Subject: [ietf-privacy] Privacy Terminology: What are useful terms?

From: Hannes Tschofenig <[email-masked]>
Date: Tue, 5 Jul 2011 13:48:57 +0300

Hi all, 

You may have seen that the privacy terminology document over time got shorter and shorter as I removed content to make it more readable. Here is the latest version: 
http://tools.ietf.org/html/draft-hansen-privacy-terminology-02

It is still too long. Most IETF document authors are likely to use only a few terms. 

In a recent discussion in the IAB privacy program we were wondering what are the terms we absolutely need to have. Here are the terms I think could be useful for IETF document authors to know. 

1) Anonymity
2) Unlinkability
3) Unobservability
4) Pseudonym/Pseudonymity

Anonymity, unlinkability and pseudonymity are useful terms for many of the IETF's authentication protocols. The sub-categories of sender anonymity and relationship anonymity are more applicable to protocols like onion routing proposals. 
Unobservability shows up in the context of security protocols where dummy traffic is used to pad exchanged data.

Identity management is often touched in the work on architectures. While many of the entities have their own unique terms with each proposal there are some concepts that seem to be quite generic, such as 'identity', and 'identifier'. It may be useful to capture this aspect as well. 

From your experience, what other terminology is useful to have? 

Ciao
Hannes

---

From: Klaas Wierenga <[email-masked]>
Date: Tue, 05 Jul 2011 12:58:29 +0200

On 7/5/11 12:48 PM, Hannes Tschofenig wrote:

Hannes,

How about privacy itself? ;-)

Klaas

> You may have seen that the privacy terminology document over time
> got shorter and shorter as I removed content to make it more
> readable. Here is the latest version: 
> In a recent discussion in the IAB privacy program we were wondering 
> what are the terms we absolutely need to have. Here are the terms I 
> think could be useful for IETF document authors to know.
> 
> 1) Anonymity 2) Unlinkability 3) Unobservability 4) 
> Pseudonym/Pseudonymity
> 
> Anonymity, unlinkability and pseudonymity are useful terms for many 
> of the IETF's authentication protocols. The sub-categories of sender 
> anonymity and relationship anonymity are more applicable to
> protocols like onion routing proposals. Unobservability shows up in
> the context of security protocols where dummy traffic is used to pad
> exchanged data.
> 
> Identity management is often touched in the work on architectures. 
> While many of the entities have their own unique terms with each 
> proposal there are some concepts that seem to be quite generic, such 
> as 'identity', and 'identifier'. It may be useful to capture this 
> aspect as well.
> 
> Ciao Hannes _______________________________________________ 
> ietf-privacy mailing list [email-masked] 
> https://www.ietf.org/mailman/listinfo/ietf-privacy

---

From: Bjoern Hoehrmann <[email-masked]>
Date: Tue, 05 Jul 2011 23:08:07 +0200

>http://tools.ietf.org/html/draft-hansen-privacy-terminology-02

Looking over the document I am reminded of Joel Spolsky's "Don't start a
business if you can't explain what pain it solves, for whom, and why
your product will eliminate this pain, and how the customer will pay to
solve this pain." It's not a tutorial that helps newcomers familiarize
themselves with common terms, it's not a glossary for reference, it can
not be any aid in dealing with legal issues (like help in understanding
a "privacy policy"). I think in order to make suggestions the document
would have to clearly state how it's meant to be useful and to whom.

Generally I would prefer to frame discussions of "privacy" terminology
with social references, as http://www.schneier.com/essay-337.html notes
people are good at directing their thinking towards desired social out-
comes, while technological and other logical results are hard to get a
hold on. With the document here I am actually very confused in that re-
rard, it starts out saying

  Data minimization means that first of all, the ability for others to
  collect personal data should be minimized.

This makes some sense from a security perspective (an attacker cannot
use against you what he doesn't have) and from a legal perspective as-
well (if society can prevent the attacker from benefiting from attacks
they become unlikely) but from a social perspective this is largely the
opposite of what I think is desired.

People do not want to live their lives worrying about how data on them
may harm them or others at a later point. We don't say always keep the
curtains closed because someone might buy a telescope any play peeping
tom (assuming you don't want to have your nude pictures all over the
internet, possibly in the dossier the neighbourhood reputation firm is
preparing on you). We rather make it socially unacceptable and illegal
to do this.

