October 2016 - DG-BSC - mailman.kantarainitiative.org

Please read and respond ASAP if you're mentioned: Meetings and section assignments this week, and how to fill in sections
by Eve Maler 10 Oct '16

10 Oct '16

Both Thomas and I are *unable to attend/run* the meetings this week. We have a couple of options: a) If there is new section content to review, we could seek a chair pro tem (*Scott S?*) for that purpose, or b) if there isn't, we probably shouldn't meet. The current assignments are as follows. You can find most of them in the Report <http://kantarainitiative.org/confluence/display/BSC/Report+from+the+Blockch…> itself. *Can people please speak up TODAY about when they can complete first drafts*, and we'll make a judgment call ASAP about tomorrow's call? - IPFS: *Thomas* - Certificate Transparency: *Scott S* (already some content there) - CommonAccord: *Jim H* - Protocol-Specific Contract Provisions: - *Kathleen* for HL7 piece - *Eve* for UMA model text piece - Legal contracts: *Scott D* - Digital Identity: *Andrew* - UMA: *Eve* - Consent Receipts: *John W* - User-Submitted Terms: *John W* or designee - Case Study: MedRec: *Kathleen* - Case Study: Blood Diamond: *Matisse+Scott S* - Case Study: Sovrin: *Eve* For case studies, we said we'd use a questionnaire approach something like this: - Deficits and benefits of how the problem space was/is being solved - Proposed benefits of the new solution space – crystalize this (e.g., fraud, not "user empowerment"?) - Different approaches being taken (e.g., whitelist? blacklist? other?) in the new solution space - Strengths, weaknesses, risks, and open issues being seen in practice - Cross-references to the appropriate other technology, case study, and use case sections - Since our Report process is time-boxed, go into only as much depth as you can in a short period of time For *use cases*, we already have a template <http://kantarainitiative.org/confluence/display/BSC/Use+Case+Template> in use; I feel it may benefit from *enhancement* with points from the above. For *technology/technique sections*, we said we'd like to see this information: - A definition - A short discussion of strengths and weakness of the current way of doing things - A short comparative discussion of strengths and weakness of the new way of doing things (if the technology/technique is "new") - Pointers to the other technology and technique sections as appropriate (so that we have cross-references among the sections) *Eve Maler*ForgeRock Office of the CTO | VP Innovation & Emerging Technology Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl *ForgeRock Summits* are coming to <http://summits.forgerock.com/> *London and Paris!*

3 4

IIW and this DG (please respond by Friday morning!)
by Eve Maler 07 Oct '16

07 Oct '16

Hi folks-- If you are thinking of attending IIW and don't have your ticket yet: I've just been speaking to Phil Windley, and he was really interested to learn of our work. *He's able to offer us a special discount registration code for use by TOMORROW if you act quickly and let me know of your interest by tomorrow morning.* Also, since the Sovrin Foundation (which he writes about in detail on his blog <http://www.windley.com>) has a "self-sovereign (no IdP) identity using distributed ledger" approach, I suggested that we try out our case study questionnaire technique on him, and he's totally game to respond. I will take that action item when we have a draft questionnaire. :-) *Eve Maler*ForgeRock Office of the CTO | VP Innovation & Emerging Technology Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl *ForgeRock Summits* are coming to <http://summits.forgerock.com/> *London and Paris!*

3 3

FYI: Blockchain Healthcare 2016 Report
by John Wunderlich 06 Oct '16

06 Oct '16

FYI https://tierion.com/blog/blockchain-healthcare-2016-report/ John Wunderlich, Sent frum a mobile device, Pleez 4give speling erurz "...a world of near-total surveillance and endless record-keeping is likely to be one with less liberty, less experimentation, and certainly far less joy..." A. Michael Froomkin -- This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. This message contains confidential information and is intended only for the individual named. If you are not the named addressee you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately by e-mail if you have received this e-mail by mistake and delete this e-mail from your system. If you are not the intended recipient you are notified that disclosing, copying, distributing or taking any action in reliance on the contents of this information is strictly prohibited.

