The Traffic Light Protocol for information sharing

Introduction

“The Traffic Light Protocol (TLP) was created to facilitate greater sharing of potentially sensitive information and more effective collaboration. Information sharing happens from an information source, towards one or more recipients. TLP is a set of four labels used to indicate the sharing boundaries to be applied by the recipients.” (FIRST)

The iAM.AMR project has adopted the TLP to simplify information sharing.

Usage

When you share your information with somebody else, include one of the four TLP markers (TLP:RED, TLP:AMBER, TLP:GREEN, or TLP:CLEAR) to indicate how widely that information may be shared with others. Prior to sharing others’ information with somebody else, review the TLP marker to understand how you may (or may not) share the information. If no marker exists, contact the original author for more details.

TLP Colour Summary Sharing When should it be used? Example
TLP:RED TLP Level Badge Not for disclosure, restricted to participants only. Recipients may not share TLP:RED information with any parties outside of the specific exchange, meeting, or conversation in which it was originally disclosed. When information cannot be effectively acted upon by additional parties, and could lead to impacts on a party’s privacy, reputation, or operations if misused. e.g. personally identifiable information, raw data sets, early manuscripts.
TLP:AMBER TLP Level Badge Limited disclosure, restricted to participants’ organizations. Recipients may only share TLP:AMBER information with members of the iAM.AMR team. This is the default level for all information stored in the iAM.AMR GitHub Organization. When information requires support to be effectively acted upon, and carries risks to privacy, reputation, or operations if shared outside of the organizations involved. e.g. incomplete models, internal communications, meeting notes.
TLP:GREEN TLP Level Badge Limited disclosure, restricted to the community. Recipients may share TLP:GREEN information with peers and partner organizations within their sector or community as necessary. Care should be taken to highlight the preliminary nature of any conclusions. When information is useful for the awareness of all participating organizations as well as with peers within the broader community or sector. e.g. presentations, posters, preliminary results.
TLP:CLEAR TLP Level Badge Public disclosure. Subject to standard copyright rules, TLP:WHITE information may be distributed without restriction. When information has been released to the public. e.g. peer-reviewed publications, presentations to stakeholders, public documentation.

Use the TLP in e-mail

Prepend the subject with the TLP marker. Append the TLP marker to the file name of any attachments.

Note, a colon (:) is not a valid file name character.

For example:

Subject:     TLP:RED Unreleased microbial surveillence data
Body:        Please find attached the preliminary data that will be released in 
             the upcomming surveillence report.
Attachments: microbial_counts_TLP-RED.csv.

Use the TLP online

The iAM.AMR project uses shields.io badges as a TLP markers.

Generate a sheilds.io badge in markdown using:

# Badge
TLP:RED   >>> ![TLP Level Badge](https://img.shields.io/badge/TLP-RED-red)
TLP:AMBER >>> ![TLP Level Badge](https://img.shields.io/badge/TLP-AMBER-yellow)
TLP:GREEN >>> ![TLP Level Badge](https://img.shields.io/badge/TLP-GREEN-brightgreen)
TLP:CLEAR >>> ![TLP Level Badge](https://img.shields.io/badge/TLP-CLEAR-lightgrey)

# Badge with Link
[![TLP Level Badge](https://img.shields.io/badge/TLP-CLEAR-lightgrey)](https://docs.iam.amr.pub)

Limitations

The TLP is simply a tool to guide information sharing; there is no mechanism by which to enfore the TLP. You should apply additional access controls to protect sensitive information, and/or be more specific with sharing boundaries where applicable.

The TLP level may be inferred from context (e.g., anything requiring a login to access is likely TLP:AMBER at minimum). However, you should not rely on others to correctly interpret context; always be explicit.