Four views are not a complete audience

Lesson map

Lesson 11. Map, example, EX057.

flowchart TD
  L["Activity log, four outside views"] --> H["Three match a hospital domain"]
  L --> P["One is the patient's forwarded view"]
  H --> Q{"Does a domain equal every later copy?"}
  P --> Q
  Q -->|No| K["The audience stays these four lines"]

A domain match is not a census of copies.

Logical drawing

window in prose: January to April
outside views:   4
hospital domain: 3
patient's view:  1
unknown address: none among those four
not stored:      IP, person name, copy count beyond the log

Learning outcomes

After this chapter, you should be able to:

1. Repeat the four-view extract without adding recipients.
2. Separate a domain string from a person's identity.
3. Refuse a side-channel finding and a zero-trust score.

11.1 The log's four lines are the audience that was written down.

The activity log says the folder was set to anyone-with-link in January, when a colleague shared one letter with a hospital. Four outside views are recorded. Three match the hospital's domain. One is the patient opening a link that had been forwarded. No fourth category, an unknown address, appears among those four. Leila judged the risk low from that extract. Mark, as data controller, makes the notification decision. His decision is a log entry, not a field in lab_sharing.py.

Matching a mail domain does not identify which employee opened the letter, and a later forward from that inbox is invisible to this export. Calling the extract closed would invent recipients the page never listed. Clock time stops at the April afternoon, and neither a network address nor a patient's name was copied onto this page.

Ristenpart, Tromer, Shacham, and Savage (2009) describe cross-tenant information leakage on shared machines. That class is not what a sharing token measures. Oakfield recorded no such finding. The clinic does not operate the machine under the storage service, and this chapter does not describe a measurement. SP 800-207 describes authorization of each request. An open link is not that architecture, and the clinic did not adopt the publication as a scored design.

11.2 Worked example

Lesson table; scroll horizontally to read all columns →

Synthetic case. The hospital and the patient stay unnamed.

Errors and limits

Do not turn the low-risk judgement into a claim that every copy was found.

Apply

• EX057 — Bounded audience. A note says the four views prove no further copy exists, names a side-channel finding, and says the clinic implemented SP 800-207. What can be kept?
  Show marking criteria

  Rubric: 3 = keep four views, three hospital-domain and one patient, with no unknown address among those four; reject the complete-audience claim, the finding, and the architecture score; Mark still decides notification;; 2 = keep the four lines and reject the extras;; 1 = one line;; 0 = none.