Full or part-time, remote or semi-remote

This is a remote or semi-remote role; full-time or part-time with use of office space in Belfast.

The Sensible Code Company uses modern software techniques to transform the processing and publication of data and statistics.

Over 10 years ago, we created ScraperWiki: one of the first collaborative in-browser coding environments focused on scraping and wrangling messy data.

We run PDFTables.com which has converted over 100 million pages of PDF files to clean tabular data for its thousands of users.

Most recently, we’ve built Cantabular: a software framework for the protection and publication of statistical data. We’ve just used it to republish the 1911 Ireland census and the Office for National Statistics are using it to automate much of the dissemination for the 2021 England and Wales census.

We’re a friendly, supportive and experienced remote team focused on delivering high quality software. We are all based within Ireland or UK and have been working remotely as a company since 2018. We collaborate using Slack, Trello, GSuite, Highrise and GitHub. We have daily informal virtual chats over coffee and organise quarterly company meetups in locations across UK & Europe.

About this role

We’re looking for a Digital Marketing Manager who will help us to grow and develop our European and international customer base.

Key things to know about this job:

• Work with the product team to plan for strategic growth
• Understand how the marketing plan contributes to revenue objectives
• Relish being empowered to make decisions
• Drive B2B customer acquisition and retention
• Lead the digital presence (SEO, PPC, Email and Social etc.)
• Research, write and publish blogs, case studies, and white papers
• Analyse campaigns, consumer trends and the competitive landscape
• Influence, educate and prompt colleagues on the benefits of marketing
• Lead generation and processing

You’ll be responsible for:

• Creating and executing end-to-end marketing campaigns
• Developing and delivering technical and business-level messaging
• Brand identity, awareness and recognition
• Implementing our go-to-market strategy
• Acquisition and lead processing for enterprise deals
• Managing virtual and in person events

Your skills are:

• Bachelor’s degree in a relevant subject
• Full or part Chartered Institute of Marketing qualification preferable however we’d also consider other similar qualifications
• Experience working with HTML or CSS
• Solid understanding of modern digital marketing techniques (PPC, SEO, website optimisation)
• Experience using automation and modern social media analytics tools
• Confident creating content in English
• Energy, enthusiasm and commercial awareness
• Self-management and accountability skills
• Understanding of a flexible start-up like environment

Bonus points if:

• 2+ years B2B technology-based marketing experience, international experience
• Data analysis experience (Excel, Python, SQL or similar)

Pay and benefits:

• Salary up to £35,000 (pro rata for part-time) and based on experience
• Flexible working times to support a healthy work/life balance
• You can be located anywhere in Ireland & UK
• We offer a generous 30 holiday days plus public holidays (38 total)
• A contribution of £1,330 per year to home office costs
• Learning and training supported for career development
• Expenses covered for internal and external meetings
• Share options available

How to apply:

Email jobs@sensiblecode.io quoting scjob26 in the subject line with the following information

• Cover letter: tell us a bit about why you’re interested in this role
• CV or resume: your professional experience
• Your telephone number

No agencies please.

Last week we released a new version of Cantabular with a big new feature: a disclosure rules language.

The disclosure rules language, or DRL, is a tool to help statisticians automate decisions about table publication which they might previously have made using manual analysis techniques. It does this by letting its users encode their own confidentiality rules in a language designed for this purpose.

It works with our API and user interfaces to automatically check requests for tables built from confidential datasets for disclosure risks such as identity disclosure, attribute disclosure and sparsity.

Statistical disclosure control at speed and scale for the England and Wales Census

The ONS is deep in preparations for the Census next year, and is working to make sure that business, government and wider society get as much value from the next Census as possible. One path to accomplish this is by allowing people to make their own queries of the data gathered in 2021, instead of relying on a smaller set of predetermined tables.

To help do this, we’ve been working with them to automate some of the privacy protections they have designed for Census 2021 outputs, based around our product Cantabular.

Cantabular works by programmatically adding noise, and hence uncertainty, to outputs and screening queries and output tables for disclosure risks, in real-time. The performance of our software means that table protection and production can be automated and used to power flexible dissemination tools or as part of a repeatable statistical production pipeline.

