You use sensitive geographic data every day. What are your strategies to protect them in your geographical information systems?
What kind of architecture do you use?
What encryption method do you use?
What do you do for users who export sensitive data from your databases?
With a multi-user geospatial database, you can implement Row Level Security (RLS). You can do this with PostgreSQL (and PostGIS), Oracle and MS SQL Server, and probably others. I've seen it implemented up to the QGIS and SDE levels. What RLS does is implement privileges on the rows (GIS features) that individual users or user groups can select/update/delete.
For example, user "bob" can log-in to a geospatial database using an encrypted connection, and pull up a GIS layer showing only the features that he is authorized to see and edit. While user "sue" can load up the same GIS layer and see a different view of the GIS features she is authorized to see and edit.
Sometimes I manage sensitive data and that can't be separated into public and private bits as in my preferred other answer because the geometry gives it all away. Good examples are raptor nests (peregrine falcon chicks fetch great prices on the black market) and salt licks (why get all cold and miserable hunting if I can just sit and wait for the prey to walk into my sights of its own accord?).
In this case our strategies are to fuzz the data: buffer the points using large units and a random offset or centroid, only show or share the maps and not the raw data. Sometimes we drop the point geometry and join the attributes with a larger parent polygon, e.g. "somewhere within the polygon bounded by these 2 rivers and that highway there's a salt lick" and that's what is shared outside the unit.
I have an out of band answer: simply, I go out of my way to not handle sensitive data if I can at all help it.
Okay, so on the face if it that's not a very helpful response. Let's make it more so. I've learned that a lot of the time when clients come to me and say they need to protect data such-n-such that a careful exploration of their data and goals will reveal that there isn't as much to protect as initially thought. Sometimes the truly private stuff can be separated without too much trouble. You keep that table of birthdays and home address locations over there, in your private file system. I'll keep the geometry over here in the shared workgroup space, and you can join them when needed using this ID column.
The basic principle is: keep the responsibility for managing the security as close to the source, to home, as possible.
This way even though I might manage the spatial data, I actually know next to nothing about it, and thus can never be a vector for it's potential exposure. I think of it as akin to the basic computer security protocol that a sysadmin can reset your password or lock the account, but not actually read it.
I use postgresql with postgis capabilities.
Data can be encrypted and accessed via user accounts with explicit database permissions; ie, superuser vs non-priviledged.
Data requests can be handled with simple or complex SQL queries therefor subsets and relevent data gets distributed while protecting sensitive (non-distributable) informations.
It supports running on a closed LAN or fully networked environment and with or without a multiuser environment.
There are of course, several other RDBMS, but postgresql is open-source.
These strategies apply in several companies that I know
There is an interesting article describing and evaluating several approaches to protect privacy:
MP Armstrong, Rushton G, Zimmerman DL. Geographically masking health data to preserve confidentiality. Stat Med.1999; 18:497–525.
Although focused on health related data, many of the approaches discussed can be relevant in other disciplines.
National Research Council. Putting People on the Map: Protecting Confidentiality with Linked Social-Spatial Data. Washington, DC: The National Academies Press, 2007.
Another good all-round resouce discussing theoretical, ethical and also technological aspects of health related spatial data.
For a large collection of papers discussing methods and implications of handling sensitive spatial data have a look at SEDAC's Selected Documents on Confidentiality and Geospatial Data page.