So, the perspective in the statement above is rather wrong, it's not in
fact very meaningful to limit the ability of others to collect, because
once information becomes available to them, they can collect, and infor-
mation becomes available all the time, people can't help that. You can
not reasonably stop talking in public because someone may have a micro-
phone, and you don't want to have on your mind all the time that you are
being spied on.

So in this sense "data minimization" to me is more a concept for those
who are actually able to collect and process and use. They need to ex-
cercise "restraint". German federal law puts it this way:

  3a Data reduction and data economy

    Personal data shall be collected, processed and used, and data
    processing systems shall be chosen and organized in accordance
    with the aim of collecting, processing and using as little
    personal data as possible.

If you asked me to design some smart metering system I would take this
to heart and think about how I can minimize what the system learns about
other citizen's habits, wonder for instance, whether this can be imple-
mented using some zero-knowledge proof systems (apparently it can). So,
data minimization is about people doing things, and not so much about
people being able to do things (which is more a personal information
security concern).

Given that the draft in title, abstract, and introduction has this as a
central theme, I find it odd that these ideas aren't really mentioned. I
do see that this is more of a policy question than a terminology thing,
but then so is, "The time how long collected personal data is stored
should be minimized" for instance.

So, in summary I am rather unsure what to make of the document. It would
need a lot more focus to offer useful commentary.
-- 
Björn Höhrmann · mailto:[email-masked] · http://bjoern.hoehrmann.de
Am Badedeich 7 · Telefon: +49(0)160/4415681 · http://www.bjoernsworld.de
25899 Dagebüll · PGP Pub. KeyID: 0xA4357E78 · http://www.websitedev.de/

---

From: Alissa Cooper <[email-masked]>
Date: Mon, 11 Jul 2011 11:58:58 +0100

Hi Hannes,

I think some of the identity terms would be useful: identity, identifier, identifiability. Interestingly, the Internet security glossary (RFC 2828) does not include any of these, although it does include identification. 

I would also like to see some terms related to data minimization after collection:
primary use
secondary use
primary purpose
secondary purpose
retention
sharing

It might also be good to briefly describe the fair information practices.

FWIW, I'm not sure that having a short definition of "privacy" is helpful or even possible. For now I think our time is better spent building up a glossary of terms that is usable for describing the properties of Internet protocols.

Thanks,
Alissa

On Jul 5, 2011, at 11:48 AM, Hannes Tschofenig wrote:

> _______________________________________________

---

From: Hannes Tschofenig <[email-masked]>
Date: Mon, 11 Jul 2011 14:08:04 +0300

Hi Alissa, 

Thank you for the feedback.

I agree with your comment about defining privacy. When I saw Klaas's comment
I was not quite sure how to react. On one hand I understand the desire to
define the term but on the other hand I know how difficult it is. Various
people have written books about it. I was briefly thinking about suggesting
to use the IAPP definition for privacy:

"
Privacy encompasses the rights and obligations of individuals and
organizations with respect to the collection, use, retention, disclosure,
and disposal of personal information.
"

Let me think about the additional terms you suggest below.

Ciao
Hannes

On 7/11/11 1:58 PM, "Alissa Cooper" <[email-masked]> wrote:

> Hi Hannes,
> 
> I think some of the identity terms would be useful: identity, identifier,
> identifiability. Interestingly, the Internet security glossary (RFC 2828) does
> not include any of these, although it does include identification.
> 
> FWIW, I'm not sure that having a short definition of "privacy" is helpful or
> even possible. For now I think our time is better spent building up a glossary
> of terms that is usable for describing the properties of Internet protocols.
> 
> Thanks,
> Alissa
> 
>> You may have seen that the privacy terminology document over time got shorter
>> and shorter as I removed content to make it more readable. Here is the latest
>> version: 
>> In a recent discussion in the IAB privacy program we were wondering what are
>> the terms we absolutely need to have. Here are the terms I think could be
>> useful for IETF document authors to know.
>> 
>> 1) Anonymity
>> 2) Unlinkability
>> 3) Unobservability
>> Anonymity, unlinkability and pseudonymity are useful terms for many of the
>> IETF's authentication protocols. The sub-categories of sender anonymity and
>> relationship anonymity are more applicable to protocols like onion routing
>> proposals. 
>> Identity management is often touched in the work on architectures. While many
>> of the entities have their own unique terms with each proposal there are some
>> concepts that seem to be quite generic, such as 'identity', and 'identifier'.
>> It may be useful to capture this aspect as well.
>>

