US bans differential privacy in Census data(desfontain.es) |
US bans differential privacy in Census data(desfontain.es) |
Fundamentally this is public data. If it's to dangerous to make public, it's too dangerous to collect, and people should be aware of exactly what it is.
There are very few things that the state has data on that should not be made public. Census data is simply not one of those things.
publishing should be the default for any data, and to keep it unpublished should require substantially good reasons that impact the country as a whole. Frankly, if it isn't detailed national defence plans, i struggle to see any data that should not be public.
The biggest challenge with running a census is getting people to trust you enough to answer your questions.
A lot of census questions are sensitive. The ACS covers topics like citizenship status, disabilities, income, SNAP assistance, languages spoken at home.
If you want accurate information about the people who live in your country you need the census process to feel as safe for people to respond to as possible.
Are you saying the census shouldn't collect any data that people wouldn't be comfortable publishing? Because that's a recipe for a census that is far less useful for helping the country make useful decisions.
I'll say that. The state representatives should provide congress and the president any data needed to inform policy decisions about the people they represent. And as others have pointed out, other departments and agencies (such as the IRS) have most of the rest of the data required to make policy decisions.
Except for gerrymandering purposes, I fail to see why income, party affiliations, etc., is useful for the purpose the census was created for.
I don't understand why the census would include SNAP data or income: surely the government already has that information. I have never doubted that the IRS knows my income better than I do. Maybe better use of existing datasets could restrict the census to less invasive questions.
I don't trust the Census Bureau with my data, so if this is as "dangerous" as the author and some people here seem to think, they shouldn't be collecting it in the first place.
2. Without noise injection it's rather simple to do statistical attacks to reverse engineer individual entities.
3. This data is and has already been used in the past to undermine democratic systems by targeting and disenfranchising minorities, as well as gerrymandering the US to hell.
4. "Too dangerous to make public, too dangerous to collect" - this is a false dichotomy. To govern effectively you need sensitive data, but it should be collected and used in a way that's safe for the individuals.
5. Macro level aggregates don't need individual exposure, that's why noise, anonymization and statistical functions are fine.
They do. After a substantial delay. Pretty handy for geneological research, while protecting privacy for the living.
But the devil is in the details. If we don't want advertisers constructing semi-complete profiles from simple web interactions then why would we publish 330 million census questionnaires for their use?
But we do. A detailed census is essential for making good policy. For example, knowing the age and distribution of children across the country helps local and state governments decide where to put the next school or children's hospital. The federal govt. allocates funds for education and daycare accordingly.
The census is the best and most important measure of govt. policy. Taking it away would leave everyone worse off.
> The actual Enumeration shall be made within three Years after the first Meeting of the Congress of the United States, and within every subsequent Term of ten Years, in such Manner as they shall by Law direct.
The key thing you're missing is "in such Manner as they shall by Law direct".
Congress has passed a whole bunch of laws that attach additional responsibilities to the census for the purpose of supporting government decisions.
The Permanent Census Office Act of 1902 for example, which established the census office and tacked on "an annual survey of cotton production, and other economic censuses" https://www.census.gov/about/history/historical-censuses-and...
Detailed census records are published 72 years after they were collected; the last release (of 1950 census data) came out in 2022; the next one should be published in 2032.
https://prologue.blogs.archives.gov/2022/01/20/census-record...
TBH I don't think the people who wrote this knew how much collateral impact it would have.
https://www.census.gov/topics/public-sector/voting/about/faq...
> the CPS Voting and Registration Supplement does not ask any questions of a partisan nature.
There are laws in place forbidding government agencies from merging together datasets.
The last thing people should support is creating of profiles of individuals by combining data from different government agencies. This is why the census is so important as a data collection mechanism.
This is an excellent point. In my opinion, such laws are a good idea. Most of the time, policy decisions should not require IRS data. (Or other personal data.)
But to get around such laws, the government asks citizens to provide that data a second time (in the census). And sometimes it's asked yet again on other forms. This seems to defeat the purpose of those laws.
I can see that federal disaster aid might need to know if some area needs more or less aid, depending on the wealth of the area receiving aid. If aid is given to individuals, the have a need to know the individuals' income.
When there is a reasonable need to know, I would prefer the government use the much more accurate IRS data, rather than ask for people's income multiple times. The laws preventing merging federal datasets could be rethought, given what is now known about preserving privacy mathematically. I would like to see specific exemptions made, with the provided data properly anonymized to preserve privacy while serving the legitimate purpose for which the data was requested. The use of such data should require a request to congress for it.
