- WG-UMA - mailman.kantarainitiative.org

Re: [WG-UMA] [projectvrm] A ... not sure what, exactly ... development in India
by Adrian Gropper 03 Mar '20

03 Mar '20

Jules - you overstate the difficulty. Let's take a very simple example of SoC: Information Governance Labels separate from Service Registries. Neither of these concerns has any access to a personal data item. A label can be standardized by one entity (e.g. the PPR Information Governance Label https://ssrn.com/abstract=3439701 ) and another entity could decide to act as registrar (e.g. digi.me or the Apple App Store) to simply post the label for services that choose to use it. In this example, MyData would choose to play either the "standards" role or the registry role but not both. I put standards in "" because PPR did not engage in a formal ANSI-accredited standards process for the IGL. It's simply a voluntary effort as an example to others that might do the same. Secondly, nothing keeps digi.me or Apple from participating in SoC standards efforts at some level even as they execute their current market strategy as end-to-end. My point is that SoC can be introduced as gently as anyone wants. I don't buy the idea that end-to-end implementations like digi.me come first because if that's the case, then Apple wins hands-down. - Adrian On Mon, Mar 2, 2020 at 2:46 PM Julian Ranger <Julian(a)jranger.com> wrote: > Adrian – splitting functionality is a very difficult thing to do in this > case. At digi.me we provide an end to end service from data into an > individual to data out – we can therefore ensure that the intermediate > steps all work together smoothly. In some future world where each step is > a well known process then one could mix and match, but that would require > each step to be well understood and agreed as a separate functional entity > which then chains to another functionally separate entity. For such chains > to exist there has to be implementations in this new world that a) work and > then b) have a desire to interoperate with other working chains – that will > take time as companies work out what can work and won’t technically, > financially and operationally with the user involved. If we want any level > of MyData operations in the near term then getting some successful end to > end implementations out into the wild is step 1; making them componentised > (SoC) and interoperable is definitely step 2. Jules > > > > *From:* Adrian Gropper <agropper(a)healthurl.com> > *Sent:* 01 March 2020 17:13 > *To:* Julian Ranger <Julian(a)jranger.com> > *Cc:* Antti Jogi Poikola <antti.poikola(a)gmail.com>; Doc Searls < > anitadrink(a)gmail.com>; LaVonne Reimer <lreimer(a)lumeno.us>; ProjectVRM > list <projectvrm(a)eon.law.harvard.edu>; Tim Reiniger <tsreiniger(a)gmail.com>; > wg-uma(a)kantarainitiative.org WG <WG-UMA(a)kantarainitiative.org> > *Subject:* Re: [WG-UMA] [projectvrm] A ... not sure what, exactly ... > development in India > > > > Julian, > > > > Thank you for engaging, as you always do. > > > > This is not about my definition of strict or anyone else’s. It’s about the > role of standards to enable and empower individuals. > > > > For example, as I understand it, digi.me has an ontology component and a > consent component. The ontology component can and does add value because it > has access to the data in the clear. The consent component can and does add > value because it can control use of the data without access to the clear > text data itself. (It could, in principle, control the flow of data > directly from a streaming source to a data processor destination.) > > > > The decision on how to connect the ontology component to the consent > component of digi.me is entirely up to digi.me. They could choose to use > a standard like UMA internally and also expose that control connection > externally. This would empower the individual customer to make separate > choice of their ontology or their consent managers. This, in turn, reduces > lock-in and promotes competition, both of which can benefit the customer. > > > > The tradeoff comes when a service provider that builds on separation of > concerns, such as our HIE of One Trustee project, cannot find investors to > sponsor the added standards work and risk of customer churn. Separation of > Concerns is therefore a finance problem more than it is a standards problem. > > > > I’m aware of only a few groups that have chosen to tackle the finance > problem and they are quite immature. One is the Digital Life Collective (by > Philip Sheldrake) others look more like Decentralized Autonomous > Organizations (DAO) and more recently, Decentralized Finance (DeFi). These > groups are so busy re-inventing management structures that they can’t be > bothered with mundane things like standards process. > > > > The other group worth mentioning is MyData. They are also immature and > have partitioned this Separation of Concerns issue into a MyData Operator > discussion (where digi.me is a participant). What MyData does has some > impact on immature EU Data Privacy regulations. Our handling of the SoC and > standards will be, IMHO, the real test of the MyData model. > > > > (Privacy regulators are the most immature group of all. They are still > oblivious to the relationship between standards and competition. The giant > platform vendors are desperately hoping to be regulated as giant platforms > rather than give innovators the opportunity that comes with Separation of > Concerns.) > > > > In other words, customers almost always come second to finance. The sole > exception seems to be open source software projects which dispense with > finance by design and deal with management as little as possible. > > > > - Adrian > > > > On Sun, Mar 1, 2020 at 10:57 AM Julian Ranger <Julian(a)jranger.com> wrote: > > Adrian, > > > > Re “the pushback is that no private business wants to be strictly a data > controller and forego access to the data itself as part of their business > model” > > > > Some businesses, i.e. digi.me, want to be neither a data controller nor > have access to the data itself – and that is ultimately the right answer. > Don’t see, touch ro hold the data. Now whether current implementations > (ours included) meet you strict definition of SoC I don’t know, but to me > it is clear that the individual’s data stores should only be handled by > software that the individual chooses to run and that processing should sit > within thinteh inidividual’s domain (until such time as the individual > specifically allows data to leave their domain). > > > > Jules > > > > > > *From:* Doc Searls <anitadrink(a)gmail.com> > *Sent:* 24 February 2020 20:02 > *To:* Adrian Gropper <agropper(a)healthurl.com> > *Cc:* Tim Reiniger <tsreiniger(a)gmail.com>; LaVonne Reimer < > lreimer(a)lumeno.us>; ProjectVRM list <projectvrm(a)eon.law.harvard.edu>; > wg-uma(a)kantarainitiative.org WG <WG-UMA(a)kantarainitiative.org> > *Subject:* Re: [WG-UMA] [projectvrm] A ... not sure what, exactly ... > development in India > > > > > > On Feb 24, 2020, at 11:49 AM, Adrian Gropper <agropper(a)healthurl.com> > wrote: > > > > This is a good thing. There’s some overlap between the Solid folks and > those of us working on SSI standards. Although they don’t say it publicly, > I’ve been assured that Inrupt will implement and respect what I call > Separation of Concerns standards. > > > > I saw the same potential synergies. > > Separation of Concerns means that the data controller can be specified by > the data subject separately form the data storage or other data processors. > UMA2 can already do that and it’s likely that the upcoming IETF OAuth3 > standards will also support SoC. A pod would then be a special case of a > co-located controller and storage. > > > > Our HIE of One Trustee project has always done this. We keep separate > github repos for the two separate concerns in order to demonstrate the > standards that connect