- Wg-ancr - mailman.kantarainitiative.org

Reminder - 0PN -ANCR - Call Today
by Mark Lizar 15 May '24

15 May '24

Hi All, A reminder that we are staring the 0PN-ANCR call today (every second wed) using the same call details, Mark Lizar Executive Director. 0PN; Digital Transparency Lab * Toronto +1 -289 - 501 -3597 * London +44 208 -123 2476

1 0

ANCR Roadmap and Assurance Program WG proposal
by Mark Lizar 01 May '24

01 May '24

HI ANCR WG, On today’s call we proposed that every second Wed meeting now be focused on the development of the ANCR Scheme and its use for a Kantara International Registrar Assurance Program. With the scope to have an initial set of meetings, aka CG, which would then propose the larger program (ideally for consideration in September). Here is a link to the workgroup proposal, drafted by Sal and I posted here for comment and review, <https://kantara.atlassian.net/wiki/x/FAAXGw> PII Controller Conformance Assessment: ANCR WG Development - WG - ANCR - Kantara Initiative<https://kantara.atlassian.net/wiki/x/FAAXGw> kantara.atlassian.net<https://kantara.atlassian.net/wiki/x/FAAXGw> [favicon-update.ico]<https://kantara.atlassian.net/wiki/x/FAAXGw> Next week, we will discuss this for consensus, and vote, which means we will cover comments and the results of their review if necessary, before a vote (if we are quorate), next Wed meeting, This proposes a transition of working group structures and mandates intended to accelerate the awareness and adoption of digital transparency (for privacy and consent) using ANCR standards for distributing and decentralising authority and governance online. Looking forward to your feedback Kind Regards, Mark Lizar Executive Director President Digital Transparency Lab and 0PN Digital Commons * Toronto +1 -289 - 501 -3597 * London +44 208 -123 2476

1 0

slide from Monthly LC call today
by Salvatore D'Agostino 16 Apr '24

16 Apr '24

IDmachines 4 Lamson Place Cambridge, MA 02139-2612 +1 617.201.4809 @idmachines https://idmachines.com <https://idmachines.com/> Please note our new address. Email, phones, other contacts remain the same. Disclaimer The information contained in this communication from the sender is confidential. It is intended solely for use by the recipient and others authorized to receive it. If you are not the recipient, you are hereby notified that any disclosure, copying, distribution or taking action in relation of the contents of this information is strictly prohibited and may be unlawful. If you have received this email in error, please delete it and advise the sender.

1 0

ANCR WG Use Case Contribution to ISO/IEC 27910 - Security and Privacy in GenAI - Expert Ad-Hoc Committee
by Mark Lizar 11 Apr '24

11 Apr '24

Hi ANCR, Please find attached the ANCR Use Case Contribution for Security, Privacy and Ethics in GenAI, from the proposed ANCR WG Digital Privacy Transparency, conformance and compliance scheme. Best, Mark

1 0

BEPP
by Salvatore D'Agostino 29 Mar '24

29 Mar '24

Attached is the first pass that we captured during the call today with regards to ANCR work and its relevance to the Board nano-visions effort that Eve Maler led. The first 3 slides were the original from Eve Slide 4 has the input from today. The goal is to have this done by the end of next week. Best, Sal IDmachines 4 Lamson Place Cambridge, MA 02139-2612 +1 617.201.4809 @idmachines https://idmachines.com <https://idmachines.com/> Please note our new address. Email, phones, other contacts remain the same. Disclaimer The information contained in this communication from the sender is confidential. It is intended solely for use by the recipient and others authorized to receive it. If you are not the recipient, you are hereby notified that any disclosure, copying, distribution or taking action in relation of the contents of this information is strictly prohibited and may be unlawful. If you have received this email in error, please delete it and advise the sender.

3 2

wallet article
by Salvatore D'Agostino 14 Mar '24

14 Mar '24

https://www.nytimes.com/2024/03/06/technology/personaltech/mobile-wallet-app .html?unlocked_article_code=1.c00.YvFS.4nDpED27n-GP <https://www.nytimes.com/2024/03/06/technology/personaltech/mobile-wallet-ap p.html?unlocked_article_code=1.c00.YvFS.4nDpED27n-GP&smid=url-share> &smid=url-share IDmachines 4 Lamson Place Cambridge, MA 02139-2612 +1 617.201.4809 @idmachines https://idmachines.com <https://idmachines.com/> Please note our new address. Email, phones, other contacts remain the same. Disclaimer The information contained in this communication from the sender is confidential. It is intended solely for use by the recipient and others authorized to receive it. If you are not the recipient, you are hereby notified that any disclosure, copying, distribution or taking action in relation of the contents of this information is strictly prohibited and may be unlawful. If you have received this email in error, please delete it and advise the sender.

