Week 12: Identity, privacy, trust, and the capstone design review

In plain words

Week 12 of the My Vote Forward seminar finishes the course with three linked problems: knowing who is taking part, protecting what they share, and earning trust. Students read federal guidance on digital identity and biometrics, the research showing that “anonymous” data can often be traced back to people, the mathematics of differential privacy and its use by the U.S. Census Bureau, and a study of voters’ confidence that their ballots were counted. Then they review the My Vote Forward framework against everything the course has covered.

A fingerprint can unlock a phone. It cannot show that a person is eligible to vote. Removing names from a dataset does not make it anonymous. And people’s trust in elections depends partly on their own experience and their politics. This week asks how a system could handle all three honestly, and whether this framework does.

Defined terms

• Authentication: confirming that the person using an account is the person who set it up. See authentication.
• Identity proofing: establishing that a person is who they claim to be in the real world. See identity proofing.
• Eligibility: whether a person meets the legal requirements to take part in a particular decision. See eligibility.
• k-anonymity: a release property in which each person’s record cannot be distinguished from at least k minus 1 others. See k-anonymity.
• De-anonymization: re-identifying individuals in a dataset presented as anonymous.
• Differential privacy: a mathematical definition of privacy for data analysis that limits how much any one person’s data can affect a published result. See differential privacy.
• Voter confidence: a voter’s belief that their ballot was recorded and counted as intended.

Learning objectives

By the end of week 12, a participant should be able to:

1. Distinguish authentication, identity proofing, and eligibility, and explain NIST’s treatment of biometrics.
2. Define k-anonymity and explain its known weaknesses.
3. Describe Narayanan and Shmatikov’s de-anonymization of the Netflix Prize data and what it implies for “anonymous” releases.
4. Explain what differential privacy guarantees, what it costs, and why the Census Bureau adopted it.
5. Summarize what Alvarez, Hall, and Llewellyn found about voter confidence.
6. Conduct a structured design review of the My Vote Forward framework using the course’s standards.

Core readings

1. National Institute of Standards and Technology, SP 800-63B-4, Digital Identity Guidelines: Authentication and Authenticator Management, sections on multi-factor authentication and biometrics.⁠¹
2. Latanya Sweeney, “k-Anonymity: A Model for Protecting Privacy,” International Journal of Uncertainty, Fuzziness and Knowledge-Based Systems 10(5), 2002, pp. 557 to 570.⁠²
3. Arvind Narayanan and Vitaly Shmatikov, “Robust De-anonymization of Large Sparse Datasets,” IEEE Symposium on Security and Privacy, 2008, pp. 111 to 125.⁠³
4. Cynthia Dwork and Aaron Roth, The Algorithmic Foundations of Differential Privacy, Foundations and Trends in Theoretical Computer Science 9(3 to 4), 2014, pp. 211 to 487, chapters 1 and 2.⁠⁴
5. John M. Abowd, “The U.S. Census Bureau Adopts Differential Privacy,” ACM SIGKDD Conference on Knowledge Discovery and Data Mining, 2018.⁠⁵
6. R. Michael Alvarez, Thad E. Hall, and Morgan H. Llewellyn, “Are Americans Confident Their Ballots Are Counted?” The Journal of Politics 70(3), 2008, pp. 754 to 766.⁠⁶

Lecture notes

Three problems that are often confused

Identity, privacy, and trust are the subjects of the final week, and the main lesson is that they are separate. Public debate often merges them: a system that verifies people with fingerprints is assumed to be both secure and eligible-only; a dataset without names is assumed to be private; a system run by a trusted-sounding organization is assumed to be trustworthy. Each assumption is false in a specific, documented way. The site’s chapters on identity and registration, privacy, consent, and published releases apply this week’s material to the framework.

Identity: what a biometric does and does not prove

NIST’s Digital Identity Guidelines are the main United States federal technical standard on authentication. SP 800-63B-4 describes multi-factor authentication, for example “a cryptographically secure device with an integrated biometric sensor that is required to activate the device.” It is explicit about the limits of biometrics: “A biometric characteristic is not recognized as an authenticator by itself,” and a physical authenticator must be “authenticated along with a biometric comparison”.⁠¹

The practical meaning is that a fingerprint on a phone is a way to unlock a device that holds a credential. It confirms that the person touching the sensor matches the enrolled fingerprint on that device. It does not establish who that person is in law, whether they are a citizen or a resident of a jurisdiction, whether they are registered, or whether they are acting freely. Those are questions of identity proofing and eligibility, governed by different processes and, for elections, by law. The site’s page does a fingerprint prove eligibility? and the glossary entry on passkeys develop the distinction. Week 4’s history adds a warning: every identity requirement must also pass the access test, because requirements that look neutral can exclude.

