15:57:05 RRSAgent has joined #privacy 15:57:05 logging to http://www.w3.org/2012/10/18-privacy-irc 15:57:23 rrsagent, make logs public 15:57:32 slight delay on the call-in / Zakim slot, my apologies 15:57:35 tara has joined #privacy 15:57:52 meeting: Privacy Interest Group teleconference 15:57:54 chair: tara 15:58:08 christine has joined #privacy 15:58:11 wseltzer has joined #privacy 15:58:15 agenda: http://lists.w3.org/Archives/Public/public-privacy/2012OctDec/0022.html 15:58:24 JoeHallCDT has joined #privacy 15:58:38 zakim, code 15:58:38 I don't understand 'code', rigo 15:58:41 zakim, code? 15:58:41 sorry, rigo, I don't know what conference this is 15:59:37 Zakim, this will be 7464 15:59:37 I do not see a conference matching that name scheduled within the next hour, npdoty 15:59:48 (hmmm, the phone PIN of 7464 doesn't seem to be working) 15:59:50 Joanne has joined #privacy 15:59:52 Hm. I am getting "this passcode is not valid." 15:59:56 k 16:00:02 wait a bit 16:00:07 Regrets - Susan Israel, Karima Boudaoud, David Singer 16:00:19 nick needs to create the conference, because it seems there was some hickup 16:00:34 Regrets: SusanIsrael, KarimaBoudaoud, DavidSinger 16:00:39 Okay; we'll hold tight. Thanks. 16:00:52 look here for message from nick 16:01:20 In the meatntime, any volunteers to scribe? 16:01:58 bblfish has joined #privacy 16:02:09 I would volunteer but this is only my 2nd w3c call, so not sure I know how to do it or do it well 16:02:09 hello 16:02:09 jtrentadams has joined #privacy 16:02:14 what is the code toay? 16:02:36 7464 as code does not seem to work 16:02:47 Apologies for bursting in... but the conference code "7464" doesn't seem to work. 16:02:52 nick is creating a new code 16:02:55 hold on with calls 16:02:56 We're working on it - thanks for your patience. 16:03:11 ok. thanks 16:03:18 Zakim, this will be 7464 16:03:18 ok, npdoty; I see Priv_IG(PING)12:00PM scheduled to start 3 minutes ago 16:03:22 Zakim, code? 16:03:22 the conference code is 7464 (tel:+1.617.761.6200 sip:zakim@voip.w3.org), npdoty 16:03:28 okay, call-in should work now! 16:03:40 Simon has joined #privacy 16:04:23 Success with 7464# 16:04:31 Thanks 16:04:44 Hello, This is Simon Krauss (CableLabs) seeing familiar names. My dial in info isn't working. please post. Thx. 16:04:50 try again 16:05:20 ok seems to be working 16:05:38 I'm in 16:05:58 Zakim, code? 16:05:58 the conference code is 7464 (tel:+1.617.761.6200 sip:zakim@voip.w3.org), MacTed 16:06:03 Zakim, who is on the phone? 16:06:05 Priv_IG(PING)12:00PM has not yet started, npdoty 16:06:05 On IRC I see Simon, jtrentadams, bblfish, Joanne, JoeHallCDT, wseltzer, christine, tara, RRSAgent, Zakim, npdoty, yrlesru, rigo, MacTed 16:06:19 Zakim, this is 7464 16:06:19 ok, MacTed; that matches Priv_IG(PING)12:00PM 16:06:28 Zakim, who's here? 16:06:28 On the phone I see +1.206.910.aaaa, [IPcaller], +1.817.329.aacc, [CDT], +1.508.380.aadd, ??P30, +1.613.947.aaee, +1.916.641.aaff, Ashok_Malhotra, npdoty, bblfish, Rigo 16:06:28 Zakim, who is on the phone? 16:06:32 On IRC I see Simon, jtrentadams, bblfish, Joanne, JoeHallCDT, wseltzer, christine, tara, RRSAgent, Zakim, npdoty, yrlesru, rigo, MacTed 16:06:32 On the phone I see +1.206.910.aaaa, [IPcaller], +1.817.329.aacc, [CDT], +1.508.380.aadd, ??P30, +1.613.947.aaee, +1.916.641.aaff, Ashok_Malhotra, npdoty, bblfish, Rigo 16:06:42 + +1.303.661.aagg 16:06:51 +OpenLink_Software 16:06:55 Zakim, aaff is Joanne 16:06:55 +Joanne; got it 16:06:56 thanks! 