- Wg-pemc - mailman.kantarainitiative.org

Apologies for the late cancellation
by John Wunderlich 29 Nov '23

29 Nov '23

Hello; Unfortunately, today’s call has to be cancelled. I will update you with respect to the publication of the Implementor’s report and moving forward on the guidance as soon as I have something concrete to report. My recovery is proceeding, and my ability to work is coming back, so I hope this delay won’t be extended. Apologies for any inconvenience. Have a better than expected day, John Wunderlich LinkedIn: https://www.linkedin.com/in/privacycdn/ Twitter: https://twitter.com/PrivacyCDN -- This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. This message contains confidential information and is intended only for the individual named. If you are not the named addressee you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately by e-mail if you have received this e-mail by mistake and delete this e-mail from your system. If you are not the intended recipient you are notified that disclosing, copying, distributing or taking any action in reliance on the contents of this information is strictly prohibited.

1 0

The Canadian Trust framework is not inclusive
by Tom Jones 23 Nov '23

23 Nov '23

The following is one example of standards that are not inclusive that need input of the sort we are trying to produce in Kantara. It subjects human holders of digital wallets to Trust Criteria that may well have the result of preventing human beings from accessing their rights and privileges. This is why I would like to see an early report on Inclusivity. "Digital Identity Ecosystems and their associated Trust Registries use a Trust Framework (such as the PCTF) to define how Issuers, Verifiers, Holders, and Digital Wallets should or must operate to be considered trustworthy." https://diacc.ca/trust-framework-components/pctf-trust-registries/ I requested a change and got the following responses: The Trust Framework defines the “how”, which may or may not include an entry in a Trust Registry. Holders belong on that list because they can be in a position to compromise the trustworthiness of an ecosystem. Additionally, a person may be the holder of credentials, a business may be a holder of credentials, an IoT thing may hold credentials, and the wallet may hold (be the holder) of credentials for a person or a business. In this context, a Holder is more than just a person. It's a person's decision whether they want to use a digital credential or not. Much like a person can choose to pay for an item with cash or use their biometrics on their smartphone to tap payment. A person's rights or privileges are not determined by this nor is it being insinuated nor is it being enforced on citizens. At the end of the day, it's the individual's decision and choice, which Canadians have and will continue to do so, how they want to interact with the digital ecosystem. Something that is not so evident in the countries you mentioned. [Russia and China] As we can see from the following example of a first nations grandfather seeking to set up a bank account for his daughter; underserved populations are AT RISK from thinking like the above. This is a good example of why technologists should not be permitted to define standards that impact normal people. They just have no clue! A Heiltsuk man, granddaughter handcuffed outside Vancouver bank settle human rights case against police. Vancouver: CBC. Retrieved from https://www.cbc.ca/news/canada/british-columbia/maxwell-johnson-granddaught… ..tom

1 0

The Face Is the Final Frontier of Privacy
by John Wunderlich 23 Nov '23

23 Nov '23

The burden should be on the verifier to ensure that the Holder can exercise their rights. Good quick read: https://time.com/collection/time100-voices/6338338/joy-buolamwini-ai-face-p… Have a better than expected day, John Wunderlich LinkedIn: https://www.linkedin.com/in/privacycdn/ Twitter: https://twitter.com/PrivacyCDN -- This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. This message contains confidential information and is intended only for the individual named. If you are not the named addressee you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately by e-mail if you have received this e-mail by mistake and delete this e-mail from your system. If you are not the intended recipient you are notified that disclosing, copying, distributing or taking any action in reliance on the contents of this information is strictly prohibited.

1 0

Reminder: No call today
by John Wunderlich 22 Nov '23

22 Nov '23

Happy American Thanksgiving. 🍗 Have a better than expected day, John Wunderlich LinkedIn: https://www.linkedin.com/in/privacycdn/ Twitter: https://twitter.com/PrivacyCDN -- This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. This message contains confidential information and is intended only for the individual named. If you are not the named addressee you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately by e-mail if you have received this e-mail by mistake and delete this e-mail from your system. If you are not the intended recipient you are notified that disclosing, copying, distributing or taking any action in reliance on the contents of this information is strictly prohibited.

1 0

Reminders & References for next actions
by John Wunderlich 08 Nov '23

08 Nov '23

Two reminders: 1. There is no meeting today, as we have moved to a bi-weekly cadence 2. Voting is underway for the draft implementors report (see my prior email with the attached draft). Please send your vote (Approve, Approve with comments/suggestions, Reject) to john(a)wunderlich.ca cc's to williams.2560(a)gmail.com, and Hannah.sutor(a)gmail.com References: Nov 1 Minutes: https://kantara.atlassian.net/wiki/spaces/PEMCP/pages/283410433/2023-11-01+… Nov 15 Agenda: https://kantara.atlassian.net/wiki/spaces/PEMCP/pages/283738113/2023-11-15+… PEMC Requirements Coverage Google Sheet for submitting requirements: https://docs.google.com/spreadsheets/d/1yJ1B9fAXMsj1IGiI2tsAihxXvXhj7VUM0xj… Have a better than expected day, John Wunderlich LinkedIn: https://www.linkedin.com/in/privacycdn/ Twitter: https://twitter.com/PrivacyCDN -- This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. This message contains confidential information and is intended only for the individual named. If you are not the named addressee you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately by e-mail if you have received this e-mail by mistake and delete this e-mail from your system. If you are not the intended recipient you are notified that disclosing, copying, distributing or taking any action in reliance on the contents of this information is strictly prohibited.