Privacy: names are not the problem

Latanya Sweeney’s k-anonymity paper starts from a data holder, such as a hospital or bank, that wants to share data with researchers and asks “How can a data holder release a version of its private data with scientific guarantees that the individuals who are the subjects of the data cannot be re-identified while the data remain practically useful?” Her answer is a formal model: “A release provides k-anonymity protection if the information for each person contained in the release cannot be distinguished from at least k-1 individuals whose information also appears in the release.” She also “examines re-identification attacks that can be realized on releases that adhere to k-anonymity unless accompanying policies are respected”.⁠²

The key insight is that combinations of ordinary attributes can identify people even without names. k-anonymity addresses that by ensuring each combination is shared by several people. Its known weakness, which Sweeney’s own attention to “accompanying policies” anticipates, is that it protects only against the attributes the data holder anticipated, and that if everyone in a group shares the same sensitive value, being hidden in the group protects nothing.

Arvind Narayanan and Vitaly Shmatikov showed how far re-identification can go with rich data. They present “a new class of statistical de-anonymization attacks against high-dimensional micro-data, such as individual preferences, recommendations, transaction records.” Applied to the Netflix Prize dataset, “which contains anonymous movie ratings of 500,000 subscribers,” they show that “an adversary who knows only a little bit about an individual subscriber can easily identify this subscriber’s record in the dataset.” Using the Internet Movie Database as background knowledge, they “successfully identified the Netflix records of known users, uncovering their apparent political preferences and other potentially sensitive information”.⁠³

This result bears directly on a priorities channel. A person’s ranking of ten subjects, plus a few shared opinions, plus a location, is exactly the kind of “individual preferences” data the paper describes. Releasing individual-level priority data, even without names, could expose people. That is why the site’s small-group suppression and consent rules matter, and why the objection page who can see my data? exists.

Differential privacy: a guarantee with a price

Cynthia Dwork and Aaron Roth describe the need for “a robust, meaningful, and mathematically rigorous definition of privacy, together with a computationally rich class of algorithms that satisfy this definition,” and state that “Differential Privacy is such a definition.” Their monograph is mostly about techniques for achieving it. They are candid about limits: “there are still fundamental limitations, not just on what can be achieved with differential privacy but on what can be achieved with any method that protects against a complete breakdown in privacy”.⁠⁴

In plain terms, differential privacy adds carefully calibrated randomness to published statistics so that the results would look nearly the same whether or not any one person’s data were included. It does not depend on guessing what an attacker knows, which is the weakness of k-anonymity. Its price is accuracy: stronger privacy means noisier statistics, which matters most for small groups.

The U.S. Census Bureau’s adoption shows both the motive and the stakes. John Abowd reports that the Bureau announced it would protect the publications of the 2018 End-to-End Census Test “using differential privacy,” as a dress rehearsal for the 2020 Census, “the constitutionally mandated enumeration of the population used to reapportion the House of Representatives and redraw every legislative district in the country.” The motivation: the Bureau’s internal research “confirmed that the statistical disclosure limitation systems used for the 2000 and 2010 Censuses had serious vulnerabilities that were exposed by the Dinur and Nissim (2003) database reconstruction theorem”.⁠⁵

Whether that accuracy cost is acceptable for small-area counts is a question students should examine using primary statements from the Bureau and from data users who rely on those counts. The site’s glossary entry on differential privacy gives the definition, and apportionment explains why census accuracy carries political weight.

Trust: confidence is uneven

The final reading turns from technical protection to public belief. R. Michael Alvarez, Thad Hall, and Morgan Llewellyn analyzed two national telephone surveys asking voters how confident they were that their 2004 presidential vote was recorded as intended. They “present preliminary evidence that suggests confidence in the electoral process affects voter turnout,” find “significant differences in the level of voter confidence along both racial and partisan lines,” and find that “voter familiarity with the electoral process, opinions about the electoral process in other voting precincts, and both general opinions about voting technology and the specific technology the voter uses significantly affect the level of voter confidence”.⁠⁶

The site’s chapter on trust in elections documents more recent patterns in confidence. For this course, the important point is that trust is not produced by security alone. Week 11’s evidence-based elections give experts reasons to trust results. Ordinary voters’ confidence also depends on familiarity, technology, and what they believe about other places. A new system that experts consider secure can still lower confidence if people do not understand it, which echoes week 4’s finding that perceived secrecy matters as much as formal secrecy.

