THE PROBLEM
How can we learn from each other’s security experience without sharing information that must be protected?
Observations held by different actors may reveal a pattern together. Their sensitivity, validity and conditions of use may differ.
Fictional scenario
What if several small observations helped us ask a better question?
Three organisations each notice an unusual event in their systems. None says much on its own. What if they shared selected information and discovered a possible connection while sensitive details stayed at the source? How would we decide whether the connection merited investigation or was merely a coincidence?
CONNECTIONS TO EXPLORE
What supports the suggested shared pattern?
A fictional miniature example. Choose a connection and read its evidence. All texts and events below are illustrative.
EVIDENCE IN THE FICTIONAL SOURCE
Synthetic observation A
Observation A records indicator X at time T.
Read the complete miniature record and connected sources
Synthetic observation A
Observation A records indicator X at time T.
Illustrative record · cybersakerhet:A · v1Synthetic observation B
Observation B records indicator X in another system.
Illustrative record · cybersakerhet:B · v1Fictional indicator X
X is used only as a comparable label in the demonstration.
Illustrative record · cybersakerhet:X · v1LET’S EXPLORE
What we want to explore with the framework
With fictional indicators, we explore how to trace sources, sensitivity and validity. Observations need to remain distinct from interpretations, with responsibility considered for questions spanning several organisations.
How can another node detect whether a shared history has been altered? Explore the local experiment ↗
Possible source material
Synthetic threat indicators, incident reports and situation reports.
An illustrative example
Synthetic indicators from three actors suggest a shared pattern. The underlying observations remain separate from the interpretation. An organisation can take responsibility for further work if it falls within its mandate.
What we need to learn
Which local conditions, responsibilities and human judgments are missing from the example? A real case may change both the problem framing and the proposed response.
What should remain useful, and on whose terms?
Which relationships could expose a person or a vulnerable organisation? How is authority checked when an alert is shared, and what should a recipient do if the source restricts access?
Questions to test. The examples do not establish that these protections or decision rules are implemented. Read about responsibility and conditions ↗
Test the question together
Do you recognise the problem, or see it differently? Bring a real case, source material or a challenge. Together, we can examine the assumptions and decide whether a focused demo or pilot is the right next step. We would test what becomes easier, what still needs human judgment and what Intertween needs to change.
Start a conversation about this path ↗