00:00:27 jmayer: 1) how long do you get to keep passively collected data around for security/fraud -- up to 6 months instead of 2 weeks 00:01:28 ... 2) when you have a reason to believe; that is, not id cookies in every browser, add a cookie for IPs where you're getting a lot of requests 00:02:07 ... and if you have a specific reason to believe, then the 6 month limit is lifted as well 00:02:16 q? 00:02:47 ifette: cookies are active, so you can't keep set/retain cookies for fraud purposes? 00:03:49 brooks: when you mean "fraud", you don't mean the legal case of "fraud", you just mean the financial reporting 00:04:07 jmayer: click fraud, impression fraud, advertising fraud ... not getting into questions of criminal fraud 00:04:08 q? 00:04:23 while issue of security and fraud needs more thinking 00:04:30 q? 00:04:46 Marc has joined #dnt 00:04:48 ack fielding 00:05:15 q+ 00:05:17 fielding: distinction between slides/draft -- is the language and the substance consistent? 00:05:26 q? 00:05:30 ack dwainberg 00:05:38 - 00:05:39 cspiezle has joined #dnt 00:05:42 jmayer: this presentation was attempted to be high-level 00:05:45 q- 00:05:47 q+ 00:06:21 dwainberg: step us through, what would a party do between first contact and when they reasonably know fraud may be undergoing? 00:06:47 q? 00:06:49 jmayer: protocol information for 6 months, plus active measures for 2 weeks [may have mis-scribed that] 00:07:16 q? 00:07:33 jmayer: this was based on talking to people at companies about how they do this now, that the most commonly used input is protocol logs, not the only input but the primary input 00:07:51 ... also tried to verify how much better off would an attacker be? 00:08:04 we need to look at a broader view of fraud, beyond ad click fraud 00:08:07 q+ 00:08:12 ack robsherman 00:08:25 ... a number of companies confirmed that they wouldn't be better off because adversaries already employ clearing/modifying cookies 00:09:22 robsherman: when I do have reason that fraud may be ongoing, how do I engineer my system to put a cookie on just the fraudster's browser? 00:09:35 q? 00:09:42 q? 00:09:47 jmayer: a variety of levels of concern about fraud; some companies were fine with just protocol information 00:10:02 ... some companies, including ad companies, were more sensitive and did engineering that was dedicated to fraud 00:10:28 q+ 00:10:35 ... a lot of online ad networks we talked to already had a two-tier system in place, with more techniques employed in those cases 00:10:39 ack Chapell 00:10:46 my concern wearing the hat of commerce and banking sites is to be sure we do not lmit or imapct their ability to detect suhc behavior. 00:11:05 q? 00:11:16 ack cspiezle 00:11:31 Chapell: first parties pretty much have a free pass, except for not getting around third parties, right? -- yes. -- that seems to contradict tl's comments earlier, are we misunderstanding something? 00:11:45 q? 00:12:04 Chapell: use of offline or other data combined with a first party's data, the earlier discussion 00:12:12 q+ 00:13:21 jmayer: business practice is like a newspaper that gathers data about the user, and then append the data from an offline party to the first party's profile of the user 00:13:47 +q 00:13:48 q+ 00:13:54 q? 00:14:03 Chapell: if Acxiom were here, they might argue that they're a service provider, so you might need to change that in the text 00:14:16 ack ifette 00:14:17 ack ifette 00:14:45 ifette: protocol includes "top-level url", you mean the full URL, not just the hostname, right? 00:14:45 Roy tells me Chris got ack'ed too early -- sorry, Chris! 00:14:46 jmayer: yes. 00:14:47 Chapell, If Acxiom were to commit to following the outsourcing/service provider rules, I suspect (?) that would solve this problem. 00:14:53 q+ 00:14:58 q+ cspiezle 00:14:59 That makes Chris next 00:15:31 ifette: how many companies did you talk to that didn't use cookies for DoS of attacks? 