- DG-BSC - mailman.kantarainitiative.org

Example of scare & snare
by John Wunderlich 09 Aug '16

09 Aug '16

I took a screen shot of this to ensure that you don’t get any drive by links from it, but this is typical of the scare and snare advertising made possible by the relatively abysmal level of security practiced by most health information custodians. Also highlights why auditing, logging and transparency with respect to health data are important issues. Auditing and logging are relatively well understood in IT, but transparency is a new concept - especially for security practitioners. If a public ledger is a transparency tool allowing organizations to prove that they are doing what they say are doing, the question will be how do you provide that transparency will providing appropriate security and privacy safeguards with respect to the underlying personal data/ Sincerely, John Wunderlich @PrivacyCDN Call: +1 (647) 669-4749 eMail: john(a)wunderlich.ca -- This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. This message contains confidential information and is intended only for the individual named. If you are not the named addressee you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately by e-mail if you have received this e-mail by mistake and delete this e-mail from your system. If you are not the intended recipient you are notified that disclosing, copying, distributing or taking any action in reliance on the contents of this information is strictly prohibited.

2 1

From: Ann Vroom RE: of interest, article link re: consent model in UK NHS ...
by M AV 09 Aug '16

09 Aug '16

http://www.theregister.co.uk/2016/08/08/some_benefits_of_digital_health_to_… From: dg-bsc-bounces(a)kantarainitiative.org [mailto:dg-bsc-bounces@kantarainitiative.org] On Behalf Of Scott Shorter Sent: Tuesday, August 9, 2016 9:06 AM To: dg-bsc(a)kantarainitiative.org Subject: [DG-BSC] Agenda for BSC telecon Tuesday August 9 http://kantarainitiative.org/confluence/display/BSC/2016-08+%28August+2016%… We meet Tuesdays for 30 minutes at 10:30am ET. We use Kantara Line A (US +1-805-309-2350, Skype +99051000000481, international options<https://www.turbobridge.com/international.html>, web interface<https://panel.turbobridge.com/webcall/>, more info<https://www.turbobridge.com/join.html>, code 4022737) and (today only) http://join.me/findscott for screen sharing. See the DG calendar<http://kantarainitiative.org/confluence/display/BSC/Calendar> for our full meeting schedule. Agenda: · Review Certificate Transparency<http://kantarainitiative.org/confluence/display/BSC/Certificate+Transparency> use case · Discuss potential use cases · Privacy-Preserving Data Sharing on Blockchain P2P Nodes (Thomas) · General Wellness Product (John W) · Others? Thanks! - Scott Scott Shorter - Vice President, Security sshorter(a)kimbleassociates.com<mailto:sshorter@kimbleassociates.com> On Aug 3, 2016, at 10:50 PM, Eve Maler <eve.maler(a)forgerock.com<mailto:eve.maler@forgerock.com>> wrote: http://kantarainitiative.org/confluence/display/BSC/2016-08+%28August+2016%… We meet Thursdays for 30 minutes at 11am PT / 2pm ET / 7pm UK / 8pm CET. We use Kantara Line A (US +1-805-309-2350, Skype +99051000000481, international options<https://www.turbobridge.com/international.html>, web interface<https://panel.turbobridge.com/webcall/>, more info<https://www.turbobridge.com/join.html>, code 4022737) and http://join.me/findthomas for screen sharing. See the DG calendar<http://kantarainitiative.org/confluence/display/BSC/Calendar> for our full meeting schedule. Agenda: * Observation: DG is at the one-month mark * Can we add something like a "technology SWOT analysis" to Alice participates in Bob's Research Study<http://kantarainitiative.org/confluence/display/BSC/Alice+participates+in+B…> as a criterion for approving it as complete? * Plotting and analyzing aspects of blockchain overall, smart contracts, CmA, other related tech – see the report outline<http://kantarainitiative.org/confluence/display/BSC/Report+from+the+Blockch…> * Do we want to categorize use cases/organize them into a taxonomy? Is this helpful for our report purposes? * What use cases do we want to take up next week? (Scott as chair pro tem on Tuesday) Eve Maler ForgeRock Office of the CTO | VP Innovation & Emerging Technology Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl ForgeRock Summits and UnSummits are coming to<http://summits.forgerock.com/> Sydney, London, and Paris! _______________________________________________ DG-BSC mailing list DG-BSC(a)kantarainitiative.org<mailto:DG-BSC@kantarainitiative.org> http://kantarainitiative.org/mailman/listinfo/dg-bsc

1 0

General wellness products use case?
by john＠wunderlich.ca 07 Aug '16

07 Aug '16

The FDA has done the heavy lifting in terms of describing the use case... http://www.fda.gov/downloads/medicaldevices/deviceregulationandguidance/gui… Thanks, John Wunderlich @PrivacyCDN Pleez 4give speling errurs, sent from a mobile device. -- This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. This message contains confidential information and is intended only for the individual named. If you are not the named addressee you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately by e-mail if you have received this e-mail by mistake and delete this e-mail from your system. If you are not the intended recipient you are notified that disclosing, copying, distributing or taking any action in reliance on the contents of this information is strictly prohibited.

