The Survivors' Privacy Left in the Evidence of Discrimination

The options

The order shown is not a ranking of preference.

1. Option 1

   Migrate the original text to new passwords

   Preserves verification material but cannot protect copies already leaked.

2. Option 2

   Preserve only records with identifying information removed

   Reduces exposure but weakens the links between context and evidence.

3. Option 3

   Delete high-risk records and re-collect oral accounts

   Re-asks for the stakeholder's choice but loses the records of people who cannot respond.

The situation as it stands

In this setting, the long-term security of some old passwords has broken down. Decision deadline: 60 days until the signature system migration.

A fictional citizens' records organization

1. Premise 1In this setting, the long-term security of some old passwords has broken down.
2. Premise 2The records prove past discrimination but also hold survivors' non-public relationships.
3. Premise 3If the original text is erased, future verifiers will read only an edited summary.

Where it holdsSets the storage and access conditions for records collected with consent. Cannot delete the stakeholder's separate copy.

What is still unknown

1. Unknown 1How much of the original text was copied externally in the past
2. Unknown 2The degree to which future re-identification technologies defeat anonymization

Signals to decide again

• Define what observation, who is responsible, and what confirmation window can check the "extent to which the original text was copied externally in the past," and re-judge if new confirmation changes the tradeoff between the options.
• Define what observation, who is responsible, and what confirmation window can check the "degree to which future re-identification technologies defeat anonymization," and re-judge if new confirmation changes the tradeoff between the options.