1 0

The famous presentation I mentioned: "It's Time to Fix HTTPS" by Chris Palmer
by Eve Maler 06 Oct '16

06 Oct '16

https://docs.google.com/presentation/d/1bieNRy4TU04PKhQ1i_J_kPZ_Tc2E6efNVbv… *Eve Maler*ForgeRock Office of the CTO | VP Innovation & Emerging Technology Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl *ForgeRock Summits* are coming to <http://summits.forgerock.com/> *London and Paris!*

2 1

Notes from BSC telecon Thursday, October 6
by Eve Maler 06 Oct '16

06 Oct '16

http://kantarainitiative.org/confluence/display/BSC/2016-10+%28October+2016… Agenda: - Report <http://kantarainitiative.org/confluence/display/BSC/Report+from+the+Blockch…> writing Attending: Eve, Scott S, Adrian, Kathleen, Matisse, Colin, Marco?, John W? Matisse has suggested the blood diamond example as a case study to analyze for this properties of enforcing ethics at a technology level. Here's a YouTube video <https://youtu.be/4sm5LNqL5j0> on it. This could be extended to several provenance use cases. Scott notes everledger.io <http://www.everledger.io/> as a company offering blockchain-based fraud detection services for insurance purposes, where the generic use case is fraud detection and the specific case study involves ethics of blood diamond provenance. The ivory trade could be another ethics use case. See also this article <http://www.coindesk.com/kimberley-process-continue-work-blood-diamond-block…>. The current process is Kimberley Process certificates. Apparently the Kimberley Process is looking at blockchain <https://www.kimberleyprocess.com/en/system/files/documents/kimberley_proces…> now. Would Matisse be willing to take on the assignment to write up the blood diamond case study? Scott S is interesting in this too. Matisse is only free after her PhD thesis is done in a month's time, and would like a structure. How about this for case study structures? - Deficits and benefits of how the problem space was/is being solved - Proposed benefits of the new solution space – crystalize this (e.g., fraud, not "user empowerment"?) - Different approaches being taken (e.g., whitelist? blacklist? other?) in the new solution space - Strengths, weaknesses, risks, and open issues being seen in practice - Cross-references to the appropriate other technology, case study, and use case sections - Since our Report process is time-boxed, go into only as much depth as you can in a short period of time *AI:* Scott S: Attempt to turn the draft case study structure into a questionnaire and see if we can reach out to everledger.io to try it out so we can begin to fill out a case study section with the results. We always reserve the right to massage any answers we get back, to do more research, and publish information in our own words. Note that it's possible to put diagrams in the final report. We will make sure of it. All report authors should feel free to submit diagrams and graphics. Discussing the language Scott has contributed to the Certificate Transparency <http://kantarainitiative.org/confluence/display/BSC/Report+from+the+Blockch…> section of the report: We suggest adding a bit of discussion about the weaknesses of PKI, and the optimistic assumption of much blockchain technology about PKI and how identity can just use a clean global PKI system. Also, how much of blockchain node participation is anonymous, how much of the time? The notion behind Certificate Transparency is to force, at a technical level, knowledge of what you've got. The section could contain cross-references to the other technology sections. *AI:* Eve: Find for Scott S the "Let's fix HTTPS" presentation that explains why browsers are never going to get better at cert management. Thomas reports that he is working on his IPFS section. Kathleen is working on her HL7 section. Eve's thoughts for her UMA section run in this direction: UMA's primary goal is empowerment for a particular type of transaction, which is sharing of digital resources. In the course of coming up with an architecture for that, UMA invented an interestingly powerful service (the AS), which is, however, a centralized entity that must be trusted. (Adrian's "pure" form requires this to be chosen by the individual, akin to a public blockchain that is completely decentralized, whereas most initial deployments are expected to be akin to a permissioned blockchain that we could consider less "pure".) The work on UMA Legal attempts to mitigate the risk of having central services matching up to distributed APIs. More brainstorming on UMA section ideas: Adrian's formulation of requirements sent to the list: Trust and personal data - identifying the patient that is the subject of the data, - identifying the user requesting patient data, - recording and auditing the authorization to release the patient data, - establishing the authenticity of the data that is being released, - paying for the service that delivered the patient data, - controlling and auditing that the shared data was used as expected. Eve's revision: ??? - Identifying the resource subject - Identifying claims about the user requesting access - (something about authorization itself??) - Recording and auditing the authorization to access the resource - Establishing the authenticity of the resource that was accessed - Paying for the service that delivered the resource - Controlling and auditing that the resource was used as expected We made a few changes in the report itself as well. *Eve Maler*ForgeRock Office of the CTO | VP Innovation & Emerging Technology Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl *ForgeRock Summits* are coming to <http://summits.forgerock.com/> *London and Paris!*

