Chapter 4 — Advanced risk and ethics
Lesson map
Lesson 04 published. Map, example, EX016.
flowchart TD
N0["Learning outcomes"]
N1["4.1 Latent, irreversible risk"]
N2["4.2 Forge-later and systemic risk"]
N3["4.3 Obligations to data subjects"]
N4["4.4 Dual use and disclosure"]
N5["4.5 Residual-risk acceptance"]
N6["4.6 Worked case"]
N7["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
N7 --> EX["Worked example"]
EX --> Q["Exercise EX016"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["4.1 Latent, irreversible risk"]
N2["4.2 Forge-later and systemic risk"]
N3["4.3 Obligations to data subjects"]
N4["4.4 Dual use and disclosure"]
N5["4.5 Residual-risk acceptance"]
N6["4.6 Worked case"]
N7["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX016"]
[Learning outcomes]
|
v
[4.1 Latent, irreversible risk]
|
v
[4.2 Forge-later and systemic risk]
|
v
[4.3 Obligations to data subjects]
|
v
[4.4 Dual use and disclosure]
|
v
[4.5 Residual-risk acceptance]
|
v
[4.6 Worked case]
|
v
[Synthesis]
|
v
[Worked example] --> [Exercise EX016]
Learning outcomes
You will (1) quantify quantum risk with scenario-based exposure measures; (2) handle risks with long latency and irreversible harm; (3) analyse ethical obligations to data subjects whose harm outlives the organization's horizon; (4) navigate dual-use and disclosure questions at specialist level; and (5) document residual risk acceptance properly.
4.1 Latent, irreversible risk
Harvest-now-decrypt-later (HNDL) risk is latent: the loss event (collection) may already have happened, and the harm (decryption) happens later and cannot be undone. Standard risk registers, built for events with immediate detection and recovery, misrepresent it. Represent HNDL as exposure accumulated per year: the volume of long-lived data crossing interceptable links under classical key exchange each year, weighted by harm, under each timeline scenario. Each year of delay adds a year's exposure that no later migration removes.
For NRHT the genomics link shows the pattern: 20,000 records a year cross it under classical key exchange, and each year adds to what an interceptor might already hold. Report this exposure by year and scenario in the risk register, and say plainly that past exposure cannot be reduced by later migration.
4.2 Forge-later and systemic risk
Forge-later risk depends on trust anchors and update channels. A forged code-signing key for a widely deployed medical device could affect patient safety across many hospitals simultaneously; the risk is systemic, not local. Specialists should identify trust anchors whose compromise has correlated effects and prioritise their migration or compensating controls, such as multiple signatures or hardware-bound verification keys that can be rotated.
At NRHT the infusion pump fleet is the clearest example: its firmware is verified with an RSA signature by a boot ROM that cannot change. A forged signature would affect every pump at once. List such trust anchors separately in the register, with the number of devices and sites that depend on each.
4.3 Obligations to data subjects
A patient's genomic data reveals information about relatives and remains sensitive for generations. The organization's planning horizon (budget cycles, contracts) is shorter than the harm horizon. Ethically, the people bearing the risk — patients — are not party to the decision, which strengthens the duty of care. Specialists should insist that harm horizons, not organizational retention schedules, set x for such data, and that minimization (Chapter 5) is considered before cryptographic controls.
For genomic data this means setting x at around 50 years even if the retention schedule is shorter, because copies held by others do not follow NRHT's schedule. Record this reasoning in the privacy impact assessment. Where possible, involve patient representatives in decisions about data that affects relatives.
4.4 Dual use and disclosure
Organization-scale inventories are maps of weakness. Restrict access, publish only aggregates, and treat vulnerability reports from suppliers under coordinated disclosure. Active testing of negotiation, downgrade or fault behaviour belongs in isolated, authorized testbeds; a specialist who directs others is responsible for ensuring those boundaries are written down.
Write down who may see the full inventory and who receives only aggregates, and review the list each year. Testing in isolated environments should be approved in writing with a named owner and an end date. A supplier report of a weakness is handled under agreed disclosure, with the supplier told before anything is published.
4.5 Residual-risk acceptance
When a risk cannot be reduced in time — a legacy imaging modality that cannot be upgraded — the accountable executive accepts it formally: scope, rationale, compensating controls, expiry date and review trigger. Acceptance without expiry becomes permanent by default.
Record each acceptance in the residual-risk register with the accountable executive's name and the date. Review it before expiry; if the risk still cannot be reduced, the executive must accept it again with a new date. At NRHT's year-two review six acceptances had passed expiry without review, which led to automatic escalation.
4.6 Worked case
NRHT's genomics service sends 20,000 records a year to an external research partner over a TLS link with classical key exchange. Exposure framing: every year adds 20,000 lifetime-sensitive records to what an interceptor could hold. Ethical framing: the harm horizon is ~50 years and includes relatives. Decision: migrate this link to hybrid key exchange within three months, reduce data sent by moving analysis to a trusted research environment, and record that prior years' transfers remain exposed — a residual risk the board formally accepts with a note in the privacy impact assessment.
4.7 Common errors and limits
- Scoring HNDL like an ordinary incident with immediate impact.
- Letting retention schedules define harm horizons.
- Risk acceptances without expiry.
Each error has a guard. Represent harvest-now-decrypt-later as yearly exposure that cannot be removed later. Set x for each dataset from the harm horizon, not from retention. Give every acceptance an expiry date and a named reviewer, and escalate automatically when one passes. At NRHT the genomics link was recorded as yearly exposure with a 50-year horizon, and the acceptance for earlier transfers was noted in the privacy impact assessment with a review date. Use that entry as a model for others.
Exercises
- EX016 — Exposure accumulation. If migration of the genomics link is delayed by 18 months, how many additional records are exposed? Rubric: 3 = 30,000 with reasoning.
- EX017 — Systemic anchor. Identify two NRHT trust anchors with correlated failure effects. Rubric: 3 = two plausible anchors with explanation.
- EX018 — Acceptance form. Write a residual-risk acceptance for a legacy MRI scanner with RSA-only firmware verification. Rubric: 3 = scope, rationale, compensating controls, expiry, trigger.
- EX019 — Ethics argument. Argue in five sentences why patients' harm horizon should set x. Rubric: 3 = non-party bearing risk, irreversibility, duty of care.
- EX020 — Access control for inventory. Define who may see the full CBOM and why. Rubric: 3 = least privilege, aggregate reporting, audit.
Synthesis
Quantum risk is latent, irreversible and sometimes systemic. Specialists express it as accumulated exposure, set horizons by harm to data subjects, guard inventories as sensitive and make residual-risk acceptance explicit and time-limited.
Continue studying — chapter 04 of 12
← Chapter 03 (draft) · Course chapter index · Chapter 05 (draft) →