---

From: Klaas Wierenga <[email-masked]>
Date: Mon, 11 Jul 2011 15:29:31 +0200

On 7/11/11 1:08 PM, Hannes Tschofenig wrote:

Hannes, Alissa,

> I agree with your comment about defining privacy. When I saw Klaas's
> comment I was not quite sure how to react. On one hand I understand
> the desire to

well, don't you think it is kind of odd to write a draft about something
undefined? I don't care for "the mother of all definitions of privacy",
but I think we need to say *something*, below definition works for me.

Klaas

> define the term but on the other hand I know how difficult it is.
> Various people have written books about it. I was briefly thinking
> about suggesting to use the IAPP definition for privacy:
> 
> " Privacy encompasses the rights and obligations of individuals and 
> organizations with respect to the collection, use, retention,
> disclosure, and disposal of personal information. "
> 
> Ciao Hannes
>> I think some of the identity terms would be useful: identity,
>> identifier, identifiability. Interestingly, the Internet security
>> glossary (RFC 2828) does not include any of these, although it does
>> include identification.
>> 
>> I would also like to see some terms related to data minimization
>> after collection: primary use secondary use primary purpose 
>> secondary purpose retention sharing
>> 
>> FWIW, I'm not sure that having a short definition of "privacy" is
>> helpful or even possible. For now I think our time is better spent
>> building up a glossary of terms that is usable for describing the
>> properties of Internet protocols.
>> 
>> Thanks, Alissa
>> 
>>> In a recent discussion in the IAB privacy program we were
>>> wondering what are the terms we absolutely need to have. Here are
>>> the terms I think could be useful for IETF document authors to
>>> know.
>>> 
>>> Anonymity, unlinkability and pseudonymity are useful terms for
>>> many of the IETF's authentication protocols. The sub-categories
>>> of sender anonymity and relationship anonymity are more
>>> applicable to protocols like onion routing proposals. 
>>> Unobservability shows up in the context of security protocols
>>> where dummy traffic is used to pad exchanged data.
>>> 
>>> Identity management is often touched in the work on
>>> architectures. While many of the entities have their own unique
>>> terms with each proposal there are some concepts that seem to be
>>> quite generic, such as 'identity', and 'identifier'. It may be
>>> useful to capture this aspect as well.
>>> 
>> _______________________________________________ ietf-privacy
>> mailing list [email-masked] 
> _______________________________________________ ietf-privacy mailing
> list [email-masked]

---

From: "Bryan McLaughlin (brmclaug)" <[email-masked]>
Date: Mon, 11 Jul 2011 14:34:59 +0100

Rather than create our own definition/ or choose our favourite does it not make sense to collate the various definitions currently used by involved parties?

I favour the EU definition used in it legislation, but can see there are other definitions that the readers news to be aware of. 

Thoughts

Bryan

Sent from my iPhone

On 11 Jul 2011, at 14:30, "Klaas Wierenga" <[email-masked]> wrote:

> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
> 
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG/MacGPG2 v2.0.14 (Darwin)
> Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/
> 
> iEYEARECAAYFAk4a+roACgkQH2Wy/p4XeFKbLwCfeFmBp/PfLYcj3BAe7xL2Lhj4
> vi8AoKitKS67M+ZFNi4284nUm+moa9oo
> =0vQP
> -----END PGP SIGNATURE-----

---

From: Alissa Cooper <[email-masked]>
Date: Mon, 11 Jul 2011 14:37:12 +0100

I could imagine something like the text below in the introduction of the document, perhaps with a bit more explanation to give a sense of what the document is about. If the document turns into more of a glossary, I would be a little nervous about having a one-line entry defining "privacy."

---

From: Rhys Smith <[email-masked]>
Date: Mon, 11 Jul 2011 15:22:13 +0100

> I could imagine something like the text below in the introduction of the document, perhaps with a bit more explanation to give a sense of what the document is about. If the document turns into more…

Quite.

Any attempt at defining privacy in a single soundbite is doomed to a lifetime of argument - some people will agree with it, some people absolutely will not. A single "mother of all definitions" of privacy just isn't possible; it might work in a specific context, but not in other contexts.

