A privacy-first trust framework starts by treating consolidated data as a liability

The Center for Democracy & Technology has published What is a Database?, a technical explainer by Hannah Quay-de la Vallee on the risks of government data consolidation. Limited, targeted data sharing between agencies has long been defensible — it reduces administrative burden and helps catch fraud, waste, and abuse — but the current push to consolidate federal, state, and local collections “poses risks to personal privacy, government surveillance, and cybersecurity vulnerabilities.” The brief’s premise is that the hard question is knowing “when the risks of data consolidation outweigh the benefits,” and that answering it requires understanding how specific risks flow from specific technical design choices.

The value here isn’t the politics; it’s the method. CDT ties concrete privacy and security risks to design decisions — what identifiers link records, how collections are joined, what a consolidated store newly makes possible — and that maps almost directly onto the trust-and-identity stack. Every layer we build to make calls and messages trustworthy accretes data: rich call data attached to a branded call, the KYC/KYB records behind an attestation, caller-reputation signals, cross-channel identity graphs. Each is defensible on its own; each, aggregated, becomes exactly the kind of honeypot CDT is describing. The fraud-prevention rationale that justifies data-sharing in telecom is the same one CDT says agencies have leaned on — and the same one that, taken past “targeted,” quietly turns a service into surveillance.

The lesson for a consumer-facing trust framework is that privacy has to be a design constraint, not a policy afterthought. If the identity layer that verifies a call ends up as a queryable record of who called whom, we will have solved spoofing by standing up the tracking infrastructure we spent a decade warning against. The same instinct runs through the calling-trust work. VESPER, the STIR profile framework I’m developing at the IETF, composes existing STIR tools for telephone-number-scoped trust in a right-to-use: what a holder declares about its numbers — the providers authorized to originate, rich call data, a binding to a domain it controls — is carried in a delegate certificate, its issuance recorded in public transparency logs for independent auditability without centralized enforcement control, rather than pooled into one queryable store. It’s a working example that verifiable trust doesn’t require a honeypot.

There’s a regulatory version of the point too. Telephone numbers are, by design, centrally administered — but central authority over the namespace does not require a central database that exposes private data. The numbering authority can issue a verifiable token attesting right-to-use, verified against that credential and its transparency-log record — not a queryable lookup of subscribers. Central authority over the namespace and privacy-preserving verification of it are separable — worth keeping separate as the FCC’s numbering and call-authentication rules evolve, the kind of thread the Regulatory Watch dispatches follow. CDT’s full report is a good articulation of the failure mode that architecture avoids — worth reading with RCD and branded calling held in mind.