1 0

Privacy Advocates Raise Concerns with New Mobile Driver’s Licenses — Internet & Social Media Law Blog — October 23, 2023
by John Wunderlich 24 Oct '23

24 Oct '23

FYI https://www.internetandtechnologylaw.com/privacy-concerns-mobile-drivers-li… Sincerely, John Wunderlich BA, MBA, CISA, CIPP/C, CIPM, FIP LinkedIn: https://www.linkedin.com/in/privacycdn/ Twitter: https://twitter.com/PrivacyCDN -- This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. This message contains confidential information and is intended only for the individual named. If you are not the named addressee you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately by e-mail if you have received this e-mail by mistake and delete this e-mail from your system. If you are not the intended recipient you are notified that disclosing, copying, distributing or taking any action in reliance on the contents of this information is strictly prohibited.

1 0

Re: Spreadsheet shared with you: "PEMC Requirements Coverage"
by Tom Jones 22 Oct '23

22 Oct '23

It's interesting. But not practical. We need wallets to be accountable. Free and accountable does not compute. thx ..Tom (mobile) On Sat, Oct 21, 2023, 6:28 PM Salvatore D'Agostino <sal(a)idmachines.com> wrote: > Thanks Adrian, really like #5 > > IDmachines > 4 Lamson Place > Cambridge, MA 02139-2612 > +1 617.201.4809 > https://IDmachines.com > ------------------------------ > *From:* Adrian Gropper <agropper(a)gmail.com> > *Sent:* Saturday, October 21, 2023 4:21 PM > *To:* John Wunderlich <john(a)wunderlich.ca> > *Cc:* aglasscock(a)nascio.org <aglasscock(a)nascio.org>; > andrewhughes3000(a)gmail.com <andrewhughes3000(a)gmail.com>; > athomabaker(a)apple.com <athomabaker(a)apple.com>; chaudhury(a)google.com < > chaudhury(a)google.com>; gail.hodges(a)oidf.org <gail.hodges(a)oidf.org>; > hannah.sutor(a)gmail.com <hannah.sutor(a)gmail.com>; > hlf(a)sphericalcowconsulting.com <hlf(a)sphericalcowconsulting.com>; > jazzmine.dowtin(a)idemia-nss.com <jazzmine.dowtin(a)idemia-nss.com>; > jimpasquale(a)gmail.com <jimpasquale(a)gmail.com>; > lisa.levasseur(a)internetsafetylabs.org < > lisa.levasseur(a)internetsafetylabs.org>; ljordaan(a)aamva.org < > ljordaan(a)aamva.org>; maria.vachino(a)jhuapl.edu <maria.vachino(a)jhuapl.edu>; > maronson(a)notary.org <maronson(a)notary.org>; mcristinatl(a)outlook.es < > mcristinatl(a)outlook.es>; noreen.whysel(a)me2ba.org <noreen.whysel(a)me2ba.org>; > peter.davis(a)airsidemobile.com <peter.davis(a)airsidemobile.com>; Salvatore > D'Agostino <sal(a)idmachines.com>; thomasclinganjones(a)gmail.com < > thomasclinganjones(a)gmail.com>; tim(a)entrustient.com <tim(a)entrustient.com>; > vkrishnaraj(a)google.com <vkrishnaraj(a)google.com>; williams.2560(a)gmail.com < > williams.2560(a)gmail.com> > *Subject:* Re: Spreadsheet shared with you: "PEMC Requirements Coverage" > > It's an interesting list but I'm unclear about the scope of the charter > that supports it. Is there one? > > From where I stand, I would like to see some things clearly stated: > > 1 - The Holder SHOULD be a semi-autonomous and delegatable agent of the > subject. This would help to address the power asymmetry between Issuers and > Verifiers vs. subjects. > > 2 - Verifiers MUST scope and sign their verification requests. Scope MUST > include a purpose. The signature MUST be sufficient to keep the verifier > accountable if they breach their stated purpose of the request. > > 3 - The process of unwitnessed online verification must be clear. For > example, under what use-cases is the subject expected to use a user-agent > (mobile or hosted) that is "certified" or otherwise controlled by some > government or federated private entity. A *single-purpose* wallet > controlled by an Issuer or Verifier and not used for interaction outside of > that specific scope could, of course, be certified by either the Issuer or > Verifier. > > 4 - Protocols for presentation to the Verifier must consider the cost and > inconvenience of doing request verifications, making authorization > decisions, and keeping logs for Verifier accountability. Verifiers SHOULD > post a payment or deposit in order to prevent spam and offset these costs > borne by the subject. We cannot assume that subjects have a choice or that > verifiers always compete fairly for subject engagement. > > 5 - The essential components, including wallets, for use of > government-issued credentials MUST be free and accessible to all. We expect > that for paper credentials, don't we? > > Adrian > > On Mon, Oct 16, 2023 at 1:01 PM John Wunderlich (via Google Sheets) < > drive-shares-dm-noreply(a)google.com> wrote: > >> John Wunderlich shared a spreadsheet >> [image: Unknown profile photo] >> John Wunderlich (john(a)wunderlich.ca) has invited you to *edit* the >> following spreadsheet: >> As a participant in the PEMC workgroup, this link provides you editor >> access to the Google Sheet that we are using to gather requirements. It >> should be relatively self explanatory but feel free to reach out to me or >> to join the call this Wedndesay. >> >> John Wunderlich >> john(a)wunderlich.ca >> PEMC Requirements Coverage >> >> <https://docs.google.com/spreadsheets/d/1yJ1B9fAXMsj1IGiI2tsAihxXvXhj7VUM0xj…> >> >> Open >> <https://docs.google.com/spreadsheets/d/1yJ1B9fAXMsj1IGiI2tsAihxXvXhj7VUM0xj…> >> If you don't want to receive files from this person, block the sender >> <https://drive.google.com/drive/blockuser?blockerEmail=agropper@gmail.com&bl…> >> from Drive >> Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA >> You have received this email because john(a)wunderlich.ca shared a >> spreadsheet with you from Google Sheets. [image: Google] >> <https://workspace.google.com/> >> >> >> This email and any files transmitted with it are confidential and >> intended solely for the use of the individual or entity to whom they are >> addressed. If you have received this email in error please notify the >> system manager. This message contains confidential information and is >> intended only for the individual named. If you are not the named addressee >> you should not disseminate, distribute or copy this e-mail. Please notify >> the sender immediately by e-mail if you have received this e-mail by >> mistake and delete this e-mail from your system. If you are not the >> intended recipient you are notified that disclosing, copying, distributing >> or taking any action in reliance on the contents of this information is >> strictly prohibited. >> >

