Privacy console
Where this idea comes from
Randomized response
In 1965 the statistician Stanley Warner described a way to ask a question people might lie about. Each person spins a spinner in private; it tells them to answer either the question or its opposite, and only they know which. The asker never learns any one person’s true answer, but over many answers the true rate can be worked out.
One thing to hold: A coin (or Warner’s spinner) that only the person answering can see.
Why it matters: The two-coin rule in the coin survey is a later, simpler form of the same idea, and it is now a standard first example of differential privacy: a true “yes” says yes three times in four, a true “no” one time in four, which is exactly ε = ln 3.
What we don’t know: People do not always follow the rule (some say “no” whatever the coin says), so real surveys using it can still be off; how much depends on the question and on whether people trust it.
Dates:
- 1965 Warner publishes randomized response.
- 2014 Dwork and Roth use the coin version as a first example of differential privacy.
A country chooses its ε
For the 2020 Census the US Census Bureau added carefully measured noise to the published tables, using differential privacy for the first time in a census. For the redistricting tables it set ε = 17.14 for people and ε = 2.47 for housing units: 19.61 in all. Some totals, such as each state’s population, were published exactly.
One thing to hold: A census block table: a few dozen people, broken down by age, race and household.
Why it matters: The Bureau had tried rebuilding individual records from its own 2010 tables and found that many could be matched to real people, so it argued that the old ways of hiding people were no longer enough. Choosing ε meant choosing, in public, how much accuracy to trade for privacy.
What we don’t know: People still disagree about the trade. Researchers and some states argued that the noise made counts for small towns, rural areas and small groups less accurate, which matters for maps and funding; the Bureau and others argued that without it people could be identified. There is no ε everyone agrees on.
Dates:
- 2021 The Bureau publishes its privacy budget for the redistricting tables.
- 2021 Researchers publish how the noise changes redistricting maps.
- 2022 The Bureau publishes how its method works, and critics publish theirs.