[HN Gopher] Privacy concerns are breaking the Census
       ___________________________________________________________________
        
       Privacy concerns are breaking the Census
        
       Author : bpodgursky
       Score  : 55 points
       Date   : 2022-01-26 14:50 UTC (8 hours ago)
        
 (HTM) web link (www.slowboring.com)
 (TXT) w3m dump (www.slowboring.com)
        
       | uoaei wrote:
       | Title should be "Census is broken because it does not handle
       | privacy concerns"
       | 
       | Yglesias once again looking at the right thing and getting
       | exactly the wrong conclusion out of it.
        
       | Claude_Shannon wrote:
       | We had obligatory census in Poland.
       | 
       | Truth be told, seeing the state of our governement, I fully
       | expect all of it to leak out sooner or later. :|
        
       | fitblipper wrote:
       | I hate the argument this blog uses. Just because your data is
       | available and abused through websites A, B, and C doesn't mean
       | you should add your private data to site D.
       | 
       | If I'm trying to avoid catching Covid-19 by limiting exposure but
       | have to go the the grocery story, the doctors, and the gas
       | station it doesn't mean I should also go to a music concert since
       | I'm already unable to avoid exposure.
        
         | 8note wrote:
         | i dont think thats a comparable case. the avaiable and abusd
         | would mean you caught and recovered from covid via the grocery
         | store, and youre avoiding future exposure from the music
         | concert while already immune
        
       | giaour wrote:
       | This was an extremely lazy article. It doesn't seem like Yglesias
       | made any effort to engage with the Census's rationale for using
       | differential privacy, with the Bureau's historic methods for
       | privacy preservation (e.g., "swapping," a different way to
       | deliberately introduce errors that has been in use in Census data
       | products for decades), or with what might have changed since 2010
       | that might justify a new approach to privacy. Even though
       | congress hasn't updated Title 13 in the past decade, there have
       | been significant advances in statistical methodology that reduced
       | or eliminated the effectiveness of the Bureau's previous methods
       | of privacy preservation.
        
       | phkahler wrote:
       | Its gerrymandering level 2.
        
       | ineedasername wrote:
       | Wow, if privacy is the concern then it makes a heck of a lot more
       | sense not to publish fine grained data. Keep it at the tract
       | level instead of block since those are more closely defined by
       | the population size living in them-- usually a few thousand.
       | 
       | Giving purposely bad data is much worse than no data.
        
       | jefftk wrote:
       | The language of "do not disclose the information reported by, or
       | on behalf of, any particular respondent" really does look to me
       | like it requires Differential Privacy. Otherwise the different
       | aggregations will reveal information for some participants.
       | 
       | It's unfortunate that this means the Census isn't accurately
       | presenting information needed for fair representation, but I
       | don't think this is something that can be fixed by attempting to
       | shame the Census for putting out "inaccurate information"?
        
       | fuckcensorship wrote:
       | I have similar hesitations about registering to vote in my state
       | (North Carolina) because it makes voter record data available to
       | "Any person upon request and for a fee. Free lists are provided
       | upon request to political parties." [1]. My name, address, etc.
       | ended up on dozens of sketchy websites after registering to vote
       | previously. Privacy conscious legislation can't come soon enough.
       | 
       | [1]: https://www.ncsl.org/research/elections-and-
       | campaigns/access...
        
         | arcbyte wrote:
         | If the government knows it, the same data should be available
         | to all citizens. Traffic camera feeds, voter data, medicare
         | claims, everything. With minor, very narrow restrictions for
         | the very latest military secrets.
        
           | thebean11 wrote:
           | You don't see any practical issues with that approach..? Do
           | you know how much personal information is in a medicare
           | claim?
        
           | katbyte wrote:
           | I see you've never been stalked harassed threatened or dealt
           | with people trying to make your life hell.
        
             | skeptical2 wrote:
             | The government goons are some of the worst stalkers and
             | harassers, which is exactly why they should never be
             | allowed to collect this data in the first place. Our
             | Founders understood this, but unfortunately, humans
             | generally never learn anything from history.
        