1 0

Update on PEMC work
by John Wunderlich 20 Oct '23

20 Oct '23

Hello; Christopher and I would like to provide an update on the PEMC work. 1. Christopher, Hannah, and I are working through the Implementor’s Guidance document and anticipate sharing a vote-ready version next week. This has been pushed back because of a medical issue that I experienced, but am working back from. Some critical points to remember when we circulate the draft for workgroup approval: a. I generally take the view that this kind of group work is ready to move forward when everyone is equally unhappy with the results (that’s one way to look at the results of consensus and compromise) b. This is not a normative report. It is preliminary guidance that roughly represents a consensus view of the group. c. I view this as V1 of the report and anticipate it will be updated after completing the first draft recommendations. 2. We are moving to a bi-weekly cadence for the PEMC calls to facilitate offline and asynchronous work. This is because the weekly meetings appear (to me) to have become the place where we discuss but do not quickly resolve the text that we are creating. We have created the Google Sheet shared with you to brainstorm and create the requirements YOU think should be included in the recommendations. The biweekly meetings will focus on issues that can not be resolved asynchronously or on votes on recommendations. More on the form and format of the published recommendations will be forthcoming once the workgroup feels it is closing in on a reasonably complete set of V1 recommendations. Next steps A: Workgroup vote on the Implementors report by email once. We anticipate getting the candidate draft out next week. B: Populate the requirements on Google Sheets. Getting your input as soon as possible is critical. I believe that the recommendations we are working on will be both unique and uniquely useful to stakeholders that want to be able to provide real assurances about their protection of personal data. This is your homework, and it is a brainstorming exercise, so the more, the better. Next Zoom Call: Wednesday, Nov. 1 at 1:00 PM Eastern. Sincerely, John Wunderlich BA, MBA, CISA, CIPP/C, CIPM, FIP LinkedIn: https://www.linkedin.com/in/privacycdn/ Twitter: https://twitter.com/PrivacyCDN -- This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. This message contains confidential information and is intended only for the individual named. If you are not the named addressee you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately by e-mail if you have received this e-mail by mistake and delete this e-mail from your system. If you are not the intended recipient you are notified that disclosing, copying, distributing or taking any action in reliance on the contents of this information is strictly prohibited.

1 0

FW: Register Now! NIST Personal Identity Verification Webinar
by Salvatore D'Agostino 19 Oct '23

