Subject: RE: Back to terminology

From: "Axel Busboom (EED)" <[email-masked]>
Date: Wed, 06 Feb 2002 16:54:46 +0100

Jorge,

IMHO, this is the best shot so far at defining a consistent terminology.  The only thing I have a problem with is the distinction between four different types of location recipients (4, 5, 6, 8).  I may be a little out-of-sync here since I didn't participate in the SLC meeting, but I'll raise this point anyway:

- An entity that acts as a "location server" by your definition always takes on the role of a "(private) location recipient" at the same time (otherwise it wouldn't possess any location information to begin with).  An "ultimate location recipient" is an entity that assumes the role of a "(private) location recipient", but not the role of a "location server".  Therefore, one of these three terms seems to be redundant.

- Whether or not a "(private) location recipient" is "ultimate" or a "location server" (it has to be one of these two) seems to be mainly a question of roles and business models.  From a technical point of view, what we should focus on is _policies_.  Using policies, the "owner" could specify whether or not it allows a "(private) location recipient" to further pass on the location information to third parties, or not.  Likewise, a "(private) location recipient" could specify what it intends to do with the location information (pass it on, use it for own location-based services, etc.).  Therefore, I would opt for dropping the "ultimate location recipient" and putting more emphasis on what exactly a policy can specify.

- Number 6 is completely obsolete, IMHO.  Why would you want to treat an access network operator differently from any other entity?  The access network provider clearly is a "location data source" (it can't help knowing my location) and a "(private) location recipient" (could be "ultimate" or "location server", see above) that uses the location information for certain purposes (the most obvious being the mobility management in a mobile access network).  Again, it will be up to the _policies_ specifies by the "owner" what the access network provider is allowed to do or not (i.e. pass it on to third parties, send location-based advertisement, publish it on the Web, etc.).  There is little difference, for example, to a bank that happens to know - from the fact that I inserted my credit card into a teller machine - that I am in Stockholm (well, more precisely it knows that my credit card is in Stockholm, along with someone who knows the PIN, but that doesn't make any difference !
here).  The bank will have to exploit this knowledge in order to provide the service that I have requested (i.e. checking my account balance back home in Germany and paying money to me in Stockholm), but I certainly wouldn't like the bank to further communicate this information to third parties without my explicit consent.  In the future, I may not even use a credit card but a mobile phone or PDA to convince the teller machine to give me money, and then the borderline gets even more blurry.  Therefore, I see no point in treating the access network operator any different from the provider of any other service that happens to be aware of my location.

- 5 has some justification, but again I am not sure this case needs to be treated separately.  Let's call this a "lawful location recipient" just to give it a name.  Any transfer of location data from a "location server" to any type of "location recipient" will require proper authentication (at least of the "location recipient" to the "location server") and authorization (e.g. enforcing the "owners" policies in some way).  We could try to also treat this case via policies.  These would specify that certain properly authenticated "lawful location recipients" are always authorized to get any location information they ask for.  These policies would have a higher priority than those of the "owner", i.e. the owner cannot override them.

Best regards,
Axel

---

From: Randall Gellens <[email-masked]>
Date: Wed, 13 Feb 2002 13:54:23 -0800

At 4:54 PM +0100 2/6/02, Axel Busboom (EED) wrote:

>From a technical point of view, what we should focus on is 
>_policies_.  Using policies, the "owner" could specify whether or 
>not it allows a "(private) location recipient" to further pass on 
>the location information to third parties, or not.  Likewise, a 
>"(private) location recipient" could specify what it intends to do 
>with the location information (pass it on, use it for own 
>location-based services, etc.).  Therefore, I would opt for dropping 
>the "ultimate location recipient" and putting more emphasis on what 
>exactly a policy can specify.

I agree, and in fact I'm concerned that much of the discussion and 
suggestions are immensely complex.  I think we need to make every 
effort to restrict our scope.  As John Noerenberg has mentioned 
before, many of the questions and distinctions posted here are 
interesting and vital, but do not need to be (or in some cases cannot 
be) part of our technical work.

If we can develop something that allows the simple cases to work but 
is extensible to more complex situations (which we can go on to 
address afterwards), I think we will have succeeded.  if we construct 
something so complex that it is ignored, we will have failed.

---

From: "Axel Busboom (EED)" <[email-masked]>
Date: Thu, 21 Feb 2002 09:59:22 +0100

Jorge,

it seems to me like a lot of the discussion following your response
to Kenji's and my comments, was geared more towards requirements (and
scope of the working group) than towards terminology.  I'm not
sure I fully understand the process here - is there going to be a
separate I-D on the terminology, or will the terminology bit be
the basis for a requirement I-D?

Anyway, I'll try to respond to your email, just concentrating on
the pure terminology, and avoiding any discussion of scope and
requirements.