Benefits of a disclosure rules language

In Censuses past, checking of tables before publication involved a manual or semi-manual process of evaluating the disclosivity of tables by checking for unsafe cells.

Each published table had to be checked for its own inherent risks, and evaluated alongside all previously published tables to also understand the cumulative risk. This was a hands-on, time-consuming process, but necessary to ensure confidentiality.

For Census 2021, the ONS’s SDC team decided to explore the possibility of automating these checks, and saving their eyeballs. The DRL we’ve created is one of the results of our collaboration with them on this problem and promises a number of benefits:

• Saving time by removing the need for manual or semi-manual processes and freeing up thinking time for gnarlier problems.
• Enabling the release of thousands or millions of output tables by collapsing the time taken to check a table to milliseconds.
• Allowing the creation of custom rules specifically written to match the structure, content and nuance of a particular dataset.
• Giving methodologists autonomy to write automated disclosure checks that don’t involve any changes to the underlying software.

What can you do with a disclosure rules language?

Our new DRL has two elements to it: firstly, it checks that a query received by our API is allowed. Secondly, it checks the disclosivity of the output table produced for each geographic area in the output to evaluate whether it is safe enough to be released.

These elements, and the flexibility inherent in the language to interrogate the properties of an output table, can support a wide range of use cases.

Here are a few of them, largely inspired by a paper published by the ONS’s Statistical Disclosure Control team (Survey Methodology Bulletin 79— Office for National Statistics)

• Set maximum variables: block queries that will lead to overly sparse outputs before they’re even run by limiting the number of variables that can be added to a query.
• Limit queries for sensitive variables: queries made including particularly sensitive variables could be limited to a smaller number of variables.
• Attribute disclosure: individual or group attribute disclosure in a table can be detected and tables with too many instances can be blocked.
• Identity disclosure: tables containing too many values of one can also be blocked.

Beyond Census

We’re expecting that the DRL will allow the use of Cantabular for other datasets and by other clients with different needs and in different data domains.

To that end, our language definition is open, to ensure it can be shared, discussed and understood, and to allow anyone to make an implementation.

Want to find out more?

If you’d like to find out more about how our product Cantabular works, we’d love to hear from you. Drop us an email at hello@sensiblecode.io.

We’re hiring for a senior methodologist role.

The Sensible Code Company is pleased to announce the appointment of Gerry O’Hanlon, former Director General Central Statistics Ireland, as a non executive director.

SensibleCode recently signed a £1.3 million contract with the UK Office for National Statistics, for Cantabular; data privacy technology that delivers real time statistical disclosure control.

Gerry O’Hanlon said …. “I am delighted to be joining The Sensible Code Company as a Non-Executive Director. As a career statistician, an ever-present key challenge was to maximise the statistical potential of available data to meet the needs of all users while ensuring that the principle of statistical confidentiality was fully adhered to in respect of all data subjects. The Cantabular software provides a cutting edge solution to assist Statistical Offices and other data holders in meeting this challenge in a timely and safe manner in an era of ever-increasing data availability and a concomitant focus on data protection”

CEO, Aidan McGuire added … “We are delighted to welcome Gerry O’Hanlon to Sensible Code, his arrival comes at a key moment; the Coronavirus pandemic shows the importance of timely granular statistical data for accurate modelling and planning. Cantabular has the capacity to transform and accelerate data dissemination to enable better policy & economic decision making“

Press contacts

Aine McGUIRE
aine@sensiblecode.io
+44 (0)7710 377929
Ormeau Baths, 18 Ormeau Avenue, Belfast BT2 8HS

Note to editors

Gerry was a top-level manager in the Irish Central Statistics Office (CSO) for over twenty years prior to his retirement as Director-General in 2012. From 2013 to 2019, he was a member of the Good Practice Advisory Committee of the Greek Statistical System, serving as Chairperson of the Committee from 2013 to 2017. In recent years he has also led high-level teams in conducting extensive reviews of national statistical systems in over ten EU and other European countries. He has a BSc in Mathematics and Mathematical Statistics from University College Cork and a Masters in Strategic Management (Public Service) from Trinity College Dublin.

