Introduction

The Indian Census was supposed to take place in 2021. It should not be a surprise that the Indian Census data is more voluminous than any other data set in the country. So I reckon that this would be a perfect use case for applying Differential Privacy to keep the data confidential.

Due to its sheer volume, and the presence of bad actors who want to sabotage the working of the largest democracy in the world, it is now absolutely essential to integrate privacy into our Census methodology. Although confidentiality about our data is guaranteed by Census Act, 1948, the same law specifies a penalty for both public and census officials for non-compliance or violation of any provision of the Act. Yet the question of "who watches the watchmen" still remains unanswered or poorly answered—which is as good as not answered.

Do I trust our elected officials to not be complicit with our sensitive data? Why would I trust them? And there are several other similar questions that demand rigorous technical and governance solutions.

Although upon research, the methodology to keep the Census data private used by the Government of India isn't available (at least not on the web except the Census Act of 1948), I reckon the methodology used in 2011 is no better than the swapping method, or more commonly known as "Data Swapping."

Background: Data Swapping and Its Limitations

The Data Swapping Technique

Data Swapping is a technique for disclosure control on statistical databases. The aim is to reduce the risk that anyone can identify a respondent and his or her responses to questionnaire items by examining publicly released microdata or tables while preserving the amount of data and its usefulness.

Imagine there is a Jewish family (only one family) living in the eastern part of Delhi. The idea is to swap the identities of that Jewish family with another Hindu family from, let's say, the southern part of Delhi where other Jewish families reside. The details for the family would be aggregated with others, and therefore not identifiable, and yet the total population in both the blocks (eastern and southern part of Delhi) would remain accurate.

Scalability Challenges

But this would not work very well should the data set become very large. As you could have already imagined, Data Swapping works fine on a small population, but it becomes reckless when applied to very large populations. Although it is never confirmed that a data set made confidential through this method has ever been compromised, in theory it is possible, hence it is vulnerable to hacks.

This is now truer than ever, given the fact that our computational power and the amount of data is increasing. That's where Differential Privacy comes into play—at least mathematically it is impossible to let the information of a single person (or a data point) be revealed.

Problem Analysis: The Privacy-Accuracy Tradeoff

Why Differential Privacy for Indian Census?

But why would the government of India want to employ Differential Privacy? Well for starters, Differential privacy would mean that, except at the state level, population and voting age population will not be reported as enumerated. And, race and ethnicity data are likely to be farther from the "as enumerated" data than in past decades, when data swapping was used to protect small populations.

The Small Population Challenge

It has been a source of tension what would the GOI (Government of India) do should there be a small district/block to be covered. I mean it is well established that DP would not be very beneficial if the dataset is small. The implementation of differential privacy could introduce substantial amounts of noise into statistics for small populations living in remote areas, potentially diminishing the quality of statistics about small blocks, like a village in Leh.

In that case, the GOI could use data swapping to cover that block, while leveraging the full potential of DP at a state and national level. Here, you could say that overpopulation is a blessing in disguise.

Identifying the Audience

It is not easy to directly answer this question: who will be the audience of DP being employed to preserve the privacy of the census data? Will it be the government? Would the government officials want to employ it and make them more transparent and hence less prone to corruption? Or will it be the citizens of India who would want their data to be private from their political leaders and the Lord himself?

I think it would be both of them because both these parties want their data not to get in the hands of a hostile entity who would want to hurt them. I don't think the government officials would want their data to be in the hands of an adversary nation, and the people of India would want their data to be handled with adherence to the most basic protocols, by their own elected officials.

Proposed Solution: A Comprehensive Privacy Framework

Information Flow Architecture

Now we know that the accepted definition of "information flow" is a flow of bits from a sender to receiver with some probability. But the very job of the government is to remove this probabilistic nature from the information flow. Both the government and the citizens don't want some 99.999% chance of correct information flow. They want a robust 100%—a sure, confirming fact that their census data can't be sniffed by the enemy of the state or some rogue agent. So defining a flow of governance for information flow becomes quite necessary.

Since this is census data, naturally the citizens won't have the privilege to veto from giving their data. They must provide their data for their elected government officials to make sense of their locality/block. But what can be done is they could provide their data in some encrypted form, which only the government can later decrypt.

Input Privacy: Homomorphic Encryption

They could use homomorphic encryption. That way, their data would remain encrypted, but the calculations done on their data would yield the same result had if the data weren't encrypted at all. So this way the citizens can be assured that their data would be private.

Then comes the part where we could ask, "what the government would do with these calculations?" To be honest, it is their business what they do with the statistical outcomes of the calculations that they did on the census data and that business better be for the welfare of the people. But for that matter, I reckon the public will have to trust their own leaders.

