- WG-UMA - mailman.kantarainitiative.org

10 Sovereign Technology Components
by Adrian Gropper 05 May '16

05 May '16

https://docs.google.com/document/d/1q5BGr4THTPai-PKJLZ0_N1ZTsKDzBD795XPicCQ… is a short, editable document that attempts to define a sovereign technology based on work at this IIW. Blockchain, UMA, and FIDO can all be combined and understood as enablers of totally decentralized systems with no privacy policies or institutional contracts required. This paper that Doc pointed out http://papers.ssrn.com/sol3/papers.cfm?abstract_id=2744751 introduces the case for sovereign technology today: > "The basic economics of blockchain can be thought of the case for why > decentralized solutions to ledgers, now technically possible, are likely to > become increasingly cost effective compared to centralized solutions as > they run down three exponential cost curves: (1) Moore’s law (cost of > processing digital information, i.e. speed, halves every 18 months); (2) Kryder’s > Law (cost of storing digital information, i.e. memory, halves every 12 > months); and (3) Nielsen’s Law (cost of shipping digital information, > i.e. bandwidth, halves every 24 months) (Wiles 2015)" > All of us as individuals can now own sovereign technology if we want to. The only question is how much of our budget should be dedicated to sovereign technology. My interest is primarily around decision support for health, but this could just as well include VRM and advertising in general. A small investment in sovereign technology allows one to leverage a huge market impact on decision support services. A sovereign technology perspective helps inform our work on standards as well as privacy. It offers a new perspective on services that ask for prior consent as an alternative to respect for our technology as our agent in their data use and sharing transactions. Accounting for the 10 sovereign technology components enables us to apportion our technology budget appropriately and it makes it easier to interpret the privacy policies of the services we choose (or are forced) to grant access to our personal data. Please help improve this paper and suggest where we go from here. Adrian -- Adrian Gropper MD PROTECT YOUR FUTURE - RESTORE Health Privacy! HELP us fight for the right to control personal health data. DONATE: http://patientprivacyrights.org/donate-2/

1 0

Privacy policy or privacy notice: what's the difference? | CIO
by John Wunderlich 05 May '16

05 May '16

Useful reading. I’ve written both privacy policies and those things on web sites ‘called’ privacy policies. They are infrequently the same thing. This piece captures the difference reasonably well. http://www.cio.com/article/3063601/privacy/privacy-policies-and-privacy-not… Sincerely, John Wunderlich @PrivacyCDN Call: +1 (647) 669-4749 eMail: john(a)wunderlich.ca -- This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. This message contains confidential information and is intended only for the individual named. If you are not the named addressee you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately by e-mail if you have received this e-mail by mistake and delete this e-mail from your system. If you are not the intended recipient you are notified that disclosing, copying, distributing or taking any action in reliance on the contents of this information is strictly prohibited.

1 0

DG on Block Chain
by Mark Lizar - OCG 04 May '16

04 May '16

HI, A couple of quick items. 1. The DG is on the Agenda today in 15 min.. are one of you going to be present to talk about it? 2. would it be in the DG scope to include smart consent (in relation to block chain) as well as contract? Best, Mark

