- Dg-mdl - mailman.kantarainitiative.org

PImDL Report for comment
by John Wunderlich 25 May '21

25 May '21

Hello; Please find attached a copy of the candidate draft report from the drafting committee, along with a comment template. Your tasks, should you choose to, or have the cycles to, is: 1. Read the attached report a. Note any errors, omissions, or changes by line number 2. Enter your observations in the comment template and send it back to me by the end of this week if you can. There will be no meeting this Wednesday, and I will update the group by next Monday with respect to the comments received and the impact that this will have on producing the final copy for voting. Sincerely, John Wunderlich BA, MBA, CISA, CIPP/C, CIPM, FIP LinkedIn: https://www.linkedin.com/in/privacycdn/ Twitter: https://twitter.com/PrivacyCDN -- This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. This message contains confidential information and is intended only for the individual named. If you are not the named addressee you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately by e-mail if you have received this e-mail by mistake and delete this e-mail from your system. If you are not the intended recipient you are notified that disclosing, copying, distributing or taking any action in reliance on the contents of this information is strictly prohibited.

1 0

mDL privacy
by Tom Jones 22 May '21

22 May '21

Here is a nice report from a Googler which might be useful to add to the references. It was written before the ACLU report. Too bad the ACLU didn't read it. https://slacker.ro/2020/10/28/privacy-preserving-features-in-the-mobile-dri… Be the change you want to see in the world ..tom

1 0

mDL declared "secretive" could we help with that?
by Tom Jones 20 May '21

20 May '21

https://www.biometricupdate.com/202105/aclu-urges-hard-questions-on-mdls-to… Be the change you want to see in the world ..tom

2 1

Fwd: [Soups-announce] Fwd: [Important Announcement] SOUPS 2021 Calls for Workshops and Beyond, Posters, Lightning Talks, and John Karat Award!
by John Wunderlich 19 May '21

19 May '21

Forwarding in case anyone in the group is interested. Sincerely, John Wunderlich BA, MBA, CISA, CIPP/C, CIPM, FIP LinkedIn: https://www.linkedin.com/in/privacycdn/ Twitter: https://twitter.com/PrivacyCDN ---------- Forwarded message ---------- From: SOUPS Publicity <soupspublicity(a)gmail.com> Date: May 19, 2021, 9:34 AM -0400 To: soupspublicity(a)gmail.com Subject: [Soups-announce] Fwd: [Important Announcement] SOUPS 2021 Calls for Workshops and Beyond, Posters, Lightning Talks, and John Karat Award! > Hi All, > Deadlines are approaching! Please consider submitting to SOUPS 2021 Workshops, Posters, Lightning talks, and John Karat Award! See details below.----------------------------The following SOUPS 2021 Calls are now available on SOUPS 2021 homepage. > • Call for Workshops and Beyond deadline: Thursday, March 4, 2021 • Call for Posters deadline: Thursday, May 27, 2021 • Call for Lightning Talks deadline: Thursday, May 27, 2021 • 2021 John Karat Usable Privacy and Security Student Research Award Nominations deadline: Thursday, May 27, 2021The SOUPS Mentoring Program is also returning for 2021. Registration information will be posted soon. > SOUPS 2021 Publicity Co-ChairsYaxing Yao & Charles Weir > _______________________________________________ > Soups-announce mailing list > Soups-announce(a)mailman.srv.cs.cmu.edu > https://mailman.srv.cs.cmu.edu/mailman/listinfo/soups-announce -- This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. This message contains confidential information and is intended only for the individual named. If you are not the named addressee you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately by e-mail if you have received this e-mail by mistake and delete this e-mail from your system. If you are not the intended recipient you are notified that disclosing, copying, distributing or taking any action in reliance on the contents of this information is strictly prohibited.

1 0

signed attributes
by Tom Jones 12 May '21

12 May '21

we need to be cognizant that, in json, attributes themselves can be signed. So the json element can be a fully formed jose structure. What this means is that there can be externally sourced attributes that carry their own assurances and do not need to be processed by any implementation that does not need the data contained. This feature will be included in identity standards now in development. This does not need to be articulated in the current draft as the standards are not complete, but it would not be good to prevent it. I fully agree that singers (issuers) need to be responsible for the data that they sign *that is not signed by others*. Be the change you want to see in the world ..tom

