OpenCyber AcademyDay 44 — Minimize a privacy referral without neglecting preservation
Objective. Ask five decision-changing questions about C31–C33, distinguish technical preservation from a legal hold, and leave classification/notification to authorized owners. Complete EX044.
Technical teaching. A bounded evidence request begins with an explicit purpose. The question “did this particular batch reach a gateway stage?” might be answerable using batch IDs, dispatcher records, source health and transaction timestamps. It may not require mapping any pseudonymous token to a real person. Mapping is a different processing activity, requiring the privacy steward to define need, permission, selected fields, custody and retention. C32 opened an assessment; it did not create blanket mapping rights. A metadata preservation request is not itself an authenticated collection, and a concern about expiring logs is not a legal hold imposed by the analyst.
NIST's Privacy Framework and its explanation of roles in the data-processing ecosystem offer primary risk-management references. Neither determines whether CTN is regulated in a particular country, which notice threshold applies, whether a contract requires reporting or whether 12 pseudonyms identify people. NIST SP 800-86 supplies forensic background but is not jurisdiction-specific legal advice.
Worked example: five questions, each with an owner and evidence boundary.
Lesson table; scroll horizontally to read all columns →
| Decision question | Minimum useful proposed evidence | Who may decide or provide it |
|---|---|---|
| What exactly did C33 test? | Internal queue-state definition, batch identifier, event/filter range, data quality and copy receipt | Queue custodian; cannot infer all other paths |
| Does a gateway receipt correlate with the batch? | Authenticated gateway/dispatcher records, join semantics, source completeness and exact 10:49–10:51 gap | Source custodians under bounded approval; unknown remains unknown if gap persists |
| Is token-to-person mapping necessary? | Named assessment purpose and minimum fields, access/retention conditions | Privacy steward; no automatic bulk export |
| Which sources risk expiry? | Verified retention and preservation mechanism, scope, custodian and receipt | Authorized records/source custodian; legal-hold decision reserved |
| What formal notification/preservation duties apply, if any? | Actual governing law, entity role, contracts, verified facts and decision record | Authorized privacy/legal/contract owner; analyst cannot declare a universal time clock |
A good source request states proposed versus received, names collection authorization and records what remains unknown. The external gateway gap is a reason to seek a discriminating independent source, not proof of dispatch or of its absence. A contact-list dump would create another sensitive artifact without necessarily testing the missing event.
Worked rejection. “Twelve tokens mean twelve learners were breached, so export all contacts and notify them within 72 hours” invents identity, impact, jurisdiction, deadline and authority. The professional action is to preserve minimal available technical records through the correct custodian and obtain a separate accountable legal/privacy determination.
Independent practice. Write EX044's five-question referral; for each state purpose, scoped source, owner, missing evidence and what conclusion is prohibited. Add an explicit “no mapping or legal notice without authorization” line. Artifact: referral and preservation-request boundary, not collection or legal advice. Rubric 0–2: 2 for five testable minimal requests and delegated determinations; 1 for good questions but uncontrolled fields; 0 for a claimed legal duty, disclosure or approved contact export. See worked answer.
Continue studying — Day 44: ← Day 43 · Course index · Day 45 →
Exercise for this lesson
EX044 — Privacy referral. Inputs: C31–C33. Produce a five-question, privacy-limited referral to the steward that distinguishes queue status, gateway evidence, mapping need, retention and decision authority. A 2-point result does not itself decide a legal duty or request a full contact-list export.