               | mehlmao wrote:
               | The Constitution calls for a census (Enumeration) every
               | ten years. https://www.census.gov/history/pdf/Article_1_S
               | ection_2.pdf
        
               | skeptical2 wrote:
        
         | Tostino wrote:
         | Heh if you think that's bad check out FL
        
         | throwaway9980 wrote:
         | I feel the same way about donating to political campaigns. It's
         | just not worth it considering that that information is then
         | public record and could be used against you in all sorts of
         | ways. Perhaps I will feel different when I'm older and of I've
         | enough money that I no longer need to worry about damaging my
         | job prospects.
         | 
         | Maybe it would make it ok to donate if you also found a likable
         | person on the other side to give money to at the same time.
        
           | brimble wrote:
           | I'm like this with magazine subscriptions. Seeing my junkmail
           | double after subscribing to one not-cheap literary quarterly
           | was enough to convince me never to subscribe to any sort of
           | periodical again. God knows who else they sold my info to.
        
         | Mountain_Skies wrote:
         | When I updated my address for voter registration a couple of
         | years ago, I noticed my phone number was wrong so I updated it
         | too. Huge mistake. I rarely received spam texts or telemarketer
         | calls and now I receive both constantly. It started just a
         | couple of months after the change. Even without those two
         | annoyances, the political spam texts are nightmarish. They're
         | basically DDOS attacks because the lists are distributed to
         | large numbers of volunteers using their own phones to send out
         | texts. It doesn't matter how many numbers you block, the next
         | day there are dozens more text from dozens of other numbers.
         | And since they're political campaign texts, they are legal due
         | to the exemption politicians gave themselves to the anti-spam
         | laws. Right now we're in a lull between elections so the number
         | of political texts is small but as we get close to the
         | midterms, it will become an all day affair. In 2020 it peaked
         | at over 80 political texts in a single day. Not sure why they
         | think this is effective in making anyone like them but they
         | keep at it.
        
           | MerelyMortal wrote:
           | > Not sure why they think this is effective in making anyone
           | like them but they keep at it.
           | 
           | It could be the other party trying to make you hate their
           | opponent (a "False Flag" operation).
        
         | mateo1 wrote:
         | Some data have to be public for them to be audited by multiple
         | independent parties. It is absolutely necessary for democracy
         | to function. I don't see what harm can be done by someone
         | knowing your name and address.
        
           | Ayyninymous223 wrote:
        
           | [deleted]
        
       | cpwright wrote:
       | If the census simply enumerated the population, then I don't
       | think there are the same level of concerns.
       | 
       | The data they are collecting related to demographics is beyond
       | what is necessary for congressional apportionment. If they
       | collected only the required data; then there would not be a need
       | to fuzz it.
        
       | gruez wrote:
       | >Private companies are already scrutinizing your purchase
       | patterns to determine that you are pregnant and then potentially
       | getting in hot water for notifying relatives you haven't actually
       | informed.
       | 
       | >Given that baseline reality, compromising the usefulness of
       | Census data for the sake of minimal privacy gains seems really
       | bad.
       | 
       | The difference is that you can opt out of various companies
       | collecting data. Can you opt out of the census? With this sort of
       | argument, you can basically justify any sort of government
       | privacy intrusion because private companies are already doing it,
       | so "compromising the usefulness of NSA surveillance data for the
       | sake of minimal privacy gains seems really bad". You do want to
       | stop terrorists and pedophiles, don't you?
        
         | viscountchocula wrote:
         | I think you're significantly overestimating the practical
         | ability to opt out of commercial collection. Governmental and
         | commercial collection seem equally non-opt-outable to me.
        
