- WG-UMA - mailman.kantarainitiative.org

UMA interfaces diagram
by Eve Maler 13 Oct '15

13 Oct '15

I’ve been working on a diagram that tries to describe how an UMA AS is also an OAuth AS and RS underneath, etc. This has been percolating in my brain for possibly YEARS. Please let me know if it’s useful, and if it could be improved. I often find myself having to point out that an UMA RS "acts in the role of an OAuth client” when it uses a PAT at the UMA AS, but this finally explains the rest of the story… :-) Eve Eve Maler | cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl | Calendar: xmlgrrl(a)gmail.com

3 6

Notes from UMA legal subgroup telecon 2015-10-09
by Eve Maler 13 Oct '15

13 Oct '15

Fri Oct 9 8-9am PT Voice: Skype: +99051000000481 or US +1-805-309-2350 (international dial-in lines <https://www.turbobridge.com/join.html>), room code 178-2540# Screen sharing: http://join.me/findthomas <http://join.me/findthomas> - NOTE: IGNORE the join.me <http://join.me/> dial-in line shown here in favor of the dial-in info above (Kantara "line C" and the Skype line) UMA calendar: http://kantarainitiative.org/confluence/display/uma/Calendar <http://kantarainitiative.org/confluence/display/uma/Calendar> How have we done on our next steps? Everyone please contribute “mile-wide, inch-deep examples on contract terms examples across all three meta-use cases — at least one of each kind (IT’S NOT TOO LATE! :-) ) Jim H walks through his Common Accord structure and examples to help us capture our examples and understand all of his Attending: Eve, Andrew Hughes, Steve, Adrian, Mark, Tim, Jim, Jon, Dazza, Ann, Scott, Mary Hodder Jim and Adrian have sent out a putative “Simplest Possible UMA Contract <https://docs.google.com/document/d/1IvuencOdrtShE6FCIu9v5eTO3Qjl4i1JnaDnCXC…>” document that structures a healthcare Release of Information form along the lines of an “imagined UMA” that does things that UMA today doesn’t do (as Adrian cautions, don’t get caught up in the technicalities). It uses the CommonAccord <http://new.commonaccord.org/index.php?action=list&file=GHx/KantaraInitiativ…> framework/data model for a mapping to the Restatement of Agency work that Adrian and Eve had attempted previously. Which meta-use case(s), if any, does this text address? It seems like it’s about RS-AS; we talked about it last time. There’s been some discussion about herd immunity, where some parties engage in selfish behavior, and if enough of them do, then other free riders can benefit such that the aggregate risk reduction ends up having selfless aspects (Scott’s “stopping at red lights” example). There can be a “tragedy of the commons” problem if there’s over-engagement in the behavior that doesn’t confer herd immunity. So the desirable behavior that weighs on the side of risk reduction has got to be valuable in and of itself often enough. The incentives have to be high enough. Put another way, as seen as is being sought with certification programs, UMA adoption should be able to drive "network effects”. The idea is that similarity of bankruptcy clause, notice clause, etc. is what gives the aggregate value. It’s “legal interoperability”. Jim’s work lets us slice and dice contracts. We drilled down on the RO-RS portion of the text, which leads to the CommonAccord framework portions that modularly lead to constructed contracts. E.g., RO Alice has this first name and this last name, and live in Dallas. Dallas, of course, is in a particular jurisdiction. Different jurisdictions have wildly different implications. The way the framework works, the “Source" is hosted on GitHub, and Jim’s site pulls it in. It can be “Edit”ed right there. The “Document” view dereferences the pointers in the source. Jim got into doing this through the “smart contracts” path in a blockchain context, though this is not technically an instance of that. Knowing that the latest Safe Harbor news has upset the current ecosystem, it appears there may be an appetite to restate the requirements in a new way. Suddenly some parties may not be well served by the way legal text is handled in the current system. With consent receipts in the picture, does it make sense to have a CommonAccord way to capture agreements and receipts? This may indeed be productive. Effectively, GitHub can be the audit log. And then, of course, the logs have to be mutually available to the parties, nonrepudiable, and tamper-proof. Blockchain technology could come into play here. An escrow agent role can make sense (again, blockchain is relevant here). There’s a larger ecosystem of contracts management and vendor management in which (e.g.) hospitals already have to operate, so whether UMA is used or not, a system like this one could be relevant if it lowers cost and friction. But then if UMA uses it, it becomes more attractive. Thinking of blockchain as a ledger, the ledger is not the actual money. A ledger has a separate value that can be measured and acquired. What sorts of deliverables should we consider producing? Some options… Previously produced: Auditable junctures in the protocol (the UMA “state changes” to which we attached some clauses in Binding Obs) Previously produced: An indivisible set of “axiomatic” clauses we thought deployers of UMA should adopt (the Binding Obs clauses - dependent on #1) Future option: Specific auditable junctures that should have consent receipts attached to them (build on #1?) Future option: CommonAccord-expressed consent receipts Future option: Recommendations about how to literally store and manage these consent receipts in CommonAccord (build on #4?) Future option: Recommendations about specific language that meets our meta-use cases and business models The EU has model clauses. Could we build on those? The “boring approach” is to get agreement on the things that matter the least. It won’t solve our problems, but it starts to build a solution and gets some success. AI: Jim, Eve (and invite Jon and Dazza and Steve): Whip up some model clause thinking for the subgroup next week. Eve to send an invite for a midweek ad hoc to do preparatory work. AI: Adrian, Eve: Document the delta between the UMA-that-is and the UMA-that-is-posited by this new doc. Eve Maler | cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl | Calendar: xmlgrrl(a)gmail.com <mailto:xmlgrrl@gmail.com>

