223 Comments
User's avatar
JG's avatar

I have a paper about this exact topic due in two weeks as part of my MPP, and I cannot thank you enough for halving my research time. I'll be sure to cite you! :)

First Citizen's avatar

Am I missing something here? The US government still has all of the correct data. What they're doing with differential privacy is tweaking the numbers that they publicly release. No small town post office is going to get closed based on a population that seems to have been cut in half because the internal government data will show the true population! The second thing is that the census bureau has been doing this for decades, it's just that this year they're using the mathematically rigorous differential privacy rather than just winging it.

(See https://www.ncsl.org/research/redistricting/differential-privacy-for-census-data-explained.aspx)

Cascadian's avatar

The GPS system used to have something similar:

"In simple terms, GPS satellites currently issue two different sets of signals used for determining location: one for the U.S. military and its allies, dubbed the Precise Positioning Service, or PPS, and one for civilian use, dubbed Standard Positioning Service, or SPS. PPS actually comprises two signals and is encrypted, whereas SPS only uses one and is unencrypted; it was designed from the start to be less accurate than PPS. When GPS came about, the military — the GPS satellite fleet is maintained through the U.S. Air Force — didn’t want its own technology being used against it in a conflict, so it intended to make the civilian signal less accurate.

"Early on, however, SPS proved more accurate than was comfortable for the military, so it introduced Selective Availability (SA). SA degraded the accuracy of the civilian signal on a global basis by introducing intentional timing errors into the civilian signal.

"Back in 2000, the U.S. government decided to turn off SA indefinitely, which is one of the factors in the growing adoption of GPS technology in consumer electronics today. This latest pronouncement from Washington D.C. effectively makes the policy change with regard to SA a permanent one.

"The U.S. military says SA is no longer necessary, as it has a range of capabilities and technology to implement regional denial of service of civilian GPS signals when needed in the area of conflict — which is why it originally recommended doing away with SA back in 2000."

https://www.gpsworld.com/defensenewswhite-house-agrees-remove-selective-availability-3243/

Nate Meyer's avatar

The privacy thing is extremely annoying in the school context. LAUSD has a testing and symptom check app called Daily Pass. The symptom check is just a single box where you check ‘no’ so little value add. But for testing even though testing is through the school, they can’t just tell the teacher which student had a positive COVID test because privacy. Instead, every student has to deal with a crash prone app that led to huge lines to get into school.

Ryan's avatar

Has there been any meaningful analysis or discussion around the potential economic advantages nations may have relative to each other given their domestic privacy regulations?

I'm sympathetic to MY's point of view here, but I also need to better understand Differential Privacy better as discussed in the comments. I'm wondering if Western attitudes towards privacy, as evidenced by GDPR and recent pushback to Apple's Child Abuse tech, disadvantage these societies technologically relative to less privacy conscious nations such as China?

Wigan's avatar

Very interesting question - the laws are designed to protect individuals, not societies, whereas China's laws are designed to protect society (or at least the party). But design and effect are 2 different things.

Eric's avatar

My understanding of what we are trying to protect against is cases where someone is gay or transgender or makes a lot of money and discloses this on the Census form but doesn't want other people to know it and then someone in their neighborhood or wherever is able to figure it out by looking at Census aggregates and then can harass that person.

Wigan's avatar

Sure, something like that is the concern. But it wouldn't happen just randomly. The census bureau needed a "crack team of experts" to do their reconstruction attack. Someone would have to repeat that process and then post the data out there with a big database of "here are all the rich people in the US" or "here's all the people from Saudi Arabia" or something.

That seems quite far-fetched to me, especially considering that people move, pass away, etc. all the time and the census itself agrees that their estimates of residents are off by 5% or so in any region.

Wil's avatar

I work for the United States Postal Service, and I will say yes, mail volume has collapsed. Doesn’t matter the context or time period, mail volume keeps finding exciting new lows. Parcel volume, on the other hand, has exploded.

Alex's avatar

I am not authorized to speak on behalf of my employer, but I want to say all the big tech companies are working on differential privacy. I personally work on differential privacy at a big tech firm and I know people who do the same at every other big tech firm. The Census in this case is helping set an example.