Jorge wrote:

> In principle, I do agree.  In an abstract view, there is no difference
> between ultimate location recipients or location servers: 
> they just react to
> the policies of the owner.  But when you look more concretely 
> and you are
> worried about how things will be implemented, a difference 
> appears.  You may
> argue that the difference I am making is not at the abstract 
> requirements
> level, but is biased towards an implementation.  Yes, perhaps 
> I would agree,
> but still I think we need to do this.  It all depends on your 
> abstraction
> level.  As soon as the requirements are concrete enough that 
> to the point
> where you say: "the location recipient has to verify the 
> authenticity of the
> policies of the owner", this distinction becomes important.

[...]

> My intention was to have Location Receivers to be exactly the 
> disjoint union
> of Location Servers and Ultimate Location Receivers.  (I do 
> not think that
> one of the three terms is redundant).

I have no problem with distinguishing between a Location Server
and an Ultimate Location Receivers.  I guess I'm just not too
happy about the choice of terms.  How about a "Location Receiver"
that can either be an "Ultimate Location Receiver" or an
"Intermediate Location Receiver"?  This would make it clearer
that "Location Receiver" is the more general term, and the other
two are specializations thereof (or, as you put it, the LR
is the disjoint union of ULR and ILR).

Jorge wrote:

> OK.  My distinction between the different types of Location Recipients
> ("private", "lawful" (= "regulatory") and "operational") is 
> quite premature.
> At some point or other we will have to consider that not all types of
> recipients will be subject to the same laws or policies (as 
> Axel writes: ...
> these [policies] would specify that certain properly 
> authenticated "lawful
> location recipients" are always authorized to get any 
> location information
> they ask for.  These policies would have a higher priority 
> than those of the
> "owner", i.e. the owner cannot override them.).  I anticipate 
> that not only
> "lawful" (= "regulatory") location recipients but also 
> "operational" ones
> will be treated differently than ordinary ones.  In this case 
> I agree, this
> distinctions do not have to be made yet, (and perhaps are not 
> the correct
> ones).

OK, then we'd have another distinction between different types of
Location Recipients, depending on their legal roles.  This
distinction would be orthogonal to the distinction between
"Intermediate" and "Ultimate".  Having them in the terminology
won't harm us, it remains to be seen if we will actually need
to make use of this distinction.

You have singled out "lawful/regulatory" as well as "access
network operators" as cases that may need special treatment,
I guess all the rest would be "private" (not the greatest term,
either, since a network operator in most cases will also be
a private entity, but I wouldn't have a better suggestion).
Are we reasonably sure we haven't missed out on anyone?  I must
say I still have my doubts that the "access network operator"
does require a special kind of treatment.  It should not be
entitled to "override" the privacy preferences of the "owner"
(whereas the "lawful/regulatory" should be able to).

Axel

---

From: Cuellar Jorge <[email-masked]>
Date: Thu, 21 Feb 2002 12:23:42 +0100

Axel,

Thank you very much for your comments. They are very much appreciated.

> the basis for a requirement I-D?

Well, terminology does not only settle what are we 
talking about (and thus gives an upper bound to our scope),
but also it decides in which abstraction level we want to talk about
things. If our scope is such that we do not need to make
a distinction, let us better do not do it. Of course, in
this discussion phase, it is sometimes safer to distinguish
between things now and conflate them if appropriate later,
as John Morris pointed already in a mail. But my intention
is only to introduce distinctions that _might_ prove to be 
significant later on.

> > In principle, I do agree.  In an abstract view, there is no
> > difference between ultimate location recipients or location servers:
> > they just react to the policies of the owner.  But when you look
> > more concretely and you are worried about how things will be
> > implemented, a difference appears.  You may argue that the
> > difference I am making is not at the abstract requirements level,
> > but is biased towards an implementation.  Yes, perhaps I would
> > agree, but still I think we need to do this.  It all depends on your
> > abstraction level.  As soon as the requirements are concrete enough
> > that to the point where you say: "the location recipient has to
> > verify the authenticity of the policies of the owner", this
> > distinction becomes important.

> > disjoint union of Location Servers and Ultimate Location Receivers.
> > (I do not think that one of the three terms is redundant).

> is the disjoint union of ULR and ILR).

I would also agree with this term. 

> > OK.  My distinction between the different types of Location
> > Recipients ("private", "lawful" (= "regulatory") and "operational")
> > is quite premature.  At some point or other we will have to consider
> > that not all types of recipients will be subject to the same laws or
> > policies (as Axel writes: ...  these [policies] would specify that
> > certain properly authenticated "lawful location recipients" are
> > always authorized to get any location information they ask for.
> > These policies would have a higher priority than those of the
> > "owner", i.e. the owner cannot override them.).  I anticipate that
> > not only "lawful" (= "regulatory") location recipients but also
> > "operational" ones will be treated differently than ordinary ones.
> > In this case I agree, this distinctions do not have to be made yet,
> > (and perhaps are not the correct ones).

