Follow-up from the GIS count-leak fix (PR #366).
Finding
/gis/query/proximity supports relation="beyond", which returns registrants NOT within the radius — effectively total_population − within. beyond counts are typically large (≥k) and pass through unsuppressed. An attacker who can also learn the total population (e.g. a very large polygon / large-radius within, both ≥k and unsuppressed) can compute within = total − beyond for a small buffer whose direct within count was suppressed — recovering the small count the suppression was meant to hide.
Options to weigh
- Suppress/relativize
beyond when the complementary within would be below k (requires computing both).
- Only expose
beyond at a coarser granularity, or gate it behind a stricter scope.
- Accept as documented residual and rely on rate-limiting/audit.
Needs a design decision. Source: internal/plans/sec-gis-count-kanon-suppression-research.md.
Follow-up from the GIS count-leak fix (PR #366).
Finding
/gis/query/proximitysupportsrelation="beyond", which returns registrants NOT within the radius — effectivelytotal_population − within.beyondcounts are typically large (≥k) and pass through unsuppressed. An attacker who can also learn the total population (e.g. a very large polygon / large-radiuswithin, both ≥k and unsuppressed) can computewithin = total − beyondfor a small buffer whose directwithincount was suppressed — recovering the small count the suppression was meant to hide.Options to weigh
beyondwhen the complementarywithinwould be below k (requires computing both).beyondat a coarser granularity, or gate it behind a stricter scope.Needs a design decision. Source:
internal/plans/sec-gis-count-kanon-suppression-research.md.