them and to highlight gaps in the standards that > still need improvement. > > > > Defining agency as requiring SoC seems to be controversial. There’s > pushback because the standards are immature. I suspect another, unstated > reason for the pushback is that no private business wants to be strictly a > data controller and forego access to the data itself as part of their > business model. > > > > Sounds right. > > I’m curious what others on this list think about defining agency in terms > of SoC. > > > > My own small thought on it (having not thought or known enough about it, > so far) is that it makes sense. Given the ease of data spread—with lost > personal agency in the midst—it's important to keep ambiguities minimized > and separate responsibilities clear. > > > > Doc > > > > - Adrian > > > > > > > > On Mon, Feb 24, 2020 at 4:26 PM Tim Reiniger <tsreiniger(a)gmail.com> wrote: > > Adrian, > > > > Thank you for compiling this great list! If you haven't seen this story, > this might become an addition: > https://www.schneier.com/blog/archives/2020/02/inrupt_tim_bern.html. See > what you think! > > > > Regards, > > > > Tim > > > > On Thu, Feb 13, 2020 at 1:02 PM Adrian Gropper <agropper(a)healthurl.com> > wrote: > > This is an important development in the global context of giving agency to > individuals. Here is my current list of related initiatives. Note that all > of these are works-in-progress. In no particular order: > > > > - US ACCESS Act > https://blog.petrieflom.law.harvard.edu/2019/10/24/access-act-points-the-wa… > > - EU+ MyData Operators > https://docs.google.com/presentation/d/1J71J8_8kSiIXmVXSkQbRixmv0rxQXC_d-I6… > > - EU Open Banking and PSD 2 > https://www.altexsoft.com/blog/engineering/open-banking-and-financial-apis-… > > - India Open Banking https://www.bloomberg.com/news/articles/2020-01-13/india-s-about-to-hand-pe… > > > - SSI and Rebooting Web of Trust > https://github.com/WebOfTrustInfo/rwot10-buenosaires/blob/master/topics-and… > > - IETF Transactional Authorization > https://tools.ietf.org/html/draft-richer-transactional-authz-03 > > > > The common thread across all of these is an authorization server acting on > behalf of a data subject. This is a very different model from GDPR, HIPAA, > CCPA, the proposed India Personal Data Protection Bill or the other 9 > privacy bills being considered in Washington. > > > > - Adrian > > > > > > > > > > On Tue, Feb 11, 2020 at 2:07 PM LaVonne Reimer <lreimer(a)lumeno.us> wrote: > > Thanks for bringing this to our attention. > > > > This is squarely my area (by way of Descant). I'm a bit crunched at the > moment so not able to provide a thorough analysis relative to VRM but if > you think back to everything I've said in past VRM days as well as on these > threads, it claims to provide a data facilitator platform congruent with > all that working code I've been sitting on for much too long! > > > > First, thoughts on the article. Then below that, a reference to the > Equifax announcement yesterday. > > > > A couple characteristics that fit the VRM way, and that are at least > implied in the article: > > - It revisits the flows of data for credit analysis "through the eyes > of" the subjects of the data. It's always important to question the extent > of this agency when it's banks rolling out the solution but the spirit of > subject-driven data flows seems to be present. > - It addresses a gap in data pipeline management on a narrower basis > than will be necessary to scale and than we offer via Descant. See the > specific reference to an India-specific requirement that financial data be > reported in a standard, machine-readable format. More on this below. > - It suggests consents will be easier to understand because data > subjects can choose to share portions of data. This is a very big challenge > and one we've largely solved by enabling UI/UX that spreads out consents > across touchpoints. Easier to provide for context-based consent in that > manner. It's not clear that India is thinking in these terms. Indeed the > intent seems to be that fintech startups will build apps on top of the > platform. Unless there are constraints on the spirit and intent of such > apps, they could be heading back to opacity with little opportunity to pull > it back. Also, more on this below. > > *Data pipeline management: * > > Of all the big data challenges addressed over the past decade, pipeline > management has only recently popped up as a significant area. I have only > seen developments (and patent filings) for pipelines within enterprises. > The essence is that applying transformation, processing, and governance to > data while in motion streamlines its path to insights. As the category > implies, it's a more fluid approach to data management for sure as compared > to the old ETL model and arguably data lakes. > > > > A facilitator platform that replaces credit bureaus will need to > management multiple pipelines, each potentially presenting different levels > of privacy-sensitivity and latency concerns. The solution announced by this > article is a reasonable start but not as extensive as would be needed to > truly replace an Equifax. I didn't see a plan to, say, open source the > system so extensions for additional data pipelines could emerge. > > > > Note that this data challenge is not obviously about privacy but it is > critical if the goal is to replace intermediated data solutions. This is a > good a place as any to include a link to an opinion in yesterday's NYT > about the indictment of Chinese hackers for the Equifax breach. Author > makes the point that the whole model underlying Equifax and data brokers is > the problem. And that is a more complicated data pipeline problem than > consents. > > > > > https://www.nytimes.com/2020/02/10/opinion/equifax-breach-china-hacking.html > > > > *Context-based consent etc:* > > Just adding a short note that I've been studying recent efforts to add > language to open source licenses that encompasses privacy, data rights, > and/or human dignity. As far as I can see, this is all new territory. In > the "humanitarian license," the author combines language from the MIT open > source license with language out of the UN's declaration of human rights. > So far OSI seems poised to reject it as a "blessed" open source license. > NYU School of Law also has some similar projects underway. > > > > I care about this because when I think about open sourcing the > data-sharing platform of Descant, I worry much more about extensions in > conflict with the ethos of people in charge of their own data than specific > uses of the source code. This goes to my concern that opening up for > fintech startups would be problematic if there's no way to police data > usage. > > > > Again, this is all off the top of my head. The title is correct that it is > better than the US but then we are a dark and surveilled country headed for > very bad days unless we can get a grip. > > > > Let me know of any questions/afterthoughts. > > > > Thanks again Doc!! > > > > LaVonne > > 503-720-0690 > > > > On Tue, Feb 11, 2020 at 1:31 PM Doc Searls <anitadrink(a)gmail.com> wrote: > > Headlines: > > > > India’s About to Hand People Data Americans Can Only Dream Of > By Saritha Rai > January 12, 2020, 11:01 PM EST > > • New system aims to protect data and unlock the credit market > > • India joins a growing movement to give consumers data control > > > > < > https://www.bloomberg.com/news/articles/2020-01-13/india-s-about-to-hand-pe… > > > > > > Anybody familiar with this want to lay it out in VRM terms (good, bad or > otherwise)? > > > > Doc > > > > -- > > LaVonne Reimer, Founder > Lumenous > 503-720-0690 (cell) > lavonnereimer (skype) > > www.lumenous.net > > > > _______________________________________________ > WG-UMA mailing list > WG-UMA(a)kantarainitiative.org > https://kantarainitiative.org/mailman/listinfo/wg-uma > > > >