         | nobody9999 wrote:
         | >The difference is that you can opt out of various companies
         | collecting data. Can you opt out of the census?
         | 
         | I'm going to assume that this isn't a rhetorical question.
         | 
         | Yes. Just don't fill out the form. And if the Census folks send
         | folks to your house, you can pretend not to be home, politely
         | ask them to leave, or in states that allow it, shoot such
         | trespassers _dead_.
         | 
         | In fact, I'd prefer it if those who live in areas that
         | consistently elect folks from $PARTY whose platform is _more
         | disagreeable_ to me do exactly that.
         | 
         | That way, when congressional districts are redrawn, the $PARTY
         | that annoys me more will have a harder time getting elected.
         | Redistricting is, after all, the _primary_ purpose of the
         | Census.
         | 
         | Edit: Less is more.
        
           | gruez wrote:
           | >Yes. Just don't fill out the form. And if the Census folks
           | send folks to your house, you can pretend not to be home,
           | politely ask them to leave, or in states that allow it, shoot
           | such trespassers dead.
           | 
           | Just like paying taxes is optional because all you have to do
           | is not send money to the IRS, and if they come you shoot them
           | dead?
           | 
           | >The participation of every citizen in the United States
           | Census of 2020 was mandatory by the law by Article I, Section
           | 2 of the American constitution. Census is carried out in the
           | U.S. every ten years to count the correct population in the
           | country. The figures obtained in the 2020 Census were
           | particularly helpful in determining congressional
           | representation and community funding.
        
       | teddyh wrote:
       | I would certainly rather they erred on the side of privacy. If
       | the data cannot be released without compromising privacy, I would
       | rather it not be released at all.
        
         | djbebs wrote:
         | You mean collected.
        
         | jeffbee wrote:
         | Definition of privacy derangement syndrome, right there.
         | 
         | This is superficial "privacy" which affords no marginal
         | improvement in your actual privacy but does concretely break
         | the Census.
        
           | bigyellow wrote:
           | Where is that definition from? I couldn't find it in DSM-5.
           | 
           | Also, why is the Census (or any collective action) more
           | important than an individual's subjective view of privacy (or
           | any private thought)?
        
             | DiggyJohnson wrote:
             | > Where is that definition from? I couldn't find it in
             | DSM-5.
             | 
             | The term defines itself. I assume you understand what is
             | meant by Privacy Derangement Syndrome, something like:
             | valuing privacy above all other virtues. For example,
             | somebody who refuses to use a mobile phone due to iOS
             | privacy concerns, and falls out of touch with family and
             | friends.
             | 
             | But I don't even really appreciate this point even as a
             | joke. The idea that every possible mental malady is
             | constrained and gatekept by a single book seems entirely
             | too rigid.
             | 
             | The subjective view of privacy has some value, I'll grant
             | that, but so to does a municipality preparing to lay
             | infrastructure to support a growing population. When it
             | comes to tangible value, the census is one of the most
             | well-known value-adding resources I can think of.
             | 
             | I almost never argue against privacy, and policies and
             | measures protecting individual privacy. But the US census
             | is value-adding for research, policy, and individual
             | purposes, let there be no doubt.
        
               | skeptical2 wrote:
        
             | skeptical2 wrote:
        
         | bpodgursky wrote:
         | The point is that there is no meaningful gain in privacy, and
         | it comes at the cost of crippling important research.
        
           | artificialLimbs wrote:
        
             | DiggyJohnson wrote:
             | Do you think infrastructure planning is important?
        
             | bpodgursky wrote:
             | I mean, if you don't like the research, it also directly
             | directly impacts voting representation and where federal
             | grant money is distributed, to target the intended
             | demographics and population. Basing either of those on
             | random noise is very very bad.
        
       | throwaway058527 wrote:
        
       | parkingrift wrote:
       | Can someone explain to me why we need the census at all? Why are
       | we actively pretending that the federal government doesn't have
       | precise estimates for where people live?
        
         | brimble wrote:
         | The way we live in a complete surveillance state _except_ when
         | it would in any way provide convenience, at which point we have
         | to pretend we don 't, is something I find irritating on a
         | pretty regular basis.
        
         | pueblito wrote:
         | It's a constitutional requirement, Article 1 section 2
        
         | spicyusername wrote:
         | > have precise estimates for where people live?
         | 
         | The census is how they have that estimate...
        
