- WG-UMA - mailman.kantarainitiative.org

Notes from UMA Legal telecon 2018-02-09
by Eve Maler 09 Feb '18

09 Feb '18

https://kantarainitiative.org/confluence/display/uma/UMA+legal+subgroup+not… 2018-02-09 Attending: Eve, Tim, Bjorn, Kathleen We don't yet have Tim in a WG leadership team <https://kantarainitiative.org/confluence/display/uma/Leadership+Team> role with a title! And he really deserves one. [image: (smile)] How about something like "legal adviser"? Let's bring that up at the next whole-of-WG call. AI: Eve: Bring up a motion on the next WG call about Tim's leadership team role. We made further tweaks to the 2018 charter refresh proposal <https://docs.google.com/document/d/1_kk8JLQZY-8eQfkWlMl0r7YJXN26dqAMTJBUMUm…> to reflect the Legal work stream. There's general agreement that the Consent Receipts format, so far, accounts for general opt-in consent as known and used today, but it doesn't account for the kind of scope-grained, asynchronous consent/authorization/policy setting and withdrawal that UMA enables. Things to consider in our business model: Can the ASO be a true Agent even in the use case where the ASO is, say, your IdP and wants to be your trusted AS, but doesn't hold any of your personal data? All your protected resources are held in third-party RS's, so the AS hooks up with them through PATs (OAuth) in an overt way. The challenges would be that the ASO can still learn about: - Which RS's Alice uses (Schwab vs. Fidelity) – could be tempted to sell this information to advertisers - Some notion of the nature of the protected resources, through the metadata uploaded as part of resource registration (e.g., see the HEART profiles, which point to FHIR Resource types) – would know what resource is an EHR – could be tempted to sell this information - The requesting parties associated with Alice and information about them (graphs of relationships), to the extent of whatever claims were collected – if the ASO isn't Facebook or Facebook-based claims aren't collected, this presumably limits the scope of discovery of who everyone is, but the risk is there The theory is that these risks could be managed much better in the case of a "personal authorization server" (which is what Adrian and Michael Chen have built into their HIE of One implementation) because the ASO's business model would not have to compromise for its *single* resource owner. Perhaps it's as simple as the "pie chart" showing the ratio of money-to-data-to-attention that the resource owner pays the service. If a SaaS company offers an AS to millions of potential ROs, and the business model is such that the ROs don't have to pay any money outright, then it's really hard for the ASO to be a true Agent. In other scenarios where the AS and the RS (or one of the RS's) are colocated, then the ASO is already "compromised" by this: - The ASO-that-is-also-the-RSO holds some/all of Alice's resources and thus can see that data (so "trust mitigations of trust attacks" – auditability of these relationships – may be needed) Further, if the ASO also runs the client (or one of the clients) that the RqPs use, then the ASO is already "compromised" by this: - The ASO-that-is-also-the-CO is gaining access to resources using tokens it issued itself (so "trust mitigations of trust attacks" – auditability of these relationships – may be needed) - Kathleen notes that they have been discussing signing of contracts Tim can join the WG calls as needed for when we combine this work with overtly technical topics. Kathleen (and Mohammad) generally can't join the Thursday calls, so we can either schedule ad hocs as necessary or perhaps use the Legal call time as necessary. (A reminder: Our "Legal role definitions" deck is here <https://docs.google.com/presentation/d/1I12agEsfaJK3LEiJyROrJV3PCEmhlCzCxYS…>. The paper will be published officially by next week, but you can also find the unofficial version, which has all the diagrams, in our mail archives here <https://docs.google.com/viewer?a=v&pid=forums&srcid=MDg2MjA2NjEyODIxNjA0NDI…> .) *AI:* Eve: Ask colleagues if their health IoT storyboard could be used as a starting point for the POC idea. *AI:* Eve: Reach out to Jim Hazard to alert him to the POC idea. *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0

