Data Swapping: A Risk-Utility Framework and Web Service Implementation

Data swapping makes it impossible for an intruder to be certain of having identified an individual or entity in the database, because no record is certain to be unaltered. At the same time, the data are distorted (joint distributions involving both swapped and unswapped attributes change), decreasing their utility for purposes such as statistical inference. Implementation of data swapping entails selection of swap attributes, the swap rate (fraction of records for which swapping occurs) and, possibly, constraints on unswapped attributes [3]. In our risk-utility framework, each candidate release is characterized by numerical values of disclosure risk and utility. See §5 for examples. A statistical agency would like to select a release that has both minimum risk and maximum utility, but ordinarily this is not possible: as shown in Figure 1, higher utility entails higher risk. Nevertheless, not all releases are sensible: any release dominates all other releases that have both lower utility and higher risk (which lie to its northwest in Figure 1), so that the choice should be made from the frontier (in economics, the efficient frontier) of undominated releases. Selection of a release on the frontier can be done by assessing the risk-utility balance subjectively or quantitatively, by means of an objective function that relates risk and utility. Figure 1 illustrates for a linear risk-utility tradeoff.