19 Oct '23

Just received this. From: NIST Cybersecurity and Privacy Program <csrc.nist(a)service.govdelivery.com> Sent: Thursday, October 19, 2023 2:30 PM To: Salvatore D'Agostino <sal(a)idmachines.com> Subject: Register Now! NIST Personal Identity Verification Webinar Register Now! <https://content.govdelivery.com/attachments/fancy_images/USNIST/2019/04/248 7463/2805250/nist_crop.png> <https://lnks.gd/l/eyJhbGciOiJIUzI1NiJ9.eyJidWxsZXRpbl9saW5rX2lkIjoxMDAsInVy aSI6ImJwMjpjbGljayIsInVybCI6Imh0dHBzOi8vY29udGVudC5nb3ZkZWxpdmVyeS5jb20vYWNj b3VudHMvVVNOSVNUL2J1bGxldGlucy8zNzY0MmExIiwiYnVsbGV0aW5faWQiOiIyMDIzMTAxOS44 NDMyNTUzMSJ9.iGdqCjUnqBleb6eOa76GppVQURGiYY0jmUhu-w4HLIg/s/15856856/br/22862 0664378-l> View As Web Page <https://content.govdelivery.com/attachments/fancy_images/USNIST/2019/09/280 0392/cyber-header_original.png> NIST Cybersecurity and Privacy Program Register for our NIST Webinar! Learn about Revisions to Two of our Identity Special Publications Event Date: November 8, 2023 Time: 1:00 PM-2:30 PM ET Description: The National Institute of Standards and Technology (NIST) will be hosting a webinar to introduce two recently published Public Draft Special Publications (SPs): The 3-part <https://lnks.gd/l/eyJhbGciOiJIUzI1NiJ9.eyJidWxsZXRpbl9saW5rX2lkIjoxMDEsInVy aSI6ImJwMjpjbGljayIsInVybCI6Imh0dHBzOi8vY3NyYy5uaXN0Lmdvdi9wdWJzL3NwLzgwMC83 My9wdDEvNS9pcGQiLCJidWxsZXRpbl9pZCI6IjIwMjMxMDE5Ljg0MzI1NTMxIn0.seMJhhNw-U2c --Vv9Sz2tE2BOO-9LRMBHes-MrOuKRQ/s/15856856/br/228620664378-l> Drafts of SP 800-73 Revision 5, Interfaces for Personal Identity Verification (PIV) and <https://lnks.gd/l/eyJhbGciOiJIUzI1NiJ9.eyJidWxsZXRpbl9saW5rX2lkIjoxMDIsInVy aSI6ImJwMjpjbGljayIsInVybCI6Imh0dHBzOi8vY3NyYy5uaXN0Lmdvdi9wdWJzL3NwLzgwMC83 OC81L2lwZCIsImJ1bGxldGluX2lkIjoiMjAyMzEwMTkuODQzMjU1MzEifQ.SUXxWpKf0ol1P7YrP v2vA8r3mschS0E1dPXaRnyCskY/s/15856856/br/228620664378-l> Draft SP 800-78 Revision 5, Cryptographic Algorithms and Key Sizes for Personal Identity Verification. These publications are complements to FIPS 201-3, which defines the requirements and characteristics of government-wide interoperable identity credentials used by federal employees and contractors. The workshop will discuss the necessary changes made to the PIV card, its credentials, and cryptographic capability to align with FIPS 201-3. Full Agenda: 1:00 PM-1:05 PM - Introduction and Welcome 1:05 PM-1:15 PM - Introduction to the PIV Standard 1:15 PM-1:45 PM - Changes to Draft SP 800-73 Revision 5 1:45 PM-2:15 PM - Changes to Draft SP 800-78 Revision 5 2:15 PM-2:30 PM - Key Dates/Next Steps/Closing Visit the event page to register and learn more about the workshop. If you have any questions, please reach out to our team at <mailto:piv_comments@nist.gov> piv_comments(a)nist.gov. <https://lnks.gd/l/eyJhbGciOiJIUzI1NiJ9.eyJidWxsZXRpbl9saW5rX2lkIjoxMDMsInVy aSI6ImJwMjpjbGljayIsInVybCI6Imh0dHBzOi8vd3d3Lm5jY29lLm5pc3QuZ292L2dldC1pbnZv bHZlZC9hdHRlbmQtZXZlbnRzL3BlcnNvbmFsLWlkZW50aXR5LXZlcmlmaWNhdGlvbi13ZWJpbmFy IiwiYnVsbGV0aW5faWQiOiIyMDIzMTAxOS44NDMyNTUzMSJ9._nMm1VHJrw9Uhpqc62B_thJQagt qnBQ-JE8pRAVfzec/s/15856856/br/228620664378-l> Register Now NIST Cybersecurity and Privacy Program Questions/Comments about this notice: <mailto:piv_comments@nist.gov> piv_comments(a)nist.gov NCCoE Website questions: <mailto:nccoe@nist.gov> nccoe(a)nist.gov Connect with us <https://lnks.gd/l/eyJhbGciOiJIUzI1NiJ9.eyJidWxsZXRpbl9saW5rX2lkIjoxMDQsInVy aSI6ImJwMjpjbGljayIsInVybCI6Imh0dHBzOi8vd3d3LmZhY2Vib29rLmNvbS9OSVNUIiwiYnVs bGV0aW5faWQiOiIyMDIzMTAxOS44NDMyNTUzMSJ9.qaJ4eZw_SnEKtyv-qr55XroaE-Hqvb3hP7V 5DVDnOGU/s/15856856/br/228620664378-l> <https://lnks.gd/l/eyJhbGciOiJIUzI1NiJ9.eyJidWxsZXRpbl9saW5rX2lkIjoxMDUsInVy aSI6ImJwMjpjbGljayIsInVybCI6Imh0dHBzOi8vdHdpdHRlci5jb20vTklTVCIsImJ1bGxldGlu X2lkIjoiMjAyMzEwMTkuODQzMjU1MzEifQ.ankJWpMpZIcGzigZC360Vx7Oq-QZ83TTJKmyv2eHN