00:15:50 Justin, I'm not sure - you may be right. But I think the offline data brokers would argue that they are outside the scope of this spec 00:15:59 jmayer: companies that already had cookies do use them now, but companies seem to think they'd be okay without them (not all companies) 00:16:06 q 00:16:07 q? 00:16:10 ack cspiezle 00:16:23 my bad 00:16:46 cspiezle: on transactional fraud, don't want to impact their ability (like banks, etc.) 00:17:22 jmayer: if you're trying to prevent fraud on your own (first party) site, this wouldn't have any impact, you can do the most intrusive tracking if you like 00:17:37 ... you can share threat intelligence, limits lifted if there is a reason to believe 00:18:17 Chapell, That may well be the case --- it's just that you had suggested they would say their service providers. They might prefer to utilize/resell the information they receive as a result of an append. I do not know about their business models to know common practice on this. 00:18:33 'innocent unless proven guilty' fraud detection approach 00:18:34 ... certain companies where all they do is follow financial transactions, look for users' whose machines have been hacked -- would want to talk to them more about that 00:18:43 ack fielding 00:18:47 q? 00:19:08 fielding: typically those groups are acting on behalf of a first party, but they store behavioral trails from multiple sites 00:19:09 they are working on behalf of first parties 00:19:31 q? 00:19:31 jmayer: wanted to solve the 95% use case 00:19:41 ack alex 00:19:41 ack alex 00:20:25 perhaps small number of servce providers but they may provide services to 100,000 of commerce sites, banks, ISPs.... 00:20:31 alex: given a currently unknown threat vector, attacker only has to change their protocol information every 6 months. can't go back through 2 years of data. 00:20:58 jmayer: yes, there would be that limit. 00:20:59 q? 00:21:11 So I'm going to click on something a lot, and then stop, and then wait six months and then do it again? 00:21:26 And it won't get detected? 00:21:50 Sort of like that, aleecia 00:22:01 jmayer: if you haven't caught someone trying to do click fraud within six months of doing it, then you won't have that data afterwards 00:22:38 couldn't you roll out hundreds/thousands of user agents on a large number of IP addresses, engage in low level click fraud and have it add up to a lot of money. 00:22:44 ... not generating this out of the blue, some companies thought they didn't need more, some companies wanted more, thought it was a compromise as many advocates were concerned about a browsing history for 6 months 00:23:01 WileyS: was one of your design considerations ready availability, scale and mass adoption? 00:23:12 q? 00:23:21 ack WileyS 00:23:48 jmayer: the privacy-preserving technologies that we have in mind include many that advertisers have said are unworkable 00:23:54 and having a full clickstream of all of us for the past 10 years (at least) would be the dream of all spooks, wouldn't it? And we don't allow that for a government but allow the government to raid this private collection? I seriously question some of the asserted need for those extraordinary retention periods 00:24:05 q? 00:24:24 ... technologies where I see a consensus among researchers do work, though they would have some implications 00:24:33 Please note "implications on performance and revenue" 00:24:49 ... no doubt that there's a runway period / grace period 00:24:58 q+ 00:25:27 mischat has joined #dnt 00:25:34 q? 00:25:43 q- 00:25:48 +q 00:25:49 Fail 00:26:02 WileyS: given that there's a disagreement between researchers and implementers, did you take mass adoption (by companies/implementers) into consideration? 00:26:02 ack JC 00:26:12 jmayer: yes, talking to companies, aimed for balance, a guiding consideration 00:26:49 q? 00:27:15 JC: if we're talking about multi-site behavioral data, why does DNT have any effect on Acxiom account data? 00:27:42 ... that's not behavioral information, so DNT doesn't apply 00:27:55 q+ 00:28:12 q? 00:28:40 jmayer: flows like these identified as a concern in small groups at Washington; very discrete sharing of information 00:28:46 JC: worried about scope creep 00:29:29 q? 00:29:36 jmayer: focused on things that are not as narrow 00:29:42 ack dwainberg 00:30:01 JC would like DNT to address OBA; people involved in DNT earlier on see DNT as applying to data more generally. (If this is not write, please correct) 00:30:05 q? 00:30:15 dwainberg: top-level domains and referers, many cases of 3rd-party ad-serving where top-level