November 2016 - DG-BSC - mailman.kantarainitiative.org

Graphic to attempt to capture what James was saying
by John Wunderlich 30 Nov '16

30 Nov '16

[image: Inline images 1] Sincerely, John Wunderlich @PrivacyCDN <https://twitter.com/PrivacyCDN> Call: +1 (647) 669-4749 eMail: john(a)wunderlich.ca -- This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. This message contains confidential information and is intended only for the individual named. If you are not the named addressee you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately by e-mail if you have received this e-mail by mistake and delete this e-mail from your system. If you are not the intended recipient you are notified that disclosing, copying, distributing or taking any action in reliance on the contents of this information is strictly prohibited.

5 17

Notes from BSC telecon Tuesday November 29
by Eve Maler 29 Nov '16

29 Nov '16

http://kantarainitiative.org/confluence/display/BSC/2016-11+%28November+201… Agenda: - Discuss end-stage recommendations Attending: Thomas, Eve, John W, Eve, John M, Jim Next steps: What would a follow-on group work on? DG or WG? You'd normally expect a WG to deliver technical specs. Existing group (such as the IRM WG) or new group? Blockchain has a challenge in that the "center is floating" but it still has one (a silo?). While the name of smart contracts is odd, the concept of joining identities in a legal sense to the code is valuable. Jim suggests that if we have an identity (that is, start from the identity-centric view), then we necessarily have semantics. The legal layer of transactional semantics is "prose" (as R3 calls it), which allows incomplete statements that can gain clarity and interpretation over time. "Code", on the other hand, must be complete in some sense immediately (modulo machine learning inference stuff). We're saying "an identity" meaning a single digital identity; all identities meet in the meat! (See this <http://www.terrybisson.com/page6/page6.html>...) In legal-land, think of "persons". (sync (relationship (identity (person (meat))))) ------------------------------------------------ (sync (identities (relationship))) (See the much nicer diagram JohnW sent to the list!) Do we think the lowest-hanging fruit around our recommendations would be around the identity/smart contracts elements? Could the relationship elements be captured in a smart contract itself? The incompleteness of any contract means there are assumptions that lean on a legal framework. ("Can smart contracts be legally binding contracts?" <http://www.nortonrosefulbright.com/knowledge/publications/144559/can-smart-…> In short, yes, if you reference both prose and code.) Use cases that are real for many today: - Smart home - Entities with identities, and their identities - Homeowner (primary), family member, AirBnB renters - Smart home devices - Contract conditions - Renters contracted through AirBnB are allowed to access the specified functions of the smart home devices, and only for a limited time - Family members can access the specified functions of the smart home devices until access is revoked - Medical/telematics - Entities with identities, and their identities - Patient (primary), doctors, nurses (care team), administrative staff - Insulin pump, other devices - Contract conditions - Whoever is a member of the care team can control and access the insulin pump settings - Substitute nurses etc. - Proxy powers - Entities with identities, and their identities - Mother, toddler, nanny - Contract conditions - The nanny can legally pick up the toddler from daycare and drive him around town Looking at PSD2, the bank account is becoming the fundamental unit of identity. Actually, it sort of always was. The notion of an "identity account" came from more monetary notions of accounts. Proposal: Add identity to the prose+code recommendations already extant for smart contracts. Jim sent this link <http://www.commonaccord.org/index.php?action=doc&file=bqc/fr/bnpp/a5we/Acco…> to a CommonAccord contract. *AI:* Jim: Send the Norton Rose paper to the list so we can bash it. *Eve Maler*ForgeRock Office of the CTO | VP Innovation & Emerging Technology Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

2 1

Can Smart Contracts be legally binding... publication..
by Colin Wallis 29 Nov '16

29 Nov '16

Just logged in here at Norton Rose Fullbright hosting WebScience@10, and saw this on their homepage.. http://www.nortonrosefulbright.com/knowledge/publications/144559/can-smart-… 'Gris to the mill. Cheers Colin

1 0

Upcoming meeting schedule adjustments
by Eve Maler 10 Nov '16

10 Nov '16

Hi folks-- Due to travel, vacations, and holidays, we're making some adjustments in our meeting schedule for the upcoming weeks: - *Cancel Tuesday Nov 8* (still keep the Thursday) - *Cancel Tuesday Nov 15* (still keep the Thursday) - *Cancel Thursday Nov 24* -- US Thanksgiving (still keep the Tuesday) You'll see these reflected in the BSC DG online calendar <http://kantarainitiative.org/confluence/display/BSC/Calendar> shortly. As always, if you haven't yet subscribed to this calendar, it's a good idea to do so. Also please note that Thomas has kindly agreed to take on a primary Report editing role, now that he's finished with the publication of his new book <https://www.amazon.com/Trust-Data-Framework-Identity-sharing/dp/153911421X/…> (have you ordered yours yet? :-) ). I'll take on a secondary editing role. Thanks, Thomas! *Eve Maler*ForgeRock Office of the CTO | VP Innovation & Emerging Technology Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl *The ForgeRock Identity Summit* is coming to <http://summits.forgerock.com/> *Paris in November!*