1 0

Fwd: mDL RFI update
by Colin Wallis Kantara 04 May '21

04 May '21

Folks Apologies in advance for cross-posting. Please find AAMVA's response to its RFI issued at the end of last year. You'll recall that Kantara did a joint response with the Future Identity Council <https://kantarainitiative.org/confluence/display/mdl/Reference+documents+fo…> (in a very compressed timeframe) which may prove helpful as you read AAMVA's response. You can sense that the input on the governance model etc has resonated. Kind regards Colin Executive Director ---------- Forwarded message --------- From: Sampson, Alaster <ASampson(a)aamva.org> Date: Tue, May 4, 2021 at 1:24 PM Subject: mDL RFI update To: Cc: Joy, Mekala <mjoy(a)aamva.org>, Ross, Siedah <SRoss(a)aamva.org> Offerors, Thank you for responding to the mDL Digital Trust Service RFI. AAMVA appreciates your input and the AAMVA team reviewed all the responses received. AAMVA Board has voted to move forward with this effort as summarized in the attached document. More info to come. Thank You, Alaster *Alaster Sampson, MBA* Senior Manager, Purchasing American Association of Motor Vehicle Administrators (AAMVA) asampson(a)aamva.org D: 1-703-908-5877 4401 Wilson Blvd, Suite 700 | Arlington, VA 22203 *Safe Drivers, Safe Vehicles, Secure Identities, Saving Lives!* *aamva.org <https://www.aamva.org/>*

1 0

Today’s meeting PImDL
by John Wunderlich 28 Apr '21

28 Apr '21

Hello; I had wanted to have a content complete version of the report ready for the group today but, for a variety of reasons, it isn’t ready. So rather than use up your valuable time going over the same ground I suggest we push back today’s meeting to next week at which point I hope to have content complete version ready for a preliminary vote or discussion. Apologies for the cancellation and I hope to talk to all you next week. In the meantime, if you haven’t looked at or commented on the report so far, here is a link to the Google Doc: https://docs.google.com/document/d/1CaOxuzip7PPVxt_slGbDmyjaKOtoxOLKkg9g9yT… Sincerely, John Wunderlich BA, MBA, CISA, CIPP/C, CIPM, FIP LinkedIn: https://www.linkedin.com/in/privacycdn/ Twitter: https://twitter.com/PrivacyCDN

3 5

TSA RFI re mDL published today, closes June 18, 2021.
by Colin Wallis Kantara 19 Apr '21

19 Apr '21

Hello mDL Discussion Group FYI.. >From Jason Lim, TSA of LinkedIn today TSA seeks input on mobile driver’s licenses to inform REAL ID rulemaking DHS and TSA are interested in mobile driver’s licenses because, compared to physical driver’s licenses, mobile driver’s licenses could provide greater security to TSA and all federal agencies verifying an individual’s identity, stronger privacy protections to individuals, and health and safety benefits to all users by enabling touchless identity verification. The Request for Information, solicits comments and input regarding technical approaches, applicable industry standards and best practices to ensure that mobile driver’s licenses can be issued and authenticated with features that ensure security, privacy and identity fraud detection. Comments may be submitted until June 18, 2021. #security <https://www.linkedin.com/feed/hashtag/?keywords=security&highlightedUpdateU…> #privacy <https://www.linkedin.com/feed/hashtag/?keywords=privacy&highlightedUpdateUr…> #protection <https://www.linkedin.com/feed/hashtag/?keywords=protection&highlightedUpdat…> #healthandsafety <https://www.linkedin.com/feed/hashtag/?keywords=healthandsafety&highlighted…> #mDL <https://www.linkedin.com/feed/hashtag/?keywords=mdl&highlightedUpdateUrns=u…> #digitalidentity <https://www.linkedin.com/feed/hashtag/?keywords=digitalidentity&highlighted…> #identitymanagement <https://www.linkedin.com/feed/hashtag/?keywords=identitymanagement&highligh…> https://www.govinfo.gov/content/pkg/FR-2021-04-19/pdf/2021-07957.pdf Kind regards Colin Executive Director Delivering 3rd party Assurance for NIST SP 800-63-3 <https://kantarainitiative.org/kantara-initiative-first-to-market-with-nist-…> Kantara Initiative <https://kantarainitiative.org/about/10th-anniversary/>

1 0

Flash pass probably will not work
by Tom Jones 15 Apr '21

15 Apr '21

Here is rather direct evidence of the vaccine test of a "flash pass". The results are as expected - fraud is just too easy. Sorry that the WSJ is behind a paywall, but the intro tells enuf of the story. https://www.wsj.com/articles/fake-covid-19-certificates-hit-airlines-which-… Be the change you want to see in the world ..tom

2 1

Fwd: Join the Team! Announcing the Launch of the NIST Privacy Workforce Public Working Group
by Tom Jones 14 Apr '21