This works by the same principle as how nobody ever drives faster than the speed limit.
As someone who got an ACS survey not long ago and had no interest in completing it, it certainly appears to be.
The government is the primary and arguably only source of the danger, and they already have most of the data whether you answer the ACS correctly or not.
It’s a census: it just asks questions.
If you start publishing and weaponizing the data against people with various attributes, they’ll just lie or not answer. And then you are left with worse than nothing: bad data people try to act on.
The real push for this now is to form lists of people to disenfranchise.
You think the census is what the government would use to mass identify and imprison people, not the NSA database(s)?
You think homeland security, or the FBI, or any other alphabet agency doesn't already have access to a giant list of people?
Think about what meta knows about everyone, or Google. You do realize that the US gov has read access to their core databases right?
"The census" has absolutely no bearing on any of that which you're worried about.
It's just shocking the level of ignorance that gets upvoted in the comments here now.
First they came for…
Knowing the racial, ethnic and socioeconomic background of the residents of a single building block is only useful to discriminate against them.
Extremists or in general any fraction willing to engage in systematic discrimination, harassment, terrorizing or similar love highly detailed non anonymized census data.
Why?
Because it gives them the perfect layout for which areas to harass (areas likely to yield), which to brutalize (areas unlikely to yield or from especially "hated" people), which to best not touch which (areas with too much influence/money or likely to contain hidden sympathizers), which to systematically take apart through other means like building a highway through them (e.g. "hated" communities to strong/connected to brutalize). etc. etc.
All of this has a lot of history weather it's from right extremists like fascists or left extremists(1).
At which point the question is, if the data you collect is that abuseable. Should you even collect it? Is it even really needed?
(1): Like actual left extremists, the a lot of US sources have the habit to label people as left extremists which by EU standards sometimes aren't even left (but centrist) and very far away from extremism...
The Harper government actively worked on destroying the efficacy of the Canadian census, to make it more difficult for subsequent governments to make data-driven decisions.
In addition to the obvious goal of making it easier to identify and target homosexuals, trans people, minorities, immigrants, it's quite possible that this is one of the objectives of the Republican party.
Something about this conversation is fundamentally broken if there's no space to iterate towards optimization and instead it's just swinging between maximalist extremes.
Thats what dutch and french bureaucrats thought until 1940.
You really, really don't want a government who can build a unified profile on you in that way.
The comments that this rather expensive endeavour should just be about getting a head count are also amusing to me. The data collected was such an important baseline of common understanding, and this will not be a good thing for its future quality. I've grown very jaded now seeing all the things taken for granted in this country and lost or degraded recently with a whimper.
*: To be fair, they sent me specifically to places that didn't respond, so I was naturally led to believe that everyone in my region hated the government, ignored bizzarrely threatening fliers, or had recently moved and had no knowledge of the inhabitants (if any) during the census period.
"What is your religious affiliation". Seems perfectly innocuous, but turned out to be retroactively fatal if your answer could be attributed to you by a certain foreign occupier in the 1940s .
Differential privacy is absolutely necessary, and the social scientists being unable to reconstruct the data at an individual level is intended. A macroscopic description is rather enough for most purposes, and anything more is asking for a surveillance state.
That frankly sounds more like a failure of enforcement, on top of a failure of the construction of the financial system. Here in Germany, it is absolutely not a common thing that mortgages or the banks holding them get sold like a hot potato towards some other sucker, and thus such a letter would cause immediate suspicion.
I think a large amount of the US’s success is the result of good institutions handling granular data. Policies can be adjusted to match outcomes more rapidly than otherwise.
I understand why people decide to diminish all state capacity - they feel that governments are populated by their opponents who will use state capacity against them. But as our relative strength wanes, our ability to overcome these forces of inertia does as well. And then our governments become less capable and eventually life starts getting worse.
We don’t need house-level data immediately (except perhaps in order to place census blocks within their appropriate congressional district etc). But there are aggregation units above which we should be using as good information as we possibly could be.
Intentionally damaging infrastructure is the recurring theme of this administration.
I don't know what the political undertones are here, but at some level you need to have actual ground truth, including "this person/household declined".
Publishing raw data though? That seems like shooting yourself in the foot from a national security perspective, not to mention all the other reasons not to do it.
It is introduced in the public data, not the secret data.
Or it's saying that one of these conflicting goals is more valuable than the other, and so shouldn't be sacrificed for it.
Seems like something that could be abused to achieve political objectives.
