Audit, accountability, and chain of custody
Audit should allow independent reviewers to reconstruct who did what, under which authority, to which system state, and with what outcome. Chain of custody preserves provenance and integrity across acquisition, transformation, delivery, receipt, storage, and authorized use.
Safety boundary: this chapter teaches lawful, governed system design from public standards. It does not provide operational targeting, activation, decryption, surveillance-evasion, or covert collection instructions.
The mental model
| Concept | Plain meaning | Control that must travel with it |
|---|---|---|
| Audit event | A structured record of a consequential control action | Exclude content and minimize target details |
| Append-only evidence | Past events cannot be silently rewritten | Protect against privileged administrators |
| Provenance | Links output to source and transformation history | Identifiers must be stable and scoped |
| Integrity proof | Detects alteration of records or delivered objects | Protect trust anchors and verification procedures |
| Custody transfer | Records accountable handover between controlled parties | Network transmission alone is not custody |
| Independent oversight | Reviewers can test legality and control effectiveness | They need sufficient context without unnecessary exposure |
Apply it as a controlled workflow
- Define the minimum audit schema for authorization, lifecycle, access, change, delivery, and deletion.
- Send evidence to a separately administered append-only store.
- Use protected time and sequence and detect missing audit intervals.
- Bind transformations and deliveries to versioned provenance.
- Provide narrow oversight queries and sealed-case review.
- Test administrator tampering, log outage, delayed upload, and evidence restoration.
Evidence to demand
- Auditors can reconstruct lifecycle without opening communication content.
- Privileged users cannot disable logging unnoticed.
- Custody records show sender, approved receiver, time, object range, and acceptance outcome.
- Audit retention and legal holds are distinct from intercepted-material retention.
Failure to reason about
An operator deletes an embarrassing failed provisioning event from the primary database. A separately controlled, cryptographically linked audit stream reveals the gap and preserves the original event.
Feynman check
Audit is the sealed diary of the process. It should tell who opened which authorized door and when, without copying what was inside the room.