3 9

Voluminous email and syncing up
by Eve Maler 12 Oct '15

12 Oct '15

I was just chatting with a non-voting participant who (quelle surprise) is finding it hard to keep up with the email volume and work outputs, and I suggested that joining the fortnightly “APAC-friendly sync meetings” could be a good way to catch up. Even if you’re not in an APAC-ish time zone (admittedly they’re not very Europe-friendly), if you’d like to join these meetings to get a succinct recap of the latest work and weigh in briefly, I’d be happy to put you on the invitations. For non-APACers, they are 4-5pm PT/7-8pm ET on Wed Oct 14, Wed Oct 28, etc. Eve Eve Maler | cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl | Calendar: xmlgrrl(a)gmail.com

1 0

New Post: How Safe Harbor’s Death Empowers Non-Europeans and Spawns Innovation
by Neiditz, Jon 12 Oct '15

12 Oct '15

With encouragement from Jim Hazard, I just posted this for the world to get maximum UMA mileage/leverage from the mass migration to model clauses following last week’s radical Safe Harbor decision: https://www.linkedin.com/pulse/how-safe-harbors-death-empowers-non-european… This is a take that has apparently eluded the thousands of other commentators on Safe Harbor. Please let me know what you think! Thanks and best, Jon [Kilpatrick Townsend LLP] Jon Neiditz Kilpatrick Townsend & Stockton LLP Suite 2800 | 1100 Peachtree Street NE | Atlanta, GA 30309-4528 office 404 815 6004 | cell 678-427-7809 | fax 770 234 6341 jneiditz(a)kilpatricktownsend.com<mailto:jneiditz@kilpatricktownsend.com> | My Profile<http://www.kilpatricktownsend.com/en/Who%20We%20Are/Professionals/N/Neiditz…> | vCard<http://www.kilpatricktownsend.com/_assets/vcards/professionals/NeiditzJonat…> [cid:image003.png@01D104D7.8F963280]<https://www.linkedin.com/in/informationmanagementlaw> [cid:image005.png@01D104D7.8F963280] <http://www.twitter.com/jonneiditz> ________________________________ Confidentiality Notice: This communication constitutes an electronic communication within the meaning of the Electronic Communications Privacy Act, 18 U.S.C. Section 2510, and its disclosure is strictly limited to the recipient intended by the sender of this message. This transmission, and any attachments, may contain confidential attorney-client privileged information and attorney work product. If you are not the intended recipient, any disclosure, copying, distribution or use of any of the information contained in or attached to this transmission is STRICTLY PROHIBITED. Please contact us immediately by return e-mail or at 404 815 6500, and destroy the original transmission and its attachments without reading or saving in any manner. ________________________________ ***DISCLAIMER*** Per Treasury Department Circular 230: Any U.S. federal tax advice contained in this communication (including any attachments) is not intended or written to be used, and cannot be used, for the purpose of (i) avoiding penalties under the Internal Revenue Code or (ii) promoting, marketing or recommending to another party any transaction or matter addressed herein.

