September 2024 - Wg-ancr - mailman.kantarainitiative.org

ANCR WG call reminder
by Salvatore D'Agostino 12 Nov '24

12 Nov '24

Dear ANCR WG, We have a very active plate of WG activities to complete by year end. Also Thanksgiving tomorrow here. Proposed Agenda Roll IPR Approve Agenda (5 min) Administration (30 mins, 10 per topic) Charter Refresh https://github.com/KantaraInitiative/WG-ANCR/blob/main/ANCR-Charter-Update-2 023.md Officer Nominations and Election Board Funding Request Technical Editor GitHub organization and administration Translation (French specifically) (Scope and Budget for above) Digital Commons White Paper (10 min). Digital Transparency Performance Scheme https://github.com/KantaraInitiative/WG-ANCR/blob/main/TPI/ANCR-Digital-Tran saprency-Scheme-v0.9.1.pdf (10 min). AOB IDmachines 4 Lamson Place Cambridge, MA 02139-2612 +1 617.201.4809 @idmachines https://idmachines.com Please note our new address. Email, phones, other contacts remain the same. Disclaimer The information contained in this communication from the sender is confidential. It is intended solely for use by the recipient and others authorized to receive it. If you are not the recipient, you are hereby notified that any disclosure, copying, distribution or taking action in relation of the contents of this information is strictly prohibited and may be unlawful. If you have received this email in error, please delete it and advise the sender.

2 1

Agenda for call today
by Salvatore D'Agostino 08 Oct '24

08 Oct '24

Hi WG, Here is the draft agenda for the call today at Noon Eastern Daylight Time. ANCR WG 20240911 draft - WG - ANCR - Kantara Initiative (atlassian.net)<https://kantara.atlassian.net/wiki/spaces/WA/pages/640974862/ANCR+WG+202409…> Here are the meeting instructions and dial in: Join Zoom Meeting<https://us06web.zoom.us/j/87282263538?pwd=K0RwY1g1b3pKeHdBcXpjeExVZUFpQT09> Meeting ID: 872 8226 3538 Passcode: 255697 See you then. Best, Sal PS, I am traveling and hope to be set up back in my room for this call, bear with me in this regard. IDmachines 4 Lamson Place Cambridge, MA 02139-2612 +1 617.201.4809 @idmachines https://idmachines.com<https://idmachines.com/> Please note our new address. Email, phones, other contacts remain the same. Disclaimer The information contained in this communication from the sender is confidential. It is intended solely for use by the recipient and others authorized to receive it. If you are not the recipient, you are hereby notified that any disclosure, copying, distribution or taking action in relation of the contents of this information is strictly prohibited and may be unlawful. If you have received this email in error, please delete it and advise the sender.

2 1

cancel call (unsigned)
by Salvatore D'Agostino 25 Sep '24

25 Sep '24

Hi WG, Sorry for the duplicate message, this one unsigned. Several of us are traveling today. Please let me know if you have any concerns about the cancellation. We will meet again in two weeks. Keep an eye on the listserve for updates. Best, Sal IDmachines 4 Lamson Place Cambridge, MA 02139-2612 +1 617.201.4809 @idmachines https://idmachines.com<https://idmachines.com/> Please note our new address. Email, phones, other contacts remain the same. Disclaimer The information contained in this communication from the sender is confidential. It is intended solely for use by the recipient and others authorized to receive it. If you are not the recipient, you are hereby notified that any disclosure, copying, distribution or taking action in relation of the contents of this information is strictly prohibited and may be unlawful. If you have received this email in error, please delete it and advise the sender.