14 Apr '21

This announcement relates directly to a discussion in PImDL about worker's actions impacting privacy. We should probably direct the PImDL report to that effort as soon as we can. I am definitely in favor of releasing the report at the earliest possible time. I want to send it to the DIF vaccination effort when I am allowed to. Be the change you want to see in the world ..tom ---------- Forwarded message --------- From: NIST Cybersecurity and Privacy Program < csrc.nist(a)service.govdelivery.com> Date: Wed, Apr 14, 2021 at 5:40 AM Subject: Join the Team! Announcing the Launch of the NIST Privacy Workforce Public Working Group To: <thomasclinganjones(a)gmail.com> [image: NIST] View As Web Page <https://lnks.gd/l/eyJhbGciOiJIUzI1NiJ9.eyJidWxsZXRpbl9saW5rX2lkIjoxMDAsInVy…> [image: Header] Cybersecurity Insights a NIST Blog Join the Team! Announcing the Launch of the NIST Privacy Workforce Public Working Group [image: Public working group image] Credit: Shutterstock/Rawpixel.com When it comes to managing privacy risks, workforce is a key consideration. According to a recent IAPP/FairWarning report <https://lnks.gd/l/eyJhbGciOiJIUzI1NiJ9.eyJidWxsZXRpbl9saW5rX2lkIjoxMDEsInVy…>, on average, even mature privacy programs have only three employees dedicated to privacy. This is why we included workforce as a priority area in the NIST Privacy Framework Roadmap <https://lnks.gd/l/eyJhbGciOiJIUzI1NiJ9.eyJidWxsZXRpbl9saW5rX2lkIjoxMDIsInVy…>. The benefits of using the Privacy Framework <https://lnks.gd/l/eyJhbGciOiJIUzI1NiJ9.eyJidWxsZXRpbl9saW5rX2lkIjoxMDMsInVy…> are enhanced when organizations have a sufficient pool of knowledgeable and skilled privacy professionals to draw from. In response to stakeholder challenges with privacy workforce recruitment and development, we are planning to create a privacy workforce taxonomy aligned with the Privacy Framework and the National Initiative for Cybersecurity Education Workforce Framework <https://lnks.gd/l/eyJhbGciOiJIUzI1NiJ9.eyJidWxsZXRpbl9saW5rX2lkIjoxMDQsInVy…> for Cybersecurity (NICE Framework). The NICE Framework provides a structure for Task, Knowledge, and Skill (TKS) Statements that may be used to support an organization’s workforce goals for cybersecurity. Our objective is to develop a set of TKS Statements aligned with the Privacy Framework to assist organizations in developing and recruiting a workforce better capable of managing privacy risks arising from their systems, products, and services. Read More <https://lnks.gd/l/eyJhbGciOiJIUzI1NiJ9.eyJidWxsZXRpbl9saW5rX2lkIjoxMDUsInVy…> Connect with us [image: twitter] <https://lnks.gd/l/eyJhbGciOiJIUzI1NiJ9.eyJidWxsZXRpbl9saW5rX2lkIjoxMDYsInVy…> Received this email from a friend? Subscribe here <https://lnks.gd/l/eyJhbGciOiJIUzI1NiJ9.eyJidWxsZXRpbl9saW5rX2lkIjoxMDcsInVy…> . [image: NIST] <https://lnks.gd/l/eyJhbGciOiJIUzI1NiJ9.eyJidWxsZXRpbl9saW5rX2lkIjoxMDgsInVy…> *You are subscribed to receive updates to NIST Cyber Blog from the National Institute of Standards and Technology (NIST).* *Subscriber services:* *Manage Preferences <https://lnks.gd/l/eyJhbGciOiJIUzI1NiJ9.eyJidWxsZXRpbl9saW5rX2lkIjoxMDksInVy…> | Unsubscribe <https://lnks.gd/l/eyJhbGciOiJIUzI1NiJ9.eyJidWxsZXRpbl9saW5rX2lkIjoxMTAsInVy…> | Help <https://lnks.gd/l/eyJhbGciOiJIUzI1NiJ9.eyJidWxsZXRpbl9saW5rX2lkIjoxMTEsInVy…>* ------------------------------ If you have questions or problems with the subscription service, please contact subscriberhelp.govdelivery.com <https://lnks.gd/l/eyJhbGciOiJIUzI1NiJ9.eyJidWxsZXRpbl9saW5rX2lkIjoxMTIsInVy…> . Technical questions? Contact inquiries(a)nist.gov. (301) 975-NIST (6478). This service is provided to you at no charge by National Institute of Standards and Technology (NIST). 100 Bureau Drive, Stop 1070 · Gaithersburg, MD 20899 · 301-975-6478 [image: GovDelivery logo] <https://lnks.gd/l/eyJhbGciOiJIUzI1NiJ9.eyJidWxsZXRpbl9saW5rX2lkIjoxMTMsInVy…>

1 0