The IAPP soundbite about privacy, for example, is very specifically centred around personal information. Someone could spy on you in the shower and not record any information and therefore not breach your privacy, according to that definition. But I think most people would disagree...

Even in a specific context there are disagreements. For example, some would say an individual has lost some privacy if an organisation has some of their personal information. Others, however, would argue that they have not lost privacy if the individual authorised the release of that information - they posit that privacy is the _control_ about one's information; not the information itself.

Anyway, to cut a several thousand year argument short, this is a complex playing field.

I think the best you can shoot for is to try to get across the idea that privacy is a very contentious issue that has been debated back and forth innumerable times throughout the last several millennia (arguably one of the first written appearances of privacy is in Aristotle's Politics, circa 350BC), and that this document specifically does not aim to try to actually define privacy in any general sense; instead it is simply trying to take the general idea of privacy (whatever that is) and define some useful terms that are generally applicable to any technology attempting to consider privacy and to limit its loss - and that these should help no matter what your particular definition of privacy happens to be.

If you do try to define privacy in a specific context (e.g. the EU regulatory context), make sure you state clearly and unequivocally what that context is - or expect to be argued with for the rest of your career ;-).

Anyway, just my 2c.

Kind Regards,
Rhys.

--
----------------------------------------------------------------------
Dr Rhys Smith                                   e: [email-masked]
Engineering Consultant: Identity & Access Management  (GPG:0xDE2F024C)
Information Services,
Cardiff University,                            t: +44 (0) 29 2087 0126
39-41 Park Place, Cardiff,                     f: +44 (0) 29 2087 4285
CF10 3BB, United Kingdom.                      m: +44 (0) 7968 087 821
----------------------------------------------------------------------

---

From: Klaas Wierenga <[email-masked]>
Date: Mon, 11 Jul 2011 16:32:23 +0200

On 7/11/11 4:22 PM, Rhys Smith wrote:
>> I could imagine something like the text below in the introduction 
>> of the document, perhaps with a bit more explanation to give a 
>> sense of what the document is about. If the document turns into 
>> more of a glossary, I would be a little nervous about having a 
>> one-line entry defining "privacy."
> 
> Quite.

Agreed, and in fact some of the text below could go into this introduction.

Klaas

> 
> Any attempt at defining privacy in a single soundbite is doomed to a 
> lifetime of argument - some people will agree with it, some people 
> absolutely will not. A single "mother of all definitions" of privacy 
> just isn't possible; it might work in a specific context, but not in 
> other contexts.
> 
> The IAPP soundbite about privacy, for example, is very specifically 
> centred around personal information. Someone could spy on you in the 
> shower and not record any information and therefore not breach your 
> privacy, according to that definition. But I think most people would 
> disagree...
> 
> Even in a specific context there are disagreements. For example,
> some would say an individual has lost some privacy if an organisation
> has some of their personal information. Others, however, would argue
> that they have not lost privacy if the individual authorised the
> release of that information - they posit that privacy is the
> _control_ about one's information; not the information itself.
> 
> I think the best you can shoot for is to try to get across the idea 
> that privacy is a very contentious issue that has been debated back 
> and forth innumerable times throughout the last several millennia 
> (arguably one of the first written appearances of privacy is in 
> Aristotle's Politics, circa 350BC), and that this document 
> specifically does not aim to try to actually define privacy in any 
> general sense; instead it is simply trying to take the general idea 
> of privacy (whatever that is) and define some useful terms that are 
> generally applicable to any technology attempting to consider
> privacy and to limit its loss - and that these should help no matter
> what your particular definition of privacy happens to be.
> 
> If you do try to define privacy in a specific context (e.g. the EU 
> regulatory context), make sure you state clearly and unequivocally 
> what that context is - or expect to be argued with for the rest of 
> your career ;-).
> 
> Anyway, just my 2c.
> 
> Kind Regards, Rhys.
> 
> -- 
> Information Services, Cardiff University, t: +44 (0) 29 2087 0126
> 39-41 Park Place, Cardiff, f: +44 (0) 29 2087 4285 CF10 3BB, United
> Kingdom. m: +44 (0) 7968 087 821

---

From: David Singer <[email-masked]>
Date: Mon, 11 Jul 2011 08:27:27 -0700

I think we can and should define terms where we use terms to have a precise meaning.  "Identifier" is such a term.

