Subject: Re: [Geopriv] New Version Notification for draft-thomson-geopriv-lying-00.txt

From: "Thomson, Martin" <[email-masked]>
Date: Wed, 29 Jun 2011 15:08:31 +0800

On 2011-06-29 at 16:49:48, [email-masked] wrote:
> A new version of I-D, draft-thomson-geopriv-lying-00.txt has been 
> successfully submitted by Martin Thomson and posted to the IETF 
> repository.

<http://tools.ietf.org/html/draft-thomson-geopriv-lying>

I think that the Abstract summarizes this best:

> Abstract:
>    Obscuring location effectively is difficult.  Falsehood offers a
>    simpler, more effective method of location privacy protection.  A
>    mechanism is defined whereby a rule maker can request that a 
>    location server lie about location.

The mechanism is an extension to geopriv-policy.

--Martin

---

From: "Carl Reed" <[email-masked]>
Date: Wed, 29 Jun 2011 17:40:49 -0600

Liar, liar your pants are on fire . . .

I am reading the draft document now. A couple of questions/suggestions:

1. Perhaps a more "serious" element name than "liar"?  I agree that the 
ability to provide a replacement location has value and is definitely easier 
than trying to obscure one's location. But . . .
2. What happens in an emergency call situation? The NENA folks might wonder. 
Perhaps some words on the emergency call use case.
3. There might be some interesting legal issues here. Also perhaps has some 
counter-terrorism or drug interdiction implications. Of course, if law 
enforcement can always get "true" location from the location determination 
provider or mobile device or mobile provider perhaps this is not an issue. 
Anyway, I passed this document to the folks at the Center for Spatial Law 
and Policy to see if they have any comments. Location and privacy policy is 
a big issue for them.

Regards

Carl

----- Original Message ----- 
From: "Thomson, Martin" <[email-masked]>
To: <[email-masked]>
Sent: Wednesday, June 29, 2011 1:08 AM
Subject: Re: [Geopriv] New Version Notification 
fordraft-thomson-geopriv-lying-00.txt

> _______________________________________________
> Geopriv mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/geopriv
>

---

From: "Thomson, Martin" <[email-masked]>
Date: Thu, 30 Jun 2011 09:20:48 +0800

One preface to this: when you use a presence service, it typically presents the information that YOU provide it (see SIP PUBLISH [RFC3903]).  There's an important  distinction between the two claims:

  This is where X is.

  This is where X says that X is.

This draft enables finer-grained, policy-based control over the lying process, for location.

> Liar, liar your pants are on fire . . .

I almost submitted this as draft-thomson-geopriv-pantsonfire-00, but thought better of it.

> 1. Perhaps a more "serious" element name than "liar"?  I agree that 
> the ability to provide a replacement location has value and is 
> definitely easier than trying to obscure one's location. But . . .

I really did try to understate the seriousness of choosing to lie.  Or more to the point: of asking someone to lie for you.  Lies can result in some very serious consequences.  I should probably point that out in the security considerations section.

Embarrassment is actually the least serious consequence I imagined.

> Perhaps some words on the emergency call use case.

Lying to a PSAP is a bad thing.  Despite the seriousness of it - and an inordinate focus on that use case in this forum - I don't actually see the need to make a special point of it here.  To be frank, that's a pretty narrow slice of the lying pie.

> 3. There might be some interesting legal issues here. Also perhaps has 
> some counter-terrorism or drug interdiction implications. Of course, 
> if law enforcement can always get "true" location from the location 
> determination provider or mobile device or mobile provider perhaps 
> this is not an issue.

Not to make light of this, but that latter part is entirely a matter for policy makers.  If a jurisdiction wants to place a requirement on location servers to tell the truth to particular agencies of that jurisdiction, then that's their prerogative.  Assuming that the location server knows the truth in the first place (see above).

> Anyway, I passed this document to the folks at the Center for Spatial 
> Law and Policy to see if they have any comments. Location and privacy 
> policy is a big issue for them.

Their response will be of great interest.

--Martin

---

From: Bernard Aboba <[email-masked]>
Date: Wed, 29 Jun 2011 18:31:43 -0700

Some thoughts:

Is this necessarily about "lying"?  The ability to manually override automatically generated location is a frequently suggested feature.  There can be a number of reasons why a LIS might not be able to determine the user's location (e.g. out of the area covered by the LIS, on a VPN), or might get it wrong (bad wiremap data).  If your LIS tells you you're in Peoria and you're in Timbuktu instead, manual override seems like a good idea.   

Of course, it's also a privacy feature. 

> From: [email-masked]
> To: [email-masked]; [email-masked]
> Date: Thu, 30 Jun 2011 09:20:48 +0800
> Subject: Re: [Geopriv] New Version Notification fordraft-thomson-geopriv-lying-00.txt
>

---

From: "Thomson, Martin" <[email-masked]>
Date: Thu, 30 Jun 2011 09:50:28 +0800

On 2011-06-30 at 11:31:43, Bernard Aboba wrote:
> Some thoughts:
> 
> Is this necessarily about "lying"?  The ability to manually override 
> automatically generated location is a frequently suggested feature.
> There can be a number of reasons why a LIS might not be able to 
> determine the user's location (e.g. out of the area covered by the 
> LIS, on a VPN), or might get it wrong (bad wiremap data).  If your LIS 
> tells you you're in Peoria and you're in Timbuktu instead, manual 
> override seems like a good idea.

True.  I hadn't really considered that use case.