Draft minutes of UMA telecon 2018-02-08
by Eve Maler 08 Feb '18

08 Feb '18

https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2018-02-08 MinutesRoll call Quorum was reached. Approve minutes Approve minutes of UMA telecon 2018-02-01 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2018-02-01>: Deferred. Charter updating Andi speaks in favor of putting all the design principles/requirements into the charter by value. It's a "historical document". Justin questions whether linking off to another document is valuable. If it doesn't add value, then it shouldn't be done. Eve asks whether we should vote to approve the "UMA Legal mission" statement as a new design principle. Then we could add it to the Requirements <https://kantarainitiative.org/confluence/display/uma/UMA+Requirements> document in any case. The text in the draft charter right now: "accelerating the ability of individuals, organizations, and legal representatives of them both to adopt, deploy, and use UMA-enabled services in a manner consistent with protecting privacy rights." A short phrase might be "Accelerate privacy protection in business". Is the candidate DP sufficiently distinct from other existing ones? Maybe not. We could also, if we want, update the approved requirements <https://kantarainitiative.org/confluence/display/uma/UMA+Requirements> to use UMA 2.0 technical language. *AI:* Eve: Revise the charter proposal <https://docs.google.com/document/d/1_kk8JLQZY-8eQfkWlMl0r7YJXN26dqAMTJBUMUm…> for consideration in next week's call. New UMA Server: Pauldron Is there interest in having Mohammad Jafari join us for a call to show us around Pauldron? It's listed on the Implementations <https://kantarainitiative.org/confluence/display/uma/UMA+Implementations> page. Yes; Eve will reach out. Attendees As of 7 Mar 2017, quorum is 4 of 7. (Domenico, Sal, Andi, Maciej, Eve, Mike, Cigdem) 1. Domenico 2. Sal 3. Andi 4. Maciej 5. Eve 6. Mike Non-voting participants: - Thomas - Justin - Scott F - *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 2

Fwd: 4 Days Left to Register Your SOUPS 2018 Paper Submissions!
by Eve Maler 08 Feb '18

08 Feb '18

FYI. Sorry for not having flagged this earlier. *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl ---------- Forwarded message ---------- From: Sonia Chiasson <sonia.chiasson(a)usenix.org> Date: Thu, Feb 8, 2018 at 9:53 AM Subject: 4 Days Left to Register Your SOUPS 2018 Paper Submissions! To: "eve(a)xmlgrrl.com" <eve(a)xmlgrrl.com> [image: SOUPS 2018, August 12–14, 2018, in Baltimore, MD, USA] <http://s.usenix.org/acton/ct/2452/s-0268-1802/Bct/l-1bc7/l-1bc7:db/ct0_0/1?…> Greetings, This is a final reminder to register your paper submissions for the Fourteenth Symposium on Usable Privacy and Security (SOUPS 2018 <http://s.usenix.org/acton/ct/2452/s-0268-1802/Bct/l-1bc7/l-1bc7:db/ct0_1/1?…>). The deadline to do so is this *Monday, February 12*. Paper registration is mandatory. Make sure to review the Call for Papers <http://s.usenix.org/acton/ct/2452/s-0268-1802/Bct/l-1bc7/l-1bc7:db/ct1_0/1?…> for submission instructions. You still have time to submit proposals for workshops, tutorials, and hackathons that support exploration and networking related to topics of interest to the usable privacy and security community. The proposal deadline is *Monday, February 26*. See the Call for Workshops, Tutorials, and Hackathons <http://s.usenix.org/acton/ct/2452/s-0268-1802/Bct/l-1bc7/l-1bc7:db/ct2_0/1?…> for details and information on how to participate. We look forward to receiving your submissions! Sonia Chiasson, *Carleton University* Rob Reeder, *Google* SOUPS 2018 Technical Papers Co-Chairs soups18chairs(a)usenix.org The email address sonia.chiasson(a)usenix.org is for automated list management only (e.g., email changes, unsubscribe requests). To contact the SOUPS 2018 Chairs, please use soups18chairs(a)usenix.org. This alias will reach Program Committee Chairs Sonia Chiasson and Rob Reeder, as well as General Chair Mary Ellen Zurko and Vice General Chair Heather Richter Lipford. About this mailing list: USENIX never shares, sells, rents, or exchanges email addresses of its members or conference attendees. We would like to continue sending you occasional email announcements like this one. However, if you no longer want to receive emails from USENIX, please click here <http://s.usenix.org/acton/rif/2452/s-0268-1802/-/l-1bc7:db/l-1bc7/zout?sid=…> to opt out. If you have any questions about the mailing list, please email office(a)usenix.org. We may also be reached via postal mail at: USENIX Association 2560 Ninth St, Suite 215, Berkeley, CA 94710, USA <https://maps.google.com/?q=2560+Ninth+St,+Suite+215,+Berkeley,+CA+94710,+US…>