16:06:57 Zakim, OpenLink_Software is temporarily me 16:06:57 +MacTed; got it 16:06:57 I am either IPcaller or ??P30 16:06:58 Zakim, mute me 16:06:59 MacTed should now be muted 16:06:59 +[IPcaller.a] 16:07:09 zakim, [CDT] is me 16:07:10 +JoeHallCDT; got it 16:07:32 Zakim, aadd is jtrentadams 16:07:33 +jtrentadams; got it 16:07:34 zakim, aaee is me 16:07:34 +tara; got it 16:07:48 We have a scribe? 16:08:11 Robin Wilton, here from the Internet Society, sitting in an OECD Paris meeting room 16:08:41 Zakim, aaaa is JC 16:08:41 +JC; got it 16:09:07 Stephanie, information policy PhD student, DPI 16:09:25 Hello Simon. Great to see you here. 16:09:28 Simon Krauss, Cable Labs, R&D for cable industry 16:09:37 Joe Hall, Center for Democracy and Technology 16:09:50 Frank Dawson, Nokia, first call but following public-privacy 16:09:53 Hi, it's Henry Story here ( http://bblfish.net/ ) working on http://webid.info/ 16:10:28 Hello Frank and Henry. Is Fred Andrews here to (re agenda item 3)? 16:10:53 any additional agenda items? hearing none... 16:11:04 volunteers to scribe? 16:11:11 soon! 16:11:20 zakim, pick a victim 16:11:20 Not knowing who is chairing or who scribed recently, I propose ??P30 16:11:22 Joe, if you want to start, I can support you 16:11:31 k 16:11:39 scribenick: JoeHallCDT 16:11:39 Thank you Joe!!! 16:12:01 First item, Frank Dawson on Specification of Privacy Assessment 16:12:17 links available from here: http://lists.w3.org/Archives/Public/public-privacy/2012OctDec/0023.html 16:12:38 ArtB has joined #privacy 16:12:58 RRSAgent, make minutes 16:12:58 I have made the request to generate http://www.w3.org/2012/10/18-privacy-minutes.html ArtB 16:13:11 Frank's background: software industry, standards particip., staring industry consortiums, last 12 years at Nokia in Mobile… new to w3c 16:13:14 RRSAgent, make log Public 16:13:37 Privacy officer within CTO group, responsibility for privacy standards in industry 16:13:46 a PbD champ! 16:13:58 Ashok_Malhotra has joined #privacy 16:13:58 MacTed has changed the topic to: Privacy IG -- http://www.w3.org/wiki/Privacy -- current agenda: http://lists.w3.org/Archives/Public/public-privacy/2012OctDec/0022.html 16:14:00 has working on privacy by design for NFC applications 16:14:24 discussing: http://lists.w3.org/Archives/Public/www-archive/2012Oct/att-0031/From_Principles_to_Technology-Nokia_Position_Paper-20120829__2_.pdf 16:14:56 "How can we create protocols, standards that have privacy baked in for software engineers" 16:16:04 this methodology is more of an Agile than Waterfall method 16:16:46 How might PING better work with other WGs to promote privacy. 16:16:56 Frank: what is the way of working we would use in working with other Working Groups? 16:16:59 Frank advocates for adopting a w3c specification for privacy assessment. 16:17:09 similar to PIAs 16:17:20 have a clause in specificaitons that address privacy issues 16:17:42 privacy assessment is somewhat standardized 16:18:34 Frank would expect actors, flows, concerns, privacy threats within a WG 16:18:50 Frank ices cakes before baking 16:19:33 document "Specification Privacy Assessment": http://lists.w3.org/Archives/Public/www-archive/2012Oct/att-0030/SpecificationPrivacyAssessment-20121008.pdf 16:19:47 understand where data is being collected, for what purpose 16:19:52 is it being stored, where? 16:20:13 is it personally-identifiable at the granular level or with more linkages to other resources 16:20:16 might be useful to diagram data flows, controllers, points where privacy might be impacted 16:20:39 in a network environment can help to map out flows, points of controls and where the user can insert themselves 16:21:01 helps to design safeguards and safeguarding reqs. 16:21:23 from Frank's IETF experience, there is a security consideration section to RFCs 16:21:35 for w3c Frank would like to see a privacy consideration section 16:21:40 would be interesting to have a privacy consideration section in http://webid.info/spec 16:21:59 would include a brief summary where there are potential threats, what privacy prinicples apply and what kinds of recs/safeguards could apply to mitigate 16:22:11 Questions? 