Subject: Consent

From: Adam Shostack <[email-masked]>
Date: Mon, 20 Aug 2001 14:46:16 -0400

I'm finding myself asking a lot of questions about what people mean by
phrases they use including the word "consent."

May I suggest that we use the following terminology:

Consentual-disclosure:  The end-user has chosen to reveal
information.  This choice is freely given, not mandated or required. 

Mandated-disclosure:    There is a legal requirement to reveal
information.

Needed-disclosure: There is a requirement to reveal the
information in order to make the service work.  For example, if I call
1-800-find-gas to get the nearest gas station, I may expect that my
location will be transmitted.

Explicit-consent-action: The user performs a GUI action to reveal or
conceal information at the time of the request

Default-conset-action: The user has set a preference for some
recipient, class of recipient, etc. 

Adam

---

From: "James M. Polk" <[email-masked]>
Date: Mon, 20 Aug 2001 14:07:56 -0500

Adam

I'm glad someone brought this up as a starting point for discussion....
comments below

>information.  This choice is freely given, not mandated or required. 

But is this given explicitly or implicitly (and yes I've read below)? Is
everyone defaulted to be allowed or not-allowed to discover location of
another. What about in letting others discover my location?

>Mandated-disclosure:    There is a legal requirement to reveal

again, explicitly or implicitly?

>recipient, class of recipient, etc. 

*************************************
"People generally demand more respect for their own rights than they are
willing to allow for others"

James M. Polk
Consulting Engineer
Office of the CTO

Cisco Systems
18581 N. Dallas Parkway
Dallas, Texas 75287
w) 972.813.5208
f)  972.813.5280
www.cisco.com

---

From: "Chris M. Lonvick" <[email-masked]>
Date: Mon, 20 Aug 2001 15:18:26 -0500

Hi Adam,

>Mandated-disclosure:    There is a legal requirement to reveal

I'm not sure that I'd go along with the word "legal".  What may be 
a legal requirement in country ABC may not be a legal requirement 
in country XYZ.  In either case, the law may, or may not, be the
requirement for "mandated-disclosure".  

I believe that what you are trying to say is something like: If you
are in the US, and you have a cell phone, then you should know (by
reading the contract?) that your location will be revealed if you
dial an emergency number.  However, in country DEF there may be no
laws governing the location disclosure when a subscriber dials an
emergency number, yet the service provider mandates it anyway (and
should note that in their contract).

It may just avoid some confusion if any documents produced from this 
group were to not base anything upon "legal requirements".  Perhaps 
a better definition may be:

Mandated-disclosure:    There is a policy requirement from the
provider of the service to reveal information.  This may be from
their adherence to local laws.

Somewhat related, the IAB and IESG have already said this on the
subject:
"    The IETF, an international standards body, believes itself to be
     the wrong forum for designing protocol or equipment features that
     address needs arising from the laws of individual countries,
     because these laws vary widely across the areas that IETF standards
     are deployed in."
-RFC 2804

I think your definitions are on track.

Thanks,
Chris

---

From: Adam Shostack <[email-masked]>
Date: Wed, 22 Aug 2001 14:57:48 -0400

> another. What about in letting others discover my location?

I think there are two issues, one of which is how we reach a consent
decision, and then second, what we do with it.  This set of ideas was
(implicitly) designed for signalling what form of consent is being
asked for or assumed.

My location is personally identifiable information in which I have a
strong privacy interest.  Under the Fair Information Practices, I need
to have notice and consent if that information is given to others.
There are exceptions, such as for law enforcement or 911, which is why
theres the mandated-disclosure category.

If we can agree that these are useful categories, we can start to
decide how to put things into categories and use them.

I think that in Europe, Canada, Australia, and other places where data
protection laws apply to private firms, the default would need to be
that your consent is required before the disclosure of information to
friends, family, or companies that want to see it.

> again, explicitly or implicitly?

I'm not sure I understand your question.  How can a law imply that you
must do something?  Don't laws need to be explicit?

If you're asking in the context of a protocol, then I think that a
disclosure is mandated by law should accompany 
- the demand for data (if the end user device is involved in the
request, the user preference software can't ignore it.  There are also
authorization requirements, otherwise I'll just tag all my packets
with a mandatory bit)

- the data as it goes elsewhere.  The fact that it was demanded
probably places limits on how it can be used and revealed onwards.
For example, while there are a set of uses for E911 data that have
been listed, the fact that I dialed 911 should not mean that the
service provider can now reveal my location to starbucks.