1 0

Re: [DG-BSC] Blockstack identity services
by James Hazard 04 Aug '16

04 Aug '16

JimW - yes, IAMAL, but that's my understanding. Merkel is the root. Patrick - I was unaware of Zittrain's work on this balance of security. If you have link ... ? If banks or other "regulated databases" (phrase from Circle) act as hosts and intermediaries, the platform could fine-tune the balances between oversight and privacy. Parts can be encrypted end to end, so the bank and others know very little. Parts could be encrypted on the way to the bank and then decrypted and recrypted as appropriate. Of course, any hub could act in this role, and I am not pitching on behalf of banks. But, as a lawyer looking to piece together a solution, banks have the advantages that they are highly regulated, quasi-local, already custodians of our creepiest data, and numerous (as opposed to telcos and e-commerce giants which will bump into monopoly issues). There is a long-standing relationship (in civil law systems there is even a general principle of bank secrecy). It is imperfect, and abused, but their is a conversation chain of bank and regulator, with legislature, customers, activists and public. They are nodes with lots of edges. A shared record format enables portability and open source would make it cheap to be a bank - giving the customer leverage and keeping intermediaries focused on their mission. I did a sketch of what it might look like to treat (all of) banking as a file system - http://www.commonaccord.org/index.php?action=list&file=bqc/fr/bnpp/a5we/ The context is French banks and an effort by "LaBChain" - the French finance industry's exploration of blockchains. So I used French examples, and demonstrate how they could be helpful to enterprise formation and capitalization by curating legal documentation. Here the "identities" are bank accounts, "roles" that are well-anchored in local law. On Thu, Aug 4, 2016 at 9:30 AM, Jim Willeke <jim(a)willeke.com> wrote: > All of the technologies we are speaking about are Distributed Database > or Distributed Ledger Technologies (DLTs) and more specifically a type of > Hash Tree or Merkel Tree <https://en.wikipedia.org/wiki/Merkle_tree>. > > There are many common examples besides the crypto-currencies including > BitTorrent, GIT, and many NoSQL databases. > > > -- > -jim > Jim Willeke > > On Thu, Aug 4, 2016 at 5:50 AM, James Hazard <james.g.hazard(a)gmail.com> > wrote: > >> Hi Patrick, >> >> Great message. My father, who taught and practiced law, said the >> conversation should start with where you want to be. >> >> That seems to me to be more or less the P2P, PDS, MIT Connection Science >> vision. Each of us has our formal existence in databases under our >> control. Each of our records interoperates with all of our other records. >> We can store them at trust providers (e.g., banks) like we do with cash, >> and carry only what we need. An app, on phones and anywhere else we want >> it, allows us to transact with anyone - or any thing - else. To have >> different accounts for different roles. To have our information be only in >> the places that it must be to interact with the network. This has lots of >> parallels with email. >> >> The rules of engagement - the stuff that good lawyers put into documents >> for smart clients - is clear, fast, free. We navigate bureaucracy - and >> weigh the trade-offs - like we use Waze. >> >> In this view, blockchains are a tool for syncing records. So are IPFS >> and Interledger, and git, and all of the existing or new payment systems. >> Blockchains, with their methods for peer-based consensus on the state of >> the record and their anti-double spend appear useful - necessary - when >> there is no 3rd party trust provider - or the trust provider can't be >> reached. The IoT is full of those use cases. >> >> This - which just came across my twitter feed - seems quite good at >> exploring when a blockchain is necessary (though perhaps the thinking does >> not include the possibility of a multiplicity of blockchains, used like >> email threads). https://www.linkedin.com/pulse/when-do-you-need- >> blockchain-decision-models-sebastien-meunier (Is the reference to our >> Bart Suichies?). >> >> All this is independent of, but a powerful driving force for, my project >> and concern, bringing the dynamic of open source collaboration to the >> negotiation and codification of legal forms. Codification of boilerplate >> (@gendal's "prose") indirectly codifies the law, and enables a >> decentralized Waze approach to bureaucracy. >> >> All good, Jim >> >> >> >> >> >> >> On Thu, Aug 4, 2016 at 6:09 AM, Patrick Curry <patrick.curry(a)bbfa.info> >> wrote: >> >>> Hi James, >>> >>> Interesting. Good discussion, thanks. I offer a few comments. >>> >>> Block chain refers to a specific, defined technology. Blockchain is a >>> trademark. >>> >>> Do we mean solutions or requirements? Are the solutions technology >>> specific or general solutions to a business problem, where a block chain >>> may feature as part of the solution set? >>> >>> If we replace Proof of Work with PKI Federation, which is attractive & >>> desirable in many situations, do we still have a block chain? My block >>> chain colleagues believe that we still do, and there is an ongoing >>> discussion about how PoW might be measured to achieve some sort of LoA that >>> could map, in policy terms, to PKI and create a basis for for BC - PKI >>> federation. >>> >>> The voting process presents several complexities, some of which could be >>> addressed by an underlying trust fabric. There hasn’t been much discussion >>> about this yet, but it will definitely be moving there later this year as >>> the UK government has just approved its first BC provider to be listed in a >>> catalogue service available to all UK gov organisations. >>> >>> A feature of BCs being used in regulated settings is that the regulator >>> (regulators in many cases, particularly internationally) requires to have a >>> voting node and so gets to see all traffic. Regulators haven’t woken up to >>> this yet, but I am expecting to see them require the development of >>> rulesets that are embedded in the process in the BC with decision authority >>> (signature), i.e. a smart contract. I don’t understand why this would be >>> a bug. A feature or a factor, yes. >>> >>> Ref data management, the smart contract is a feature of permissioned >>> block chains because of how the cryptography works. It’s hard to see how >>> this functionality could be replicated easily in other existing >>> technologies. Instead, what is beginning to happen is that companies link >>> their ERP etc to the block chain. The ERP provides the internal business >>> functionality and logic, the block chain DLT provides the external >>> interoperability & contract integrity. The smart contract runs on the >>> chain, not on in the enterprise app. This satisfies the supply chain >>> requirements where a centralised enterprise solution would/does not. >>> >>> Agree about data replication. Depending on the nature of the business >>> requirement and use cases, data minimisation is one of the privacy >>> principles. Proofs of concept on some Zero Knowledge Proof mechanisms have >>> been completed and a couple are moving to bigger pilots. ZKP and other >>> anonymised attribute assurance mechanisms are attractive and suitable >>> options for block chain privacy requirements. >>> >>> Interesting that you mention Zittrain. His work on trusted >>> intermediaries has come up in international discussions of lead industries, >>> law enforcement and govs, as a way to address policy collisions on public >>> safety and privacy. The discussions are more about encryption and key >>> management; block chains haven’t yet been discussed, but they might be. I >>> agree about JSON. I’d be interested in knowing more about your and Eve’s >>> work in this area. is there anything you can share? >>> >>> regards, >>> >>> Patrick >>> >>> Patrick Curry >>> Director >>> >>> British Business Federation Authority - BBFA Ltd >>> M: +44 786 024 9074 >>> T: +44 1980 620606 >>> patrick.curry(a)bbfa.info >>> www.bbfa.info – a not-for-profit, self-regulating body >>> >>> >>> >>> On 3 Aug 2016, at 15:08, James Hazard <james.g.hazard(a)gmail.com> wrote: >>> >>> Though "Blockchain" is in the title of this discussion group, it need >>> not be in all of the solutions. "Blockchains" have large privacy and data >>> security challenges built into maintaining consensus on the state of the >>> ledger (database). Most real life situations have available a range of >>> alternative means of validating the state of the ledger. For instance, a >>> regulator. >>> >>> So, we might view it as a bug, rather than a feature, if a "smart >>> contract" solution requires execution on a blockchain. >>> >>> Organizations and humans will want to be able to efficiently manage >>> large numbers of ledger entries, in efficient databases (SQL, graph, IPFS), >>> not blockchains. They will need to be able to run the smart contracts on >>> those other platforms. >>> >>> Data replication should be minimized, and temporary to the extent >>> possible. This will, I think, also be required by GDPR. >>> >>> The necessary point of agreement, the waist of the Zittrain hourglass, >>> is very small - a format for ledger entries. CommonAccord asserts (I >>> assert on its behalf) that the key to this is ... key/values, a way of >>> resolving references, and inheritance. For good reasons, JSON is a likely >>> to be the most common "punctuation" (Eve's word) for exchange of ledger >>> entries. Our current rendering engine uses plain text and carriage >>> returns. That is the lightest "punctuation" and may be the best for >>> collaboration on big texts, notably for collaboration among lawyers and >>> regulators on Github. It closely parallels the presentation of software >>> source code. But this barely matters. What matters is a common approach >>> to linking and inheritance. >>> >>> >>> >>> >>> >>> >>> >>> >>> >>> >>> On Wed, Aug 3, 2016 at 6:53 AM, John Wunderlich <john(a)wunderlich.ca> >>> wrote: >>> >>>> Domenico; >>>> >>>> As soon as the use case makes Alice's role that of a "Citizen" a whole >>>> raft of non-technical issues arise that should be addressed. How do you >>>> implement privacy protection into the architecture to avoid abuse by >>>> authoritarian regimes? If I think of all the cases where I'm asked to >>>> present government issued ID as proof of identity, and then ask, "Would it >>>> be a good thing if there was an permanent audit trail available to the >>>> government (any state agency) of all those interactions?" >>>> >>>> I would restate your problem definition to see if we can design a wide >>>> identity ecosystem use case for managing citizen identities that enables >>>> (or better, only works if) citizens control their own identities. >>>> >>>> (PS, see my signature block below, apropos of this issue) >>>> >>>> John Wunderlich, >>>> >>>> Sent frum a mobile device, >>>> Pleez 4give speling erurz >>>> >>>> "...a world of near-total surveillance and endless record-keeping is >>>> likely to be one with less liberty, less experimentation, and certainly far >>>> less joy..." A. Michael Froomkin >>>> >>>> _____________________________ >>>> From: Domenico Catalano <domenico.catalano(a)oracle.com> >>>> Sent: Wednesday, August 3, 2016 4:47 AM >>>> Subject: [DG-BSC] Blockstack identity services >>>> To: <dg-bsc(a)kantarainitiative.org> >>>> >>>> >>>> Hi all, >>>> >>>> maybe, you already know blockstack id technology for identity services, >>>> at blockstack.org <https://blockstack.org/docs/how-blockstack-works> >>>> >>>> I think it’s quite useful for investigation and for defining use cases. >>>> >>>> I was wondering whether we can provide a wide identity ecosystem use >>>> case for managing citizen identities. >>>> >>>> Consider the following high level use case: >>>> >>>> - The Citizen is identified by a Blockchain-ready Registry. >>>> - The Citizen requests to register with the Registry through a specific >>>> mobile app, which provides the necessary cryptographic key pairs with which >>>> the request is signed. >>>> - The Registry includes the request in the blockchain which is >>>> distributed among the nodes, as smart contract. >>>> - The mobile app and the cryptographic keys are now able to provides >>>> strong authentication mechanisms for citizen online access. >>>> >>>> Citizen Identity can be enriched through the blockchain nodes (special >>>> nodes) interactions which provide attribute/profile attestation. >>>> >>>> I hope it’s useful for further discussions. >>>> >>>> Thanks >>>> Domenico >>>> >>>> >>>> >>>> >>>> >>>> This email and any files transmitted with it are confidential and >>>> intended solely for the use of the individual or entity to whom they are >>>> addressed. If you have received this email in error please notify the >>>> system manager. This message contains confidential information and is >>>> intended only for the individual named. If you are not the named addressee >>>> you should not disseminate, distribute or copy this e-mail. Please notify >>>> the sender immediately by e-mail if you have received this e-mail by >>>> mistake and delete this e-mail from your system. If you are not the >>>> intended recipient you are notified that disclosing, copying, distributing >>>> or taking any action in reliance on the contents of this information is >>>> strictly prohibited. >>>> >>>> _______________________________________________ >>>> DG-BSC mailing list >>>> DG-BSC(a)kantarainitiative.org >>>> http://kantarainitiative.org/mailman/listinfo/dg-bsc >>>> >>>> >>> >>> >>> -- >>> @commonaccord >>> _______________________________________________ >>> DG-BSC mailing list >>> DG-BSC(a)kantarainitiative.org >>> http://kantarainitiative.org/mailman/listinfo/dg-bsc >>> >>> >> >> >> -- >> @commonaccord >> >> _______________________________________________ >> DG-BSC mailing list >> DG-BSC(a)kantarainitiative.org >> http://kantarainitiative.org/mailman/listinfo/dg-bsc >> >> > -- @commonaccord

