Residual Leakage Review Board¶

Standing review body — instantiates Side-Channel Leakage Containment

A standing cross-functional body that reviews the leakage remaining after controls, sets the tolerated distinguishability budget, and records — with named accountability — what residual risk is formally accepted.

No containment is perfect; after padding, suppression, and isolation have done their work, some residual leakage always remains. The Residual Leakage Review Board is the human governance mechanism that owns what's left. It ratifies exactly where the authorized-disclosure line sits, sets how much residual distinguishability the system is willing to tolerate, and — the part no tool can do — records who accepted the remaining risk, on what evidence, and under what assumptions. Its defining move is that it decides and owns residual risk rather than measuring or reducing it: it converts a vague "we think it's probably fine" into a signed, dated, revisitable acceptance with a name attached.

Example¶

A national statistics agency is preparing a new small-area data product — useful precisely because it's granular, and risky for the same reason. The measurement mechanisms report a small residual re-identification risk: under a plausible adversary holding an external dataset, a handful of individuals in the sparsest areas could be singled out. The board convenes — statisticians, a legal advisor, a data steward, and a subject-matter representative — and weighs the residual against the public value of the release.

It reaches an explicit decision: the residual is acceptable at this granularity, but only if the tolerated distinguishability budget for the release is set at a stated level and the two thinnest geographies are merged upward first. That decision is written down with its assumptions, its accountable owner, and a re-review trigger: if a new external dataset that changes the adversary's power becomes available, this acceptance re-opens. Statistical agencies run standing disclosure review boards for exactly this purpose. The record is what makes the acceptance revisitable instead of forgotten.

How it works¶

Convene the cross-functional standing body. Bring the perspectives — statistical, legal, domain, stewardship — that no single owner holds.
Adjudicate the boundary. Decide where authorized disclosure ends and unacceptable leakage begins, for this system and this release.
Set the tolerated budget. Fix how much residual distinguishability is acceptable, as a policy the enforcing controls are then tuned to meet.
Record acceptance with a name. Log the decision, its evidence, its assumptions, its owner, and the condition that re-opens it.

Tuning parameters¶

Risk appetite — how much residual leakage the board is willing to accept. Lower appetite is safer but suppresses more value; the setting belongs to the institution, not the engineers.
Evidence bar — how much test and measurement evidence is required before a decision. A higher bar prevents rubber-stamping but slows releases.
Composition and quorum — which roles must be present. Missing a perspective (legal, domain) produces decisions that don't hold up.
Acceptance lifetime — whether an acceptance is permanent or time-boxed with mandatory re-review. Time-boxing catches assumptions that decay.
Re-open triggers — the specific conditions (new external data, a changed adversary) that force reconsideration.

When it helps, and when it misleads¶

Its strength is that it forces residual risk into the open and gives it an owner, replacing acceptance-by-silence — the default where no one decides, so the risk is "accepted" by nobody — with a deliberate, accountable, auditable choice. The record it leaves is what lets the decision be revisited when the world changes rather than rediscovered after an incident.

Its failure modes are the ones every governance body faces, sharpened here by the technical subject. Without teeth or real evidence it degrades into risk theater — a signature that blesses whatever engineering already shipped. It is slow, and under deadline pressure it is the step most tempting to skip. And it is easily run backwards: convened to ratify a decision already made rather than to test one, so the "review" manufactures a justification instead of a judgment. This is the governance face of statistical disclosure control — the discipline of trading a bounded, explicitly-accepted disclosure risk for data utility.^[1] The discipline that keeps it honest is to require genuine test evidence, time-box every acceptance, and keep the person who accepts the risk distinct from the person shipping the release.

How it implements the components¶

The board fills the governance-and-ownership components — judgment and accountability, not tooling or measurement:

residual_risk_acceptance_record — the signed, dated, owned record of what leftover leakage was accepted and why.
authorized_disclosure_boundary — the ratified line between what the policy permits to be revealed and what it does not.
distinguishability_or_leakage_budget — the tolerated leakage level, set as policy for the enforcing controls to be tuned against.

It implements none of the controls that reduce leakage: equalization is Response Padding or Coarsening, aggregate suppression is Threshold Suppression, and timing isolation is Secret-Independent Resource Scheduling. The board sets the budget those mechanisms enforce.

Instantiates: Side-Channel Leakage Containment — owns and accepts the leakage that remains once the controls have done their work.
Consumes: Side-Channel Regression Test and Side-Channel Inventory Workshop supply the evidence and the inventory the board adjudicates.
Sibling mechanisms: Side-Channel Regression Test · Threshold Suppression · Side-Channel Inventory Workshop · Query Rate and Composition Limit · Response Padding or Coarsening · Secret-Independent Resource Scheduling · Privacy-Preserving Telemetry View · Batching and Delayed Release · Broker Visibility Partitioning · Cache Partitioning or Flush Rule · Constant Response Envelope · Controlled Noise Injection · Differential Observation Test · Error Message Normalization · Metadata Minimization Filter

Notes¶

The budget the board sets is consumed by the enforcing controls: Response Padding or Coarsening realizes it as a bucket width and Threshold Suppression as a minimum-support threshold. Separating who sets the tolerance from who enforces it is deliberate — it lets the technical controls be re-tuned without re-litigating the risk decision, and lets the risk decision be revisited without touching the controls.

References¶

[1] Statistical disclosure control is the field concerned with releasing useful data while bounding the risk that individuals can be re-identified from it. It is explicitly a risk–utility tradeoff: some disclosure risk is accepted in exchange for utility, which is precisely the judgment a review board is convened to make and record. ↩