3 3

DRY systems, authoritative sources of data, and individuals
by Eve Maler 07 Nov '16

07 Nov '16

I changed the subject line so as not to be misleading. Hopefully that starts a "new thread" in most everybody's email systems. I'm still not getting what about "blockchain the technology" helps any of this. Lots of information that is important to an individual -- e.g. credit information, as pointed out below -- must be third-party-asserted to be valuable. We can argue about whether this is/constitutes/contributes to "identity" information or not (in this case, it can be used to help "proof" a digital identity and so on). But the conventional wisdom seems to be hardening around the notions that: - It's inefficient, inappropriate, and insecure to store such information by means of DLTs. - It's quite often inefficient, inappropriate, and insecure to aggregate such information in a single place away from whoever is authoritative for it. See all the schemes -- federated identity and federated authorization both -- for getting this info fresh by means of attribute transfer and API calls and such. You have to tamper-proof college e-transcripts, income tax forms, identity attributes, etc. that have to pass through intermediary services if you can't arrange for them to be shared directly. UMA at least tries to let an individual authorize access to data that is asserted by others about them. (That role at the technical level is called "resource owner" after OAuth, but as I always say, I never liked that phrase, property being a bundle of sticks... :-) ) *Eve Maler*ForgeRock Office of the CTO | VP Innovation & Emerging Technology Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl *The ForgeRock Identity Summit* is coming to <http://summits.forgerock.com/> *Paris in November!* On Tue, Nov 1, 2016 at 10:46 AM, Adrian Gropper <agropper(a)healthurl.com> wrote: > I share Jim's perspective about incremental semantic standards and I'm > seeing coherent identity standardization efforts at every level with: > > 1 - Authentication credentials corresponding to a decentralized identifier > (DID), point to > 2 - Secure decentralized identity data objects (DDO), that point to > 3 - Identity Containers that issue (W3C) verifiable claims and > (UMA) authorization tokens to use > 4 - on other resources with my personal data on the Web that are only > partially under my control. > > Levels 1-3 can be self-sovereign without any federated IDPs. > > However, there is absolutely no mention of PDS in any of the forums. The > term may be too vague and overloaded to be useful. I hope we can abandon it > soon. Identity containers may not be a much better term but at least it > allows for a personal authorization server as a component. > > Adrian > > On Tuesday, November 1, 2016, James Hazard <james.g.hazard(a)gmail.com> > wrote: > >> Sorry, I missed the call, again. On the west coast for a bit. >> >> I agree with the direction of the conversation. >> >> The essence of a peer-based system is the PDS notion. Each participant >> has a first-class copy of the records that touch them. >> >> Those records must be in formats that have common semantics. >> >> Because the world is big and varied (and more top-down is dangerous), the >> semantics need to be extensible by the participants. The commonality of the >> semantics does not need to be system-wide, it only needs to be shared as >> far as the records they relate to. This makes it possible to do >> "standards" incrementally. (Open source software iterates from personal >> project to standard this way.) >> >> Blockchain permits each participant to have a first-class copy, but has >> major draw backs, particularly that every participant gets a copy of all >> the records (reason that Corda is not a blockchain) and blockchains have >> the rigidities of "shared state." (https://medium.com/@justmoon >> /the-subtle-tyranny-of-blockchain-91d98b8a3a65#.oupo603xl) >> >> Ideally, each record would be only in the PDSs of the participants that >> the record directly touches. >> >> To run a "DRY" system, with very little need to have duplicate >> information about participants, the PDS must be available to respond to >> appropriate queries. >> >> The records in the PDS could come all via a single protocol, but they >> could instead come via a variety of protocols. The participants do need a >> way to prove records as against one another. There are a variety of ways >> to do this, and they don't need to depend on the protocol. >> >> From this perspective, the goal is PDSs with shared record semantics, >> unlimited extensibility, and a secure method of querying. Unlimited >> extensibility is what the "prototype inheritance" model of CommonAccord >> appears to enable. >> >> That in turn will create an ecosystem for codified legal, which is the >> goal of CommonAccord. >> >> >> >> >> >> >> On Tue, Nov 1, 2016 at 8:52 AM, Adrian Gropper <agropper(a)healthurl.com> >> wrote: >> >>> You might find the FAQ useful. >>> >>> https://w3c.github.io/webpayments-ig/VCTF/charter/faq.html >>> >>> Adrian >>> >>> On Tuesday, November 1, 2016, Eve Maler <eve.maler(a)forgerock.com> wrote: >>> >>>> Adrian-- I'm sorry, it appears you already did send this link to the >>>> group! Thanks; action item completed. >>>> >>>> >>>> *Eve Maler*ForgeRock Office of the CTO | VP Innovation & Emerging >>>> Technology >>>> Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl >>>> *The ForgeRock Identity Summit* is coming to >>>> <http://summits.forgerock.com/> *Paris in November!