This memorandum describes several operations or activities performed in the planning or conduct of the 2020 Census that are considered sensitive and for which access must be restricted. For each of the operations or activities, some operational information is shared among Census Bureau staff with a business need to know such details, but not outside that group. What follows is a list of several such sensitive activities, a description for each, and what aspects of the activity must be kept confidential. Reasons for requiring this confidentiality include preventing the disclosure of information from individual respondents, minimizing the opportunity for outside parties to manipulate census data, enhancing the quality of census responses, and others.

It should be noted that everything in this memorandum is consistent with the requirements to maintain the confidentiality of titled data, such as data collected under Titles 13 and 26. Titled data can only be seen by people who are sworn under Title 13 and who have a business need to access the data. In fact, most Census Bureau staff do not and will never have access to the information and details mentioned below. Finally, there is no attempt to keep secret the existence of the operations and activities discussed below — only specific details, as described.

1. Primary Selection Algorithm (PSA). For some addresses in the census, we receive two or more valid responses. For example, one person at an address might respond on the internet, while another person at the same address returns the completed paper questionnaire. The PSA is a post-processing operation — that is, one which is conducted after data collection is complete — which addresses this situation.

   The Census Bureau has dealt with this situation in previous censuses. Although the available response modes have been be expanded for the 2020 Census, we are prepared to handle this situation again in 2020. However, the specific details of how we treat different situations are restricted to those working on the PSA.

2. Self-Response Quality Assurance (SRQA). SRQA, formerly known as Fraud Detection, is an activity that monitors the responses we receive in the census with the intent to identify cases that are suspicious. Various activities are applied to accomplish this goal. The details of these activities are shared only with those working on them.
3. IP Addresses: An internet protocol (IP) address is a numeric label assigned to each device connected to a computer network. It can be used to identify computers on the Internet. In many ways, it is like a return address on a piece of mail. With Internet response expected to be the primary mode of response in the 2020 Census, we are keenly aware of the potential for bad actors where those actors may be within the United States or elsewhere around the world. Safeguards are in place, the details of which are known by a limited few, associated with protections against responses associated with the IP addresses of potentially bad actors.
4. Sufficiency Criteria. Sufficiency is an address-level concept applied to a census response as a whole. It addresses the question, does the response have enough information? Basic information is required for a response to be considered "sufficient." The Census Bureau sets criteria to determine whether a response in the 2020 Census is sufficient to determine how it will be processed. These criteria are sensitive.
5. Data Defined Criteria. "Data defined" is a person-level concept applied to an individual person-level record, obtained as part of a census response. It addresses the question, do the data on the person record have enough information? Some person records derived from valid census responses are missing some or all characteristics. The Census Bureau establishes whether a person-level record is "data defined" in the census, that is, has enough information so that we retain all valid reported characteristics. If not enough information has been collected, according to these rules, that record would go through the imputation process. The rules for determining whether the record is data defined are sensitive.
6. Sensitive Group Quarters. Among the various types of group quarters from which the Census Bureau collects data in the census, one or more are considered sensitive in that we don't provide their census counts or other information to the public. Data from these group quarters are considered sensitive, and specific guidance is provided for protecting such data. For example, relevant tabulations are combined with others to maintain appropriate confidentiality. While information from these group quarters is protected through special procedures, it is not sensitive to discuss which group quarters these procedures apply to.
7. Identification Number Specification. The Census Bureau establishes rules for defining and validating a valid identification (ID) number for a census address. These rules are considered sensitive.
8. Specific Information from the Post-Enumeration Survey (PES). The Census Bureau conducts the Post-Enumeration Survey around the time of the census to evaluate the coverage of the census at the national level and for a set of demographic and geographic domains. Although the sample design and procedures for weighting and estimation in the PES are made available to the public, some data and parameters are not. They include, among others, the actual areas (basic collection units) selected for sample, the model parameters applied in the dual-system estimation, and the factors applied to mitigate correlation bias. These results are shared only with those working on them.

9. Disclosure Avoidance. In past censuses, the Census Bureau applied methods such as data swapping to prevent the disclosure of information on individual people or addresses. Although we discussed the methods in general, the parameters used in the application were not released to the public. In the 2020 Census, we will apply a disclosure avoidance procedure involving differential privacy. Under this approach, we can publicly release all parameters of the procedure without compromising confidentiality under Title 13, while data users can assess the level of noise infused into the data.

Sensitive information on the activities described above cannot be shared with anyone — inside or outside the Census Bureau — who doesn't have a business need to know.