US Department of Commerce Bans Noise Infusion in Census and BEA Data
The Ban on Noise Infusion
The United States Department of Commerce has issued an order banning "noise infusion" from all statistical products published by the Census Bureau and the Bureau of Economic Analysis (BEA). The order mandates that the Department prioritize accuracy and objectivity, explicitly stating that any use of noise infusion is inconsistent with Department policies.
Under the new guidelines, the Department of Commerce has established a strict order of priority for disclosure avoidance methods:
- Coarsening: This is the preferred method for all statistical products.
- Suppression: Permitted only as a last resort when coarsening is prohibited by law or would substantially defeat the usability of the product.
- Noise Infusion: Strictly prohibited for any statistical product.
The Role of Differential Privacy and Noise
Noise infusion is a core component of differential privacy, which is widely regarded by scientists as the gold standard for protecting individual privacy in large datasets. Differential privacy typically combines contribution bounding (limiting the impact of any single individual on a statistic) with carefully calibrated noise addition to ensure that individual records cannot be reconstructed from published statistics.
Historically, the U.S. Census Bureau used "swapping" (exchanging attributes between records) from 1990 to 2010. However, researchers discovered that swapping was unsafe, allowing for the reconstruction of individual records. This led the Bureau to adopt differential privacy for the 2020 Census to maintain the highest possible utility while preventing such reconstruction attacks.
Impact on Data Utility and Privacy
Removing noise infusion from the disclosure avoidance toolbox creates a critical trade-off between data utility and privacy. Because privacy attacks on statistical releases often involve solving systems of equations, perfectly accurate statistics make these attacks trivial. Noise forces attackers to deal with probabilities and uncertainty, making re-identification significantly harder.
Risks of Coarsening and Suppression
Coarsening (making attributes less precise) and suppression (removing data below certain thresholds) are considered "blunt instruments." For complex data products involving small populations or minority groups, these methods often either:
- Destroy utility: The data becomes too vague to be useful for demographers and social scientists.
- Increase vulnerability: The data remains susceptible to privacy attacks if not sufficiently coarsened.
Perspectives on the Ban
The decision has sparked significant debate among technical experts, policymakers, and the public, reflecting a fundamental tension between the need for precise data and the right to privacy.
Arguments Against the Ban (Privacy and Security Concerns)
Critics argue that the ban facilitates the weaponization of data. By making re-identification easier, the data could potentially be used for gerrymandering or targeted surveillance.
"If you start publishing and weaponizing the data against people with various attributes, they’ll just lie or not answer. And then you are left with worse than nothing: bad data people try to act on."
Others point to historical precedents where census data was used by oppressive regimes to target specific religious or ethnic groups, arguing that differential privacy is a necessary firewall against such abuses.
Arguments For the Ban (Accuracy and Transparency Concerns)
Some users of Census data found the 2020 Census's implementation of differential privacy problematic. Critics argue that the noise introduced made the data difficult to use for researchers who were not equipped with the advanced statistical tools required to analyze noisy datasets.
"The way the data was released produced serious issues downstream as most researchers and statisticians who ingested the data weren't prepared for receiving noisy data values."
Some argue that the government should not be "synthesizing" data at all, suggesting that if data is too dangerous to be made public, it should not be collected in the first place.
Summary of Disclosure Avoidance Techniques
| Technique | Description | Status under New Order |
|---|---|---|
| Coarsening | Reducing precision (e.g., county $\rightarrow$ state) | Preferred |
| Suppression | Removing data below a threshold | Last Resort |
| Noise Infusion | Adding random values to hide true totals | Banned |
| Swapping | Exchanging attributes between records | Banned (as it involves randomness) |
| Sampling | Randomly removing records | Banned (as it involves randomness) |