Learning objectives
- Explain append-only storage and its operational implications
- Identify the trust assumptions that remain after append-only is implemented
- Evaluate a system's key custody arrangements
Content
- Append-only: records may be added, never modified or deleted. Corrections are new records referencing prior ones — the same discipline as a general ledger.
- Operational consequences officials must plan for: data entry errors become permanent (visible, corrected, never erased); storage grows monotonically; retention policy becomes a design constraint rather than a cleanup task.
- The residual trust question: append-only within a system you control still requires trusting you. What closes the gap is external anchoring — publishing a periodic commitment somewhere you cannot retroactively change.
- Key custody (25 min): who holds signing keys, where they live, what happens when a staff member with key access leaves. HSMs in plain language. Why "the vendor holds the keys" is a different security posture than "the county holds the keys," and why officials should ask.
- Exercise: design a key custody arrangement for a hypothetical 200,000-voter county. Constraints: two-person integrity, staff turnover, a 3 a.m. failure.
Run the exercise
Assessment
key custody plan with justification for each role assignment. ---