January 2017 - DG-BSC - mailman.kantarainitiative.org

blockchain for identity
by j stollman 01 Feb '17

01 Feb '17

I am seeking some insight from this group on the viability of blockchain for identity. The notion of a user-controlled, distributed identity mechanism strikes me as the holy grail in identity. But, like the holy grail, I am finding it difficult to believe that it is real. In particular, I don't see what the blockchain can add to identity. Yes, I recognize that blockchain does offer distributed consensus. And I while I am not persuaded that proof-of-work and/or proof-of-stake are as bulletproof as most people accept, I am not focused on these concerns. My concerns stem from what value add the blockchain provides to the inscrutable problem of identity. We can use blockchain to confirm that a particular transaction too place at a particular point in time. For example, we can use it to confirm that Alice paid Bob the $1000 he owed her within the terms of their agreement. This verification may be valuable in a subsequent credit transaction. And we can use blockchain to confirm that someone claiming to be Alice passed a background check by Bob at a fixed point in time where the background check attests to aspects of her health, home address, financial stability, national loyalty, trustworthiness with confidential data, or some combination of these. But even this information is only useful to someone who believes that Bob is trustworthy and thorough in his checking. And since Bob can never be absolutely certain that the Alice who sat in front of his desk is the Alice she claims to be, Bob's assessment -- no matter how trustworthy and thorough he is -- is always subject to some doubt. And how are we certain that it was really Bob who is asserting the claim on behalf of Alice and not an impostor Bob? Do we believe that merely possessing his private key is sufficient proof to an organized attempt to create a false Alice? I don't see anything about the blockchain that addresses these concerns which are - and always have been - at the root of identity and trust. So many people seem excited because blockchain offers a distributed governance model that uses economic incentives to encourage good behavior of vetting parties (e.g., miners). But tracking a single crypto-currency is a much more simple task that vetting identifies and the vast array of attributes of interest to relying parties - depending on their business. And unlike measuring crypto currency transactions which either do or do not take place, identify attributes are not 0/1 transactions. They are a collection of probabilities. And using blockchain does not change this. If I have a bad credit rating using one self-managed identity, why don't I just create a new identity and seek credit for it? As a newbie, I might not have a high rating, but it would likely be better than a bad rating. What am I missing here? Thank you. Jeff --------------------------------- Jeff Stollman stollman.j(a)gmail.com +1 202.683.8699 <stollman.j(a)gmail.com> Truth never triumphs — its opponents just die out. Science advances one funeral at a time. Max Planck

5 6

Provenance definitions for BSC Report
by Kathleen Connor 31 Jan '17

31 Jan '17

Hi Below are the best Provenance definitions that seem appropriate for the BSC Report that I can find among the ISO/NIST etc. sources I reviewed. Provenance = DF: Information about entities, activities, and people involved in producing a piece of data or thing, which can be used to form assessments about its quality, reliability or trustworthiness. W3C PROV-Overview http://www.w3.org/TR/2012/WD-prov-overview-20121211 Provenance of a resource is a record that describes entities and processes involved in producing and delivering or otherwise influencing that resource. Provenance provides a critical foundation for assessing authenticity, enabling trust, and allowing reproducibility. Provenance assertions are a form of contextual metadata and can themselves become important records with their own provenance. [W3C Provenance XG Final Report] http://www.w3.org/2005/Incubator/prov/XGR-prov-20101214/#Importance_of_prove nance

4 3

Dilbert & Robot lawyer contracts
by John Wunderlich 31 Jan '17

31 Jan '17

Dilbert & Robot lawyer contracts http://dilbert.com/strip/2017-01-31 John Wunderlich, Sent frum a mobile device, Pleez 4give speling erurz "...a world of near-total surveillance and endless record-keeping is likely to be one with less liberty, less experimentation, and certainly far less joy..." A. Michael Froomkin -- This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. This message contains confidential information and is intended only for the individual named. If you are not the named addressee you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately by e-mail if you have received this e-mail by mistake and delete this e-mail from your system. If you are not the intended recipient you are notified that disclosing, copying, distributing or taking any action in reliance on the contents of this information is strictly prohibited.

