Privacy-protection building blocks in the experimental prototype
Development status: Experimental implementation exists — An experimental implementation exists; this page describes the intended public developer capability. A prototype library of privacy-accounting, access-control and tamper-evident logging components exists for internal testing; several of its protections are simulated, and these components provide no privacy or confidentiality protection today. Nothing is publicly available for live use.
Before you read: Privacy and confidentiality: intent and current limits.
Which privacy-related components exist in the experimental prototype, and how protective are they? A prototype library with three categories of privacy-related components exists for internal testing. The short answer to the second half of the question is that they are not protective: they provide no privacy or confidentiality protection today. This page names the categories, explains why their names and outputs must not be read as guarantees, relates each category to the intended capability it touches, and sets out what would have to be true before anyone could rely on them.
Why this page exists
- Readers reviewing the project may come across privacy-related components and assume that they protect data. This page states what they are, and how little protection they provide today.
- It describes categories and status only, not how the components work.
- It complements Known limitations of the experimental prototype rather than repeating it.
Component categories
Status of this section: Experimental implementation exists — internal testing only; several protections are simulated, and none provides protection today.
Table: categories of privacy-related components in the prototype library, what each is intended to do and its status today.
| Category | What it is intended to do | Status today |
|---|---|---|
| Privacy accounting | Keep track of how much information about data has been released by analyses | Prototype for internal testing; provides no protection |
| Access control | Decide who may access protected information | Prototype for internal testing; provides no protection |
| Tamper-evident logging | Record events so that later changes to earlier entries could be detected | Prototype for internal testing; provides no protection |
- A tamper-evident audit log component exists in an internal prototype. Tamper-evident means that later changes could be detected, not that they are prevented.
- Several of the library’s protections are simulated. Which ones, and how, is not described.
- The library exists for internal testing and is not available to developers.
How protective are they today?
- Not protective. They provide no privacy or confidentiality protection today.
- Simulated protections are not protections. A simulated protection imitates the shape of a protection without providing it. Its outputs are not evidence of protection.
- Names are not properties. Component names describe intended purposes, not achieved properties. No privacy guarantee of any kind is claimed for them.
- Not reviewed. They have not been independently reviewed.
Treat anything these components produce as test output, not as a record that something was protected.
How the building blocks relate to intended capabilities
- Access control relates to the intended visibility controls described on Visibility controls and selective disclosure. The experimental prototype provides no access-controlled data.
- Tamper-evident logging relates to the intended audit trails described on Audit trails and tamper-evident logging.
- Encrypted computation is covered elsewhere: the simulated encrypted-computation interfaces are described separately on Confidential computation.
These relationships are conceptual. The components are not the intended capabilities themselves, and the existence of a component does not mean that the capability it relates to exists in any form.
What reliance would require
Before any of these components could be relied on, at least the following would need to be in place:
- real implementations in place of simulated protections;
- integration with a network, rather than isolated internal testing;
- independent review and published evaluation; see Evaluation methodology and published results and Security assurance status and reporting problems;
- a release with versioned reference.
None of these conditions is met today, and no timeline is implied.
Assumptions, trust and limitations
- The presence of a component is not evidence of protection.
- Assurance readers should treat these components as development artefacts, not as controls.
- Nothing in the experimental implementation should be used with real or sensitive data.
Not yet available, and how this page will grow
The components are not available to developers. Further technical reference is not yet available. If a component becomes part of a released capability, that capability’s primary page would describe it, and this page would be updated or retired. The status label would change only with evidence, and the Documentation change log would record the change.
What this page does not claim
This page does not claim:
- any algorithm, rule, interface, parameter or guarantee;
- any privacy or confidentiality property, or that logged entries cannot be altered;
- any review or audit result.
Anything not stated here as available or assured should be treated as neither.
Related pages
- Confidential computation — the separately described simulated encrypted-computation interfaces.
- Audit trails and tamper-evident logging — the intended capability that the logging component relates to.
- Known limitations of the experimental prototype — the full list of prototype limitations.
- Privacy and confidentiality: intent and current limits — the section overview and what is protected today.
Glossary
References
No approved public references yet.