Also, the idea of differential privacy is not really just that you just aggregate at higher levels to eliminate the noise. The shape of the introduced noise is disclosed. When you do statistical analysis, you always assume some noise in your data. When analyzing differentially-private datasets, you basically just include the noise as part of your model.

The other really nice thing about differential privacy is that it is quantifiable and provable. That's going to make it a lot easier to communicate about privacy, set standards, etc... In and of itself, the Census' adoption isn't going to make a huge difference. But it is contributing to an overall trend in the correct direction.

Jason Kerwin's avatar

Thank you for helping clarify the source of this movement—DP is being driven by tech bros and CS nerds.

However, of this is helpful for communication. It’s obviously much clearer for the census to say that they swap some characteristics in certain tables than it is for them to use arcane “noise injection” methods.

Eric's avatar

I also work at a big tech firm on differential privacy and my impression is that we make a big deal about it because if we don't, and something bad happens, which it has in the past and probably will again, everyone will be like "Well why didn't you do this one simple thing to prevent this from happening" and it is not an acceptable answer to say "Because actually nobody cares" which although it may be true does not appear from the perspective of elected officials or regulators to be the case.

Jason Kerwin's avatar

Are there elected officials who are actually demanding that the census bureau put out fake results? Or is this just an invention of obsessive CS bros?

Alex's avatar

The first differentially-private mechanism we know of was designed for social science surveys in the 1950s to study sensitive topics such as sexuality and crime. The formal definition of differential privacy we use is from a 2006 paper whose first author is Cynthia Dwork. Dismissing DP as the invention of tech bros is both the genetic fallacy and factually incorrect.

Jason Kerwin's avatar

I’m asserting that the *demand* is an invention of obsessive tech bros—which it is. No normal citizens or political leaders are demanding that you folks fuck up the census data and ruin the apportionment process. This is a solution in search of a problem, classic Silicon Valley.

Alex's avatar

The census bureau does not add noise to apportionment-related figures. Their mandate to use differential privacy explicitly prohibited them from doing that.

The census bureau is required by law to keep the information they collect confidential and that's why they are adopting this technique instead of using other techniques that do not maintain confidentiality. Maybe keeping the census data confidential is unimportant, but for now, it is actually legally mandated and dp is the best way to do it if they want to release useful information.

Michael's avatar

Apple already does use differential privacy for a lot of things. There’s a good chance Google and Facebook will start too. People are getting increasingly disturbed by tracking and are actually paying for VPNs, paid email, etc. So I’m not sure how long this public-private distinction will hold up.

Peter G's avatar

On a lighter subject than terrorism consider transportation planning. You know what is really useful to planning that? Knowing where you are coming from and where you are going door to door. And not just when you turn a turnstyle. If you want better public transportation stop being a paranoid idiot.

Kareem's avatar

2 observations:

(1) I wonder if this will lead to legal challenges by the kinds of communities that might lose representation or funding based on this data. It certainly seems to me like they could cite a cognizable claim, and I'm not sure what the Census Bureau's defense would be if it were redistricting-based. (I'm sure they'll have one, I just don't know what it is.)

(2) Something funny inspired by MY's experience with Spanish spam: My own internet usage is all in English, but ever since my SO (who also speaks Spanish) started coming to my apartment with any frequency, I get Spanish-language banner ads. Of course, I don't actually speak Spanish (I've just started to take lessons), so these ads are pretty useless. Just goes to show how targeting can backfire.

Lost Future's avatar

You're not using Adblock?

Kareem's avatar

Not worth it for me. The handful of ad-supported sites I visit regularly on my laptop either block you if you don't whitelist them or bug you about whitelisting them so much that it's just more convenient to just leave adblock off. I literally never pay attention to the ads unless they're weird (e.g. being in Spanish).

Also, banner ads aside, I also get YouTube ads in Spanish. Forgot to mention that (or more accurately, included that, revised my sentence, then hit "Comment" before realizing I had removed YouTube.)

