Chapter 46 — Engineering capstone II | Engineering Privacy and data protection

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 46 — Engineering capstone II

Lesson map

Lesson 46 published. Map, example, EX136.

flowchart TD
  N0["Learning outcomes"]
  N1["46.1 Building"]
  N2["46.2 Verification"]
  N3["46.3 Evaluation with researchers"]
  N4["46.4 Reflection"]
  N5["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5
  N5 --> EX["Worked example"]
  EX --> Q["Exercise EX136"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["46.1 Building"]
  N2["46.2 Verification"]
  N3["46.3 Evaluation with researchers"]
  N4["46.4 Reflection"]
  N5["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> Q["EX136"]

[Learning outcomes]
    |
    v
[46.1 Building]
    |
    v
[46.2 Verification]
    |
    v
[46.3 Evaluation with researchers]
    |
    v
[46.4 Reflection]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX136]

Learning outcomes

You will (1) build the research data service; (2) verify it against acceptance criteria; (3) evaluate it with researchers.

46.1 Building

Zara builds the service in three months. Analyses run as approved query templates inside an isolated environment. The output checker blocks counts below ten and applies differential privacy to published outputs using the study's budget. The consent service supplies opt-outs at each run. Study approvals carry expiry dates checked at query time. She implements the system with small, tested components and reuses the privacy platform where possible, which shortens development and means that improvements to shared components also benefit the research service.

46.2 Verification

Zara runs the planned tests. All pass except one: an expired study can still run if its expiry date was set in a different time zone format. She fixes the date handling and reruns. The independent classmate attempts reconstruction by issuing overlapping queries within the budget. The attack recovers no individual's data, because each output is noisy and the budget stops further queries. She records all results in the evidence folder, including the initial failure, so the record shows exactly how the acceptance criteria were met.

46.3 Evaluation with researchers

Three researchers use the service for a pilot study on follow-up consultations. They find the template approach restrictive but workable. They ask for one more template type, which Zara adds after review. The national figures for rare conditions are useful, though less timely than they wanted. She records their feedback. The evaluation confirms that the service supports real analysis without record-level access, which is the capstone's central claim, while also showing the limits that remain for exploratory research. Their feedback is recorded verbatim.

46.4 Reflection

Zara reflects on the capstone. The hardest problems were not algorithms but edge cases: time zones, caching and opt-out timing. Independent review and testing found them before they harmed anyone. She notes that the service will need monitoring for budget use, opt-out synchronisation and template changes. Prof. Holm comments that her capstone shows mature engineering because she chose a narrow scope, verified it thoroughly and was honest about the limits that remain for researchers who want more flexibility. She documents what the scope deliberately excluded.

Worked example

Zara builds the service with templates, output checks and budgets, fixes an expiry time-zone bug, withstands a reconstruction attempt and evaluates it with three researchers.

Synthetic case. The service, tests and researchers are synthetic.

Errors and limits

Template systems can be extended unsafely; review each new template.

Exercises

EX136 — Expiry bug. What test failed in verification? Rubric: 3 = an expired study could run due to a time-zone date format;; 2 = mentions expiry;; 1 = vague;; 0 = none.
EX137 — Attack result. What did the reconstruction attack recover? Rubric: 3 = nothing about any individual, because noise and the budget stopped it;; 2 = nothing, without the reason;; 1 = partial;; 0 = no answer.
EX138 — Researcher view. How did researchers judge the template approach? Rubric: 3 = restrictive but workable; asked for one more template;; 2 = mentions restriction;; 1 = ideal;; 0 = none.

Synthesis

Chapter 46 delivers the capstone. Chapter 47 tests failure and recovery.

Continue studying — chapter 46 of 50

← Chapter 45 (draft) · Course chapter index · Chapter 47 (draft) →