A Framework and Decision Tool for Confidentiality Protection in Public Use Data

描述（由申请人提供）：公共使用的统计数据库提出了一个关键问题：如何在不泄露侵犯隐私、违反保密或危害国家安全的信息的情况下，使数据可供分析。鉴于获取数据对推进研究和制定政策至关重要，公共和私营部门的组织在这个保密问题上都有重大利益。然而，从数据中提取某些敏感信息的可能性可能危及这些组织的福利，并可能危及它们所处社会的福利。因此，挑战在于以一种允许对支持研究、决策和政策倡议进行准确分析的形式表示数据，同时防止不道德或恶意的一方利用数据产生有害后果。该项目的目标是开发一个实用的、基于计算机的框架，以评估、衡量和减轻公共使用数据的披露风险。我们提出的框架，称为OptShield，克服了目前部署的披露限制方法的缺点。我们通过将扰动和抑制方法与微数据级别敏感记录的最佳切换相结合来实现这一目标，以产生一种在保持数据完整性的同时保护机密性的方法。在第二阶段，我们建议继续进行算法和软件开发，以实现软件和服务的工作原型的目标。该软件将作为核心技术，为广大市场提供一种应用，在这个市场中，客户对保密有着重大的利害关系。我们最终计划在第三阶段提供的应用程序将包括三个阶段的方法来解决披露限制问题：(1)评估用户在组织数据发布和共享计划中固有的定性和定量披露风险；(2)衡量用户建议的数据产品的披露风险；(3)采用适当的限制披露技术保护用户数据。

DESCRIPTION (provided by applicant): Statistical databases for public use pose a critical problem: how to make the data available for analysis without disclosing information that would infringe on privacy, violate confidentiality, or endanger national security. Organizations in the public and private sectors have a major stake in this confidentiality protection problem, given the fact that access to data is essential for advancing research and formulating policy. Yet, the possibility of extracting certain sensitive elements of information from the data can jeopardize the welfare of these organizations and potentially, the welfare of the society in which they operate. The challenge is, therefore, to represent the data in a form that permits accurate analysis for supporting research, decision-making and policy initiatives, while preventing an unscrupulous or ill- intentioned party from exploiting the data for harmful consequences. The objective of this project is to develop a practical, computer-based framework for assessing, measuring, and mitigating disclosure risk in public use data. Our proposed framework, called OptShield, overcomes the disadvantages found in currently deployed disclosure limitation methods. We achieve this by combining perturbation and suppression methods with optimal switching of sensitive records at the micro-data level, to produce a method that protects confidentiality while preserving data integrity. In Phase II we are proposing to continue algorithmic and software development to achieve the objective of a working prototype of the software and service. This software will serve as the core technology to provide an application for a broad market in which customers have a major stake in confidentiality protection. The application we ultimately plan to offer in Phase III will consist of a three-phased approach to the disclosure limitation problem: (1) Assess a user's qualitative and quantitative disclosure risks inherent in the organization's data publishing and sharing plans; (2) Measure the disclosure risks in a user's proposed data products; and (3) Protect the user's data by applying the appropriate disclosure limitation techniques. PUBLIC HEALTH RELEVANCE: Public health organizations that collect and share sensitive data are apprehensive about the risk of inadvertently disclosing confidential information, given the fact that access to their data is essential for advancing research and formulating policy. Yet, the possibility of extracting certain vulnerable elements of information from the data, even after personal identifiers have been removed, can jeopardize the welfare of these organizations and potentially the welfare of the society in which they operate. Within the US Department of Health and Human Services, for example, preserving the confidentiality of records in order to continue to elicit information from the American people and from health care providers is "a matter of primary concern" (CDC/NCHS confidentiality guide). OptTek Systems, Inc. (OptTek) is developing a comprehensive framework designed to help public health and other organizations to avoid the disclosure of confidential information in public-use data. The application consists of a three-phased approach to the disclosure limitation problem: (1) Assess a user's qualitative and quantitative disclosure risks; (2) Measure the disclosure risks in a user's proposed data publishing and sharing plans; and (3) Protect the user's data by applying the appropriate disclosure limitation techniques.