1 0

Blockstack identity services
by Domenico Catalano 04 Aug '16

04 Aug '16

Hi all, maybe, you already know blockstack id technology for identity services, at blockstack.org <https://blockstack.org/docs/how-blockstack-works> I think it’s quite useful for investigation and for defining use cases. I was wondering whether we can provide a wide identity ecosystem use case for managing citizen identities. Consider the following high level use case: - The Citizen is identified by a Blockchain-ready Registry. - The Citizen requests to register with the Registry through a specific mobile app, which provides the necessary cryptographic key pairs with which the request is signed. - The Registry includes the request in the blockchain which is distributed among the nodes, as smart contract. - The mobile app and the cryptographic keys are now able to provides strong authentication mechanisms for citizen online access. Citizen Identity can be enriched through the blockchain nodes (special nodes) interactions which provide attribute/profile attestation. I hope it’s useful for further discussions. Thanks Domenico

5 6

Potential category of use case
by John Wunderlich 03 Aug '16

03 Aug '16

Hi; The article linked to below suggested to me one category of problem that we could consider for blockchains. It seems to me that in a generic sense blockchain technology is technology in the service of governance and transparency. And further, since Kantara is all about identity, the category of problem that the report may choose to focus or include is how can we design/build/implement IBCT's (newly identified acronym: Identity Block Chain Technologies) that have the following characteristics: 1. Facilitates appropriate levels of identity proof (only need to prove of age at a liquor store, but will need strong proof that I'm the full natural person when voting). 2. Provide aggregate transparency and reporting so that anyone - citizen or government - can see where and what kinds of identity proofs are being used by the government. 3. Provides individual privacy protection and audit capability. I can audit who has looked at my identity information and in what context, but I CANNOT do that for any other person. I'm not fully immersed in the blockchain hype machine, but I'm fully aware that all this and more (but wait...) has been promised by block chain evangelists, but I'm not sure how seriously to take some or all of that. Linked article: http://www.csmonitor.com/World/Passcode/Passcode-Voices/2016/0729/Opinion-H… Sincerely, John Wunderlich @PrivacyCDN Call: +1 (647) 669-4749 eMail: john(a)wunderlich.ca -- This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. This message contains confidential information and is intended only for the individual named. If you are not the named addressee you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately by e-mail if you have received this e-mail by mistake and delete this e-mail from your system. If you are not the intended recipient you are notified that disclosing, copying, distributing or taking any action in reliance on the contents of this information is strictly prohibited.

