Street masking: a network-based geographic mask for easily protecting geoprivacy

Abstract

Background: Geographic masks are techniques used to protect individual privacy in published maps but are highly under-utilized in research. This leads to continual violations of individual privacy, as sensitive health records are put at risk in unmasked maps. New approaches to geographic masking are required that foster accessibility and ease of use, such that they become more widely adopted. This article describes a new geographic masking method, called street masking, that reduces the burden on users of finding supplemental population data by instead automatically retrieving OpenStreetMap data and using the road network as a basis for masking. We compare it to donut geomasking, both with and without population density taken into account, to evaluate its efficacy against geographic masks that require slightly less and slightly more supplemental data. Our analysis is performed on synthetic data in three different Canadian cities.

Results: Street masking performs similarly to population-based donut geomasking with regard to privacy protection, achieving comparable k-anonymity values at similar median displacement distances. As expected, distance-based donut geomasking performs worst at privacy protection. Street masking also performs very well regarding information loss, achieving far better cluster preservation and landcover agreement than population-based donut geomasking. Distance-based donut geomasking performs similarly to street masking, though at the cost of reduced privacy protection.

Conclusion: Street masking competes with, if not out-performs population-based donut geomasking and does so without requiring any supplemental data from users. Moreover, unlike most other geographic masks, it significantly minimizes the risk of false attribution and inherently takes many geographic barriers into account. It is easily accessible for Python users and provides the foundation for interfaces to be built for non-coding users, such that privacy can be better protected in sensitive geospatial research.

Keywords: Donut geomasking; Geographic masking; Geomasking; Geoprivacy; OpenStreetMap; Osmnx; Street masking.

Fig. 1

A map depicting the points that were generated in Vancouver (a), Surrey (b), and Kamloops (c, Inset) and used for evaluating each geographic mask

Fig. 2

A graphic illustrating the street masking algorithm. Note that the top point is in a low-density area, the middle point is in a high-density area, and the bottom point is in a medium-density area. As a result, the top point is moved the furthest distance after masking, the middle point is moved the least distance, and the bottom point is moved a medium distance

Fig. 3

Results of Ripley’s K function analysis for clustering at different spatial scales in Vancouver. Results between the masks are fairly comparable, though population-based donut geomasking tends to increase clustering more than other methods

Fig. 4

Results of Ripley’s K function analysis for clustering at different spatial scales in Surrey. Results here diverge more than in Vancouver due to increased population heterogeneity. Population-based donut geomasking significantly increases clustering compared to other masks. Street masking and distance-based donut geomasking produce similar results to the original data

Fig. 5

Results of Ripley’s K function analysis for clustering at different spatial scales in Kamloops. With the most heterogeneously distributed population out of the three study areas, results here are most dramatic. Population-based donut geomasking greatly altered clustering. Distance-based donut geomasking is most like the original data, though street masking is not far behind