Adam

-- 
"It is seldom that liberty of any kind is lost all at once."
					               -Hume

---

From: Adam Shostack <[email-masked]>
Date: Wed, 22 Aug 2001 15:16:30 -0400

> requirement for "mandated-disclosure".  

These are excellent points, and they make adding authorization to a
mandated-disclosure request difficult.

> should note that in their contract).

Thats not quite it.  If you are in the US and you have a cell phone,
then it does not matter if you know your location will be revealed if
you dial an emergency number.  The E911 regulations require that your
location be revealed, and you don't get a choice, and you might not
even be entitled to notification.

Lets take EU and Mexico as two examples as how the latter (DEF case)
might work.  The EU has data protection laws which apply to the
private sector.  As far as I know, Mexico does not.

In DEF-EU, I think it would be tricky (absent E911-like rules) to
claim that a disclosure is mandatory, because I have a privacy right
to notice and choice that the company can not arbitrarily override.

In Mexico, without data protection law, then you might be able to use
the mandatory bit.   I think that using needed-disclosure would be
better, because it would reduce the likelyhood that somone would hack
their software to override the mandated bit.

> their adherence to local laws.

I think it may be useful to distinguish between the contractual and
legal obligations, because I may be willing to disregard one and not
the other.

>      because these laws vary widely across the areas that IETF standards

Thanks for pointing that out.  I feel somewhat odd, because I'm basing
some of my arguments on national laws, knowing full well what 2804
says, and having participated (marginally) in the raven discussions
that led to it.  However, the laws I'm working from are laws which do
not vary widely in those places where they are.  That is, countries
will either have a privacy law, which is based on the fair information
practices, or they don't have a privacy law at all.  So, if there is a
privacy law, it will tend to be harmonious, and we can address a large
number of country's laws with a few broad strokes.  Those broad
strokes will also represent good privacy practices.

> I think your definitions are on track.

Thanks!

Adam

---

From: John W Noerenberg II <[email-masked]>
Date: Wed, 22 Aug 2001 17:24:06 -0700

In general, I think your classifications are on the right track.

At 3:18 PM -0500 8/20/01, Chris M. Lonvick wrote:
>At 3:16 PM -0400 8/22/01, Adam Shostack wrote:

These two are nasty.  Chris is right to be careful about introducing 
something representing a legal decision into the classification.  But 
Adam is right, there's no inherent harm marking the disclosure as 
legally required, as that can be set according to governing law.  The 
problem is determining governing law.  Let's say I acquired my device 
in a place where there is no mandated-disclosure requirement.  Then I 
attempt to use it in a place where mandated disclosure is required. 
What's the precedence?

Needed-disclosure and mandated-disclosure overlap in meaning.  Both 
imply an obligation.  After all, the police need to know where you 
are to respond to your 911 call.  Is that a mandated-disclosure or a 
needed-disclosure?  If my agreement with AAA says that every time I 
call for roadside assistance my location is transmitted to their 
dispatcher is that mandated or needed?

It's probably more important that the location that is transmitted by 
the sender is encoded in such a way that it can only be used for the 
purpose the sender allows.  If I call 1-800-find-gas, I may not want 
to receive a list of fast-food joints along with the list of nearby 
gas stations -- or maybe I do.

But a taxonomy of disclosure is a real good idea.
-- 

john noerenberg
[email-masked]
   --------------------------------------------------------------------------
   Peace of mind isn't at all superficial, really.  It's the whole thing.
   That which produces it is good maintenance; that which disturbs it
   is poor maintenance.
   -- Zen and the Art of Motorcycle Maintenance, Robert M. Pirsig, 1974
   --------------------------------------------------------------------------

---

From: Adam Shostack <[email-masked]>
Date: Thu, 23 Aug 2001 10:36:35 -0400

> attempt to use it in a place where mandated disclosure is required. 

An excellent question.

In practice, I expect that the mandated disclosure wins, because the
service provider is going to do it, not caring about your contract or
law where you bought the phone, sim, etc.  If we work from this
assumption, then I'd say it is a mandated-disclosure, because the
information is being disclosed because a party thinks its mandated.
Note that I did say that a mandated disclosure is imposed by the
service provider, not someone else.  That raises a set of questions if
the service provider offers other location-based services, which I
don't know how to answer or finesse.  For example, if the service
provider (OnStar) provides roadside assistance, would that be
mandated- or needed-?  My goal was to have it needed-, but I'm hard
pressed to find a definition set that respects 2804.

> dispatcher is that mandated or needed?

Firstly, I agree that my definitions are imperfect, and can use some
work.