> to make use of this distinction.

Let us have this terminology on the back of our heads an not 
in front of our eyes.

> (whereas the "lawful/regulatory" should be able to).

I think the "access network" has already
brought a confusion in other mails. There are
two different things here: 

1. the "operational" Location Recipients
(of which "access network operator", is only an example). Indeed,
if you look at the papers from the European Community on privacy of
personal data, they give a different "legal" status to data that
is collected for the operational purposes of running the network, etc.

Also the privacy requirements of UMTS distinguish this
type of location information in their policies. In this sense,
I think that "lawful/regulatory" as well as "operational"
Location Recipients may be treated differently from ordinary ones.

But in order to simplify the discussion now, as Randall pointed out:

> If an operational entity is forced by 
> law or regulation or contract to impose constraints on the policies 
> of its users, that's their business.  As long as our work permits 
> this to occur, it needn't concern us.

I agree, this differentiation is now premature. At this
point of the discussion, we do not need to talk about
"lawful/regulatory" or "operational" Location Recipients.

Going back to the "access network operator":
there is another entity, the 

2. Location Data Source: This is the original source of the sighting.
Often this is some network entity, authenticated and 
authorized by the network, but perhaps totally unknown to the 
target/owner, unaware of the full details of the 
policies of the owner, and/or not fully trusted by him.
This may be an entity in the "access network".

I do think that this entity in general has to be treated differently from
"Location Recipients". It may run in a very small processor, with
no power to process the policies of all the owners passing by.
It may be untrusted, in a roaming situation. The owner has
no possibility of saying "_his_ location data is authorized by me",
because he doesn't know who he is. (This is not a matter of the 
mechanics of authentication/authorization, it is a matter 
of being able or not in principle to authorize the data.)

---------

In summary, my proposal now is to have the following terms:

Target: The entity whose location is desired by the Location
Recipient. The target may be a device (say, a cellular phone), a
person (say, the subscriber of the cellular phone), an animal, a ship
or truck, equipment in the field, etc.

Owner of the privacy rights of the target, or, for abbreviation, the
owner: An entity that has the authorization to decide the policies
that apply to the location information of the target. 

Location Server (or "Intermediate Location Receiver"): 
Software and/or hardware entity offering Location
Service capabilities based on user-defined privacy policies.

Ultimate Location Recipient: A Location Recipient that is the ultimate
recipient of the location information (he may not pass this
information, or derived one, to others, except to the target or the
owner). He does not to be aware of the policies of the owner.

Location Data Source: The original source of the sighting.

--------

That is all! The terms "lawful/regulatory", "operational"
or "private" Location Recipients are not needed now.
(We'll keep those things in the back of our heads.)

The term Location Recipient denotes only the disjoint union of
Location Servers (or "Intermediate Location Receiver") and 
Ultimate Location Recipients.

What I would like to ask the group in particular is, if they
are comfortable with:
- the target not necessarily being a device
- the "owner" as the being "owner of the privacy rights"

Those two points were not settled in the discussion so far,
and my impression was that there were a couple of different
opinions. 

Best regards,

Jorge

---

From: "Axel Busboom (EED)" <[email-masked]>
Date: Thu, 21 Feb 2002 16:45:36 +0100

Hi Jorge,

sounds good, I'm happy with the terminology, as proposed in your
update earlier today.

> - the target not necessarily being a device

Yes, I think this should be within our scope.  When a person
uses, for example, an ID card to enter a building, then the
card reader is doing a location "sighting", whether voluntarily
or not. In this example, it makes little sense to consider this a
sighting of the (stationary) card reader or of the (potentially
passive, e.g. bar code) ID card, but the sighted entity rather
is the person.  There may be other cases where it is the device
that is actually sighted, e.g. a cell phone shared by several
users.

> - the "owner" as the being "owner of the privacy rights"

I'm also happy with this definition.  The key open question
here seems to be whether we want to include the case that
a single target can have more than one owner (of privacy
rights).  I could certainly think of scenarios where this
applies. However, for the mere sake of limiting complexity,
I would vote for leaving this out of scope for the time
being.  Otherwise, we'll have to address rather complex
matters, such as delegation of privacy rights, resolution
of conflicting policies etc.  I would tend to second
Randall there, who uttered concerns about keeping
complexity within reasonable bounds.

/Axel

---

From: Cuellar Jorge <[email-masked]>
Date: Thu, 21 Feb 2002 17:14:58 +0100

Hi Axel,

I fully agree! I am also in favor of restricting ourselves
to the case where we have only one owner.

Best regards,

Jorge

-----Original Message-----
From: Axel Busboom (EED) [mailto:[email-masked]]
Sent: Thursday, February 21, 2002 4:46 PM
To: Cuellar Jorge
Cc: [email-masked]'
Subject: RE: Back to terminology

Hi Jorge,

/Axel