Enhancing Legal Document Security and Accessibility with TAF

Enhancing Legal Document Security and Accessibility with TAF

Speakers: Renata Vaderna

Conference: NDSS Symposium

YouTube: https://www.youtube.com/watch?v=I6BAfjZQm-E

Overview

Renata Vaderna, former lead developer of TAF (The Archive Framework), presents a system for long-term security and preservation of digital legal documents that combines Git (version control) with TUF (The Update Framework) to create an authenticated, tamper-evident archive of the law. TAF is already deployed in 14 US jurisdictions including the District of Columbia and the Council of Maryland, as well as tribal governments and the National Indian Law Library. The system addresses a critical gap: while paper law has millennia of mature preservation practices (seals, signatures, multiple copies in law libraries), digital law has only decades of experience and remains vulnerable to cyberattacks -- illustrated by three incidents in 2024-2025 including the erasure of a third of Russian court archives, a US federal court file system breach, and a UK government cover-up of a family court file loss due to an IT glitch.

Background

▶ Watch: Three 2024-2025 cyberattacks on legal document systems (0:30)

Legal document security differs fundamentally from other digital preservation challenges. Law operates on century-long timescales -- the DC Council's legal code includes English law from the 13th century. Past versions of laws remain legally relevant for decades. Law is an interconnected system where tampering with one document can have cascading consequences. The Uniform Electronic Legal Material Act (UELMA), enacted in 2011 in the US, formalizes requirements for trustworthiness and long-term preservation of digital law.

Existing digital archiving solutions like LOCKSS and DSpace excel at keeping files safe but fall short on providing authenticated access to complete legal histories, including all prior versions, with cryptographic guarantees about authorship and temporal ordering. Meanwhile, some governments already use Git and GitHub for law publication, but Git alone does not support threshold signatures (what happens if an employee's GitHub account is compromised?) and has known vulnerabilities including the ability of a malicious server to present different views of history to different users.

Key Findings

▶ Watch: Why Git alone fails: no threshold signing, known vulnerabilities (4:00)

Naive combination is insufficient: Simply putting Git (for versioning) together with TUF (for authentication) would authenticate only the latest version but not guarantee that all historical versions were also authenticated. TAF applies TUF-style authentication to every version within a Git history, forming a single ordered chain of authorized states.

Threshold signing with YubiKeys: Authorization of new legal versions requires signatures from a threshold of keys stored on YubiKey hardware devices. An attacker would need to physically steal multiple YubiKeys to forge an authorization, even if they compromise a GitHub account.

Authenticated temporal queries: By bundling effective dates of law with cryptographic state authorization, TAF enables verifiable answers to questions like "what did the law say on March 15, 2020?" -- a capability critical for legal research and litigation.

Rollback and deletion detection: If an attacker with GitHub access deletes recent versions (force-push), a fresh download would not detect the issue. However, any existing local copy would detect the discrepancy. To address this, TAF establishes a network of mirror publishers and trustworthy institutions (law libraries, archives) that maintain independent copies.

Battle-tested in production: 14 US jurisdictions actively use TAF, including the District of Columbia (whose legal code spans to the 13th century), the Council of Maryland, tribal governments, and one law library.

Technical Deep Dive

▶ Watch: Authenticated temporal queries: what did the law say on date X? (8:00)

TAF's workflow begins when a publisher is ready to update the law (a new bill passed, a regulation changed). The publisher updates the documents (the format handling is outside TAF's scope) and creates an explicit authorization -- a signed statement that the current state of the law is valid and official. This authorization requires a threshold of signatures from keys stored on YubiKey hardware.

Each authorization is paired with the corresponding state of the law, forming a chain of (state, authorization) pairs that constitutes the authenticated version history. A client downloading the archive first cryptographically verifies the authorization chain, then validates each corresponding state against the authorization metadata. Any discrepancy -- missing states, wrong ordering, unauthorized changes -- causes the update to be rejected.

The system inherits TUF's protection against rollback attacks, mix-and-match attacks, and freeze attacks, extended to work across a complete version history rather than just the latest state. Git provides the content-addressable storage and versioning infrastructure, while TUF metadata provides the cryptographic authentication layer.

For the mirror network, institutions like law libraries and legal archives maintain independent copies. Out-of-band authentication (direct contact with the original publisher) establishes trust during initial mirroring, with plans to leverage DNS records for automated publisher verification in the future.

Demo / Proof of Concept

▶ Watch: Threshold signing with YubiKeys prevents single-point compromise (10:00)

TAF is open-source with a simulation environment available for testing. The system has been in production use across 14 US jurisdictions, handling real legal documents including statutes, regulations, and codes. The DC Council deployment manages a legal corpus spanning centuries. A simulation is available for researchers to experiment with the authentication and verification workflow.

Defensive Implications

▶ Watch: Q&A: public key distribution and false repository protection (14:00)

TAF addresses a critical infrastructure security gap -- the integrity of the legal system itself. As governments increasingly digitize their legal publications, ensuring that citizens, lawyers, and courts can trust that the digital version of the law matches what was actually enacted becomes a foundational security requirement. The recent cyberattacks on court systems demonstrate that this threat is not hypothetical.

For organizations in regulated industries, TAF's authenticated temporal queries provide a mechanism for proving which regulations applied at a specific historical date -- useful for compliance disputes, litigation, and audit trails. The threshold signing model and hardware key storage (YubiKeys) provide a governance framework that balances security with operational practicality.

Key Takeaways

• TAF combines Git (versioning) with TUF (authenticated updates) to create cryptographically verified archives of digital law
• Deployed in 14 US jurisdictions including DC, Maryland, tribal governments, and a national law library
• Threshold signing with YubiKeys prevents single-point-of-compromise authorization, even if GitHub accounts are breached
• Enables authenticated temporal queries: cryptographically verifiable answers to "what did the law say on date X?"
• Addresses attacks against legal archives including the 2024-2025 incidents (Russian court archives erased, US federal court breach, UK family court file loss)
• Open source with simulation available; network of mirror institutions provides redundancy against publisher compromise

About the Speaker(s)

Renata Vaderna is the former lead developer of TAF, having spent a significant portion of her career building the system. The project is a collaboration between Open Law Library (an NGO), NYU, and the University of Wisconsin, focused on ensuring the security and accessibility of digital legal documents for the long term.