16:22:13 threats and potential mitigations that implementers could use to address those threats 16:22:31 q? 16:22:42 not sure who is speaking 16:22:55 Q: is there a document that I should use to build this into my spec? 16:22:56 q+ 16:23:01 this one http://lists.w3.org/Archives/Public/www-archive/2012Oct/att-0030/SpecificationPrivacyAssessment-20121008.pdf 16:23:09 Frank: look at the two documents I've shared (links above) 16:23:12 As a side note, the IETF is also ramping up increased support for a Privacy Considerations section added to RFCs that is akin to the Security Considerations. 16:23:53 q+ 16:23:59 Frank: also look at the IETF RFC catalog… that has privacy considerations… internet draft 03 (not yet an RFC) 16:24:04 q- later 16:24:04 (not sure I have that right) 16:24:25 Frank: one needs prior art draft 03 on privacy considerations. [ but Frank is saying these are are just thinking of the threats ] 16:24:26 IAB Privacy Considerations draft: http://tools.ietf.org/html/draft-iab-privacy-considerations-03 16:24:40 q? 16:24:54 I look forward to reviewing the documents 16:24:55 ack npdoty 16:25:05 Nick: responding to Henry, not sure that's exactly what we want to do in PING. 16:25:46 We'd also like to help do reviews for different WGs. 16:25:47 q+ 16:26:10 Henry: would appreciate that… get's dang complicated. 16:26:14 ack rigo 16:26:16 npdoty: I think coming up with that guidance, a single document for protocol authors, is exactly what we're working on at PING 16:26:24 (oops) 16:26:33 ack simon 16:26:52 ... and while PING might be doing reviews, we'd like to come up with a document for authors from within individual groups 16:27:18 Q: Rigo is not sure if the right knowledge is yet present in the WG. 16:27:43 s/Q: Rigo is/rigo:/ 16:28:04 rigo: requires a lot of knowledge to translate down from the PbD principles all the way down to spec-writing 16:28:33 Frank: from IETF, the first set of specs that did security considerations was a learning experience… will be the case here. 16:28:34 Robin has joined #privacy 16:28:36 +1, the experience from security considerations is that early on it wasn't particularly comprehensive, but obviously improved over time 16:29:08 q+ Simon 16:29:53 ack simon 16:30:08 Simon asks where do you see this going? 16:30:21 rigo: greetings (test) 16:30:27 Is this a procedure or a seal of approval? 16:30:33 success: great back 16:31:06 q+ to tell the story about ipse 16:31:09 Frank sees these as assessments but not audits. 16:31:57 More about a cumulative feedback process. 16:32:03 I imagine that's pretty familiar in the software engineering context: security reviews, performance reviews, even basic code reviews; not a post-facto audit but input during the process 16:32:05 (scribe's wording) 16:33:25 yrlesru has joined #privacy 16:33:35 I am back on IRC, Tara. 16:33:48 Simon is concerned about having a grey zone between privacy aspirations being documented re litigation threat. 16:34:05 jtrentadams: hi Trent - how's life? 16:35:21 Frank says whatever your accountability model is, there needs to be someone who can sign off for the w3c publication process for spec text. 16:35:54 I think better documentation (usually accompanied by improvement or mitigation) will be a net positive, rather than a risk of attack for the technology being imperfect 16:35:55 Want to move from vague regulatory text to crystal clear technical text. 16:37:07 Simon is wary of this serving as a w3c seal of approval. 