"Privacy" is not a term, it is a concept.  We can introduce the document by saying something like "Privacy is a general concept that includes a number of considerations under its umbrella, including the use, dissemination and possible publication of data about, or derived from, individuals, and ..."

I don't think "privacy" is a defined term, in other words.

David Singer
Multimedia and Software Standards, Apple Inc.

---

From: SM <[email-masked]>
Date: Mon, 11 Jul 2011 09:36:39 -0700

>and disposal of personal information.

It's easier to talk about violation of privacy instead of defining 
privacy; e.g. access or distribution of information about a natural 
person without the person's prior consent.

In a security context, you might see the following description for privacy:

   "Privacy refers to the right of an entity, normally a person, acting in
    its own behalf, to determine the degree to which it will interact with
    its environment, including the degree to which the entity is willing to
    share information about itself with others."

Regards,
-sm

---

From: Hannes Tschofenig <[email-masked]>
Date: Mon, 11 Jul 2011 20:01:42 +0300

Three comments come to my mind: 

* The approach of defining privacy in the sense of violations has some history going back to Warren and Brandeis, "The Right to Privacy". Solove followed a similar approach in his book "Understanding Privacy"
So, there is some established history for following this approach but what I dislike is a laundry list of privacy violations (even if you categorize them into groups) - many of which only make sense when you describe the entire context (which would go far outside the IETF scope). 

* Your definition below does not address the full information lifecycle, namely  collection, use, retention, disclosure, and disposal. 

* You say "Privacy refers to the right of an entity, normally a person"

Many privacy laws I am aware of explicitly refer to rights for persons rather than for abstract entities or legal constructs. 

In any case I prefer to use some existing definition instead of creating my own. My intention is that people would rather use specific terms, like unlinkability or anonymity, when writing about properties of certain protocol features instead of using the term privacy. So, the challenge is the following: What are the most important privacy terms that IETF protocol authors are likely to find useful in their work? 

Ciao
Hannes

On Jul 11, 2011, at 7:36 PM, SM wrote:

> It's easier to talk about violation of privacy instead of defining privacy; e.g. access or distribution of information about a natural person without the person's prior consent.
>

---

From: Mischa Tuffield <[email-masked]>
Date: Mon, 11 Jul 2011 18:11:57 +0100

Hello All, 

Just to add my 2 cents to this thread. When we wrote up the Social Web Incubator Group's final report at the W3C where we attempted to address privacy we posed it as a problem - specifically the problem being the "violation of privacy" [1]. 

Regards, 

Mischa

[1] http://www.w3.org/2005/Incubator/socialweb/XGR-socialweb-20101206/#Privacy  

>>  share information about itself with others."

___________________________________
Mischa Tuffield PhD
Email: [email-masked]
Homepage - http://mmt.me.uk/
+44(0)208 439 8200  http://www.garlik.com/
Registered in England and Wales 535 7233 VAT # 849 0517 11
Registered office: Thames House, Portsmouth Road, Esher, Surrey, KT10 9AD

---

From: Josh Howlett <[email-masked]>
Date: Mon, 11 Jul 2011 18:24:02 +0000

>
>
>
>"Privacy" is not a term, it is a concept.

Much like freedom, pursuit of happiness, etc. I suggest taking a pragmatic
approach and use definitions that permit measurement, such as regulatory
compliance (although even that's a rapidly moving and diffuse target).

Josh.

JANET(UK) is a trading name of The JNT Association, a company limited
by guarantee which is registered in England under No. 2881024 
and whose Registered Office is at Lumen House, Library Avenue,
Harwell Oxford, Didcot, Oxfordshire. OX11 0SG

---

From: Rhys Smith <[email-masked]>
Date: Mon, 11 Jul 2011 19:37:45 +0100

> compliance (although even that's a rapidly moving and diffuse target).

Just to repeat my point - that way lies madness. Do not attempt to define privacy at all. Just discuss privacy as a concept and idea that is worth protecting, and point interested readers at some literature to get them started if they're interested in the long sordid history of attempting to define privacy.

Hannes' doc then needs to introduce terms that can help people express how privacy is affected in their specific context and domain using a common language: things such as linkability and whatnot. This would be extremely helpful to people and very useful for readers.