       | kodah wrote:
       | > unless you are a weirdo living off the grid, basic Census-style
       | information about where you live, your age, marital status, and
       | race and gender identities is widely available to commercial
       | actors.
       | 
       | Being able to doxx with PII was shown to be able to be done in
       | the suburbs, so this is more accurately phrased as "anyone in
       | low-density suburbs and below are at-risk." If the author doesn't
       | care about that, then just say it. There's many deanonymization
       | attacks, and this is just one, but it showcases just how little
       | is required _with an actual dataset_ :
       | https://www.cs.utexas.edu/~shmat/shmat_oak08netflix.pdf
       | 
       | The authors basic argument can be summarized as, "Well, companies
       | already list all your personal data, or just flat out abuse it.
       | So, let the government also list your personal data so we can
       | make congressional seats as accurate as possible." Congressional
       | seats being affected by census data scrubbing is not good, it
       | should be fixed, but open data _to the public_ that can be
       | enumerated and deanonymized isn 't a good thing either.
       | 
       | If the census can't be anonymized, or is rolled back then I
       | imagine we'll have to start warning people about participating in
       | the census. The irony at that point is your census data also
       | won't be accurate because of a lack of participation.
        
         | SpicyLemonZest wrote:
         | The author doesn't care about that and says it pretty clearly.
         | He doesn't (and I don't) think that it makes sense to think in
         | terms of "deanonymization attacks" here, since your legal name,
         | address, and basic demographic information are already semi-
         | publicly linked together in a large variety of ways. Is it
         | deanonymization if I go to the county registrar and pull the
         | deed for someone's house?
        
           | kodah wrote:
           | I fixed the link, sorry about that.
           | 
           | You can deanonymize block level data and the study shows as
           | much. You just need to have _some amount_ of information that
           | is either unique or low enough in distribution.
           | 
           | There's a tutorial on Twitter if you'd like to follow: https:
           | //mobile.twitter.com/john_abowd/status/111494218027827...
        
             | SpicyLemonZest wrote:
             | I see. You're right, I misunderstood what the attack vector
             | is supposed to be here.
        
           | giaour wrote:
           | The census contains some data that commercial databases are
           | legally prohibited from holding (e.g., info about children
           | within a household).
           | 
           | The deanonymization/reidentification attacks rely on joining
           | census data against commercial datasets to produce something
           | beyond what either contains. It's not accurate to say this
           | information is already semi-public, because a good deal of it
           | is not.
        
       | tharne wrote:
       | The Census has really lost the thread. The original mission was
       | simply to do a headcount to determine how many representatives
       | and electoral votes each state was entitled to.
       | 
       | One thing that annoyed me in particular was their creepy
       | obsession around race. Even once you answer, "White", there are
       | several more questions aimed at determining precisely what
       | subcategory of white person you are.
       | 
       | If anyone at the census is listening, here's some advice. If you
       | only get to ask Americans a handful of question once every ten
       | years, don't waste half of them trying to figure out someone's 50
       | shades of whiteness.
        
         | ironman1478 wrote:
         | This is important for understanding how gerrymandered a
         | district is.
        
           | tharne wrote:
           | > This is important for understanding how gerrymandered a
           | district is.
           | 
           | That's a bit circular. One of the main reasons that districts
           | are so easy to gerrymander is precisely because there is so
           | much rich census data that can be used to predict voting
           | patterns.
        
             | brimble wrote:
             | Parties and campaigns already buy & maintain huge private
             | databases on this stuff. They wouldn't hesitate to buy
             | slightly more to have that info, because gerrymandering is
             | so powerful.
             | 
             | Watchdogs and groups trying to fight gerrymandering
             | (racially-tilted or otherwise) usually don't have as many
             | resources. It's harder for the public to keep an eye on
             | this without public data, while keeping it private-only
             | barely inconveniences the most relevant bad actors.
        