* >>>> >>>> On Tue, Aug 30, 2016 at 2:06 PM, Adrian Gropper <agropper(a)healthurl.com >>>> > wrote: >>>> >>>>> We should also consider the place of protocols that support >>>>> decentralization without neccessarily being either blockchain or smart >>>>> contracts. For example, W3C Verifiable Claims https://w3c.github.io/w >>>>> ebpayments-ig/VCTF/use-cases/ seems to solve a major privacy and >>>>> centralization problem by enabling triple-blind interactions. >>>>> >>>>> Adrian >>>>> >>>>> >>>>> On Tuesday, August 30, 2016, Scott L. David <sldavid(a)uw.edu> wrote: >>>>> >>>>>> Jeff - I heartily agree with all the points you raise. >>>>>> >>>>>> Kind regards, >>>>>> Scott >>>>>> >>>>>> Scott L. David >>>>>> >>>>>> Director of Policy >>>>>> Center for Information Assurance and Cybersecurity >>>>>> University of Washington - Applied Physics Laboratory >>>>>> >>>>>> Principal Consulting Analyst >>>>>> TechVision Research >>>>>> >>>>>> w- 206-897-1466 >>>>>> m- 206-715-0859 >>>>>> Tw - @ScottLDavid >>>>>> >>>>>> ------------------------------ >>>>>> *From:* j stollman <stollman.j(a)gmail.com> >>>>>> *Sent:* Tuesday, August 30, 2016 10:15:27 AM >>>>>> *To:* Scott L. David >>>>>> *Cc:* Eve Maler; dg-bsc(a)kantarainitiative.org >>>>>> *Subject:* Re: [DG-BSC] Agenda for BSC telecon Tuesday, August 30 >>>>>> (shortly -- sorry for the late note!) >>>>>> >>>>>> Scott, >>>>>> >>>>>> Excellent survey. >>>>>> >>>>>> I would like to further emphasize one of the corollary points you >>>>>> raise: *Perhaps we shouldn't be looking for a >>>>>> distributed organizational "structure" at all. Instead, we might consider >>>>>> what organizational "processes" would serve the interests involved, and >>>>>> then allow the organizational structure to reveal itself based on the >>>>>> observation and reification of the patterns that emerge from those >>>>>> processes.* >>>>>> >>>>>> In my observations people move rapidly from trying to describe a new >>>>>> solution to using their description to prescribe its use. Over two years >>>>>> of focus on blockchain technology, I have noticed that it is common for >>>>>> people to recognize that a particular instance of blockchain solves a >>>>>> particular problem and to then falsely conclude that the features of that >>>>>> instantiation are necessary to achieve the same end in other contexts. For >>>>>> example, we give a lot of lip service to the fact that popular blockchain >>>>>> instances use a distributed model in which the blockchain itself is >>>>>> replicated in numerous locations and the block verification process is also >>>>>> distributed among a large group of "miners." This has been followed by the >>>>>> conclusion that all blockchains are necessarily distributed for both data >>>>>> integrity and verification integrity. (In fact many people now refer to >>>>>> blockchain technology as "Distributed Ledger Technology" (DLT)). I >>>>>> suggest that this causes an unnecessary narrowing of our thinking by >>>>>> casting out other alternatives before they are even considered. >>>>>> >>>>>> In the example, I would suggest that distributed data does provide >>>>>> higher levels of information assurance by removing a single point of >>>>>> failure that a nefarious hacker could modify. And this is likely true for >>>>>> any instantiation of a data structure -- whether or not it is a blockchain >>>>>> -- as long as the consensus mechanism for determining which data set is the >>>>>> correct one when discrepancies are found is robust. But, depending on the >>>>>> risk of such hacks, it may not be cost-effective to use this information >>>>>> assurance technique. As long as the underlying data structure uses >>>>>> blockchain encryption, I would still consider it a blockchain application. >>>>>> >>>>>> I also agree that distributed miners afford some ability to reduce >>>>>> collusion in systems where there is an incentive to collude. But not all >>>>>> transaction systems have such an incentive. And I don't think that mining >>>>>> whether using proof of work or proof of stake is either cost-effective or >>>>>> necessary. >>>>>> >>>>>> We all agree that standardization can create great benefits. But >>>>>> standardizing too early can stifle innovation or raise the cost of better >>>>>> solutions to the point of making them no longer viable. >>>>>> >>>>>> In view of the many directions that our blockchain DG discussions >>>>>> continue to splinter off, I hope that this comment