1 0

Re: [WG-UMA] [projectvrm] A ... not sure what, exactly ... development in India
by Henrik Biering 01 Mar '20

01 Mar '20

I like Julians explanation that appears to be based on the roles of business entities rather than the roles of technical solution components as the SoC proposed by Adrian. To me SoC should ensure what Doc phrased here a long time ago: https://blogs.harvard.edu/vrm/tag/first-party/ "Fourth parties also need to be /substitutable/. They need /service portability/, just as the customer needs /data portability/ between fourth (and other) party services. That way whatever they can provide can be swapped out by the user, if need be." This means that services like Digi.me that leaves the data controller role to the individual may have agreements with 2. and 3. parties as long as they are transparent to the user. But it means that a user may need to substitute the 4. party if he/she should decide to switch to another 2. party. 4. party services like recommender and relationship management services on the other hand naturally cannot coexist with any contractual relationship between a 4. party and any 2. or individual 3. parties. 4. parties may only facilitate interactions (anonymously or identified) between 1. and 2. parties following instructions from the 1. party. This is evidenced by the huge amount of claimed 4. party "comparison services" that overwhelmingly have turned out to be concealed 3. party services. And any separation of roles at the technical level would not prevent this from happening. So SoC may have different implications depending on the nature of services. Once appropriate SoC has been determined at the business layer, then it is up to technical standards to ensure that: * that these concerns including - also legal and ethical requirements - can be enforced by technology rather than policy * service portability as well as data portability can be implemented as required to support the business layer SoC in easy and nondiscriminatory ways. /Henrik Den 01-03-2020 kl. 16:57 skrev Julian Ranger: > > Adrian, > > Re “the pushback is that no private business wants to be strictly a > data controller and forego access to the data itself as part of their > business model” > > Some businesses, i.e. digi.me, want to be neither a data controller > nor have access to the data itself – and that is ultimately the right > answer. Don’t see, touch ro hold the data. Now whether current > implementations (ours included) meet you strict definition of SoC I > don’t know, but to me it is clear that the individual’s data stores > should only be handled by software that the individual chooses to run > and that processing should sit within thinteh inidividual’s domain > (until such time as the individual specifically allows data to leave > their domain). > > Jules > > *From:*Doc Searls <anitadrink(a)gmail.com> > *Sent:* 24 February 2020 20:02 > *To:* Adrian Gropper <agropper(a)healthurl.com> > *Cc:* Tim Reiniger <tsreiniger(a)gmail.com>; LaVonne Reimer > <lreimer(a)lumeno.us>; ProjectVRM list <projectvrm(a)eon.law.harvard.edu>; > wg-uma(a)kantarainitiative.org WG <WG-UMA(a)kantarainitiative.org> > *Subject:* Re: [WG-UMA] [projectvrm] A ... not sure what, exactly ... > development in India > > On Feb 24, 2020, at 11:49 AM, Adrian Gropper > <agropper(a)healthurl.com <mailto:agropper@healthurl.com>> wrote: > > This is a good thing. There’s some overlap between the Solid folks > and those of us working on SSI standards. Although they don’t say > it publicly, I’ve been assured that Inrupt will implement and > respect what I call Separation of Concerns standards. > > I saw the same potential synergies. > > > Separation of Concerns means that the data controller can be > specified by the data subject separately form the data storage or > other data processors. UMA2 can already do that and it’s likely > that the upcoming IETF OAuth3 standards will also support SoC. A > pod would then be a special case of a co-located controller and > storage. > > Our HIE of One Trustee project has always done this. We keep > separate github repos for the two separate concerns in order to > demonstrate the standards that connect them and to highlight gaps > in the standards that still need improvement. > > Defining agency as requiring SoC seems to be controversial. > There’s pushback because the standards are immature. I suspect > another, unstated reason for the pushback is that no private > business wants to be strictly a data controller and forego access > to the data itself as part of their business model. > > Sounds right. > > > I’m curious what others on this list think about defining agency > in terms of SoC. > > My own small thought on it (having not thought or known enough about > it, so far) is that it makes sense. Given the ease of data spread—with > lost personal agency in the midst—it's important to keep ambiguities > minimized and separate responsibilities clear. > > Doc > > - Adrian > > On Mon, Feb 24, 2020 at 4:26 PM Tim Reiniger <tsreiniger(a)gmail.com > <mailto:tsreiniger@gmail.com>> wrote: > > Adrian, > > Thank you for compiling this great list! If you haven't seen > this story, this might become an addition: > https://www.schneier.com/blog/archives/2020/02/inrupt_tim_bern.html. > See what you think! > > Regards, > > Tim > > On Thu, Feb 13, 2020 at 1:02 PM Adrian Gropper > <agropper(a)healthurl.com <mailto:agropper@healthurl.com>> wrote: > > This is an important development in the global context of > giving agency to individuals. Here is my current list of > related initiatives. Note that all of these are > works-in-progress. In no particular order: > > - US ACCESS Act > https://blog.petrieflom.law.harvard.edu/2019/10/24/access-act-points-the-wa… > > - EU+ MyData Operators > https://docs.google.com/presentation/d/1J71J8_8kSiIXmVXSkQbRixmv0rxQXC_d-I6… > > - EU Open Banking and PSD 2 > https://www.altexsoft.com/blog/engineering/open-banking-and-financial-apis-… > > - India Open Banking > https://www.bloomberg.com/news/articles/2020-01-13/india-s-about-to-hand-pe… > > > - SSI and Rebooting Web of Trust > https://github.com/WebOfTrustInfo/rwot10-buenosaires/blob/master/topics-and… > > - IETF