1 0

Verifiable Claims and standardizing around distributed ledgers to reduce the need for federations
by Adrian Gropper 24 Jan '17

24 Jan '17

All, You might find the outlines below useful to explain where this might be headed. I have no idea whether linked data is needed to get there but I do share their interest in deprecating the role of federations as a way to reduce the asymmetry of the current Internet as relates to individuals, including licensed professionals. To be more explicit about how I hope Verifiable Claims and distributed ledgers will help, right now licensed professionals tend to link their claims to an employer and the employer verifies the attribute, often injecting other strategic interests into the process. This reduces the autonomy of the licensed professional to a much larger extent than was the case with paper-based systems. Since licensed professionals don't buy IT directly, they have not seen the strategic reduction in their autonomy until rather recently as the actual impact of massive institutional record systems on the professional-individual relationship has begun to chafe. Adrian ---------- Forwarded message ---------- From: Luis-Daniel Ibáñez <L.D.Ibanez(a)soton.ac.uk> Date: Tue, Jan 24, 2017 at 8:58 AM Subject: [CfP] 2nd International Workshop on Linked Data and Distributed Ledgers To: public-blockchain(a)w3.org The 2nd International Workshop on Linked Data and Distributed Ledgers. https://sites.google.com/site/lddleswc2017/ <https://sites.google.com/site/lddlworkshop2017/> A workshop of ESWC 2017, Portoroz, Slovenia, May 29th, 2017 (1st edition will be held in conjunction with WWW 2017 - Perth, Australia) *Important Dates:* - *Submission deadline:* Friday March 10, 2017 - *Notifications:* Friday March 31, 2017 - *Camera-ready version:* Thursday April 13, 2017 Distributed Ledgers (DLs) have emerged as a novel way to manage and exchange different types of digital assets among a large number of agents operating in a decentralised way. Existing DL platforms are driven by use cases from different user communities. Each community has its own requirements regarding the level of decentralisation, privacy, and identity management that the ledger would need to offer. To allow for these developments to be applicable to a wider, and more complex range of applications, they will need to be able to interoperate, both with existing distributed systems and databases technologies, and among each other. This has motivated researchers and practitioners to look at approaches such as Linked Data, which relies on core Web principles and standards such as URIs, HTTP, JSON-LD, RDF, and SPARQL. We envision the workshop as a forum for researchers and practitioners from Distributed Ledgers and Linked Data to come together to discuss common challenges; propose solutions to shortcomings of existing architectures; and identify synergies for joint initiatives. The ultimate goal is the creation of a Web of Interoperable Ledgers. The first edition of LD-DL will be held as part of WWW 2017 in Perth, Australia We invite original research submissions addressing any of the following two broad themes: Linked Data for Distributed Ledgers: Vision, insight and research on how to use Linked Data and Web technologies to enhance Distributed Ledgers, including but not limited to: • Architectures and protocols for DL interoperability • Architectures and protocols for interoperability between DLs and other Web components and architectures (non-ledger based web services, web databases, etc) • Extensions of web data models and formats to accommodate Distributed Ledgers (JSON, HTTP, HTML, RDF, etc) • Languages and query engines for Distributed Ledgers • Privacy considerations of interoperating Distributed Ledgers • Vocabularies and ontologies for describing DLs and Smart Contracts • Semantification and linking of DL frameworks and their contents • Storage, querying and updating RDF data inside Distributed Ledgers • SPARQL extensions to use it as a Smart Contract language. Extensions to current Smart Contract languages to use semantic data. Distributed Ledgers for Linked Data: Vision, insight and research on how to use DLs to enhance Linked Data and Web applications, including, but not limited to: • Decentralisation and disintermediation of web-based architectures. • Distributed management of identity and online identity. • Distributed Ledger backing of general Linked Data processes: vocabulary and dataset evolution, entity naming and re-naming, etc. • DLs for Web and Linked Data provenance. • DL-backing of Web signatures • Digital rights management and enforcing -- Dr. Luis-Daniel Ibáñez Research Fellow Web and Internet Science Group University of Southampton -- Adrian Gropper MD PROTECT YOUR FUTURE - RESTORE Health Privacy! HELP us fight for the right to control personal health data. DONATE: http://patientprivacyrights.org/donate-2/