tk/s/15856856/br/228620664378-l> <https://lnks.gd/l/eyJhbGciOiJIUzI1NiJ9.eyJidWxsZXRpbl9saW5rX2lkIjoxMDYsInVy aSI6ImJwMjpjbGljayIsInVybCI6Imh0dHBzOi8vd3d3LnlvdXR1YmUuY29tL05JU1QiLCJidWxs ZXRpbl9pZCI6IjIwMjMxMDE5Ljg0MzI1NTMxIn0.nDNbFKcS6tcIzUNkesJUykjc6vX7bJq4yMY2 FSe3dys/s/15856856/br/228620664378-l> <https://lnks.gd/l/eyJhbGciOiJIUzI1NiJ9.eyJidWxsZXRpbl9saW5rX2lkIjoxMDcsInVy aSI6ImJwMjpjbGljayIsInVybCI6Imh0dHBzOi8vd3d3LmxpbmtlZGluLmNvbS9jb21wYW55L25p c3QiLCJidWxsZXRpbl9pZCI6IjIwMjMxMDE5Ljg0MzI1NTMxIn0.rE5a_oupVR1rFt--KtDuUtqP pMCRn8vU5MtxnoVsVnY/s/15856856/br/228620664378-l> <https://lnks.gd/l/eyJhbGciOiJIUzI1NiJ9.eyJidWxsZXRpbl9saW5rX2lkIjoxMDgsInVy aSI6ImJwMjpjbGljayIsInVybCI6Imh0dHBzOi8vd3d3Lmluc3RhZ3JhbS5jb20vbmlzdC8iLCJi dWxsZXRpbl9pZCI6IjIwMjMxMDE5Ljg0MzI1NTMxIn0.jYA7j9lArNiOjucwTovtAzLCs091I4eT YZoYeRjJZYU/s/15856856/br/228620664378-l> Received this email from a friend? <https://lnks.gd/l/eyJhbGciOiJIUzI1NiJ9.eyJidWxsZXRpbl9saW5rX2lkIjoxMDksInVy aSI6ImJwMjpjbGljayIsInVybCI6Imh0dHBzOi8vcHVibGljLmdvdmRlbGl2ZXJ5LmNvbS9hY2Nv dW50cy9VU05JU1Qvc3Vic2NyaWJlci9uZXc_dG9waWNfaWQ9VVNOSVNUXzEiLCJidWxsZXRpbl9p ZCI6IjIwMjMxMDE5Ljg0MzI1NTMxIn0.DDxB_yWmqHL8BemJUuc9p7Prs3p8-I3wXTqDMc0CUq4/ s/15856856/br/228620664378-l> Subscribe here. <https://lnks.gd/l/eyJhbGciOiJIUzI1NiJ9.eyJidWxsZXRpbl9saW5rX2lkIjoxMTAsInVy aSI6ImJwMjpjbGljayIsInVybCI6Imh0dHBzOi8vd3d3Lm5pc3QuZ292L2l0bCIsImJ1bGxldGlu X2lkIjoiMjAyMzEwMTkuODQzMjU1MzEifQ.8EaTVnyEWPKfBR5gBfqoSIouIMxubKpOGsse6sr5P Iw/s/15856856/br/228620664378-l> Subscriber services: <https://lnks.gd/l/eyJhbGciOiJIUzI1NiJ9.eyJidWxsZXRpbl9saW5rX2lkIjoxMTEsInVy aSI6ImJwMjpjbGljayIsInVybCI6Imh0dHBzOi8vcHVibGljLmdvdmRlbGl2ZXJ5LmNvbS9hY2Nv dW50cy9VU05JU1Qvc3Vic2NyaWJlci9lZGl0P3ByZWZlcmVuY2VzPXRydWUjdGFiMSIsImJ1bGxl dGluX2lkIjoiMjAyMzEwMTkuODQzMjU1MzEifQ.I96vs7GTxOcGZK11UTrj535SrnJNZm-F8uRj1 xmAwYk/s/15856856/br/228620664378-l> Manage Preferences | <https://lnks.gd/l/eyJhbGciOiJIUzI1NiJ9.eyJidWxsZXRpbl9saW5rX2lkIjoxMTIsInVy aSI6ImJwMjpjbGljayIsInVybCI6Imh0dHBzOi8vcHVibGljLmdvdmRlbGl2ZXJ5LmNvbS9hY2Nv dW50cy9VU05JU1Qvc3Vic2NyaWJlci9lZGl0P3ByZWZlcmVuY2VzPXRydWUjdGFiMSIsImJ1bGxl dGluX2lkIjoiMjAyMzEwMTkuODQzMjU1MzEifQ.S0MWx6TLC2NjpNDAW6jRfTjnM7ZxsC5W7H81e xyP5_U/s/15856856/br/228620664378-l> Unsubscribe | <https://lnks.gd/l/eyJhbGciOiJIUzI1NiJ9.eyJidWxsZXRpbl9saW5rX2lkIjoxMTMsInVy aSI6ImJwMjpjbGljayIsInVybCI6Imh0dHBzOi8vc3Vic2NyaWJlcmhlbHAuZ292ZGVsaXZlcnku Y29tLyIsImJ1bGxldGluX2lkIjoiMjAyMzEwMTkuODQzMjU1MzEifQ.i0lA5WdBqz7ec4eNkP-VR fFZuI8iV-mo3cDomH11yCM/s/15856856/br/228620664378-l> Help _____ If you have questions or problems with the subscription service, please contact subscriberhelp.govdelivery.com <https://lnks.gd/l/eyJhbGciOiJIUzI1NiJ9.eyJidWxsZXRpbl9saW5rX2lkIjoxMTQsInVy aSI6ImJwMjpjbGljayIsInVybCI6Imh0dHBzOi8vc3Vic2NyaWJlcmhlbHAuZ292ZGVsaXZlcnku Y29tLyIsImJ1bGxldGluX2lkIjoiMjAyMzEwMTkuODQzMjU1MzEifQ.zaakIPw4S07-6Nkab9_CP zXLivQbPqGcOqOqCwS_sdo/s/15856856/br/228620664378-l> . Technical questions? Contact inquiries(a)nist.gov <mailto:inquiries@nist.gov> . (301) 975-NIST (6478). This service is provided to you at no charge by National Institute of Standards and Technology (NIST). 100 Bureau Drive, Stop 1070 . Gaithersburg, MD 20899 . 301-975-6478 <https://lnks.gd/l/eyJhbGciOiJIUzI1NiJ9.eyJidWxsZXRpbl9saW5rX2lkIjoxMTUsInVy aSI6ImJwMjpjbGljayIsInVybCI6Imh0dHBzOi8vc3Vic2NyaWJlcmhlbHAuZ3JhbmljdXMuY29t LyIsImJ1bGxldGluX2lkIjoiMjAyMzEwMTkuODQzMjU1MzEifQ.jgG9eFCvmWRqMFlaK1YLCgCSP _imR-4XIT2ZsBugI_Y/s/15856856/br/228620664378-l> <https://links.govdelivery.com/track?enid=ZWFzPTEmYnVsbGV0aW5yZWNpcGllbnRpZD 0yMjg2MjA2NjQzNzgtbCZzdWJzY3JpYmVyaWQ9MTU4NTY4NTYmbXNpZD0mYXVpZD0mbWFpbGluZ2 lkPTIwMjMxMDE5Ljg0MzI1NTMxJm1lc3NhZ2VpZD1NREItUFJELUJVTC0yMDIzMTAxOS44NDMyNT UzMSZkYXRhYmFzZWlkPTEwMDEmdHlwZT1vcGVuJnNlcmlhbD0xNjg2MjIwNCZlbWFpbGlkPXNhbE BpZG1hY2hpbmVzLmNvbSZ1c2VyaWQ9c2FsQGlkbWFjaGluZXMuY29tJnRhcmdldGlkPSZmbD0mbX ZpZD0mZXh0cmE9JiYm>