Transactional Authorization > https://tools.ietf.org/html/draft-richer-transactional-authz-03 > > > The common thread across all of these is an authorization > server acting on behalf of a data subject. This is a very > different model from GDPR, HIPAA, CCPA, the proposed India > Personal Data Protection Bill or the other 9 privacy bills > being considered in Washington. > > - Adrian > > On Tue, Feb 11, 2020 at 2:07 PM LaVonne Reimer > <lreimer(a)lumeno.us <mailto:lreimer@lumeno.us>> wrote: > > Thanks for bringing this to our attention. > > This is squarely my area (by way of Descant). I'm a > bit crunched at the moment so not able to provide a > thorough analysis relative to VRM but if you think > back to everything I've said in past VRM days as well > as on these threads, it claims to provide a data > facilitator platform congruent with all that working > code I've been sitting on for much too long! > > First, thoughts on the article. Then below that, a > reference to the Equifax announcement yesterday. > > A couple characteristics that fit the VRM way, and > that are at least implied in the article: > > * It revisits the flows of data for credit analysis > "through the eyes of" the subjects of the data. > It's always important to question the extent of > this agency when it's banks rolling out the > solution but the spirit of subject-driven data > flows seems to be present. > * It addresses a gap in data pipeline management on > a narrower basis than will be necessary to scale > and than we offer via Descant. See the specific > reference to an India-specific requirement that > financial data be reported in a standard, > machine-readable format. More on this below. > * It suggests consents will be easier to understand > because data subjects can choose to share portions > of data. This is a very big challenge and one > we've largely solved by enabling UI/UX that > spreads out consents across touchpoints. Easier to > provide for context-based consent in that manner. > It's not clear that India is thinking in these > terms. Indeed the intent seems to be that fintech > startups will build apps on top of the platform. > Unless there are constraints on the spirit and > intent of such apps, they could be heading back to > opacity with little opportunity to pull it back. > Also, more on this below. > > *Data pipeline management: * > > Of all the big data challenges addressed over the past > decade, pipeline management has only recently popped > up as a significant area. I have only seen > developments (and patent filings) for pipelines within > enterprises. The essence is that applying > transformation, processing, and governance to data > while in motion streamlines its path to insights. As > the category implies, it's a more fluid approach to > data management for sure as compared to the old ETL > model and arguably data lakes. > > A facilitator platform that replaces credit bureaus > will need to management multiple pipelines, each > potentially presenting different levels of > privacy-sensitivity and latency concerns. The solution > announced by this article is a reasonable start but > not as extensive as would be needed to truly replace > an Equifax. I didn't see a plan to, say, open source > the system so extensions for additional data pipelines > could emerge. > > Note that this data challenge is not obviously about > privacy but it is critical if the goal is to replace > intermediated data solutions. This is a good a place > as any to include a link to an opinion in yesterday's > NYT about the indictment of Chinese hackers for the > Equifax breach. Author makes the point that the whole > model underlying Equifax and data brokers is the > problem. And that is a more complicated data pipeline > problem than consents. > > https://www.nytimes.com/2020/02/10/opinion/equifax-breach-china-hacking.html > > *Context-based consent etc:* > > Just adding a short note that I've been studying > recent efforts to add language to open source licenses > that encompasses privacy, data rights, and/or human > dignity. As far as I can see, this is all new > territory. In the "humanitarian license," the author > combines language from the MIT open source license > with language out of the UN's declaration of human > rights. So far OSI seems poised to reject it as a > "blessed" open source license. NYU School of Law also > has some similar projects underway. > > I care about this because when I think about open > sourcing the data-sharing platform of Descant, I worry > much more about extensions in conflict with the ethos > of people in charge of their own data than specific > uses of the source code. This goes to my concern that > opening up for fintech startups would be problematic > if there's no way to police data usage. > > Again, this is all off the top of my head. The title > is correct that it is better than the US but then we > are a dark and surveilled country headed for very bad > days unless we can get a grip. > > Let me know of any questions/afterthoughts. > > Thanks again Doc!! > > LaVonne > > 503-720-0690 > > On Tue, Feb 11, 2020 at 1:31 PM Doc Searls > <anitadrink(a)gmail.com <mailto:anitadrink@gmail.com>> > wrote: > > Headlines: > > India’s About to Hand People Data Americans Can > Only Dream Of > By Saritha Rai > January 12, 2020, 11:01 PM EST > > • New system aims to protect data and unlock the > credit market > > • India joins a growing movement to give > consumers data control > > <https://www.bloomberg.com/news/articles/2020-01-13/india-s-about-to-hand-pe…> > > Anybody familiar with this want to lay it out in > VRM terms (good, bad or otherwise)? > > Doc > > > > -- > > LaVonne Reimer, Founder > Lumenous > 503-720-0690 (cell) > lavonnereimer (skype) > > www.lumenous.net <http://www.lumenous.net/> > > _______________________________________________ > WG-UMA mailing list > WG-UMA(a)kantarainitiative.org > <mailto:WG-UMA@kantarainitiative.org> > https://kantarainitiative.org/mailman/listinfo/wg-uma >

1 0

Re: [WG-UMA] [projectvrm] A ... not sure what, exactly ... development in India
by Adrian Gropper 01 Mar '20

