◇ OpenCyber Academy
Engineering · Chapter 35 · English

Chapter 35 — Design studio II

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 35 — Design studio II

Lesson map

Lesson 35 published. Map, example, EX103.

flowchart TD
  N0["Learning outcomes"]
  N1["35.1 The export problem"]
  N2["35.2 Design options"]
  N3["35.3 Critique"]
  N4["35.4 Privacy"]
  N5["35.5 Verification instructions"]
  N6["35.6 Iteration"]
  N7["35.7 Decision record"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
  N7 --> EX["Worked example"]
  EX --> Q["Exercise EX103"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["35.1 The export problem"]
  N2["35.2 Design options"]
  N3["35.3 Critique"]
  N4["35.4 Privacy"]
  N5["35.5 Verification instructions"]
  N6["35.6 Iteration"]
  N7["35.7 Decision record"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX103"]

[Learning outcomes]
    |
    v
[35.1 The export problem]
    |
    v
[35.2 Design options]
    |
    v
[35.3 Critique]
    |
    v
[35.4 Privacy]
    |
    v
[35.5 Verification instructions]
    |
    v
[35.6 Iteration]
    |
    v
[35.7 Decision record]
    |
    v
[Worked example] --> [Exercise EX103]

Learning outcomes

You will (1) design the reporting and export features; (2) critique them with examiners and a defence-expert perspective; (3) balance disclosure and privacy; (4) iterate on feedback.

35.1 The export problem

Courts and defence experts may need custody and acquisition records. The export must be complete, readable and verifiable, while excluding unrelated case data.

A defence expert reviewing a case needs enough to test whether the evidence was handled properly, but other cases handled by the same lab are none of their business, and leaking them could harm other investigations. The design studio frames the task as three properties that must all hold at once. The class then lists what 'complete' means here: every item, every custody event and every acquisition record for that case.

35.2 Design options

Option 1: PDF report generated from records. Option 2: JSON export with a signed manifest. Option 3: both — a readable PDF and the machine-verifiable JSON with matching hashes.

Each option is sketched in one page before any code. The PDF is familiar and prints well but cannot easily be checked by machine. The JSON with a manifest can be verified exactly but is hard to read in a courtroom. The combined option costs more work and raises a new risk, that the two formats could disagree, which the matching hashes are meant to expose.

35.3 Critique

Examiners like PDF for court bundles. A guest playing a defence expert asks for the raw records and the ability to verify the chain independently. Option 3 serves both.

The guest pushes further, asking what stops the lab from producing a PDF that differs from the JSON. Priya's answer is that the PDF prints the hash of the JSON export and the final chain value, so anyone can check that both came from the same records. The critique also raises page count; a long custody history is moved to an appendix so the main report stays short.

35.4 Privacy

Exports include only the case's items and events. Personal details of staff beyond names and roles are excluded.

Staff home addresses, phone numbers and internal notes about workload have no role in establishing custody, so the export filter removes them. The rule is written as an allow-list of fields rather than a block-list, so a field added later stays out until someone decides it belongs. A test builds an export from a case with deliberately sensitive extra fields and checks none of them appear in either format.

35.5 Verification instructions

The export includes a short text explaining how to recompute the chain with any SHA-256 tool, so verification does not depend on EvidenceDesk.

The instructions explain the canonical form, give the command to hash one entry, and show the first two links worked through with real values. A defence expert with a standard laptop can reproduce the chain in an afternoon. Priya tests the text by handing it to a classmate who has never used EvidenceDesk; their questions lead to two clarifications about line endings and character encoding.

35.6 Iteration

The first PDF prints times in local zone without saying so; critique catches it. Version two prints UTC with a label.

Ambiguous times matter in court because the order of events can be contested, and an hour's offset during a daylight-saving change could make a seizure appear to follow its own examination. The fix touches the PDF template, a test asserting every printed time carries a zone label, and the export guide. Priya notes that the JSON already used UTC, so the error lived only in the human-readable layer.

35.7 Decision record

Decision: dual export; reason: readability plus independent verifiability; rejected: PDF only (cannot verify), JSON only (hard for courts to read).

The record also notes the conditions that would reopen the decision: a court rule requiring a specific export format, or evidence that defence experts are not using the JSON. It names who made the decision and when, and links to the critique notes. Writing down rejected options stops the same debate from restarting each year with new staff who were not in the room.

Redaction

Sometimes an export must omit details, such as a victim's address in an item description. Redaction is recorded as an event with a reason and approver; the export marks where text was withheld, and the unredacted original stays in the record. Verification still works because the manifest covers the redacted export as produced, while the full chain stays available to the court if ordered.

Worked example

The guest expert recomputes the chain from the JSON export using a command-line tool on her own laptop. The final link matches the manifest. She notes this would answer most challenges to custody records.

Synthetic case. The guest exercise is invented.

Errors and limits

Verifiable exports show records were not altered; they do not show the original entries were truthful.

Exercises

Synthesis

Exports should be readable, verifiable without your software, privacy-respecting and explicit about time.

Continue studying — chapter 35 of 50

← Chapter 34 (draft) · Course chapter index · Chapter 36 (draft) →