November 2017 - WG-UMA - mailman.kantarainitiative.org

URGENT: The UMA 2.0 specifications are now in Kantara All-Member Ballot
by Eve Maler 11 Dec '17

11 Dec '17

I'm pleased to report that the Draft Recommendations, which our WG approved to progress to the LC, and which the LC certified in a very efficient amount of time, have been put into All-Member Ballot by Kantara staff in a likewise extremely efficient manner. Special thanks to Andrew Hughes and Megan Cannon for their assistance! I have prepared a Get Out The vote (GOTV) Google spreadsheet <https://docs.google.com/a/meshfire.com/spreadsheets/d/1FpiB6PMH9Tx4nbn3PYuM…> to help us reach out to Kantara members and member reps individually, to make the best use of this two-week balloting period. It will go by FAST. I invite you all to please help by going into the spreadsheet (I will share with any WG participant who requests access), filling in Kantara member/rep names, and -- especially -- *marking yourself down as a "champion" to reach out personally to ask these people ASAP to vote YES on the ballot*. There are tabs in the spreadsheet that even suggest email template text to make things extra easy. ;) By the way, several Kantara individual members are also UMA WG participants, and I will be dropping each of you a note shortly! Thank you -- please do take action on this as soon as you can, because the ballot runs from today only until *DECEMBER 11*! *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

2 8

Legal call is on for tomorrow (Friday) - back to using join.me
by Eve Maler 30 Nov '17

30 Nov '17

Let's review what we learned in today's joint call, look at new language in Business Model Paper 5 that Tim has added, and figure out what we can accomplish by the end of the year. *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0

Draft minutes of UMA telecon 2017-11-30
by Eve Maler 30 Nov '17

30 Nov '17

https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2017-11-30 MinutesJoint meeting notes - Consent Receipts people present on Consent Receipts to UMA people (Eve and Domenico are the only "non-CIS WG" UMAnitarians on the call.) CR V1.0 is fully published and downloadable now. The WG has developed V1.1 and has voted to move it to the public review period. That's due to go to the 45-day review shortly. The data structure inside the receipt has seen some structural changes (to allow multiples, e.g. of data controllers), and the spec has had editorial changes. V1.1 had a fundamental goal to make no breaking changes. There were a couple of minor such changes. The spec is for a data structure, not a protocol. It has implementers in various stages, mostly for internal use and with heavy extensions (which is compatible with the "MVCR" intention – "minimum viable"). Consentua, digi.me, JLINC (when it gets to V1.0 of its product), and Open Consent Group are all implementing. There are a bunch of random commenters on GitHub. There have been a lot of downloads of V1.0, more than UMA! The informal roadmap includes what will likely be a V2.0 that focuses on interop issues. The new Consent Management WG would be able to feed best practices into the CR work at that point. The CR would be able to become something like a "personal data privacy receipt" that captures all the justifications for processing. Or maybe this is overstating future directions. - UMA people present on UMA to Consent Receipts people, including reviewing the GitHub issues labeled "shoebox" <https://github.com/KantaraInitiative/wg-uma/issues?q=is%3Aopen+is%3Aissue+l…> Eve showed the UMA V2.0 specs, and a quick demo of a "profile and privacy dashboard" that integrates UMA2. Mary asked who has built UMA-style sharing dashboard interfaces. ForgeRock has, and HIE of One has (on UMA1 so far). CR has focused first on the notice requirements, not all privacy requirements. By contrast, UMA's design center is more about authorization/access control made convenient for humans. So it's a control mechanism. A regulation like GDPR has made "choice and control" more important and viable for data subjects, but there are a lot of consent flows outside UMA use cases. - UMA Legal people present on UMA Legal to all Mark notes: There is no obligation in privacy law for natural persons to protect other natural persons' data. It's about organizations. Companies have used individuals as a loophole to get around their obligations. The UMA Legal plan to use licenses can plug some loopholes. Chris notes: It's not so much that people have a fear factor about sharing data, but we need to press for a unified identity+consent structure that is deregulated. Andrew proposes: A "consent receipt" is a record that should be issued whenever a person agrees to something. Can we say that Alice (the resource owner) is definitely the data controller? Bob (the requesting party) is a data processor, because he's following the rules that Alice set out for him? But then he becomes a data controller (another data controller, with a different purpose) when he uses his access. CR today is about data privacy, not about IoT (though Eve notes the ePrivacy regulation mentions IoT). Let's find a use case that encompasses both CR and UMA. How about using the Aggregating and Sharing Pension Information UMA case study <https://kantarainitiative.org/confluence/display/uma/Case+Studies>? (Sal notes it's similar to this Massachusetts search feature <https://www.findmassmoney.com/>.) We seem to have some gaps. What are the specific roles? What is the role of timing? The time of consent is the time you must be prepared to issue a receipt. The data controller must be prepared to issue a receipt to the data subject – or rather, we think that would be nice; some of that data would be included in a subject access request, but "consent receipts" aren't included as such. But what if, as our analysis, the (a) data controller is the data subject, or at least their proxy? Andi: When a resource owner decides who is going to have access and what kind, which could happen multiple times, presumably that's an occasion for generating a receipt. Similarly, when a resource server makes a decision on receiving an access token and a resource request. Andrew envisions the UMA roles flipping from data subject to data controller to data processor at different stages. Can we capture state changes and each of the UMA roles, and try to pinpoint what their "data *" roles are supposed to be? There are a lot of verbs that might work for "agrees to something", depending on the circumstances. Permits, approves, grants access, becomes a party to a transaction...! Robert: Every new subject/controller agreement needs a receipt. The receipt is just the metadata. Sal: It's a relationship! - Enumerate the possible places in UMA where things would be useful to "record"/have a "receipt" structure - See also IIW XXI "Consent Receipts in UMA" session notes (also known as "pumpkin security theater") – page 38 <https://github.com/windley/IIW_homepage/raw/gh-pages/assets/proceedings/IIW…> - Enumerate places where the UMA resource owner and requesting party would find it useful to get a receipt ("repudiation" use cases) Eve showed the Legal slides where the OAuth client credentials, ToS/PN, PAT, (optional) PCT, and RPT get issued. They can also be revoked. - Enumerate relevant technical artifacts in UMA and their places of issuance and usage - Record next steps *AI:* Andrew, Eve, Robert, Andi: Work on UMA/receipt state changes spreadsheet. Put some thinking into the "relationship" angle. *AI:* Andrew, Eve: Find next time for a joint meeting. UMA agenda - Update on spec timeline progress and GOTV efforts - Update on new logo selection Mike asked his colleagues and they don't like the new logo. [image: (smile)] Regarding the "2", he points out that OAuth 1 was huge, and with a 2.0, he worries about a 3.0 and changing his client software. Jin likes the middle one. Adrian doesn't think the "2" is necessarily useful, and thinks having a distinctive design (e.g. with the circle) is useful. Having the blue and green does add cost in printing. - Update on plan to switch to GoToMeeting in 2018 Eve will freshen up the calendar event invites in 2018 with this info; our current events don't extend past 2017. Attendees As of 7 Mar 2017, quorum is 4 of 7. (Domenico, Sal, Andi, Maciej, Eve, Mike, Cigdem) 1. Domenico (first hour) 2. Sal 3. Andi (second hour) 4. Maciej (second hour) 5. Eve 6. Mike (second hour) Non-voting participants: - John - Mark - Mary - Andrew - Adrian - Jin (second hour) - Bjorn (second hour) - Tim (second hour) Other participants from the CIS WG *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0