domain info isn't shared (because of iframes, etc.) 00:30:50 ... sometimes you'll receive a domain name that isn't the top-level domain but an intermediate iframe 00:30:58 q? 00:31:01 aleecia: I don't limit DNT to OBA, but online collection of data 00:31:27 ok, thanks for fixing that 00:31:50 jmayer: if you don't get the Referer in the header but it get it somewhere else (passed along as a URL parameter, for example) -- that's passive collection in the same sense, some advocates thought this was a concession but it happens with some frequency 00:31:58 q? 00:32:35 dwainberg: can you share the list of companies you talked to? 00:32:49 q+ hwest 00:33:24 q+ 00:33:27 jmayer: commonly have permission to talk to companies without revealing who they are, companies can identify themselves but I'm not comfortable doing so 00:33:52 ... I thought it was a broad representation of both size and market sector, including more companies than I recall, including companies inside and outside of the WG 00:34:22 What is punishment? 00:35:00 q? 00:35:12 tl: some organizations talked about concerns sharing regarding trade associations 00:35:29 ack jchester 00:35:38 hwest: concern about misrepresentation 00:35:56 I don't think it's useful to think about this in terms of representation. This is Jonathan's take of where the industry is. 00:36:01 +q 00:36:04 He may or may not be right. 00:36:22 jmayer: tried to present it adequately, including qualifications in almost cases 00:36:24 Now we need to have things about the impact of these ideas on the table here. 00:36:53 q? 00:37:03 q- 00:37:09 thank you, Heather 00:37:14 q- 00:37:35 Thank you, Alan 00:37:51 Let's get through the discussion if we can 00:37:56 dwainberg: what do we do if there's a new fraud attack that requires changing these requirements? 00:38:01 q? 00:38:12 ack amyc 00:38:19 q? 00:38:20 jmayer: have to evaluate the likelihood of such a new attack, have an implementation period, can revise specification 00:38:37 q? 00:38:44 ack Marc 00:38:50 Well, if Jonathan's not concerned (about the unintended consequences of his rather grand proposal), that's good enough for me! 00:38:56 amyc: operational practices such as billing with "Active" -- I'd like to understand that better 00:39:41 Let's keep the tone civil, please. 00:39:47 specifically, want to understand whether Jonathan thinks it is OK to use LSO or fingerprint for operational uses 00:39:54 Rob has joined #dnt 00:40:02 q? 00:40:19 jmayer: instead of having a billing exception, passive/actively collected used for a period of time for any use 00:40:21 thanks, Marc 00:40:32 jmayer: design motivations 00:40:36 aleecia, schunter ack'd Marc above 00:40:42 which I believe he did when he handed him a microphone 00:41:09 ... based on current advertising company practices, including opt-out practices 00:41:19 Yes 00:41:30 q? 00:41:31 ... make it possible for external verification of compliance 00:41:37 Thank you. Marc was kind enough to be willing to wait 00:41:53 q+ 00:42:03 ... concerns about updating the standard whenever there's a new business model or business purpose 00:42:32 I'm going to let Jonathan finish, since we're very close to time. We'll go to the queue after 00:42:43 ... don't want any new company/model to have to get a standards body's permission to explore a new business model 00:43:12 ... give a protocol retention period given how many companies talked about how useful it was 00:43:27 While I recognize the importance of maintaining confidentiality when speaking with companies, and I certainly don't question TL or JM's ethics -- its very difficult to vet the accuracy of the claim that industry was widely consulted about this proposal without a better sense of the nature of the companies you've spoken with 00:43:29 jmayer: defaults 00:44:06 ... this proposal says DNT can't be on by default, a concession as I and some others believe it would be a better policy if they could 00:44:22 johnsimpson has left #dnt 00:44:36 ... servers don't get to "second-guess" an expressed header 00:44:37 "industry" is a broad term -- sort of like "human" ---- some similarities, but lots of differences... making generalizations and extrapolations difficult 00:44:40 q? 00:44:44 q+ WileyS 00:44:45 +q 00:44:47 ack alex 00:44:49 +q 00:45:00 q+ 00:45:04 q? 00:45:07 sean has joined #dnt 00:45:13 q+ 00:45:31 alex: external verification as a motivation: why would privacy advocates be against internal verification like audits? 