- Wg-pemc - mailman.kantarainitiative.org

SVIP Presentation
by Salvatore D'Agostino 24 Aug '23

24 Aug '23

IDmachines 1264 Beacon Street, #5 Brookline, MA 02446 +1 617.201.4809 @idmachines https://idmachines.com Please note I have a new email certificate, please update the public key you use for encrypted messages to me. It is part of this (S/MIME) email. Disclaimer The information contained in this communication from the sender is confidential. It is intended solely for use by the recipient and others authorized to receive it. If you are not the recipient, you are hereby notified that any disclosure, copying, distribution or taking action in relation of the contents of this information is strictly prohibited and may be unlawful. If you have received this email in error, please delete it and advise the sender.

1 1

Agenda for today’s call
by John Wunderlich 23 Aug '23

23 Aug '23

Good morning; I’m still working my way through the comments on the Draft Implementors Report. The main goal of today’s call is to start considering requirements. Please take look at the Requirements Coverage page: https://kantara.atlassian.net/wiki/spaces/PEMCP/pages/240025664/Requirement…. You will notice that we are missing requirements in a number of areas, so today’s session will be a brainstorming session to discuss the missing requirements. Starting next week we will resume reviewing the candidate requirements - starting with reviewing the process we have come up with to write, review, revise, and select requirements. Today’s agenda is here: https://kantara.atlassian.net/wiki/spaces/PEMCP/pages/246644737/2023-08-23+… Sincerely, John Wunderlich BA, MBA, CISA, CIPP/C, CIPM, FIP LinkedIn: https://www.linkedin.com/in/privacycdn/ Twitter: https://twitter.com/PrivacyCDN -- This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. This message contains confidential information and is intended only for the individual named. If you are not the named addressee you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately by e-mail if you have received this e-mail by mistake and delete this e-mail from your system. If you are not the intended recipient you are notified that disclosing, copying, distributing or taking any action in reliance on the contents of this information is strictly prohibited.

1 0

Cancelling today’s call
by John Wunderlich 16 Aug '23

16 Aug '23

I was hoping to have the final consolidated draft implementors report ready for final review and voting today, but the work has been delayed. Apologies for the late notice. Sincerely, John Wunderlich BA, MBA, CISA, CIPP/C, CIPM, FIP LinkedIn: https://www.linkedin.com/in/privacycdn/ Twitter: https://twitter.com/PrivacyCDN -- This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. This message contains confidential information and is intended only for the individual named. If you are not the named addressee you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately by e-mail if you have received this e-mail by mistake and delete this e-mail from your system. If you are not the intended recipient you are notified that disclosing, copying, distributing or taking any action in reliance on the contents of this information is strictly prohibited.

1 0

privacy problem with blue tooth
by Tom Jones 16 Aug '23

16 Aug '23

Somehow the requirements need to address the problems with device-device connections. Does that need a separate set of codes? Here are some of the issues reported, but others relate to information leakage prior to the consent screen, which seems to be the case with a proposed standard from the OIDF. I believe it would apply to the details of 13018-5 as well. In summary - the interchange at the network level before the data interchange is initiated. https://www.foxnews.com/tech/detect-creeps-unwanted-bluetooth-tracker-googl… ..tom

1 0

FW: July 20 NIST NCCoE Mobile Driver’s License COI Meeting
by Salvatore D'Agostino 14 Jul '23

14 Jul '23

In case u don't subscribe, best Sal From: Finke, Jeffrey (Ctr) <jeffery.finke(a)nist.gov> Sent: Friday, July 14, 2023 9:31 AM Subject: July 20 NIST NCCoE Mobile Driver's License COI Meeting Hello mDL Community of Interest! Following the publication of our final project description in June, the National Cybersecurity Center of Excellence (NCCoE) will be releasing a Federal Register Notice (FRN), a formal call for project collaborators. In light of this event, we will host the following community of interest (COI) meeting to discuss the project and answer questions you may have about the FRN process. Please join the project team on Thursday, July 20 from 10:00-10:30 a.m. ET to: * Meet the NCCoE Digital Identities - Mobile Driver's License (mDL) team. * Receive a briefing on the background of this NCCoE project. * Learn how to participate and respond with a Letter of Intent (LoI) via an FRN to be published by the NCCoE shortly. * Engage in a question-and-answer period with the project team. We look forward to seeing you on the 20th. Call-in details are listed below. For your convenience, an iCalendar file has been attached. If you are unable to attend the COI meeting on July 20, another invite will be sent out shortly for the same meeting on another date. Respectfully, The NCCoE Digital Identities mDL Team --- Microsoft Teams meeting Join on your computer, mobile app or room device <https://teams.microsoft.com/l/meetup-join/19%3ameeting_YjI5ZGM2ZjYtOWZlOS00 ZTUyLTk3ODUtNmY2MDkxNjA0NTgx%40thread.v2/0?context=%7b%22Tid%22%3a%222ab5d82 f-d8fa-4797-a93e-054655c61dec%22%2c%22Oid%22%3a%22cfcf194a-39b1-4ca3-95ac-1f 29ba086f54%22%7d> Click here to join the meeting Meeting ID: 212 143 178 963 Passcode: cUZBdt <https://www.microsoft.com/en-us/microsoft-teams/download-app> Download Teams | <https://www.microsoft.com/microsoft-teams/join-a-meeting> Join on the web Join with a video conferencing device 101340915(a)teams-us.bjn.vc <mailto:101340915@teams-us.bjn.vc> Video Conference ID: 114 815 237 8 <https://dialin.bluejeans.com/teams?key=101340915&conf=1148152378&domain=tea ms-us.bjn.vc> Alternate VTC instructions <https://aka.ms/JoinTeamsMeeting> Learn More | <https://teams.microsoft.com/meetingOptions/?organizerId=cfcf194a-39b1-4ca3- 95ac-1f29ba086f54&tenantId=2ab5d82f-d8fa-4797-a93e-054655c61dec&threadId=19_ meeting_YjI5ZGM2ZjYtOWZlOS00ZTUyLTk3ODUtNmY2MDkxNjA0NTgx(a)thread.v2&messageId =0&language=en-US> Meeting options

