Subject: [Geopriv] Nits about draft-ietf-geopriv-held-measurements-06.txt

From: SM <[email-masked]>
Date: Wed, 10 Apr 2013 23:02:01 -0700

Hi Martin,

[I added a Cc to Eliot in case he is interested]

At 17:00 10-04-2013, Martin Thomson wrote:
>Hmm, I'd be interested to hear about what you consider to be
>problematic with the privacy considerations.  We put a lot of thought
>into those.  Obviously, this is potentially highly sensitive, but I
>thought we'd hit the important considerations.

As a FYI, the is an article about the privacy bounds of human 
mobility at 
http://www.nature.com/srep/2013/130325/srep01376/full/srep01376.html

Here are some nits (feel free to ignore).  Section 6 mentions that:

   "In order to protect the privacy of the subject of location-related
    measurement data, this implies that measurement data is protected
    with the same degree of protection as location information."

Section 6.2 mentions that:

   "By adding measurement data to a request for location information, the
    Device implicitly grants permission for the LIS to generate the
    requested location information using the measurement data.
    Permission to use this data for any other purpose is not implied."

and

   "A LIS MUST discard location-related measurement data after servicing
    a request, unless the Device grants permission to use that information
    for other purposes."

How can a device implicitly grant permission?  It is up to the user 
to grant permission.

The specification also sends information, e.g. for wifi, which might 
not readily available to the cellular operator.  The privacy model 
followed can be described as the unknowingly informant model.

Regards,
-sm

---

From: Martin Thomson <[email-masked]>
Date: Thu, 11 Apr 2013 09:55:54 -0700

Hey SM,

On 10 April 2013 23:02, SM <[email-masked]> wrote:
> As a FYI, the is an article about the privacy bounds of human mobility at

Interesting research, but not a particularly surprising finding.
There was research a few years back that found that very coarse
information (again, cellular radio transmitter locations) was
sufficient information to track a precise path for a journey if a
precise path had once been provided.

It's also consistent with our findings on obscuring location.  That
is, it doesn't work as well as you think it does, even if you don't
think it works very well at all.

> How can a device implicitly grant permission?  It is up to the user to grant
> permission.

Ah yes, I'm not sure whether this was made explicit in this draft
(probably not), but we take the view that the Device is a proxy for a
user (Target in geopriv-parlance).  In terms of protocols and location
determination that's the only reasonable assumption to make.  That's a
really important point though, not something we should be taking on
faith.  I'll make sure to add a note.

> The specification also sends information, e.g. for wifi, which might not
> readily available to the cellular operator.  The privacy model followed can
> be described as the unknowingly informant model.

I don't know where you are going with the "unknowingly informant
model", but it's true that in some cases, measurements that are
provided to a LIS might not be useful. If your LIS is operated by a
cellular operator, then maybe (though it's only a maybe) the cellular
operator wont be able to use the information to improve a location
estimate.  Similarly, they might not know how to deal with GLONASS
pseudoranges.

Implementations have choices on the spectrum between: provide nothing
and see if the LIS asks for more information; and provide everything
and don't worry about the extra stuff.  The latter choice actually has
some implications with respect to performance and time, so most likely
it will go somewhere in between the two.

---

From: "Carl Reed" <[email-masked]>
Date: Thu, 11 Apr 2013 11:05:26 -0600

>From a privacy perspective what is much more problematic is the ability to 
predict where an individual will be based on past tracked behavior. I just 
attended a Web and Wireless GIS conference. About half the papers were on 
tracking of mobile assets and using this information to predict future 
behavior. Lots of math, stochastic process modeling, etc.

Cheers

Carl

-----Original Message----- 
From: Martin Thomson
Sent: Thursday, April 11, 2013 10:55 AM
To: SM
Cc: [email-masked] ; GEOPRIV WG ; Eliot Lear
Subject: Re: [Geopriv] Nits about 
draft-ietf-geopriv-held-measurements-06.txt

Hey SM,

Implementations have choices on the spectrum between: provide nothing
and see if the LIS asks for more information; and provide everything
and don't worry about the extra stuff.  The latter choice actually has
some implications with respect to performance and time, so most likely
it will go somewhere in between the two.
_______________________________________________
Geopriv mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/geopriv

---

From: Alissa Cooper <[email-masked]>
Date: Fri, 12 Apr 2013 00:22:47 +0200

> faith.  I'll make sure to add a note.

You could reference the role definitions in RFC 6280 (section 2) for this.

Alissa

---

From: SM <[email-masked]>
Date: Sun, 14 Apr 2013 23:44:24 -0700

Hi Martin,
>faith.  I'll make sure to add a note.

I don't disagree with the above.  I guess that the easier path is to 
add a note.  Alissa mentioned referencing Section 3.2 of RFC 6280.

>estimate.  Similarly, they might not know how to deal with GLONASS

In easy terms the "unknowingly informant model" is about a device 
providing information related to other people; i.e. data collection 
of information not belonging to the Target.

>it will go somewhere in between the two.

Thanks for explaining this.

Regards,
-sm