3 2

UMAnitarian available to speak on UMA and PDS for conference in Japan December 2?
by Eve Maler 11 Oct '15

11 Oct '15

An opportunity has arisen to speak at the World Engineering Conference and Convention <http://www.wecc2015.info/index.html> in Kyoto on December 2, on using UMA for consent management in the personal data store context, in a session <http://www.wecc2015.info/program/oral/dec_2.html> on information security and privacy. (Thomas Hardjono was originally slated to appear at the conference, but is unable.) I’m told there is funding to partially reimburse flight and accommodation, and that the WECC event expects 2000 participants and even an appearance by a Japanese royal family member at the opening ceremony. If you’re interested and able, can you please get in touch with me immediately so that I can connect you with the organizers? There is a wealth of UMA outreach material available to build on, such as our webinar slides, to help you in preparing materials, and I’m happy to offer assistance. Thanks in advance! Eve Eve Maler | cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl | Calendar: xmlgrrl(a)gmail.com

1 0

Introducing myself - Andrew Johnston
by Andrew Johnston 09 Oct '15

09 Oct '15

Hello everyone, I'm excited to have joined this UMA Working Group. I look forward to working with you all as UMA matures and grows. I've only been receiving mailing-list messages for about 24 hours so far, and I'm already regretting not having joined sooner. The thoughts, ideas, and challenges have all broadened my perspective. My employer, TELUS, has recently become a member of the Kantara Initiative, particularly to encourage support for the evolution and adoption of UMA. A formal announcement is in the works. We're working at the moment on an effort with a strategic customer, and we've demonstrated that UMA can help us address some particular challenges. We've created a prototype UMA Authorization Server, and a number of sample Resource Servers and Clients to demonstrate some of UMA's applicability to our problem set. I hope my experience with this effort, will add some value to this group's good work. Best regards, Andrew Andrew Johnston Principal Technology Architect Chief Technology Office TELUS T: +1.647.837.8198 | M: +1.416.684.8738 andrew.johnston(a)telus.com<mailto:andrew.johnston@telus.com>

2 1

Simplest Practical UMA Legal Contract
by Adrian Gropper 08 Oct '15

08 Oct '15

Just in time for our conversation about CommonAccord tomorrow, Jim and I have updated some work I started with Eve a while ago. https://docs.google.com/document/d/1IvuencOdrtShE6FCIu9v5eTO3Qjl4i1JnaDnCXC… Adrian <http://patientprivacyrights.org/donate-2/>

1 0

Reminder: UMA legal subgroup telecon 2015-10-09
by Eve Maler 08 Oct '15

08 Oct '15

Fri Oct 9 8-9am PT Voice: Skype: +99051000000481 or US +1-805-309-2350 (international dial-in lines <https://www.turbobridge.com/join.html>), room code 178-2540# Screen sharing: http://join.me/findthomas <http://join.me/findthomas> - NOTE: IGNORE the join.me <http://join.me/> dial-in line shown here in favor of the dial-in info above (Kantara "line C" and the Skype line) UMA calendar: http://kantarainitiative.org/confluence/display/uma/Calendar <http://kantarainitiative.org/confluence/display/uma/Calendar> How have we done on our next steps? Everyone please contribute “mile-wide, inch-deep examples on contract terms examples across all three meta-use cases — at least one of each kind (IT’S NOT TOO LATE! :-) ) Jim H walks through his Common Accord structure and examples to help us capture our examples and understand all of his Eve Maler | cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl | Calendar: xmlgrrl(a)gmail.com