Defining privacy in some way that is only going to be wrong according to many people will just get this doc bogged down in argument. C.f. this thread - as just the beginning of a long debate - just wait until you get psychologists and philosophers weighing in...

N.B. Only in specific contexts/domains is it possible to measure privacy loss - it just cannot be done as a general "measurement". Apples and oranges across contexts. Which means that specific protocols/RFCs should discuss what privacy loss means in their own particular case, and how to measure it (if poss).

R.

---

From: Rhys Smith <[email-masked]>
Date: Mon, 11 Jul 2011 19:57:23 +0100

> N.B. Only in specific contexts/domains is it possible to measure privacy loss - it just cannot be done as a general "measurement". Apples and oranges across contexts. Which means that specific prot…

Just to give some a concrete example here - how you define privacy, measure privacy loss, and design ways to minimise privacy loss would be totally different for a protocol that deals with geographic location [1] compared to say a protocol that is dealing with protecting assertions about a user [2] (note I've made up the details of [1] and [2] below completely off the top of my head, no need to tell me if they're nonsense :-) ).

[1] e.g. privacy could be an attacker not being able to find out where you are, privacy loss could be measured in how accurately they can locate you to the meter, minimising could involve only releasing location to within 5 miles of your real location with some randomness in.

[2] e.g. privacy could be an attacker gaining access to the parts of the information about the user, privacy loss could be measured according to how many assertions about you were taken, minimising could involve protecting each assertion with a different cryptographic key.

So if Hannes' document is supposed to support anyone writing a document that wants to talk about privacy in a consistent way, you must not attempt to define privacy, ways of measuring privacy loss, or methods of minimising privacy loss at all, as any attempt to do so will be subject specific in some way and thus limit its flexibility and usefulness. The usefulness comes in defining specific terminology that *is* much more likely to be relevant across domains, so that we have more consistency in how people discuss privacy.

R.

---

From: "Thomson, Martin" <[email-masked]>
Date: Tue, 12 Jul 2011 07:59:57 +0800

> properties of Internet protocols.

I think that you have it right.  We should talk of "privacy" in the same way that we talk about "security".  That is, it's vagueness is tolerated where vagueness is appropriate, but more specificity is required for anything other than the broadest statement.

On 2011-07-11 at 23:29:31, Klaas Wierenga wrote:
> I don't care for "the mother of all definitions 
> of privacy", but I think we need to say *something*

RFC 3552 doesn't attempt to define "security".  But it does have something to say on the generic nature of the term:

   Most people speak of security as if it were a single monolithic
   property of a protocol or system, however, upon reflection, one
   realizes that it is clearly not true.  Rather, security is a series
   of related but somewhat independent properties.  Not all of these
   properties are required for every application.

Defining each of the properties we're interested in paints a more accurate picture of the concept than a single trite statement.

--Martin

---

From: Bjoern Hoehrmann <[email-masked]>
Date: Tue, 12 Jul 2011 02:25:45 +0200

* David Singer wrote:
>We can introduce the document by saying something like "Privacy is a
>general concept that includes a number of considerations under its
>umbrella, including the use, dissemination and possible publication of
>data about, or derived from, individuals, and ..."

I've thought about this and think we should probably do even less. I've
looked at "privacy is the" definitions on the web and it appears to be
the state, ability, quality, condition, right, idea, choice, interest,
protection, expectation, claim, relationship, freedom, practise, desire,
mandate, control, power, exclusion, and any number of other things. I'd
also note that some languages do not have a word or idiom that captures
all that may be meant by "privacy", German for instance does not.

Including the term "privacy" is important for reasons of discoverability
and establishing context; beyond that I do not think it's a very useful
term. That in fact is probably true for many related idioms as people do
associate different ideas with them and how you logically arrive at the
ideas due to cultural differences. So, rather than making any sort of
"privacy is" statements, just point out that certain concepts and terms
are "privacy"-related.
-- 
Björn Höhrmann · mailto:[email-masked] · http://bjoern.hoehrmann.de
Am Badedeich 7 · Telefon: +49(0)160/4415681 · http://www.bjoernsworld.de
25899 Dagebüll · PGP Pub. KeyID: 0xA4357E78 · http://www.websitedev.de/

---

From: David Singer <[email-masked]>
Date: Mon, 11 Jul 2011 17:30:15 -0700

> "privacy is" statements, just point out that certain concepts and terms

Yes, you are probably right.  Make sure privacy is mentioned as the umbrella subject, but then do not attempt to define it...

