Report - Guardian

The LSE Identity Project Report: June 2005 269Figure 5 - Non-repudiable audit trailsThis figure shows how, on top of the basic system outlined in the above figures, thegovernment could centrally collect non-repudiable audit trails that are not privacyinvasive.Step 5: Government Services A and B can forward non-repudiable digital audit trails tothe central Authority (or any other auditing body); they can capture these whenever Bobinteracts with them using his various local unidirectional identifiers. The GovernmentServices can optionally censor the audit data prior to forwarding it, so as to protectBob’s privacy interests or their own privacy and autonomy interests vis-à-vis auditors.Step 6: The Authority can keep the audit trails and verify the validity of transactions. Incase of a dispute, censored data can be uncensored with the help of the appropriateGovernment Services. The Authority cannot trace and link the actions of Bob acrossGovernment Services on the basis of the non-repudiable audit trails, unless Bob haschosen to specifically enable this. (Bob can decide on a per-transaction basis.).However, as we will see below, the invisible presence of the embedded master identifierin the audit trails can be leveraged for cross-domain security purposes.