<a id="ch-01"></a>

## Chapter 1 — Advanced research integrity and methods

<!-- open-cyber-academy:lesson-figures:start ch-01 -->
### Lesson map

Lesson 01 published. Map, example, EX001.

```mermaid
flowchart TD
  N0["Learning outcomes"]
  N1["1.1 A falsifiable question"]
  N2["1.2 Why the question matters"]
  N3["1.3 Integrity rules"]
  N4["1.4 Uniqueness as a baseline"]
  N5["Lab — Uniqueness of synthetic riders on quasi-identi"]
  N6["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6
  N6 --> EX["Worked example"]
  EX --> Q["Exercise EX001"]
```

### Logical drawing

```mermaid
flowchart LR
  N0["Learning outcomes"]
  N1["1.1 A falsifiable question"]
  N2["1.2 Why the question matters"]
  N3["1.3 Integrity rules"]
  N4["1.4 Uniqueness as a baseline"]
  N5["Lab — Uniqueness of synthetic riders on quasi-identi"]
  N6["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> Q["EX001"]
```

```text
[Learning outcomes]
    |
    v
[1.1 A falsifiable question]
    |
    v
[1.2 Why the question matters]
    |
    v
[1.3 Integrity rules]
    |
    v
[1.4 Uniqueness as a baseline]
    |
    v
[Lab — Uniqueness of synthetic riders on quasi-identi]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX001]
```
<!-- open-cyber-academy:lesson-figures:end ch-01 -->


### Learning outcomes

You will (1) frame a falsifiable question about privacy-preserving data release; (2) set integrity rules for research that touches personal data; (3) measure how quickly ordinary attributes make people unique.

### 1.1 A falsifiable question

Ines Carvalho is a doctoral candidate at the fictional Thornbury University, supervised by Prof. Henrik Aaltonen. Her partner is the fictional Valemont Regional Transit Authority, which collects smart-card journeys and wants to publish travel data for city planners. Ines asks whether releasing differentially private origin-destination counts protects riders better than releasing k-anonymised journey records, at a utility planners still accept. Before collecting anything she writes down which results would prove her wrong: no measurable reduction in linkage risk, or an error so large that planners reject the counts for routine timetable decisions.

### 1.2 Why the question matters

The question matters because transit data looks harmless but describes where people live, work and pray. Under Regulation (EU) 2016/679, the GDPR, data that can single out a person remain personal data, while Recital 26 places truly anonymous information outside the regulation. The Brazilian LGPD, Lei 13.709/2018, draws a similar line in its definition of anonymised data. Whether a release counts as anonymous is therefore a legal as well as a technical question. Ines treats it as an empirical claim to be tested rather than a label that the authority can simply apply to a spreadsheet before publishing it.

### 1.3 Integrity rules

Research on personal data must not create the harm it studies. Ines's protocol, approved by the Thornbury ethics committee and reviewed by Valemont's data protection officer, sets five rules. She works only on a synthetic population generated to match published aggregate statistics; no real card numbers leave the authority; any attack experiment targets the synthetic population, never real riders; the analysis plan is pre-registered before results are seen; and every file leaving the secure environment is checked for direct identifiers. She also declares that she has no commercial interest in any anonymisation product or consultancy.

### 1.4 Uniqueness as a baseline

Before comparing release methods, Ines measures how identifying ordinary attributes are. Sweeney (2002) showed that a few quasi-identifiers such as postcode, birth date and sex can single out most people, which motivated the k-anonymity model. The lab builds 20,000 synthetic riders with a home zone, a work zone, a birth year and a sex, then counts the share who are unique on growing combinations. Home zone alone singles out nobody, and home plus work zone singles out nobody either, but adding birth year makes 83.4% unique, and adding sex raises the figure to 91.5% of the synthetic population.