1 0

Age Assurance - New Benchmark Proposal
by MarkL 14 Mar '24

14 Mar '24

Hi All, With regards to age assurance there is a proposal going forward. Which looks a lot like the type of proposal we would need to contribute to or develop from ANCR with the DPT-TPS. I will see if I can find a draft of it, and see how we might contribute. In addition, the OpenID Connect (input attached) provides a good example of what a Consent Token spec structure might look like, for interoperability. - Mark Executive Director Digital Transparency Lab & 0PN Trust Framework

1 0

Age Assurance Update
by MarkL 14 Mar '24

14 Mar '24

Hi All, Here is the latest on Age Assurance ever. Noticing a lot of inputs from OpenID, but most notably. ANCR - TPS is listed. - Mark

1 0

Fwd: [projectvrm] Identity in India - Payments
by Salvatore D'Agostino 12 Mar '24

12 Mar '24

Get Outlook for iOS<https://aka.ms/o0ukef> ________________________________ From: Adrian Gropper <agropper(a)healthurl.com> Sent: Tuesday, March 12, 2024 3:40:38 AM To: ProjectVRM list <projectvrm(a)eon.law.harvard.edu>; technical-discuss(a)lists.openwallet.foundation <technical-discuss(a)lists.openwallet.foundation> Subject: [projectvrm] Identity in India - Payments This is my second post now based on three weeks of travel in India. The first was mostly about identity in the sense of (state) security. This one is about commerce and is cross-posted to OWF and VRM. As a foreigner, paying for things in India before and during the trip has been a constant problem. In two cases, it was impossible because the largest cell service provider, AirTel, and a government-run hotel network, MTDC, are both “cashless” but could not accept any US credit card in practice. The preferred payment processor in India is the UPI standard but that requires both a gov-run biometric Aadhaar identity as well as an Indian bank account. As far as I can tell, neither is accessible to a foreigner. This is how identity comes into payments. I don’t know the details of UPI but I saw it in action when a native friend purchased something from a typical small vendor. The overwhelming majority of vendors ranging from AirTel to pushcart vendors display a QR code that a customer can scan with their UPI app. The salesperson then uses their smartphone app to scan a QR code on the customer’s smartphone. The transaction is confirmed in seconds and the purchase complete. The identity questions are: - Why bother with the card displaying the QR code instead of just having the salesperson display a QR code from their phone? and, - Why can’t I use my BTC and ETH wallet and skip UPI in a clearly decentralized transaction? As best I can tell, the issue is more likely taxation and fraud rather than KYC. (I suspect money laundering is a separate issue when large transfers can be done via tumblers already.) In the Open Wallet and VRM context, Web3 and central bank digital currency seem clearer to me now. What’s needed is a way to prevent the vendor from evading taxes and the salesperson from pocketing the digital cash. It’s not obvious to me how either VCs or DIDs fit into this picture. Adrian

1 0

ANCR-Assurance Program Discussion
by MarkL 06 Mar '24

06 Mar '24

Hi All, In the ANCR WG meeting we discussed making this a regular call to work on the ANCR Assurance Program & Committee. Expect some spider-diagrams in the near future. We look at how a Kantara ANCR Assurance Program could enable the certification of Registrars, running controller credential and receipt notary services. The aim is to have something presented prior to the April 12 Meeting in Manchester on Age Assurance, where we will be presenting the consent receipt - Transparency Performance Scheme and the 0PN-Digital Privacy Program for the Age Assurance industry. If you are interested, the next call on this topic will be in two weeks, Best, Mark

2 2

21970 - use case TPS for Gen AI
by MarkL 06 Mar '24

06 Mar '24

Hello, I submitted this, with what little time I could scrape, I think is more representative of latest, simplified consent record and receipt semantic and its application from an ANCR perspective., There is a specific format that they are requested - with various use case formats to be provided,. *also attached, If anyone wants t work on this with us, next week, at the same time we can work on it. (In the off week) Mark

1 2

Reminder off Week Call today - Notary Authentication Assurance
by MarkL 07 Feb '24

07 Feb '24

Hi ANCR, Reminder we are having an off week call today and discussing: 1. generic cyber-notary authentication scheme, 2. Notary Assurance Levels 3. A too small to fail service implementation for the cyber-notary Best, - Mark

1 1

COMMENTS FOR 0- ISO/IEC - Age Assurance Standard WD 27566-1 and Benchmarking 27566-2
by MarkL 30 Jan '24

30 Jan '24

Hi ANCR, Just to let you know that we looking to progress comments for Age Assurance Benchmarking27566-2 from ANCR, which would coincide with My Comments from SCC/Canada on 27566-1. (Both attached) The standard inputs should be retrievable via the BOT-Liaison WG, if you want to take a closer look, In addition, 0PN Digital Transparency Lab will be looking to host a WHiSSPRR - Fireside on Age Assurance on February 23rd or March 1st, depending on availability, inviting Tony Allen the lead for 27566 (BSI) + equivalent in Brazil, up against some Canadian regulation on Age Assurance Bill 210, with DIACC Joni and Sharon from PACC also being invited, Stay tuned for more information, Best, Mark

1 0

Fwd: CALL FOR SUBMISSIONS: International Conference on AI and the Digital Economy, CADE 2024
by MarkL 30 Jan '24