About The Sensible Code Company

The Sensible Code Company is a digital start-up with venture capital backing. It has won several awards for innovative technology products. Its ground breaking technology Cantabular(TM) modernises the processing and dissemination of data. The software is designed to support statisticians and data controllers, to help improve business operations that require the processing of confidential data.

We’d planned a hack day at the Office for National Statistics for our work on Census 2021 towards the end of May. But the arrival of Covid-19 meant we had to pivot to making the event virtual.

The objective was to allow ONS data scientists and analysts the opportunity to road test an innovation that will happen when anonymised, high level Census 2021 data are released. It’s called flexible table builder and is powered by our software Cantabular.

Cantabular applies privacy protections as a query is processed in order to produce safe tables of aggregated data. Queries are facilitated by an API that has two design objectives; security and speed.

What is a flexible table builder?

We’ve been working with the ONS to modernise the way Census data are protected and disseminated. At the heart of the census is the principle of keeping information safe, confidential, secure and private — no one can find out individual’s details for 100 years.

However, aggregated census data are essential to inform decisions nationally and locally on vital services and issues like diversity. And the ONS has made a commitment to provide more timely information and analysis.

At the start of the hackday, our sponsor introduced the concept and how it had the potential to dramatically change how Census data can be made available

Before: For Census 2011, there was a 16 month lag between the final day of collection and the first output table appearing on the ONS website. It took up to 4 years to produce all the output tables. It was a time consuming process that required significant human intervention and expert decision making.

After: the ONS wants to collapse the time frame, producing first results within 12 months of data collection, and make as many census statistics as possible available soon after that first date of publication; aiming to do so within a year. This will increase the contribution census data make to the economy and provide much higher value to ONS customers.

Modern tools and a large synthetic dataset

We’ve been working on a Python API client that makes it easy for data scientists to query the data as part of their applications and visualizations. We created extra documentation and ran a short tutorial at the start of the event to help the analysts get started and see some useful code snippets.

We spun up a server instance running a hosted Jupyter notebook to support anyone who was unable to install the Python package because of security restrictions which worked really well.

The hackday participants were working with a 57 million row artificial dataset that mimicked the 2011 census and to give a real sense for the lightning speed with which a query can return results.

Imagining new uses for census data

Despite the challenges of working remotely, the assembled company managed to organise into six groups around an impressive variety of ideas and almost all managed to show a working prototype within a few hours.

The judges said “The teams worked well together. The fact that it was a remote event did not detract from the quality of work produced; we were impressed with the range of ideas; the speed with which they were realised as well as the potential for these to be developed further.”

Winner: Map areas where my query is too disclosive

The winning team approached an issue that is likely to present itself when disclosure control is applied to data. If generated data for an area are too disclosive, the flexible table builder suppresses the output. It may be possible to get more aggregated data by performing the same query at a higher geographic area (e.g. Middle Super Output Area (MSOA instead of LA) or by using variables with fewer categories (e.g. ages grouped into 5 year bands instead of individual years). The program highlights these missing areas using a choropleth map. The team produced a working proof of concept. It demonstrated great collaboration between the data science campus and the census outputs team.

Where should I move to?

The initial idea was to create a tool to help someone find places they might like to live based on factors that were important to them such as good health or level of education.

A user would select factors that were important to them, and the tool would perform queries using the API to find areas that met their desired criteria.

Where is similar to where I live today?

The purpose of this tool was to identify similar areas based on a set of chosen variables. The tool used a similarity matrix l to find the most similar areas to a specified Local Authority (LA). To improve this program, the team suggests developing a UI and to generate a map on output, highlighting similar LAs. If an LA had a problem, such as low educational attainment, they could use this tool to find other LAs with a similar population but high educational attainment. Planners could then engage with those other LAs to identify any approaches that might benefit their own area.

