Abowd, Vilhuber Win 2026 PET Award

John Abowd, professor emeritus of economics, statistics, and data science at Cornell and Lars Vilhuber, research professor and executive director of  ILR’s Labor Dynamics Institute, have received the 2026 Caspar Bowden PET Award for Outstanding Research in Privacy Enhancing Technologies for  their paper, “A Simulated Reconstruction and Reidentification Attack on the 2010 U.S. Census.” The announcement was made at the annual PET Symposium, held in Calgary from July 20–25.

The Caspar Bowden PET award is presented annually to researchers whose work makes an outstanding contribution to the theory, design, implementation, or deployment of privacy-enhancing technology. The award comes with a $3,000 prize, which the research team donated to the organization’s student travel fund.

Abowd, the retired Chief Scientist at the U.S. Census Bureau, previously won the award in 2023 for the paper “The 2020 Census Disclosure Avoidance System Top Down Algorithm.”  

“It is satisfying that they gave this team the award,” said Vilhuber, a research professor on the faculty of the Department of Economics at Cornell University and at the ILR School. “It's validation for a large amount of work that started in 2017. It was a massive undertaking that brought together economists and data scientists, working with computer scientists and engineers, to figure out how to actually run this.

“The computational demands were not trivial, but we tackled an important question because the Census Bureau was pondering whether to introduce a new disclosure avoidance method to protect the privacy of respondents. Our job was to poke holes in the old system to see whether there was a reason to implement a new one or if the old system was good enough. So, our work had to be meticulous.”

The paper – which focused on privacy aspects of the 2010 U.S. Census – was published by the Harvard Data Science Review in September 2025. The authors found that while the 2010 Census published more than 150 billion aggregate statistics across 180 table sets, they needed only 34 of those table sets to reconstruct microdata records, including five variables (census block, sex, age, race, and ethnicity), from the confidential records.

“We knew in principle that, based on the science up to that date, this kind of protection mechanism had its weaknesses. I think we weren't quite prepared to see how weak it might actually be,” said Vilhuber.

The article addresses the claim that, if there is uncertainty about whether a particular respondent’s data was used in a particular statistic, agencies enjoyed “plausible deniability” and could claim they provided meaningful confidentiality protection to respondents. The authors argue that in the 2010 Census, data aggregation and swapping were inadequate, allowing potential attackers to exploit the collected data.

According to Vilhuber, there are practical implications for protecting the privacy of Census respondents.

“There is a duty to protect everybody, and that is, in particular, the state's duty,” Vilhuber said. “Nowadays, people will data mine the statistics. When an individual can drill down to a particular person and infer from their data that a person is Black, they can use that information to discriminate against that individual, say for an online credit application, and that's not supposed to happen. The government collects this data, in part, to allocate billions of dollars across the country, but it should not jeopardize people’s privacy.

“So, if an individual thinks that by telling the truth, they are putting themselves at risk to be discriminated against, are they now going to respond honestly? And how will their refusing to answer, or giving a fake answer, affect that allocation of funds, because now the answers no longer reflect reality?”