a database automatically makes it vulnerable to being exposed by reconstruction attacks and we show that this claim is, in fact, incorrect. We also show that reconstruction can be averted by properly using traditional statistical disclosure control (SDC) techniques. We further show that the geographic level at which exact counts are released is even more relevant to protection than the actual SDC method employed. Finally, we caution against confusing reconstruction and reidentification: using the quality of reconstruction as a metric of reidentification results in exaggerated reidentification risk figures.

Database Reconstruction Is Not So Easy and Is Different from Reidentification

University of Oklahoma Price College of Business

Dept. of Marketing and Supply Chain Management

Department of Computer Engineering and Mathematics, CYBERCAT-Center for Cybersecurity Research of Catalonia Av

Journal of Official Statistics

This work is licensed under the Creative Commons Attribution-NonCommercial-NoDerivatives 3.0 License.

{"article-title":"Database Reconstruction Is Not So Easy and Is Different from Reidentification"}

In recent years, it has been claimed that releasing accurate statistical information on a database is likely to allow its complete reconstruction. Differential...

Database Reconstruction Is Not So Easy and Is Different from Reidentification

Publicado en línea: 07 sept 2023

Páginas: 381 - 398

Recibido: 01 feb 2022

Aceptado: 01 mar 2023

DOI: https://doi.org/10.2478/jos-2023-0017

Palabras clave
Database privacy, database reconstruction, statistical disclosure control, differential privacy

© 2023 Krishnamurty Muralidhar et al., published by Sciendo

This work is licensed under the Creative Commons Attribution-NonCommercial-NoDerivatives 3.0 License.

Database Reconstruction Is Not So Easy and Is Different from Reidentification

Publicado en línea: 07 sept 2023

Páginas: 381 - 398

Recibido: 01 feb 2022

Aceptado: 01 mar 2023

DOI: https://doi.org/10.2478/jos-2023-0017

Palabras claveDatabase privacy, database reconstruction, statistical disclosure control, differential privacy

© 2023 Krishnamurty Muralidhar et al., published by Sciendo

This work is licensed under the Creative Commons Attribution-NonCommercial-NoDerivatives 3.0 License.

Palabras clave
Database privacy, database reconstruction, statistical disclosure control, differential privacy