2 1

Starting a BTC/ETH Company
by Rainer Hoerbe 03 Aug '16

03 Aug '16

Nice overview about breakdown/collapse of various products: https://magoo.github.io/Blockchain-Graveyard/ - Rainer

1 0

Notes from BSC telecon Tuesday August 2
by Eve Maler 02 Aug '16

02 Aug '16

http://kantarainitiative.org/confluence/display/BSC/2016-08+%28August+2016%… Agenda: - Work on "Trust and verification in a health research context" (was: Alice Consents to Health Research) and discuss implications for technologies sections in the report Attending: Eve, Jeff S, Andrew, Thomas, John W, Matisse, Scott S, Jim, Adam, Domenico, John M, Colin "L" The new title is a working title. And...now it's Alice participates in Bob's Research Study <http://kantarainitiative.org/confluence/display/BSC/Alice+participates+in+B…> ! There's a bifurcation of PHI for healthcare and PHI for health research. The biggest question: Is there a role for the blockchain? The three lightbulbs highlight the particular steps where this comes into play. Thomas notes there is a bit of a crisis of repeatability in research. Could that be addressed with the new technologies somehow? John suspects that this is where putting the protocols (the descriptions of the studies) themselves on the blockchain would be more productive, and this is where his mention of a "predecessor or stereotypical case" of Human Research Consent could encompass that solution. He points to https://clinicaltrials.gov. John M has written up a use case on his blog that leverages the blockchain for blinded (lightly deidentified) identity, not for the consent per se, in a research context. Jeff comments that if hashing for pseudonymity is being suggested (yes), then the entire suite of technologies that constitute "blockchain" may not be needed. One theme of blockchain application, therefore, is "identity proving". Another that we started with was "agreement proving" ?? So: Do we have use case bundles that are related, and can we write them quickly and with their relatedness exposed? (whether that relation is hierarchy, mind map, or whatever) It appears so, yes. Does it make sense to think of problems blockchain purports to solve, in specific, as things like "proving identity", "proving of agreement status" (e.g. whether consent has currently been given) – or "proving an event"? (suggested in the chat), and "proving that conditions have been met" (smart contracts)? Eve will reach out to Bart Suichies' erstwhile colleagues at the Philips Blockchain Lab to see if they have someone interested to join. There's no doubt that today's notes are incomplete or – gasp! – even wrong in spots. Please correct in followup email. *Eve Maler*ForgeRock Office of the CTO | VP Innovation & Emerging Technology Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl *ForgeRock Summits and UnSummits* are coming to <http://summits.forgerock.com/> *Sydney, London, and Paris!*

2 2

New BSC use-case: Privacy-Preserving Data Sharing on Blockchain P2P Nodes
by Thomas Hardjono 02 Aug '16

02 Aug '16

Folks, Below is a new BSC use-case I'm championing. Its a first sketch (I'll be revising/improving it). Best. /thomas/ ---------------------------------------------------- Name of use case: Privacy-Preserving Data Sharing on Blockchain P2P Nodes Description: Instead of a centralized data processing architecture, the P2P nodes (e.g. in a blockchain) offers the opportunity for data (user data and organizational data) to be stored by these nodes and be processed in a privacy-preserving manner. In this new paradigm of privacy-preserving data sharing, we “move the algorithm to the data” where queries and subqueries are computed by the data repositories (nodes on the P2P network). This means that repositories never release raw data and that they perform the algorithm/query computation locally which produce aggregate answers only. This approach of moving the algorithm to the data provides data-owners and other joint rights-holders the opportunity to exercise control over data release, and thus offers a way forward to provide the highest degree of privacy-preservation while allowing data to still be effectively shared. This paradigm requires that queries be decomposed into one or more subqueries, where each subquery is sent to the appropriate data repository (nodes on the P2P network) and be executed at that repository. This allows each data repository to evaluate received subqueries in terms of “safety” from a privacy and data leakage perspective. Furthermore, safe queries and subqueries can be expressed in the form of a query smart contract (QSC) that legally bind the querier (person or organization), the data repository and other related entities. A query smart contract has been vetted to be safe can even be stored on nodes of the P2P network (e.g. blockchain). This allows Queriers to not only search for useful data (as advertised by the metadata in the repositories) but also search for prefabricated safe QSCs that are available throughout the P2P network that match the intended application. Such a query smart contract will require that identities and authorizations requirements be encoded within the contract. A node on the P2P network may act as a Delegate Node in the completion of a subquery smart contract. A delegate node works on a subquery by locating the relevant data repositories, sending the appropriate subquery to each data repository, and receiving individual answers and collating the results received from these data repositories for reporting to the (paying) Querier. A Delegate Node that seeks to fulfil a query smart contract should only do so when all the conditions of the contract has been fulfilled (e.g. QSC has valid signature; identity of Querier is established; authorization to access APIs at data repositories has been obtained; payment terms has been agreed, etc.). A hierarchy of delegate nodes may be involved in the completion of a given query originating from the Querier entity. The remuneration scheme for all Delegate Nodes and the data repositories involved in a query is outside the scope of the current use-case. Champion: Thomas Hardjono Actors: (a) Data repository node: The role of the data repositories to hold raw-data and perform privacy-preserving “safe” query/subquery computations. (b) Querier: This is the entity that seeks to run a query over data that are distributed across multiple data-repositories. (c) QSC node: These are the nodes that store a signed copy of a query smart contract. (d) Delegate Node: This is a node on the P2P network that seek to complete a subquery smart contract. ----------------------------------------------------

1 0

IAPP views of blockchain
by Rainer Hoerbe 02 Aug '16

02 Aug '16

> Am 28.07.2016 um 21:00 schrieb Patrick Curry <patrick.curry(a)bbfa.info <mailto:patrick.curry@bbfa.info>>: > > Bitcoin > Society is very confused about Bitcoin, and whether it is good or bad. > Bitcoin benefitted from first mover advantage, but it suffers from the historic inevitability that any economic system without adequate governance will collapse when those that can, abuse others too much. Hence the drive to introduce much more governance into cryptocurrencies and have suitable mechanisms in the underlying block chains. Practically, some of the banks have been looking at how to establish “trusted Bitcoin” i.e. to put a cryptographically bound wrapper around the Bitcoin transaction and the provenance/traceability trail, which would more normally be met in a permissioned chain. The lack of governance can also be seen as a feature of blockchains. Other distributed, non-hierarchical systems (e.g. PGP web-of-trust, BGP routing) did not collapse and managed to restrict abuse (at the expense of scalability). It is also worth to consider that Satoshi's primary intent was to solve the double spending problem in a fully distributed system, which Bitcoin, even considering its inefficiencies, does solve quite well. It is without governance by design. It lets many different users agree on the current state of the blockchain even though they don't trust each other or any central authority. This problem had remained unsolved until the Bitcoin network was launched. OTOH, as the recent Ethereum fork (to mitigate the DAO breach) showed, having a major decision being made by a ad-hoc structured community of developers reaching out to stakeholders by questionnaires appears scary. However, just adding adequate governance is difficult for such a system. Having a centrally controlled consensus algorithm or introduce gated access might contradict fundamental properties. I would be curious to learn which approaches lead to better governance without discarding the fundamental properties of the block chain. - Rainer Hörbe

