Abstract:Using only 34 published tables, we reconstruct five variables (census block, sex, age, race, and ethnicity) in the confidential 2010 Census person records. Using the 38-bin age variable tabulated at the census block level, at most 20.1% of reconstructed records can differ from their confidential source on even a single value for these five variables. Using only published data, an attacker can verify that all records in 70% of all census blocks (97 million people) are perfectly reconstructed. The tabular publications in Summary File 1 thus have prohibited disclosure risk similar to the unreleased confidential microdata. Reidentification studies confirm that an attacker can, within blocks with perfect reconstruction accuracy, correctly infer the actual census response on race and ethnicity for 3.4 million vulnerable population uniques (persons with nonmodal characteristics) with 95% accuracy, the same precision as the confidential data achieve and far greater than statistical baselines. The flaw in the 2010 Census framework was the assumption that aggregation prevented accurate microdata reconstruction, justifying weaker disclosure limitation methods than were applied to 2010 Census public microdata. The framework used for 2020 Census publications defends against attacks that are based on reconstruction, as we also demonstrate here. Finally, we show that alternatives to the 2020 Census Disclosure Avoidance System with similar accuracy (enhanced swapping) also fail to protect confidentiality, and those that partially defend against reconstruction attacks (incomplete suppression implementations) destroy the primary statutory use case: data for redistricting all legislatures in the country in compliance with the 1965 Voting Rights Act.

Synthetic Census Data Generation via Multidimensional Multiset Sum

Synthetic Census Microdata Generation: A Comparative Study of Synthesis Methods Examining the Trade-Off Between Disclosure Risk and Utility

The 2010 Census Confidentiality Protections Failed, Here's How and Why

Confidentiality Protection in the 2020 US Census of Population and Housing

Escalation of Commitment: A Case Study of the United States Census Bureau Efforts to Implement Differential Privacy for the 2020 Decennial Census

Private Tabular Survey Data Products Through Synthetic Microdata Generation

The 2020 United States Decennial Census Is More Private Than You (Might) Think

Assessing Statistical Disclosure Risk for Differentially Private, Hierarchical Count Data, with Application to the 2020 U.S. Decennial Census

GenSyn: A Multi-stage Framework for Generating Synthetic Microdata using Macro Data Sources

The Impact of the U.S. Census Disclosure Avoidance System on Redistricting and Voting Rights Analysis

Differential Privacy Protections in 2020 U.S. Decennial Census Data Do Not Impede Measurement of Racial and Ethnic Disparities

Differential Privacy in the 2020 Decennial Census and the Implications for Available Data Products

Privacy-Preserving Data Analysis for the Federal Statistical Agencies

"Minus-One" Data Prediction Generates Synthetic Census Data with Good Crosstabulation Fidelity

Bayesian Data Synthesis and Disclosure Risk Quantification: An Application to the Consumer Expenditure Surveys

Quantifying Privacy Risks of Public Statistics to Residents of Subsidized Housing

Multiply-Imputed Synthetic Data: Advice to the Imputer

PrivSyn: Differentially Private Data Synthesis

Releasing survey microdata with exact cluster locations and additional privacy safeguards

Impacts of Census Differential Privacy for Small-Area Disease Mapping to Monitor Health Inequities

30 Years of Synthetic Data