What we are building
An audit of the child-welfare system that follows real children's outcomes across every state and every agency, for their whole lives, while making it cryptographically impossible for auditors, researchers or the public to identify any child.
Core requirement — one person, one permanent token, everywhere; never reversible by the people using the data.
| Requirement | Specification |
|---|---|
| Tokenisation | Deterministic, keyed — HMAC-SHA-256 or format-preserving encryption (NIST FF3-1). Keys live only in HSMs (FIPS 140-3 Level 3). Same person → same token, in every state and dataset. |
| Cross-dataset matching | Privacy-preserving record linkage (Bloom-filter encoding / secure multiparty computation) so messy records match without names in the clear. |
| The vault | The identity↔token crosswalk, encrypted at rest, isolated from the audit environment, processed only inside confidential-computing enclaves, append-only. |
| Threshold access | Vault key split via Shamir's Secret Sharing; a quorum (e.g. 4 of 7 independent holders) required to open. No individual can re-identify. Routine auditing never opens the vault. |
| Break-glass | Re-identification only via trusted broker + quorum + documented legal cause + permanent logging. Sole purpose: protecting a child in present danger. |
| Audit log | Append-only, tamper-evident (hash chain / Merkle tree on WORM storage), independently anchored so history cannot be rewritten. Every touch recorded, permanently. Explicitly stronger than mutable medical-record systems. |
| On demand | The engine tokenises new and updated cases continuously as they arrive. |
The design test to hold us to
If evidence enters this system, it must be impossible for anyone — including the operators — to make it quietly disappear.
A working demonstration of all three mechanisms is on this site → Ask the team to break it.
Programs to build on and cite
These are established, verifiable programs. Citing and extending them frames this as reform of things that already exist, not a leap into the unknown.
- AFCARS, NCANDS, NYTD — the federal foster-care, abuse/neglect and youth-outcomes data systems, run through the Children's Bureau (ACF) and archived at NDACAN.
- Child and Family Services Reviews — the existing federal audit of state child-welfare performance.
- Citizen Review Panels — citizen oversight bodies CAPTA already requires every state to maintain.
- Chapin Hall's Multistate Foster Care Data Archive — already links foster-care records across states; direct proof the cross-state method works.
- Privacy-preserving record linkage — established practice for matching the same person across datasets without sharing identities.