Estimation of Disclosure Risk and Statistical Methods for Disclosure Limitations

最近研究人员和决策者对微观数据的需求激增，特别是当数据收集是由公共资金支付时，增加了对保密保护的关注。 对答复保密是数据收集机构对研究参与者作出的一项严肃承诺。任何向研究人员和决策者传播数据的机构都应作出类似的承诺。沿着对微观数据的需求增加，一些载有姓名、地址和人口信息等识别信息的商业数据库也可供使用。这些数据库引起了人们的关注，即入侵者可能会将数据收集机构发布的供公众使用的匿名调查数据与商业数据库联系起来，以确定一个或多个调查受访者的身份。本研究计划有三个主要目的：（1）评估 本报告使用了四个试验台国家概率调查的数据，涵盖了各种各样的主题。风险将使用两大类入侵者模型来解决。第一类是入侵者知道一个人在调查中，而入侵者本人也认识此人;第二类是入侵者能够进入载有姓名和地址的外部数据库，试图查明调查中的答复者，从而获得机密资料;（2）开发和评估避免披露的新方法，（3）制定公共变量替换策略-使用被认为会增加披露风险的数据集，因为汇总变量允许用户在不知道其实际值的情况下调整或控制这些变量。

The recent explosion in demands for microdata from researchers and policy makers, especially when the data collection is paid for with public funds, has increased concerns about confidentiality protection. Confidentiality of responses is a serious commitment made by data-collecting agencies to participants in the study. A similar commitment is expected of any agency that disseminates the data to researchers and policy makers. Along with the increased demands for microdata, a number of commercial databases with the identifying information such as names and addresses and demographic information have also become accessible. These databases raise the concern that an intruder can potentially link the anonymous survey data released by the data collection agencies for public use with the commercial databases to identify one or more respondents to the survey. This research proposal has three primary objectives: (1) To assess the risk of disclosure using data from four test-bed national probability surveys covering a wide variety of topics. The risk will be addressed using two broad classes of intruder models. Type I, where an individual, personally known to the intruder, is known by the intruder to be in the survey; and Type II, where an intruder with access to an external database with names and addresses is seeking to identify respondents in the survey and hence gain access to confidential information; (2) To develop and evaluate new methods to avoid disclosure, and (3) To develop strategies for replacing variables in public-use data sets deemed to increase the risk of disclosure by summary variables that allow users to adjust or control for these variables without knowing their actual values.