Peter G's avatar

I have seen a lot of stupidity on this subject. Anybody remember how during the Obama years we had the terrible fears that the NSA would be preserving telephone billing records? Yep. They were going to know who was calling who and when forever. Big deal thinks I. That information is absolutely useless except forensically and it can only be accessed by a FISA warrant. I was quite comfortable being buried in a mass of information of stupendous size. I do not care if anyone in any government knows what my favorite pizza place might be. Forensically on the other hand it was a great idea to collect this information and preserve it.

Timothy McVeigh was caught within hours of committing a horrendous act of terrorism. How? Well the rear axle of the truck he rented and filled with explosives had a serial number on it. All part of quality control and product tracing every manufacturer does. Through GMs database that number was attached to a VIN number which led to the rental outfit that led to Tim. And it happened within minutes of knowing that axle number.

Now a stupendous pile of phone records or similar data is absolutely useless for finding anyone before they commit a criminal or terrorist act. But once they have done it then you are absolutely going to want to know who that person was talking to and probably for years. It was a great idea that enhanced everyone's security. Except for the paranoid for whom nothing is ever satisfactory.

Alex's avatar

> Anybody remember how during the Obama years we had the terrible fears that the NSA would be preserving telephone billing records? Yep. They were going to know who was calling who and when forever. Big deal thinks I. That information is absolutely useless except forensically and it can only be accessed by a FISA warrant.

They literally used that information to designate people as terrorists and kill them. Even if you think call logs don't provide any useful information, they certainly thought the information they had was enough to justify killing people. How do you know a future administration won't decide to play 7 Degrees of Terrorist Bacon and kill you? Or someone you care about? Or decide to play 7 Degrees of Political Opponent instead.

User's avatar
Comment deleted
Aug 16, 2021
Comment deleted
A.D.'s avatar

My recollection of some of these NSA metadata complaints were that the warrant protections were insufficient - some of these warrant requests were always rubber-stamped yes.

For things that should only be available "with a warrant", controlling warrant access appropriately seems like a good way to try and regulate privacy.

Tim O'Reilly's avatar

This is such an important message. I do wish this were one of your public posts, since I'd love to share it far and wide!

BD Anders's avatar

The problem with speed cameras is that we have speed limits for public safety purposes. By ticketing people after the fact, rather than stopping them in flagrante, you don't serve any public safety interest; speeders just keep speeding until they reach their destination.

Universal interlocks are a terrible idea. They aren't nearly as reliable or consistent as they need to be, and there's already a cottage industry devoted to scamming them.

Beyond the reasons cited by others here, car bricking is a terrible idea because it presupposes cops have accurate identifying information about the car they're chasing. Plates and VINs sometimes have multiple associations in law enforcement records.

Kenny Easwaran's avatar

The point of speed (and red light) cameras is that we know people respond best to incentives when those incentives come quickly and certainly. If the speed camera flashes when it sees you speeding, and sends you a small fine every single time you do it, then you learn not to speed, rather than it being a large fine only once every few hundred times you do it.

It's important to have the flash at the moment it happens so that it doesn't become something that happens to you a week later when you get a bill in the mail, but certainty is much more effective than a high cost at deterrence.

Police can then focus on reckless drivers instead of having to watch for everyone going over speed.

Allan Thoen's avatar

Plainly, what we need are precogs and a precrime program to prevent speeding violations before they occur. Don't even think about speeding!

Brian T's avatar

I've noticed that privacy advocates tend to take a very siloed approach when evaluating these issues.

So for COVID19 tracking apps, they might say "here's all the possible data it could reveal about you", rather than "here's the additional information it could reveal, on top of what Facebook and the cellular carriers already track."

Alex's avatar

That's because if tomorrow we try to get Facebook to be more privacy-preserving, people will respond with "Well, the COVID19 tracking app knows this, so why should we care?" Basically, we're in a flooding ship trying to get some pumps working and while it won't make a big incremental difference today, punching more holes in the hull is going to make things harder in the long run.

Joshua W.'s avatar

My problem with speed cameras is that they violate due process. They are cop, judge, jury, and executioner.

Kenny Easwaran's avatar

I'm pretty sure that speed cameras don't execute people.

And what exactly is the problem of the camera being both cop and judge? What is so important about getting the labor of two different people, rather than a more efficient and accurate system?