             | dredmorbius wrote:
             | The issue is specifically gerrymandering on the basis of
             | race.
             | 
             | Parties know their votes by precinct, those data are
             | available.
             | 
             | Apportionment of voting districts must be done by
             | _population_ , so the Census is necessary. Discrimination
             | on the basis of race violates multiple Constitutional
             | amendments and voting laws, for which _enforcement_
             | requires clear knowledge of demographics.
             | 
             | The justirications are somewhat involved, but not strictly
             | circular.
             | 
             | For a discussion of the background, from a conservative
             | viewpoint, see: "Redistricting, Race, and the Voting Rights
             | Act" (2010). This touches on the question multiple times,
             | this passage captures much of the circumstance, though I
             | recommend reading the full piece:
             | 
             |  _[T]he South 's swift and effective circumvention of the
             | Voting Rights Act in the wake of its passage demonstrated
             | the truth of what many civil-rights activists had argued:
             | that merely providing access to the ballot was insufficient
             | after centuries of slavery, another century of segregation,
             | ongoing white racism, and persistent resistance to black
             | political power. In the Deep South in 1969 (and beyond),
             | the alternative to de facto reserved legislative seats for
             | black candidates would have been the perpetuation of
             | whites-only politics._
             | 
             | https://www.nationalaffairs.com/publications/detail/redistr
             | i...
        
             | ironman1478 wrote:
             | Its probably possible to gerrymander a state without this
             | information? Sure, it would be harder (and probably less
             | effective) but you could use proxy metrics to figure out
             | the distribution of race within a state. I imagine I could
             | use housing data as a proxy for example, given that
             | property values are correlated with race. I don't have
             | exact proof of that last statement, but it feels right.
             | 
             | Also, I did some reading. Apparently the census has been
             | asking these questions since 1790
             | https://www.census.gov/acs/www/about/why-we-ask-each-
             | questio.... Though, I imagine the nature of the question
             | has changed over time.
        
             | bpodgursky wrote:
             | This isn't true, each voting precinct reports vote totals
             | each election.
             | 
             | Demographic info adds almost no predictive value over this.
        
           | caymanjim wrote:
           | That's not the purpose of the census, though. That's a
           | political and social concern, and people can debate the value
           | of that data and who should collect it, but it's not part of
           | the Constitutional mandate to count the number of people.
        
             | ironman1478 wrote:
             | https://www.census.gov/programs-surveys/decennial-
             | census/abo....
             | 
             | Unless I misunderstood your question and you meant to say
             | that the race portion specifically is not.
        
         | 8note wrote:
         | If you're going to count some Americans as less than a person
         | when determining the electoral votes based on their race,
         | you're going to have to know the race of the respondents.
         | Collecting race data is then part of the original mission
        
         | mullingitover wrote:
         | > One thing that annoyed me in particular was their creepy
         | obsession around race. Even once you answer, "White", there are
         | several more questions aimed at determining precisely what
         | subcategory of white person you are.
         | 
         | This isn't really on the census. This is just the census trying
         | to account for Americans' creepy obsession with race. Let's not
         | forget that for most of this country's history, your race was
         | _everything_.
        
         | nonameiguess wrote:
         | It's not actually up to the Census. They're following OMB
         | Directive 15 on race reporting standards for all federal data
         | collection. You can read it here:
         | https://www.govinfo.gov/content/pkg/FR-1997-10-30/pdf/97-286...
         | 
         | This is the latest version, but it was originally published in
         | 1977 and based on the idea that humanity consisted of only four
         | races. The reason it asks what "kind of white person" you are
         | is the 1997 update was in response to criticism that this
         | wasn't fine-grained enough, so they split Pacific Islander into
         | its own group and split white people into Hispanic and Non-
         | Hispanic. The idea of there only being four races in the world
         | comes from Carleton Coon's publications from the early 60s. He
         | had a theory that human races all evolved independently from
         | Homo erectus to Homo sapiens, in contrast to the more widely
         | accepted "out of Africa" theory, and that this accounts for why
         | some races, according to him, are "more civilized" than others.
         | That is, humans left Africa in a savage state and evolved into
         | sapiens form and developed civilization much earlier in Europe
         | and Asia, again, according to him.
         | 
         | I think it should be obvious why making a theory like this the
         | basis of US official federal standards for race is somewhat
         | controversial, but as we know, laws and regulations change
         | slowly, if ever, so the Census is kind of stuck defending work
         | they're legally charged with doing, and this data is used to
         | assess things like racial equity of federal spending and
         | assessment of the fair housing act and what not. It's kind of a
         | relic of our shitty history, but it's there.
        