3 6

Notes from UMA legal telecon 2016-04-29
by Eve Maler 29 Apr '16

29 Apr '16

http://kantarainitiative.org/confluence/display/uma/UMA+legal+subgroup+note… 2016-04-29 - Accountability (data controller) vs. responsibility (data processor) in relation to the data subject (this topic came up at our UMA Legal IIW session) - Terminology <http://www.commonaccord.org/index.php?action=doc&file=GH/KantaraInitiative/…>: the next generation – can we tackle Grantee subtleties next? - What is the right structure for UMA Legal work and review? (this topic came up at our UMA Legal IIW session) Attending: Eve, John W, Adrian, Jon N, Mary, Dazza, Ann RACI charts map the responsible/accountable/consulted/informed split. We discussed at IIW22 how the accountable body, the data controller, would typically outsource to a third party, the data processor, some work. It's optional to outsource. Would could it possibly mean if Alice really runs her own AS (she's the ASO) and her own RS (she's the RSO)? Could the AS be viewed as a DP in any sense? We recognize that conceiving of the DS as a DC is really novel. The IIW microservices conversation is relevant to this because micro-level service conversations that go cross-domain don't yet have a "legal model" of personal data flow. Each RS seems naturally to be a DC. Okay, but what about the case where you have APIs that allow clients to put data back in to the service? E.g., if the API presents a POST-based call that lets a multitude of clients send various kinds of PII-bearing data to the service for safekeeping? A cloud file system is a great example; there are lots of third-party GDrive clients. Maybe there's some split of DC and DP roles among resource servers and clients for any one API, determinable by their contractual trust relationships. We didn't even list *RSO - Client Operator* as one of our trust relationships below, because so it's clearly out of our scope. An important note: Alice's interactions (in whatever technical or legal role) with the AS and RS are actually out of band; there are no UMA messaging arrows there. There's only "contractual" (or role?) and "regulatory" reality. John W is suggesting that we have two diagrams of UC1 (etc.), the current one and a new one that carries an analysis of how the DS, DC, and DP roles might map onto our roles. Jim and Thomas have an opportunity, if they wish, to bring it up at the GLTL MIT event they're attending next week. The exercise would be to map the flows of information represented in the use cases to the delegation of authority and responsibility represented by the model of authority and responsibility in the GDPR. Is the AS even anything in this system? Maybe nothing; it's novel. Jon N believes it doesn't add anything and could make things work. UMA brings something new, and the problem is of consent. The AS, in GDPR terms, must stand in for the DS, and the critical problem is that it may be difficult to make the case for this important role given the regulatory regime that never imagined this role. The AS needs to be the DS's "agent"! How can we achieve this? Let's seriously consider outreach on this score as part of our remit. Watch out for missing meetings in our schedule. *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0

Agenda for UMA legal telecon 2016-04-29
by Eve Maler 28 Apr '16

28 Apr '16

http://kantarainitiative.org/confluence/display/uma/UMA+legal+subgroup+note… 2016-04-29 - Accountability (data controller) vs. responsibility (data processor) in relation to the data subject (this topic came up at our UMA Legal IIW session) - Terminology <http://www.commonaccord.org/index.php?action=doc&file=GH/KantaraInitiative/…>: the next generation – can we tackle Grantee subtleties next? - What is the right structure for UMA Legal work and review? (this topic came up at our UMA Legal IIW session) *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

2 1

G2C attribute sharing use cases / OIX workshop event in London on May 5
by Eve Maler 24 Apr '16

24 Apr '16

Though the WG isn't meeting formally for a little while, we do always look for events where we can gather in person when possible, and another potential one has arisen. For those of you interested in attribute sharing use cases and where UMA might come into the picture, particularly in a government-to-citizen context, this is be one of the topics we'll explore at an OIX workshop on May 5th in London (that's just a couple of weeks from now): https://www.eventbrite.co.uk/e/oix-workshop-5th-may-2016-hosted-by-barclays… For some background on the motivations, you can check out this article: http://www.ukauthority.com/UKA-Local-Digital/Entry/5958/local-and-central-g… If you think you'll be there, let me know! *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0

Fwd: User-Managed Communications
by Mike Schwartz 21 Apr '16

21 Apr '16

Interesting ideas and comments from Igor Zboran -------- Original Message -------- Subject: User-Managed Communications Date: 2016-04-20 15:02 From: "Igor Zboran" <izboran(a)gmail.com> To: <mike(a)gluu.org> Hello Mike, It has been a while since I was active on the UMA WG. Most recently, I worked as a solutions architect on Privacy Box project for one big customer Orange SK, which is a Slovak mobile network operator. Privacy Box is a secure data storage built on the top of the Identity-Based Privacy [1] trusted model. During my work I was trying to evangelize OAuth2/UMA all the time but without any significant success. It was rather disappointing for me. Gradually, I've realized that there is a marketplace for User-Managed THIS AND THAT built on the top of the OAuth2 protocol. Getting it understood I've started to look at the UMA from a wider perspective. Then the idea of User-Managed Communications (UMC) Platform came up. It is a platform that brings together people, processes, data, and things in an intelligent, manageable and secure manner. You can find the basic info here: https://token7.com [2]. From my point of view, the most valuable UMC Platform feature is the federation support. You can find more info here: https://github.com/token-7/token7-specs/blob/master/draft-token7-oauth-toke… [3]. Just imagine it - with UMC Platform anybody can be a 'communications provider' on their own. Not for voice services but for various Internet of Everything services. Feel free to ask me anything if you are interested in UMC Platform. For the time being I prefer written communication because I am not fluent in spoken English. Best regards, Igor Zboran Solutions Architect Links: ------ [1] https://igi64.github.io/ibp.html [2] https://token7.com [3] https://github.com/token-7/token7-specs/blob/master/draft-token7-oauth-toke… -- ------------------------------------- Michael Schwartz Gluu Founder / CEO mike(a)gluu.org