00:46:15 ... audits of internal operations, for example 00:46:57 q? 00:47:04 jmayer: I think external verification is important: strong role of encouraging compliance, researchers and advocates can work with regulators to discover issues, invite media or public pressure 00:47:08 q+ 00:47:12 ... this would allow that mechanism to continue working 00:47:15 If you passed before to wait, please add yourself now. 00:47:22 ... also gives consumer confidence 00:47:24 And then we'll be closing the queue, since we're done at 6 00:47:51 zakim, close queue 00:47:51 ok, tlr, the speaker queue is closed 00:48:08 alex: but why don't you like internal audits? for example, when a party needs to collect some data 00:48:11 q? 00:48:41 jmayer: these were advantages I saw to external rather than internal 00:49:03 alex: but can't you get all those advantages from internal audits? mathematically proven unlinkability can be audited for 00:49:33 q? 00:49:43 q+ 00:50:02 ack WileyS 00:50:05 ack WileyS 00:50:15 q? 00:51:01 WileyS: said advocates were making a significant concession, but creating an exception that swallows the rule. because DNT:1 would still have to be followed. 00:51:23 jmayer: gives an extra lever to say that browsers that set it by default are not in compliance with the W3C spec 00:51:38 ... possible legal measures, public pressure 00:52:09 ... couldn't claim to following the spec (which could otherwise be a deceptive practice) 00:52:17 ack justin 00:52:33 ack ChrisPedigoOPA 00:52:38 ack ChrisPedigoOPA 00:52:44 ack sean 00:53:07 q? 00:53:11 ack fwagner 00:53:13 sean: thx for presentation. didn't address exceptions/out-of-band consent...? 00:53:22 aleecia: not part of the original template folks were supposed to cover 00:53:56 fwagner: do you expect a complete overview of all affiliates of Microsoft? would that list ever be complete? 00:54:07 q? 00:54:10 yes, yes it is 00:54:33 q+ 00:54:40 jmayer: believe it's very similar to the proposal Shane presented; I would hope that it would be mostly complete although maybe there would be some edge cases (cover the 95% case) 00:54:49 we end at 6 00:54:55 Aleecia wanted a few minutes to wrap up. 00:55:00 which I think is useful 00:55:26 we could talk easily another hour 00:55:27 meetings should be 24*7 ;-) 00:55:30 ... I believe this could deviate from user expectations and an area where regulators have expressed concern, so I think it was a substantive concession 00:55:41 on either proposal 00:55:51 fwagner: can you make a clear difference between unlinkability and anonymity? 00:56:21 jmayer: borrows some from DAA concept on deidentifiability 00:56:37 ... not asking for Arvind to proof your data 00:56:52 ... does ask for significant steps, beyond dropping an ID cookie, more like aggregation 00:57:01 I heard no justification for why outsourced service providers are listed as an exception instead of being part of the definition of same "party" 00:57:38 fwagner: from a European perspective, collection of data while it's identifiable is still a problem with European regulations 00:57:42 we nned to accept business users may opt in by defualt for all of their devices and users. We need to be sure we respect this even though the user did not turn on DNT, but the owner of the device did. Second ISPs could offer a pre-configured browser for max privacy and security protections. If a user accepts the browser with DNT =1 then this option needs to be respected. 