offers some value. >>>>>> >>>>>> Jeff >>>>>> >>>>>> >>>>>> --------------------------------- >>>>>> Jeff Stollman >>>>>> stollman.j(a)gmail.com >>>>>> +1 202.683.8699 >>>>>> >>>>>> >>>>>> Truth never triumphs — its opponents just die out. >>>>>> Science advances one funeral at a time. >>>>>> Max Planck >>>>>> >>>>>> On Tue, Aug 30, 2016 at 12:09 PM, Scott L. David <sldavid(a)uw.edu> >>>>>> wrote: >>>>>> >>>>>>> Hi folks - This wiki page provides a pretty nice overview of >>>>>>> cooperatives. >>>>>>> >>>>>>> >>>>>>> https://en.wikipedia.org/wiki/Cooperative >>>>>>> >>>>>>> I am NOT suggesting that we confine ourselves to these historical >>>>>>> structures, since they are all institutions configured to address various >>>>>>> prior governance/organizational challenges, none of which will perfectly >>>>>>> match current challenges in character and scope. >>>>>>> >>>>>>> >>>>>>> However, exploration of the co-op form (and similar structures >>>>>>> developed under various legal and cultural regimes) can provide insight >>>>>>> into at least prior forms of "organic" stakeholder-responsive governance >>>>>>> that can potentially help to reveal governance techniques that might be >>>>>>> borrowed for our current discussions and effort. >>>>>>> >>>>>>> >>>>>>> I am guessing (projecting) that organizational surveys might suggest >>>>>>> that we consider separating the analysis of stakeholder involvement into at >>>>>>> least three sub-categories of governance activity, along the lines to >>>>>>> which Jeff S. was alluding in the call. >>>>>>> >>>>>>> >>>>>>> Specifically, we might benefit from separating out stakeholder >>>>>>> involvement in the separate activities of 1. rule making, 2. system >>>>>>> operation, and 3. enforcement, as helpful in mitigating the >>>>>>> conflict-of-interest/power accumulation/etc. issues that are inherent in >>>>>>> the centralized models (and their too-often-tempting-abuses of gatekeeping >>>>>>> function). For example, in 2007 when NASD (National Association of >>>>>>> Securities Dealers) converted to FINRA (FInancial Industry Regulatory >>>>>>> Authority, Inc.) they formed separate subsidiaries to separate these three >>>>>>> functions for the SRO (self-regulatory organization) responsible for broker >>>>>>> dealer activities (at least for purposes of optics!). For current >>>>>>> purposes, the important point is that they chose to separate the rule >>>>>>> making, operation and enforcement purposes to at least reduce the >>>>>>> appearances of conflict among the decision making in those separate spheres. >>>>>>> >>>>>>> >>>>>>> Of course, these 3 "system governance" elements are in addition to >>>>>>> stakeholder role as system "users," which is not a "governance" role, per >>>>>>> se. However, in co-op and similar forms participation as a "user" is a >>>>>>> form of quasi-governance since the use of the system by a >>>>>>> stakeholder reveals problems and value propositions that helps the >>>>>>> stakeholders to set the agenda for further refinement of the system in the >>>>>>> "1. rule making" role of stakeholders alluded to above. >>>>>>> >>>>>>> >>>>>>> The current global information network organizational structure >>>>>>> that we are looking for does not yet have a name, but that novelty should >>>>>>> not be discouraging. ALL forms of human organization (governance, >>>>>>> language, belief systems, etc.) are responses to shared challenges, and all >>>>>>> of them permit stakeholders (both institutional or individual) to do >>>>>>> things (mitigate risks and enhance rewards) that they cannot do (or cannot >>>>>>> do as well) unilaterally. Many of the shared challenges that are currently >>>>>>> faced by individuals are unprecedented, requiring groups such as ours to >>>>>>> search the history of human organization for clues as to what might be >>>>>>> effective in this context. >>>>>>> >>>>>>> >>>>>>> One last thought (at least for now!). Perhaps we shouldn't be >>>>>>> looking for a distributed organizational "structure" at all. Instead, we >>>>>>> might consider what organizational "processes" would serve the interests >>>>>>> involved, and then allow the organizational structure to reveal itself >>>>>>> based on the observation and reification of the patterns that emerge from >>>>>>> those processes (as "Lagrangian Coherent Structures" for you fluid >>>>>>> mechanics geeks out there). Our first question might be "What are the sets >>>>>>> of processes that MUST be standardized, normalized in order for the value >>>>>>> propositions of block chain and/or smart contracts to be effective in >>>>>>> mitigating risk and/or leveraging value?" After we catalog those >>>>>>> processes, we might be in a position to assign that catalog a name. >>>>>>> >>>>>>> >>>>>>> An article "Self Regulation as Policy Process" by Porter and Ronit >>>>>>> (2006) suggests that among hundreds of "self-regulatory" organizations, a >>>>>>> familiar 5 stage pattern emerges for a governance feed-back loop among >>>>>>> stakeholders (agenda setting-problem identification-decision-implementation-review). >>>>>>> The emergence of this similar archetype pattern in myriad disparate >>>>>>> settings may be suggesting that there is a natural feedback process through >>>>>>> which separate elements of human organization can be joined together to >>>>>>> create larger forms in "information" space, where decreased Shannon entropy >>>>>>> (in whatever context or domain) is the ultimate test of fitness (based on >>>>>>> the primacy of information risk and information leverage in current >>>>>>> discussions). >>>>>>> >>>>>>> >>>>>>> This latter suggestion may be confirmed by considering how many >>>>>>> current human institutions and organizations can be accurately described by >>>>>>> reference to their information flows and processes, variously constrained >>>>>>> by their intended application. Human organizations that demonstrate their >>>>>>> usefulness "achieve" longevity (in fact human stakeholders have >>>>>>> endowed governments, and corporations with "perpetual life," by mutual >>>>>>> agreement, in an effort to project an external sovereignty toward these >>>>>>> organizational forms that are relied upon to create a "solid" foundation of >>>>>>> most (not all) human endeavor). However, all governments and corporations >>>>>>> are collective hallucinations of the stakeholders that recognize, and >>>>>>> depend upon, their presence. >>>>>>> >>>>>>> >>>>>>> But I digress. . . >>>>>>> >>>>>>> >>>>>>> Kind regards, >>>>>>> >>>>>>> Scott >>>>>>> >>>>>>> >>>>>>> *Scott L. David* >>>>>>> >>>>>>> >>>>>>> Director of Policy >>>>>>> >>>>>>> Center for Information Assurance and Cybersecurity >>>>>>> >>>>>>> University of Washington - Applied Physics Laboratory >>>>>>> >>>>>>> >>>>>>> Principal Consulting Analyst >>>>>>> >>>>>>> TechVision Research >>>>>>> >>>>>>> >>>>>>> w- 206-897-1466 >>>>>>> >>>>>>> m- 206-715-0859 >>>>>>> Tw - @ScottLDavid >>>>>>> >>>>>>> >>>>>>> >>>>>>> ------------------------------ >>>>>>> *From:* dg-bsc-bounces(a)kantarainitiative.org < >>>>>>> dg-bsc-bounces(a)kantarainitiative.org> on behalf of Eve Maler < >>>>>>> eve.maler(a)forgerock.com> >>>>>>> *Sent:* Tuesday, August 30, 2016 6:50 AM >>>>>>> *To:* dg-bsc(a)kantarainitiative.org >>>>>>> *Subject:* [DG-BSC] Agenda for BSC telecon Tuesday, August 30 >>>>>>> (shortly -- sorry for the late note!) >>>>>>> >>>>>>> http://kantarainitiative.org/confluence/display/BSC/2016-08+ >>>>>>> %28August+2016%29+Meetings#id-2016-08(August2016)Meetings-Tu >>>>>>> esday,August30 >>>>>>> >>>>>>> We meet *Tuesdays* for 30 minutes at 7:30am PT / 10:30am ET / >>>>>>> 3:30pm UK / 4:30pm CET. We use Kantara Line A (US +1-805-309-2350, >>>>>>> Skype +99051000000481, international options >>>>>>> <https://www.turbobridge.com/international.html>, web interface >>>>>>> <https://panel.turbobridge.com/webcall/>, more info >>>>>>> <https://www.turbobridge.com/join.html>, code 4022737) and >>>>>>> http://join.me/findthomas for screen sharing. See the DG calendar >>>>>>> <http://kantarainitiative.org/confluence/display/BSC/Calendar> for >>>>>>> our full meeting schedule. Previous meeting minutes are here: July >>>>>>> <http://kantarainitiative.org/confluence/display/BSC/2016-07+%28July+2016%29…> >>>>>>> . >>>>>>> >>>>>>> Agenda: >>>>>>> >>>>>>> >>>>>>> - Confirm timeline, scope, and approach, or revise in specific >>>>>>> - Assign action items for report next steps >>>>>>> >>>>>>> >>>>>>> *Eve Maler *ForgeRock Office of the CTO | VP Innovation & Emerging >>>>>>> Technology >>>>>>> Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl >>>>>>> *ForgeRock Summits and UnSummits* are coming to >>>>>>> <http://summits.forgerock.com/> *London and Paris!* >>>>>>> >>>>>>> _______________________________________________ >>>>>>> DG-BSC mailing list >>>>>>> DG-BSC(a)kantarainitiative.org >>>>>>> http://kantarainitiative.org/mailman/listinfo/dg-bsc >>>>>>> >>>>>>> >>>>>> >>>>> >>>>> -- >>>>> >>>>> Adrian Gropper MD >>>>> >>>>> PROTECT YOUR FUTURE - RESTORE Health Privacy! >>>>> HELP us fight for the right to control personal health data. >>>>> DONATE: http://patientprivacyrights.org/donate-2/ >>>>> >>>>> >>>>> _______________________________________________ >>>>> DG-BSC mailing list >>>>> DG-BSC(a)kantarainitiative.org >>>>> http://kantarainitiative.org/mailman/listinfo/dg-bsc >>>>> >>>>> >>>> >>> >>> -- >>> >>> Adrian Gropper MD >>> >>> PROTECT YOUR FUTURE - RESTORE Health Privacy! >>> HELP us fight for the right to control personal health data. >>> DONATE: http://patientprivacyrights.org/donate-2/ >>> >>> >>> _______________________________________________ >>> DG-BSC mailing list >>> DG-BSC(a)kantarainitiative.org >>> http://kantarainitiative.org/mailman/listinfo/dg-bsc >>> >>> >> >> >> -- >> @commonaccord >> > > > -- > > Adrian Gropper MD > > PROTECT YOUR FUTURE - RESTORE Health Privacy! > HELP us fight for the right to control personal health data. > DONATE: http://patientprivacyrights.org/donate-2/ > >