> The census bureau decided to adopt differential privacy for the 2020 Census
and:
> The consequences will be dire for utility or for privacy, and possibly both. It's hard to understate this point: future statistical releases will either be useless compared to past ones, or they will be incredibly unsafe
so we took the census for centuries before this point, and it was “ok.” and for the last census only we added some privacy items. but if we remove just one of those filters, we are in “dire” circumstances? but there were no privacy features before. so we’re actually still much better off than we were for hundreds of years before this.
this makes it feel like an emotional overblown problem
It must therefore be maximally transparent. Do you want president Trump or palantir to decide on the "noise infusion" algorithm?
Eg via some app that instructs respondents to enter a specific answer in a pseudorandomly chosen question.
Of course security would be another question.
Do. The American Census Survey (randomly-selected long-form questionairre) is dangerously overinvasive.
I was a big fan of differential privacy but now I think it might be doing more harm than good, as I haven't seen a single case where it was applied successfully in a problem where it actually mattered, and it contributed strongly to discrediting and preventing a lot of work on other anonymization techniques as it was deemed the only way to preserve privacy by the research community, so showing up with enhancements to k-anonymity or any other noise mechanism not rooted in it was a sure way to get ridiculed and ignored. And it's just not a practical mechanism, even when it works for a single disclosure you always end up having to blow up the privacy budget to a ridiculous amount in order to keep disclosing statistics as otherwise you would for almost all real-world data run out of budget after a few publications.
So, for me it's a technique that works in the areas where it doesn't really matter (publishing highly aggregated statistics that pose almost zero privacy risk even without differential privacy) and doesn't work in other areas where it would actually matter (publishing fine-grained data about individuals or small groups). There are some niche use cases but in my view the privacy community has really overblown the importance of differential privacy by portraying it as the only way to reliably anonymize data.
BTW the German census bureau has an interesting approach to anonymization which they use for several decades already and so far I haven't heard of any cases of successful de-anonymization of the data, maybe the US bureau should have a look at that for their own needs.
* I want to accurately report the finances of our company to the best of my ability.
* But that report would allow people to reconstruct private data about the terms of our contracts with various counterparties. I'd really like to avoid that, there's no rule that says we're supposed to release that data. In fact some of those contracts probably came with nondisclosure agreements!
* So here's what I'm going to do. I'm going to calculate our results to the best of my ability, and then I'm going to add random values to them and report only the randomized ones. Any reconstruction people try to do will be wrong because of the randomness.
* If the SEC says "no, you need to report your actual numbers", I will explain to them that there's no such thing as an actual number because all data is noisy.
I can't get behind it.
You can of course disagree about what what should actually be part of a transparent public record. (Though I suspect a lot of people post-date what was generally available in a "phone book.")
"...for the next 950 days"
because the next two years are going to become insanely miserable
https://www.statenews.org/government-politics/2026-06-12/ohi...
Representative Joyce Beatty is from Ohio and was instrumental in stopping Trump from illegally renaming the Kennedy Center.
https://www.theatlantic.com/culture/2026/06/kennedy-center-b...
Boy were the Germans happy to find these.
The American obsession with asking for people their perceived origins (AAPI, AA, Latino, ...) is more than weird: it's downright dangerous. Don't fucking ask these questions, and never, ever write it down, especially not with names.
Thankfully, now they can just buy it from data brokers and let Palantir target, so that makes life easier for them
https://www.census.gov/programs-surveys.html
The American Community Survey is the most well-known, as it replaced the “long form” sampling that had been an extension to the Census.
no person shall be compelled to disclose information relative to his religious beliefs or to membership in a religious body.
https://www.congress.gov/94/statute/STATUTE-90/STATUTE-90-Pg...
(Also, linkage. There are more data sources to cross reference now with the internet and social media and web tracking and hacks - the record footprint of Americans even as recently as the 70s and 80s was dramatically lower!)
Privacy issues that weren’t possible before due to cost are now pennies to exploit. Also keep in mind as it points out people were using census data to drive gerrymandering efforts, so these attacks are real and have been going on for a long time.
One notable thing we have today that we didn't have 100 years ago is a computer. Before, you could reasonably assume that recreating individual records wasn't feasible, at least not on a large scale. You can't assume that now. A 4 digit password was safe for hundreds of years, but it would be a security lability today for the same reason.
No it is not an overblown problem.
As the article says anytime you want to enforce privacy, the data becomes somewhat less useful, there is just no way around that.
The point of rights is that we have them and that they should not be trampled upon when they become slightly inconvenient to someone in power.
1: https://pmc.ncbi.nlm.nih.gov/articles/PMC8494446/?utm_source...