Mapping postcodes to census geographies

This idea looked at linking Census data to a particular postcode. The tool would map the postcode to areas in the census geographic hierarchy e.g. What Lower Super Output Area includes my postcode?’ A UI was developed that enabled the user to input a postcode into a search box at the top of a page, then when the postcode is submitted, a list of anonymised information would be output. This approach could be applied to alternative geographies such as school district.

The commonalities quiz

This team worked on an idea to create a fun game using census data. A commonalities quiz was produced and presented in an easy-to-use UI. Random shuffling was used to make the quiz different each time it was run. The questions are based around identifying areas that are similar according to different characteristics. The project showed that a dataset can be used to return random questions. A quiz like this could be tailored for different audiences e.g. school children.

Identifying Covid-19 risk factors

This idea was inspired by a recent ONS publication around ethnicity and the risk of being a victim of Covid-19. The team looked for a link between various variables (such as commuting distance and mode of transport) and Covid-19 deaths. Their hypothesis was that public transport was a contributing factor in the spread of Covid-19 — the longer spent on transport, the higher risk of being infected. The team produced a program that estimated the average time a commuter spent on public transport using a number of basic assumptions. They feel confident that the queries could be combined with more accurate commuter data to establish whether commute time is a Covid-19 risk factor. A similar approach could be applied to other variables.

A virtual hack day requires lots of planning!

We’d originally planned for an onsite face to face hack day — for which we had experience. Covid lockdown put that idea on ice. We prepared for weeks — we tested and retested the systems. We had a group of users who downloaded the Python client and made sure they were able to access the hosted synthetic dataset. We also had fantastic support to mobilise a bunch of analysts from the data science campus, census outputs and digital publishing including a data analyst in Beirut. We used a designated Slack workspace with channels for announcements, team communications and tech support. We used Google Meet for presentations and for the API tutorial.

What happens next?

We’re hoping that some of the ideas presented on the day will be considered for further development and to inspire analysts inside the ONS. We’re developing a Go client and we’re responding to user feedback on how the API worked for the participants.

We’d like to thank everyone at the ONS who participated and who helped make the event successful.

ONS hack day Census data unplugged was originally published in The Startup on Medium, where people are continuing the conversation by highlighting and responding to this story.

Cantabular is designed for organisations that want to share statistics derived from sensitive and potentially personally identifiable data, whilst protecting privacy. It is designed to modernise statistics.

Sensible Code decided to use the Go programming language (also known as Golang) to build the latest version of its product. The Cantabular team have been working on it for three years and found Go a great fit; almost everyone developing in Go at Sensible Code learned it on the project. Go has a small set of keywords to learn, and a compact and readable language specification.

Strong tooling and library support

The toolkit provided by the language core helps all developers, whether new to the language or not. A standout is the gofmt tool that formats valid Go code into a uniform standard. By defining a standard, there are no time-wasting debates about how the code should be formatted. It enables our entire Go codebase to be formatted in this standard way, making the code look more uniform and easier to read. In addition gofmt is used to support the continuous integration process in Cantabular and to ensure the code is formatted correctly for every build.

Furthermore, Go features a test framework (go test) and has performance tooling (pprof) for profiling; both of these are used in Cantabular. Go reduces the friction to getting started by bundling the core development tools with the language. This is especially important for new developers and it’s worth mentioning the useful defaults included.

Go’s extensive official library enabled the Cantabular team to minimise external dependencies for this enterprise scale project. As this excellent paper by Russ Cox (@_rsc) highlights, the convenience of including external code has an overhead associated with auditing and managing dependencies. This is a concern in security-critical environments; a software’s attack surface can increase with large numbers of dependencies, both direct and transitive.

Safety features

Security is an important consideration for Cantabular since it processes sensitive data.

Go is a memory safe language and includes features that avoid security bugs that might occur if Cantabular was developed in another language. Although data races can circumvent this memory safety, there is also an in-built race checker to help catch them.

Go’s static type system helps too. Data types of values are checked at compilation time, before the code is even run. This process helps catch bugs, rather than discovering a problem while the code is actually running. Additionally, Go’s static typing helps Cantabular offer protection against accidentally publishing raw data by defining distinct types for publication-safe and publication-unsafe values.

