Chapter 14 — Privacy foundations | Bachelor's Digital forensics and malware analysis

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 14 — Privacy foundations

Lesson map

Lesson 14 published. Map, example, EX040.

flowchart TD
  N0["Learning outcomes"]
  N1["14.1 Principles"]
  N2["14.2 Minimisation in practice"]
  N3["14.3 Third parties"]
  N4["14.4 Notification"]
  N5["14.5 Access to case data"]
  N6["14.6 Redaction"]
  N7["14.7 Privacy by design"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
  N7 --> EX["Worked example"]
  EX --> Q["Exercise EX040"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["14.1 Principles"]
  N2["14.2 Minimisation in practice"]
  N3["14.3 Third parties"]
  N4["14.4 Notification"]
  N5["14.5 Access to case data"]
  N6["14.6 Redaction"]
  N7["14.7 Privacy by design"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX040"]

[Learning outcomes]
    |
    v
[14.1 Principles]
    |
    v
[14.2 Minimisation in practice]
    |
    v
[14.3 Third parties]
    |
    v
[14.4 Notification]
    |
    v
[14.5 Access to case data]
    |
    v
[14.6 Redaction]
    |
    v
[14.7 Privacy by design]
    |
    v
[Worked example] --> [Exercise EX040]

Learning outcomes

You will (1) apply privacy principles to investigations; (2) minimise data collected; (3) protect third parties' information; (4) balance investigation needs and rights.

14.1 Principles

Common privacy principles include lawful basis, purpose limitation, data minimisation, accuracy, storage limitation and security. Data protection laws in many countries express them in legal duties.

Each principle shapes forensic work. Purpose limitation means data collected for the phishing investigation are used for that purpose only. Minimisation means collecting what the question needs. Storage limitation means case data are deleted when no longer required. The next example shows how minimisation applied in the ws-114 case, where the registrar's request tested it.

14.2 Minimisation in practice

For the ws-114 case, the team needs the workstation image, relevant logs and s.kaur's sign-in records — not her entire mailbox. Where full images are collected, analysis is still limited to what answers the question.

Analysis limits are recorded like any other decision, so a reviewer can see what was examined and what was not. The registrar's request for the whole mailbox, declined in the worked example, shows the principle under pressure: the summary answered the real question with a fraction of the personal data. Keeping the full image but limiting analysis also avoids having to collect again if a new question arises.

14.3 Third parties

The mailbox forwarding rule sent other people's messages outside. Their data are part of the incident; the report mentions the scale (count of forwarded messages) without quoting contents unnecessarily.

The people whose messages were forwarded did nothing wrong, yet their data left the university. Reporting the count, date range and recipient domains lets the security office judge the impact and decide on notification without exposing message contents to more readers. If contents must be reviewed, for example to identify sensitive data, a small authorised group does so.

14.4 Notification

Data breaches involving personal data may require notifying regulators or affected people within set deadlines, depending on law. Forensic findings — what data left, when — inform those decisions.

The forensic timeline gives the dates that notification decisions depend on: when the forwarding rule was created, when it was removed, and how many messages it sent. Uncertainty in these figures is stated, because regulators may ask how the numbers were obtained. Leah's role is to provide accurate facts, while the decision whether to notify belongs to the data protection officer and legal advisers.

14.5 Access to case data

Only investigators assigned to the case can access it; access is logged.

Access logs let the university show who saw personal data and when, which matters if the investigation is later challenged. A colleague who is curious about the case but not assigned to it has no access, even within the security office. At the end of the case, access is removed and the data are kept or deleted under the retention schedule, and the deletion is itself logged with the date and the person who carried it out.

14.6 Redaction

Reports shared beyond the team redact personal details not needed by the reader.

For example, the summary for the registrar gives the number of forwarded messages and recipient domains, not names or subjects. Redaction is checked by a second person, because missing a name in a long report is easy. Leah keeps the unredacted version in the case folder so the full evidence remains available to those entitled to see it, under the same access controls as the rest of the case.

14.7 Privacy by design

Logging systems can be designed to collect what investigations need while avoiding unnecessary personal content.

For the ws-114 case, logging which hosts were contacted and when gave enough to trace the phishing without recording page content. Proxy logs that kept full URLs with query strings would have captured more personal data than needed, such as search terms. Choosing fields at design time is easier than redacting later and reduces what an attacker could steal from the log store. Harrowgate's proxy records host names and sizes, not full URLs.

Data subject requests

People may have rights to ask what data an organisation holds about them. Investigation records can be subject to such requests, with legal exemptions in some cases. Leah notes that clear, factual records make responding easier and fairer, and that the university's data protection officer decides how requests are handled.

Worked example

The registrar asks for a copy of s.kaur's full mailbox "to understand the incident". Grace declines and offers a summary: number of messages forwarded, dates and recipients' domains. That answers the registrar's question with less personal data.

Synthetic case. The request is invented.

Errors and limits

Minimisation must not hide evidence needed to answer the question; justify both what is collected and what is left out.

Exercises

EX040 — Minimal set. What data does the ws-114 case need? Rubric: 3 = workstation image, relevant logs, sign-in records; not whole mailbox; 2 = partial; 1 = everything; 0 = none.
EX041 — Registrar request. How was the mailbox request handled? Rubric: 3 = declined; summary of counts, dates, domains; 2 = partial; 1 = handed over; 0 = none.
EX042 — Notification role. How do forensic findings inform breach notification? Rubric: 3 = establish what data left and when; 2 = partial; 1 = vague; 0 = none.

Synthesis

Collect and share only what the authorised question needs, and let findings guide legal notification duties.

Continue studying — chapter 14 of 40

← Chapter 13 (draft) · Course chapter index · Chapter 15 (draft) →