Subject: [ietf-privacy] FW: Privacy Terminology Comments/Updates

From: Hannes Tschofenig <[email-masked]>
Date: Mon, 26 Dec 2011 16:53:22 +0200

Hi all,

in an attempt to update the privacy terminology document Rhys and I had 
a chat and here are some remarks I sent to him. I thought it may be 
useful to share them with the rest of you as well.

Feedback appreciated.

Ciao
Hannes

_____________________________________________
From: Tschofenig, Hannes (NSN - FI/Espoo)
Sent: Wednesday, December 21, 2011 3:11 PM
To: [email-masked]'
Subject: Privacy Terminology Comments/Updates

Hi Rhys,

Here are my thoughts about the privacy terminology document:

* Personal Data

The abstract says:	

"
    The
    specific context of privacy used within this document is that of
    "personal data", information about an individual stored and/or
    transmitted electronically in Internet protocols.
"

We seem to be using the European definition here but shouldn't we then 
be a bit more precisely, namely
"
'personal data' means any information relating to a data subject;

'data subject' means an identified natural person or a natural person 
who can be
identified, directly or indirectly, by means reasonably likely to be 
used by the
controller or by any other natural or legal person, in particular by 
reference to an
identification number, location data, online identifier or to one or 
more factors
specific to the physical, physiological, genetic, mental, economic, 
cultural or social
identity of that person;
"
Since we don't have the term data subject defined, it may be useful to 
have something in there.

* Introduction

You wrote:

"
    For example, consideration
    of privacy in terms of personal information is distinctly different
    from consideration of privacy in a geographical information sense: in
    the former a loss of privacy might be framed as the uncontrolled
    release of personal information without the subject's consent, while
    in the latter it might be the ability to compute the location of an
    individual beyond a certain degree of accuracy.
"

I am not sure whether I agree with this statement.

First, in the rest of the document we talk about personal data and not 
personal information.
Second, geographical information is a subset of personal data. As such, 
the issues shouldn't be so different.
Third, we have a document from the GEOPRIV working group that talks 
about location privacy in more detail (see 
http://tools.ietf.org/html/rfc6280). It illustrates a number of threats, 
including release of information without consent and then there is, as 
you state, the ability of others to gain more information about the 
released information than expected by the data subject. The former issue 
was part of the work on policies, see 
http://tools.ietf.org/html/rfc4745, and the latter issue is actually an 
extension to the policies for location obfuscation (see 
http://tools.ietf.org/html/draft-ietf-geopriv-policy-25).

In essence I am saying that these issues appear to be different but in 
fact they aren't.

You wrote:

"
    In order to discuss privacy in any meaningful way a tightly defined
    context needs to be elucidated.  The specific context of privacy used
    within this document is that of "personal data", information about an
    individual stored and/or transmitted electronically in Internet
    protocols.  This context is highly relevant since a lot of work
    within the IETF involves defining protocols that can potentially
    transport (either explicitly or implicitly) personal data and can
    therefore either, by dint of design decisions when creating them,
    enable either privacy protection or result in privacy breaches.  In
    this specific context, discussions of privacy largely centre around
    the collection minimalization, the usage, and release of such
    personal data."
"
I suggest to delete the last sentence because we are talking about data 
minimization in the next paragraph anyway.

You wrote:
"
    The core principal of data minimization is that the ability for
    others to collect any personal data should be removed.  Often,
    however, the collection of personal data cannot not be prevented
    entirely, in which case the goal is to minimize the amount of
    personal data that can be collected for a given purpose and to offer
    ways to control the dissemination of personal data.
"

I would suggest to write:

"
    The core principal of data minimization is that the ability for
    others to collect personal data should be removed or at least minimized
    when this is either not desirable or when it cannot be entirely 
prevented.
"

I don't want to have the 'purpose' term in there since in the 
consideration document we argue that
for many IETF protocols we are unable to specify the exact purpose due 
to the generic nature of the
protocol design.

* Context section

The first part of the writeup could actually go into the introduction. 
The message of it is: There may not always be a direct link from a 
device to a human using that device. When it is possible that Internet 
protocol message carry data that can be used to identify an individual 
directly or indirectly then there will be privacy concerns. This relates 
to the definition of personal data.

The definition of the terms initiator and responder is fine but we need 
to explain the attacker (or use a different term, such as 'tracker' or 
'observer'). I don't know whether it makes sense to move the text into 
the introduction section as well.

* Definitions

I suggest to remove all "from an attacker's perspective" occurrences 
from the definitions for better readability.

Pseudonymity: I believe we should leave the definition as is and add 
that within the context of IETF protocols there are only pseudonyms 
since there is no requirement to use real names in any of the protocols. 
Do you think that this is a workable solution?