1 0

cancel call
by Salvatore D'Agostino 25 Sep '24

25 Sep '24

0 *H÷ 010 `He0 *H÷ $-Content-Type: multipart/alternative; boundary="----=_NextPart_000_0000_01DB0F20.4B2B2350" This is a multipart message in MIME format. ------=_NextPart_000_0000_01DB0F20.4B2B2350 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Hi WG, A number of us are traveling or at conferences so I think it makes sense to cancel the call today. Let me know if anyone thinks otherwise. Best, Sal IDmachines 4 Lamson Place Cambridge, MA 02139-2612 +1 617.201.4809 @idmachines https://idmachines.com <https://idmachines.com/> Please note our new address. Email, phones, other contacts remain the same. Disclaimer The information contained in this communication from the sender is confidential. It is intended solely for use by the recipient and others authorized to receive it. If you are not the recipient, you are hereby notified that any disclosure, copying, distribution or taking action in relation of the contents of this information is strictly prohibited and may be unlawful. If you have received this email in error, please delete it and advise the sender. ------=_NextPart_000_0000_01DB0F20.4B2B2350 Content-Type: text/html; charset="us-ascii" Content-Transfer-Encoding: quoted-printable <html xmlns:v=3D"urn:schemas-microsoft-com:vml" = xmlns:o=3D"urn:schemas-microsoft-com:office:office" = xmlns:w=3D"urn:schemas-microsoft-com:office:word" = xmlns:m=3D"http://schemas.microsoft.com/office/2004/12/omml" = xmlns=3D"http://www.w3.org/TR/REC-html40"><head><META = HTTP-EQUIV=3D"Content-Type" CONTENT=3D"text/html; = charset=3Dus-ascii"><meta name=3DGenerator content=3D"Microsoft Word 15 = (filtered medium)"><style></style></head><body lang=3DEN-US = link=3D"#467886" vlink=3D"#96607D" style=3D'word-wrap:break-word'><div = class=3DWordSection1>Hi WG,<o:p></o:p><o:p> </o:p>A number of us are = traveling or at conferences so I think it makes sense to cancel the call = today.<o:p></o:p><o:p> </o:p>Let me know if anyone = thinks otherwise.<o:p></o:p><o:p> </o:p>Best,<o:p></o:p>Sal<o:p></o:p><o:p> </o:p>IDmachines<o:p></o:p></span= >4 Lamson = Place<o:p></o:p>Cambridge, MA = 02139-2612<o:p></o:p>+1 = 617.201.4809<o:p></o:p>@idmachines<o:p></o:p></spa= n><a = href=3D"https://idmachines.com/">https://idmachines.com</a><o:p></o:p></s= pan><o:p> </o:p>Please note our new = address. Email, phones, other contacts remain the = same.