The built-in Go tooling discussed earlier helps with safety too; go vet is a built-in static analysis tool for checking for mistakes or bad coding practices. A large range of third-party static analysis tools supplement the built-in tooling. As these analysis tools are often written in Go too, they are easy to deploy — see the next section. This makes it simple to incorporate these tools into continuous integration pipelines for providing automated code quality checking that can help highlight potential security flaws.

Rapid build and deployment

Cantabular customers run our code in their secure environments; we do not have access to their systems to debug deployment problems. Customers shouldn’t need to configure prerequisite software to use Cantabular because Go compiles code to standalone binary executables. One hitch is that getting static Go binaries is not quite as simple as it could be, but if this is not yet simple, then at least it is possible. Static binaries remove guesswork on what libraries and packages our customers have installed, and avoids us having to suggest additional software requirements (e.g. Docker, Ansible or others).

Go code can be compiled for multiple platforms from a single operating system; further reducing barriers to a customer looking to run our software. Enterprise customers have varying computing requirements. Some customers are Windows-only shops and the ability to offer a Windows installation option with minimum effort is a great benefit to them. Internally, we’ve benefited from Go’s cross-platform support too: most developers at Sensible Code use Linux, but developers on our Go projects sometimes use OS X.

Last, and by no means least, quick builds were a must have for the Go language developers from the outset, and at Sensible Code we benefit directly from this by not waiting long for our code to compile!

Going forward

Cantabular is a strategic product for the company; we must provide long term support to all our customers since the product will be operational for some years. There is a need therefore to consider the plan for Go’s forward compatibility.

It is intended that programs written to the Go 1 specification will continue to compile and run correctly, unchanged, over the lifetime of that specification.

Being able to rebuild the source to incorporate subsequent security fixes to the Go compiler and libraries over a support period, with minimum effort, reduces code maintenance overhead. This means that future Go performance improvements can be passed to customers. Hopefully, this compatibility promise also proves true when Go 2 is finally released too, as this post suggests:

Go 2 must also bring along all the existing Go 1 source code. We must not split the Go ecosystem.

Where do we Go next?

There are tradeoffs in the choice of a programming language and a team has to find a compromise by selecting a language that is suitable for the application domain, and for developer comfort and productivity. The positive experiences with Go certainly make it a candidate for SensibleCode future projects.

This post is based on a presentation that Steven Maude presented on behalf of SensibleCode at Golang Amsterdam in 2019.

Thanks to Orne Brocaar and the rest of the great team of organisers for inviting us to speak and for hosting us in the evening.

Want to know more about Cantabular? Visit the Cantabular site!

SensibleCode are looking for a Statistical Disclosure Control Specialist to help build core expertise in the discipline.

The team at Sensible Code have been busy for a few years working on an innovative privacy preserving technology called Cantabular. This highly performant disclosure control algorithm protects data in real time as a user or reasearcher makes a query.

The UK based Office for National Statistics has selected Cantabular to allow flexible dissemination for anonymised Census 2021 data.

We’re delighted to be working with the ONS, given its international reputation as the gold standard in statistical practice. Our technology will transform the way Census 2021 data is disseminated and deliver higher value to the economy, through better policy, better business decisions and valuable research. The software applies robust statistical disclosure control techniques in real time. The ONS is able to compute millions of tables of data at high speed whilst protecting anonymity and to ensure data are non-disclosive.
Aine McGUIRE, Commercial Director, SensibleCode​.

It’s a journey for the ONS

The outputs team at the ONS have been in consultation with users since 2017. From day one the statistical disclosure control professionals within the ONS have been engaged in the process. To give some sense of this, we’ve included references to some public events and consultations.

United Nations Economic and Social Council, Economic Commission for Europe Conference of European Statisticians (ECE/CES/GE.41/2018/18)

Abstract: The Office for National Statistics has been working to ensure 2021 Census outputs are more flexible, timely and accessible compared to the 2011 Census. This document outlines our strategic vision for the dissemination of 2021 Census outputs. We also set out the approach we have taken to gather feedback from a spectrum of users on our design and content and how we are planning to incorporate this feedback into our future research. In early 2018, we held a public consultation to outline our vision for the content and design of 2021 Census outputs.

