Suppression of directly-disclosive cells in frequency tables

Recent law changes in Norway have forced Statistics Norway to re-evaluate the use of SDC methods for protecting its publications. Previous distinctions regarding the sensitivity of variables are no longer included in the law. Instead, publications are required by law to ensure that no identifiable individual can have attributes directly or indirectly disclosed. Common heuristics (such as small count primary suppression) used in frequency table suppression do not directly target disclosure, but rather rely on established rule-of-thumb. Such methods can lead to the suppression of a large number of cells and simultaneously not provide adequate protection from disclosure. Motivated by risk measures within microdata, we discuss a new approach aimed directly at detecting those cells that can lead to disclosure in frequency tables. In this context we define the notion of direct disclosure: the scenario where an attacker, with full knowledge of themselves (or a coalition), can disclose attributes of specific individuals. Finally, we present an implementation where the above method for primary suppression is combined with an alternative method to secondary suppression which aims to guarantee no linear dependency between published and suppressed cells. The secondary suppression method is implemented using Gaussian elimination and shows promising results in practice, striking a balance between computational complexity and number of suppressed cells. The presented methods are available in the R package GaussSuppression. Suppression of Directly Disclosive Cells in Frequency Tables Daniel P. Lupp∗, Øyvind Langsrud∗∗ ∗ Statistics Norway, daniel.lupp@ssb.no ∗∗ Statistics Norway, oyvind.langsrud@ssb.no Abstract. Recent law changes in Norway have forced Statistics Norway to re-evaluate the use of SDC methods for protecting its publications. Previous distinctions regarding the sensitivity of variables are no longer included in the law. Instead, publications are required by law to ensure that no identifiable individual can have individual attributes directly or indirectly disclosed. Common heuristics (such as small count primary suppression) used in frequency table suppression do not directly target disclosure, but rather rely on established rule-of-thumb. Such methods can lead to the suppression of a large number of cells and simultaneously not provide adequate protection from disclosure. Motivated by risk measures within microdata, we discuss a new approach aimed directly at detecting those cells that can lead to disclosure in frequency tables. In this context we define the notion of direct disclosure: the scenario where an attacker, with full knowledge of themselves (or a coalition), can disclose attributes of specific individuals. Finally, we present an implementation where the above method for primary suppression is combined with an alternative method to secondary suppression which aims to guarantee no linear dependency between published and suppressed cells. The secondary suppression method is implemented using Gaussian elimination and shows promising results in practice, striking a balance between computational complexity and number of suppressed cells. The presented methods are available in the R package GaussSuppression. Recent law changes in Norway have forced Statistics Norway to re-evaluate the use of SDC methods for protecting its publications. Previous distinctions regarding the sensitivity of variables are no longer included in the law. Instead, publications are required by law to ensure that no identifiable individual can have individual attributes directly or indirectly disclosed. Common heuristics (such as small count primary suppression) used in frequency table suppression do not directly target disclosure, but rather rely on established rule-of-thumb. Such methods can lead to the suppression of a large number of cells and simultaneously not provide adequate protection from disclosure. Motivated by risk measures within microdata, we discuss a new approach aimed directly at detecting those cells that can lead to disclosure in frequency tables. In this context we define the notion of direct disclosure: the scenario where an attacker, with full knowledge of themselves (or a coalition), can disclose attributes of specific individuals. Finally, we present an implementation where the above method for primary suppression is combined with an alternative method to secondary suppression which aims to guarantee no linear dependency between published and suppressed cells. The secondary suppression method is implemented using Gaussian elimination and shows promising results in practice, striking a balance between computational complexity and number of suppressed cells. The presented methods are available in the R package GaussSuppression.