Security of statistical databases

Abstract

Statistical evaluation of databases which contain personal records may entail risks for the confidentiality of the individual records. The risk has increased with the availability of flexible interactive evaluation programs which permit the use of trackers, the most dangerous class of snooping tools known. A class of trackers, called union trackers, is described. They permit reconstruction of the entire database without supplementary knowledge and include the general tracker recently described as a special case. For many real statistical databases the overwhelming majority of definable sets of records will form trackers. For such databases a random search for a tracker is likely to succeed rapidly. Individual trackers are redefined and counted and their cardinalities are investigated. If there are n records in the database, then most individual trackers employ innocent cardinalities near n /3, making them difficult to detect. Disclosure with trackers usually requires little effort per retrieved data element.