## 1. Introduction

When survey questions are asked about sensitive topics, respondents might be reluctant to provide a direct honest answer. To deal with this situation, Warner (1965) introduced randomized response (RR). This is an interview design where the observed answer to a question depends on the true status with respect to the topic as well as on a specified probability mechanism. The basic idea of RR is, first, that the probability mechanism protects the privacy of the respondent, and, second, that statistical inference is possible by incorporating the probability mechanism in the statistical model. Meta-analysis has shown that RR produces better prevalence estimates than other survey designs that deal with sensitive topics (Lensvelt-Mulders *et al.*, 2005).

The forced response design that was introduced by Boruch (1971) is an illustrative example of RR. In this design, a question is asked that requires a *yes* or a *no* as an answer. Instead of answering the question directly, the respondent throws two dice without revealing the sum of the dice. Next, the respondent follows a design: if the sum is 2, 3 or 4, the respondent answers yes. If the sum is 5, 6, 7, 8, 9 or 10, he answers the question truthfully. If the sum is 11 or 12, he answers no. Since the sum of the dice is hidden, the interviewer does not know whether the answer was forced by the design or provided truthfully. In this way, the privacy of the individual respondent is guaranteed.

The forced response design is a misclassification design. If we name the true status with respect to the question *latent*, then we can define and deduce conditional misclassification probabilities such as , i.e. the probability of answering no in the RR design conditional on a true yes status. These probabilities are used to define the statistical model for the RR data.

It may not come as a surprise that some respondents do not follow the design when participating in an RR survey (Fox and Tracy, 1986; Clark and Desharnais, 1998; Böckenholt and Van der Heijden, 2007). We define *cheating* as the act of providing the least stigmatizing answer irrespectively of the outcome of the RR probability mechanism. In the forced response design, for example, answering no while the sum of the dice is 2 is cheating. There may be more than one reason for cheating. If a respondent does not understand the way that privacy is protected, he or she might be reluctant to co-operate. Likewise, general lack of trust with regard to the institute that conducts the survey may also induce cheating. Because of the way that RR works, cheaters cannot be identified. At the same time, it is clear that cheating causes extra perturbation that has to be taken into account in the model to obtain valid statistical inference.

Clark and Desharnais (1998) discussed cheating in a design with one RR question. They suggested using two samples where in each sample the same RR question is asked with different conditional misclassification probabilities. By combining the two samples, an RR model that takes cheating into account can be estimated. Inspired by the idea of using two samples, we propose a model to estimate cheating in a dual sampling scheme where a direct questioning (DQ) design and an RR design are applied to the same set of questions. The combination of the two designs provides information that is not obtainable by either design alone: we can estimate cheating simultaneously in both settings.

Our model is different from that in Clark and Desharnais (1998) since the latter is formulated for two differently specified RR designs with the assumption that the two designs induce the same level of cheating. Our model allows for different levels of cheating in the two designs. In addition, we relate the levels of cheating to individual covariates. The result is a general model that incorporates the model in Clark and Desharnais (1998) as a special case. Cruyff *et al.* (2007) investigated cheating by using a restricted log-linear model for RR data (no dual sampling scheme). The latter model can also been seen as a restricted version of our model.

In what follows, Section 2 describes the motivating data and Section 3 presents the models. In Section 4 identifiability is discussed and in Section 5 we compare our model with the model in Clark and Desharnais (1998). Section 6 analyses the data and Section 7 concludes the paper.