Agenda for UMA telecon 2017-11-30 (joint with CIS WG; starts an hour earlier; different dial-in)
by Eve Maler 29 Nov '17

29 Nov '17

https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2017-11-30 Date and Time - *Special time, Thursday 8am PT *(scheduled for 1 hour, assuming it will run longer!) - Special dial-in for today: CIS WG GoToMeeting line (see calendar link below for additional details): https://global.gotomeeting.com/join/323930725 <https://www.google.com/url?q=https%3A%2F%2Fglobal.gotomeeting.com%2Fjoin%2F…> - UMA calendar: http://kantarainitiative.org/confluence/display/uma/Calendar Agenda for joint meeting - Consent Receipts people present on Consent Receipts to UMA people - UMA people present on UMA to Consent Receipts people, including reviewing the GitHub issues labeled "shoebox" <https://github.com/KantaraInitiative/wg-uma/issues?q=is%3Aopen+is%3Aissue+l…> - UMA Legal people present on UMA Legal to all - Enumerate the possible places in UMA where things would be useful to "record"/have a "receipt" structure - Enumerate places where the UMA resource owner and requesting party would find it useful to get a receipt ("repudiation" use cases) - Enumerate relevant technical artifacts in UMA and their places of issuance and usage - Record next steps - At 9am PT take a quick break for: - Update on spec timeline progress and GOTV efforts - Update on new logo selection - Update on plan to switch to GoToMeeting in 2018 - AOB *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0

Reminder about our joint meeting with the CIS WG on Nov 30
by Eve Maler 27 Nov '17

27 Nov '17

I've added an event to our calendar for 8am PT this Thursday, just before our regular hour, and we'll be using the CIS WG's GoToMeeting line. It has an agenda in it. If we go over, we'll just keep using the GTM line, instead of our join.me. If anyone would like to be explicitly added to the invitation, please let me know. (And I've been noticing that there are a lot of people on the existing weekly invitation who don't attend regularly, so I'm going to drop them so they're not bothered by this stuff. If you want to be retained on these anyway, let me know.) *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0

