# BingBong — Privacy Threat Model

> Version: 0.1 (design target). Status: pre-launch design system.

## 1. Data inventory

| Asset | Domain | Sensitivity | Retention target |
|---|---|---|---|
| Token ↔ surface mapping | Identity | Medium | Until revocation + 30 days |
| Consent receipts | Identity | Medium | Until revocation + 1 year |
| Token-tagged events | Event | Medium | Per contract; default 90 days |
| Cohort definitions | Event | Low | Until superseded |
| Cohort aggregates | Event (output) | Low | Until `retention_until` |
| Buyer local copies | Buyer | Low | Out of contract at `retention_until` |
| Access logs | Governance | Medium | 1 year |
| Boundary event log | Governance | High | 1 year |

### What is explicitly NOT collected

- Email addresses, phone numbers, account ids.
- Raw IPs at the event domain.
- Full user-agent strings at the event domain.
- Geolocation more precise than coarsened bucket.
- Any direct identifier at the event or buyer domain.

## 2. Trust boundaries

```
+------------------------+        +-------------------------+
| Participating surface  |  --->  | Edge filter (partner)   |
+------------------------+        +-------------------------+
                                          |
                                          v
+----------------------------------------------------------+
|                       BingBong                            |
|                                                           |
|   +--------------------+        +---------------------+    |
|   | Identity domain    |  --->  | Event domain        |    |
|   |  - token issuance  |  join  |  - ingestion        |    |
|   |  - revocation      |  (priv) |  - cohort build     |    |
|   |  - consent         |        |  - suppression      |    |
|   +--------------------+        +---------------------+    |
|                                          |                  |
+------------------------------------------|------------------+
                                           v
                                  +------------------------+
                                  | Buyer contract output  |
                                  +------------------------+
```

The **identity / event join** is the most privileged operation in the system. It is logged, budgeted, and gated by governance review for any non-operational use.

## 3. Threats and mitigations

### 3.1 Reidentification by join

- **Threat:** A party with access to a BingBong cohort and to an external dataset with shared feature space joins the two and recovers a person's record.
- **Mitigation:** Domain separation; minimum cohort thresholds; suppression; prohibited-uses list; buyer roster.
- **Residual:** Live. Documented in `docs/CLAIMS_REGISTER.md` as RESIDUAL.

### 3.2 Singling-out by side-channel

- **Threat:** A small cohort with distinctive features is identified by repeated queries with side information.
- **Mitigation:** Cohort rounding; query budgets; near-singling suppression.
- **Residual:** Live. Documented as RESIDUAL.

### 3.3 Cross-context correlation

- **Threat:** BingBong cohorts are correlated across participating surfaces via shared features.
- **Mitigation:** Prohibited-uses list; buyer roster; contract enforcement; documented boundary events for any cross-context join.
- **Residual:** Live. Documented as RESIDUAL.

### 3.4 Token replay

- **Threat:** A token is replayed against an ingestion endpoint with a forged surface tag.
- **Mitigation:** Token signing; rotation; revocation propagation; edge-side filter.
- **Boundary status:** Mitigated. Documented as BOUNDARY.

### 3.5 Insider abuse

- **Threat:** A party with privileged access to the identity or event domain misuses it.
- **Mitigation:** Least privilege; access logging; governance review; documented incident response.
- **Boundary status:** Mitigated. Documented as BOUNDARY.

### 3.6 Breach

- **Threat:** Confidentiality failure at the identity or event domain.
- **Mitigation:** Encryption at rest; key separation; documented incident response; documented disclosure cadence.
- **Boundary status:** Mitigated. Documented as BOUNDARY.

### 3.7 Model inversion

- **Threat:** A cohort output can be partially reversed by a sufficiently motivated adversary.
- **Mitigation:** Cohort-only output; aggregate validation; opt-out propagation.
- **Residual:** Live. Documented as RESIDUAL.

### 3.8 Small cohort / fingerprinting

- **Threat:** A small or distinctive cohort is itself a fingerprint.
- **Mitigation:** Minimum-count thresholds; suppression at the boundary.
- **Residual:** Live. Documented as RESIDUAL.

### 3.9 Consent fraud

- **Threat:** A participating surface presents a forged consent receipt.
- **Mitigation:** Consent replay; documented issuance flow; partner obligation.
- **Boundary status:** Mitigated at the partner edge. Documented as BOUNDARY.

### 3.10 Retention overreach

- **Threat:** A buyer or partner retains a BingBong artifact beyond `retention_until`.
- **Mitigation:** Documented contract; access logs; partner obligations.
- **Boundary status:** Contractual. Documented as BOUNDARY.

## 4. Residual risk

Residual risk is named, not hidden. The mitigations are documented above. The following statements are honest about what remains:

- Reidentification is **not** eliminated. It is managed.
- Singling-out is **not** eliminated. It is throttled.
- Cross-context correlation is **not** eliminated. It is contractually bounded.
- Model inversion is **not** eliminated. It is bounded by aggregate validation.
- Small cohorts are **not** eliminated. They are suppressed at the boundary.

## 5. Acknowledgement under audit

A deployed BingBong will publish a quarterly governance review that names the residual risks above and the mitigations in effect at the time of review. The review will be paired with the artifacts it relied on. Narrative without receipt is not a review.