Subject: Re: Important Information about IETF 76 Meeting Registration

From: Dave CROCKER <[email-masked]>
Date: Tue, 01 Sep 2009 07:10:12 -0700

Fred Baker wrote:
> Chill Out.

Back at you.

> Go ahead and opt out. PLEASE opt out if you you can't deal with 
> technology that might change - as all IETF technology does over time. 
> Leave Alexa out of this.

An important datum in human studies is how humans react to things.  Taking such
a dismissive stance towards reactions to the RFID announcement ensures missing
important information about acceptability to the target population.

There's also a good chance of missing important data about usage that might be 
ancillary, but desired by users, and will be lost with the new technology. 
We've already had a couple of postings providing such insight.

But it's probably been ignored.

d/
-- 

   Dave Crocker
   Brandenburg InternetWorking
   bbiw.net

---

From: Alissa Cooper <[email-masked]>
Date: Tue, 1 Sep 2009 11:04:28 -0400

This entire thread is perfectly illustrative of why the IETF needs a  
privacy policy. Without one, it is entirely unclear how the data  
collected about IETF participants is used, disclosed and protected,  
whether that data is part of an experiment or not. While the  
supplemental information about the RFID tagging experiment (http://www.ietf.org/meeting/76/ebluesheet.html 
) is helpful, it is not complete (for example, how long the RFID- 
captured data is stored in electronic form is not disclosed), and  
nothing equivalent exists (to my knowledge) for other kinds of data  
about IETF participants, like registration data.

In our protocol development work, many of us try very hard to design  
privacy and security features in from the outset, whether we're  
designing a highly experimental prototype or a core protocol. The same  
should be true for the design of data collection mechanisms and  
practices associated with IETF meetings.

Alissa

---

From: SM <[email-masked]>
Date: Wed, 02 Sep 2009 01:02:58 -0700

Hi Alissa,
At 08:04 01-09-2009, Alissa Cooper wrote:
>supplemental information about the RFID tagging experiment 
>(http://www.ietf.org/meeting/76/ebluesheet.html ) is helpful, it is 
>not complete (for example, how long the RFID- captured data is 
>stored in electronic form is not disclosed), and

 From the above webpage:

  - The data will be printed and archived along with the paper blue sheets

  - The data will NOT be distributed to anyone other than the IAOC, IAD,
    the Secretariat and  the host team that is organizing and supporting
    this experiment

  - The data will be available for use if subpoenaed

It summarizes the use of the data after the meeting.  There is 
already a retention policy document and it may contain the answer to 
your question.

I don't have any concerns about this experiment.

>practices associated with IETF meetings.

You asked a similar question about a privacy policy a few weeks 
ago.  As we talking about IETF meetings, the question can be viewed 
from a different angle.  One of the goals of the Internet Standards 
Process is openness and fairness.  Participation in the IETF is open, 
i.e. anyone can join in.  We can already find out who are the 
"contributors" in a Working Group as there are open discussions on 
the relevant mailing list and there is a publicly accessible archive 
of the discussions.  The Working Group sessions (at a meeting) are 
not that different.

Everything a person says in a Working Group session is not 
private.  For the process to be transparent, the list of individuals 
that are there also should not be considered as private.  In 
practice, the IETF offers you a some leeway.  Nobody will coerce you 
to sign the attendance list.  If you are going to the mic, you do 
have to identify yourself.  If you have any other concerns, please 
read the messages posted by Doug Ewell and Tony Hain on this thread 
on how to restrict what information is collected about you.

A list of session attendees is useful for:

  (a) capacity planning (size of the meeting room to accommodate the 
number of participants)

  (b) catering

  (c) session scheduling

  (d) cross-area participation

The Area Directors and Working Group Chairs might have a rough idea 
about item (d).  The IETF can gain a better view of (d) if the 
information is collected in electronic form.

I'll comment on Steve Crocker's questions:

(i) Do we need access controls on the information?

If the electronic process mimics existing practices, it is easier to 
publish the information.  That is already done for the meeting 
attendees list.  Note that this model may not be appropriate for 
other organizations.

(ii) Do we need an ability to edit information that's been collected 
if it's inaccurate?

The meeting registration form has a field for the "Name to appear on 
badge".  That can be used throughout the meeting.  The Working Group 
attendance collected during the session can be verified by the 
participants in the room.  Set up a procedure where they can contact 
the IETF Secretariat to correct any errors they find.