2 1

Notes from BSC telecon Tuesday, January 24
by Eve Maler 24 Jan '17

24 Jan '17

http://kantarainitiative.org/confluence/display/BSC/2017-01+%28January+2017… Agenda: - Report <https://docs.google.com/document/d/1HOVJ3lKqOIjwCqPt5jFxfLr7wEoJ0ZVNbMGsdsW…> work Attending: Eve, Matisse, Susan, Devon, Marco, Kathleen, Adrian, Thomas Kathleen notes that HL7 has woken up to blockchain, and says it will be doing something by 2018. Adrian will be speaking <https://cyber.harvard.edu/events/digitalhealth/2017/01/Gropper> at Harvard Law School on Thursday on "free, independent health records"; the talk will include a lot about UMA. PPR will be filling comment on the Sedona work. *Verifiable claims:* We looked at Manu's responses to Adrian's questions. Adrian is advocating for moving away from federation. Thomas and Eve's analysis focused on being dubious about much being new in the approach vs. what's possible with JWTs, and this being troublesome from the perspective of "respecting and balancing all ecosystem parties' needs". Kathleen comments that for our readers to consider the spectrum of ecosystems (tight to loose), what is the most an individual should "have to put with" just to get the service they want and have trust? The goal should be to find discoverable semantics, and compute the trust you need. One thing we missed in the W3C charter is that it talks about extensible semantics. But otherwise it doesn't differentiate what it's trying to do from other claim formats. The temptation is to design a JWT-based format that has the extensions that do what VC is doing! Susan observes that it was ID2020 that was the impetus. She suggests going back to the VC people and asking for a brief analysis that shows a compare/contrast over existing tools in extended form, for the empowerment goals we hold (the charter doesn't mention this goal). Lowering friction in development and deployment is one that we're concerned about (for accelerating adoption and also for reducing complexity = greater security); can they speak to that? Thomas notes that people are starting to change out the word "trust" for the word "blockchain". Yikes! But then it still gets down to key management; the problem hasn't gone away. This could turn into an Observation. *AI:* Eve: Ask Manu if it's okay to share his responses with the group, and let him know that we're discussing our whole analysis. *Eve Maler*ForgeRock Office of the CTO | VP Innovation & Emerging Technology Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0

Notes from BSC telecon Thursday, January 19
by Eve Maler 19 Jan '17

19 Jan '17

http://kantarainitiative.org/confluence/display/BSC/2017-01+%28January+2017… Agenda: - Report <https://docs.google.com/document/d/1HOVJ3lKqOIjwCqPt5jFxfLr7wEoJ0ZVNbMGsdsW…> work Attending: Eve, Devon, JohnW, Adrian, Colin L. We discussed the CommonAccord section in the report. John created a diagram (file name "BSC DG Decision-Making Power 2017-01-19.png" on Eve's computer) to describe the opportunity to even things up. Eve suggests creating an Observations section talking about contractual mechanisms and tensions around them, with the diagram as a centerpiece; it would pull in a lot of mentions of the tech/techs. Some Recommendations that may fall out could do with strengthening the connection between legal and smart contracts in a formal way. We discussed the Legal Contracts section. We debated the order of tech/tech sections; it would be nice to have Smart Contracts and Legal Contracts very near each other. The notion of "fully executed legal contracts" brings them together conceptually. *Next Tuesday:* Look at Manu's answers on Verifiable Claims, and look at Eve's putative new sections, and look at the User-Submitted Terms section from JohnW. (*NOTE:* Eve can't make next *Thursday's* call because she'll be doing a Data Privacy Day event in SF <https://www.eventbrite.com/e/live-from-twitter-hq-data-privacy-day-event-20…>, and hopes Thomas can run it.) *Eve Maler*ForgeRock Office of the CTO | VP Innovation & Emerging Technology Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0

Notes from BSC telecon Tuesday, January 17
by Eve Maler 17 Jan '17

17 Jan '17

http://kantarainitiative.org/confluence/display/BSC/2017-01+%28January+2017… Agenda: - Report <https://docs.google.com/document/d/1HOVJ3lKqOIjwCqPt5jFxfLr7wEoJ0ZVNbMGsdsW…> work Attending: Eve, Devon, Matisse, Marco, JohnW, Susan, Adrian AI: Eve: Mark the old version of the report as truly obsolete now. [DONE] We commented on the OPAL/Enigma section for Thomas to work on. We commented on the UMA Legal Toolkits section for Eve to work on. We commented on the Consent Receipts section for JohnW to work on. The UMA Legal subgroup may try to have an ad hoc F2F meeting during #RSAC. *Eve Maler*ForgeRock Office of the CTO | VP Innovation & Emerging Technology Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0

Fwd: Here's the Norton Rose White Paper
by Eve Maler 17 Jan '17

17 Jan '17

Susan told me it was okay to forward these -- sorry I took so long to do so! *Eve Maler*ForgeRock Office of the CTO | VP Innovation & Emerging Technology Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl ---------- Forwarded message ---------- From: Susan Joseph <susan.joseph1786(a)gmail.com> Date: Tue, Jan 10, 2017 at 8:39 AM Subject: Here's the Norton Rose White Paper To: Eve Maler <eve.maler(a)forgerock.com> Eve, Here's the R3/Norton Rose Smart Contracts White Paper. And if you have not read their prior white paper on Smart Contracts, here is that one as well. Susan