They weren't prepared for data that was obviously noisy. The data has always been inherently inaccurate, and folks just chose to ignore that previously
1: https://www.aeaweb.org/articles?id=10.1257%2Fpandp.20191107&... 2: https://www.science.org/doi/10.1126/sciadv.abk3283?utm_sourc... 3: https://www.nationalacademies.org/read/27150/chapter/14
then, make it so your answer is more valid than if they asked what you usually have for breakfast.
i guarantee you more gov actions can be positively impacted by the breakfast question than the religion one.
the ONLY use for religious data is to get it for free for campaigns.
How does knowing your religious affiliation help them with any of this?
Because making it esy to find all the rich people just seems like a very bad idea given the direction things are going.
When it was broad, the only thing you could do was locate, say, large minority groups. Blacks and latinos for instance. And even that led to problems. I can't imagine what will happen when we can drill down and tease out immigrants from citizens. Gay from straight. Rich from well to do. And so on.
> You think the census is what the government would use to mass identify and imprison people, not the NSA database(s)?
I think, and history shows, they would use the tools at their disposal.
Example: https://stateline.org/2026/01/20/ice-is-using-medicaid-data-...
Cell tower data, credit bureau integration, social media scraping, palantir, smart home device surveillance, DNA database exploitation, facial recognition networks, tax, payroll, passport, visa, medicare/medicaid, immigrations and customs databases and many more...
The census is a historical relic used to jerrymander congressional seats, and that's about it.
Eg
> Cell tower data
That's just going to get you a subscriber and device ID, unless you're talking about going deep packet inspection and parsing the contents of the packets. You could, but that's a lot of effort to get something the census can hand you for free.
> credit bureau integration
Notoriously unreliable and identities for the purpose of credit get stolen constantly. The easiest way to clean that is against known-good info, like the census.
> social media scraping
Half the profiles are fake, also not reliable data unless you clean it up. Again, census data makes it very easy to cut out profiles that don't match a real person.
> tax, payroll
These are probably fairly reliable, although they usually won't tell you about a person's demographics.
> passport, visa, medicare/medicaid, immigrations and customs databases
There's an enormous part of the population that won't appear in these at all. The huge part of the country that's "working poor" but not poor enough for Medicaid probably aren't traveling internationally. I wouldn't be surprised if half the country doesn't appear in any of these.
The census has value in that it contains a huge depth of information, is tied with your identity, citizens are compelled by law to answer so even the privacy folks have to respond and lying on it is a crime (enforcement is probably non-existent, though).
I'm sure that can all be reconstructed to some level of accuracy given sufficient effort, but that's a lot harder and requires a ton more coordination than "SELECT * FROM census_data WHERE ..."
I'm all for keeping all of this data private. But to think it isn't already available is a bit 'head in sand'. Maybe put laws in place for 'general' privacy across all data, before getting too inflamed about Census in particular.
Don’t forget there’s an entire industry that exists solely for this purpose.
https://www.census.gov/about/history/bureau-history/agency-h...
> Title 13 provides the following protections to individuals and businesses:
> Private information is never published. It is against the law to disclose or publish any private information that identifies an individual or business such, including names, addresses (including GPS coordinates), Social Security Numbers, and telephone numbers.
> The Census Bureau collects information to produce statistics. Personal information cannot be used against respondents by any government agency or court.
> Census Bureau employees are sworn to protect confidentiality. People sworn to uphold Title 13 are legally required to maintain the confidentiality of your data. Every person with access to your data is sworn for life to protect your information and understands that the penalties for violating this law are applicable for a lifetime. Violating the law is a serious federal crime. Anyone who violates this law will face severe penalties, including a federal prison sentence of up to five years, a fine of up to $250,000, or both.
Voting for the worse people makes things worse.
In a sense, this in itself is the issue. It's long-term _worse_ to vote for the "lesser of two serious evils". This extreme "long-term pain for short-term gain" attitude is what's gotten the US to where it is. If in 2016 of 2024 even 20% of the dems would've stayed home or voted third party, the DNC's continuous forcing of awful corpocrats with zero charisma would've become completely untenable and Trump would've been limited to one term. Yet instead they were rewarded for it, so you'll see Newsom get the candidacy and presidency in 2028 (if 2028 even happens at this point), and then in 2032 you'll get something like Hegseth or Thiel winning and it's all over.
There is an answer: relentlessly vote, but only for candidates who are actually slightly decent - including third-party - and otherwise stay at home. "Relentlessly" means "at every level", including locally from the very bottom, all the way up.