This included our plans to disseminate the majority of census data through a single point of access via the ONS website using a flexible dissemination system. This will be enabled through an innovative combination of statistical disclosure control methods, which include targeted record swapping, and an automated layer of light-touch perturbation and final disclosure checks. We also set out our plans for the design and dissemination of specialist products, including microdata samples and origin-destination (flow) data products.

Source: Plans for disseminating 2021 Census data for England and Wales

Applying Cell-Key Perturbation to 2021 Census Outputs

By Iain Dove, Stephanie Blanchard, and Keith Spicer

“In preparation for 2021, the disclosure control team is investigating several methods of protection, including use of targeted record swapping plus cell key perturbation, illustrated below.

This would specifically protect against disclosure by differencing and allow user-defined outputs to be distributed through an online table builder. The protection and checking will have been applied before the tables are made, so anything available to be built will not need to be checked, and tables will not need to be re-designed. Most protection would still come from targeted record swapping as before, with cell perturbation also protecting against differencing.”

Source: Applying Cell-Key Perturbation to 2021 Census Outputs

…and it’s a journey for SensibleCode too

We’ve been working with the ONS since 2016. This is an enterprise-scale digital transformation and is driven by user needs. Census is a critically important dataset for the ONS and information assurance is paramount.

We’ve included some earlier posts that explain the approach to the product design. The product used to be called TableBuilder.

• Modernising statistics — keeping data safe
• Engineering confidentiality for Census 2021 — more data, more quickly and for more areas

The Sensible Code Company makes digital products that automate processing, privacy protection and publication of data.

We’re looking for a senior methodologist to develop our understanding of the statistical domain and to help inform how we enhance and extend Cantabular.

Key things to know about this job:

• could be a full-time or part-time role
• supporting our technical team in designing approaches to SDC
• supporting our work with large enterprise customers like the Office for National Statistics (ONS) and other statistical institutes and agencies
• participating and speaking at international conferences
• writing technical papers
• must be within a 2 hour flight to Belfast, Northern Ireland

Your skills are:

• have a knowledge and experience in the implementation of SDC methods
• a keen enthusiast for stats packages: e.g. R, SAS, Python
• an ability to interpret and describe the latest SDC methods
• an ability to install and experiment with commercial and open source SDC software
• ability to convey your ideas in written and verbal forms

You’ll be responsible for:

• identifying use cases and associated SDC feature requirements
• creating a knowledge bank on SDC from across the world
• analysing existing SDC software
• documenting algorithms
• finding the highest value events to talk about our SDC software
• installing and configuring software on Windows and Linux including in the cloud, e.g. on AWS

Facts about The Sensible Code Company

• we all have balanced lives, exact working times are flexible
• we offer a generous 30 days plus public holidays (38 total)
• we have a remote team across the EU
• we are centred in Belfast
• we use lots of Go, Python, AWS, Docker and more

Salary

to €75,000 based on experience and pro-rata for part-time

To apply, send the following:

• It would be nice to see example of your papers you’ve published.
• Your CV;
• Your telephone number.

How to apply

Email jobs@sensiblecode.io quoting scjob23 in the subject line (no agencies).

The UK-based Office for National Statistics has selected Belfast company SensibleCode and its privacy preserving technology Cantabular for disseminating anonymised Census 2021 data.

The three year contract valued at £1.3m is a significant commercial win for the company that specialises in products for modernising statistics.

The ONS is improving the way it disseminates data in order to add value to its community of users. Cantabular applies data anonymisation in real time as a user makes a census query. Data can be published sooner, users can self service their queries and researchers can get access to a high speed API to allow seamless data processing.

Aine McGUIRE, Commercial Director, SensibleCode. “We’re delighted to be working with the ONS, given its international reputation as the gold standard in statistical practice. Our technology will transform the way Census 2021 data is disseminated and deliver higher value to the economy, through better policy, better business decisions and valuable research. The software applies robust statistical disclosure control techniques in real time. The ONS is able to compute millions of tables of data at high speed whilst protecting anonymity and to ensure data are non-disclosive”.

