Subject: [atoca] My use cases

From: "Rosen, Brian" <[email-masked]>
Date: Thu, 17 Nov 2011 23:01:30 -0500

1) Hurricane/Tsunami warning - national authority, broadcast, no opt-in/opt-out
2) Hurricane warning for my daughter - national authority, sub/not, opt-in
3) Traffic Alert - local authority, broadcast, opt-in
4) Pre-School Closing - enterprise, sub/not, opt-in

---

From: Richard Barnes <[email-masked]>
Date: Fri, 18 Nov 2011 12:04:06 +0800

Do I sense a taxonomy?

On Nov 18, 2011, at 12:01 PM, Rosen, Brian wrote:

> _______________________________________________
> atoca mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/atoca

---

From: "James M. Polk" <[email-masked]>
Date: Thu, 17 Nov 2011 23:36:34 -0600

Brian

What prompted this outburst of 4 use cases to the list?

Each are fairly different and I can think of many use cases that 
aren't national (on the level of a Tsunami affecting the whole coast 
of a country) and aren't local (such as traffic alerts) or enterprise 
focused (school closings), and others that aren't so planned in timing.

These involve

- tornados (where I live, and where my daughter's college is).
- shootings or stalkers (again, where I live and where my daughter is).
- earthquakes
- floods, flash or just rivers rising
- volcanos
- lightning halting a sports game my daughter is playing in
- etc...

James

---

From: "Rosen, Brian" <[email-masked]>
Date: Fri, 18 Nov 2011 00:48:09 -0500

During the meeting, chairs asked for use cases to be listed as email to the list.

I think that there is no difference we care about between a national authority and a regional or local authority save the notion that we can have all of them.  So whether it's a NOAA weather alert, a state AMBER alert, or a local hazmat alert, they have the same properties = broadcast for the geographic area they affect with no opt-out, opt-in sub/not out of the area.

I think that once you get beyond the notion of government authority, you are into something I class as "enterprise", and you are likely in the sub/not opt-in only arena.  What differentiates these use cases is that they come from a distribution point that isn't tied to your ISP.

As long as "shootings and stalkers" are local government issued alerts, all but "lightening halts a sporting event" look like my first use case with a different level of government authority.

Brian

On Nov 18, 2011, at 12:36 AM, James M. Polk wrote:

> Each are fairly different and I can think of many use cases that aren't national (on the level of a Tsunami affecting the whole coast of a country) and aren't local (such as traffic alerts) or enterprise focused (school closings), and others that aren't so planned in timing.
> 
> These involve
>

---

From: Randall Gellens <[email-masked]>
Date: Thu, 17 Nov 2011 22:01:23 -0800

At 12:48 AM -0500 11/18/11, Brian Rosen wrote:

>  I think that there is no difference we care about between a 
> national authority and a regional or local authority save the 
> notion that we can have all of them.  So whether it's a NOAA 
> weather alert, a state AMBER alert, or a local hazmat alert, they 
> have the same properties = broadcast for the geographic area they 
> affect with no opt-out, opt-in sub/not out of the area.
>
>  I think that once you get beyond the notion of government 
> authority, you are into something I class as "enterprise", and you 
> are likely in the sub/not opt-in only arena.  What differentiates 
> these use cases is that they come from a distribution point that 
> isn't tied to your ISP.

So, the authorization for an alert in the case of government is up to 
the ISPs in an area within the jurisdiction?  And for 
enterprise/organizational alerts, presumably the alert servers are 
federated and have local authorization?

-- 
Randall Gellens
Opinions are personal;    facts are suspect;    I speak for myself only
-------------- Randomly selected tag: ---------------
I'm prepared for all emergencies but totally unprepared for
everyday life.

---

From: "Rosen, Brian" <[email-masked]>
Date: Fri, 18 Nov 2011 01:20:13 -0500

I think that the ISPs know who the local/regional/state/national authorities are, and can provide their credentials to endpoints.  I think "discovery" of an enterprise alert server is probably more conventional domain based and the act of subscribing establishes the credential exchange. While you don't really need object security for that case, I think we have it anyway for the broadcast case.

It's not a bad idea to have object security.  I'm not sure we really want to use some form of transport security if we have a good object security model.

So you get the credentials of the notifiers from the distribution point, and the objects are secured with those credentials.

Brian

---

From: "Carl Reed" <[email-masked]>
Date: Fri, 18 Nov 2011 09:16:18 -0700

For argument sake, should this group be defining alert use cases or should 
we be seeking well known, established and documented use cases? I suspect 
that many nations and jurisdictions have already defined use cases based on 
knowledge and requirements from the EM community.

