Subject: [saag] "Privacy in IETF Protocols" at IETF83

From: Henry Story <[email-masked]>
Date: Fri, 30 Mar 2012 05:24:49 +0200

I very much appreciated Ian Walden's talk today at IETF83 meeting in 
Paris [1] He mentioned that the EU directives made it a legal requirement 
to make the use of cookies transparent to the users. In the questions 
and answers session I mentioned work by Mozilla that gave a very good UI
demonstration of how this could be done. You can find the blog post by 
Azza Raskin where he developed this here:

  http://www.azarask.in/blog/post/identity-in-the-browser-firefox/

He was working on a more cookie oriented approach, but this would also work very
well for TLS, and there is an issue open for this on Google Chrome for example

  http://code.google.com/p/chromium/issues/detail?id=29784

It is good to see that the legislation is now providing an extra incentive to
for browser vendors to provide good clean transparent user interfaces.

 Henry

[1] picture of Ian Walden http://instagr.am/p/IwxJJQvhf6/

Social Web Architect
http://bblfish.net/

---

From: "Adam W. Montville" <[email-masked]>
Date: Fri, 30 Mar 2012 07:13:26 +0200

+1

Sent from my iPhone

On Mar 30, 2012, at 5:24 AM, Henry Story <[email-masked]> wrote:

> _______________________________________________
> saag mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/saag

---

From: Hannes Tschofenig <[email-masked]>
Date: Fri, 30 Mar 2012 09:42:46 +0300

Hi Henry, 

great to hear that you like this topic. 

The Internet Architecture Board (IAB) has spent some time thinking about how to consider privacy in the design of Internet protocols. We tried to take a structured approach to it. 

Here is it: 
http://tools.ietf.org/html/draft-iab-privacy-considerations-02

Looking forward to your comments.

Ciao
Hannes

---

From: Josh Howlett <[email-masked]>
Date: Fri, 30 Mar 2012 08:26:46 +0000

Hi Hannes,

I agree that this was a really great presentation. There were a couple of
things that Ian didn't mention that might be of general interest:

 * The proposed Data Protection Regulation will apply to non-EU entities
offering goods or services
to EU-based customers. Such entities are also required to provide an
equivalent level of protection to customers in other (non-EU)
jurisdictions.

 * Entities found in breach of the proposed Regulation can be fined up to
2% of annual global turnover

 * The US government has recently proposed a Consumer Privacy Bill of
Rights. One of my colleagues has compared this to the EU regulation; his
analysis is at 
http://webmedia.company.ja.net/edlabblogs/regulatory-developments/2012/03/1
4/us-consumer-privacy-bill-of-rights.

>The Internet Architecture Board (IAB) has spent some time thinking about
>how to consider privacy in the design of Internet protocols. We tried to
>take a structured approach to it.

"Privacy by design" is an excellent idea, but the existing directive and
proposed regulation are both sufficiently broad that any non-trivial
protocol will impose legal obligations on users; there are no technical
silver bullets and so we also need to develop smarter solutions at layer 9.

Josh.

Janet is a trading name of The JNT Association, a company limited
by guarantee which is registered in England under No. 2881024 
and whose Registered Office is at Lumen House, Library Avenue,
Harwell Oxford, Didcot, Oxfordshire. OX11 0SG

---

From: Hannes Tschofenig <[email-masked]>
Date: Fri, 30 Mar 2012 11:46:08 +0300

Hi Josh, 

it was a fun presentation. The link to the Internet protocol work was not really there. 

The challenge is that the privacy principles defined by OECD, EC, FTC, etc. are not directly applicable to what we do in the IETF (or anyone else in the technical community does). 

What Ian did not mention is that on paper everything looks pretty clear. 
When you look at the practice then things get rough.

> equivalent level of protection to customers in other (non-EU)

Correct. However, there are "escape-paths". The Safe Harbor  would be one such path. 

> 2% of annual global turnover

That's what the proposal says today but that's very likely to change. I had already changed from Dec. 2011 to Jan. 2012. 

> 4/us-consumer-privacy-bill-of-rights.
Thanks for the pointer. 

> silver bullets and so we also need to develop smarter solutions at layer 9.
We had tried to figure out what this "let us consider privacy throughout the process" actually means. 
Similar to security the story is not trivial. 

If folks would spend 30mins through our document then that should become clear. (You need additional 30min to look at the terminology document because speaking about "privacy" does not make sense -- you need to be more specific to convey a meaningful message.)

Ciao
Hannes