<o:p></o:p><o:p> </o:p>Disclaimer<o:p></o:p>The information contained in this communication from Íthe sender is = confidential. It is intended solely for use by the recipient and others = authorized to receive it. If you are not the recipient, you are hereby = notified that any disclosure, copying, distribution or taking action in = relation of the contents of this information is strictly prohibited and = may be unlawful. If you have received this email in error, please delete = it and advise the sender.<o:p></o:p></= span><o:p> </o:p><o:p> </o:p></div></body></html> ------=_NextPart_000_0000_01DB0F20.4B2B2350-- ü0`0H BE#ÈDµ0 *H÷ 0J10 UUS10U IdenTrust1'0%UIdenTrust Commercial Root CA 10 140116181223Z 340116181223Z0J10 UUS10U IdenTrust1'0%UIdenTrust Commercial Root CA 10"0 *H÷ 0 §PÞ?=Ô3FñoQa²©Og]ÙSÝ(Ù×ðÿ®Crùµ]|ÁBá1PtÑ |Í!«Câ¬^nó Z2œ¢ëùè\ ìÿÒ¯q³ŽSNïŒœìO20K^WÄSÂöÙb+¿$bßÃž)KIx<`"üÚ6ÈÂ¢Ô,Tg5ns¿Xð€Ýå°¢&zÊà6¥õý·ï®?@õmZýÎ4Ê$Üt#]3]Ä%ö0Ý]àÕGœŽë¡»IIØ[óä$äbOOÁ¯tšÑrjzIÌŽFyÆ±ÚYúu!eÝVÎû«¥`ÄùR°œù+# #v;÷3áÉóiùK¢àNŒ~9÷Dp~þZå±¬ÑÌò5åIIÊVÉ=û};ÁÂMÉO7é¡jßb.Ë5Qy,È%8ôúK§\Òã 9Jt|ÕYÂ?N\Rô=÷Rñê£¬ýI4(óA:îèÞÿ_ºËèò¹P`À1ÓsåïŸ í3tŸ ÄglðzUFN§ô>áöØ á3d+c×2^ùÀ{xoŒùxz×rtUtx±ºánpºO ºhÃ{ÿ1ðs==*±A þMeky3Ž×£B0@0Uÿ0Uÿ0ÿ0UíDÀÓðî€{ŸBç&TÈ6v0 *H÷ ®2öŠK|Dva'(Í^Tï%Œãù)×®háXï..~SR¶\êºP×ßa æÎÁò7x°_³¢sž8Í>°žûÀÏ±òì--Ììª³ª`-;Ã=WužÓ0Í`ÓTñMfÀ]t@£î~ÂwèÁ§]RíÉÝ%mú©í£:4ÐY{ÚíPó5¿íëM1Ç`ôÚñâHâÆÅ7ûúuYf1G)Úvé®ï¹Q÷#ib<åU6×Tÿñ¹]ÎÔ#oØEJ[eïÝ§ Ë¥%Ž ùð¢ÒôÈt¡*HeÛÄâ%}ëŸ[ TQJSì]Ê3íbýEÇ/[ÜX 9æú×þŠí=JBtÔÃwYsÍFŸU8ïúè2êX"Þ8ÃÌŒmÉ3:j i? Èêrc#œm<àILª¢¹*6xíÃèFâ&YDuÙuQÍa`Ë]ù"Mæãö[»®ÍÊJk^óQát+é~'§ÙINø¥Û%cbÉ3gk<ÆÞšÍð7qò«üAõÁì7] åNïú±\8¥JáÜ8-<Ü«ÕJîÑplÌîôWøºn00 @žáê<zÌ>BO0 *H÷ 0:10 UUS10U IdenTrust10UTrustID CA A140 240425192606Z 260426192506Z0M1!0 *H÷ sal(a)idmachines.com1(0&UA01410C0000018F16B8E1DC00130CBB0"0 *H÷ 0 êPV_FŒÞÇYÞ»1w@ ÿÈÈr/näœ»uoBŠZ@^üÈ »wýVá!ó}gk° >:¥4:ütÅe"°³XÉº&XºðpÓ²>ºEÍ?z ¬b^5á¯ôRiÓïVOgLaèÕ².úrÑF~ÃöÕ?ô5,ËÅú2¯áâœú"EÆšŽ5õ4Åk~CP*ÒfnTnhÄÈ*£}ÞIºÝ€VÛÄTÞÄEh\8ºº ù]BÊÑÈQi1¢/vNþŠÆk'5²;6ÿËènë®0 |=£00Uÿ00Uÿ 0+x0v00+0$http://commercial.ocsp.identrust.com0B+…U#0ÂÔD qÏHVŸh8\§·÷EŒ0#U 00 g0 `Hù/0EU>0<0: 8 64http://validation.identrust.com/crl/trustidcaa14.crl0U0sal(a)idmachines.com0U6(Óqï/ØD@Ø;lmXæSE~0U%0 +0 *H÷ °`ó0Äùê2`'3V-ŠÔý.