30 Jan '24

FYI - Begin forwarded message: From: Angelika Kerlin <akerlin(a)turing.ac.uk> Subject: CALL FOR SUBMISSIONS: International Conference on AI and the Digital Economy, CADE 2024 Date: 30 January 2024 at 09:22:42 GMT-5 To: Trustworthy Digital Identity Interest Group <digitalidentityIG(a)turing.ac.uk> Dear all, This year marks a significant milestone for the International Conference on AI and the Digital Economy (CADE), as they celebrate their 10th anniversary. Over the past decade, CADE has been a great place for researchers, especially those in the early stages of their careers, to share their work, discuss ideas, and make professional connections. This year's programme will again take place in Venice, Italy, in a blended format, allowing participants to attend physically or virtually on 24-26 June 2024. We are getting in touch to let you know that this year’s call for submissions is now open with a deadline of the 3rd of March 2024. The themes cover AI in Health, AI in Finance, Digital Public Infrastructure, Smart Mobility, and Sustainability. You can submit an extended abstract (2 pages) or a full paper (6 pages). The conference proceedings will be published on IET and IEEE Xplore. More information can be found in the attachment, as well as on their website<https://warwick.ac.uk/fac/sci/wmg/news-and-events/events/wmgevents/cade2024/>. Your participation would be very welcome. Please feel free to circulate to others within your network, who may also be interested. With best wishes, Angelika Publications from the previous conferences can be accessed via the following links: CADE 2021<https://ieeexplore.ieee.org/xpl/conhome/9650934/proceeding> / CADE 2022<https://ieeexplore.ieee.org/xpl/conhome/9945911/proceeding> / CADE 2023<https://ieeexplore.ieee.org/xpl/conhome/10324414/proceeding> _____________________________ Angelika Kerlin Research Project Manager Finance & Economics Programme akerlin(a)turing.ac.uk<mailto:akerlin@turing.ac.uk> +44 203 8623 374 _____________________________ The Alan Turing Institute turing.ac.uk<http://www.turing.ac.uk/> Registered Charity 1162533 || Company Registration 09512457 || VAT no 270 0609 32 The Alan Turing Institute is a limited liability company, registered in England with registered number 09512457. Our registered office is at British Library, 96 Euston Road, London, England, NW1 2DB. We are also a charity registered in England with charity number 1162533. This email and any attachments are confidential and may be legally privileged. If you have received it in error, you are on notice of its status. If you have received this message in error, please send it back to us, and immediately and permanently delete it. Do not use, copy or disclose the information contained in this message or in any attachment. DISCLAIMER: Although The Alan Turing Institute has taken reasonable precautions to ensure no viruses are present in this email, The Alan Turing Institute cannot accept responsibility for any loss or damage sustained as a result of computer viruses and the recipient must ensure that the email (and attachments) are virus free. While we take care to protect our systems from virus attacks and other harmful events, we give no warranty that this message (including attachments) is free of any virus or other harmful matter, and we accept no responsibility for any loss or damage resulting from the recipient receiving, opening or using it. E-mail transmission cannot be guaranteed to be secure or error-free as information could be intercepted, corrupted, lost, destroyed, arrive late or be incomplete. If you think someone may have interfered with this email, please contact the Alan Turing Institute by telephone only and speak to the person dealing with your matter or the Accounts Department. Fraudsters are increasingly targeting organisations and their affiliates, often requesting funds to be transferred to a different bank account. The Alan Turing’s bank details are contained within our terms of engagement. If you receive a suspicious or unexpected email from us, or purporting to have been sent on our behalf, particularly containing different bank details, please do not reply to the email, click on any links, open any attachments, nor comply with any instructions contained within it, but contact our Accounts department by telephone. Our Transparency Notice found here - https://www.turing.ac.uk/transparency-notice sets out how and why we collect, store, use and share your personal data and it explains your rights and how to raise concerns with us. You're receiving this message because you're a member of the Trustworthy Digital Identity Interest Group group from The Alan Turing Institute. To take part in this conversation, reply all to this message. View group files<https://outlook.office365.com/owa/digitalidentityIG@turing.ac.uk/groupsubsc…> | Leave group<https://outlook.office365.com/owa/digitalidentityIG@turing.ac.uk/groupsubsc…> | Learn more about Microsoft 365 Groups<https://aka.ms/o365g>

1 0

Re: Jan 24 AdHoc Call - ANCR Use Case Call for 27091: Security & Privacy in AI
by MarkL 24 Jan '24

24 Jan '24

Hi Sharon, Thanks for point that out, I didn’;r make it clear, this review is for a review of the use cases out there, so that use experts can provide security and privacy use cases. So you are spot on.with your response. - Mark On 22 Jan 2024, at 13:44, ccbw(a)duck.com wrote: Thanks for including the use cases. I’ve reviewed a few and am concerned that some — which speak to tracking individuals and their preferences — do not list any "threats & vulnerabilities” much less any privacy risks to the individual. Without fulsome consideration and disclosure of the privacy and human rights risks that individuals will face from the AIs, the status quo is further endorsed and entrenched. My 2c. Sharon Polsky DPO BIS MAPP • President — Privacy and Access Council of Canada<http://pacc-ccap.ca/> • Vice-Chair, Digital Governance Council Technical Committee <https://dgc-cgn.org/standards/> for Privacy & Access Control Standards<https://dgc-cgn.org/standards/> • Vice-Chair, Digital Governance Council Technical Committee<https://dgc-cgn.org/standards/> for Canadian Information Privacy Protection Framework<https://dgc-cgn.org/standards/> • PbD — Privacy By Design Ambassador<http://web.archive.org/web/20121012080217/http:/privacybydesign.ca/ambassad…> On Jan 22, 2024, at 6:07 AM, MarkL <mark_at_0pn.org_ccbw(a)duck.com> wrote: Hi All, As mentioned on the last call, this coming Wed we will have a call working on submitting use case via the Kantara ISO liaison to expert ad-hoc committee, for security and privacy in AI. In the Hi All, As mentioned on the last call, this coming Wed we will have a call working on submitting use case via the Kantara ISO liaison to expert ad-hoc committee, for security and privacy in AI. In the last ISO-Ad-Hoc for 27091 (held last week) there was a review of 132 and 187 AI use cases were reviewed for relevance to security and privacy, (See attached summary) WG5 experts have invited us to provide our ANCR privacy and security AI use case and it’s an opportunity to apply ANCR work. This brings up a number of items if we were to participate via ANCR, 1, administrative liaison 2. Use case development Attached is a use case info and template/pdf. Best, Mark <ISO-IEC JTC 1-SC 27-WG 5_27091 meeting 240117 Contribution existing use cases.pdf><ISO-IEC JTC 1-SC 27-WG 5_27091 meeting 240117 Contribution study methodology.pdf>_______________________________________________ A Community Group mailing list of KantaraInitiative.org Wg-ancr mailing list -- wg-ancr(a)kantarainitiative.org To unsubscribe send an email to staff(a)kantarainitiative.org List archives -- https://mailman.kantarainitiative.org/hyperkitty/list/wg-ancr@kantarainitia… ______ Group wiki -- https://kantara.atlassian.net/wiki/spaces/Wg-ancr