8 28

Fwd: Smart contracts: unlock blockchain's potential
by Colin Wallis 04 Nov '16

04 Nov '16

Folks FYI from DigiCat. Cheers Colin ---------- Forwarded message ---------- From: Digital Catapult <newsletter(a)digital-catapult.org.uk> Date: Fri, Nov 4, 2016 at 7:02 PM Subject: Smart contracts: unlock blockchain's potential To: "colin(a)kantarainitiative.org" <colin(a)kantarainitiative.org> Not displaying properly? | View in Browser <http://digital-catapult.org.uk/2DZY-Y09Y-F15XSSQT83/cr.aspx> Forward this email to a friend <http://digital-catapult.org.uk/2DZY-Y09Y-F15XSSQT83-1/fw.aspx> News November 2016 Dear Colin, *Top News**New games, new rules <http://digital-catapult.org.uk/2DZY-Y09Y-5XSSQT-GZ7NZ-1/c.aspx>* We've been working with the *UK Games Fund <http://digital-catapult.org.uk/2DZY-Y09Y-5XSSQT-GZ7O0-1/c.aspx>* to create a smart contract prototype that uses blockchain technology to boost innovation in the UK gaming industry. You can read more about our work in blockchain and smart contracts *here <http://digital-catapult.org.uk/2DZY-Y09Y-5XSSQT-GZ7NZ-1/c.aspx>*, watch *'The Blockchain: Change Everything Forever' <http://digital-catapult.org.uk/2DZY-Y09Y-5XSSQT-GZ7O1-1/c.aspx>* video and and share your thoughts at our next *blockchain meetup <http://digital-catapult.org.uk/2DZY-Y09Y-5XSSQT-GZ7O2-1/c.aspx>* on 5 December. *Save the date: Blockchain Meetup <http://digital-catapult.org.uk/2DZY-Y09Y-5XSSQT-GZ7O3-1/c.aspx> * <http://digital-catapult.org.uk/2DZY-Y09Y-5XSSQT-GZ7O4-1/c.aspx> *Open Call: Thales Pit Stop <http://digital-catapult.org.uk/2DZY-Y09Y-5XSSQT-GZ7O4-1/c.aspx>* Develop 'predict and prevent' rail infrastructure <http://digital-catapult.org.uk/2DZY-Y09Y-5XSSQT-GZ7O5-1/c.aspx> *Open Call: ViiV Pit Stop <http://digital-catapult.org.uk/2DZY-Y09Y-5XSSQT-GZ7O5-1/c.aspx>* Find new solutions to transform HIV care Other News F-Interop Open Call <http://digital-catapult.org.uk/2DZY-Y09Y-5XSSQT-GZ7O6-1/c.aspx> IoT SMEs looking to test interoperable solutions are invited to take part in our *F-Interop Open Call* <http://digital-catapult.org.uk/2DZY-Y09Y-5XSSQT-GZ7O6-1/c.aspx>. Apply before *25 January 2017* and you could receive up to *€100,000* funding. Case studies <http://digital-catapult.org.uk/2DZY-Y09Y-5XSSQT-GZ7O7-1/c.aspx> Learn how we are working with businesses big and small with our latest case studies featuring *PwC <http://digital-catapult.org.uk/2DZY-Y09Y-5XSSQT-GZ7O8-1/c.aspx>* and *Blue Maestro <http://digital-catapult.org.uk/2DZY-Y09Y-5XSSQT-GZ7O9-1/c.aspx>*. Check out the full list of case studies *here <http://digital-catapult.org.uk/2DZY-Y09Y-5XSSQT-GZ7O7-1/c.aspx>*. Jim Collins: Live in London <http://digital-catapult.org.uk/2DZY-Y09Y-5XSSQT-GZ7OA-1/c.aspx> Business strategist, leadership thinker and best-selling author Jim Collins will be presenting an exciting seminar in London. Join him on *28 February 2017* and discover the characteristics your company needs to achieve success. *Book your place now.* <http://digital-catapult.org.uk/2DZY-Y09Y-5XSSQT-GZ7OB-1/c.aspx> Events Meet the Expert: NASA <http://digital-catapult.org.uk/2DZY-Y09Y-5XSSQT-GZ7OC-1/c.aspx> What does innovation at NASA look like? Find out on *10 November* as Digital Catapult Centre North East & Tees Valley interview JPL Ops Labs' Doug Ellison about his career and technology used by NASA. *Sign up here <http://digital-catapult.org.uk/2DZY-Y09Y-5XSSQT-GZ7OC-1/c.aspx>.* Brighton Digi Drop in <http://digital-catapult.org.uk/2DZY-Y09Y-5XSSQT-GZ7OD-1/c.aspx> Meet the Digital Catapult Centre Brighton team on *11 November* and hear about the latest tech trends and developments at their *Digi Drop in <http://digital-catapult.org.uk/2DZY-Y09Y-5XSSQT-GZ7OD-1/c.aspx>*. This month they will be joined by the University of Brighton's Knowledge Engineering Group, who will share their expertise in big data and Applied Intelligent Systems. *Book your place <http://digital-catapult.org.uk/2DZY-Y09Y-5XSSQT-GZ7OD-1/c.aspx>* *AI vs Business: Economic Impacts of Deep Learning <http://digital-catapult.org.uk/2DZY-Y09Y-5XSSQT-GZ7OE-1/c.aspx>* How will artificial intelligence impact UK industries and businesses? Join us for a day of exciting discussions on *6 December* at the Digital Catapult Centre in London. *Register here. <http://digital-catapult.org.uk/2DZY-Y09Y-5XSSQT-GZ7OE-1/c.aspx>* Latest content Bring Your Own Device: where's the risk? <http://digital-catapult.org.uk/2DZY-Y09Y-5XSSQT-GZ7OG-1/c.aspx> Could bringing your own device to work hinder the security of your business? Hypersocket's *Lee Painter* shares thoughts in his *blog post. <http://digital-catapult.org.uk/2DZY-Y09Y-5XSSQT-GZ7OG-1/c.aspx> * Connected Homes: a storm in a teacup <http://digital-catapult.org.uk/2DZY-Y09Y-5XSSQT-GZ7OH-1/c.aspx> Digital Catapult Centre Brighton resident *Mark Rittman* had an epic 11 hour struggle to make a cup of tea with his IoT enabled kettle. Read about his experience *here* <http://digital-catapult.org.uk/2DZY-Y09Y-5XSSQT-GZ7OI-1/c.aspx>. *The Blockchain: Change Everything Forever <http://digital-catapult.org.uk/2DZY-Y09Y-5XSSQT-GZ7OJ-1/c.aspx>* Discover how blockchain is set to transform society by watching our new *YouTube video <http://digital-catapult.org.uk/2DZY-Y09Y-5XSSQT-GZ7O1-1/c.aspx>*, made in collaboration with Furtherfield. All the best, *Digital Catapult Team* <http://digital-catapult.org.uk/2DZY-Y09Y-5XSSQT-GZ7OK-1/c.aspx> <http://digital-catapult.org.uk/2DZY-Y09Y-5XSSQT-GZ7OL-1/c.aspx> <http://digital-catapult.org.uk/2DZY-Y09Y-5XSSQT-GZ7OM-1/c.aspx> <http://digital-catapult.org.uk/2DZY-Y09Y-5XSSQT-GZ7ON-1/c.aspx> <http://digital-catapult.org.uk/2DZY-Y09Y-5XSSQT-GZ7OO-1/c.aspx> © Digital Catapult 2016 | Unsubscribe <http://digital-catapult.org.uk/2DZY-Y09Y-F15XSSQT83/uns.aspx>