ÛvéñNF$~L/2A2õþèC(á£Ãüûdï\×î ;!)GùÓ¬NÍÏÐÖ®êòrš¥%]TaË#ÑQ÷²Ö/ªÆÛä$]IÙNØCÓ*Yµ°ôHàî+ÈŠå£ªaóòœyJl[RU*wœZºé%¹v9N6¬N}íà³so4=µ#Ü)}MÅQWãQüÊoHÖþÿ©ðMoÃŠÌ^ªê,®j³± Li;I)¡Øâ&È:÷€ôÿÕç<fëñA±°ßÙm°x~š-Çu<Îý>>U±5íkªmÀÇÏë|Ô`îMEa³©)&sGriûi=Ñïfhµîuø$ÐqÃ 6ÅÆ<A<šÄÞAr7À¢dŒÀ£0ŠbZÍ»ÄÏž.î£ú§Bì)! Ûª¬Éã#jÕäbßúätâV\1èÑÄN ÓÝÝ ^ÐGÜ]šb¹ÜÞFûn}Ácô2ŽÅ]OÝ 1ö)ÉË ."La\W!!ìRj[Ø@ðÒ{ìKÆ+ÜZ3Ù%¯Áf{"ÀË7WF¯\¬1vyÓŽÄ0ô0Ü @ÿÒiÚwÂéÕMM0 *H÷ 0J10 UUS10U IdenTrust1'0%UIdenTrust Commercial Root CA 10 230816192846Z 330812192845Z0:10 UUS10U IdenTrust10UTrustID CA A140"0 *H÷ 0 è©õŒ±éäÙËíX€ËF`eð¬ûÃA`kX»0DÙ9bÜrÁñRñÕ×«²3È÷6u/!²Öa§? Œ§8lxn×î%ûf¬<²Ñ»X$=-Ÿà§ÆÍ£EðiùëžÅFÖ{ePH»òÒßqEK tG%£¹yP2`A6ìL[Nä\ÍÒ§»Ó À[:«CQR ãL|70ídj¢Et«¹}Ì u÷@ òxb× Æ°K=°1dªØØWÐ.ïvkª r Xý(bšFr|qG Ôñ³ÿ£|\3òÚtÈ:ÒXTßŒôBp`¡Â`@±[xoÄR^.W°ö@ÁÃé7¯Ì;Œ=Us¯Ø$YÂîníºË*tÅùÛò\ oþåê'Y. xp,¬\¿åù!³I.EÛË7ï¢±ßÔh[P:4£ÿ]|×2`vZXtZ+cÒŒ~ÚÖP!!4Ó3aózG]wËí=.DÜ"X¯jë]êq?å§â!»aææVBJFQCj)(ñ" êÀÈ"©&?žR§gßû--Ùùt=µK7w¬eÀ#×k%ã3Ö)ŠÁåwsšxh:ÂÝ 8Ÿmí&Û5®i"\OŽEÝ£ä0à0Uÿ0ÿ0Uÿ0+}0{00+0$http://commercial.ocsp.identrust.com0G+0;http://validation.identrust.com/roots/commercialrootca1.p7c0U#0íDÀÓðî€{ŸBç&TÈ6v0_U X0V0TU 0L0J+>https://secure.identrust.com/certificates/policy/ts/index.html0JUC0A0? = ;9http://validation.identrust.com/crl/commercialrootca1.crl0UÂÔD qÏHVŸh8\§·÷EŒ0AU%:08++ +7 +7 +7 0 *H÷ ò][i]ãR®hÝE#+ 9q7%,Lya`VRÐÛ|ìAs«ÊœkYPÄÜdw S_ÇS¡Šá°èö(1Ü@ žæŒ&tš-B9Ì§åÚTt³Ý¿xQ¿0_¬óã°lÏ>Çc@±]NDì[£]ùb9"fkj¬ØçÀÉ¬Å»µû]5O®šªJ}ø@/Sä":MÄ ¥ÜIpÎ-'- WÌ»/MNÎŸaŒ@,µtí ¿ÛøÎxÒ]ªK'Eh2»ëô¬EØÍìÁjìñK³Ô g£JGÌüž«b]aÕ6ì·»m>Ë¡Ér"HA)ãÔ®r"Dë$\4Áìwš"0ØëQ%DœÐgëZÏ]\×¹IŽ¶l#@0â èÜ;£_àº,÷íèjA=UéOÆ0üôÈÖAg!Y6 ô*s!YTÉŒ¿é©J^íxàÝN}ý+Š°L%Rmü?â/[ìs$ßÃÿeZ((ôjdÓ±x*EB;2SšDåêìÄXyÈÍÏ3ké/ÒysáÎZªf²žÍ~º£±}EÐ*)K]b8NU¢f1<080N0:10 UUS10U IdenTrust10UTrustID CA A14@žáê<zÌ>BO0 `He ¿0 *H÷ 1 *H÷ 0 *H÷ 1 240925115531Z0/ *H÷ 1" ~ÏPï(çCÈmÄÓZŠÑ°ÎÛfÚ`<Ü@Ôº;0] +71P0N0:10 UUS10U IdenTrust10UTrustID CA A14@žáê<zÌ>BO0_*H÷ 1P N0:10 UUS10U IdenTrust10UTrustID CA A14@žáê<zÌ>BO0 *H÷ 100 `He*0 `He0 *H÷ 0 `He0*H÷ 0 *H÷ @0 `He0 `He0 `He0+0 *H÷ aAÿ}ÓaÌžÁíG*¿å·S2" 2`h_ÊÊiÙ$Ò?ìDYGÚ)ãGo8wñn L³`b¯¬®Ê!Ÿy¡ïÖÞSH7Tq.eÛGÈéoñâÕ€Q,üráÏqtþÙ¶${@;çÈ=Q7~Ô6ËSy-¹ŽŒódœÂá<n{c\Ê¢:gÅ£Æ¹£ÂÂWÑ°%ë7IÉãòŒíñSž·Båçö»E£ÖÇÔÀè£ButäÇZª}ãPT©°$Øúûš)QB Öõþ&O·_ú(îøæ)5à©

