Subject: [Int-area] Feedback on draft-andersdotter-intarea-update-to-rfc6302-00

From: S Moonesamy <[email-masked]>
Date: Sun, 11 Nov 2018 11:11:41 -0800

Hi Amelia,

I read draft-andersdotter-intarea-update-to-rfc6302-00 (expired) 
several months ago.  I unfortunately did have time to comment because 
of a significant increase in workload.  I had an email exchange [1] 
with one of the RFC authors about RFC 6302.  Was there any feedback 
on your draft?  if that is the case, could you please point me to it 
or share a quick summary?

By the way, there was an article [2] about your draft by "one of the 
most influential research and advisory firms in the world".

Regards,
S. Moonesamy

1. It is in the Internet Area mailing list archive.
2. 
https://go.forrester.com/blogs/ietf-takes-gdpr-influence-a-little-too-far-in-its-draft-standard-for-logging-for-internet-facing-servers/

---

From: Amelia Andersdotter <[email-masked]>
Date: Mon, 12 Nov 2018 19:32:13 +0100

On 2018-11-11 20:11, S Moonesamy wrote:
> with one of the RFC authors about RFC 6302.  Was there any feedback on
> your draft?  if that is the case, could you please point me to it or
> share a quick summary? 

E-mails in this thread:
https://www.ietf.org/mail-archive/web/int-area/current/msg06335.html 

and here:
https://www.ietf.org/mail-archive/web/int-area/current/msg06434.html

It was my sense that the feeling in the group was that, much like
RFC6302 hasn't necessarily been taken up or solved the problems it
purported to, neither would updating it in a privacy-conducive direction.

> most influential research and advisory firms in the world". 

I think they've misunderstood the GDPR. It's a highly risk assessment
based text, which only makes requirements where "possible" or
"appropriate". This was also one of the feedbacks that inspired my
draft, or rather grievances expressed with the GDPR (it is a framework
which is difficult to understand because of its vagueness).

Practically, the use cases for logged data discussed in the WG were
unrelated to breaches and related to advertising and LEA.

best regards,

Amelia

-- 
Amelia Andersdotter
Technical Consultant, Digital Programme

ARTICLE19
www.article19.org

PGP: 3D5D B6CA B852 B988 055A 6A6F FEF1 C294 B4E8 0B55

---

From: S Moonesamy <[email-masked]>
Date: Mon, 12 Nov 2018 11:43:58 -0800

Hi Amelia,
At 10:32 AM 12-11-2018, Amelia Andersdotter wrote:
>E-mails in this thread:
>https://www.ietf.org/mail-archive/web/int-area/current/msg06335.htmlÂ
>
>and here:

Thank you for summarizing the group discussion.

>which is difficult to understand because of its vagueness).

Ok.

>unrelated to breaches and related to advertising and LEA.

The reasons given are usually anti-abuse and regulatory requirements.

Regards,
S. Moonesamy