Subject: Re: Mobile Location Based Service user privacy (commercial issue)

From: Alex WANG JiaYi <[email-masked]>
Date: Fri, 20 Jul 2001 13:36:36 +0800

Hi Shahid,

This is to follow up our previous email discussion. First, thank you very
much for the comments. 

Now I use a people finding application as an example to show that if the
Mobile Network Operator wants to control the user privacy profile for every
application, it becomes quite complicated. This is always my concern. Do you
have any idea about the general practice of MNOs regarding this, now and
perhaps in future UMTS?

Following is my example of the People Tracking Application provided and
operated by an ASP. By subscribing to this service, people can locate others
whom they have the authorization to locate.
There are User A, B, C, D, etc. Each of them has a user profile in ASP side.

User Profile (People Tracking) in ASP:
User A	-- B, C can track me (User A), time, date, conditions etc.
User B	-- C, D can track  me (User B), time, date, conditions etc.
User C	-- A, D can track  me (User C), time, date, conditions etc.
User D ....
.....

The user profile in ASP is required since ASP operates the Application and
it wants to send request to Network Operator only if the location request is
valid and with authorization.
Also, as you mentioned, the Network Operator will maintain the same Profile
at its own side. Also, it is the arrangement of UMTS.

So, we have anothe user profile in Network Operator.
User Profile (People Tracking) in Network Operator (it is the same one as
User Profile in ASP)
User A	-- B, C can track me (User A), time, date, conditions etc.
User B	-- C, D can track  me (User B), time, date, conditions etc.
User C	-- A, D can track  me (User C), time, date, conditions etc.
User D ....
.....

One question then arises. Where shall the user change his profile since
there are two identical user profiles at different places, one in ASP and
another in Network Operator? Anyway, a solution could be that once one user
profile has been changed, the other has to be informed and updated to make
them match. Then we have another problem. The two user profiles have to talk
and interface to each other.

Thus, for an ASP to develop a Location Based Service/Application, several
interfaces have to be written.

1. The interface between Application and Mobile Terminal (through Mobile
Network)
It could be SMS, WAP (based on WML) in GSM.
Or it could be i-mode compatible HTML in i-mode.
Or HDML in CDMA network.

2. The interface between Application and Location Platform for them to
request and get location feed of certain user.

3. The interface between User Profile in ASP and that in Network Operator
for the user profile date to be imported and exported bwt ASP and Network
Operator.

So, from Mobile Network Operator's point of view, at least two interfaces (2
and 3) are to provided by Location Platform. Also, it will be easy for ASP
to develop applications if the Location Platform can incorporate all the
interfaces together.

I guess that is what NTT DoCoMo's Location Based Service Platform is doing. 

It seems that DLP (DoCoMo Location Platform) for PDC and mopera for PHS is
the only box that 3rd party application/content provider has to deal with,
which simpify the whole structure.
So far, the NTT DoCoMo LBS seems to be content focused other than
application (ASP) focused. That is user requst some information and the
content provider will send the information upon request.

Do you know if DLP or mopera has the full user profile for Location Based
Service?

Thank you for your discussion with me.

Br,
Alex

Alex WANG Jiayi
Mobile, StarHub Pte Ltd
51 Cuppage Road, # 07-00 StarHub Centre, Singapore 229469
Tel:          (+65)    825 5547
Mobile:     (+65)  9004 0768
Email:	[email-masked]
http://www.starhub.com.sg

---

From: Shahid Shoaib <[email-masked]>
Date: Tue, 24 Jul 2001 10:38:09 -0700

> have any idea about the general practice of MNOs regarding this, now and

Presently, DoCoMo offers a number of location based services for example
Ima-DoCo (requires PHS handsets) and DoCo-Navi (uses GPS and i-mode
terminals). These first generation location based services ensure some
degree of user privacy by using a password based authentication mechanism.

UMTS has quite decent support for user privacy. Please see the latest
release of 3GPP TS 23.271 for more details.

> and interface to each other.

The user will always make changes to the subscription profile that is
maintained by the MNO. I really don't think the MNO will agree to
transferring the user's entire/partial subscription information to the ASP
because subscription information itself is quite confidential.

> Do you know if DLP or mopera has the full user profile for Location Based

I consider DLP as part of the MNO. Subscribers to location information
services can access DLP via standard interface and use it to locate
different entities. You can envision DLP playing the role of the Gateway
Mobile Location Center (GMLC) in UMTS/GPRS network.

----------------------------------------------------------------------------
---
Shahid Shoaib                                  +1-408-451-4740 Direct
DoCoMo USA Labs Inc.                  +1-408-573-1090 Fax
[email-masked]           http://www.docomo-usa.com

---

From: Andrew Daviel <[email-masked]>
Date: Fri, 27 Jul 2001 12:01:59 -0700 (PDT)

> release of 3GPP TS 23.271 for more details.