I don't agre that the police need to know where you are to respond to
a 911 call; they are able to respond today.  It is a mandated
disclosure because the SP is going to give out the information, and
nothing we say here, or build into protocols, is going to change
that.  I think that AAA is a needed-disclosure; it may be possible to
convince the SP that they may not arbitrarily hand out data, whatever
their contract says.

> gas stations -- or maybe I do.

I've been playing with the idea that we should encourage location to
be encoded in tuples of (location, privacy-info), where privacy-info
includes ways to talk about the various fip requirements.

Adam

---

From: John W Noerenberg II <[email-masked]>
Date: Thu, 23 Aug 2001 16:44:40 -0700

At 10:36 AM -0400 8/23/01, Adam Shostack wrote:
>work

S'ok.  Some would say that everything I write could use some work....

Readers shouldn't trip over the names.  Let's try this.  To put them 
in terms of 2026 definitions,

A mandated-disclosure is one where the sender MUST deliver the 
location with tbd precision.  A needed-disclosure is one where the 
sender SHOULD deliver the location with tbd precision.  Is this 
moving in the right direction?

>includes ways to talk about the various fip requirements.

I like this.
-- 

john noerenberg
[email-masked]

---

From: Greg Troxel <[email-masked]>
Date: Fri, 24 Aug 2001 10:23:55 -0400

I think this drags in semantics that don't really fit.  SHOULD has an
impression that it is better to comply, with the notion that there may
be good reasons why one doesn't.  I'm uncomfortable with a protocol
document telling some computer/person that their location must be
revealed as a protocol issue - this both seems unreasonable and
crosses the no-contortions-for-laws line.

needed-disclosure has a different sense from SHOULD - it's about
policy, and independent of implementations.  In this case, a service
provider says "if you don't provide a location, I won't give you
service".  Whether to provide a location and get the service is a
per-user/agent per-service policy choice (perhaps evaluated at every
use).  Thus, this is squarely in the realm of policy.

So, perhaps the request for location should contain some sort of
information that specifies what is required to obtain the service.
I believe that this isn't all that different from a service that
requires a name/address/credit card in a web form, except that the
requirements statement isn't intended to be machine-parseable.

But even in the 'needed' case, there is some fuzz in what is
'necessary'.  I have used a number of geographic search services, and
almost never given the right location.  Usually I pick some round
number that is more or less close, and some wide enough radius, and
then filter the results on my end.  Some sort of protocol support to
make this sort of behavior easier could be helpful, but this gets into
how the response is encoded, and that seems out of the charter's scope.

Another issue I have with 'mandated-disclosure' being equated to MUST
is that it commingles legal issues and protocol issues.  MUST is about
ensuring interoperability, and sending location is a policy/legal
issue.
To reconcile these, location objects should have one or more
distinguished values representing "location not available", perhaps in
various flavors.

A legal requirement to send location on emergency calls can be viewed
not as a protocol issue, but a requirement for policy configuration to
be done a certain way.  The protocol can still allow the
(IETF-viewpoint :-) appropriate level of user control.
Corporate-manufactured handsets in the US would probably then have a
'911 gets location no matter what' policy in ROM.

That said, it seems reasonable to have some protocol support for
policy configuration, in the spirit of a CA for 911-like answering
points which have a legal requirement for location delivery.  Then, a
handset could easily be configured with "deliver location to 911-like
places for which there is a legal requirement to do so" policy
hard-coded.  This raises issue of predelivery of such things so that
they'll be in place when services are needed and there isn't time to
fetch certs.  All of this would be optional in the protocol spec; it's
merely a way to express policy.  (My sense of the IETF/legal situation
is that it is ok to provide support for various possible policies in a
policy negotiation system, but not to contort a protocol or do
something technicall broken to meet some particular law.  So this
seems ok.)

Perhaps policy support capable of expressing policies like the above
should be MUST (with the caveat that there there should
confidentiality and integrity protection on information in transit).

        Greg Troxel <[email-masked]>

---

From: Dante Castiglione <[email-masked]>
Date: Thu, 30 Aug 2001 21:30:38 -0300

>Greg Troxel [mailto:[email-masked]] wrote:

>then filter the results on my end.

Well, maybe what we need to include is a way for a server to express what
degree of precision it needs to get in the request, to be able to deliver
its services to the user/agent.

>distinguished values representing "location not available", perhaps in

I like that. A 'null' value for location.

>be done a certain way.

I think this is important; we need to distinguish 'protocol' issues from
'configuration' issues.

>is ok to provide support for various possible policies in a
>something technicall broken to meet some particular law

I agree too.

Kind regards,

Dante

Dante Castiglione
[email-masked]
15-4992-3446