Private Discovery Between People

Priya has been chasing a failure in her protocol for three weeks: an intermittent split vote under clock skew that she can reproduce about one run in twenty. She suspects someone else has seen it. She does not know who. The ways of finding out are the usual ones. She can post about it publicly and wait. She can search for people who have written about similar problems. She can lean on a platform that indexes what everyone has published and recommends accordingly. Each of these works because privacy has already been surrendered: her interest is announced, other people’s work is catalogued, and the introduction happens at the price of exposure.

Now that the system can speak for her under bounded authority, it can do something different. It could look for the person without announcing the search, and let a connection be found before either side has to say who they are or what they know. The question has to be put carefully, because it is tempting to think the only way to find a relevant person is to reveal a lot:

How can the system help two people discover a relevant connection without revealing more private information than the discovery itself requires?

The answer is a sequence of separate steps, each with its own permission.

Five stages, not one

Discovery usually collapses into a single act: the system finds someone and tells you. Taken apart it has several distinct steps, and the whole chapter depends on keeping them apart:

private state
     ↓
MATCH            there may be someone relevant
     ↓
IDENTITY REVEAL  it is Daniel
     ↓
INTRODUCTION     would you like to speak?
     ↓
DISCLOSURE       here is what he is working on, and why

A match is the weakest claim: “there may be someone relevant to this problem”. Identity reveal says who. Introduction is an invitation to talk. Disclosure shares what the other person knows or is doing. Each step reveals more than the last, and each needs its own permission. The first law of the chapter says why the order matters:

Discovery before disclosure.

The system should be able to say that there may be someone relevant before it says who, and say who before it says what that person is working on or worried about. The private states the match was computed from never become the discovery index. They stay where they were, and what moves is the minimum needed to establish that a connection exists.

A match is not permission

The second law is the chapter’s hardest line, because the pull to run the stages together is strong.

A match is not permission to reveal.

Suppose the system detects that Priya and Daniel are independently working on the same failure mode. That is a useful fact, and it licenses none of the following: telling Priya that Daniel is working on it, telling Daniel that Priya is interested, revealing either person’s notes, or introducing them. These are separate acts. The match is evidence that a connection might be valuable. It is not authority for any later stage.

Take the case through with each person’s own wishes. Priya has told the system: if anyone else is independently investigating this exact failure mode, I would like to know. Separately, Daniel has told his system: I am open to being introduced to others working on the same issue, but do not reveal my notes. Each system acts only for its own principal, on its own grant, and each grant has a scope, an end and a way to be withdrawn: Priya’s standing request is not a permanent one. The result:

match:               yes
identity reveal:     permitted (both have said so)
introduction:        permitted (both have said so)
notes disclosure:    not permitted (Daniel has withheld it)

Priya and Daniel are put in touch, and nothing Daniel wanted kept back has been given up. Neither system decided anything on the other’s behalf. The stages made it possible to say yes to part of what each wanted and no to the rest.

Using evidence is not disclosing it

A subtler point sits inside the first. A person can authorise a criterion without authorising the evidence behind it. Priya might say: find people who have reproduced this bug. To decide who qualifies, the system may use private evidence about her own reproduction, and about theirs. That does not imply it may tell anyone exactly how she reproduced it.

permission to use evidence for matching
   ≠  permission to disclose that evidence

This is the data-use gate from the delegation chapter applied to two people. Using information to reach a conclusion and revealing the information are different operations with different authority, and having cleared one clears nothing about the other. The delegation chapter and the speech chapter each drew a line, and the two meet here in one chain:

may perform the action
   ≠  may use every available datum
   ≠  may disclose the datum

Whose information is it?

The third law is where relational privacy finally has a proper home, and it explains why this chapter is harder than it first looks.

One person’s consent does not authorise another person’s information.

Many facts are not about one person. Consider: Priya met Daniel privately about the incident. That is not Priya’s fact alone, and it is not Daniel’s alone. It is about a relation between them. If the system holds it because it appears in Priya’s messages, it cannot assume Priya’s permission is enough to disclose it, any more than it could assume Daniel’s. Having a message does not make everything in it freely usable. A person’s account contains other people’s lives.

This has a practical consequence for a case that will come up constantly. Where a fact involves several people and no single person’s grant covers the use, the system should not guess. The right outcome is that it cannot decide, and that a policy involving everyone concerned is needed. “Requires policy” is a legitimate result and often the correct one.

When the matching itself is the problem

Two further cautions belong here, because making discovery private does not make every discovery acceptable.

First, the criterion has to be legitimate before any private computation happens. A search for colleagues who are quietly looking to leave their employer is no better for being conducted privately. The purpose and the predicate must be something the people involved authorised, and privacy of the machinery does not turn an illegitimate question into a legitimate one.

Second, even the answer to a match query can leak. Ask “does anyone match this?” many times with small variations, and the pattern of yes and no narrows to an individual. A discovery service therefore needs limits on how often and how finely it can be asked, coarse outputs, and a refusal to be used as a probe. Computing something privately is not the same as discovering something privately.

Techniques exist that can sometimes determine whether two parties satisfy a shared condition without exposing the underlying inputs. The chapter does not depend on any one of them, and nothing here claims that private matching of meaning, as opposed to exact values, is a solved problem. The architectural distinction is the one that matters: matching can be separated from disclosure.

How it goes wrong

The cases are worth having in front of the design:

matching reveals too much by itself
identity is revealed without permission
one side consents and the other does not
an introduction is permitted but private details are not
a relation is disclosed though only one participant authorised it

The first happens when the match output carries more than a yes: when “someone matches” quietly becomes “someone in this team who works on exactly this”. The second collapses the stages. The third is the central relational case. The fourth shows why the stages must be separate: she may be glad to meet and unwilling to share. And the fifth is the same boundary seen at the level of facts.

When the system does explain a match, it should explain the least that is sufficient: both of you are investigating the same failure mode. The person can ask for more or decline. Revealing more of oneself should be progressive, something that is done step by step as each person chooses, and should not be a single large step taken at the moment of matching. After an introduction, nothing in it licenses the system to keep a profile of the other person or to reuse what it learned in some other setting.

Where this leaves us

Discovery has stages: match, identity reveal, introduction and disclosure. Each reveals more and needs its own permission. Discovery comes before disclosure, a match is not permission to reveal, using evidence is not disclosing it, and one person’s consent does not authorise another person’s information. Making the computation private does not legitimise a bad question or stop its answers from leaking.

Now suppose this works between two people, each with a system acting for them. The harder problem comes next, and it is no longer only privacy. It is coordination between several agents, each carrying a different authority, different information and different obligations. A pair of systems can be made to behave. What happens when there are thousands of them, each doing something locally acceptable?