1 0

REVIEW NOTICE: UMA Draft Specification Document and IPR Review
by Joni Brennan 07 Oct '15

07 Oct '15

Dear Kantara Initiative Members and Community: This is a formal notification that the UMA Work Group has approved the following documents as Working Group Draft Specifications for public comment and IPR Review: Title of Documents (click the titles to view the documents): - User-Managed Access (UMA) Profile of OAuth 2.0 V1.0.1 <https://docs.kantarainitiative.org/uma/draft-uma-core-v1_0_1.html> - OAuth 2.0 Resource Set Registration V1.0.1 <https://docs.kantarainitiative.org/uma/draft-oauth-resource-reg-v1_0_1.html> In accordance with the Katnara Initiative Operating Procedures, this email initiates a review and comment period of 45 days on these documents. Comment and IPR Review: - Opens: Today, Friday, 18 September 2015 - Closes: Monday, 2 November 2015, 23:59 Pacific Time To comment on these Draft Recommendations use one of the following options for participation: 1. Use the comment form: http://contact.kantarainitiative.org/comment/ 2. Send your comment via email to support @ kantarainitiative.org with the subject “UMA WG COMMENT SUBMISSION" NOTE: We are aware of the formatting issue resulting in some space characters showing up as question marks. We will solve this problem before final publication. IPR NOTICE: UMA WG Participants <http://kantarainitiative.org/confluence/display/uma/Participant+Roster> are required to make claims to IPR regarding these technical documents. If you are not an UMA WG Participant you have no IPR licensing obligation to any of these documents. If you wish to submit an IPR claim please do the following: 1. IPR Claims may be sent to support @ kantarainitiative.org with the subject “UMA WG IPR CLAIM” Happy reviewing and best regards, Joni Brennan Kantara Initiative | Executive Director email: joni @ kantarainitiative.org Connecting Identity for a more trustworthy Internet - Overview <http://www.slideshare.net/kantarainitiative/kantara-overview2014-37969351>

1 1

The Death of Safe Harbor is the Ultimate VRM and UMA Legal Opportunity
by Neiditz, Jon 07 Oct '15

07 Oct '15

Why? The Advocate General's opinion and the Court's decision both turn on the inability of Safe Harbor to prevent surveillance. NO permitted basis for data transfer prevents surveillance, not Model Clauses, not Binding Corporate Rules (BCRs). Logically, if probably not in immediate corporate and EU national practice, the only bulletproof basis for data transfer to the US is now the ever-so-revocable CONSENT, which presumes no fictitious protection from surveillance. See also: https://www.linkedin.com/pulse/good-morning-safe-harbor-dead-what-does-mean… Your thoughts? Jon Neiditz Kilpatrick Townsend & Stockton LLP Suite 2800 | 1100 Peachtree Street NE | Atlanta, GA 30309-4528 office 404 815 6004 | cell 678-427-7809 | fax 770 234 6341 jneiditz(a)kilpatricktownsend.com | www.kilpatricktownsend.com ________________________________ Confidentiality Notice: This communication constitutes an electronic communication within the meaning of the Electronic Communications Privacy Act, 18 U.S.C. Section 2510, and its disclosure is strictly limited to the recipient intended by the sender of this message. This transmission, and any attachments, may contain confidential attorney-client privileged information and attorney work product. If you are not the intended recipient, any disclosure, copying, distribution or use of any of the information contained in or attached to this transmission is STRICTLY PROHIBITED. Please contact us immediately by return e-mail or at 404 815 6500, and destroy the original transmission and its attachments without reading or saving in any manner. ________________________________ ***DISCLAIMER*** Per Treasury Department Circular 230: Any U.S. federal tax advice contained in this communication (including any attachments) is not intended or written to be used, and cannot be used, for the purpose of (i) avoiding penalties under the Internal Revenue Code or (ii) promoting, marketing or recommending to another party any transaction or matter addressed herein.

7 13