1 0

Transparency Performance Indicators Overview
by Mark Lizar 20 Sep '24

20 Sep '24

Hi Everyone, In terms of defining ANCR WG relationship to the work being proposed I have drafted this, thus far, does this work for everyone? - Mark *** The ANCR WG would participate in providing comments on the Notice Receipt for standard transparency assurance, in addition to using it to publish Transparency Performance Indicators, which use the controller record, notice receipt or log to provide a conformant measure of how operational the performance of transparency is for the Individual. The objective of ANCR'd TPI work at Kantara is to further the transparency of surveillance and privacy beyond just an inclusive transparency record. The TPI work aims to enable controller to provide dynamic data controls, to act as a gateway for personal data and reduce, even eliminate the need for a PII Principals to share raw data with any third party, dramatically reducing risks and data breaches, making personal data operational with privacy rights controls, while reducing the requirement for personal data, to be surveilled, protected and stored by every Data Controller, at great risk to the individual. TPI’s along with the Notice Receipt standard address the well know challenge of personal data being un-governed in commercial data silo’s, unable to be used by the individual. Notice receipts and their logs make any profile and it’s processing transparent to the appropriate governing authority, wether that be the police or the individual, and is used to govern surveillance capitalism, surveillance by default and secret surveillance. TPI’s for example can measure if consent is valid, or secure, They can then also be used for signalling transparency and identity assurance scheme’s, to govern, secure the use age surveillance assurance technologies and generative AI. TPI’s have been contributed through the Kantara liaison and included in 27566 security and privacy of digital twins, and as a use case for 29170 security and privacy of generative AI, early 2024.