1 0

Agenda for UMA telecon 2018-02-08
by Eve Maler 07 Feb '18

07 Feb '18

(I should have a draft charter-refresh proposal to y'all before the call.) https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2018-02-08 Date and Time - *Thursdays 9am PT* - Screenshare and dial-in: https://global.gotomeeting.com/join/857787301 - See UMA calendar for additional details: http://kantarainitiative.org/confluence/display/uma/Calendar Agenda - Roll call - Approve minutes - Approve minutes of UMA telecon 2018-02-01 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2018-02-01> - Charter updating - AOB *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0

Draft minutes of UMA telecon 2018-02-01
by Eve Maler 01 Feb '18

01 Feb '18

(NOTE: We decided to cancel the Legal call tomorrow.) https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2018-02-01 MinutesRoll call Quorum was reached. Approve minutes Approve minutes of UMA telecon 2018-01-18 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2018-01-18>: APPROVED. *Note:* Joint consent receipt ad hoc call happening in the next hour Note! (see calendar <https://kantarainitiative.org/confluence/display/uma/Calendar>) Legal update The Draft Report will be up shortly. Tim introduced Eve to an attorney who is interested in this work. 2018 charter and roadmap discussion - Joint consent receipt work - Legal/business/trust (related to the above) (see relevant issues <https://github.com/KantaraInitiative/wg-uma/issues?q=is%3Aopen+is%3Aissue+l…> ) - Extension opportunities (see relevant issues <https://github.com/KantaraInitiative/wg-uma/issues?q=is%3Aopen+is%3Aissue+l…> ) - What else? Mike has mentioned an extension idea around JSON Logic <http://jsonlogic.com/>, which describes a simple way to get AND/OR logic and has a lot of libraries. See this use of it <https://gluu.org/docs/ce/3.1.2/admin-guide/uma/#scopes-expressions>; the idea is that the RS could express that the user could have (or the resource is associated with?) scope X OR scope Y (or something like that). Mohammad Jafari has recently release a new UMA server called Pauldron <https://medium.com/@jafarim/introducing-pauldron-an-experimental-uma-server…> that implements some extension ideas. Eve and James have been discussing UMA requirements with some customers that may result in some extension proposals. We have saved off a variety of issues <https://github.com/KantaraInitiative/wg-uma/issues?q=is%3Aopen+is%3Aissue+l…> that might be interesting to look at once again. Justin notes that protected discovery may need some work. Profiles are also interesting. Many probably want to remain third-party, but it would be nice to point off to them. Financial use cases are interesting. The Pensions Dashboard use case starts with a phase that's "mostly plain OAuth" with a bit of stuff where UMA is helpful, but then proceeds to a classic Alice-to-Bob sharing flow. *AI:* Eve: Reach out to find what happened to the Pensions Dashboard profile doc and see if the WG should be pointing to it. So what's our list of anticipated activities? - Joint work with consent receipts - Legal/business/trust (consider changing subgroup name?) - Extension opportunities – decide which become work items as required - Promote adoption – could offer guidance on profiling and extension creation by third parties in various sectors (gov, fintech, healthcare...) - Promote interop? – known that it's challenging Our familiar discussion about interop: Cross-matrix testing is not that great an experience or productive. A test framework is better. UMA, like OAuth itself, is more challenging to test than something like OIDC (it can protect any API, and more, it has more moving parts that have to interoperate). Assumption: Only AS conformance testing would be on the table first, as only OP conformance testing was done for the first long while. Justin is involved in the OB testing effort. A lot of community members would be interested to throw in on a broader conformance testing effort. *AI:* Eve: Produce charter draft for review. Updates on auxiliary material editing if any No updates. (after end of call) Joint consent receipt/UMA ad hoc notes Attending: Andrew, Eve, Andi, Domenico, James, Justin, Sal, Tim, Colin Our previous notes are here <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2017-11-30> . Andrew: A consent receipt fits in as an interoperable security audit log entry. It has richness of detail so that it can be processed as something that goes beyond security use cases. The goal is to fulfill the individual's objectives. Andi: If a company gets a subject access request, what happens next? If the audit trail includes a consent receipt, isn't it still very valuable to them? Okay, so maybe "security" isn't the best word. The current design of Consent Receipts focuses on traditional opt-in consent. UMA is sort of more policy-driven. Regarding dictating flows and formats: Interacting claims gathering is outside the view/scope of UMA; a profile could dictate a particular thing happening. There are several "consent receipt"-ish formats extant. The Security Events WG formed a couple of years ago. We've identified more than just consents as artifacts deserving of "receipts". Would a security event token be appropriate, given this? Justin isn't sure that the SET is a good match at this point, actually. Eve: Muses about the scope of the UMA WG regarding "receipt workflow" sorts of work. Should we be thinking bigger regarding things like the shoebox endpoint (while keeping it appropriately modularized)? The regs that are dictating that a purpose statement be included (and have specific requirements) would seem to give problems to a RO-specified purpose (user-submitted terms). But why can't our license-based model carry a purpose? What if we were to propose a POC that develops an end-to-end technical artifact/legal device connection? Tim: Go for the gold and make it GDPR-ready! What would such a POC entail? Does it depend on a running UMA instance, and/or CommonAccord, and/or template clauses, and/or what exactly? It would need to demonstrate: - Some of the key mappings - A realistic and evocative business use case – EU jurisdiction and (which?) sector - A step-by-step end-user walkthrough with "receipts" that Alice (and Bob?) and Larry and Linda the Lawyers (for different parties – how many do we need?) find useful Eve has an UMA health+IoT+IRM demo that we could perhaps "port" to smart home for this purpose. Let's figure out next steps in the Friday calls, e.g. timeline and answering all the questions posed above. We decided that this served as our UMA Legal call for the week, [image: (smile)] and we'll cancel for tomorrow. Attendees As of 7 Mar 2017, quorum is 4 of 7. (Domenico, Sal, Andi, Maciej, Eve, Mike, Cigdem) 1. Domenico 2. Sal 3. Maciej 4. Eve 5. Mike Non-voting participants: - James - Justin - Mark - *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0

