Exploratory principle capture, not build-committed. A pattern the shop actually ran for years.
The pattern
Repair data migration driven by a JOB/TICKET ID, executed blindly:
- Tech boots the machine off a USB stick, runs a script: enter ticket number → hit enter →
it rsyncs the customer's data. The tech never sees a filename.
- Result: the customer's privacy is preserved AND the technician has ZERO exposure to other
people's private/disturbing/illegal content — a real occupational hazard in repair (techs have found traumatic, legally-radioactive material). Protects BOTH parties.
The principle (same bright line as everywhere else in this engagement)
Handle the data without inspecting it. Password checked locally, never displayed. Breach match by hash, never revealed. Data migrated by ticket ID, never browsed. Sensor analyzed on-device, raw discarded. The sensitive thing is processed by an ID/derived-value; the human (and the log) never sees the content.
Apply to the platform (vetted-technician dispatch)
- Data migration/backup steps are ID-driven and blind; the tech/software never enumerates
filenames or content.
- WORM audit records the ACTION by job/ticket ID ("migrated ticket #1234", byte counts,
outcome) — NEVER filenames or content.
- If content-level inspection is ever unavoidable (e.g. a legal preservation hold), it is a
separate, explicitly-consented, separately-authorized, separately-logged step — never the default path, and never silent.
Guardrail
Consent + ownership + WORM + this blind-handling default. Protect the customer AND the worker.