1 0

IAPP views of blockchain
by John Wunderlich 01 Aug '16

01 Aug '16

The IAPP (International Association of Privacy Professionals) has published a number of small pieces for privacy professionals about blockchain on its web site and newsletters. I've attached a representative sample for your edification Sincerely, John Wunderlich @PrivacyCDN Call: +1 (647) 669-4749 eMail: john(a)wunderlich.ca -- This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. This message contains confidential information and is intended only for the individual named. If you are not the named addressee you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately by e-mail if you have received this e-mail by mistake and delete this e-mail from your system. If you are not the intended recipient you are notified that disclosing, copying, distributing or taking any action in reliance on the contents of this information is strictly prohibited.

4 8

Agenda for BSC telecon Tuesday August 2
by Eve Maler 01 Aug '16

01 Aug '16

http://kantarainitiative.org/confluence/display/BSC/2016-08+%28August+2016%… We meet *Tuesdays* for 30 minutes at 7:30am PT / 10:30am ET / 3:30pm UK / 4:30pm CET. We use Kantara Line A (US +1-805-309-2350, Skype +99051000000481, international options <https://www.turbobridge.com/international.html>, web interface <https://panel.turbobridge.com/webcall/>, more info <https://www.turbobridge.com/join.html>, code 4022737) and http://join.me/findthomas for screen sharing. See the DG calendar <http://kantarainitiative.org/confluence/display/BSC/Calendar> for our full meeting schedule. Agenda: - Work on Trust and verification in a health research context <http://kantarainitiative.org/confluence/display/BSC/Trust+and+verification+…> (was: Alice Consents to Health Research) and discuss implications for technologies sections in the report *Eve Maler*ForgeRock Office of the CTO | VP Innovation & Emerging Technology Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl *ForgeRock Summits and UnSummits* are coming to <http://summits.forgerock.com/> *Sydney, London, and Paris!*

1 0

Use Case updated
by John Wunderlich 31 Jul '16

31 Jul '16

I've renamed the use case and put in a basic narrative and use case diagram. I've tried to put forward the simplest case. Please review and comment if you have a chance, before I move on and fill in the rest of the use case. http://kantarainitiative.org/confluence/display/BSC/Trust+and+verification+… Sincerely, John Wunderlich @PrivacyCDN Call: +1 (647) 669-4749 eMail: john(a)wunderlich.ca -- This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. This message contains confidential information and is intended only for the individual named. If you are not the named addressee you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately by e-mail if you have received this e-mail by mistake and delete this e-mail from your system. If you are not the intended recipient you are notified that disclosing, copying, distributing or taking any action in reliance on the contents of this information is strictly prohibited.