To get their trust, the leaders must provide some tangible proof(s) or evidence(s) if you will, that they will indeed work hard to better their people's lives and lawful business. That evidence could be in the form of amendments, referendums, or even some new plan put into action. But no matter what they do, the data provided by the people would still remain encrypted, ergo private. This way, there would be a two-way (or bilateral if you will) privacy ensured by the government, assured to the people for the mutual benefit of the nation.

Input Verification: Cryptographic Signatures

As mentioned above, one of the tools that could be used for input privacy is homomorphic encryption. So this technique is magical in the sense that although your data would be encrypted and only you could decrypt it, should you feel the sudden urge to do so, still the required computations can be done by some third parties on your encrypted data, and return the same output, had if they did the same calculations on your "raw" data. So this way the citizens can be assured that their data would be private. This way the government is offering their citizens a guarantee that they cannot "see" their private data. That means the citizens truly stay in control of their data.

Now given the fact that most of the Indian population actually resides in the rural part of the country, it would be a huge challenge to employ cryptographic signature for input verification. Although the vast majority of the Indian population would not be interested in input verification—going to the trouble of verifying that their data is indeed private and the computation that got done by the government parties are indeed true—theoretically it is possible to enforce input verification.

For that matter, the GOI could use cryptographic signatures, sort of like a receipt, so that whenever someone from a certain district of the country asks for it, they can be reassured that their data is indeed private.

Output Privacy: Differential Privacy Implementation

The dual requirement for an accurate count and the protection of respondents and their data creates a natural tension: The more accurate (and therefore usable) the reported data is, the easier it may be to identify individual responses. The use of differential privacy would mean that reported data will not be the same as the raw data.

Final decisions about the mathematical model used for differential privacy, and therefore the impact on reported data, is a debatable matter. On one extreme, to have zero risk of privacy disclosure, all totals reported would have to have some "noise" injected (or some variation from the actual count). On the other extreme, if there were no noise injected, the risk of privacy disclosure would be great.

These two variables—the risk of disclosure and accuracy—can be measured against each other and, in fact, create a trade-off. This is referred to as a "privacy loss budget."

The good thing about DP (Differential Privacy) is that once the raw data is injected with noise, then we don't need the raw data anymore. All the calculations are now done on the altered data (alteration being decided by the privacy loss budget of course). The raw data could be even "thrown away" because from henceforth for any and every statistical calculation, the new altered dataset would be used. This way it guarantees output privacy.

Output Verification: Legal Framework

As for the output verification part, it turns out that we already have it in place and are being enforced. It is the very Census Act of 1948. The Act makes it obligatory on the part of every citizen to answer the Census question truthfully and also penalizes for giving false information.

One of the most important provisions of the Census Act 1948 is that it makes provisions for the maintenance of secrecy of the information collected at the Census of each individual. All information collected under the Census is confidential and is not shared with any agency—Government or private.

Discussion: The Foundation of Trust

Perhaps the most important privacy tool of all is the mutual trust between the citizens and the government, and therefore their full enthusiastic support to get their census data both accurate and private. The rest of the "tools" which could be used to inculcate structured transparency within the census data collection and deployment by achieving input privacy, input verification, the flow of governance, output privacy, and output verification have already been discussed above.

However, mutual cooperation between the government and its people is perhaps the foundation upon which the rest of this privacy-oriented enterprise stands. Without this foundational trust, even the most sophisticated cryptographic techniques cannot ensure meaningful privacy protection in practice.

Practical Implementation Challenges

The implementation of such a comprehensive privacy framework faces several practical challenges:

1. Technical Infrastructure: Deploying homomorphic encryption and differential privacy at scale requires significant computational resources and technical expertise.

2. Rural Accessibility: Given that most of India's population resides in rural areas, ensuring cryptographic verification capabilities across all demographics presents a substantial challenge.

3. Privacy Loss Budget: Determining the optimal balance between privacy protection and data utility requires careful calibration and ongoing adjustment.

4. Governance Transparency: Establishing mechanisms for citizens to verify privacy guarantees without compromising the system's security is a delicate balance.

Conclusion

The Indian Census represents a unique opportunity to implement privacy-preserving technologies at an unprecedented scale. By combining differential privacy for output protection, homomorphic encryption for input privacy, and cryptographic signatures for verification, India can establish a gold standard for privacy-preserving demographic data collection.

The tension between data accuracy and privacy protection is not insurmountable. Through careful application of modern cryptographic techniques and a well-designed privacy loss budget, it's possible to achieve both statistical utility and individual confidentiality. However, the success of such a system ultimately rests on the foundation of mutual trust between citizens and their government. A trust that must be earned through transparency, accountability, and demonstrable commitment to privacy protection.

As the world's largest democracy prepares for its next census, the choices made regarding privacy protection will have implications far beyond India's borders, potentially setting precedents for privacy-preserving data collection in democracies worldwide.