The capstone: reviewing the framework

The course ends by turning its tools on the framework this site describes. The review is not meant to praise or condemn My Vote Forward. It is meant to test whether the framework meets the standards students would apply to any proposal. A full review asks at least these questions, each tied to a week:

1. Feedback (weeks 1 and 3): Would the framework’s participants be less skewed than people who contact officials today? What evidence would show it?
2. Representation (week 2): Which form of representation does it aim to improve, and which could it weaken?
3. Secrecy and access (week 4): Does it keep shared opinions optional and separate from any vote, and do its requirements exclude anyone?
4. Aggregation (week 5): Does it name its method and report sensitivity?
5. Measurement (week 6): Does it disclose who participated and avoid presenting opt-in results as the public’s view?
6. Agenda (week 7): Who chooses the subjects, and can the choice be contested? See who chooses the ten?.
7. Deliberation (week 8): Does it distinguish quick rankings from considered judgment?
8. Direct democracy (week 9): Does it avoid treating priorities as mandates on rights?
9. Power (week 10): Does it place itself honestly on Arnstein’s ladder?
10. Security (week 11): Does it avoid claiming a secure remote vote, and does its threat model match the literature?
11. Identity, privacy, and trust (week 12): Does it separate authentication from eligibility, protect individual-level data, and explain itself in ways ordinary people can check? Who runs it and who funds it; see why trust this operator? and who funds it?.

The framework’s governance and jurisdictions chapters describe who would hold authority and why no universal certification exists. Students should treat those chapters as claims to examine, not conclusions to accept.

Common misreadings this week guards against

Three errors are common enough to name. “We use biometrics, so only eligible people can take part” confuses authentication with eligibility, which NIST’s guidance keeps separate. “We removed names, so the data are anonymous” ignores the re-identification results of Sweeney and of Narayanan and Shmatikov. “The system is secure, so people will trust it” ignores Alvarez, Hall, and Llewellyn’s finding that confidence depends on familiarity, technology, and group differences. A review that catches these three errors in any proposal, including this one, has learned the week’s lesson.

Discussion questions

1. NIST says a biometric is not an authenticator by itself. Why do many people believe a fingerprint proves who they are? What should a system tell them?
2. Narayanan and Shmatikov identified people from movie ratings. What could be learned about a person from a ranking of ten public priorities plus their postal code?
3. Differential privacy trades accuracy for privacy. Who should decide that trade for a public priorities release, and how?
4. Alvarez, Hall, and Llewellyn found confidence varies by race and party. Can any design produce equal confidence across groups that distrust each other?
5. Which of the eleven capstone questions does the My Vote Forward framework answer worst? What would a better answer require?
6. Having completed the course, is collecting public priorities between elections worth doing at all? State the strongest case for and against.

Assignment

Capstone design review (3,000 to 4,000 words). Write a structured review of the My Vote Forward framework using the eleven capstone questions above. For each question, state what the framework claims, cite the relevant site chapter, evaluate the claim against at least one course reading, and rate it as adequate, partially adequate, or inadequate with reasons. Conclude with the three most important changes you would recommend and the strongest objection to each, and with an overall judgment of whether the framework should be developed further, revised fundamentally, or abandoned. A well-argued recommendation to abandon it earns full credit. Use only the site’s published chapters and course readings; do not contact the project or any official.

Evidence

The NIST text is quoted from SP 800-63B-4. Sweeney, Narayanan and Shmatikov, Dwork and Roth, Abowd, and Alvarez, Hall, and Llewellyn are quoted from their published abstracts. All sources were opened on the review date.

Competing interpretations

On identity, some argue strong identity checks are necessary to prevent fraud and manipulation, while others argue they exclude eligible people and create surveillance risks; NIST’s guidance addresses authentication strength, not that political choice. On privacy, k-anonymity and similar methods are practical and widely used but vulnerable to rich background knowledge, while differential privacy offers a formal guarantee at a cost in accuracy that some data users reject. On trust, one view holds that better security and audits will build confidence, while another, supported by evidence that confidence follows familiarity and partisanship, holds that technical improvements alone will not.

Application to this framework

My Vote Forward separates authentication from eligibility, keeps shared opinions optional, and proposes aggregate releases with small-group suppression, as described in its identity and registration, privacy, and published releases chapters. This week’s readings test whether those rules are adequate: whether suppression thresholds resist de-anonymization of preference data, whether formal privacy is warranted, and whether explanations would build confidence among people who distrust institutions.

Unresolved questions

• What suppression or formal privacy settings would make aggregate priority releases safe without making them useless for small communities?
• Can a participation system build trust among groups that distrust each other, and how would anyone measure success?
• After twelve weeks, does the evidence support collecting public priorities between elections, and under what conditions?