1 0

FYI from Papers, Please!
by John Wunderlich 17 Oct '23

17 Oct '23

Headline: The TSA wants to put a government tracking app on your smartphone https://papersplease.org/wp/2023/10/16/the-tsa-wants-to-put-a-government-tr… Sincerely, John Wunderlich BA, MBA, CISA, CIPP/C, CIPM, FIP LinkedIn: https://www.linkedin.com/in/privacycdn/ Twitter: https://twitter.com/PrivacyCDN -- This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. This message contains confidential information and is intended only for the individual named. If you are not the named addressee you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately by e-mail if you have received this e-mail by mistake and delete this e-mail from your system. If you are not the intended recipient you are notified that disclosing, copying, distributing or taking any action in reliance on the contents of this information is strictly prohibited.

1 0

Google Sheets for Requirments gathering
by John Wunderlich 16 Oct '23

16 Oct '23

Hi; Here is a commenter link to the Google Sheet called “PEMC Requirements Coverage”. https://docs.google.com/spreadsheets/d/1yJ1B9fAXMsj1IGiI2tsAihxXvXhj7VUM0xj… I’ll go through the participant page to add PEMC participants as editors, assuming I have the emails. Please advise if the email you want to use for editing and commenting is different than the one that is associated with you on the PEMC participants list, found here: https://kantara.atlassian.net/wiki/spaces/PEMCP/pages/2097688/Participant+r… Sincerely, John Wunderlich BA, MBA, CISA, CIPP/C, CIPM, FIP LinkedIn: https://www.linkedin.com/in/privacycdn/ Twitter: https://twitter.com/PrivacyCDN -- This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. This message contains confidential information and is intended only for the individual named. If you are not the named addressee you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately by e-mail if you have received this e-mail by mistake and delete this e-mail from your system. If you are not the intended recipient you are notified that disclosing, copying, distributing or taking any action in reliance on the contents of this information is strictly prohibited.

1 0

PEMC WG meeting cancelled this week
by Christopher Williams 25 Sep '23

25 Sep '23

Hello Everyone, As we discussed at the meeting last Wednesday we will be moving to biweekly meetings for the PEMC WG to give everyone more time to focus on offline editing of the Requirements and Implementer's Guide. I will follow up with more instructions on how to best access those documents soon. In the meantime have a great wednesday and I look forward to connecting at our next meeting on Oct. 4th. Best, Christopher

1 0

Fwd: Webinar host invited you to be panelist for My Webinar
by Salvatore D'Agostino 23 Sep '23