4 9

Re: [DG-BSC] Use Case updated
by j stollman 31 Jul '16

31 Jul '16

John, It is reassuring that we share sensitivity to the issues researchers would face if they had to individualize consents to meet each patient's unique requirements. We appear to part ways (at least for purposes of this discussion) on the best ways to compose and memorialize medical research consents. Regarding consent composition, perhaps, it is best addressed by developing a few model consents that afford different levels of control to data subjects. In this way, review boards might then challenge researchers on why they didn't use the model with the most user control and the researcher would be obliged to justify his selection from among the models. I don't know that allowing subjects full ability to tailor their consent won't raise the objections you cite of sample size and cost. And I don't know that giving subjects such power has much impact on the doctor who recommends participation in the wrong study for the wrong reasons. Regarding memorializing the consents, I could be persuaded that merely giving a subject a copy of a signed consent may be too burdensome on the subject. Storing and tracking the document (in hard copy of digital form) is such a rare event for most subject that they are unlikely to have a good system for doing so that allows for ready retrieval when an issue arises. But I also suspect that adding such a consent to a blockchain may be unnecessarily costly. It could just as easily be stored in a standard database by some independent administrator of such research consents that would operated like a library. The funding for the administrator could come from the same source as funding for a blockchain. I also suspect that giving individuals additional consent opportunities with regard to re-use of research in which they were a subject could dramatically reduce the opportunity to re-use the data. If a large study has 10,000 subjects and the data from it could be used for another study, the new researchers have merely to show that their reuse is consistent with the original consent. If they have to go to each subject to obtain a new, separate consent, the database could well become unusable. Subjects may have new addresses (physical or digital) and tracking them down too costly. I had a similar experience when I wrote a musical several years ago. The entire point of the musical was to re-use existing rock songs that told a story. I assumed that a theater could just pay ASCAP or BMI their licensing fees and be free to have the songs performed in the context of the musical. Not so. Bands can play copyrighted songs under ASCAP and BMI. But a musical requires obtaining unique consent from every publisher. No theater would consider my musical until I first obtained consent from each publisher. I began contacting the publishers. After a few replies such as, "Mr. Morrison needs to know how many seats are in the theater and what is the price per seat," I abandoned the effort. I see individualized consents causing the same problem. I suppose it could be argued that if we can't obtain such individualized consents, perhaps the research is not in the public interest. Perhaps that current practices is tilted too strongly towards the researchers. But I would not want to be the spokesperson representing individualized consents -- even though I am a strong adherent of the rights of the individual. Jef --------------------------------- Jeff Stollman stollman.j(a)gmail.com 1 202.683.8699 Truth never triumphs — its opponents just die out. Science advances one funeral at a time. Max Planck On Sat, Jul 30, 2016 at 10:13 PM, John Wunderlich <john(a)wunderlich.ca> wrote: > Jeff; > > I’ll not disagree that at first blush the value add for smart contracts > and blockchain doesn’t leap off the page. You may recall me trying to argue > against a health research/consent use case in the DG. That being said, the > basic use case can be used throughout Kantara - once elaborated and > validated since there is a lot of work in Kantara that could touch health > research. > > I agree with your assessment of how clinical trials and the YES/NO > decision is made. From sitting on REBs I believe that a study sponsor, > especially in an RCT (randomized controlled trial) literally can’t let in > too much variability how subjects participate in a drug trial. It would > essentially add another independent variable and balloon the sample size > and cost requirements. > > But here’s the issue arising out of that that may make this worth > addressing. Public ledgers can be tools for better governance and > transparency to address power imbalances between the information ‘elites’ > and the information ‘masses’. And I don’t there that there is an imbalance > greater that between a patient that has just been told that the 5 year > survival rate for Stage 3 exocrine pancreatic cancer is 3% (ref. here > <http://www.cancer.org/cancer/pancreaticcancer/detailedguide/pancreatic-canc…>) > and the doctor that is offering an ‘experimental treatment’. How meaningful > is consent (which is supposed to be ‘free of coercion’ and ‘informed’) at > this point? The circumstances are inherently coercive. This is not to blame > the study team or the doctor. It is what it is. > > The vast majority, but not all physicians and researchers will make the > best choices they can in what they believe to be the patient’s best > interests. But even then, once consent has been obtained, some researchers > see data as proprietary and something over which the patient has no right > to a say. (After all, do rocks have any rights to seismological data?) > Consents are often written to enable that proprietary view, and some > countries’ laws agree. Research ethics boards are generally self policing, > with some governance, and some lay input. But the fact remains that they > are mainly researchers approving other researchers’ work. Quis custodiet > ipsos custodes? > > If it is the case that a doctor recommends certain studies over others > based on bad medical judgement, or her relationship with the investigators, > or for rewards and recognition (either academic or cash) what tools can a > patient or her estate use? A public ledger could protect patient privacy > and still provide regulators, auditors and investigators something more to > go on that self reports from the investigated. But until such tools are > available, it is hard to advocate for them. > > As an aside I would argue that consent receipts, if developed and > implemented create a whole new potential for consent based big data type > recruitment and data mining (thinking of thinks like some of the studies > that the Apple Health Kit is starting to make possible). These would be > voluntary, so the consent would be real, and real benefits could accrue > from such large scale studies. More robust and accurate wearable hardware > and software could have large implications, but not for drug trials. > > > > > Sincerely, > John Wunderlich > @PrivacyCDN > > Call: +1 (647) 669-4749 > eMail: john(a)wunderlich.ca > > On 30 July 2016 at 16:52, j stollman <stollman.j(a)gmail.com> wrote: > >> John, et al, >> >> I agree that this is a real-world use case. But I am not certain how >> blockchain has much value add. Perhaps I am too rigid in my thinking, but >> I see this as a classic example of a use case that is well served by >> consent consent processes. >> >> If I were conducting a clinical trial, I will need consent from all >> participants. But consent will be on my terms and will be a YES/NO >> decision. Ideally, it would be nice to allow some give and take and allow >> for customized consents for each user. But practically speaking this could >> become a management nightmare and there is likely too much risk in >> violating HIPAA for researchers to tolerate anything beyond a traditional >> consent. Why couldn't this just be stored in a file cabinet. >> >> If, subsequent to the consent, another researcher desires to re-purpose >> data developed in the first clinical trial, the new researcher would have >> to obtain separate consents from the users, unless the original consent >> included consent for using subject data to support other research efforts. >> >> Am I missing something? >> >> If not, what benefit do we expect to get from using the blockchain to >> track this simple logging of consent receipts? >> >> Thank you. >> >> Jeff >> >> >> --------------------------------- >> Jeff Stollman >> stollman.j(a)gmail.com >> 1 202.683.8699 >> >> Truth never triumphs — its opponents just die out. >> Science advances one funeral at a time. >> Max Planck >> >> On Fri, Jul 29, 2016 at 3:45 PM, John Wunderlich <john(a)wunderlich.ca> >> wrote: >> >>> I've renamed the use case and put in a basic narrative and use case >>> diagram. I've tried to put forward the simplest case. Please review and >>> comment if you have a chance, before I move on and fill in the rest of the >>> use case. >>> >>> >>> http://kantarainitiative.org/confluence/display/BSC/Trust+and+verification+… >>> >>> >>> Sincerely, >>> John Wunderlich >>> @PrivacyCDN >>> >>> Call: +1 (647) 669-4749 >>> eMail: john(a)wunderlich.ca >>> >>> >>> This email and any files transmitted with it are confidential and >>> intended solely for the use of the individual or entity to whom they are >>> addressed. If you have received this email in error please notify the >>> system manager. This message contains confidential information and is >>> intended only for the individual named. If you are not the named addressee >>> you should not disseminate, distribute or copy this e-mail. Please notify >>> the sender immediately by e-mail if you have received this e-mail by >>> mistake and delete this e-mail from your system. If you are not the >>> intended recipient you are notified that disclosing, copying, distributing >>> or taking any action in reliance on the contents of this information is >>> strictly prohibited. >>> >>> _______________________________________________ >>> DG-BSC mailing list >>> DG-BSC(a)kantarainitiative.org >>> http://kantarainitiative.org/mailman/listinfo/dg-bsc >>> >>> >> > > > This email and any files transmitted with it are confidential and intended > solely for the use of the individual or entity to whom they are addressed. > If you have received this email in error please notify the system manager. > This message contains confidential information and is intended only for the > individual named. If you are not the named addressee you should not > disseminate, distribute or copy this e-mail. Please notify the sender > immediately by e-mail if you have received this e-mail by mistake and > delete this e-mail from your system. If you are not the intended recipient > you are notified that disclosing, copying, distributing or taking any > action in reliance on the contents of this information is strictly > prohibited. >

1 0

Where blockchain COULD BE used
by Salvatore D'Agostino 29 Jul '16

29 Jul '16

https://www.cbinsights.com/blog/industries-disrupted-blockchain/?utm_source= CB+Insights+Newsletter <https://www.cbinsights.com/blog/industries-disrupted-blockchain/?utm_source =CB+Insights+Newsletter&utm_campaign=ec0d61b746-ThursNL_7_28_2016&utm_medium =email&utm_term=0_9dc0513989-ec0d61b746-86864785> &utm_campaign=ec0d61b746-ThursNL_7_28_2016&utm_medium=email&utm_term=0_9dc05 13989-ec0d61b746-86864785 Salvatore D'Agostino IDmachines LLC 1264 Beacon Street, #5 Brookline, MA 02446 USA http://www.idmachines.com <http://www.idmachines.com/> http://idmachines.blogspot.com <http://idmachines.blogspot.com/> @idmachines +1 617.201.4809 ph +1 617.812.6495 fax