1 0

Age Assurance Teen Safety
by Salvatore D'Agostino 17 Sep '24

17 Sep '24

https://www.nytimes.com/2024/09/17/technology/instagram-teens-safety-privac… Get Outlook for iOS<https://aka.ms/o0ukef>

1 0

Work Items - D
by Mark Lizar 11 Sep '24

11 Sep '24

WRT putting the spec forward, seems the options (roughly stated and dynmic) 1) put it forward via mirror committee to Jan and Harsh / 27560, ask if they would like to work with this Notice Receipt Standard for Transparency,, or if we should put if forward a New Work Item Proposal (NWIP) with the request that it is open and free to access once published, (if this is possible) - this address 50% of the challenge - The immediate Action is to put a comment in right away, with an outline /overveiw of the CR 2 spec as it is specified for record, receipt and log compliance, and usable for a) every legal justification as a proof of notice, b) self-identification c) secondary purpose of consent d) as interoperable open standard, to control personal data. The advanced stuff, - all data controller's can become PII gateways, and act as relying parties with the use of receipt, which is how it works with digital identity management, 1b) propose to collaborate with Data Gov Council - making a corresponding Canadian National Version. Invite all the interested/overlapping groups, W3C DPV, IEEE Digital Privacy, DIACC, OIX into a DGSI led process - This brings together the capacities to work with the international community efforts. Note: the original call to action in 2012, was for standards industry to work together on this.. Perhaps, the same call to action would be more timely now? https://www.w3.org/2012/dnt-ws/position-papers/23.pdf

1 0

Re: Next Steps - Notice and Consent Receipt v2,
by Mark Lizar 06 Sep '24

06 Sep '24

Dear WG, There has been some good forward movement on resolving long outstanding issues in advancing the work from the ANCR WG. Below I explain why I would like to propose that we take our v2 notice and consent receipt work to Data Governance Standards Institute (DGSI), a Canadian national standards body, as soon as possible. For those of you who don’t know, there are some known challenges to progress the notice and consent receipt work. In summary: * Originally called the MVCR [Minimum Viable Consent Receipt], it was taken too soon to ISO and named 27560 Consent record information structure, without the CISWG’s knowledge * At ISO, it was politicised and diluted by numerous national inputs until it was unable to address the core issues of notice and consent * Consent requires open and standard transparency; its strength, integrity and viability depend on it. This is why the MVCR is a notice receipt, that anyone can use to consent with, Consent is essentially based on a notice record information structure, which is what ISO/IEC 29184 is focused on, as well as some very specific laws,. able to be used autonomously to demonstrate consent * It was specified to the ISO/IEC 29100 security and privacy framework which was open, but its latest update is not * It was specified for ISO/IEC 291284 Online Privacy notice and consent standard, (see Appendix D 29184). This standard is not open (exclusive), so not operational as a international transparency and identity governance standard * Finally, 27560 the consent record information structure makes a fundamental error by confusing consent (managed by humans) with permission (managed by services) * Whats more, continuing this work via Kantara has a dis-advantage, As Kantara is not a national standard body, making a Special Interest Group, for Authc with members from national stakeholder a non viable path. For these reasons and more, the ANCR WG has always been viewed as a place to incubate standards for industry and regulatory use. This is why we have worked on a companion TP-Scheme that uses this specification to demonstrate conformance and compliance. The idea being that we, the ANCR WG, work on the scheme, and support its use and extension for a Kantara programme, or one that Kantara collaborates with. The ANCR WG demo, in collaboration with a specification at DGS is what is ultimately being proposed here as the immediate path forward DGSI are now recognised, accredited to make national and international standards, and have a direct route to ISO/IEC. Even more importantly, DGSI have an arrangement with ISO because their standards are open, the standards put forward to ISO will also be free and open to access. This provides us with a clear path for our v2 Notice and Consent specification to ISO, with national regulatory input, at no cost. To this end, the next plenary for ISO is coming up at the end of this month and comment is needed next week (w/c 9 September). I suggest we put forward to the 27560 that we have a proposed v2 to be developed in collaboration with DGSI, and that we have a TPS at Kantara, to assess validity of consent, Suggesting We move the TP-Scheme forward in this context - and from this context work on the AuthC SiG. Please comment and respond before next weeks meeting (Wed 12th of September) - Mark

3 8