In this thesis we present a critical analysis of the system-wide anonymity metric by Edman et al. [1], which is based on the permanent value of a doubly-stochastic matrix. From the view of intuitive understanding, we show that a metric that looks no further than the permanent, a composite value, is at best a rough indicator of anonymity, We find the range where its inaccuracy is acute, and propose a better anonymity indicator. Also, we show that this metric fails to possess desirable generalization properties by constructing an information-preserving embedding of a smaller class of attacks into the wider class for which this metric was proposed. Finally, we show a new general, accurate anonymity metric that does not exhibit these shortcomings.