I found http://webapp.etsi.org/action\PU/20010424/ts_123171v030300p.pdf
ETSI TS 123 171 V3.3.0 (2001-03)

8.11.3  UE Privacy Options
 Call related Class  positioning allowed without notifying the UE user (default case)
 Non-Call related Class  Location request allowed from any GMLC (default case)

Interesting defaults...

> > There are User A, B, C, D, etc. Each of them has a user profile in ASP

I was wondering if you had any ideas for how the authorization might be
accomplished to the ASP, and whether this might allow for anonymous
authentication, as of an online "buddy" of whom the real name is not
known.

There is also the issue of how much the user trusts the ASP.

I am perhaps atypical. In my imaginary example, I am my own ASP and take
responsibility for privacy, security etc. My server has a lot of private
information - mail, financial records, medical records, surfing history,
digital certificates - so I will probably be careful to whom I grant
access. Adding some location information to this mix isn't a significant
escalation in privacy risk. I'd probably require direct identity assertion
for authentication (e.g. I give family members a key) and rely on
the operating system (and, I guess, lack of computer skills) to preserve
privacy between family members. As administrator, that gives me
maybe too much power (unless everyone encrypts everything), but I just
have to resist temptation, much as as a security manager in the workplace
I have to respect privacy and not read everyone's mail and track their
surfing habits.

Some arbitrary ASP I may not trust with much information; I may trust
Yahoo with my real name and email, but not my address, phone number etc.
Other ASPs (AOL, ICQ) one may trust with a city and sexual preference, but
not a name or email.
I am unlikely to trust one ASP (Hailstorm, whatever) with everything. The
privacy risk seems too great to have a single huge repository of sensitive
information which might be hacked or compromised by insiders.

Thinking about this some more, I'm not so sure I like the Pull model at
all. As a parent of a minor child (well, under about 13) I might figure I
have a right (or obligation) to know where they are at all times, but
I can't think of many other exaples, apart from say a fleet operator that
wants to track its vehicles (not its employees) or a state that wants to
track convicted felons under house arrest. I probably don't want family
members to know that I'm in an abortion clinic, detox centre, jewellers
buying someone a gift etc. etc. and keeping track of when I want to be
found and when I don't and who I trust with what accuracy  would be a
nightmare.

The business case for pull is, as I understand, to deliver targetted
advertising. Again, I'm not so happy with this. If I only allow anonymous
pull (I agree to accept material from all businesses within 150 metres,
but they can't know who I am) I will be deluged with unwanted messages.
But if I allow them to know who I am in order to deliver personalized
content, they will know my location which I consider unacceptable, unless
my location is brokered one-way through an ASP that I trust, so that the
businesses have some kind of ID (perhaps a free email address) to hang my
"personality" on and the trusted ASP is able to translate this ID (one of
many, perhaps) into a mobile address in order to deliver the content.
I'm trying to avoid making it too easy for someone to know absolutely
everything about me - shoe size, favourite food, education, credit rating,
name, phone number, address, sexual preference, account balance, hair
colour, location etc. etc. - just by monitoring a single ASP (or small
number of them).

Hmm, maybe there's a case for some kind of entertainment channel with
slots for localised advertising - sort of a micro network TV. I'd get
impersonal messages from nearby businesses, but inserted into a stream
that I'd want to receive anyway, such as news or music programming, and
the messages wouldn't be mixed up with personal calls or mail and could be
just switched off without fear of missing anything important. Thinking out
loud here...

-- 
Andrew Daviel
Vancouver Webpages.

---

From: Kenji Takahashi <[email-masked]>
Date: Mon, 30 Jul 2001 16:52:55 +0900

Alex,

As Shahid mentioned, several cellular carriers are offering self/third party
locationing services.  The guidelines by Japanese government requires the
service providers to:

(1) notify users of being tracked in real time
(2) give users means to stop being tracked at any time

Currently the location information is never directly transfered to ASPs in a
"stealth" mode.

And with current services, you can only specify who can get your location -
no restriction on time, areas, or anything.  It may take signiccant time, a
day or two?, to make a change to the control list.

At least, in case of using self-positioning MT, e.g. PDAs with GPS, I prefer
to store control list/divulging policy in my MT, so that I can change it at
my will.

PS. I just returned from Singapore.  I saw the "Starhub" airship in the air
and was wondering what it was.  Now I figured it out :-)

Regards,

Kenji
----- Original Message -----
From: "Alex WANG JiaYi" <[email-masked]>
To: "'Shahid Shoaib'" <[email-masked]>;
<[email-masked]>
Sent: Friday, July 20, 2001 2:36 PM
Subject: Re: Mobile Location Based Service user privacy (commercial issue)