A field researcher’s notebook usually holds two kinds of maps. The first is the printed shapefile — administrative boundaries, roads, sensor locations. The second is the one drawn in a spiral notebook on a wooden bench in the middle of a village, in blue and red ink, with a small compass mark at the top. This is the map that gets used. It carries the community boundaries the shapefile does not know about, the water source, the shape of the caste hamlets, the two streets that are also alliances.
The second map is also the map that, published as drawn, would tell any local reader exactly which village you were in — even if the report used a pseudonym.
This is a note on a pipeline we built to keep the analytical value of that map while stripping the identifying detail. The design constraint was simple: two different researchers running the pipeline on the same original should produce the same de-identified output. If the anonymisation depends on who is doing it, it is not anonymisation. It is politeness.
What the map carries
The first map carries three kinds of identifying information, each requiring a different treatment.
Named landmarks. Road names, temple names, school names, well names. These are the highest-risk items — a single named landmark can uniquely identify a village. The pipeline strips these first, using inpainting so the strokes underneath the label are reconstructed from surrounding pen texture rather than left as blank patches. A ghost patch is a fingerprint.
Community geometry. The shape of the residential blocks — where each community lives, where the boundaries run, which pen colour was used for which quarter. This is the analytical payload. The pipeline keeps the geometry and the pen colours, because that is what makes the map useful. But it re-labels the blocks by number, in the same hand-drawn style as the original, so nothing on the page names the community out loud.
Landmarks that anchor the village. The temple, the well, the school, the panchayat office. These often stay on the page — an analysis of caste geometry needs to know where the temple sits. But which particular temple this is gets swapped or moved under pre-agreed rules. Some pipelines swap landmark positions between villages in the same block. Others shift each landmark by a small blinded random offset within its neighbourhood. The rule is documented before the anonymisation runs, not chosen during it.
The reproducibility check
The pipeline’s real trick is not any single de-identification step. It is the requirement that two runs produce the same output.
We test this by handing the original map to two researchers, in separate rooms, with identical instructions and identical parameters. If the outputs match, the pipeline is deterministic and the anonymisation is auditable. If they differ, the pipeline has quietly left a decision to the human — and a decision left to a human is a decision that can leak.
This matters because the auditability is what you can defend. A reviewer who asks how did you decide to remove that landmark and not the other deserves an answer that does not start with “well, in the moment…”
What we chose not to do
We chose not to redraw the maps from scratch. A redrawn map loses the field researcher’s hand — the little quirks, the pen pressure, the corrections. Those are part of the record. The pipeline stays as close to the original artefact as possible, and only intervenes on the identifying detail.
We chose not to use full geometric transformation — rotating or mirroring the map. Transformations are traceable if a reader knows what to look for. They also break the intuition of the field researcher, whose analytical work depends on the map still reading as the place they walked through.
And we chose not to publish the de-identified map without a matched-tier disclosure. Every published version says exactly what has been removed and what has been swapped, at what tier. If a reader wants to interrogate the analysis, they know which layer to argue with.
The wider point
Anonymisation of field data is often treated as an ethics-review checkbox — sign the consent form, replace the village name with a pseudonym, publish. That is not anonymisation. That is trust.
For hand-drawn maps, the actual anonymisation happens in the pen strokes, the colour palette, the shape of the community boundaries, and the landmarks that anchor the whole thing. The pipeline is the place where field research meets version-controlled honesty about what has been done to the record before it leaves the room.
If you have a pipeline you use and it does something different — write in. The design gets better every time somebody with a differently-shaped village pushes back on it.