16:37:07 ack rig 16:37:07 rigo, you wanted to tell the story about ipse 16:37:53 Rigo describes how w3c wants to have very solid technical sections… this is not concrete enough for w3c. 16:37:54 Simon, I'm not sure the intent is a "seal" approach, but just having done and documented considerations 16:38:01 Too high-level for w3c. 16:38:55 Frank responds that the SPA document was intended to be submitted to the primary (in Nokia's view) web and technical standards settings. 16:39:10 so it hasn't yet been translated to w3c context. 16:39:29 rigo, I think we can use this framework as a starting point, and might be an outline to writing our document 16:39:53 nick, I agree, but we have to remain plumbers 16:40:07 The w3c standards will be different from management standards for ISO 20 (something? didn't get it) 16:40:16 agenda? 16:40:48 agenda+ CSP specification - privacy issues 16:40:57 zakim, take up next 16:40:57 agendum 1. "CSP specification - privacy issues" taken up [from rigo] 16:41:15 http://lists.w3.org/Archives/Public/public-privacy/2012OctDec/0008.html 16:41:16 Tara: this has been on ongoing process to try and solidify what PING has been interested in into documentary form. 16:41:17 agenda+ W3C Workshop 16:41:24 agenda+ TPAC 16:41:36 q+ 16:41:44 Is Fred here? 16:41:52 haven't seen him 16:42:16 ack ri 16:42:19 -Rigo 16:42:38 who gave that man buttons? 16:42:38 https://www.w3.org/2011/webappsec/track/issues/11 16:42:43 +??P2 16:42:48 - +1.817.329.aacc 16:43:04 +Rigo 16:43:50 q+ 16:44:55 q- 16:45:03 q+ to ask about the use case for 'phoning home' violation reports 16:45:15 ack npdoty 16:45:15 npdoty, you wanted to ask about the use case for 'phoning home' violation reports 16:45:19 zakim, mute me 16:45:19 Rigo should now be muted 16:45:40 -JC 16:45:43 ack ri 16:45:56 Nick asks if anyone has a good grasp on the use cases for when this would be invoked. 16:46:08 CSP? Use case? 16:46:11 q+ 16:46:13 npdoty: does someone know the precise use cases for when a violation report is sent? is it likely to reveal information that might be sensitive? 16:46:46 ack christine 16:46:47 zakim, mute me 16:46:47 Rigo should now be muted 16:47:05 Christine asks what could/shound PING do here that would be useful? 16:47:19 ack ri 16:47:52 Nick says that maybe we can understand or communicate the concerns in a more useful way. 16:47:56 q+ 16:48:12 q+ 16:48:17 ack JoeHallCDT 16:48:17 ack Joe 16:49:19 ack jtrentadams 16:49:22 JoeHallCDT: one helpful function of PING can be in deducing a core concern, best delivery 16:49:41 Thank you Trent. 16:49:42 jtrentadams++ 16:49:59 jtrentadams takes this as an item to unravel and help lucidify 16:50:02 (my words) 16:50:21 -[IPcaller] 16:50:32 jtrentadams ++ 16:50:38 (I have to hop off at 13:00 EDT, so need to pass the scribe pen at that time) 16:51:06 jtrentadams, if it's helpful to loop one of us in, feel free 16:51:23 Robin has joined #privacy 16:51:40 Zakim, agenda? 16:51:40 I see 3 items remaining on the agenda: 16:51:41 1. CSP specification - privacy issues [from rigo] 16:51:41 2. W3C Workshop [from npdoty] 16:51:41 3. TPAC [from npdoty] 16:51:49 No problem.... I hope we're able to uncover the true issues and ensure they're addressed as appropriate. 16:51:59 zakim, take up agendum 2 16:51:59 agendum 2. "W3C Workshop" taken up [from npdoty] 16:52:15 -Ashok_Malhotra 16:52:32 Impetus behind DNT and Beyond is to figure out how w3c should chart a future course in this flavor of privacy expression. 