The Resolution Layer

This case is not “disaggregation is surveillance,” and it is not “the census sells your data.” Both die on the evidence — Statistics Canada’s own red-team shows a rounded table mostly resists reconstruction, and its cost-recovered services recover cost, not profit. The real case is a logical structure, held exactly: disaggregation reveals harms that invisibility hides (true), and disaggregation also builds identity-linked legibility (also true) — two independent costs, borne by one population, with no synthesis that zeroes either. The Laundering is the move that treats proof of the first as if it had answered the second. This case is built on firsthand record on both sides, and its whole discipline is the refusal to let one truth stand in for the other.

§01 — The two propositions

State the structure before any evidence, so that no later page can smuggle a substitution past you.

• P1 Disaggregation can reveal harms that aggregate statistics conceal.
• P2 Disaggregation can also create richer identity-linked datasets — useful for governance, administration, profiling, resource allocation, research, or surveillance.
• P3 The existence of P1 does not eliminate P2.
• P4 Evidence that proves P1 does not settle P2.

These are two truths, not two ends of a scale; neither cancels the other. The Laundering lives in P4: the move by which evidence for the protective proposition is deployed as if it had retired the exposure proposition. It is the false-confirmation structure of Case 20 — a claim returning as its own confirmation — except here the case refuses the move. The claim is “disaggregation is justified because it reveals harm.” The echo is “…therefore the exposure concern is answered.” It is not. P4 is the spine, and everything below is held to it.

Counter: when a true premise is offered, ask exactly which conclusion it licenses — and which other one it is being used to wave away.

§02 — What invisibility cost

Concede P1 completely, without hedge — because the cost of invisibility here is not abstract. When the official health data carries no ethnicity field, a specific harm can stay uncounted, and therefore deniable. The Standing Senate Committee on Human Rights heard exactly this: Canada does not routinely collect data on sterilization procedures, including the ethnicity of the patients — so the forced and coerced sterilization of Indigenous women could not be seen in the official numbers at all.

The count that exists was assembled not by the system but by counsel. The lawyer Alisa Lombard told the committee her firm had been contacted by more than 100 Indigenous women who alleged they were pressured into sterilization between 1970 and 2018, the Saskatchewan class action at its centre. The record behind it is long and documented: provincial Sexual Sterilization Acts in Alberta (1928) and British Columbia (1933), not repealed until 1972 and 1973; the historian Karen Stote’s finding of roughly 1,150 Indigenous women sterilized in federally run “Indian hospitals” into the early 1970s; and the United Nations Committee Against Torture, in 2018, calling on Canada to end the practice. The harm stayed legible only because women came forward — not because the data showed it. Invisibility has a body count, and this case grants P1 in full.primary

Counter: “we don’t collect that field” is never neutral. Ask what cannot be seen, and who pays for the blindness — and then hold that this concession is exactly what makes the next proposition serious, not paranoid.

§03 — The linkage program

Now the other proposition, and its mechanism. Statistics Canada has combined personal records since 1986, under a Directive on Microdata Linkage that concedes the method “is privacy intrusive,” because a person’s information is “being put together in a manner that is generally unknown to the individual,” justified by a public-good balancing test the agency administers itself. Canada Revenue Agency tax records flow into named linked files — the Intergenerational Income Database, the employer–employee file. The data is placed by mandate, not by consent in any meaningful sense.

And the agency red-teams itself in public: the evidence that follows is drawn from its own 2022 symposium proceedings — a published admission against interest, not a leak. Nearly every load-bearing claim about P2 below is the agency’s own.primary

§04 — The de-identification move

Before a linked file moves, it is de-identified — and here the case grants the protection in full. De-identification is an administrative designation layered on real technical measures: random rounding (a true cell value of 3 published as 5, or as 0), cell suppression, sometimes synthetic data, and analysts sworn as deemed employees under criminal penalty. At the single-source tier this is genuine protection — the next section proves it on the agency’s own numbers, and does not overstate it.

But notice what de-identification is for. It is the step that lets the data move — to researchers, to other departments, into published tables under an open licence — while wearing a new institutional pedigree that changes the access and disclosure regime around it. The safeguard is also the passport. This is the inversion Case 20 names: the protective step is the enabling step.

Counter: ask what a safeguard enables, not only what it prevents. De-identification both protects the respondent and makes the file shareable — the same operation, read from two ends.

§05 — The red-team

This is where the case earns the right to be believed: by reporting the evidence against its own dramatic version — the P4 discipline turned on itself. The agency’s researchers reconstructed synthetic census tables with a Boolean-satisfiability solver and measured the match rate — the fraction of true records the reconstruction recovered.

