Subject: [siprec] Clarifying siprec-req scope/privacy

From: "Elwell, John" <[email-masked]>
Date: Mon, 13 Dec 2010 16:49:15 +0100

Prior to and during Beijing we had good discussions on privacy, and we ended up with some proposed text that seemed to be acceptable and has been incorporated in -05. However, Alissa Cooper also asked for more clarity on scope:
http://www.ietf.org/mail-archive/web/siprec/current/msg01044.html
and I don't think this has been addressed properly yet in siprec-req-05 (https://datatracker.ietf.org/doc/draft-ietf-siprec-req/).

I would like to propose the following changes:

1. In section 2, paragraph beginning "Respecting the privacy rights and wishes of users ...", the last sentence says: "In addition, lawful intercept is outside the
   scope of this document."
I propose replacing this sentence with:
"Use cases where users participating in a call are not informed that the call is or might be recorded are outside the scope of this document. In particular, lawful intercept is outside the scope of this document."

2. The whole of this same paragraph (beginning "Respecting the privacy rights and wishes of users..."), including the modification proposed above, should be repeated at the start of section 6 (Privacy Considerations). Originally this paragraph and the paragraphs that currently appear in section 6 were proposed for inclusion in section 6. Whilst it is good to have the first paragraph up front in section 2, if it is not repeated in section 6 the rest of section 6 loses its context.

John (as individual)

---

From: Alissa Cooper <[email-masked]>
Date: Wed, 15 Dec 2010 22:03:46 +0000

Hi John,

Thanks for circling back to these. I agree with both of your  
suggestions. I'm also glad to see the addition of section 6.

As noted in my email that you reference below, I still think the last  
paragraph of section 6 overstates the case a bit. I would suggest  
trimming the parts that make assumptions about user preferences and  
policy, like so:

"This document does not specify any requirements for a user engaged in  
a CS to be able to dictate policy for what happens to a recording, or  
for such information to be conveyed from an SRC to an SRS. It is  
assumed that the SRS has access to policy applicable to its  
environment and can ensure that recordings are stored and used in  
accordance with that policy."

Cheers,
Alissa

On Dec 13, 2010, at 3:49 PM, Elwell, John wrote:

> Prior to and during Beijing we had good discussions on privacy, and  
> we ended up with some proposed text that seemed to be acceptable and  
> has been incorporated in -05. However, Alissa Cooper also asked for  
> more clarity on scope:
> and I don't think this has been addressed properly yet in siprec- 
> req-05 (https://datatracker.ietf.org/doc/draft-ietf-siprec-req/).
>
> 1. In section 2, paragraph beginning "Respecting the privacy rights  
> and wishes of users ...", the last sentence says: "In addition,  
> lawful intercept is outside the
>   scope of this document."
> "Use cases where users participating in a call are not informed that  
> the call is or might be recorded are outside the scope of this  
> document. In particular, lawful intercept is outside the scope of  
> this document."
>
> 2. The whole of this same paragraph (beginning "Respecting the  
> privacy rights and wishes of users..."), including the modification  
> proposed above, should be repeated at the start of section 6  
> (Privacy Considerations). Originally this paragraph and the  
> paragraphs that currently appear in section 6 were proposed for  
> inclusion in section 6. Whilst it is good to have the first  
> paragraph up front in section 2, if it is not repeated in section 6  
> the rest of section 6 loses its context.
>
> John (as individual)
>
>
> _______________________________________________
> siprec mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/siprec
>

---

From: "Elwell, John" <[email-masked]>
Date: Thu, 16 Dec 2010 09:25:04 +0100

Thanks, Alissa. Personally I agree with your revised words.

John

> -----Original Message-----
> From: Alissa Cooper [mailto:[email-masked]] 
> Sent: 15 December 2010 22:04
> To: Elwell, John
> Cc: [email-masked]
> Subject: Re: [siprec] Clarifying siprec-req scope/privacy
> 
> Hi John,
>

---

From: "Parthasarathi R (partr)" <[email-masked]>
Date: Thu, 16 Dec 2010 14:26:10 +0530

John/Alissa,

Could you please let us know whether all privacy policy of SIPREC will
be passed in the metadata from SRC to SRS or not?  

Currently, we have attributes like retention policy in the model. If
metadata is used to pass all privacy info, whether it falls under
application data of the  model or specific attribute has to be added in
the model? 

Thanks
Partha

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf
Of Elwell, John
Sent: Thursday, December 16, 2010 1:55 PM
To: Alissa Cooper
Cc: [email-masked]
Subject: Re: [siprec] Clarifying siprec-req scope/privacy

John

---

From: "Elwell, John" <[email-masked]>
Date: Thu, 16 Dec 2010 10:18:36 +0100

Partha,

Present requirements document (with or without the recent working change proposal) does not require policy to be conveyed from SRC to SRS. Thus I would conclude there is no requirement for including retention policy in the metadata model.

I would hope that the model and the metadata representation during transport would be extensible, so that we could add policy information at a future revision if necessary.

John (as individual)

> From: Parthasarathi R (partr) [mailto:[email-masked]] 
> Sent: 16 December 2010 08:56
> To: Elwell, John; Alissa Cooper
> Cc: [email-masked]
> Subject: RE: [siprec] Clarifying siprec-req scope/privacy
> 
> John/Alissa,
> 
> From: [email-masked] 
> [mailto:[email-masked]] On Behalf
> Of Elwell, John

---

From: "Parthasarathi R (partr)" <[email-masked]>
Date: Thu, 16 Dec 2010 16:06:32 +0530

John,

Thanks for the clarification.

Thanks
Partha 

-----Original Message-----
From: Elwell, John [mailto:[email-masked]] 
Sent: Thursday, December 16, 2010 2:49 PM
To: Parthasarathi R (partr); Alissa Cooper
Cc: [email-masked]
Subject: RE: [siprec] Clarifying siprec-req scope/privacy

Partha,

Present requirements document (with or without the recent working change
proposal) does not require policy to be conveyed from SRC to SRS. Thus I
would conclude there is no requirement for including retention policy in
the metadata model.
<Partha> We will conclude this point in today interim meeting and remove
from the model bsaed on the consensus </Partha>

I would hope that the model and the metadata representation during
transport would be extensible, so that we could add policy information
at a future revision if necessary.
<Partha> I agree with you, we will add policy information attributes in
the next revision based on more detail inputs </Partha>

John (as individual)

> application data of the  model or specific attribute has to be added 
> in the model?
> 
> Thanks
> Partha
> 
> [mailto:[email-masked]] On Behalf Of Elwell, John