1 0

How EU’s plan to digitising travel documents might affect you - European Digital Rights (EDRi)
by John Wunderlich 13 Jul '23

13 Jul '23

https://edri.org/our-work/how-eus-plan-to-digitising-travel-documents-might… Sincerely, John Wunderlich BA, MBA, CISA, CIPP/C, CIPM, FIP LinkedIn: https://www.linkedin.com/in/privacycdn/ Twitter: https://twitter.com/PrivacyCDN -- This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. This message contains confidential information and is intended only for the individual named. If you are not the named addressee you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately by e-mail if you have received this e-mail by mistake and delete this e-mail from your system. If you are not the intended recipient you are notified that disclosing, copying, distributing or taking any action in reliance on the contents of this information is strictly prohibited.

1 0

use of biometrics
by Tom Jones 13 Jul '23

13 Jul '23

TSA's biometric tests are getting attention, but it seems like the questions being asked are wrong. There has been biometric testing of all airline travelers since 9/11. The question is where is biometric data collected and retained. It seems that public cameras are becoming ubiquitous and the storage duration varies widely. Given this, what is there really to control now? A senator had trouble saying no to TSA's voluntary facial recogntion - The Washington Post <https://www.washingtonpost.com/technology/2023/07/11/tsa-airport-security-f…> ..tom

2 1

Implementor’s report
by John Wunderlich 12 Jul '23

12 Jul '23

Hello; We are (finally) at the stage of moving the Implementor’s report forward. In other words, I’m urging you to make your final comments in this version of the report by Friday. I will finalize all the comments and put that in a Word document that I will post in our Confluence for a few days for any final comments from members of the WG. That document will then be submitted as a draft report for us to vote on. Once we approve the draft it will go to the Leadership Council which may make recommendations after which the report can be approved and finalized on a simple majority of the Leadership Council. For information on the Kantara Document Development process see: https://kantara.atlassian.net/wiki/spaces/GI/pages/1089207/WG+DG+Document+D… Sincerely, John Wunderlich BA, MBA, CISA, CIPP/C, CIPM, FIP LinkedIn: https://www.linkedin.com/in/privacycdn/ Twitter: https://twitter.com/PrivacyCDN -- This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. This message contains confidential information and is intended only for the individual named. If you are not the named addressee you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately by e-mail if you have received this e-mail by mistake and delete this e-mail from your system. If you are not the intended recipient you are notified that disclosing, copying, distributing or taking any action in reliance on the contents of this information is strictly prohibited.

2 1

user privacy experience levels
by Tom Jones 06 Jul '23

06 Jul '23

Based on my last discussion on availability of data & metadata to user i added a section on level of experience complexity and other details. See if this is helpful. https://tcwiki.azurewebsites.net/index.php?title=Mobile_Privacy_Experience#… The wallet must accommodate both holder experience and legal requirements. These are often incompatible and judgement is needed. The following levels are conceptual and are based on the deviation from the norm similar to a normal distribution, so one could be considered (very roughly) within one standard deviation and so on. 1. Common case the user gets one screen that contains the purpose, a user understandable identity of the verifier (and other data controllers or providers) and the proposed summary data to be released. A user gesture is required to release the data. 2. The wallet or user decides that more information is required to be evaluated than the one screen can provide 3. The holder wants to see the full data (and metadata) that is to be released to the verifier. 4. The holder wants (or is forced) to view the terms and conditions of the issuer or verifier. 5. The holder needs to change the wallet (device/app) configuration setting to allow the data access requested. ..tom

2 2