2 2

FYI - BiT Supplement
by MarkL 23 Jan '24

23 Jan '24

HI All, Paul has submitted a concrete list of what data is considered ultra-sensitive and Blinding Identity Taxonomy is a practice to mitigate clear text use of identifiers in this attached draft supplement. FYI The supplement is currently in the review phase with the Kantara Leadership Council and will be openly discussed in their next meeting on Feb 20 Best, Mark

1 0

ISO Liaison
by Salvatore D'Agostino 23 Jan '24

23 Jan '24

Hi WG, I wanted to remind folks that in order to access ISO drafts you need to go through this page. https://kantara.atlassian.net/wiki/spaces/lsc/overview?homepageId=4456453 Thanks, Sal

1 0

Re: Jan 24 AdHoc Call - ANCR Use Case Call for 27091: Security & Privacy in AI
by ccbw＠duck.com 22 Jan '24

22 Jan '24

Thanks for including the use cases. I’ve reviewed a few and am concerned that some — which speak to tracking individuals and their preferences — do not list any "threats & vulnerabilities” much less any privacy risks to the individual. Without fulsome consideration and disclosure of the privacy and human rights risks that individuals will face from the AIs, the status quo is further endorsed and entrenched. My 2c. Sharon Polsky DPO BIS MAPP • President — Privacy and Access Council of Canada <http://pacc-ccap.ca/> • Vice-Chair, Digital Governance Council Technical Committee <https://dgc-cgn.org/standards/> for Privacy & Access Control Standards <https://dgc-cgn.org/standards/> • Vice-Chair, Digital Governance Council Technical Committee <https://dgc-cgn.org/standards/> for Canadian Information Privacy Protection Framework <https://dgc-cgn.org/standards/> • PbD — Privacy By Design Ambassador <http://web.archive.org/web/20121012080217/http:/privacybydesign.ca/ambassad…> On Jan 22, 2024, at 6:07 AM, MarkL <mark_at_0pn.org_ccbw(a)duck.com> wrote: DuckDuckGo did not detect any trackers. More <https://duckduckgo.com/-AfbRryfaswqENWPS6jOkjZauDmjumUSaympnaaOznAEt2SBlID5…> Report Spam <https://duckduckgo.com/-AfbRryfaswqENWPS6jOkjZauDmjumUSaympnaaOznAEt2SBlID5…> Hi All, As mentioned on the last call, this coming Wed we will have a call working on submitting use case via the Kantara ISO liaison to expert ad-hoc committee, for security and privacy in AI. In the last ISO-Ad-Hoc for 27091 (held last week) there was a review of 132 and 187 AI use cases were reviewed for relevance to security and privacy, (See attached summary) WG5 experts have invited us to provide our ANCR privacy and security AI use case and it’s an opportunity to apply ANCR work. This brings up a number of items if we were to participate via ANCR, 1, administrative liaison 2. Use case development Attached is a use case info and template/pdf. Best, Mark <ISO-IEC JTC 1-SC 27-WG 5_27091 meeting 240117 Contribution existing use cases.pdf><ISO-IEC JTC 1-SC 27-WG 5_27091 meeting 240117 Contribution study methodology.pdf>_______________________________________________ A Community Group mailing list of KantaraInitiative.org Wg-ancr mailing list -- wg-ancr(a)kantarainitiative.org To unsubscribe send an email to staff(a)kantarainitiative.org List archives -- https://mailman.kantarainitiative.org/hyperkitty/list/wg-ancr@kantarainitia… ______ Group wiki -- https://kantara.atlassian.net/wiki/spaces/Wg-ancr

1 0

Jan 24 AdHoc Call - ANCR Use Case Call for 27091: Security & Privacy in AI
by MarkL 22 Jan '24

22 Jan '24

Hi All, As mentioned on the last call, this coming Wed we will have a call working on submitting use case via the Kantara ISO liaison to expert ad-hoc committee, for security and privacy in AI. In the last ISO-Ad-Hoc for 27091 (held last week) there was a review of 132 and 187 AI use cases were reviewed for relevance to security and privacy, (See attached summary) WG5 experts have invited us to provide our ANCR privacy and security AI use case and it’s an opportunity to apply ANCR work. This brings up a number of items if we were to participate via ANCR, 1, administrative liaison 2. Use case development Attached is a use case info and template/pdf. Best, Mark