00:57:48 q? 00:58:19 schunter: jmayer talking about meeting his standard, not a guarantee of satisfying EU regulation 00:58:23 Topic: wrap-up 00:58:37 schunter: thanks for a productive discussion, civil ("no flying tomatoes ;) 00:58:52 ... always talk about the differences, sometimes we set aside how much agreement we have 00:58:56 Ideally we have greater understanding walking out now 00:59:15 ... actually have a lot more agreement than we had, we're just not talking about those parts any more 00:59:20 Address is in the agenda 00:59:45 JC: caddy-corner for NE 8th & 110th, please bring your nameplates 00:59:57 ... if you get lost, call JC! :) 01:00:14 schunter has joined #dnt 01:00:32 JC: doors open at 8 o'clock, food arrives at 8:30 01:00:58 optional self-hosted dinner present here: 01:01:00 http://www.w3.org/2011/tracking-protection/agenda-2012-06-20-bellevue.html 01:01:07 rrsagent, draft minutes 01:01:07 I have made the request to generate http://www.w3.org/2012/06/21-dnt-minutes.html npdoty 01:01:18 Chair: aleecia, schunter 01:01:40 Meeting: Tracking Protection Working Group Bellevue Face-to-Face 01:16:40 KevinT has joined #dnt 01:19:12 aleecia has joined #dnt 02:19:52 tedleung has joined #dnt 03:10:33 tedleung has joined #dnt 04:28:30 Zakim has left #dnt 05:11:44 tl has joined #dnt 05:18:09 fielding has joined #dnt 05:21:13 schunter has joined #dnt 05:23:16 dwainberg has joined #dnt 05:46:12 dwainberg has joined #dnt 06:16:26 mischat has joined #dnt 06:21:55 fwagner has joined #dnt 06:43:53 fielding_ has joined #dnt 06:49:59 dwainberg has joined #dnt 07:40:25 fielding has joined #dnt 09:06:14 mischat has joined #dnt 10:35:20 mischat has joined #dnt 10:35:50 fwagner has joined #dnt 11:09:24 mischat_ has joined #dnt 11:34:42 mischat has joined #dnt 12:05:19 schunter has joined #dnt 12:12:50 djm has joined #dnt 12:13:59 fwagner has joined #dnt 13:29:32 djm has joined #dnt 13:56:08 tedleung has joined #dnt 14:15:00 djm has joined #dnt 14:19:16 tl1 has joined #dnt 14:19:17 tedleung has joined #dnt 14:20:40 fwagner has joined #dnt 14:42:03 dwainberg has joined #dnt 15:08:13 ifette has joined #dnt 15:09:38 fielding has joined #dnt 15:10:20 schunter has joined #dnt 15:16:59 djm has joined #dnt 15:18:15 tl has joined #dnt 15:21:24 hwest has joined #dnt 15:28:09 tl has joined #dnt 15:36:56 tedleung has joined #dnt 15:38:27 hwest has joined #dnt 15:40:03 efelten has joined #dnt 15:44:12 efelten has joined #dnt 15:46:03 sidstamm has joined #dnt 15:47:50 mischat_ has joined #dnt 15:51:44 KevinT has joined #dnt 15:53:24 dwainberg has joined #dnt 15:55:45 erikn has joined #dnt 15:56:07 James has joined #dnt 15:56:42 ifette has joined #dnt 15:58:41 npdoty has joined #dnt 15:58:57 rrsagent, make logs public 15:59:00 rrsagent, pointer? 15:59:00 See http://www.w3.org/2012/06/21-dnt-irc#T15-59-00 15:59:20 Meeting: Tracking Protection Working Group Bellevue F2F 15:59:24 Chair: aleecia, schunter 15:59:48 Joanne has joined #DNT 16:01:13 scribenick: npdoty 16:01:29 JC: welcome! breakfast kudos to hwest 16:01:41 aleecia: welcome, reflections on yesterday 16:01:59 ... maybe not a particularly good use of our collective time, moving slowly 16:02:26 ... group has gotten a lot larger, so today we'll try more to use smaller groups 16:02:33 aleecia has joined #dnt 16:03:00 ... not adding things new, but trying different approaches 16:03:03 rvaneijk has joined #dnt 16:03:05 ... we need to publish something 16:03:27 ... we need to figure out what exactly we're building, better understanding of the two proposals 16:03:50 robsherman has joined #dnt 16:04:06 Ionel has joined #dnt 16:04:12 ... self-hosted dinner tonight 16:04:41 efelten: want to say a few words for myself, I've been pretty quiet through these meetings but want to offer a perspective of where we are 16:04:45 BrianH has joined #dnt 16:04:52 Brooks has joined #dnt 16:04:55 ... frankly it hards to see how either of these proposals will get consensus as it is now 16:04:57 jeffwilson has joined #dnt 16:05:26 ... I can't see how either group could "steam-roll" the other, and in any case it wouldn't be successful in getting legitimacy of all the stakeholders and users 16:05:27 egrant has joined #dnt 16:05:46 ... companies don't want a technology that's overly prescriptive about their practices 16:06:06 ... and consumers want a choice that makes a change in the data that's collected, retained and used 16:06:18 ... not all consumers want the same thing, that's why it's a user choice mechanism 16:06:21 vinay has joined #dnt 16:06:36 ... not all companies agree, if the MSFT IE discussion has taught us anything 16:06:56 ... natural in a competitive marketplace, different companies, even just the browser vendors, all have distinct positions 16:07:09 ... everyone is going to need to make concessions, concessions that impose