1 0

Info about the Taqanu use case
by Eve Maler 15 Jan '17

15 Jan '17

Thanks to Colin's outreach, Balázs Némethi of Taqanu responded with enthusiasm to my request for a use case writeup. His brief one-pager response to the questionnaire is attached. I suggested that he's welcome to provide additional links, diagrams, etc. to ensure we get the detailed picture -- we just can't publish a 10- or 20-page writeup... If you have questions, please send 'em in in this thread, and we can collect them and share them along. *Eve Maler*ForgeRock Office of the CTO | VP Innovation & Emerging Technology Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0

Notes from BSC telecon Thursday, January 12
by Eve Maler 12 Jan '17

12 Jan '17

http://kantarainitiative.org/confluence/display/BSC/2017-01+%28January+2017… Agenda: - Report <https://docs.google.com/document/d/1HOVJ3lKqOIjwCqPt5jFxfLr7wEoJ0ZVNbMGsdsW…> work Attending: Eve, Thomas, Kathleen, Devon, Adrian, Colin, JohnW The current exercise is to rationalize the entire ToC and outline. Devon has moved over all the text from the old report – thank you, Devon! We started discussing Verifiable Claims again; Adrian has gotten some more information about the role of Linked Data as a differentiator vs. JWT. Devon and Kathleen are working on OPAL/Enigma content. Kathleen has gotten the okay to bring on HL7 work around creating trust contracts on the fly for, e.g., a research repository controller and a researcher (or anyone) comes with a "safe query" (for differential privacy). Devon offers to fill in the Legal Contracts section. Excellent! AIs for Tuesday's meeting: - Eve: Write UMA and Sovrin section - Devon: Write Legal Contracts section - Kathleen: Work on HL7 subsection - Kathleen: Expand JohnW's use case section - JohnW: Continue working on his technology/technique sections - Eve: (stretch goal) Revise Intro We agreed it's a good idea for us to have our own Skype chat room and not barge in on UMA chat room, so if anyone has a Skype handle that Eve ("xmlgrrl") doesn't know about, please feel free to send an invite to her. *Eve Maler*ForgeRock Office of the CTO | VP Innovation & Emerging Technology Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0

Notes from BSC telecon Tuesday, January 10
by Eve Maler 10 Jan '17

10 Jan '17

http://kantarainitiative.org/confluence/display/BSC/2017-01+%28January+2017… Agenda: - Report <https://docs.google.com/document/d/1HOVJ3lKqOIjwCqPt5jFxfLr7wEoJ0ZVNbMGsdsW…> work Attending: Eve, Adrian, Matisse, Thomas, Susan, JohnW Eve gave an update on the efforts to move to the new report doc. Devon is helping Thomas and Eve with some key overall editing tasks. Adrian described the value proposition of Verifiable Claims: It "kills the need for federation" because, in a triple-blind manner, the RP can verify a claim directly from the issuer. Thomas's and Eve's analysis didn't find this to be true in any special way; the technology looks extremely similar to JWTs, for example, and the notion of an RP is a federation notion and requires trust to be established somehow. Adrian will review, discuss with Manu (the draft spec author), and get back to the group. Thomas has filled out the OPAL/Enigma section; no analysis section yet. What's the best way to drive to consensus on the analysis of each section? Thomas, Eve, and Devon will continue editing, and will draw the DG's attention to new sections for timely review. Scheduled meetings will focus on analysis and review. *Eve Maler*ForgeRock Office of the CTO | VP Innovation & Emerging Technology Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0

Timely perspective on our eRx Use Case
by Adrian Gropper 05 Jan '17

05 Jan '17

http://www.healthitoutcomes.com/doc/the-e-prescribing-evolution-today-s-ben… Note that the author ignores the patient perspective, and imagines there will be a source for the decision support information that combines genomic and financial data with the health record. -- Adrian

