# Technical field classification

This inventory covers all 22 columns returned by a schema-only `pyarrow.parquet.read_schema` inspection of the source specified in [data setup](../data-setup.md), on 19 September 2026. No row values were read for this account. Arrow types below are observed schema types, not verified measurement units. The supplied [field description](../sources/elisa-dataset-description.txt) calls the station identifier `enb`; the Parquet schema and current code use **`enb_id`**. There is no additional `enb` column.

The implementation reference is commit `6c38bae0f581dfebf581af30f0c2397ac7499e54`, particularly [m1 transformations](../../src/dsh/m1/transform.py) and [privacy evaluation](../../src/dsh/m1/privacy.py). Links follow the checkout; use that commit when checking the historical account. This is a technical risk classification, not a legal determination or a claim that a released table is anonymous.

## Meaning of the classes

**Direct** means a stable subscriber/device identifier intended to select or link the same entity. It does not establish a person's civil identity: values in this supplied dataset have been transformed/randomized. The three such fields are still reported to be one-to-one in this file, so removing only one leaves equivalent grouping through the others ([dataset overview](dataset-overview.md)).

**Quasi** means a field that may narrow candidates or support linkage when combined with other fields, repeated observations or auxiliary knowledge. For numeric measurements, this is a conservative potential-risk classification, not evidence that every value is unique or that a successful numeric attack has been measured. **Non-identifying** would mean no plausible identifying contribution under a stated release/attacker context. No source column is assigned that unconditional label here: even broad categories or noisy measurements remain attached to individual rows. They may be useful measurement attributes while also contributing to a fingerprint.

## Complete inventory

| Column | Arrow type | Class | Context and combination risk |
| --- | --- | --- | --- |
| `time_start` | int64 | Quasi | Event-window timestamp; repeated time/category/location observations can be intersected. Fabricated dates do not establish real chronology, and the integer unit is not confirmed here. |
| `msisdn` | large_string | Direct | Phone/subscriber identifier semantics; stable grouping key in the evaluator. Treat as an identifier even though supplied values are transformed. |
| `imsi` | large_string | Direct | SIM/subscriber identity semantics; preserves subscriber grouping independently of phone number. |
| `imei` | large_string | Direct | Equipment identity semantics; device identifier, with one-to-one subscriber linkage reported in this file. |
| `tp_dl_avg` | double | Quasi | Average download throughput is a measurement, but exact magnitude together with time, application and other measurements may fingerprint observations. |
| `tp_ul_avg` | double | Quasi | Average upload throughput adds a potentially distinctive paired download/upload profile. |
| `tp_dl_filtered_avg` | double | Quasi | Filtered download throughput can refine that profile; the filtering threshold is not specified in the source description. |
| `cont_rtt_radio_avg` | double | Quasi | Continuous radio RTT can contribute to a latency/throughput fingerprint when linked to contextual fields. |
| `cont_rtt_internet_avg` | double | Quasi | Continuous internet RTT adds another latency dimension; no real endpoint identity is established by this column alone. |
| `initial_rtt_radio_avg` | double | Quasi | Initial radio RTT combined with continuous RTT and time may distinguish observations; missingness can also be informative. |
| `tcp_retrans_byte_ratio_downlink_avg` | double | Quasi | Downlink retransmission ratio can refine a quality signature; do not assume a precise denominator beyond the supplied description. |
| `tcp_retrans_byte_ratio_uplink_avg` | double | Quasi | Uplink ratio may distinguish otherwise similar rows when combined with downlink and throughput. |
| `http_response_time_avg` | double | Quasi | Response-time measurement and its zero/missingness pattern can aid matching; zeros are not verified to mean instant responses. |
| `http_sr_avg` | double | Quasi | Success-rate field and missingness may contribute to matching; observed values above one leave its scale unresolved. |
| `data_GB_sum` | double | Quasi | Total data volume can be known from another observation or combined into a usage fingerprint; row additivity is an assumption, not an established session definition. |
| `im_video_GB_sum` | double | Quasi | Video volume adds a usage dimension and may reveal an activity profile when linked; subset accounting against total volume is unverified. |
| `im_audio_GB_sum` | double | Quasi | Audio volume adds another activity dimension; low frequency or exact combinations may distinguish rows. |
| `tethering_data_GB_dl_sum` | double | Quasi | Tethering volume may characterize usage. The name says downlink while the supplied description says upload; direction is unresolved, and it is not safely treated as a subset of total volume. |
| `radio_access_type` | large_string | Quasi | Broad radio-technology class; weak alone but narrows candidate groups in conjunction with time, category and quality measurements. |
| `province` | large_string | Quasi | Region label participates in the current linkage test. Location was randomized; matching labels in the supplied data does not establish real geography or movement. |
| `application_category` | large_string | Quasi | Application category plus time/location, or a set of categories across observations, may distinguish a subscriber. It can also expose usage interests when linked. |
| `enb_id` | large_string | Quasi | Stable station/infrastructure label, not a direct subscriber identity. In combination with time and category it narrows candidates; neither actual coordinates nor station-to-province mapping are verified. |

## Relationship to the current release and evaluation

At the pinned commit, default `id_removal` removes the three direct identifiers and retains the other 19 fields. Default `id_removal_coarsen` also removes `enb_id`, retaining 18 fields. Despite the configuration name, no rounding is enabled by default. Both preserve row count/order and suppress no rows. API parameter overrides can change removed fields or add rounding; this classification describes source fields and default behavior, not every possible override.

The current linkage probes use time + province + application category and time + station + application category. Singling-out partitions use the released subset of time, province, station, application category and radio technology. Numeric fields are **not** part of those configured attack keys. Their omission is evaluation scope, not evidence they are non-identifying. The retained-linkage metadata also lists selected context fields rather than every possible numeric combination.

Dropping an attack's required field yields an unsupported attack, not a measured zero risk. Inference is explicitly unsupported and no combined privacy score is implemented. Row equivalence on a chosen subset does not assess all released attributes, future auxiliary information or composition across multiple releases. Read the [measurement caveats](measurement-caveats.md), [Elisa guidance](../elisa-guidance.md) and [data-handling account](../data-handling.md) before interpreting or sharing any output. No privacy-rate result is used here as proof of anonymity.