1 0

Re: Call Agenda
by MarkL 17 Jan '24

17 Jan '24

Hi FYI - I might be couple min late, Mark In terms of TPS we need to discuss scope , PS - Here is some clip/edits on that from me. For reference, NOTICE This specification relies on (open access to) ISO/IEC 29100 Security and privacy techniques, to generate a notice receipt, which is stored in an ANCR consent record format for conformity assessment as specified in the Kantara Initiative Consent Receipt v1.1<https://kantarainitiative.org/download/7902/>.[1]<applewebdata://161B40AB-D6EE-456B-97E0-5D8BD5DB02DE#_ftn1> Conditions for use License Condition: This specification is for creating an ISO/IEC 29100 conformant record which is then used for assessing compliance with legal instruments and ISO/IEC standards 29100 security and privacy framework and 29184 Online privacy notice and consent. The compliance scheme international baseline is focused on digital transparency and consent adequacy performance. The ISO/IEC 29100 standard is compatible and interopeble with the international Council of Europe 108+, and GDPR Section 1 Transparency and modalities, as there are mirrored in these instruments ________________________________ [1]<applewebdata://161B40AB-D6EE-456B-97E0-5D8BD5DB02DE#_ftnref1> Consent receipt v1, CISWG Kantara Initiative https://kantarainitiative.org/download/7902/ 1 TERMS & DEFINITIONS Normative to 29100 and 29184 compliance and conformance assement nativel. In the TPS scheme, a 29100 conformant record is generated, then applied to measure the operational performance, which can then be compared against international baseline, or national baseline., , for Compliance it can be applied against any privacy regulation for a standard compliance rule set, and conformity assessment framework. Council of Europe, Convention 108+, The normative language for the TPI Scheme is defined by ISO/IEC 29100 which extends the 27002 security standard framework. The ANCR Record Framework is used to specify Transparency Performance Indicators (TPIs) and has evolved from the Kantara Minimum Viable Consent Receipt Specification in Kantara since 2013. \ On 17 Jan 2024, at 09:40, Salvatore D'Agostino <sal(a)idmachines.com> wrote: Hi ANCR Leadership, We have a call at noon. Suggested agenda 1. Roll 2. IPR 3. Agenda Approval 4. TPS review 5. TPS Scheme profile 6. Controller Credential and AuthZ roadmap 7. NIST and other comments 8. Other activity

1 0

Call reminder
by Salvatore D'Agostino 17 Jan '24

17 Jan '24

Hi ANCR WG, We have a call at noon. Suggested agenda 1. Roll 2. IPR 3. Agenda Approval 4. TPS review 5. TPS Scheme profile 6. Controller Credential and AuthZ roadmap 7. NIST and other comments 8. Other activity https://us06web.zoom.us/j/87282263538?pwd=K0RwY1g1b3pKeHdBcXpjeExVZUFpQT09

1 0

Fwd: [KI-LC] Fwd: Feedback
by Salvatore D'Agostino 17 Jan '24

17 Jan '24

IDmachines 4 Lamson Place Cambridge, MA 02139-2612 +1 617.201.4809 https://IDmachines.com ________________________________ From: Kay Chopard via LC <lc(a)kantarainitiative.org> Sent: Wednesday, January 17, 2024 11:07:04 AM To: Kantara Board of Directors <directors(a)kantarainitiative.org>; Kantara Leadership Council <LC(a)kantarainitiative.org> Cc: staff(a)kantarainitiative.org list <staff(a)kantarainitiative.org> Subject: [KI-LC] Fwd: Feedback Hello everyone, I hope you are well. A second Request for Information has been posted regarding the CSP Special Item Number (SIN) that GSA is planning to create and post. They have asked for comments. Please share this with others. Also, please take the time, if you can, or someone in your organization is able, to respond to the request for feedback. Please let me know if you have any questions. We have hopes that this will be a very big plus for Kantara once it is published. Thank you for your assistance. Kind regards, Kay Kay Chopard | Executive Director [https://docs.google.com/uc?export=download&id=1f_FyEBepOKYcAfkyIsaSFzguA7Tg…] Twitter: @KantaraNews LinkedIn: @KantaraInitiative ---------- Forwarded message --------- From: India Donald - QT3BC <india.donald(a)gsa.gov<mailto:india.donald@gsa.gov>> Date: Wed, Jan 17, 2024 at 7:54 AM Subject: Feedback To: Kay Chopard <kay(a)kantarainitiative.org<mailto:kay@kantarainitiative.org>>, Lynzie Adams <lynzie(a)kantarainitiative.org<mailto:lynzie@kantarainitiative.org>> Hello, A second Request for Information (RFI) has been posted for the Credential Service Provider (CSP) Special Item Number (SIN). https://feedback.gsa.gov/jfe/form/SV_3BHE1iQQLHsgtCe Please pass on. Thanks India

1 0

EU - US Mapping
by Salvatore D'Agostino 17 Jan '24

17 Jan '24

https://www.nist.gov/identity-access-management/eu-us-ttc-wg-1-digital-iden… EU-US TTC WG-1 Digital Identity Mapping Exercise Report<https://www.nist.gov/identity-access-management/eu-us-ttc-wg-1-digital-iden…> Save the Dates! www.nist.gov

1 0

Fw: Request for Comment & IPR Review: PCTF Authentication Final Recommendation V1.1 / Demande de commentaires et d’examen des droits de propriété intellectuelle : Recommandation finale pour la composante « Authentification » V1.1 du CCP
by Salvatore D'Agostino 16 Jan '24