1 0

Notes from BSC telecon Tuesday, January 3
by Eve Maler 04 Jan '17

04 Jan '17

http://kantarainitiative.org/confluence/display/BSC/2017-01+%28January+2017… Agenda: - Report <https://docs.google.com/document/d/1HOVJ3lKqOIjwCqPt5jFxfLr7wEoJ0ZVNbMGsdsW…> work Attending: Eve, Thomas, Kathleen, Matisse, Thorsten, Adrian, Susan, Devon (finishing law school, studying data privacy), SteveO, JohnW Our DG's life is extended just for this next month. Kathleen points to the 21st Century Cures Act (house bill link <http://docs.house.gov/billsthisweek/20161128/CPRT-114-HPRT-RU00-SAHR34.pdf>). It calls for a trust framework. Adrian notes that it mentions longitudinal health records, which is a novel challenge in the patient context vs. clinical research (subjects). See his blog post <http://thehealthcareblog.com/blog/2016/12/16/making-the-physician-patient-r…> . To pick a fintech use case, can we find one with an individual perspective vs. an institutional perspective? Can we pick one from Sedona <https://thesedonaconference.org/> that has the right characteristics? Susan notes that Everledger is working to ensure that the ethical diamond use case is protecting workers etc., not just tracking the diamonds. What about BanQu <http://www.banquapp.com/> ("Dignity Through Identity") as a financial use case for empowerment? Susan has talked to the principal. *AI:* Eve to send the questionnaire to Susan for sharing with the BanQu person and to Adrian for sharing with the Consensys people. *AI:* Thomas: Fill out the questionnaire for Enigma/Opal. *AI:* Adrian: Fill out the questionnaire for his use case (and/or write the full use case! ). *AI:* Eve: Flesh out report outline (hopefully together with Thomas), completing AIs in report comments, before our Thursday meeting. *Eve Maler*ForgeRock Office of the CTO | VP Innovation & Emerging Technology Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

2 4

Sedona EHR Use Case fails in terms of how individuals interact more equitably and efficiently
by Adrian Gropper 03 Jan '17

03 Jan '17

https://s3.amazonaws.com/IGG/EHR.pdf When the individuals involved are a licensed professional and a patient, the Logical Model (p62) makes almost no sense at all. The EHR could be compiled from source and patient owned as long as: (1) the licensed professional's claims can be verified by the patient against their issuers (2) the licensed professional can put a digital signature on a detailed log entry created by the EHR (3) the timestamped hash of the log entry can be put on a distributed public ledger (4) the licensed professional may keep a copy of their log entry and the timestamp proof in case of dispute where the patient "loses" their copy. An effective individual-centric solution depends on substitutability and therefore standards. There are standards being worked on for many of these steps: (1) W3C Verifiable Claims https://www.w3.org/2017/vc/charter (2) Rebooting Web of Trust Decentralized Identifier (DID <https://github.com/WebOfTrustInfo/rebooting-the-web-of-trust-fall2016/blob/…>) is being implemented by 4 separate groups (3) Chainpoint http://www.chainpoint.org/ and Open Timestamps <https://petertodd.org/2016/opentimestamps-announcement> are being combined in Rebooting Web of Trust (4) is just a personal data store like Dropbox The HIE of One Use Case and reference implementation http://hieofone.org/ is in the process of implementing this whole stack. (a) The patient-controlled EHR is done. (b) The patient-controlled controller of the EHR and other resources is a personal UMA AS and is done. (c) The physician's DID and secure signature are initially demonstrated using uPort <https://www.youtube.com/watch?v=FNlAkGauIdw&list=PLn9P7BiqUmmjk09q4I57cvPwy…> and being upgraded and integrated. (d) Verifiable Claims is not yet implemented. The Use Case paper <https://www.healthit.gov/sites/default/files/7-29-poweringthephysician-pati…> won an ONC Blockchain Health prize. (e) Timestamps of the physician's interaction with the EHR are not yet implemented. I believe this shows a licensed individual writing a prescription or curating a patient-centered longitudinal health record in the absence of any particular federation or trust framework. Adrian -- Adrian Gropper MD

1 0

Reminder: BSC telecon series starts up again tomorrow (Tuesday)
by Eve Maler 02 Jan '17

02 Jan '17

Happy 2017, all! Our focus is completing the report, so please consider these to be working sessions, with Thomas and me wielding the main pen. Especially if you have a writing assignment, please come prepared and try to review the link and last set of notes I sent out. Eve (from my iPad)

1 0

Book Review
by John Wunderlich 02 Jan '17

02 Jan '17

For your holiday reading pleasure. This might be of interest to the Legal UMA group and some on the BSC DG. It's a review <http://www.rogerwhitson.net/?p=3501>of Benjamin Bratton’s The Stack: On Software and Sovereignty <https://www.amazon.ca/Stack-Software-Sovereignty-Studies-ebook/dp/B01D1Q44HE> John Wunderlich, BA, MBA IAPP Fellow of Information Privacy CISA, CIPM, CIPP/C, PbD Ambassador @PrivacyCDN <https://twitter.com/PrivacyCDN> & Privacist -- This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. This message contains confidential information and is intended only for the individual named. If you are not the named addressee you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately by e-mail if you have received this e-mail by mistake and delete this e-mail from your system. If you are not the intended recipient you are notified that disclosing, copying, distributing or taking any action in reliance on the contents of this information is strictly prohibited.

2 1