What other terms do you think we should introduce? The following terms 
come to my mind (from what is used in the privacy considerations draft)
  - fingerprinting
  - retention
  - identifier

Maybe 'sticky policy' is also useful.

Ciao
Hannes

---

From: Avri Doria <[email-masked]>
Date: Mon, 26 Dec 2011 13:12:45 -0500

Hi,

I have a few comments on the email which I have interspersed below.  

I also have some concerns on the doc itself not mentioned yet as a far as I can tell

Page 6.
"
 Definition:  Anonymity of a subject from an attacker's perspective
      means that the attacker cannot sufficiently identify the subject
      within a set of subjects, the anonymity set.
"

How is the scope of the Anonymity Set defined?  Is there one set for each data item? For each protocol?  Are there several overlapping Anonimity sets that might serve to allow for narrowing down the identity.  This is pointed out in the last sentence quoted on PAI, but I think it should also be considered in the context of the definition.  i.e

"Note that this example assumes that other personal data cannot be
      inferred from the other SIP protocol payloads, which is a useful
      assumption to be made in the analysis of one specific protocol
      extension but not for analysis of an entire architecture."

Also I think the following is possibly too limited:
"
The set of possible subjects depends on the knowledge of the
   attacker.  Thus, anonymity is relative with respect to the attacker.
"

In the case of a determined attacker would it not be the potential knowledge of an attacker (or all attackers) using all the clues to be found anywhere in any IETF defined header or in the linked headers of other messages?

avri

On 26 Dec 2011, at 09:53, Hannes Tschofenig wrote:

> Hi all,
> 
> 
> in an attempt to update the privacy terminology document Rhys and I had a chat and here are some remarks I sent to him. I thought it may be useful to share them with the rest of you as well.
> 
> Feedback appreciated.

Thanks, while I signed up for the list, I was not paying any attention to the draft.

> We seem to be using the European definition here but shouldn't we then be a bit more precisely, namely
> "

I am wondering about singling out a specific data subject.  If information about a group of similar data subjects can be determined, especially when in a a similar or the same location, an attacker may have all the information needed.

> 
> 'data subject' means an identified natural person or a natural person who can be
> identified, directly or indirectly, by means reasonably likely to be used by the
> controller or by any other natural or legal person, in particular by reference to an
> identification number, location data, online identifier or to one or more factors
> specific to the physical, physiological, genetic, mental, economic, cultural or social
> identity of that person;
> "

I.e. I am wondering whether the 'subject' should be 'subjects'

> Since we don't have the term data subject defined, it may be useful to have something in there.

perhaps this definition is where this can be handled.

> First, in the rest of the document we talk about personal data and not personal information.
> Second, geographical information is a subset of personal data. As such, the issues shouldn't be so different.
> Third, we have a document from the GEOPRIV working group that talks about location privacy in more detail (see http://tools.ietf.org/html/rfc6280). It illustrates a number of threats, including release of information without consent and then there is, as you state, the ability of others to gain more information about the released information than expected by the data subject. The former issue was part of the work on policies, see http://tools.ietf.org/html/rfc4745, and the latter issue is actually an extension to the policies for location obfuscation (see http://tools.ietf.org/html/draft-ietf-geopriv-policy-25).
> 
> In essence I am saying that these issues appear to be different but in fact they aren't.

I agree that they are related and additive. I think that terminology that defines the full scope of what can be learned from the complex of personal data, including location, needs to be included.

> I suggest to delete the last sentence because we are talking about data minimization in the next paragraph anyway.
> 
> You wrote:
> "
>   when this is either not desirable or when it cannot be entirely prevented.
> "
> 
> I don't want to have the 'purpose' term in there since in the consideration document we argue that
> for many IETF protocols we are unable to specify the exact purpose due to the generic nature of the
> protocol design.

Also purpose does not really fit in a Terminological document.

> 
> * Context section
> 
> The first part of the writeup could actually go into the introduction. The message of it is: There may not always be a direct link from a device to a human using that device. When it is possible that Internet protocol message carry data that can be used to identify an individual directly or indirectly then there will be privacy concerns. This relates to the definition of personal data.
> 
> The definition of the terms initiator and responder is fine but we need to explain the attacker (or use a different term, such as 'tracker' or 'observer'). I don't know whether it makes sense to move the text into the introduction section as well.
> 
> 
> * Definitions
> 
> I suggest to remove all "from an attacker's perspective" occurrences from the definitions for better readability.
> 
> Pseudonymity: I believe we should leave the definition as is and add that within the context of IETF protocols there are only pseudonyms since there is no requirement to use real names in any of the protocols. Do you think that this is a workable solution?
> 
> What other terms do you think we should introduce? The following terms come to my mind (from what is used in the privacy considerations draft)
> - fingerprinting
> - retention
> - identifier
> 
> _______________________________________________
> ietf-privacy mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/ietf-privacy
>