23 Sep '23

Here is the link to the hackathon today and tomorrow morning.. IDmachines 1264 Beacon Street, #5 Brookline, MA 02446 +1 617.201.4809 @idmachines ________________________________ From: Zoom <no-reply(a)zoom.us> Sent: Saturday, September 23, 2023 9:36:46 AM To: Salvatore D'Agostino <sal(a)idmachines.com> Subject: Webinar host invited you to be panelist for My Webinar [http://us02web.zoom.us/w_p/8WmmtMhDT_CD-p2DxWZNhw/8652212f-596f-4e8f-ba74-4…] Hi Salvatore D'Agostino, Webinar host invited you to be panelist for My Webinar. My Webinar Date & Time Sep 23, 2023 10:00 AM Montreal Webinar ID 861 2396 6915 Participant ID 605271 Passcode 0230506 Add to: [https://us02st3.zoom.us/static/6.3.15784/image/new/google.png] Google Calendar <https://us02web.zoom.us/webinar/tZIsdeqhqD0jG9GFXHHmcV_4ULsP9HSVpFpE/calend…> [https://us02st3.zoom.us/static/6.3.15784/image/new/outlook.png] Outlook Calendar(.ICS) <https://us02web.zoom.us/webinar/tZIsdeqhqD0jG9GFXHHmcV_4ULsP9HSVpFpE/ics?us…> [https://us02st3.zoom.us/static/6.3.15784/image/new/yahoo.png] Yahoo Calendar <https://us02web.zoom.us/webinar/tZIsdeqhqD0jG9GFXHHmcV_4ULsP9HSVpFpE/ics?us…> Please submit any questions to: sharon.polsky(a)aminacorp.ca Thank you! WAYS TO JOIN THIS WEBINAR * Join from PC, Mac, iPad, or Android Join Webinar <https://us02web.zoom.us/w/86123966915?tk=MVbL9-TlSZ6d33UL_Qbp-tJKpZcRtnu5uz…> If the button above does not work, paste this into your browser: https://us02web.zoom.us/w/86123966915?tk=MVbL9-TlSZ6d33UL_Qbp-tJKpZcRtnu5uz… To keep this webinar secure, do not share this link publicly. * Join via audio Canada: +12042727920,,86123966915#<tel:+12042727920,,86123966915#> or +14388097799,,86123966915#<tel:+14388097799,,86123966915#> Or, dial: Canada: +1 204 272 7920 or +1 438 809 7799 or +1 587 328 1099 or +1 613 209 3054 or +1 647 374 4685 or +1 647 558 0588 or +1 778 907 2071 US: +1 267 831 0333 or +1 301 715 8592 or +1 720 928 9299 or +1 206 337 9723 United Kingdom: +44 203 901 7895 More International numbers<https://us02web.zoom.us/u/keJ2aM36pw> Webinar ID: 861 2396 6915 Passcode: 0230506 [https://us02st3.zoom.us/static/6.3.15784/image/new/twitter.png] <https://twitter.com/zoom_us> [https://us02st3.zoom.us/static/6.3.15784/image/new/linkedin.png] <https://www.linkedin.com/company/zoom-video-communications/> [https://us02st3.zoom.us/static/6.3.15784/image/new/zoomblog.png] <https://blog.zoom.us/> +1.888.799.9666<tel:1-888-799-9666> Copyright ©2023 Zoom Video Communications, Inc. Visit Zoom.us<http://zoom.us> 55 Almaden Blvd San Jose, CA 95113<https://www.google.com/maps/place/55+Almaden+Blvd,+San+Jose,+CA+95113/@37.3…> [https://us02st3.zoom.us/static/6.3.15784/image/new/ZoomLogo3.png] <https://zoom.us>

1 0

9/13 PEMC WG meeting cancelled
by Christopher Williams 13 Sep '23

13 Sep '23

Hello Everyone, Due to conflicts and heads down work on the report we are going to cancel the WG meeting for tomorrow. As a reminder, next week on the 20th we will begin discussion of the new draft privacy requirements. Thanks, Christopher

2 1

Privacy Enhancing Requirements for Mobile Credentials
by Christopher Williams 11 Sep '23

11 Sep '23

Hello Everyone, I hope you all had an excellent weekend. As we look to the next phase in our project of developing a set of privacy requirements we are seeking input from everyone. John has set-up a google doc here: https://docs.google.com/spreadsheets/d/1yJ1B9fAXMsj1IGiI2tsAihxXvXhj7VUM0xj… We hope this will be helpful in collecting draft requirements. Please take a look at what is there and add ideas of your own that you would like to see in the requirements set. We are seeking all input at this stage of drafting, don't let perfect be the enemy of the good in content creation. You will only need to fill in the columns in yellow. We plan to have our initial discussion of the requirements on Sept. 20th at our usual meeting time. Please let me know if you have any questions. Best, Christopher

1 0

TSA may be backing off trust of state issued mDL
by Tom Jones 05 Sep '23

05 Sep '23

In Iowa and Utah the state mDL can only be used at the airport with PreCheck from Sal https://x.com/tsa/status/1696644402708377893?s=12 ..tom

2 2

TSA on acceptable creds
by Tom Jones 02 Sep '23

02 Sep '23

https://www.federalregister.gov/documents/2023/08/30/2023-18582/minimum-sta… thx ..Tom (mobile)

1 0

policy - a start
by Tom Jones 31 Aug '23

31 Aug '23

Policy - Policy here means digital representations of policy that apply to wallet - The wallet provider can create a default policy that the holder can modify - The holder can set conditions for what to display during consent process - The issuer can set policy that is a part of the credential - In that case the issuer can limit the wallets it provision with credentials to honor policy - The contract between the user and the verifier with request and consent - Could be considered to be a statement of policy that the verifier will honor ..tom

1 0

Policy can up in today's meeting
by Tom Jones 30 Aug '23

30 Aug '23

https://tcwiki.azurewebsites.net/index.php?title=Policy-Based_Access_Contro… This is the report i created over a year ago when i was working on it. ..tom

1 0

California has a shiny new app for its mDL
by Tom Jones 26 Aug '23

26 Aug '23

https://www.biometricupdate.com/202308/california-has-a-shiny-new-app-for-i… Looks like some states are doing it themselves. thx ..Tom (mobile)

1 0

SVIP Presentation
by Salvatore D'Agostino 24 Aug '23

24 Aug '23

IDmachines 1264 Beacon Street, #5 Brookline, MA 02446 +1 617.201.4809 @idmachines https://idmachines.com Please note I have a new email certificate, please update the public key you use for encrypted messages to me. It is part of this (S/MIME) email. Disclaimer The information contained in this communication from the sender is confidential. It is intended solely for use by the recipient and others authorized to receive it. If you are not the recipient, you are hereby notified that any disclosure, copying, distribution or taking action in relation of the contents of this information is strictly prohibited and may be unlawful. If you have received this email in error, please delete it and advise the sender.