1 0

Notes from BSC telecon Thursday July 28
by Eve Maler 28 Jul '16

28 Jul '16

http://kantarainitiative.org/confluence/display/BSC/2016-07+%28July+2016%29… Agenda: - Work on Alice Consents to Health Research <http://kantarainitiative.org/confluence/display/BSC/Alice+Consents+to+Healt…> - Report <http://kantarainitiative.org/confluence/display/BSC/Report+from+the+Blockch…> section assignments and review if time Attending: Thomas, Eve, Scott, Ann, Andrew, Mark, Kathleen, Jeff, Don, John *Research use case:* We looked at the use case text and explored the model data sharing consent form, which has been "accordified" in CmA. This is one of the technologies we're explicating and exploring. In Jim's candidate cast of actors, we're missing a likely clinician (dealing with Alice and her treatment for a particular condition) or investigator (looking into, say, an experimental drug), which two roles might be filled by the same person (say, Dr. Whoever). The data might be collected for research generically, or in a different fork of the data flow, it's collected in the course of a specific treatment that Alice is undergoing. Is there a fork as well for aggregation of data and then dissemination to multiple research teams, vs. direct data donation to a specific research effort? Could be both. Our concerns would be that the use case: - Captures requirements for deidentification - Captures the different parties to whom it's being shared - Captures the different intermediaries - Captures data usage requirements and constraints - Captures the ethical considerations for the patient (data subject) but also others sharing part of the same genome - Captures the patient's requirements for comfort around consenting so that they can verify compliance of the other parties more stringently (smart contract implications?) - Captures cross-cutting jurisdictional regime implications of the patient as a stakeholder (rights vs. property) – affects data usage, compliance, etc. - Captures granularity and specificity of consent throughout the consent life cycle (UMA and Consent Receipts implications?) Kathleen has seen ugly lawsuits where, because even deidentified data was unconsented, it had to be destroyed. We're guessing that some of the above list items will become standard use case "Considerations" items, and some will be use-case-specific "Observations" items. Technologies we haven't listed yet include UMA and Consent Receipts; they should be added to the report outline. *Eve Maler*ForgeRock Office of the CTO | VP Innovation & Emerging Technology Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl *ForgeRock Summits and UnSummits* are coming to <http://summits.forgerock.com/> *Sydney, London, and Paris!*

5 10

Agenda for BSC telecon Thursday July 28
by Eve Maler 27 Jul '16

27 Jul '16

http://kantarainitiative.org/confluence/display/BSC/2016-07+%28July+2016%29… We meet *Thursdays* for 30 minutes at 11am PT / 2pm ET / 7pm UK / 8pm CET. We use Kantara Line A (US +1-805-309-2350, Skype +99051000000481, international options <https://www.turbobridge.com/international.html>, web interface <https://panel.turbobridge.com/webcall/>, more info <https://www.turbobridge.com/join.html>, code 4022737) and http://join.me/findthomas for screen sharing. See the DG calendar <http://kantarainitiative.org/confluence/display/BSC/Calendar> for our full meeting schedule. Agenda: - Work on Alice Consents to Health Research <http://kantarainitiative.org/confluence/display/BSC/Alice+Consents+to+Healt…> - Report <http://kantarainitiative.org/confluence/display/BSC/Report+from+the+Blockch…> section assignments and review if time *Eve Maler*ForgeRock Office of the CTO | VP Innovation & Emerging Technology Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl *ForgeRock Summits and UnSummits* are coming to <http://summits.forgerock.com/> *Sydney, London, and Paris!*

1 0

New thoughts for the report: add IAM as a technology
by Eve Maler 26 Jul '16

26 Jul '16

I'm thinking we should add "Identity and access management" as a technology in the report, and then discuss taxonomies a bit within that subsection (and maybe more extensively elsewhere, if they play an extensive role in our recommendations). I have in mind a description of the blockchain technology that differentiates between the (potential) need for identification/authentication/authorization of those who *interact with* it and the use case of putting identity-related information *on* it. (*Jeff S:* If I were to draft V1 of this, would you be willing to review it? I already have some candidate text that's short and hopefully pithy.) And wherever we have a section/subsection that analyzes connections between technologies/techniques, we can perhaps touch on the "self-sovereign identity" solutions that are coming out that use blockchain technology to address user-centric types of identity use cases. If non objections, I can add outline stubs as above so we don't lose the ideas. *Eve Maler*ForgeRock Office of the CTO | VP Innovation & Emerging Technology Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl *ForgeRock Summits and UnSummits* are coming to <http://summits.forgerock.com/> *Sydney, London, and Paris!*

2 1

blockchain is and isn't
by Salvatore D'Agostino 26 Jul '16

26 Jul '16

https://medium.com/@pavelkravchenko/decline-of-blockchain-hype-and-rise-of-a -common-sense-8de5789a794d#.vom3pjey8

2 1

Notes from BSC telecon July 26
by Eve Maler 26 Jul '16

26 Jul '16

http://kantarainitiative.org/confluence/display/BSC/2016-07+%28July+2016%29… Agenda: - Review of BSC DG Report outline <http://kantarainitiative.org/confluence/display/BSC/Report+from+the+Blockch…> - Use case <http://kantarainitiative.org/confluence/display/BSC/Use+Cases?src=contextna…> work Attending: Eve, Matisse, Jeff, Scott, Don, Thomas, Jim, Andrew (from the Kantara LC), John, Colin Lurking *Discussing the outline:* We should ensure that we satisfy the needs of an external audience that shares our purpose too. We could, in part, do this by including a review (John: "environmental scan") of other activities attempting to address some of these issues. The world seems to just be entering the trough of disillusionment. We want to achieve empowerment and the "P2P-ness" in a *functional* sense, even if not in a strictly technical sense. It's a good idea to reference the Kantara vision/mission wording. Jeff suggests: Maybe we shouldn't say "P2P" at all in our goal, because it implies a (technical) technique too strongly. We could illustrate the power imbalance instead by talking about "contracts of adhesion" or simply talk about addressing the power imbalance directly (brute force method!). Eve essays a goal: Solve the use cases, with whatever technologies. This may mean not always using a pure blockchain model if that has certain vulnerabilities, or requires a TTP in the mix, or whatever. We could discuss how blockchain has started to be over-applied to solve problems it perhaps wasn't meant for (the root of the trough-of-disillusionment phenomenon!). >From the chat: Technology cannot solve problems that require management and governance . But technology can provide tools to manage and govern. Jim shares this link as a resource <https://docs.google.com/document/d/1AIuACsbe5B4I438r0vS6dS9jZFZUOBh6uJeGxrw…> for helping with the first use case. Next time: Continue with the same agenda. *Eve Maler*ForgeRock Office of the CTO | VP Innovation & Emerging Technology Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl *ForgeRock Summits and UnSummits* are coming to <http://summits.forgerock.com/> *Sydney, London, and Paris!*

1 0

Agenda for BSC telecon July 26
by Eve Maler 25 Jul '16

25 Jul '16

http://kantarainitiative.org/confluence/display/BSC/2016-07+%28July+2016%29… We meet *Tuesdays* for 30 minutes at 7:30am PT / 10:30am ET / 3:30pm UK / 4:30pm CET. We use Kantara Line A (US +1-805-309-2350, Skype +99051000000481, international options <https://www.turbobridge.com/international.html>, web interface <https://panel.turbobridge.com/webcall/>, more info <https://www.turbobridge.com/join.html>, code 4022737) and http://join.me/findthomas for screen sharing. See the DG calendar <http://kantarainitiative.org/confluence/display/BSC/Calendar> for our full meeting schedule. Agenda: - Review of briefing note outline (to be supplied) - Use case work *Eve Maler*ForgeRock Office of the CTO | VP Innovation & Emerging Technology Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl *ForgeRock Summits and UnSummits* are coming to <http://summits.forgerock.com/> *Sydney, London, and Paris!*

