Reconstruction attack testing disclosure controls

Description

Summary of the work Provide assurance of census disclosure control parameters, by completing a ‘reconstruction attack’. The supplier will receive frequency table outputs, from which they will form a best guess of the microdata set that produced them. The reconstructed microdata should be as close as possible to the real data. Latest start date Monday 6 December 2021 Why the Work is Being Done Following Census 2021, ONS are planning on releasing many more flexible outputs (frequency tables) through an online table builder. It is hoped that much more data will be made available than in 2011. This additional utility will be enabled whilst continuing to protect the confidentiality of the data with robust statistical disclosure control methods which are comprehensively assured. One aspect of the assurance is testing the feasibility of a reconstruction attack, which is a means of combining many frequency tables to get back to the original microdata. Frequency tables are converted into sets of simultaneous equations, which are solved to give a microdata set. If there are enough equations provided, the solution should be an accurate estimate of the real data. The disclosure control protection applied to the data should prevent accurate reconstruction. A reconstruction attack has previously been carried out internally, but the process took too long to solve, and evidence could only be gathered for small areas. Evidence is needed for a wider range of Output Areas (average 300 residents) and Middle Layer Super Output Areas (average 8000 residents). Once larger areas have been reconstructed, ONS can measure the effectiveness of the protection applied and adapt accordingly. Problem to Be Solved The contractor will receive frequency table outputs and will be provided the means of accessing them online. The contractor will combine the information in the outputs to reconstruct an estimate of the original microdata - record level data. This record level data will be returned to ONS for assessment, from this ONS can assess the level of risk of reconstruction attacks. For example: tables will be provided of counts of individuals by age*sex*ethnicity, and by age*sex*marital status breakdowns. The aim is to deduce the dataset of age*sex*ethnicity*marital status that would produce those two tables. Who Are the Users Disclosure control team, ensuring that data output from the Census 2021 system has a low disclosure risk, including from reconstruction attacks. A reconstruction attack is required to be performed on Census 2021 outputs (from test data) and a reconstructed best-guess of the original record level data returned to ONS. These are then compared to the original data and assess whether the disclosure risk from reconstruction attacks is too high. Work Already Done A small-scale reconstruction attack has been carried out using SAT solver software - converting the frequency tables into a large number of equations and finding the solution - but the process was too computationally intensive and took too long to solve. Evidence could only be gathered for small areas, so we are seeking evidence on reconstruction attacks for larger areas, which will require appropriate software/hardware, experience of handling large amounts of data and solving computationally intensive problems. Previous work did not consider the effect of disclosure protection already added to the data. Existing Team The supplier will be working with the ONS disclosure control team and with team members from census outputs. This team specialises in confidentiality and disclosure risk, and have good knowledge of the data that is to be reconstructed, however, we lack the tools/software to perform a strong reconstruction attack. Very limited collaboration with another supplier may be needed when arranging access to the data. Current Phase Alpha Skills & Experience • Evidence in form of a successfully delivered piece of work that you have capability and skills that will enable you to successfully complete this exercise • Previous experience of the methods you would use for reconstruction, for example constrained optimisation or equivalent. If not constrained optimisation, specify the proposed alternative method. • Evidence in form of a successfully delivered piece of experience with tools (software/hardware) that will be able to perform this exercise • Evidence in form of a successfully delivered piece experience of working with large data, high performance computing. Nice to Haves Previous experience of undertaking assurance testing including Reconstruction attacks Work Location In line with current Government restrictions work can be performed remotely, from any location (within the UK). The Census ONS staff are mostly based at Office for National Statistics, Segensworth Road, Titchfield/Fareham, PO15 5RR. Working Arrangments Work can be performed remotely, with preferably weekly updates given via Microsoft teams or similar. Weekly updates would outline progress made and next steps. A final report would be produced outlining how and to what extent objectives were met. Any travel is agreed in advance following the ONS travel and subsistence policy Security Clearance The supplier will hold Baseline Personnel Security Standard (BPSS) or higher and will agree to an End User License conditions to enable data access. No. of Suppliers to Evaluate 5 Proposal Criteria • Proposal/Methodology of how you would undertake this requirement • Explanation of why you consider your Methodology will produce accurate results. • Explanation of how this approach will work with inconsistent totals between frequency tables, arising from the cell key perturbation. • Explanation of why the software being used to deliver this contract will be sufficiently capable of solving the problem. • Explanation of why the proposed method will be accurate in the reconstruction of record level data using the frequency tables provided, and given the cell-key perturbation applied. • Provision of a Gantt Chart (or similar) to illustrate your programme for delivery, including confirmation of dates for completion. • Expected size of data the method could work for. A range of data will be tested, up to a potential maximum of 60M rows of 20 columns. Cultural Fit Criteria • Methodology for identifying and managing cyber security risks in the delivery of the contract including in the supply chain . • Work as a team with our organisation and other suppliers • Share knowledge and experience with other team members Payment Approach Fixed price Assessment Method Presentation Evaluation Weighting Technical competence 70% Cultural fit 10% Price 20% Questions from Suppliers No questions have been answered yet.