8 Security considerations§
AGREED Escalated in the same spirit as BUS-1 19: history is evidence, and evidence attracts adversaries.
8.1 A sample file is inert§
A bus-csv-1 file has no elements, no references, no styles, no scripts, no external fetches, and no execution model — three columns of text. Compare BUS-1 19.3’s handling of figures: SVG is a document format with live semantics, so figure mode needed a closed profile, forbidden-element lists, and refusal rules to make it safe to render. CSV needed none of that, because there is no behavior to constrain. That asymmetry is an argument for the format, not an accident of it, and it is why this clause is short.
Inert is not free. An importer MUST bound the resources it will spend parsing sample files — nothing in this part constrains row count or decompressed size — and the path-safety and digest-before-ingestion rules of BUS-1 19.3 apply to sample files exactly as to every other package entry.
8.2 History is personal data at fine grain§
BUS-1 19.4 notes that occupancy points can reveal the movements of identifiable people. A time series is that risk at full resolution: months of occupancy, badge-driven lighting, or single-tenancy meter data is a record of when particular humans were where. An exporter MUST provide a means to withhold such series and MUST declare the withholding with reason excludedForConfidentiality — declared, not silent, for BUS-1 19.4’s reason: an undeclared redaction is indistinguishable from an assertion that was never made.
8.3 History as evidence§
An energy baseline dispute, a warranty claim, a performance-contract settlement — series data is what the argument is about, which makes tampering profitable. The digests of BUS-1 16.5 make tampering detectable within a package; signatures over the manifest (BUS-1 16.3) extend that to the package as an artifact; and the byte-equality rule of 7.1 means a re-export cannot silently launder an altered file as an equivalent one. Where series data is relied on as evidence, the package SHOULD be signed, and the signature-format gap BUS-1 Annex F.1 records applies here with the same weight.