01 Mar '20

Julian, Thank you for engaging, as you always do. This is not about my definition of strict or anyone else’s. It’s about the role of standards to enable and empower individuals. For example, as I understand it, digi.me has an ontology component and a consent component. The ontology component can and does add value because it has access to the data in the clear. The consent component can and does add value because it can control use of the data without access to the clear text data itself. (It could, in principle, control the flow of data directly from a streaming source to a data processor destination.) The decision on how to connect the ontology component to the consent component of digi.me is entirely up to digi.me. They could choose to use a standard like UMA internally and also expose that control connection externally. This would empower the individual customer to make separate choice of their ontology or their consent managers. This, in turn, reduces lock-in and promotes competition, both of which can benefit the customer. The tradeoff comes when a service provider that builds on separation of concerns, such as our HIE of One Trustee project, cannot find investors to sponsor the added standards work and risk of customer churn. Separation of Concerns is therefore a finance problem more than it is a standards problem. I’m aware of only a few groups that have chosen to tackle the finance problem and they are quite immature. One is the Digital Life Collective (by Philip Sheldrake) others look more like Decentralized Autonomous Organizations (DAO) and more recently, Decentralized Finance (DeFi). These groups are so busy re-inventing management structures that they can’t be bothered with mundane things like standards process. The other group worth mentioning is MyData. They are also immature and have partitioned this Separation of Concerns issue into a MyData Operator discussion (where digi.me is a participant). What MyData does has some impact on immature EU Data Privacy regulations. Our handling of the SoC and standards will be, IMHO, the real test of the MyData model. (Privacy regulators are the most immature group of all. They are still oblivious to the relationship between standards and competition. The giant platform vendors are desperately hoping to be regulated as giant platforms rather than give innovators the opportunity that comes with Separation of Concerns.) In other words, customers almost always come second to finance. The sole exception seems to be open source software projects which dispense with finance by design and deal with management as little as possible. - Adrian On Sun, Mar 1, 2020 at 10:57 AM Julian Ranger <Julian(a)jranger.com> wrote: > Adrian, > > > > Re “the pushback is that no private business wants to be strictly a data > controller and forego access to the data itself as part of their business > model” > > > > Some businesses, i.e. digi.me, want to be neither a data controller nor > have access to the data itself – and that is ultimately the right answer. > Don’t see, touch ro hold the data. Now whether current implementations > (ours included) meet you strict definition of SoC I don’t know, but to me > it is clear that the individual’s data stores should only be handled by > software that the individual chooses to run and that processing should sit > within thinteh inidividual’s domain (until such time as the individual > specifically allows data to leave their domain). > > > > Jules > > > > > > *From:* Doc Searls <anitadrink(a)gmail.com> > *Sent:* 24 February 2020 20:02 > *To:* Adrian Gropper <agropper(a)healthurl.com> > *Cc:* Tim Reiniger <tsreiniger(a)gmail.com>; LaVonne Reimer < > lreimer(a)lumeno.us>; ProjectVRM list <projectvrm(a)eon.law.harvard.edu>; > wg-uma(a)kantarainitiative.org WG <WG-UMA(a)kantarainitiative.org> > *Subject:* Re: [WG-UMA] [projectvrm] A ... not sure what, exactly ... > development in India > > > > > > On Feb 24, 2020, at 11:49 AM, Adrian Gropper <agropper(a)healthurl.com> > wrote: > > > > This is a good thing. There’s some overlap between the Solid folks and > those of us working on SSI standards. Although they don’t say it publicly, > I’ve been assured that Inrupt will implement and respect what I call > Separation of Concerns standards. > > > > I saw the same potential synergies. > > > Separation of Concerns means that the data controller can be specified by > the data subject separately form the data storage or other data processors. > UMA2 can already do that and it’s likely that the upcoming IETF OAuth3 > standards will also support SoC. A pod would then be a special case of a > co-located controller and storage. > > > > Our HIE of One Trustee project has always done this. We keep separate > github repos for the two separate concerns in order to demonstrate the > standards that connect them and to highlight gaps in the standards that > still need improvement. > > > > Defining agency as requiring SoC seems to be controversial. There’s > pushback because the standards are immature. I suspect another, unstated > reason for the pushback is that no private business wants to be strictly a > data controller and forego access to the data itself as part of their > business model. > > > > Sounds right. > > > I’m curious what others on this list think about defining agency in terms > of SoC. > > > > My own small thought on it (having not thought or known enough about it, > so far) is that it makes sense. Given the ease of data spread—with lost > personal agency in the midst—it's important to keep ambiguities minimized > and separate responsibilities clear. > > > > Doc > > > > - Adrian > > > > > > > > On Mon, Feb 24, 2020 at 4:26 PM Tim Reiniger <tsreiniger(a)gmail.com> wrote: > > Adrian, > > > > Thank you for compiling this great list! If you haven't seen this story, > this might become an addition: > https://www.schneier.com/blog/archives/2020/02/inrupt_tim_bern.html. See > what you think! > > > > Regards, > > > > Tim > > > > On Thu, Feb 13, 2020 at 1:02 PM Adrian Gropper <agropper(a)healthurl.com> > wrote: > > This is an important development in the global context of giving agency to > individuals. Here is my current list of related initiatives. Note that all > of these are works-in-progress. In no particular order: > > > > - US ACCESS Act > https://blog.petrieflom.law.harvard.edu/2019/10/24/access-act-points-the-wa… > > - EU+ MyData Operators > https://docs.google.com/presentation/d/1J71J8_8kSiIXmVXSkQbRixmv0rxQXC_d-I6… > > - EU Open Banking and PSD 2 > https://www.altexsoft.com/blog/engineering/open-banking-and-financial-apis-… > > - India Open Banking https://www.bloomberg.com/news/articles/2020-01-13/india-s-about-to-hand-pe… > > > - SSI and Rebooting Web of Trust > https://github.com/WebOfTrustInfo/rwot10-buenosaires/blob/master/topics-and… > > - IETF Transactional Authorization > https://tools.ietf.org/html/draft-richer-transactional-authz-03 > > > > The common thread across all of these is an authorization server acting on > behalf of a data subject. This is a very different model from GDPR, HIPAA, > CCPA, the proposed India Personal Data Protection Bill or the other 9 > privacy bills being considered in Washington. > > > > - Adrian > > > > > > > > > > On Tue, Feb 11, 2020 at 2:07 PM LaVonne Reimer <lreimer(a)lumeno.us> wrote: > > Thanks for bringing this to our attention. > > > > This is squarely my area (by way of Descant). I'm a bit crunched at the > moment so not able to provide a thorough analysis relative to VRM but if > you think back to everything I've said in past VRM days as well as on these > threads, it claims to provide a data facilitator platform congruent with > all that working code I've been sitting on for much too long! > > > > First, thoughts on the article. Then below that, a reference to the > Equifax announcement yesterday. > > > > A couple characteristics that fit the VRM way, and that are at least > implied in the article: > > - It revisits the flows of data for credit analysis "through the eyes > of" the subjects of the data. It's always important to question the extent > of this agency when it's banks rolling out the solution but the spirit of > subject-driven data flows seems to be present. > - It addresses a gap in data pipeline management on a narrower basis > than will be necessary to scale and than we offer via Descant. See the > specific reference to an India-specific requirement that financial data be > reported in a standard, machine-readable format. More on this below. > - It suggests consents will be easier to understand because data > subjects can choose to share portions of data. This is a very big challenge > and one we've largely solved by enabling UI/UX that spreads out consents > across touchpoints. Easier to provide for context-based consent in that > manner. It's not clear that India is thinking in these terms. Indeed the > intent seems to be that fintech startups will build apps on top of the > platform. Unless there are constraints on the spirit and intent of such > apps, they could be heading back to opacity with little opportunity to pull > it back. Also, more on this below. > > *Data pipeline management: * > > Of all the big data challenges addressed over the past decade, pipeline > management has only recently popped up as a significant area. I have only > seen developments (and patent filings) for pipelines within enterprises. > The essence is that applying transformation, processing, and governance to > data while in motion streamlines its path to insights. As the category > implies, it's a more fluid approach to data management for sure as compared > to the old ETL model and arguably data lakes. > > > > A facilitator platform that replaces credit bureaus will need to > management multiple pipelines, each potentially presenting different levels > of privacy-sensitivity and latency concerns. The solution announced by this > article is a reasonable start but not as extensive as would be needed to > truly replace an Equifax. I didn't see a plan to, say, open source the > system so extensions for additional data pipelines could emerge. > > > > Note that this data challenge is not obviously about privacy but it is > critical if the goal is to replace intermediated data solutions. This is a > good a place as any to include a link to an opinion in yesterday's NYT > about the indictment of Chinese hackers for the Equifax breach. Author > makes the point that the whole model underlying Equifax and data brokers is > the problem. And that is a more complicated data pipeline problem than > consents. > > > > > https://www.nytimes.com/2020/02/10/opinion/equifax-breach-china-hacking.html > > > > *Context-based consent etc:* > > Just adding a short note that I've been studying recent efforts to add > language to open source licenses that encompasses privacy, data rights, > and/or human dignity. As far as I can see, this is all new territory. In > the "humanitarian license," the author combines language from the MIT open > source license with language out of the UN's declaration of human rights. > So far OSI seems poised to reject it as a "blessed" open source license. > NYU School of Law also has some similar projects underway. > > > > I care about this because when I think about open sourcing the > data-sharing platform of Descant, I worry much more about extensions in > conflict with the ethos of people in charge of their own data than specific > uses of the source code. This goes to my concern that opening up for > fintech startups would be problematic if there's no way to police data > usage. > > > > Again, this is all off the top of my head. The title is correct that it is > better than the US but then we are a dark and surveilled country headed for > very bad days unless we can get a grip. > > > > Let me know of any questions/afterthoughts. > > > > Thanks again Doc!! > > > > LaVonne > > 503-720-0690 > > > > On Tue, Feb 11, 2020 at 1:31 PM Doc Searls <anitadrink(a)gmail.com> wrote: > > Headlines: > > > > India’s About to Hand People Data Americans Can Only Dream Of > By Saritha Rai > January 12, 2020, 11:01 PM EST > > • New system aims to protect data and unlock the credit market > > • India joins a growing movement to give consumers data control > > > > < > https://www.bloomberg.com/news/articles/2020-01-13/india-s-about-to-hand-pe… > > > > > > Anybody familiar with this want to lay it out in VRM terms (good, bad or > otherwise)? > > > > Doc > > > > -- > > LaVonne Reimer, Founder > Lumenous > 503-720-0690 (cell) > lavonnereimer (skype) > > www.lumenous.net > > > > _______________________________________________ > WG-UMA mailing list > WG-UMA(a)kantarainitiative.org > https://kantarainitiative.org/mailman/listinfo/wg-uma > > >