Agenda for UMA telecon 2018-02-01
by Eve Maler 01 Feb '18

01 Feb '18

https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2018-02-01 Date and Time - *Thursdays 9am PT* - Screenshare and dial-in: https://global.gotomeeting.com/join/857787301 - See UMA calendar for additional details: http://kantarainitiative.org/confluence/display/uma/Calendar Agenda - Roll call - Approve minutes - Approve minutes of UMA telecon 2018-01-18 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2018-01-18> - *Note:* Joint consent receipt ad hoc call happening in the next hour - Legal update - 2018 charter and roadmap discussion - Joint consent receipt work - Legal/business/trust (related to the above) (see relevant issues <https://github.com/KantaraInitiative/wg-uma/issues?q=is%3Aopen+is%3Aissue+l…> ) - Extension opportunities (see relevant issues <https://github.com/KantaraInitiative/wg-uma/issues?q=is%3Aopen+is%3Aissue+l…> ) - What else? - Updates on auxiliary material editing if any - AOB *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0

E-ballot to approve UMA Legal business model paper draft 7e as a Draft Report
by Eve Maler 29 Jan '18

29 Jan '18

Hi folks-- Attached is draft 7e of the business model paper (what we had been discussing as a "legal framework"). The UMA Legal subgroup has been working on this deliverable for some months. As I mentioned I'd be doing on the last call, since we didn't manage to get to a motion then, and don't have a call this Thursday, here is an e-ballot for approval of this document. On a personal note, I just want to commend and thank Tim R for all his hard work getting to this point. This electronic ballot is designed to conform to Kantara's Operating Procedures 2.0 <https://kantarainitiative.org/confluence/download/attachments/84279306/Kant…> (see Section 7.2). ==== Approve the attached document as a Draft Report and submit it to the Leadership Council. ==== WG voting participants (the current roster is here <https://kantarainitiative.org/confluence/display/uma/Participant+Roster>; eligible voters are Domenico, Sal, Andi, Maciej, Eve, Mike, and Cigdem), *please respond in this thread* with one of the following: [ ] Yes [ ] No *(you are encouraged to provide a rationale explaining why)* [ ] Abstain For the ballot to be valid, a majority of eligible voters must return a vote (including "Abstain"). For the ballot to pass, the "Yes" votes must exceed the "No" votes. This ballot closes at *11:59:59pm Pacific Daylight Time on Monday 29 January 2017*, or earlier at the Chair's discretion if all eligible voters have voted before that time. *Eve Maler*Cell +1 425.345.6756 <(425)%20345-6756> | Skype: xmlgrrl | Twitter: @xmlgrrl