         | willis936 wrote:
         | You're misrepresenting what a census is and why they are done
         | (yes, including historically since the US began and even
         | before).
         | 
         | You might not like the idea of being accounted for, but that
         | negates exactly zero benefit to society that census brings. How
         | can the rulemakers make informed decisions if they're blind?
        
           | overboard2 wrote:
           | By making less decisions
        
             | willis936 wrote:
             | I appreciate the honesty. Fallaciously pushing an issue for
             | dishonest reasons damages representation in politics.
             | 
             | If you dislike the census because you hate big gov't then
             | it should be left there, even if you know it's not a
             | popular opinion.
        
       | HedgingPointer wrote:
       | It seems as thought this author has never read any materials on
       | inference control...
       | 
       | Ross Anderson's Security Engineering Chapter 9 is all about this
       | https://www.cl.cam.ac.uk/~rja14/Papers/SEv2-c09.pdf (Anderson
       | releases the textbook free online)
       | 
       | This is a fairly well developed field (i.e., in medicine there
       | highly screened "Medical Statisticians" who give data to research
       | groups only after it's properly anonymized. They know beforehand
       | what the researchers are interested in, and introduce noise that
       | effects all the measures _except_ the ones the researchers said
       | they were interested in looking at beforehand.
       | 
       | > The idea behind the differential privacy strategy, as I
       | understand it, is that you can basically introduce statistical
       | noise into the block-level results in a way that will make it
       | impossible to reverse-engineer the demographic profile of people
       | who live at specific addresses.
       | 
       | >This has, I think, roughly zero real-world privacy value
       | 
       | This was painful to read...
        
         | bpodgursky wrote:
         | There is an enormous practical difference between allowing
         | inference of medical conditions (PHI deidentification) and
         | allowing in edge cases the inference of information that is
         | already available in public voter registration rolls.
        
           | giaour wrote:
           | > allowing in edge cases the inference of information that is
           | already available in public voter registration rolls.
           | 
           | This is a really inaccurate way to characterize what
           | researchers were able to obtain from reidentification attacks
           | on block-level data from the 2010 census:
           | https://www.science.org/content/article/can-set-equations-
           | ke...
        
         | droidist2 wrote:
         | > They know beforehand what the researchers are interested in,
         | and introduce noise that effects all the measures _except_ the
         | ones the researchers said they were interested in looking at
         | beforehand.
         | 
         | Isn't there a danger in the census statisticians doing the same
         | thing? That they'll introduce noise that affects looking at the
         | data in ways that they didn't anticipate or allow for. Or even
         | that hinders drawing conclusions that go against current dogma.
        
       | mindslight wrote:
       | First, the article would read much better without a pejorative
       | outgroup reference of " _weirdo living off the grid_ ",
       | especially in its opening paragraph!
       | 
       | In general we would have to be much less guarded about the
       | collection of personal information if we had laws prohibiting its
       | harmful use ala the GDPR. Presently, anything that is collected
       | becomes fair game for the advertising-surveillance industry's
       | monetization, manipulation, and indefinite storage. So an entity
       | with a bona fide use for personal information (eg The Census)
       | cannot be trusted because resisting collection of such data is
       | currently the only way to prevent yourself from being abused. And
       | while I agree practically the Census isn't really collecting much
       | data that the surveillance industry doesn't already have, this
       | dynamic still informs societal norms.
        
       | aaron695 wrote:
        
       ___________________________________________________________________
       (page generated 2022-01-26 23:01 UTC)