Subject: privacy

From: Edward Lewis <[email-masked]>
Date: Tue, 7 Jan 2003 14:40:21 -0500

Over the past few weeks the primary concern of the WG has been 
preparing an answer to the IESG comments.  The one sticking point has 
been the comment to provide privacy information at a more granular 
level that we now provide.

There was a meeting of the IESG members involved, your chairs, and 
Scott to review the state of the issue last month.  The outcome of 
that phone call was sent by Scott to the list.  I've seen responses 
from just two folks publicly and one privately.  I've been hoping for 
more - and more positive responses.

First I want to make it clear that Scott isn't pushing this issue 
back on to the table because we wants to.  This is an issue on which 
we are getting feedback from the IESG, and they hold sway over our 
documents, as in they have the final word.  They are reasonable 
folks, but they do hold the final word.

I promised Scott that I'd wait until today to let folks that have 
been out of the office over the past two weeks (plus a day to 
download all the pending mail) before prompting the group another 
time to consider this issue.

The crux of the issue is, there are situations in which a registrar 
may wish to alter the default privacy considerations for data when 
interacting with a registry.  Not all registrar-registry environments 
will need this flexibility, but there is a claim that some exist.  (I 
have no personal, first-hand knowledge of any such environments.)

How can we accomodate such environments?  That is the basic question.

The most recent thread on this begins with:
      http://www.cafax.se/ietf-provreg/maillist/2002-12/msg00100.html

Next: Milestones, ROID and other issues...
-- 
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
Edward Lewis                                          +1-703-227-9854
ARIN Research Engineer

---

From: Rick Wesson <[email-masked]>
Date: Tue, 7 Jan 2003 13:43:57 -0800 (PST)

Ed,

I have some thoughts on this. I prefered the capability in scott's second
to the last proposal [1] -- I also have an issue with the IESG deciding
what in the most appropiate methodology.

finally I would appreciate it if the IESG would post these discussion to
the public list as private discussions are just that, private. Since we
are discussing the privacy of end-users information (that will eventually
be published in whois) it seems silly that we are not involved in the
discussion and decision process on this topic.

Lets put the proposal [1] back on the table and if the IESG has an issue
with it lets here from the IESG in this wg, not through our
DOCUMENT-EDITOR or the CHAIR but involve those members of the IESG that
have a problem with it.

-rick

[1] http://www.cafax.se/ietf-provreg/maillist/2002-12/msg00093.html

---

From: Edward Lewis <[email-masked]>
Date: Tue, 7 Jan 2003 17:04:25 -0500

Note that I cut off the IESG from the reply - this isn't something to 
clutter them up with.

In as mush as I appreciate where Rick's coming from, I'd just like to 
solve the problem at hand, the privacy issue.  Issues concerning the 
IESG interface (I admit that there are some in general) are being 
discussed elsewhere, i.e.:
    ([email-masked] for subscriptions to that).

It's not that I don't want to hear about IESG interface problem - 
even though I really don't - it's that I don't want to hear about 
that issue here.  If you get my drift.

Okay, but I did say that we are stuck because the IESG has said we 
have to address their concerns.  I meant this to be the reason why 
Scott has had the unenviable task of raising once again the privacy 
issue.  I did not mean this to be a complaint about the IESG 
stonewalling us.  If the WG has sufficient reason for us to not 
address an IESG comment, we need to build a case for that.  It's not 
like the IESG can't change their mind about an issue.

As far as the privacy issue discussion, everything that was discussed 
between "us" has been posted to the provreg list.  BTW, the entire 
call was on clarifying the comments on privacy (which are on the mail 
list archive site).  No document modifying "decisions" or even 
suggestions were made.

Let me ask this of the WG group:

Is there a reason not to add more granularity to the privacy specification?

Should we strive to add granularity?
Should we not strive to add granularity?

---

From: Patrik Fältström <[email-masked]>
Date: Tue, 7 Jan 2003 23:28:40 +0100

> what in the most appropiate methodology.

What IESG want is _some_ mandatory to implement mechanism which makes 
it possible for the registrar to say to the registry "Do not disclose 
this attribute to a third party". If the wg want to have the mandatory 
to implement mechanism more powerful than that, fine. What is not ok is 
the protocol not having any mandatory to implement privacy mechanism in 
it, only extensions.

> the public list as private discussions are just that, private.

The issues IESG has are posted on the I-D tracker, and it is up to the 
editor and wg chair (and that way the wg) how to resolve the issues. 
What we as IESG members have got are suggestions on solutions, and we 
have (as far as I remember) said yes to all proposals.

What we have heard back from wg chairs etc is that they have got 
private messages back from wg members which have issues with the 
proposals, issues with privacy being mandatory _at_all_. They have 
checked with IESG whether things really need to be mandatory, and the 
answer is yes.