16 Jan '24

fyi ________________________________ From: review(a)diacc.ca <review(a)diacc.ca> Sent: Tuesday, January 16, 2024 9:16 AM To: Salvatore D'Agostino <sal(a)idmachines.com> Subject: Request for Comment & IPR Review: PCTF Authentication Final Recommendation V1.1 / Demande de commentaires et d’examen des droits de propriété intellectuelle : Recommandation finale pour la composante « Authentification » V1.1 du CCP Français à suivre Notice of Intent: DIACC is collaborating to develop and publish the Authentication component of the Pan-Canadian Trust Framework (PCTF) to set a baseline of public and private sector interoperability of identity services and solutions. During this public review period, DIACC is looking for community feedback to ensure that the conformance criteria is clear and auditable. To learn more about the Pan-Canadian vision and benefits-for-all value proposition please review the Pan-Canadian Trust Framework Overview<https://diacc-dot-yamm-track.appspot.com/28zd0TGbiQXtMGiyCf0-eBSKmMAaDA7Pap…>. Document Status: These review documents have been developed by members of the DIACC’s Trust Framework Expert Committee<https://diacc-dot-yamm-track.appspot.com/2JVjj0zymk3OgdDAlfKJ2df4-8B1J0E6aq…> (TFEC) who operate under the DIACC controlling policies and consist of representatives from both the private and public sectors. These documents have been approved by the TFEC as Draft Recommendations V1.0. Summary: The PCTF Authentication Component defines: 1. A set of processes that enable access to digital systems. 2. A set of Conformance Criteria for each process that, when a process is shown to be compliant, enable the process to be trusted. Invitation: • All interested parties are invited to comment. Period: • Opens: January 16, 2024 at 23:59 PT | Closes: February 15, 2024 at 23:59 PT When reviewing the components Conformance Criteria, please consider the following and note that responses to this question are non-binding and serve to improve the PCTF. 1. Would you consider the Conformance Criteria as auditable or not? That is, could you objectively evaluate if an organization was compliant with that criteria and what evidence would be used to justify that? Review Documents: Authentication • Conformance Profile Final Recommendation V1.1<https://diacc-dot-yamm-track.appspot.com/2M8Z3V12SLp8MUG3QHMqeh-FebLTFCXSh2…> • Component Overview Final Recommendation V1.1<https://diacc-dot-yamm-track.appspot.com/2_UrwuzjJv36fkGGUpRMBqldzknvg447mi…> • DIACC Comment Submission Spreadsheet<https://diacc-dot-yamm-track.appspot.com/2zzrG69USxQDWkhLFlf-SlkUz3mc27Q4ZJ…> Intellectual Property Rights: Comments must be received within the 30-day comment period noted above. All comments are subject to the DIACC contributor agreement<https://diacc-dot-yamm-track.appspot.com/2wUO4oqQbPYiwiD7TeT3zluSDz2BPmB3wZ…>; by submitting a comment you agree to be bound by the terms and conditions therein. DIACC Members are also subject to the Intellectual Property Rights Policy<https://diacc-dot-yamm-track.appspot.com/2sXAQWdjzzJN-O9kkyv4ht3zlG_JuCX9zg…>. Any notice of an intent not to license under either the Contributor Agreement and/or the Intellectual Property Rights Policy with respect to the review documents or any comments must be made at the Contributor’s and/or Member’s earliest opportunity, and in any event, within the 30-day comment period. IPR claims may be sent to review(a)diacc.ca<mailto:review@diacc.ca>. Please include “IPR Claim” as the subject. Process: • All comments are subject to the DIACC contributor agreement.<https://diacc-dot-yamm-track.appspot.com/2xPVELHmtVpGVq7KPHbf-yykBn453MTDA1…> • Submit comments using the provided DIACC Comment Submission Spreadsheet<https://diacc-dot-yamm-track.appspot.com/2BCNYzUMyQo19ji6dHLiHF5mhKNKM8hQpb…>. • Reference the draft and corresponding line number for each comment submitted. • Email completed DIACC Comment Submission Spreadsheet to review(a)diacc.ca<mailto:review@diacc.ca>. • Questions may be sent to review(a)diacc.ca<mailto:review@diacc.ca>. Value to Canadians: The purpose of the PCTF Authentication Component is to assure the on-going integrity of login and authentication processes by certifying, through a process of assessment, that they comply with standardized Conformance Criteria. The Conformance Criteria for this component may be used to provide assurances: • That Trusted Processes result in the representation of a unique Subject at a Level of Assurance that it is the same Subject with each successful login to an Authentication Service Provider. • Concerning the predictability and continuity in the login processes that they offer or on which they depend. All participants will benefit from: • Login and authentication processes that are repeatable and consistent (whether they offer these processes, depend on them, or both). • Assurance that identified Users can engage in authorized interactions with remote systems. Relying Parties benefit from: • The ability to build on the assurance that Authentication Trusted Processes uniquely identify, at an acceptable level of risk, a Subject in their application or program space. Context: The purpose of this review is to ensure transparency in the development and diversity of a truly Pan-Canadian, and international, input. In alignment with our Principles for an Identity Ecosystem<https://diacc-dot-yamm-track.appspot.com/2ksQhMCqNZdn6rnZ9QzKU29MFfDmfnXdTS…>, processes to respect and enhance privacy are being prioritized through every step of the PCTF development process. DIACC expects to modify and improve these Draft Recommendations based upon public comments. Comments made during the review will be considered for incorporation into the next iteration and DIACC will prepare a Disposition of Comments to provide transparency with regard to how each comment was handled. Demande de commentaires et d’examen des droits de propriété intellectuelle : Recommandation finale pour la composante « Authentification » V1.1 du CCP Déclaration d’intention : Le CCIAN collabore pour développer et publier la composante « Authentification » du Cadre de confiance pancanadien (CCP) afin