1 0

Notes from BSC telecon Thursday, November 3
by Eve Maler 03 Nov '16

03 Nov '16

http://kantarainitiative.org/confluence/display/BSC/2016-11+%28November+201… Agenda: - Report <http://kantarainitiative.org/confluence/display/BSC/Report+from+the+Blockch…> writing – Sovrin Foundation questionnaire answers discussion Attending: Eve, Thomas, Kathleen, Scott S, Susan What's the right way to proceed? We don't have a lot of time to engage in a back-and-forth; we should write in our report whatever our analysis is, and if we have dissenting opinions we can attach those in appendices or whatever. Let's bubble up the reason for Sovrin's existence. The vision is, of course, familiar, with a new technology being introduced to solve it better than before. In May, Thomas asked Chris Allen "How do you get the counterparty to accept what's being offered?" (In this case, it's a relying party accepting a self-sovereign identity.) Thomas points to a different system that leverages blockchain to provide somewhat similar capability, CONIKS <https://coniks.cs.princeton.edu/>: The individual can generate new key pairs, and there's a ledger that records the history of the key pairs over time. Binding the record to a (say) proofed identity is the exercise left for the reader, so IAM would still be needed. It's a kind of key directory that gives correlatability over time of a set of keys. Maybe this, and Sovrin, and certificate transparency, all are different approaches to the "blockchain identity use case". Eve temporarily climbed up on a soapbox to rant about identity as, in great part, a function of an individual's relationship with an organization (e.g. vendor or whatever). Thomas points out this is in Chapter 2 of his new book <https://www.amazon.com/Trust-Data-Framework-Identity-sharing/dp/153911421X/…>! Thus, many attributes/claims that the organization has to store are unique to that organization, and it's inefficient and pointless for the individual to store them in tamper-proof form anywhere else. Susan points out that "self-sovereign" has grabbed the world's imagination, and a lot of it has to do with consent. A big concern of Eve's is: When we're talking about autonomous individuals, in the cases of what solutions does Alice have to go get an app from an app store or a browser plugin (thinking of things like "Sovrin clients")? The thinking is that *requiring* users to take an extra step is likely to make a solution fail unless some vertically integrated provider (like Apple or Google) builds it in, or some country forces the solution. A big question is: "What does the consumer want?" Does Alice want to install something? Sovrin does add a unique multi-stakeholder governance model, which mitigates risk well beyond what Ripple <https://ripple.com/> could do beyond its four virtual walls. We do seem to have gained some consensus here on skepticism about the longstanding aims of the user-centric/self-sovereign movement, which we'll have to capture in our report and share back with the various stakeholders. *Eve Maler*ForgeRock Office of the CTO | VP Innovation & Emerging Technology Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl *The ForgeRock Identity Summit* is coming to <http://summits.forgerock.com/> *Paris in November!*

