Privacy and accountability for location-based aggregate statistics