The whole idea of "third-party voting is a complete waste in the US" is incredibly dumb because a vote for someone who loses isn't a wasted vote. It shows the others that there's a voter there who can be convinced if catered to, if they select a better candidate. The powers that be have done a fantastic job of brainwashing the entire population of the myth that anyone who _doesn't_ go out and vote for either major candidate is a morally bankrupt person, because it directly benefits them.
The reply to this will be "well it's too late for that now!". It's wrong because the alternative doesn't help you one bit. You're just wishing for a miracle, that in 4 years something happens, kicking the can down the road making things worse long term. And that's actually what's got you here.
It's a symptom of the terminal disease which has infected all layers of American society and has gotten it to where it's at: short-termism. Everyone just looks at the next quarter, the next election. China's ascendency is 1:1 tied to doing the exact opposite. Some smartypants will now point "but zero Covid", great you found a potential exception, now look at the other 90% of policy.
Every time I've explained this I've gotten instantly downvoted without a single reply making an argument against it, because it's too painful for people to admit that they've been part of the road to where the US is at. And again, short-termism: rather feel the short-term tiny dopamine hit by slamming that downvote button than thinking about it. Let's see if this happens again.
Yes, but with a caveat, if you had a strong preference between the top two actually-likely-to-win candidates (assuming the third party wasn't competitive), it's at least not voting the most in your interests for the outcome. Which is why we really need approval voting, so we can actually vote for the candidates we like, rather than needing to "strategically" hold our noses.
But I agree with the rest of it, if none of the candidates represent you, the third-party vote at least allows you to send a signal of "I vote, but you need to make me want to vote for you, and this is what I want".
You mean the 2024 election cycle where incumbents all around the globe were beaten because the economic situation was strongly anti-incumbent? Are you positing that the US election was somehow a unique outlier and solely down to Harris being the Democrat candidate? Even though a swing of 115k votes would have handed the presidency to Harris instead?
It sounds like you have a particular issue with the 2016 and 2024 elections and I'm wondering if there's something in common that might explain it...
Ok I'll break it down for you.
> If in 2016 of 2024 even 20% of the dems would've stayed home or voted third party
Parties cater to their bases, and putting yourself out there as an unreliable voting bloc is exactly how you get your demands ignored.
> The whole idea of "third-party voting is a complete waste in the US" is incredibly dumb
It's not incredibly dumb, it's simple mathematical reality. This doesn't change unless the first past the post system changes. Why do you think the GOP backs the Green Party?
But in normal years candidates are successful because of the amount of money they can raise. The more they can raise the more brainwashing ads they can buy. The non so secret cabal is the donor class.
Anyone can run? You must meet requirements on age and how long you have lived in the US. You must pay fees and provide signatures for each state. If doing it through a party you have to meet their rules.
Cost to get on most states ballots at a basic level is a million. You could do it for free if you dont want to appear on any ballots.
"In May 2016, MSNBC's Mika Brzezinski accused the DNC of bias against the Sanders campaign and called on Wasserman Schultz to step down. Wasserman Schultz was upset at the negative media coverage of her actions, and she emailed the political director of NBC News, Chuck Todd, that such coverage of her "must stop". Describing the coverage as the "LAST straw", she ordered the DNC's communications director to call MSNBC president Phil Griffin to demand an apology from Brzezinski."
[1] - https://en.wikipedia.org/wiki/2016_Democratic_National_Commi...
Because it's dumb. People don't want to hear dumb ideas, or take the time to try and convince someone that would spend however long it took to type that, apparently multiple times, without realizing it. Throwing away votes will never be the reasonable thing to do. I know you don't want to hear that, because it's too painful for you to admit there's no simple answer.
Tried that in 2000, voting for Nader as a protest vote against Clinton/Gore third way neoliberalism. I did that in a state where the electoral votes for Dems were 100% safe. Still just got blamed for Bush and there was zero self-reflection on the part of the Democratic Party.
...
I would urge everyone to stop fixating on the Presidential vote as the only fight to win and everything being win/lose based on that outcome. If the Congressional Progressive Caucus in the House exceeds 50% of Democrats in the House, then we can start thinking about a world where e.g. AOC might be the speaker of the House rather than Nancy Pelosi.
> It's a symptom of the terminal disease which has infected all layers of American society and has gotten it to where it's at: short-termism. Everyone just looks at the next quarter, the next election.
Yeah, and the Office of the President is 4-8 years and is just more short-termism, along with individualism / cult of personality / CEO-leadership. If you want to make lasting change in the DNC, start by flipping more and more House seats to progressive from neoliberal.