About Office for National Statistics, UK

The Office for National Statistics (ONS; Welsh: Swyddfa Ystadegau Gwladol) is the executive office of the UK Statistics Authority, a non-ministerial department which reports directly to the UK Parliament. It is charged with the collection and publication of statistics related to the economy, population and society of the UK; responsibility for some areas of statistics in Scotland, Northern Ireland and Wales is devolved to the devolved governments for those areas.

About SensibleCode

The Sensible Code Company is a digital start-up with venture capital backing. It has won several awards for innovative technology products. Its ground breaking technology modernises the processing and dissemination of data. The software is designed to support statisticians and data controllers, to help improve business operations that require the processing of confidential data.

Press contacts

Aine McGUIRE
aine@sensiblecode.io
+44 (0)7710 377929

cantabular.com

Statistics professionals within public sector agencies take great care in how they process and protect personal data and this is reflected in the trust and respect they enjoy from their customers and the public at large. #GDPR has thrown a further spotlight on governance around data confidentiality.

A significant increase in the number of new data sources and a drive to make use of admin data means more data is being processed and published. Getting data released as close as possible to their collection date results in higher value to the economy. Transparency and open data are also driving change. There is an appetite for innovation and projects that focus on data confidentiality are happening across government.

There are two routes to get data:-

• aggregate tables are published on a website, these have had manual disclosure control techniques applied
• access to research data is made available to those who meet specific criteria and sign legal agreements. Where data is highly sensitive the research is often conducted in a locked and secure room.

Common challenges

Data consumers

• want more data and sooner.
• want to be able to access customised tables as their needs cannot always be served by pre computed published tables.
• require more meta data to support statistical releases.
• public sector data consumers worry about a 100% push to API. They fully support open data, but are under cost pressure and do not have the resources to exploit these downstream.

Process

• Myriad disclosure control techniques exist; these are manual processes.
• Legal agreements to protect data access are complex and time consuming to negotiate and agree.
• Data controllers want users to be able to make ‘meaningful’ queries so that data cannot be misinterpreted.
• A pragmatic risk-utility balance needs be achieved and a precedent set if automation is to be successful.

Culture

• Micro data access is still the norm for research purposes for a percentage of government datasets

There is no simple solution to address all of the challenges; it seems likely that a variety of different approaches will be used to address the tension between publication and statistical disclosure control (SDC).

Open source software for SDC

There are numerous tried and tested open source solutions in the market.

sdcMicro

SDCMicro is free, R-based open-source package for the generation of protected microdata for researchers and public use.

Multiple options for reducing disclosure risk and for assessing information loss.

Multiple methods for assessing the re-identification risk (k-anonymity, individual, and global re-identification risk).

Graphical user interface available for users with no or limited knowledge of the R language.

Author: Matthias Templ

τ-ARGUS

Tau-Argus is a software tool which enables statistical disclosure control to be carried out to protect tabular output. It can be run in either interactive or batch mode and can import tables or microdata, allowing the user to create tables. Tau-Argus supports either frequency or magnitude data types and once imported along with a metadata file, the user can apply a number of confidentiality rules.

Typically for magnitude tables, safety rules such as threshold and dominance rules are set by the user, and cells failing these rules are highlighted, allowing the user to select them for suppression. In order to avoid disclosure by differencing, secondary suppression can be applied using a variety of techniques. For frequency tables, controlled rounding is commonly applied. This method rounds cell values to the nearest multiple of a user specified base, whilst maintaining the table additivity.

• Author: Numerous authors. Peter-Paul de Wolf — Statistics Netherlands.

SUDA

Software tool for use with statistical disclosure control for microdata. It provides a per record risk measure which not only tells the user how much risk they have but also where in the file (by record, by variable, by variable value) the risk is located. This enables the user to make principled decisions and to target disclosure control which in turn maximises the residual utility.