1 1

Agenda for today’s call
by John Wunderlich 23 Aug '23

23 Aug '23

Good morning; I’m still working my way through the comments on the Draft Implementors Report. The main goal of today’s call is to start considering requirements. Please take look at the Requirements Coverage page: https://kantara.atlassian.net/wiki/spaces/PEMCP/pages/240025664/Requirement…. You will notice that we are missing requirements in a number of areas, so today’s session will be a brainstorming session to discuss the missing requirements. Starting next week we will resume reviewing the candidate requirements - starting with reviewing the process we have come up with to write, review, revise, and select requirements. Today’s agenda is here: https://kantara.atlassian.net/wiki/spaces/PEMCP/pages/246644737/2023-08-23+… Sincerely, John Wunderlich BA, MBA, CISA, CIPP/C, CIPM, FIP LinkedIn: https://www.linkedin.com/in/privacycdn/ Twitter: https://twitter.com/PrivacyCDN -- This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. This message contains confidential information and is intended only for the individual named. If you are not the named addressee you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately by e-mail if you have received this e-mail by mistake and delete this e-mail from your system. If you are not the intended recipient you are notified that disclosing, copying, distributing or taking any action in reliance on the contents of this information is strictly prohibited.

1 0

Cancelling today’s call
by John Wunderlich 16 Aug '23

16 Aug '23

I was hoping to have the final consolidated draft implementors report ready for final review and voting today, but the work has been delayed. Apologies for the late notice. Sincerely, John Wunderlich BA, MBA, CISA, CIPP/C, CIPM, FIP LinkedIn: https://www.linkedin.com/in/privacycdn/ Twitter: https://twitter.com/PrivacyCDN -- This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. This message contains confidential information and is intended only for the individual named. If you are not the named addressee you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately by e-mail if you have received this e-mail by mistake and delete this e-mail from your system. If you are not the intended recipient you are notified that disclosing, copying, distributing or taking any action in reliance on the contents of this information is strictly prohibited.

1 0

privacy problem with blue tooth
by Tom Jones 16 Aug '23

16 Aug '23

Somehow the requirements need to address the problems with device-device connections. Does that need a separate set of codes? Here are some of the issues reported, but others relate to information leakage prior to the consent screen, which seems to be the case with a proposed standard from the OIDF. I believe it would apply to the details of 13018-5 as well. In summary - the interchange at the network level before the data interchange is initiated. https://www.foxnews.com/tech/detect-creeps-unwanted-bluetooth-tracker-googl… ..tom

1 0

FW: July 20 NIST NCCoE Mobile Driver’s License COI Meeting
by Salvatore D'Agostino 14 Jul '23

14 Jul '23

In case u don't subscribe, best Sal From: Finke, Jeffrey (Ctr) <jeffery.finke(a)nist.gov> Sent: Friday, July 14, 2023 9:31 AM Subject: July 20 NIST NCCoE Mobile Driver's License COI Meeting Hello mDL Community of Interest! Following the publication of our final project description in June, the National Cybersecurity Center of Excellence (NCCoE) will be releasing a Federal Register Notice (FRN), a formal call for project collaborators. In light of this event, we will host the following community of interest (COI) meeting to discuss the project and answer questions you may have about the FRN process. Please join the project team on Thursday, July 20 from 10:00-10:30 a.m. ET to: * Meet the NCCoE Digital Identities - Mobile Driver's License (mDL) team. * Receive a briefing on the background of this NCCoE project. * Learn how to participate and respond with a Letter of Intent (LoI) via an FRN to be published by the NCCoE shortly. * Engage in a question-and-answer period with the project team. We look forward to seeing you on the 20th. Call-in details are listed below. For your convenience, an iCalendar file has been attached. If you are unable to attend the COI meeting on July 20, another invite will be sent out shortly for the same meeting on another date. Respectfully, The NCCoE Digital Identities mDL Team --- Microsoft Teams meeting Join on your computer, mobile app or room device <https://teams.microsoft.com/l/meetup-join/19%3ameeting_YjI5ZGM2ZjYtOWZlOS00 ZTUyLTk3ODUtNmY2MDkxNjA0NTgx%40thread.v2/0?context=%7b%22Tid%22%3a%222ab5d82 f-d8fa-4797-a93e-054655c61dec%22%2c%22Oid%22%3a%22cfcf194a-39b1-4ca3-95ac-1f 29ba086f54%22%7d> Click here to join the meeting Meeting ID: 212 143 178 963 Passcode: cUZBdt <https://www.microsoft.com/en-us/microsoft-teams/download-app> Download Teams | <https://www.microsoft.com/microsoft-teams/join-a-meeting> Join on the web Join with a video conferencing device 101340915(a)teams-us.bjn.vc <mailto:101340915@teams-us.bjn.vc> Video Conference ID: 114 815 237 8 <https://dialin.bluejeans.com/teams?key=101340915&conf=1148152378&domain=tea ms-us.bjn.vc> Alternate VTC instructions <https://aka.ms/JoinTeamsMeeting> Learn More | <https://teams.microsoft.com/meetingOptions/?organizerId=cfcf194a-39b1-4ca3- 95ac-1f29ba086f54&tenantId=2ab5d82f-d8fa-4797-a93e-054655c61dec&threadId=19_ meeting_YjI5ZGM2ZjYtOWZlOS00ZTUyLTk3ODUtNmY2MDkxNjA0NTgx(a)thread.v2&messageId =0&language=en-US> Meeting options

1 0