What is the difference between what you here point to, and what Scott 
might have proposed later, I can not say, and I don't know if any of 
the IESG members can say straight from our head. We have many documents 
to look at, and we have posted the issues we have on the I-D tracker. 
We must trust the wg chair being able to solve the problem in one way 
or another, and come back to us with updated documents.

    paf

> Since we

---

From: Rick Wesson <[email-masked]>
Date: Wed, 8 Jan 2003 09:35:27 -0800 (PST)

Patrik,

> the protocol not having any mandatory to implement privacy mechanism in

The issue that some folks have with and IESG mandatory to implement
privacy capability in the prov-reg domain registration context is that
addressing privacy just in epp is not a solution. Addressing privacy in
epp also requires addressing it in the publishing protocols.

privacy is a thick issues and I've not seen/herd one prov-reg participant
stand up and say "we understand privacy and here is what should happen"
What we do see on the list and in the meetings is that we are not the
people who should develop a privacy context and we don't know how to do
it.

we have asked for additional direction and get a responses that are obtuse
and confusing. Everyone appears to agree that privacy is a more complex
issue than the IESG is willing to accept and that provreg may not be the
place to define such capabilities.

I request that you consider that this working group may not be capable of
addressing the problem and appreciate your thoughts on the next step if
this proves to be true.

-rick

---

From: Patrik Fältström <[email-masked]>
Date: Wed, 8 Jan 2003 20:09:48 +0100

Let me rephrase what I heard IESG saying, as sponsoring AD for this 
document. As IESG is cc:ed people can jump in and correct me, or add 
more/different things.

First IESG completely agree the issues with privacy is complicated. The 
laws and requirements in different countries are very different, and 
basically differ in for example the following ways for "white-pages 
information":

  - Whether opt-in or opt-out in a public database is the function needed
  - Whether the opt-in/opt-out is allowed to be implicit, or if it
    must be implicit
  - What information a registry can say is mandatory to allow being
    public
  - ...

These requirements which certainly differ not only between registries 
but also what legislation the registrant belong to is clear. In various 
communities discussions exists wether for example it is ok for the 
registry outside of Sweden to publicly publish social information about 
a domain name holder from Sweden if the registrant is a private person. 
The input I have got from lawyers in Sweden is that publication of such 
information in whois is not ok if not the registrant has explicitly 
said yes to it. And, competition legislation say it is not ok for a 
registry to require this (implicit opt-in) to get the service.

Of course, these people I have talked with can be wrong, but similar 
examples exists in Austria, Switzerland and the Netherlands. This issue 
is discussed heavily in for example CENTR Legal group (I forgot the 
name of this group) because the "requirements" ICANN has put on whois 
and ccTLD is violating the local law in some countries.

These differences together with the requirement in RFC 3375 that the 
protocol MUST be able to handle the cases that one have:

  - multiple registrars connected to one registry
  - one registrar connecting to multiple registries
  - one object being associated with other objects, possibly under
    authoritative control of a different registrar
  - one registry being thin, another thick (when looking at
    where social information is stored)

These three rules are just some signs that the protocol MUST be 
something which is interoperable between multiple implementations, and 
this in turn lead to the need for multiple implementations which can 
handle the various permutations of legal rules for handling of the 
social information about a registrant.

Now, what IESG is concerned about is _INTEROPERABILITY_, not so much 
privacy.

Are you surprised? I hope not.

Now, IF the wg explain in the specification of epp how interoperability 
in the real world is guaranteed, then we are done. Interoperability in 
mixed environments when multiple different privacy models are used.

Does this explain the issue better?

    paf

---

From: Allison Mankin <[email-masked]>
Date: Wed, 08 Jan 2003 19:22:36 -0800

Rick,

---

From: Allison Mankin <[email-masked]>
Date: Wed, 08 Jan 2003 19:37:02 -0800

Rick,

We are just trying ensure that a basic privacy can be implemented
on the fields.  Like what we have done for years in IETF with
security: mandatory-to-implement baseline, with the customized stuff
in extensions.

There are a number of other efforts on privacy in IETF working groups
and at large - this is not the only place nor the only way that a group
has been asked to make mandatory-to-implement privacy.  Geopriv is an
entire working group for that.   I know, as its co-chair, how hard
the problem is.

Allison

---

From: Andrew Sullivan <[email-masked]>
Date: Thu, 9 Jan 2003 12:54:02 -0500

On Wed, Jan 08, 2003 at 07:37:02PM -0800, Allison Mankin wrote:
> on the fields.  

I get the impression, from reading the thread, that it is not clear
what "a basic privacy" is.  But any time I try to answer that
question, I always end up thinking about policy matters and not
technical ones.  That seems to me to be a reason to believe that this
problem should not be addressed in the base specification.

> has been asked to make mandatory-to-implement privacy.  Geopriv is an

And so what if the others come up with a mandatory-to-implement
privacy that is inconsistent with the mandatory-to-implement privacy
that ends up in the EPP specification?  It seems to me it might be a
mistake to implement privacy piecemeal.

(As is the tradition in the IETF, I speak only for myself and not my
employer.  My employer might well not agree with my view.)

A

-- 
----
Andrew Sullivan                         204-4141 Yonge Street
Liberty RMS                           Toronto, Ontario Canada
<[email-masked]>                              M2P 2A8
                                         +1 416 646 3304 x110