Author: Mark Elliot, University of Manchester

Protecting personal data with TableBuilder

TableBuilder is designed to help statistics professionals to modernise the way they process and disseminate data whilst ensuring data is kept confidential.

It allows flexible data dissemination through real-time application of disclosure control techniques in response to user queries.

The benefits

• More granular data
• More speed as data are released closer to collection data
• More flexible as users can make their own queries

There is a standard user Interface and an API. Data controllers can use TableBuilder as an internal tool to model disclosure risk.

The data controller administration module allows experimentation with disclosure parameters and to see the results in real time.

Components

• Statistical disclosure control module (cell key method with automatic preservation of structural zeros)
• Data controller administrator module
• End user interface module

Poster presented at the International Association of Statistics in Paris in September 2018.

Over the past 9 months we’ve added substantial capability to TableBuilder. The end game is to allow the Office for National Statistics, England and Wales to publish more 2021 Census data tables, much sooner, while ensuring that data is kept confidential.

The Office for National Statistics is a trusted organisation: it commits to ensuring that the personal information people provide will be kept safe and secure. It also has to comply with confidentiality requirements set out in the Statistics and Registration Service Act 2007, the Data Protection Act 1998 and the forthcoming General Data Protection Regulation.

Publishing more tables for diverse areas

Access to finer grained data across the England and Wales will mean that decisions made which are based on census data can be better. Disclosure control rules are complex and historically they’ve been applied manually. This meant they were mostly applied uniformly across different geographical areas because there are too many output areas to consider: about 180,000 in England and Wales. This gave rise to a problem: tables that could be created for diverse areas (like Barnet in London) were not published because the similar table would be too disclosive in, for example, Northumberland.

Using TableBuilder the ONS can create a set of rules which are applied uniformly across the country. However the effect of the rules is not uniform because they depend on data which varies across the country. The rules are evaluated independently for every area in a user’s query (up to 180,000 areas). Data is only published for those areas where all the rules pass.

With TableBuilder we can now :-

• Process more complex input data
• Set disclosure rules to determine which tables can be published
• Automatically preserve ‘structural zeros’
• Demonstrate the user interface
• Generate tables orders of magnitude faster than a conventional database

Process more complex input data

We’ve transformed TableBuilder so that it can handle the amount of data generated by the Census (over 56 million people living in more than 23 million households according to the last Census ). We’ve loaded a full geographic hierarchy for England and Wales (180,000 output areas), added mappings (a.k.a. grouping or banding) and loaded ONS supplied perturbation parameters.

Set Disclosure Rules

The ONS has developed a set of disclosure rules which determine whether a table can be published. These rules are configurable with numeric threshold parameters that determine their sensitivity.

We created a disclosure rules editor to allow the ONS team to experiment with adjusting the rule parameters. Using this tool they can immediately see the impact on the number of different tables that could be published across the country.

How it works

TableBuilder Architecture

Preserve Structural zeros

Some combinations of categories should never coexist, for example: people under 16 who are in full time employment. Zeros in the output table with these combinations are deemed “structural”.

In order to avoid exposing the workings of the perturbation algorithm we need to make sure that “structural” zeros in the output table are not perturbed. TableBuilder does this by first running the user’s query at a higher level geography to determine which zeros must not be changed.

Demonstrate the user interface

We’ve built a test interface to allow the ONS to show its users how the system works and to facilitate user research.

Why performance matters

TableBuilder has been engineered from the ground up to be performant: we can deliver results to queries in sub-second response times. In this time-frame we scan 56,000,000 rows, compute results at two different geographic levels, execute the cell key perturbation and evaluate multiple business rules on up to 180,000 areas.

What happens next?

The dissemination team at the ONS will show the system to some of their users and conduct more user research and testing.

“Users have always wanted the data as soon as possible after the Census. We expect this desire to be strongly reflected again in our forthcoming public consultation on outputs [launching on 28 February this year]. This work paves the way for us to be able to meet this demand”.

Suzie Dunsmith (Head of 2021 Census Outputs at ONS)

The backstory….

This blog tells you how we got here! Expose the value — Protect the data.