1 0

UMAnitarians at RSAC: Meet in person instead of telecon?
by Eve Maler 26 Feb '20

26 Feb '20

Do we have enough UMAnitarians in SF to make it worthwhile to try and get together Thursday morning for breakfast at, say, 8am instead of doing our call at 6:30am PT? *Eve Maler*Cell or Signal +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 1

Re: [WG-UMA] [projectvrm] A ... not sure what, exactly ... development in India
by Adrian Gropper 24 Feb '20

24 Feb '20

This is an important development in the global context of giving agency to individuals. Here is my current list of related initiatives. Note that all of these are works-in-progress. In no particular order: - US ACCESS Act https://blog.petrieflom.law.harvard.edu/2019/10/24/access-act-points-the-wa… - EU+ MyData Operators https://docs.google.com/presentation/d/1J71J8_8kSiIXmVXSkQbRixmv0rxQXC_d-I6… - EU Open Banking and PSD 2 https://www.altexsoft.com/blog/engineering/open-banking-and-financial-apis-… - India Open Banking https://www.bloomberg.com/news/articles/2020-01-13/india-s-about-to-hand-pe… - SSI and Rebooting Web of Trust https://github.com/WebOfTrustInfo/rwot10-buenosaires/blob/master/topics-and… - IETF Transactional Authorization https://tools.ietf.org/html/draft-richer-transactional-authz-03 The common thread across all of these is an authorization server acting on behalf of a data subject. This is a very different model from GDPR, HIPAA, CCPA, the proposed India Personal Data Protection Bill or the other 9 privacy bills being considered in Washington. - Adrian On Tue, Feb 11, 2020 at 2:07 PM LaVonne Reimer <lreimer(a)lumeno.us> wrote: > Thanks for bringing this to our attention. > > This is squarely my area (by way of Descant). I'm a bit crunched at the > moment so not able to provide a thorough analysis relative to VRM but if > you think back to everything I've said in past VRM days as well as on these > threads, it claims to provide a data facilitator platform congruent with > all that working code I've been sitting on for much too long! > > First, thoughts on the article. Then below that, a reference to the > Equifax announcement yesterday. > > A couple characteristics that fit the VRM way, and that are at least > implied in the article: > > - It revisits the flows of data for credit analysis "through the eyes > of" the subjects of the data. It's always important to question the extent > of this agency when it's banks rolling out the solution but the spirit of > subject-driven data flows seems to be present. > - It addresses a gap in data pipeline management on a narrower basis > than will be necessary to scale and than we offer via Descant. See the > specific reference to an India-specific requirement that financial data be > reported in a standard, machine-readable format. More on this below. > - It suggests consents will be easier to understand because data > subjects can choose to share portions of data. This is a very big challenge > and one we've largely solved by enabling UI/UX that spreads out consents > across touchpoints. Easier to provide for context-based consent in that > manner. It's not clear that India is thinking in these terms. Indeed the > intent seems to be that fintech startups will build apps on top of the > platform. Unless there are constraints on the spirit and intent of such > apps, they could be heading back to opacity with little opportunity to pull > it back. Also, more on this below. > > *Data pipeline management: * > Of all the big data challenges addressed over the past decade, pipeline > management has only recently popped up as a significant area. I have only > seen developments (and patent filings) for pipelines within enterprises. > The essence is that applying transformation, processing, and governance to > data while in motion streamlines its path to insights. As the category > implies, it's a more fluid approach to data management for sure as compared > to the old ETL model and arguably data lakes. > > A facilitator platform that replaces credit bureaus will need to > management multiple pipelines, each potentially presenting different levels > of privacy-sensitivity and latency concerns. The solution announced by this > article is a reasonable start but not as extensive as would be needed to > truly replace an Equifax. I didn't see a plan to, say, open source the > system so extensions for additional data pipelines could emerge. > > Note that this data challenge is not obviously about privacy but it is > critical if the goal is to replace intermediated data solutions. This is a > good a place as any to include a link to an opinion in yesterday's NYT > about the indictment of Chinese hackers for the Equifax breach. Author > makes the point that the whole model underlying Equifax and data brokers is > the problem. And that is a more complicated data pipeline problem than > consents. > > > https://www.nytimes.com/2020/02/10/opinion/equifax-breach-china-hacking.html > > *Context-based consent etc:* > Just adding a short note that I've been studying recent efforts to add > language to open source licenses that encompasses privacy, data rights, > and/or human dignity. As far as I can see, this is all new territory. In > the "humanitarian license," the author combines language from the MIT open > source license with language out of the UN's declaration of human rights. > So far OSI seems poised to reject it as a "blessed" open source license. > NYU School of Law also has some similar projects underway. > > I care about this because when I think about open sourcing the > data-sharing platform of Descant, I worry much more about extensions in > conflict with the ethos of people in charge of their own data than specific > uses of the source code. This goes to my concern that opening up for > fintech startups would be problematic if there's no way to police data > usage. > > Again, this is all off the top of my head. The title is correct that it is > better than the US but then we are a dark and surveilled country headed for > very bad days unless we can get a grip. > > Let me know of any questions/afterthoughts. > > Thanks again Doc!! > > LaVonne > 503-720-0690 > > On Tue, Feb 11, 2020 at 1:31 PM Doc Searls <anitadrink(a)gmail.com> wrote: > >> Headlines: >> >> India’s About to Hand People Data Americans Can Only Dream Of >> By Saritha Rai >> January 12, 2020, 11:01 PM EST >> • New system aims to protect data and unlock the credit market >> • India joins a growing movement to give consumers data control >> >> < >> https://www.bloomberg.com/news/articles/2020-01-13/india-s-about-to-hand-pe… >> > >> >> Anybody familiar with this want to lay it out in VRM terms (good, bad or >> otherwise)? >> >> Doc >> > > > -- > LaVonne Reimer, Founder > Lumenous > 503-720-0690 (cell) > lavonnereimer (skype) > > www.lumenous.net > >

2 2

FYI: New open-source UMA resource server
by Eve Maler 21 Feb '20

21 Feb '20

A LinkedIn post from Scott F: https://www.linkedin.com/feed/update/urn:li:activity:6633851062736482304/ *Eve Maler*Cell or Signal +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0