1 0

Draft minutes of UMA telecon 2016-04-14
by Eve Maler 21 Apr '16

21 Apr '16

http://kantarainitiative.org/confluence/display/uma/UMA+telecon+2016-04-14 MinutesRoll call Quorum was reached. Approve minutes Approve minutes of UMA telecons 2016-03-24 <http://kantarainitiative.org/confluence/display/uma/UMA+telecon+2016-03-24> and 2016-03-31 <http://kantarainitiative.org/confluence/display/uma/UMA+telecon+2016-03-31>: They're approved. Wide ecosystem *Adrian's solution proposal* Alice has to have exactly one AS, and it has to work in a partitioned manner, such that Bob, the AS, and the RS have to work in a situation where they're on the same LAN with no Internet connectivity; this is required for #wideeco. Alice's AS has to be able to handle a client of Bob's if it's a web browser. Why the limited connectivity? Because if Alice decides that her AS wants to be on her phone vs. in the cloud, it may need to survive this lack of connectivity. Sal comments: The widest possible ecosystem would include examples of this, and there is some IoT that has this requirement, but this is not necessarily the best test of solutions for #wideeco. Eve wonders if we should be modularizing our problem space vs. bundling this challenge into #wideeco vs. in #IoT. Kathleen asks if this makes the ecosystem narrow vs. wide. What is the relationship between limited connectivity and the notion that Alice should ideally have exactly one AS? If the AS is "always on", then it would seem to be able to fulfill the needs of the other two components. If it has limited connectivity, then it would have problems whether Alice has one or more than one. Eve's solution proposal Alice's AS dynamically gets client credentials to Bob's claim sources. Lots of people have independently come up with this. In fact, MitreID Connect implements it. It's WebFinger-enabled. There's a constraint on the need to be in a canonical domain. (More notes may be coming from Sal.) Attendees As of 13 Apr 2016, quorum is 6 of 11. (François, Domenico, Kathleen, Sal, Thomas, Andi, Robert, Maciej, Eve, Mike, Sarah) 1. Domenico 2. Kathleen 3. Sal 4. Andi 5. Eve 6. Mike 7. Sarah Non-voting participants: - Scott - Justin - Adrian - Jin *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

2 1

[legal] No legal subgroup call this Friday after all
by Eve Maler 21 Apr '16

21 Apr '16

Sorry for the almost-late notice, but it seemed appropriate to cancel Friday's call as I won't have a chance to do any model text edits tomorrow because I'll be unavoidably offline all day, and I know Jim H. is really slammed with lots of other things. We do have a fair amount of model text progress to share at IIW (again, let's please meet near the barista early on Day 1 to discuss how to go about this), so let's do that. Thanks, *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0

Agenda for UMA legal telecon 2016-04-15
by Eve Maler 19 Apr '16

19 Apr '16

http://kantarainitiative.org/confluence/display/uma/UMA+legal+subgroup+notes Date and Time - *Fridays,* 8-9am PT - Voice: Skype: +99051000000481 or US +1-805-309-2350 (international dial-in lines <https://www.turbobridge.com/join.html>), room code 178-2540# - Screen sharing: http://join.me/findthomas - *NOTE:**IGNORE* the join.me dial-in line shown here in favor of the dial-in info above (Kantara "line C" and the Skype line) - UMA calendar: http://kantarainitiative.org/confluence/display/uma/Calendar 2016-04-15 - Grantee and Resource definitions; how to handle role stacking (Grantor can be Resource Subject, RSO can be ASO, etc.) – handle in a generic way? (see this thread <https://groups.google.com/forum/#!searchin/kantara-initiative-uma-wg/%5Bleg…> ) - (Based on input from Scott D.) RSO - ASO model clauses (original proposal <https://kantarainitiative.org/confluence/Newly%20revised%20versions%20of%20…> ): - How to parameterize to enable different legal models for handling the granting of "access"? - How to identify/parameterize to enable exceptions to normal access/non-access? (see decision tree <http://kantarainitiative.org/confluence/display/uma/UMA+legal+subgroup+note…> ) - How to handle notification requirements? Attending: ... *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 1