d’établir une base d’interopérabilité des services et solutions d’identité dans les secteurs public et privé. Pendant cette période d’examen public, le CCIAN cherche à obtenir la rétroaction de la communauté afin de s’assurer que les critères de conformité sont clairs et vérifiables. Pour en savoir plus sur la vision pancanadienne et la proposition de valeur présentant des avantages pour tous, veuillez passer en revue l’aperçu du Cadre de confiance pancanadien<https://diacc-dot-yamm-track.appspot.com/27MmefMLXId_ALqTYKoxYoZzoCqfqY2v25…>. État des documents : Ces documents à examiner ont été développés par les membres du Comité d’experts du Cadre de confiance<https://diacc-dot-yamm-track.appspot.com/2N0Yr90YBrPviuqPy36nxrqZtVh_lGxCwm…> (TFEC) du CCIAN, qui sont régis par les politiques qui contrôlent le CCIAN et comprennent des représentants des secteurs privé et public. Ces documents ont été approuvés par le TFEC en tant que recommandations préliminaires V1.0. Résumé La composante « Authentification » du CCP définit : 1. Un ensemble de processus donnant accès à des systèmes numériques. 2. Un ensemble de critères de conformité pour chaque processus qui, lorsqu’un processus s’avère conforme, permettent de faire confiance au processus. Invitation • Toutes les parties intéressées sont invitées à faire des commentaires. Période • Début : 16 janvier 2024 à 23 h 59 HP | Fin : 15 février 2024 à 23 h 59 HP En examinant les critères de conformité de la composante, veuillez tenir compte de la question qui suit et noter que les réponses ne sont pas contraignantes et visent à améliorer le CCP. 1. Considéreriez-vous que les critères de conformité sont vérifiables ou non? Autrement dit, pourriez-vous évaluer objectivement si une organisation était conforme à ces critères et quelles preuves seraient utilisées pour justifier cela? Documents à examiner : Authentification • Recommandation finale pour le profil de conformité V1.1<https://diacc-dot-yamm-track.appspot.com/2ctYL1VKYGuy6_IFd-oB8J6Q7hC9ZzyO7D…> • Recommandation finale pour l’aperçu de la composante V1.1<https://diacc-dot-yamm-track.appspot.com/2sXJn5gCX1gdfN1siuDcak3ymelufC6wAj…> • Formulaire pour soumettre les commentaires au CCIAN<https://diacc-dot-yamm-track.appspot.com/2Gy7LT9i7f3j200ngGQpekpUhfVCmvFfwc…> Droits de propriété intellectuelle Les commentaires doivent être reçus pendant la période de 30 jours indiquée ci-dessus. Tous les commentaires sont assujettis à l’entente de contributeur du CCIAN<https://diacc-dot-yamm-track.appspot.com/2Lw9MP8jccVK9cCLDyCEqLHOwQa1X9yjVh…>; en soumettant un commentaire, vous acceptez d’être lié par les conditions qu’elle renferme. Les membres du CCIAN sont également assujettis à la politique sur les droits de propriété intellectuelle<https://diacc-dot-yamm-track.appspot.com/2HwME7dSShmy58bj59XfaupLZJkKjicW0I…>. Tout avis d’intention de ne pas octroyer une licence en vertu de l’entente de contributeur et/ou de la politique sur les droits de propriété intellectuelle relativement aux documents à examiner ou à des commentaires doit être donné dès que le contributeur et/ou le membre en ont la possibilité, et en toute circonstance, pendant la période de commentaires de 30 jours. Les revendications au titre des droits de propriété intellectuelle peuvent être adressées à review(a)diacc.ca<mailto:review@diacc.ca>. Veuillez indiquer « Revendication en matière de propriété intellectuelle » dans l’objet. Processus • Tous les commentaires sont assujettis à l’entente de contributeur du CCIAN.<https://diacc-dot-yamm-track.appspot.com/2kl7ImnTN3w4K_6XsCd3-TGi_hl2w0prNp…> • Veuillez utiliser le formulaire prévu à cet effet pour soumettre vos commentaires au CCIAN<https://diacc-dot-yamm-track.appspot.com/2z-tuDYuVY1IjHZdJ6rStPmg0BczQ0CZ3i…>. • Assurez-vous d’indiquer le numéro de version et de ligne correspondant à chaque commentaire soumis. • Le formulaire de soumission de commentaires au CCIAN doit être envoyé par courriel, dûment rempli, à review(a)diacc.ca<mailto:review@diacc.ca>. • Questions : review(a)diacc.ca<mailto:review@diacc.ca>. Valeur pour les Canadiens La composante « Authentification » du CCP vise à assurer l’intégrité continue des processus de connexion et d’authentification en certifiant, au moyen d’un processus d’évaluation, qu’ils sont conformes aux critères de conformité uniformisés. Les critères de conformité pour cette composante peuvent être utilisés pour fournir des assurances : • Comme quoi les processus de confiance donnent la représentation d’un sujet unique à un niveau assurant qu’il s’agit du même sujet à chaque connexion réussie auprès d’un fournisseur de services d’authentification. • En ce qui concerne la prévisibilité et la continuité des processus de connexion qu’ils offrent ou dont ils dépendent. Tous les participants bénéficieront de : • Processus de connexion et d’authentification qui sont répétitifs et uniformes (qu’ils offrent ces processus, dépendent d’eux ou les deux). • L’assurance que les utilisateurs identifiés peuvent prendre part à des interactions autorisées avec des systèmes à distance. Les parties dépendantes bénéficieront de : • La capacité de tirer parti de l’assurance comme quoi les processus de confiance de l’authentification identifient d’une manière unique, à un niveau de risque acceptable, un sujet dans la sphère de leur application ou programme. Contexte Cet examen a pour but d’assurer la transparence de l’élaboration et de la diversité d’un apport véritablement pancanadien et international. Conformément à nos principes pour un écosystème de l’identité<https://diacc-dot-yamm-track.appspot.com/2UMztnwll9w8ucFCqy6LOFfMh82fYc8j7u…>, la priorité est accordée aux processus visant à respecter et à renforcer la vie privée à chaque étape du processus de développement du Cadre de confiance pancanadien. Le CCIAN s’attend à modifier et à améliorer ces recommandations finales en fonction des commentaires du public. Les commentaires faits pendant l’examen seront pris en compte pour être intégrés dans la prochaine itération et le CCIAN préparera un document expliquant d’une façon transparente comment chaque commentaire a été traité.

