Alternatives to "Cold Rooms" for Restricted-use Data

Abstract

More and more studies are producing data with disclosive and sensitive variables. Modifying these data to make them public-use may reduce the analytic value tremendously. As a result these data are often only available in physical enclaves or “cold” rooms. Unfortunately, these cold rooms are an impediment to research because of travel and inconvenience. The challenge is to provide appropriate security while making the data as accessible as possible. Cold Rooms: Guarded and Unguarded Cold rooms have two types: guarded and unguarded. The computers in the room are not connected to a public network and are not connected to printers. USB ports for connecting flash drives are disabled and inaccessible. Researchers must submit requests to remove output. Authorized personnel release the output to the researcher only if it passes disclosure review. In the guarded room, data manipulation is monitored, and notes may not be removed from the room. Secure Online Enclave Instead of unguarded cold rooms, secure online enclaves are a better alternative. Researchers make an encrypted connection to the online server. All data analysis occurs on the server. The server blocks connections to the Internet, and researchers cannot copy files from the server. As in the cold room, researchers must submit requests to remove output. The secure enclave has several advantages. Researchers can connect to the server from their offices. (These locations must be specified and must be private; libraries, cafes and coffee shops are not allowed.) Collaboration is easier since project team members can connect to the same server from different locations. The server may also offer more processing power than a desktop computer. Just as in the unguarded cold room, researchers are not prevented from making notes. Batch system and synthetic data The guarded enclave has both output restrictions and monitored activity. While the guarded cold room is the most secure, it is also the most expensive to maintain and the least conducive to research. Researchers are only allowed to view the restricted-use data if an invigilator is present. As an alternative, researchers can submit programs to perform analysis. Output is only provided to researcher if it passes disclosure review. Researchers never have access to the restricted-use data. The key advantage is that researchers would not have to travel to submit programs. This type of system can however be quite cumbersome as researchers must wait for output. Furthermore, programming mistakes may take days to detect. To make this type of system run more smoothly, synthetic data with the same structure as the restricted-use data should be made available. Programs can be tested on the synthetic data, and only fully tested programs are then submitted to run on the restricted-use data.