4 3

blockchain standard for certificates/assertions
by j stollman 03 Nov '16

03 Nov '16

MIT Media Lab is proffering a standard for blockchain-secured certificates: https://bitcoinmagazine.com/articles/mit-media-lab-releases-code-for-digita… --------------------------------- Jeff Stollman stollman.j(a)gmail.com +1 202.683.8699 <stollman.j(a)gmail.com> Truth never triumphs — its opponents just die out. Science advances one funeral at a time. Max Planck

3 2

Comments on FCCX and Gov.UK Verify critique from 2015
by Eve Maler 02 Nov '16

02 Nov '16

In yesterday's call, I mentioned that there was a scholarly critique made last year on systems such as FCCX (afterwards renamed Connect.gov and since apparently scrapped <http://www.secureidnews.com/news-item/feds-scrap-connect-gov/> -- or being rebuilt??) and Gov.UK Verify. These systems leverage a (centralized) broker to effect a "triple-blind" design in terms of IdP<->RP identification in the context of a specific user. Here's an article <http://www.computing.co.uk/ctg/news/2414194/govuk-verify-identity-managemen…> describing the problem and pointing to the technical paper. (If you have trouble getting through the paywall with this link, search for the title "Gov.UK Verify identity management system riddled with 'severe privacy and security problems', warn UCL academics" using Google News.) The opinion I shared with a number of people at the time went like this: - I'm pretty suspicious of scholarly critiques of unlinkability claims, since most users end up voluntarily sharing sufficient attributes to be linkable anyway. - The article doesn't make very clear what the exact risk is nor what the proposed solution is, which doesn't surprise me because it's all very subtle. - The researchers have found a limitation in the tradeoff choice that the system designers made. This tradeoff prizes the ability for the user to use an online service (relying party) and an identity provider, free from worrying that the two will discover who the other is, over the perfect ability for a pseudonymous identifier and attributes representing the user to pass unseen through the broker in the middle (the broker makes this "service blinding" possible). - The researchers propose some clever encryption tricks to guard against the broker seeing things, and go further and propose a new user-chosen "identity integration" (II) service that could handle the tricks. - Given that brokered systems, and the "older" protocols such as SAML already in use, and the encryption tricks the researchers suggest, and user interfaces that force users to choose services, are all considered expensive and unpleasant in various ways, and given that the notion of an II service is 100% novel, I give the researchers' suggestions a nil chance of succeeding in the current environment. And given users' incentives to share enough attributes in everyday circumstances to routinely become identifiable, it's questionable whether the researchers' preference for tradeoffs vs. the nations' preference is the correct one. With hindsight, it's possible to observe that this specific critique didn't make that huge a splash at the time. However, we can also observe that these solutions have been struggling for a variety of other reasons (cost, complexity, politics, resulting pace...). I believe that in the Canadian province of BC, for example, they're not (or at least weren't as of a year ago) even using the triple-blind approach favored at the whole-of-Canada level and are going for a straight federated identity approach -- in other words, trading away *both* tradeoff choices discussed above in favor of even more back-end and front-end simplicity. Maybe the II service would now morph into a user-chosen blockchain-based identity source, or something like that, in the current rendering. Or such technology might have other roles to play; the US Postal Service (which took over FCCX/Connect.gov last year) does mention validating and authenticating user identities in its blockchain report <https://www.uspsoig.gov/sites/default/files/document-library-files/2016/RAR…> issued in May of this year. Then we're back to assessing the same propositions we've been looking at of late, I think. *Eve Maler*ForgeRock Office of the CTO | VP Innovation & Emerging Technology Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl *The ForgeRock Identity Summit* is coming to <http://summits.forgerock.com/> *Paris in November!*

3 4

Agenda for BSC telecon Tuesday, August 30 (shortly -- sorry for the late note!)
by Eve Maler 01 Nov '16

01 Nov '16

http://kantarainitiative.org/confluence/display/BSC/2016-08+%28August+2016%… We meet *Tuesdays* for 30 minutes at 7:30am PT / 10:30am ET / 3:30pm UK / 4:30pm CET. We use Kantara Line A (US +1-805-309-2350, Skype +99051000000481, international options <https://www.turbobridge.com/international.html>, web interface <https://panel.turbobridge.com/webcall/>, more info <https://www.turbobridge.com/join.html>, code 4022737) and http://join.me/findthomas for screen sharing. See the DG calendar <http://kantarainitiative.org/confluence/display/BSC/Calendar> for our full meeting schedule. Previous meeting minutes are here: July <http://kantarainitiative.org/confluence/display/BSC/2016-07+%28July+2016%29…> . Agenda: - Confirm timeline, scope, and approach, or revise in specific - Assign action items for report next steps *Eve Maler*ForgeRock Office of the CTO | VP Innovation & Emerging Technology Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl *ForgeRock Summits and UnSummits* are coming to <http://summits.forgerock.com/> *London and Paris!*

5 11