David Singer

---

From: Alissa Cooper <[email-masked]>
Date: Tue, 12 Jul 2011 08:04:41 +0100

I think there is actually a fair amount of text that we can crib from RFC 3552 for this document or the privacy considerations document (or both).

---

From: "Bryan McLaughlin (brmclaug)" <[email-masked]>
Date: Tue, 12 Jul 2011 12:08:56 +0200

-----Original Message-----
From: [email-masked]
[mailto:[email-masked]] On Behalf Of David Singer

> "privacy is" statements, just point out that certain concepts and
terms

Yes, you are probably right.  Make sure privacy is mentioned as the
umbrella subject, but then do not attempt to define it...

David Singer

BMC>

Do we include  the interpretation(s)/definition(s) that are currently in
use and are enforceable in the ecosystem(s) the IETF protocols must
operate in?

So rather than  a 'privacy is' definition we might have 'privacy has
been defined as X by Y  but also as....'

Bryan

---

From: Rhys Smith <[email-masked]>
Date: Tue, 12 Jul 2011 11:17:21 +0100

> been defined as X by Y  but also as....'

That might end up being a very long and contentious list... (the ecosystems in which IETF protocols must operate in spans many cultures and contexts).

As other contributors have said, the properties of privacy are what are actually useful, rather than a definition (or set of definitions).

R.

---

From: "Bryan McLaughlin (brmclaug)" <[email-masked]>
Date: Tue, 12 Jul 2011 13:14:08 +0200

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] 
Sent: 12 July 2011 11:17
To: Bryan McLaughlin (brmclaug)
Cc: David Singer; Bjoern Hoehrmann; [email-masked]
Subject: Re: [ietf-privacy] Privacy Terminology: What are useful terms?

> been defined as X by Y  but also as....'

That might end up being a very long and contentious list... (the
ecosystems in which IETF protocols must operate in spans many cultures
and contexts).

As other contributors have said, the properties of privacy are what are
actually useful, rather than a definition (or set of definitions).

R.
--

Whilst possible the list may be contentious I do not see that as a
barrier to its inclusion. 

I also agree that the properties are the important foundation of this
document. 

However if we fail to expose the reader to the complexity of the
interpretations already in existence and evolving, I fear we do the
reader a disservice for when they consider the implications of their
work to privacy.

Bryan

---

From: Rhys Smith <[email-masked]>
Date: Tue, 12 Jul 2011 12:24:56 +0100

> reader a disservice for when they consider the implications of their

I think the main issue would actually not be that its contentious - rather that it would almost certainly be incomplete. There are so many definitions of privacy - across multiple contexts, multiple cultures - that we'd be certain to not capture them all (and probably not even most). And therein lies the danger of people thinking that we have in fact defined privacy, when we haven't - potentially leading people in the future to only consider their work against the list, not against the core principles of privacy (whatever they are!).

If we were to include a list of examples it would have to be stated *very* clearly that this list was not exhaustive, but rather illustrative only...

R.

---

From: SM <[email-masked]>
Date: Tue, 12 Jul 2011 08:10:33 -0700

At 10:14 11-07-2011, David Remahl wrote:
>IMHO, “right” is a value-laden and culturally 
>predicated word unsuitable for an international 
>technical document. I would favor a more neutral 
>term such as “capability”, “ability”, or 
>“capacity”. To talk about a right to privacy 
>that is believed to exist or be granted by 
>society “privacy right”, “legal privacy protections”, etc. can be used.

Cultural and legal definitions are unsuitable.

The quoted text is from RFC 3365.  The BCP 
discusses about Security Requirements for IETF 
protocols.  The most interesting part however is the Danvers Doctrine:

  "The overwhelming consensus was that the IETF should standardize on the
   use of the best security available, regardless of national policies."

There are some parallels between that and the 
current discussion about privacy.  It is rare to 
see consensus in discussions about policy.  I 
would say that the IETF avoids dictating policy.

Rhys Smith commented on the way to madness and 
suggested discussing the concept of 
privacy.  Martin Thomson pointed out that RFC 
3552 doesn't attempt to define "security".  Björn 
Höhrmann suggested pointing out that certain 
concepts and terms are "privacy"-related.

Regards,
-sm