16:53:06 want to have quite a few people to talk about privacy techniques and issues 16:53:09 q+ 16:53:22 very short position papers, due Monday 16:53:37 Berkeley is great! 16:53:45 ack Joe 16:53:52 Robin has joined #privacy 16:54:47 There is an implicit scope for this for web work, coming from the w3c. 16:54:59 Or I can? 16:55:13 Zakim, next agendum 16:55:13 agendum 1. "CSP specification - privacy issues" taken up [from rigo] 16:55:17 zakim, take up agendum 3 16:55:17 agendum 3. "TPAC" taken up [from npdoty] 16:55:19 Zakim, take up agendum 3 16:55:19 agendum 3. "TPAC" taken up [from npdoty] 16:55:41 Fingerprinting breakout session at TPAC 16:55:47 http://www.w3.org/wiki/TPAC2012/SessionIdeas#Is_user_agent_Fingerprinting_a_lost_cause.3F 16:56:07 where is the bar on trackability? 16:56:15 lessons from browser modes and protections? 16:56:42 TPAC will have an informal PING get together… drinks! 16:56:47 I am going 16:56:49 I'll be there. 16:56:57 +1, informal get-together 16:57:03 Alissa from our shop I think will be around 16:57:04 note that related on the SEssion Ideas page there is http://www.w3.org/wiki/TPAC2012/SessionIdeas#WebID_and_RWWeb 16:57:06 (I think) 16:57:17 Can we do the next call on 22 Nov? 16:57:21 email Christine if you'll be around at TPAC and want to gather for drinks 16:57:34 that is american thanksgiving 16:57:35 holiday 16:57:43 US Thanksgiving, yeah 16:58:03 the 29th is close 16:58:04 I'm booked 15 and 29 16:58:08 Nov 15 or Nov 29? 16:58:10 to the w3c thing,… traveling 16:58:13 but can try to fit it in 16:58:17 11/15 WFM 16:58:22 Nov 29 in Berkeley 16:58:28 I submitted a position paper (SPA) but no reply. 16:58:33 either day works for me, or we can look at Fridays 16:58:35 what about 22 Nov? or early Dec 16:58:52 either day works for me 16:58:54 we'll be cooking and getting fatter that day, rigo 16:59:08 December 6th? 16:59:12 works for me 16:59:13 okay for me 16:59:15 wfm 12/6 16:59:18 okay for me 16:59:33 Dec 6th... St Nick's Day 16:59:42 Apologies to Henry that we did not have time for your item today. We can add to next call if you like. 16:59:51 - +1.303.661.aagg 16:59:57 hope to see you at TPAC in Lyon 16:59:58 tara: excellent discussion today 17:00:04 -MacTed 17:00:05 -Joanne 17:00:05 -JoeHallCDT 17:00:06 -??P30 17:00:06 Thanks all! 17:00:06 -Rigo 17:00:08 thanks, good talking with you all 17:00:08 -bblfish 17:00:14 -tara 17:00:30 Thanks Joe for scribing! Bye! 17:00:40 Thanks, Tara (Frank = yrlesru) 17:00:42 MacTed has changed the topic to: Privacy IG -- http://www.w3.org/wiki/Privacy -- latest agenda: http://lists.w3.org/Archives/Public/public-privacy/2012OctDec/0022.html -- next call 2012-12-06 17:01:42 Zakim, list attendees 17:01:42 As of this point the attendees have been +1.206.910.aaaa, +44.208.123.aabb, [IPcaller], +1.817.329.aacc, +1.508.380.aadd, +1.613.947.aaee, +1.916.641.aaff, Ashok_Malhotra, npdoty, 17:01:46 ... bblfish, Rigo, +1.303.661.aagg, Joanne, MacTed, JoeHallCDT, jtrentadams, tara, JC 17:01:56 rrsagent, draft minutes 17:01:56 I have made the request to generate http://www.w3.org/2012/10/18-privacy-minutes.html npdoty 17:02:14 np! 17:03:39 quit 17:06:09 -[IPcaller.a] 17:08:22 -npdoty 17:15:11 -??P2 17:17:56 -jtrentadams 17:17:57 Priv_IG(PING)12:00PM has ended 17:17:57 Attendees were +1.206.910.aaaa, +44.208.123.aabb, [IPcaller], +1.817.329.aacc, +1.508.380.aadd, +1.613.947.aaee, +1.916.641.aaff, Ashok_Malhotra, npdoty, bblfish, Rigo, 17:17:57 ... +1.303.661.aagg, Joanne, MacTed, JoeHallCDT, jtrentadams, tara, JC 18:10:04 ArtB has left #privacy