7 10

Re: [WG-UMA] E-ballot to approve UMA Legal business model paper draft 7e as a Draft Report
by Eve Maler 29 Jan '18

29 Jan '18

Thanks, Mike! I added the WG just to have this in our archives. Eve (sent from my iPhone, possibly with Siri's "help": +1-425-345-6756) > On Jan 28, 2018, at 6:53 PM, Mike Schwartz <mike(a)gluu.org> wrote: > > > [X] Yes > > To approve draft 7e of the UMA business model paper. > > - Mike > > > ------------------------ > Michael Schwartz > Gluu > Founder / CEO > mike(a)gluu.org > https://www.linkedin.com/in/nynymike/

1 0

Money For Your Life: Understanding Modern Privacy ...
by John Wunderlich 22 Jan '18

22 Jan '18

FYI https://cyber.jotwell.com/money-life-understanding-modern-privacy/ Thanks, John 4giv spellin errurz from mobile devize -- This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. This message contains confidential information and is intended only for the individual named. If you are not the named addressee you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately by e-mail if you have received this e-mail by mistake and delete this e-mail from your system. If you are not the intended recipient you are notified that disclosing, copying, distributing or taking any action in reliance on the contents of this information is strictly prohibited.

1 0

Notes from UMA Legal telecon 2018-01-19
by Eve Maler 19 Jan '18

19 Jan '18

https://kantarainitiative.org/confluence/display/uma/UMA+legal+subgroup+not… 2018-01-19 Attending: Eve, Colin, Tim, Adrian, Mark, Kathleen Agenda: - Final edits to the business model doc draft 7c, taking into consideration comments collected during UMA telecon 2018-01-18 - Get the draft ready to send to WG members for review in PDF form so we can do an e-ballot for draft WG report publication *Regarding the Vermont legislation:* Though the overt focus is blockchain, Colin has some thoughts about the notion of a "personal identity trust company". Can we simply have a conversation with the legislators? Yes! Tim reads the bill as being about identity brokering. Which others could also provide input? Perhaps those with an eye on the legal landscape as well as identity and privacy. (John W?) The bill authors have expertise in banking law. Adrian could talk to them as well – turns out he's already aware of the effort. We don't want to necessarily derail their "blockchain" focus, but we want to introduce them to our notion of the ASO as an agent and the power of that. Colin can help with those experienced on the brokering side, and mentions some comparative country ID efforts. Adrian mentions India's identity system Aadhar and their efforts towards greater privacy; he's involved on the health records side. *AI:* Tim: Make introductions as appropriate between the Vermont legislators and the UMAnitarians. *Business model paper:* Elevator pitch in doc: *A Proposed Licensing Model for User-Managed Access* Can we describe our audience much more directly? Old: *This paper is intended for audiences who are business-knowledgeable and experienced with legal devices.* New: *This paper is intended for professionals in the areas of law, privacy, risk, compliance, security policy, and business policy, particularly those responsible for building and running UMA-enabled services.* Latest subtitle/elevator pitch: *How the UMA access sharing protocol together with a licensing model for personal digital assets enables user-centric control in the network-based information society* Mike's, with additions: *How UMA enables an individual to control access to their personal digital assets in the information society <<when UMA-enabled services are mapped to a licensing model>>* Playing around/discussion: *UMA protocol (associate it with "privacy" and "privacy instruments"?) and licensing model * Further work: *How licensing enables personal digital asset access control for individuals using services enabled by the UMA protocol, heightening privacy protection <<and compliance?>>* Arrgh, so close! Tim and Eve will try and wrap up all the remaining comments in the doc by Monday and get the e-ballot out. *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0