Draft minutes of UMA telecon 2020-02-13
by Eve Maler 13 Feb '20

13 Feb '20

https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2020-02-13 MinutesRoll call Quorum was reached. Approve minutes - - Approve minutes of UMA telecons 2019-10-03 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2019-10-03> , 2019-11-21 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2019-11-21> , 2019-12-05 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2019-12-05> , 2019-12-12 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2019-12-12> , 2019-12-19 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2019-12-19> Deferred. Fastest route to publishing current UMA relationship material? Relevant docs: - Business-Legal Framework and Use Cases <https://docs.google.com/document/d/1Accua4AWQrl6N0trjdj4NFA0fyDpOn2B1orupCu…> (GDoc) - Mapping Graphics <https://docs.google.com/presentation/d/1uigCMQI_TKuFyOstQTngYuZaqs36wwbE3BB…> (GSlides) - Legal Role Definitions <https://docs.google.com/presentation/d/1I12agEsfaJK3LEiJyROrJV3PCEmhlCzCxYS…> (GSlides) - Definitions and Use Cases Spreadsheet <https://docs.google.com/spreadsheets/d/1QT5LR_ibpwYwpD_XLQ1tB7OLXbdaT6Oi9aj…> (GSheet) Adrian is the common element between UMA and the DI world. He just reviewed an Indian privacy law. Several of the bills he has reviewed have an authorization server intermediary. They don't dictate technology, but they all have this characteristic. This is new as of the last year. This intermediary approach is gaining traction. Also, a lot of people are working on consent management. Google, IBM, likely Amazon, Microsoft, Salesforce, and Oracle are working on this. At least in healthcare and also more generally, giant platform vendors are desperate to introduce consent management solutions. These 4-7 "platform wannabes" for managing data that could be used for ML and decision support. Without "consent" (or something improved), open APIs enable massive access to personal data. In the case of highly sensitive data, the use case of encrypted data vaults is arising. The question of who pays for storage is arising: the individual or the service provider. In a storage medium that the RO doesn't control (call it an RS), the "cascading OAuth" type of model where the RS wants to assert its right to "mask" (prevent) access even if the RO wants to give access comes to the fore. Serious question: Should we be promoting the esoteric delegation use cases (the subject of our business-legal work), or is the time ripe to do more promotion of our basic use cases (Alice-Bob)? The latter sounds like it would be hugely beneficial. Nancy recommends making a presentation to the FAST (FHIR At Scale Taskforce) group <https://oncprojectracking.healthit.gov/wiki/pages/viewpage.action?pageId=43…>. Sal notes in the chat: "Look at the need of "operators", human-legal entity->policy- controller->(service) operator <- needs AS, perhaps... so then this is about the service context which would lead to a real customer.." He noted that there is a Kantara FIRE (Federated Identifiers for Resilient Ecosystems group that has produced a spec for Distributed Identity Assurance <https://kantarainitiative.org/confluence/display/WT/Draft+Recommendations?p…> (not related to UMA's distributed authorization model) as well. A subtlety that we have recognized is that Dr. Bob (RqP) might be using a client (the UMA client) and that Bob might be working on behalf of a different entity. "Just because you have a wallet doesn't mean you control the keys." Entity-to-wallet binding is a fundamental problem. Everything in DI is keys, and DPKI. The next subtlety is the difference between DIDs and VCs. Is the next step a webinar where we all (e.g., vendors) show our wares? Enthusiasm from Mike and Eve. GTM booted us off the call right at the bottom of the hour, but on Skype afterwards, Andi suggested that anyone at RSA get together on-site for further coordination. Attendees As of 16 Jul 2019, quorum <https://kantarainitiative.org/confluence/display/uma/Participant+Roster> is 5 of 9. (Domenico, Peter, Sal, Thomas, Andi, Maciej, Eve, Mike, Cigdem) 1. Domenico 2. Sal 3. Andi 4. Eve 5. Mike 6. Cigdem Non-voting participants: - Nancy - Adrian - Scott - Lisa *Eve Maler*Cell or Signal +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0

Agenda for UMA telecon 2020-02-13
by Eve Maler 12 Feb '20

12 Feb '20

https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2020-02-13 Date and Time - *Thursdays 6:30am PT (NEW TIME)* - Screenshare and dial-in: https://global.gotomeeting.com/join/857787301 - See UMA calendar for additional details: http://kantarainitiative.org/confluence/display/uma/Calendar Agenda - Roll call - Approve minutes of UMA telecons 2019-10-03 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2019-10-03> , 2019-11-21 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2019-11-21> , 2019-12-05 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2019-12-05> , 2019-12-12 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2019-12-12> , 2019-12-19 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2019-12-19> - Fastest route to publishing current UMA relationship material? - AOB *Eve Maler*Cell or Signal +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0

Planning future UMA meetings
by Eve Maler 10 Feb '20

10 Feb '20

Thanks to everyone who filled out the Doodle poll. The resulting matrix was interestingly challenging – sign of the times. :-) We can't accommodate everyone all of the time, but I believe we can optimize our opportunities by doing the following: - Move our "traditional" Thursday call a half-hour later, to 6:30am PT / 9:30am ET / 2:30pm UK / 3:30pm CET – could start this week - Officially change to a biweekly (fortnightly) schedule, to acknowledge reality – when there's a conflict or holiday, could move the meeting to the next week or could cancel, as necessary The people who said they could attend the new Thursday time besides myself are Sal, Andi, Nancy, Cigdem, Adrian, and Lisa. I'm willing to hold ad hoc sync meetings for those who can't make it when we can get critical mass, and adjust participants' voting status as necessary. Sound like a plan? *Eve Maler*Cell or Signal +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

2 1

Notes from 2020-01-28 UMA business-legal framework telecon
by Eve Maler 28 Jan '20

28 Jan '20

https://kantarainitiative.org/confluence/display/uma/UMA+legal+subgroup+not… 2020-01-28 Attending: Eve, Domenico, Colin, Tim, Lisa This is the last time we'll be meeting at this hour where it's the "biz-legal call". We'll see what the results of the Doodle poll are in terms of a new hour. Please fill out that poll <https://doodle.com/poll/th8ahr8dnqa8zi8u>! Tim likes that the Guardianship paper really wrestles with the temporal dynamics of guardianship. Tim had introduced the concept of "diachronic" issues in our work on the first Report, though it looks like the word itself didn't survive the editing process through to the final version. These aspects reflect (literal) life cycle changes that traditional IAM typically handles through workflow approvals and the like. Colin would have liked to see a reflection of existing work. Likely people are not fully understanding both UMA and OAuth, both of which handle delegation of authorization in some subtle ways. We need to make this really easy to understand with some demos. The very first step in a Me2B relationship, delegating a guardian – or other RRA (resource rights administrator) – relationship, is not yet today interoperable in an OAuth or UMA world. Does profiling OAuth with a claim representing this semantic make sense? We looked at the original NZ POC case study <https://kantarainitiative.org/confluence/display/uma/Case+Study:+Users+Mana…> to see if it had any examples of guardianship or interesting delegation. The Aroha/Bailey use case is about "classic" delegation of access, though it includes mobile notifications of IoT data, which is nice. The ministry of education/picking up kids use case is about chaining delegation. At Kantara we produce reports and specifications. We could analyze the use cases covered by the paper; our BLT work address guardianship along with various non-guardianship delegation use cases between data subjects and RRAs. UMA's architecture and Sovrin's architecture are pretty different. However, Identos has created an extension that seems to be potentially valuable in privacy-enhancing an UMA AS in an SSI-ish context, and Adrian and his cohorts have integrated uPort for providing RqP verifiable claims. We'd like to get a broader shared understanding in the group about these options. *Eve Maler*Cell or Signal +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0