Read it honestly. On the rounded tables, reconstruction barely clears chance — and the authors say so: the reconstructed rate is “not substantially” above the coincidental one, which “suggests that many of the reconstructed matches might be accidental.” Only on the unrounded tables did matching reach ~90%, from which they conclude “random rounding is to some degree successful in hindering a reconstruction attack.” Even an intruder who knows every record but one is mostly stopped: a missing age is recovered about half the time, gender about 75% (against a 50% coin-flip), marital status about 25%. The honest headline: the published table, by itself, mostly does not reverse. Any write-up that says “you can de-anonymize the StatCan table” dies on this page.primary

Counter: a safeguard that works against the single-source attack is real. Hold that — then ask the question the single-source test cannot: what happens when the table is not used by itself?

§06 — The bounded intruder

Classical disclosure control rests on one assumption, and the agency’s own paper states it plainly enough to retire it. The math assumes an attacker holds the published tables plus bounded external information. The paper concedes the bound does not hold. Its measures, it writes, “are not able to provide any strict mathematical guarantee against disclosure, especially when considering the overall risk of all information being combined.” And an intruder “may also have access to commercial or administrative databases which could be cross-referenced … for the purposes of re-identification of individuals.” That is the mechanism of P2, in the agency’s own words.

The environment — broker files, electoral rolls, breach corpora — is not bounded, and it grows. The forward edge: training-data-scale memorization in large language models is a new, effectively unbounded external channel the bounded-intruder framework never anticipated — carried here as an extension, not an established finding, because the structural case does not need it.claim The framework was designed for a world that no longer exists.

Counter: a guarantee with an assumption is only as strong as the assumption. Ask what external information the safeguard assumes the attacker lacks — then ask whether, in 2026, anyone lacks it.

§07 — The capability layer

Follow the access, not a profit motive — because there isn’t one. Statistics Canada’s cost-recovered services recovered about $121.6 million in full cost in 2017–18 (precisely $121,576,584), and the rates are set, in the audit’s words, to “recover but not exceed full cost.” So the dramatic line — “Statistics Canada sells your confidential data” — is false, and this case drops it.

But do not reach for the comfortable line either. The same audit records where its paying clients were least satisfied: access to data prior to release — the lowest-scoring item in its client survey, with only 53.3% satisfied (8 of 15 respondents). The friction is not over price; it is over getting at figures before the public does. And the agency’s own management response concedes the shape of it: the Policy on Official Release “makes allowances for cost-recovery clients to have access to anonymized pre-release aggregated data,” and “inherent to increased pre-release access … is the risk of information being inadvertently divulged prior to official release.” That is the resolution layer in the agency’s own words, with its own conceded risk: paying clients pressing for earlier, privileged access to not-yet-public figures, and the agency naming the divulgence hazard as it weighs whether to widen the door. Whether that is efficiency or routing-around is the fair question — raised, not answered.primaryclaim

Counter: “we only produce public statistics” is not quite what the record says. Ask who gets the numbers before they are public — and what the agency itself says that access risks.

§08 — Why P4 holds

Now name the substitution the case refuses, and why it fails. The move is: “disaggregation reveals harm (true), therefore the exposure concern is answered (does not follow).” It is tempting precisely here, because the evidence for P1 is overwhelming — the Senate sterilization record is about as powerful as evidence gets, since the cost of invisibility in that case was a body count.

But that magnitude does not discharge P2 — it raises it. The same identity field that would have surfaced the sterilizations is the field that makes a person legible to everything else. High stakes on the left do not lower the stakes on the right; they are the same stakes, borne by the same population, at both ends. There is no exchange rate between “seen, and therefore protected” and “seen, and therefore exposed.” The honest position holds both, refuses to net them, and declines to draw the arrow that would let either one disappear.

Two costs. One population. No synthesis that zeroes either.

§09 — The resolution layer, named

Strip it to the structure. Statistics Canada is not a leak and not a vault. It is a resolution layer: it adds probabilistic resolution to an environment already made identifiable by keys it does not hold and largely did not build. No one decided “let us sharpen the broker ecosystem.” The disaggregation protocol, run for the defensible reasons §02 makes undeniable, produces the resolution effect when it meets a data world the agency does not control — convergent exposure without coordinated intent. The disclosure-control orthodoxy, the equity mandate, and the broker ecosystem each behave correctly by their own lights; the integration is the cost, and “they each meant well” does not retire it.

It sits beside Vol. I · Case 10 · The Index — measurement laundering, here on the disclosure-control side — shares Case 20’s discipline but inverts its picture (there the arrow loops and closes; here the integrity is in refusing to close it), and runs the colonial-legibility axis of Case 03. Read the sentence-level moves in The Grammar of the Con; the de-nominalization counter here is the two propositions kept apart — what the disaggregation reveals, and what it resolves, and the refusal to let the first answer for the second.

Not a leak, not a vault — a resolution layer. The equity mandate sharpens the resolution most on the very people it means to make visible.