A field researcher’s notebook usually holds two kinds of map. The first is the printed shapefile, with administrative boundaries, roads and sensor locations. The second is drawn in a spiral notebook on a wooden bench in the middle of a village, in blue and red ink, with a small compass mark at the top. The second one is the map people use. It shows the community boundaries the shapefile does not know about, the water source, the layout of the caste hamlets, and the two streets whose households are also political allies.
Published as drawn, that second map would also tell any local reader exactly which village you were in, even if the report used a pseudonym.
This note describes a pipeline we built to keep the analytical value of that map while removing the identifying detail. The design constraint was that two different researchers running the pipeline on the same original should get the same de-identified output. If the result depends on who does the work, the map has not been anonymised in any reliable sense, and its safety rests on individual discretion.
What the map carries
The hand-drawn map carries three kinds of identifying information, and each needs a different treatment.
Named landmarks. These are the names of roads, temples, schools and wells. They carry the highest risk, because a single named landmark can identify a village on its own. The pipeline removes them first. It uses inpainting, so the strokes under each label are rebuilt from the surrounding pen texture instead of being left as blank patches, since a blank patch can itself identify the source.
Community geometry. This is the shape of the residential blocks: where each community lives, where the boundaries run, and which pen colour was used for which quarter. It is what the analysis needs. The pipeline keeps the geometry and the pen colours, because they are what make the map useful. It relabels the blocks with numbers, written in the same hand-drawn style as the original, so that nothing on the page names a community.
Landmarks that anchor the village. These are the temple, the well, the school and the panchayat office. They often stay on the page, because an analysis of caste geography needs to know where the temple is. What changes is which temple it appears to be, under rules agreed in advance. Some pipelines swap landmark positions between villages in the same block. Others move each landmark by a small, blinded random offset within its neighbourhood. The rule is written down before the anonymisation runs, and nobody chooses it while the work is under way.
The reproducibility check
The most important feature of the pipeline is the requirement that two runs give the same output. No single de-identification step matters as much.
We test this by giving the original map to two researchers in separate rooms, with identical instructions and identical parameters. If their outputs match, the pipeline is deterministic and the anonymisation can be audited. If they differ, the pipeline has left a decision to a person without saying so, and a decision left to a person is one that can leak information.
Auditability matters because it is what you can defend. A reviewer who asks how you decided to remove one landmark and keep another deserves an answer that does not begin “well, in the moment…”.
What we chose not to do
We chose not to redraw the maps from scratch. A redrawn map loses the field researcher’s hand: the small quirks, the pen pressure, the corrections. These are part of the record. The pipeline stays as close to the original as it can and changes only the identifying detail.
We chose not to transform the whole geometry by rotating or mirroring the map. A reader who knows what to look for can trace such transformations. They also disrupt the field researcher’s sense of the place, and their analysis depends on the map still matching the village they walked through.
We also chose not to publish any de-identified map without a disclosure at the matching tier. Every published version states exactly what has been removed and what has been swapped, and at which tier. A reader who wants to question the analysis knows which layer to question.
The wider point
Anonymising field data is often treated as a box to tick in ethics review: sign the consent form, replace the village name with a pseudonym, publish. That approach depends on trusting that nobody will recognise the place, and it does little to prevent recognition.
For hand-drawn maps, the anonymisation happens in the pen strokes, the colours, the shape of the community boundaries, and the landmarks that anchor the whole map. The pipeline is where field research meets a version-controlled record of everything done to the map before it is shared.
If you use a pipeline that does something different, please write in. The design improves each time somebody working with a differently laid-out village tells us where it falls short.