2 1

Fw: Call for Comments - EU-U.S. TTC WG1 Digital Identity Mapping Exercise Report Now Open for Feedback and Webinar Save the Date
by Salvatore D'Agostino 06 Jan '24

06 Jan '24

Thanks Mark. ________________________________ From: Mark Lizar <mark(a)openconsent.com> Sent: Saturday, January 6, 2024 8:26 AM To: Salvatore D'Agostino <sal(a)idmachines.com> Subject: Fwd: Call for Comments - EU-U.S. TTC WG1 Digital Identity Mapping Exercise Report Now Open for Feedback and Webinar Save the Date FYI Begin forwarded message: From: The Trade and Technology Dialogue <info(a)tradeandtechdialogue.com> Subject: Call for Comments - EU-U.S. TTC WG1 Digital Identity Mapping Exercise Report Now Open for Feedback and Webinar Save the Date Date: 5 January 2024 at 10:16:03 GMT-5 To: info(a)0pn.org [cid:200811b2-999b-45bf-b807-42d4028fdd6c@namprd14.prod.outlook.com] Call for Comments / Save the Date TRADE AND TECHNOLOGY COUNCIL (TTC) EU-U.S. TTC WG1 Digital Identity Mapping Exercise Report now open for feedback and webinar Save the Date Dear Mark, Following a successful round of government-to-government technical exchanges earlier this calendar year, in March 2023, the European Commission and the U.S. Government, operating under the auspices of the US-EU Trade and Technology Council (TTC), publicly committed to undertake a transatlantic mapping exercise with the objective of finding commonalities between the EU and U.S. approaches to digital identity. Released on December 22, the jointly authored EU-US TTC Digital Identity Mapping Exercise Report<https://futurium.ec.europa.eu/en/EU-US-TTC/news/eu-us-ttc-digital-identity-…>, provides the preliminary results of an initial mapping centered on the definitions, assurance levels, and references to international standards included across Revision 3 of the NIST Digital Identity Guidelines (Special Publication 800-63, Revision 3<https://pages.nist.gov/800-63-3/sp800-63-3.html>) and European Regulation (EU) No 910/2014<https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=uriserv:OJ.L_.2014.257.…> on electronic identification and trust services for electronic transactions in the internal market. The next phase of this project will include collecting feedback and selecting potential use cases for transatlantic cooperation that highlight the need for and value of enabling the cross-border use of digital identities. The European Commission and the U.S. are actively seeking comments from communities with subject matter expertise in digital identity, privacy, human-centered design, and cybersecurity; organisations that have designed or implemented digital identity systems within the EU, the U.S., or in cross-border contexts; and others with equities related to the topic of digital identity. Call for Comments Feedback on the report, as well as use cases and areas of potential U.S.-EU cooperation on digital identity, is requested 5:59 AM CET on March 1, 2024 / 11:59 PM EST on February 29, 2024 and can be submitted via CNECT-H4(a)ec.europa.eu<mailto:CNECT-H4@ec.europa.eu> or dig-comments(a)nist.gov<mailto:dig-comments@nist.gov>. Save the Date EU-U.S. TTC Webinar: Unpacking the Digital Identity Mapping Results Date: Thursday, February 22, 2024 Location: Virtual Join the European Commission and NIST for a webinar to: - Hear an overview of the U.S. and EU's efforts to map their digital identity frameworks. - Provide feedback to NIST and the EC on the preliminary results of the mapping exercise. - Weigh in on use cases where future US-EU collaboration could accelerate progress on cross-border interoperability. Further information will follow in due course. We appreciate your feedback, participation, and interest in our efforts. To learn more about our publications, news, and get the latest updates, please visit Futurium<https://futurium.ec.europa.eu/en/EU-US-TTC>. ________________________________________________________________ Queries & Support  If you have any queries ahead of the event, please contact the event manager on the details below.  Andrea Evans  TTD Events & Outreach Manager info(a)tradeandtechdialogue.com<mailto:info@tradeandtechdialogue.com>  The TTD supports the EU-U.S. Trade and Technology Council with stakeholder activities and analysis. TTD activities are published on Futurium<https://futurium.ec.europa.eu/en/EU-US-TTC/pages/eu-us-trade-and-technology…>. Here, you can also find more information on all TTC Working Groups and make your voice heard by providing written input. For email updates with news, event invitations and research reports from the TTD, subscribe to the TTD Newsletter<https://ec.europa.eu/newsroom/ttd/user-subscriptions/2926/create>. [cid:563057ac-979d-4b5c-a63c-ccffe20c0304@namprd14.prod.outlook.com] C/o Forum Europe - EU Office: Square de Meeûs, 37 - 4th floor, 1000 Brussels, Belgium This email is confidential. If you are not the intended recipient do not copy or disclose its content and contact the sender immediately. This email message has been checked for the presence of known computer viruses, and has been found to be clean. The recipient should also check this email and any attachments for viruses. Forum Europe accepts no liability for any damage caused by any virus transmitted by this email.

1 0