Joshua W.'s avatar

Well, the Constitution guarantees your right to a trial for both criminal and civil cases. A robot spitting out tickets like a skeeball machine hardly qualifies as a trial.

Kenny Easwaran's avatar

If you insist on going to court over a speeding ticket, why is it preferable to have the testimony of a human police officer over the video record from a speed camera? The camera doesn't literally function as judge in such a case, and I don't think judges are going to make a fairer trial with a human witness than with a camera record.

Joshua W.'s avatar

For one, unlike the camera, the cop can actually identify who was driving. This seems pretty important in our legal system...identifying the person accused of the crime. The robots just read the license plate and send the ticket to the owner's house. If the owner wasn't driving...too bad!

Tex Pasley's avatar

A ticket is not a judgment. Due process requires that you have the opportunity to contest the facts at a court hearing before you are obligated to pay a cent. So if you in fact weren't driving the car, you can show up to court and provide evidence that says so.

Kenny Easwaran's avatar

Is the violation (not crime) driving a car too fast, or giving control of a car to someone who drove it too fast? I don't see why we should treat these things differently, especially if it makes it harder to enforce things. (This is how we treat people who try to fly with toy guns in their luggage.)

unreliabletags's avatar

Although cops can ticket you for speeding alone, in practice it seems that most of the time they make a judgement about the overall safety context of what’s happening on the road. This human empathy and intelligence can be preferable to strict rules.

Hypothetically if you had every road under perfect surveillance by human officers, that would be better than pure speed camera surveillance, because only some portion of them will be sticklers. Others will be reasonable humans at least some of the time.

Kenny Easwaran's avatar

I don't see how this is an advantage. Wouldn't we prefer if speed limits are enforced predictably, rather than on the basis of some human empathy with all its biases? Obviously, we shouldn't be setting stupid speed limits the way we currently often do, but isn't flexibility exactly the *problem* with police most of the time?

unreliabletags's avatar

I don't think what we really care about is people going N miles an hour. What we care about is people being unsafe. A speed limit is a crude simplification to make that principle easier to administer and harder to debate. And for various reasons, whenever we make such a simplification, it's going to be maximally conservative. But officer discretion is an important compensating control against its crudeness and conservatism.

I'll give you another example. In California we have a lot of curvy two lane roads. The cars and the bicycles both love them. Unfortunately because they're curvy, they're double yellow the whole way. As the law is written, if you come up behind a bicycle you're just going to follow it at bicycle speed the rest of the way. Drivers are obviously not going to actually do that. It would turn a 90 minute journey into an all day journey. But pressure to avoid the oncoming lane makes them cut it too close when passing the bikes. So the bike lobby sponsored a bill that would make it legal to use the oncoming lane to pass a bike. It passed the legislature, but the governor vetoed it, citing liability. It is, after all, double yellow for a reason.

Now this law isn't very consequential, because there's almost never an officer present for one one these passing situations. And even if there was, he'd be unlikely to issue a ticket. But with perfect robotic enforcement, drivers would _actually_ be stuck behind bikes. Once every park/beachgoing driver had this happen to them at least once, delaying their trip by 8-10 hours, I'm guessing bikes would simply be banned from these roads. The law can't be fixed for liability reasons. But a little bit of lawbreaking lets everyone coexist.

Kenny Easwaran's avatar

That's a good example.

I'm less convinced that examples where exceptions for speed limits make sense exist, but if they are, it seems that there's still a place to argue them in court.

unreliabletags's avatar

You can't argue it in court. It's illegal. "The law is dumb in this case, we're not doing it" is something a cop or a prosecutor can say, not a judge.

Joshua W.'s avatar

Agreed. The community's laws and expectations should be patrolled and upheld by members of the community, not robots.

Phil's avatar

What? You can challenge a ticket issued by speed camera.

Joshua W.'s avatar

Speeding cameras don't identify the driver. In most cases, the driver, not the owner of the car, is the one responsible for the ticket, but the robot mails the ticket to the owner's house. It is then up to the owner to challenge the ticket and prove they weren't driving. In other words, guilty until proven innocent. Unconstitutional. Robots shouldn't be cops.

JR's avatar

Well there are front and rear facing speed cameras. Not that I love either.