UMAnitarian holiday get-together in London
by Eve Maler 25 Nov '17

25 Nov '17

Hi all-- Who might be available/interested to get together in London on the 14th or 15th, lunchtime or afternoon or evening, for a little holiday celebration? I'll be in town. I've created a Doodle poll to capture preferences. https://doodle.com/poll/hr3nm6yprncqi2q9 Please let me know by end of next week (Dec 1), if you can, so I can make arrangements! *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0

Breaking: The LC has certified our Draft Recommendations
by Eve Maler 22 Nov '17

22 Nov '17

Next stop: The All-Member Ballot to approve our specifications as Recommendations will start on Monday and will run for fourteen days (Nov 27-Dec 11). So it will shortly be time to gear up for our GOTV (Get Out The Vote) effort! In the meantime, I hope those of you who celebrate US Thanksgiving have a very happy one. Talk to y'all on the 30th. *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0

Reminder: No WG or Legal meeting this week
by Eve Maler 21 Nov '17

21 Nov '17

Also, I heard back from our commenter on issue #358, who reported that sub-issue (a) was the correct interpretation, and they noted our disposition of the comment. I added that the UMA Legal work may be of interest; they agreed (paraphrasing) that non-technical solutions would help with the potential problem with PII exposure they reported. *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0

Notes from UMA Legal telecon 2017-11-17
by Eve Maler 17 Nov '17

17 Nov '17

https://kantarainitiative.org/confluence/display/uma/UMA+legal+subgroup+not… 2017-11-17 Attending: Eve, Jim, Tim, Kathleen, Colin, Bjorn, Mark Tim asked: To avoid many many contracts, is it possible to have all parties go through the ASO? - Eve: Most circumstances today leave Alice accepting the ASO's and RSO's ToS/PN as a contract of adhesion. (Also, presumably, the use of each RS comes at a time when Alice decided to use it, and the choice to sew together each RS with the AS – authorizing PAT issuance -- comes at an appropriate time also, so, the experience is at her discretion.) Our work to add to templated clause text can strengthen the provisions of these contracts even if there are several preceding the license phase. - Eve: In some deployment ecosystems, the ASO may be singular because other parties are aggregated into it (ASO + singular RSO, ASO + RSO + CO, etc.). In these cases, the process of accepting an initial (non-UMA) ToS/PN and authorizing a later PAT, e.g., could be rolled into one. - Jim and Kathleen: In some cases, Alice may have power, either because the RO is "AliceCo" (not directly in our framework's scope for now) or because the law gives her more power (e.g. "patient right of access") – effectively, the Alices have been "aggregated". These effectively give strength to the templating we can do. Jim: Regarding improving the circumstances of the "little" party wrt the "big" party, you can do it through influencing law (out of scope for our group), you can do it through intermediaries, you can do it through model terms/template clauses (the latter now being this group's favored phrase – so this would be our group's role in this ecosystem), and you can do it through adopting processes that enforce industry behavior that manage compliance risk for "big" parties (this is how others could use our deliverables – maybe IACCM, Pan-Canadian Trust Framework effort, other countries, other industries, etc.). We can't make anyone use this framework; rather, we want to make it as easy to use, adopt, adapt, and profile as possible. These links illustrate templating and ecosystem chains: http://www.commonaccord.org/index.php?action=source&file=Dx/Acme/09-EU-US-D… http://www.commonaccord.org/index.php?action=xEdit&file=G/TechContractsCom-… Eve has reached out to the people at Origo regarding their use of UMA (V1, however) and their potential need for ToC/PN that are protective of privacy rights in a standard way. https://pensionsdashboardproject.uk/saver/about-the-pensions-dashboard/ http://www.origo.com/news/Kenneth_May_Demonstrates_Delegated_Authority_Pens… https://www.ipe.com/countries/uk/uk-government-backs-pension-dashboard-proj… Let's plan to focus on this as a candidate case study/use case in the document. It has properties of strong authentication, a likely "design pattern" of sharing we'll see again, a government friend for Alice in negotiating the terms ("you and what army?" "this army!"), non-co-located services/parties, mappings to many of the characteristics of the use cases we gathered in deliverable #1, people who profiled UMA for real use already, etc. It only doesn't have UMA2, but we could work around that. *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0

We have a Legal call tomorrow
by Eve Maler 16 Nov '17

16 Nov '17

Also: Please note that on Nov 30, Legal subgroup denizens are invited to join a joint UMA WG/Consent and Information Sharing WG call at 8am PT to discuss touchpoints. We'll use their GoToMeeting dial-in. Stay tuned for details. *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0