1 0

Notes from BSC telecon Tuesday, October 4
by Eve Maler 04 Oct '16

04 Oct '16

http://kantarainitiative.org/confluence/display/BSC/2016-10+%28October+2016… Agenda: - Report <http://kantarainitiative.org/confluence/display/BSC/Report+from+the+Blockch…> writing Attending: Eve, Thomas, Kathleen, Scott S, John W, Matisse, Adrian *N.B.:* Many of us will begin to see daylight saving time weirdness in the timing of BSC calls this month and into the next. Please note that US times are normative during daylight saving time changes! Please double-check the DG calendar <http://kantarainitiative.org/confluence/display/BSC/Calendar> if your local clock has changed. We gave out additional technology writeup assignments. No new text was written yet, but we will expect at least some for review by Thursday. The assignment in each case is: - A definition - A short discussion of strengths and weakness of the current way of doing things - A short comparative discussion of strengths and weakness of the new way of doing things (if the technology/technique is "new") - Pointers to the other technology and technique sections as appropriate (so that we have cross-references among the sections) The blockchain section will end up being the most complex and lengthy. Discussion about "public and private blockchains have different dynamics": How different is the dynamic when anyone can can write a block to the chain vs. there has to be a trust framework determining who can write a block to the chain? *How does the value to an individual (read: disempowered party) who wants to use the resulting blockchain-based system change?* We looked at the example of OpenBazaar.org for trading any goods in a peer-to-peer fashion, vs. a traditional non-blockchain-based system like eBay, vs. a private blockchain-based system where you have to get into the trust framework (the "club")? Discussion about public, private, different consensus protocols, etc.: There's an interplay of consensus types and governance types. OpenBazaar in particular may require node participants to sign an agreement (according to Thomas's tentative understanding), although node participants may be anonymous – we're not exactly sure. OpenBazaar <https://openbazaar.org/> might be a good compact intro-level example – or a worked case study. It's just a bit more controlled than total anonymous/anarchy. It was started <https://en.wikipedia.org/wiki/OpenBazaar> to illustrate that e-commerce transactions can be legitimate in an efficient P2P environment, removing huge third-party coercion (Amazon, eBay) concerns – but the big parties can mitigate the risk of a bad actor in the way that we suspect P2P system can't. We should research their level of contract/governance imposition to see if it contains a solution to weed out bad actors. The identities/parties in this picture: Individuals who want to trade; node miners; OpenBazaar itself; who else? *AI:* Eve: Ask Thomas to follow up with OpenBazaar or make introductions with some other BSCer. *Eve Maler*ForgeRock Office of the CTO | VP Innovation & Emerging Technology Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl *ForgeRock Summits* are coming to <http://summits.forgerock.com/> *London and Paris!*

1 0

- Model Stock Purchase Agreement
by James Hazard 03 Oct '16

03 Oct '16

Many of you know that the CommonAccord vision of smart contracts is comprehensive - _all_ records of transactions could be "smart contracts," if we view smart contracts as records that link to their context. At one extreme, there are high-volume, low-text transactions like payments. At the opposite extreme is the acquisition of a company. An acquisition, of course, requires many records, but we can frame it with a single one - a transaction term sheet. This six minute video shows the American Bar Association's "Model Stock Purchase Agreement" in codified form, complemented by a term sheet of parameters. This term sheet is not a smart contract, but it is easy to see that much of it could be automated, or at least supported by automation. A smart contract approach to acquisition agreements could drive codification of business operations - leading ultimately to a company-as-object. https://www.youtube.com/watch?v=TXQvk6_GXDc

1 0

blockchain papers repository
by mat perugini 02 Oct '16

02 Oct '16

http://www.the-blockchain.com/docs/ Kind regards Matisse

1 0