Social distancing remains an important strategy to combat the COVID-19 pandemic in the United States. However, the impacts of specific state-level policies on mobility and subsequent COVID-19 case trajectories have not been completely quantified. Using anonymized and aggregated mobility data from opted-in Google users, we found that state-level emergency declarations resulted in a 9.9% reduction in time spent away from places of residence. Implementation of one or more social distancing policies resulted in an additional 24.5% reduction in mobility the following week, and subsequent shelter-in-place mandates yielded an additional 29.0% reduction. Decreases in mobility were associated with substantial reductions in case growth two to four weeks later. For example, a 10% reduction in mobility was associated with a 17.5% reduction in case growth two weeks later. Given the continued reliance on social distancing policies to limit the spread of COVID-19, these results may be helpful to public health officials trying to balance infection control with the economic and social consequences of these policies.

Differential privacy (DP) provides formal guarantees that the output of a database query does not reveal too much information about any individual present in the database. While many differentially private algorithms have been proposed in the scientific literature, there are only a few end-to-end implementations of differentially private query engines. Crucially, existing systems assume that each individual is associated with at most one database record, which is unrealistic in practice. We propose a generic and scalable method to perform differentially private aggregations on databases, even when individuals can each be associated with arbitrarily many rows. We express this method as an operator in relational algebra, and implement it in an SQL engine. To validate this system, we test the utility of typical queries on industry benchmarks, and verify its correctness with a stochastic test framework we developed. We highlight the promises and pitfalls learned when deploying such a system in practice, and we publish its core components as open-source software.

Cardinality estimators like HyperLogLog are sketching algorithms that estimate the number of distinct elements in a large multiset. Their use in privacysensitive contexts raises the question of whether they leak private information. In particular, can they provide any privacy guarantees while preserving their strong aggregation properties?We formulate an abstract notion of cardinality estimators, that captures this aggregation requirement: one can merge sketches without losing precision. We propose an attacker model and a corresponding privacy definition, strictly weaker than differential privacy: we assume that the attacker has no prior knowledge of the data. We then show that if a cardinality estimator satisfies this definition, then it cannot have a reasonable level of accuracy. We prove similar results for weaker versions of our definition, and analyze the privacy of existing algorithms, showing that their average privacy loss is significant, even for multisets with large cardinalities. We conclude that strong aggregation requirements are incompatible with any reasonable definition of privacy, and that cardinality estimators should be considered as sensitive as raw data. We also propose risk mitigation strategies for their real-world applications.

No abstract