some pain 16:07:20 SimonKrauss has joined #dnt 16:07:34 ... those of us who have been involved for a long time recognize what the available compromise would roughly look like 16:07:44 ... the biggest issue is the scope of permitted use exceptions 16:07:57 fielding has joined #dnt 16:08:00 ... if there is substantial agreement on that issue, the rest of it can be worked out, what the rest of an agreement would look like 16:08:22 ... this is an issue where FTC has spoken, Do Not Collect with limited permitted exceptions 16:08:34 ... we have an opportunity here to do something that's difficult to do in any other forum 16:08:55 ... we have very significant areas of agreement, which we might miss because we talk most about the areas where we disagree 16:09:30 ... not any magic to get to an answer on this, but the stakes are high, think about the alternative to a compromise (as we discussed yesterday) 16:09:56 ... and to the extent that I can be helpful, either by talking to folks or getting out of the way, please let me know 16:10:10 ScribeNick: robsherman 16:10:15 jmayer has joined #dnt 16:10:15 justin_ has joined #dnt 16:10:28 cSpiezle has joined #dnt 16:10:28 vincent has joined #dnt 16:10:31 PG has joined #dnt 16:10:31 adrianba has joined #dnt 16:10:34 schunter has joined #dnt 16:10:35 aleecia: Want to summarize what we hope DNT will help us avoid as compared to current proposals. 16:10:52 … After that, break into small groups to discuss issues and then bring proposals back to the group. 16:10:57 … We'll re-plan after lunch. 16:11:12 jchester: Not sure that small groups make sense. 16:11:41 aleecia: we're not giving enough time for individuals to get their points across effectively. 16:11:44 rigo has joined #dnt 16:12:18 jchester: Industry colleagues should specify what their concerns are and articulate how it would affect their business. If we break into small groups, that would help us understand the playing field. 16:12:38 tlr has joined #dnt 16:12:47 thanks for using the mic 16:13:02 aleecia: Let's go ahead and do small groups and then do that after lunch. We'll get more out of people having a discussion than we will with this many people. 16:13:17 XX: No point in talking to a portion of the group - just repeat ourselves. 16:13:29 s/XX/fielding/ 16:13:36 thx efelten 16:13:47 fielding: How do you envision setting up the groups? 16:14:07 aleecia: Please do not go to groups of people you coauthored a proposal with. I'm not going to assign them, but they should be balanced. 16:14:18 … Observers should not write parts of proposals because of IP concerns. 16:15:00 chesterj2 has joined #dnt 16:15:04 schunter: Rob explained some principles under which exceptions are acceptable in the EU. We have to discuss each one-by-one but we need a working group to discuss this. 16:15:19 rvaneijk: Good idea — we have work to do. 16:15:27 suegl has joined #dnt 16:15:45 aleecia: Going to summarize status of proposals discussed yesterday, and also recalling CDT proposal. 16:16:15 bryan has joined #dnt 16:16:19 WileyS: I think you've made some assertions that aren't correct. 16:16:31 aleecia: Don't interrupt. 16:16:43 present+ Bryan_Sullivan 16:17:01 Does anyone have a link to the slide being presented? 16:17:10 … EU enforcement risk if people adopt Jonathan proposal is less likely, more likely under Shane's. Unclear under CDT. 16:17:30 … Few browsers would adopt new mechanisms for privacy under Jonathan proposal, more under Shane, unclear under CDT. 16:17:44 … Arms race continues regardless of which proposal we adopt. 16:18:06 … If I wanted to do this, could do Jonathan's approach with cookie management. Shane's with beefTACO. No real analog for CDT. 16:18:12 s/do this/do this today 16:18:33 … Jonathan's proposal protects privacy, Shane's doesn't, and CDT's somewhat. 16:18:51 … Jonathan's proposal is unlikely to be adopted. Shane's will get widespread adoption. Unclear where CDT stands. 16:18:59 q? 16:19:03 Zakim has joined #dnt 16:19:12 q+ WileyS 16:19:25 ack WileyS 16:19:31 what CDT proposal? 16:19:31 WileyS: Please explain the CDT proposal and how you made those assertions because we didn't get a chance to summarize it yesterday. I think our proposal and CDT's were quite well aligned. 16:19:42