### Lab — Uniqueness of synthetic riders on quasi-identifiers

```python
# Share of synthetic transit riders who are unique on combinations of quasi-identifiers.
import random
from collections import Counter
r = random.Random(7)
riders = [(r.randrange(40), r.randrange(40), r.randrange(1940, 2008), r.choice("FM")) for _ in range(20000)]
def unique(cols):
    keys = [tuple(x[c] for c in cols) for x in riders]
    c = Counter(keys)
    return sum(1 for k in keys if c[k] == 1) / len(keys)
for name, cols in [("home zone", (0,)), ("home + work zone", (0, 1)),
                   ("home + work + birth year", (0, 1, 2)), ("home + work + birth year + sex", (0, 1, 2, 3))]:
    print(f"{name:32s} unique {unique(cols):6.1%}")
```

Run with `python3 lab_unique.py`. Verified output:

```text
home zone                        unique   0.0%
home + work zone                 unique   0.0%
home + work + birth year         unique  83.4%
home + work + birth year + sex   unique  91.5%
```

### Worked example

Ines frames a falsifiable comparison between k-anonymised records and differentially private counts, sets integrity rules for research on transit data and records a baseline: 83.4% of synthetic riders are unique on home zone, work zone and birth year.

> **Synthetic case.** Thornbury, Valemont and every rider are synthetic; the GDPR, the LGPD and Sweeney (2002) are real.

### Errors and limits

Uniqueness in a synthetic population only approximates uniqueness in the real one. Being unique is not the same as being re-identified; an attacker also needs outside knowledge.

### Exercises

- **EX001 — Falsifiable plan.** What makes Ines's research question falsifiable? *Rubric:* 3 = she lists in advance results that would refute it: no drop in linkage risk or unacceptable error;; 2 = mentions pre-stated outcomes vaguely;; 1 = says it is a good question;; 0 = none.
- **EX002 — Anonymous in law.** Why is "anonymous" a legal as well as a technical question for the authority? *Rubric:* 3 = GDPR Recital 26 and the LGPD place anonymous data outside the law, so the label changes legal duties;; 2 = cites one law only;; 1 = says it is technical;; 0 = none.
- **EX003 — Synthetic population.** Why does Ines work on a synthetic population instead of real cards? *Rubric:* 3 = it lets her run attacks and publish results without exposing or re-identifying real riders;; 2 = says it is easier;; 1 = says real data is unavailable;; 0 = none.
- **EX004 — Uniqueness jump.** Which attribute causes the biggest jump in uniqueness in the lab, and why? *Rubric:* 3 = birth year: from 0% to 83.4%, because it splits each zone pair into many small groups;; 2 = names birth year without numbers;; 1 = names zone;; 0 = none.
- **EX005 — Unique versus identified.** Why is uniqueness not yet re-identification? *Rubric:* 3 = an attacker also needs outside knowledge that links the unique combination to a named person;; 2 = says they differ;; 1 = treats them as equal;; 0 = none.
- **EX006 — Interest declaration.** Why does Ines declare that she has no commercial interest? *Rubric:* 3 = readers can judge bias; a product interest could tilt the method comparison;; 2 = says it is required;; 1 = omits reasons;; 0 = none.
- **EX007 — Pre-registration value.** What does pre-registering the analysis plan protect against? *Rubric:* 3 = choosing metrics or thresholds after seeing results that flatter one method;; 2 = mentions bias generally;; 1 = says it is paperwork;; 0 = none.

### Synthesis

Chapter 1 sets a falsifiable question, integrity rules and a uniqueness baseline. Chapter 2 maps the research frontier from Warren and Brandeis to differential privacy.

### Continue studying — chapter 01 of 08

[← Course home](../../README.md) · [Course chapter index](../SUBJECTS.md) · [Chapter 02 (draft) →](#ch-02)

## Worked answers

<a id="answer-ex001"></a>
**EX001.** Ines states beforehand that no reduction in linkage risk, or error planners reject, would refute her claim, so data can prove her wrong.

<a id="answer-ex002"></a>
**EX002.** Because the GDPR and LGPD exclude truly anonymous data from their scope, calling a release anonymous removes legal duties; the claim must therefore be technically justified.

<a id="answer-ex003"></a>
**EX003.** A synthetic population lets her test attacks and publish without exposing real riders, keeping the research from causing the harm it measures.

<a id="answer-ex004"></a>
**EX004.** Adding birth year moves uniqueness from 0.0% to 83.4%; it divides each home-work pair into dozens of tiny groups.

<a id="answer-ex005"></a>
**EX005.** A unique row only becomes a named person when an attacker holds outside data matching that combination; uniqueness is a precondition, not proof.

<a id="answer-ex006"></a>
**EX006.** Declaring no interest in anonymisation products lets examiners and the authority trust that the comparison is not tilted toward a product she sells.

<a id="answer-ex007"></a>
**EX007.** It prevents her from picking the error metric or epsilon grid after seeing which choice favours her preferred method.