1 1

Notes from BSC telecon July 21
by Eve Maler 21 Jul '16

21 Jul '16

http://kantarainitiative.org/confluence/display/BSC/2016-07+%28July+2016%29… Agenda: - 10 min: Review Tuesday's discussion briefly if we have substantially different people on the call - Rest of the time: Figure out the broad outlines of use case #1 in light of our new understanding Attending: Thomas, Eve, Scott, Don, Marco, Matisse In doing a use case, here are questions we could consider answering: - Who is the party we want to empower or give autonomy to? That would be the "Alice", so to speak. - What is the transaction we are describing? This would be the gerund that goes into the use case name. (Like "consent", e.g.) - What is the domain of the transaction? (Like "health research", e.g.) We need a champion to stand up and take the new use case wiki page further. Is that Jim? John? Both together? Please see the new Alice Consents to Health Research <http://kantarainitiative.org/confluence/display/BSC/Alice+Consents+to+Healt…> use case page for details. For next week: - The briefing note dumping ground to throw eggs at - Use case work *AI:* Thomas: Ask Shannon to tidy up the calendar. *Eve Maler*ForgeRock Office of the CTO | VP Innovation & Emerging Technology Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl *ForgeRock Summits and UnSummits* are coming to <http://summits.forgerock.com/> *Sydney, London, and Paris!*

3 3

Agenda for BSC telecon 2016-07-21 (today!)
by Eve Maler 21 Jul '16

21 Jul '16

*Note that we're now using Kantara line A* (TurboBridge) for the phone line. You may experience trouble getting into it using Skype, in which case try the web interface instead -- though that choice seems incompatible with Safari browsers. Sigh. :) http://kantarainitiative.org/confluence/display/BSC/2016-07+%28July+2016%29… We meet *Thursdays* for 30 minutes at 11am PT / 2pm ET / 7pm UK / 8pm CET . We use Kantara Line A (US +1-805-309-2350, Skype +99051000000481, international options <https://www.turbobridge.com/international.html>, web interface <https://panel.turbobridge.com/webcall/>, more info <https://www.turbobridge.com/join.html>, code 4022737) and http://join.me/findthomas for screen sharing. See the DG calendar <http://kantarainitiative.org/confluence/display/BSC/Calendar> for our full meeting schedule. Agenda: - 10 min: Review Tuesday's discussion briefly if we have substantially different people on the call - Rest of the time: Figure out the broad outlines of use case #1 in light of our new understanding *Eve Maler*ForgeRock Office of the CTO | VP Innovation & Emerging Technology Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl *ForgeRock Summits and UnSummits* are coming to <http://summits.forgerock.com/> *Sydney, London, and Paris!*

1 0

Notes from BSC telecon July 19
by Eve Maler 20 Jul '16

20 Jul '16

http://kantarainitiative.org/confluence/display/BSC/2016-07+%28July+2016%29… Agenda: - 15 min: Sharpen our deliverable ToC/value prop - E.g., focus on transactions/contracts aspects? verticals/sectors? what other constraints to make our goals achievable and valuable?... - Choose a mini-goal for Aug 5 (the one-month mark) - 15 min: Thorsten: present IRM touchpoints and next steps - Homework for Thursday: next steps on patient consent for research (?) use case Attending: Eve, Thorsten, Jim, Marc D, John, Philip (Thomas regrets) *Sharpening our deliverable:* Is our primary audience the Kantara leadership, as John suggests? Kantara is in the business <https://kantarainitiative.org/what-we-do/> of identity innovation and interior. Jim notes that he's discovered the centrality of identity to his purposes, while blockchain is really one of a variety or family of technologies that are potentially relevant to his purposes, namely "moving legal onto GitHub, more or less – making legal processes cheaper and faster and getting them closer to user control and autonomy". Other technologies : IPFS and so on. We seem to have achieved rough consensus about this vision for the scope of our briefing note: We want to focus on use cases that are about "contracting and transacting" in the context of empowering individuals, smaller companies, smaller countries, and communities in a "peer to peer" way with larger companies and countries etc. (not meaning P2P technologies necessarily, though it might do so). "Legal" means a formal statement of relationships, and it could include contracts, permits, consents, and so on. All legal documents increment relationships between some "Persons" (including both human and non-human). *IRM presentation:* Thorsten presented <https://slides.com/wedaslide/irm-bcsc/> some thoughts (of his own) on the IRM principles. We're thinking that capturing various technologies adjacent to blockchain (many of which he has listed here) and presenting an analysis of them in our briefing note would be a valuable idea. Scott (not on the line but on the screenshare) added this link <https://kantarainitiative.org/confluence/download/attachments/69275399/asse…> to a taxonomy of identity types, including human and other. *AI:* Eve: Create a GDoc that would be a briefing note dumping ground for outline ideas (see above re Thorsten comments). *Eve Maler*ForgeRock Office of the CTO | VP Innovation & Emerging Technology Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl *ForgeRock Summits and UnSummits* are coming to <http://summits.forgerock.com/> *Sydney, London, and Paris!*

4 7

Agenda for BSC telecon July 19 (note the switch to Kantara Line A)
by Eve Maler 18 Jul '16

18 Jul '16

Please note that we're now fully in the swing of using the Kantara dial-in infrastructure (TurboBridge). A number of people have have problems using Skype in combination with it; if you have this problem, try the web interface. (I can't get it to work with Safari, myself, but it's awesome with Chrome.) http://kantarainitiative.org/confluence/display/BSC/2016-07+%28July+2016%29… We meet *Tuesdays* for 30 minutes at 7:30am PT / 10:30am ET / 3:30pm UK / 4:30pm CET . We use Kantara Line A (US +1-805-309-2350, Skype +99051000000481, international options <https://www.turbobridge.com/international.html>, web interface <https://panel.turbobridge.com/webcall/>, more info <https://www.turbobridge.com/join.html>, code 4022737) and http://join.me/findthomas for screen sharing. See the DG calendar <http://kantarainitiative.org/confluence/display/BSC/Calendar> for our full meeting schedule. Agenda: - 15 min: Sharpen our deliverable ToC/value prop - E.g., focus on transactions/contracts aspects? verticals/sectors? what other constraints to make our goals achievable and valuable?... - Choose a mini-goal for Aug 5 (the one-month mark) - 15 min: Thorsten: present IRM touchpoints and next steps - Homework for Thursday: next steps on patient consent for research (?) use case *Eve Maler*ForgeRock Office of the CTO | VP Innovation & Emerging Technology Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl *ForgeRock Summits and UnSummits* are coming to <http://summits.forgerock.com/> *Sydney, London, and Paris!*

1 0