Many are described in the ISCRAM proceedings:
For example: 
http://www.iscram.org/ISCRAM2009/papers/Contributions/167_CAP-ONES%20An%20Emergency%20Notification%20System_Malizia2009.pdf

And of course the US Government:
http://www.fema.gov/library/viewRecord.do?id=3999
http://clarus.meridian-enviro.com/nwpassage/files/NWPassage_ClarusUseCaseScenarios.pdf

And I know, based on discussions with the alerting community in Canada as 
part of ongoing CAP work, that are some excellent use cases defined by the 
Canadian alerting community.

And of course a variety of international activities such as those in GEO, 
WMO, and INSPIRE:

For example: 
http://www.wmo.int/pages/mediacentre/factsheet/Earlywarning_en.html

Cheers

Carl

-----Original Message----- 
From: Rosen, Brian
Sent: Thursday, November 17, 2011 11:20 PM
To: Randall Gellens
Cc: [email-masked]
Subject: Re: [atoca] My use cases

I think that the ISPs know who the local/regional/state/national authorities 
are, and can provide their credentials to endpoints.  I think "discovery" of 
an enterprise alert server is probably more conventional domain based and 
the act of subscribing establishes the credential exchange. While you don't 
really need object security for that case, I think we have it anyway for the 
broadcast case.

It's not a bad idea to have object security.  I'm not sure we really want to 
use some form of transport security if we have a good object security model.

So you get the credentials of the notifiers from the distribution point, and 
the objects are secured with those credentials.

Brian

---

From: Marc Linsner <[email-masked]>
Date: Fri, 18 Nov 2011 12:43:33 -0500

Carl,

IMO, this group should be both collecting use cases from other
organizations plus defining our own.  The issue with some use cases, they
are defined to match the available capability.  We don't want to limit
capability due to limiting use cases.

-Marc- 

-----Original Message-----
From: Carl Reed <[email-masked]>
Date: Fri, 18 Nov 2011 09:16:18 -0700
To: "Rosen, Brian" <[email-masked]>, Randall Gellens
<[email-masked]>
Cc: <[email-masked]>

>http://www.iscram.org/ISCRAM2009/papers/Contributions/167_CAP-ONES%20An%20
>Emergency%20Notification%20System_Malizia2009.pdf
>

---

From: "Carl Reed" <[email-masked]>
Date: Fri, 18 Nov 2011 11:29:54 -0700

Marc -

Good point. Thanks

Carl

-----Original Message----- 
From: Marc Linsner 
Sent: Friday, November 18, 2011 10:43 AM 
To: Carl Reed 
Cc: [email-masked] 
Subject: Re: [atoca] My use cases 

Carl,

-Marc- 

-----Original Message-----
From: Carl Reed <[email-masked]>
Date: Fri, 18 Nov 2011 09:16:18 -0700
To: "Rosen, Brian" <[email-masked]>, Randall Gellens
<[email-masked]>
Cc: <[email-masked]>

---

From: Richard Barnes <[email-masked]>
Date: Sat, 19 Nov 2011 15:24:42 +0800

I haven't read through Carl's references, but my guess would be that what we want to define here is probably more general than those cases.  So we should definitely take them into account, with an eye toward abstracting out the key features that we want to create.

--Richard

---

From: "Rosen, Brian" <[email-masked]>
Date: Sun, 20 Nov 2011 10:10:43 -0500

The use cases we are looking for now define our scope.

I have no problem with gleaning what we can from other's work.

I do think we have tried to include use cases beyond what is traditionally defined as authority to citizen alerting.

Right at the moment, we're mostly checking to see that we agree on scope.

Brian

On Nov 18, 2011, at 11:16 AM, Carl Reed wrote:

> For argument sake, should this group be defining alert use cases or should we be seeking well known, established and documented use cases? I suspect that many nations and jurisdictions have already defined use cases based on knowledge and requirements from the EM community.
> 
> For example: http://www.iscram.org/ISCRAM2009/papers/Contributions/167_CAP-ONES%20An%20Emergency%20Notification%20System_Malizia2009.pdf
> 
> And I know, based on discussions with the alerting community in Canada as part of ongoing CAP work, that are some excellent use cases defined by the Canadian alerting community.
> 
> And of course a variety of international activities such as those in GEO, WMO, and INSPIRE:
> 
> For example: http://www.wmo.int/pages/mediacentre/factsheet/Earlywarning_en.html
> 
> Cheers
> 
> Carl
> 
> 
> -----Original Message----- From: Rosen, Brian