(iii) Do we need more flexibility in the information stored in the 
record, e.g. a distinct email address for each working group?

Some people prefer not to provide an email address (see bluesheet 
"spam" discussions over the last few years).  Some people may be 
using a distinct email address for each working group for ease of 
sorting or filtering.  Provide the ability for the participant to 
edit the email address.  It is better not to publish these email 
addresses to avoid rehashing the "spam" discussions.

>important information about acceptability to the target population.

Agreed.  It is useful to know how many participants opted out of the 
experiment and why they did so.  For example, was it because there 
was a misunderstanding about how the experiment works or what 
information is collected?  It is better to address this informally 
instead of having a form asking the person why they are opting out.

I avoided the question of proximity tracking and the time the 
participant spends in a session as my comments on items (i) to (iii) 
would be different then.

Regards,
-sm

---

From: Marshall Eubanks <[email-masked]>
Date: Wed, 2 Sep 2009 18:10:47 -0400

On Sep 1, 2009, at 11:04 AM, Alissa Cooper wrote:

> designing a highly experimental prototype or a core protocol. The  
> same should be true for the design of data collection mechanisms and  

I fully agree with you about the need for a privacy policy. However,  
if we had one right now, it would likely not fully capture the full  
possibilities and potential dangers of an experiment like this.

In my opinion, these experiments are as much or more organizational as  
they are technological. In fact, I would assume that the technology is  
likely to work. The real questions concern the organization, have to  
be brought to the surface, weighed and discussed by the community, and  
the answers improved based on experience. Or, to put it another way, I  
expect that the privacy policy (and maybe the document retention  
policy) will be informed and hopefully improved by the results of this  
experiment.

Regards
Marshall

> Alissa
>
>
>
>
>
>
>
> _______________________________________________
> Ietf mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/ietf
>

---

From: Eric Rescorla <[email-masked]>
Date: Mon, 07 Sep 2009 13:43:37 -0700

Alexa Morris writes:
> My apologies, I actually thought that I'd responded to this.
> 
> Handheld readers will be passed around the meeting rooms, much as the  
> clipboards are now (and still will be). Individuals will swipe their  
> card through the reader and pass it on. Once collected, the data will  
> be used as the current Blue Sheet data is used, that is, to respond to  
> subpoena requests for attendance at different sessions typically  
> issued during a dispute over intellectual property. At the moment, we  
> are planning to print out a copy of the electronically obtained data  
> and store it with the regular blue sheets, then keep the source file  
> with the rest of our electronic archives.
> 
> The data collected consist solely of an individuals full name and  
> company/organization affiliation. We are not collecting email address  
> information on the e-blue sheets.

Alexa,

Can you clarify what, if any, the security properties of this system
are:

In particular:

1. Will the RFID tag in question respond to any reader or just those
   controlled by the secretariat?
2. Is the information on the tag in the clear or encrypted?

My general experience with RFID systems suggests that the answer to
these questions is likely to be "yes" and "in the clear", but I'd
certainly be pleasantly surprised to hear otherwise.

Thanks,
-Ekr

---

From: Alissa Cooper <[email-masked]>
Date: Tue, 8 Sep 2009 17:44:59 -0400

I don't disagree with what you're saying below. I'm advocating that a  
privacy policy should exist -- what the policy says is another matter.  
For example, the policy might say, "The IETF collects your data and  
sells it to identity thieves." Although I doubt that's what it would  
say, it would still be preferable for that policy to be published than  
to not be published. One of the core, widely accepted tenets of  
individual privacy is transparency. I personally doubt that the IETF's  
practices with respect to the data that it collects will be  
objectionable to many people, but I think those practices should be  
known so that the community can judge for itself. I think the  
practices should be documented -- whether they need to be changed or  
not is something to discuss once they've been documented.

It is unclear to me whether the data retention policy applies to the  
RFID data. Perhaps it counts as "Blue Sheets," in which case the data  
is retained permanently, but that is not immediately obvious from  
reading the policy. The note on the supplemental RFID page makes it  
sound as though the RFID data might not ultimately be stored  
electronically, but it's not totally clear.

Alissa

On Sep 2, 2009, at 4:02 AM, SM wrote:

>> same
> Process is openness and fairness.  Participation in the IETF is  
> open, i.e. anyone can join in.  We can already find out who are the  
> Everything a person says in a Working Group session is not private.   
> For the process to be transparent, the list of individuals that are  
> there also should not be considered as private.  In practice, the  
> IETF offers you a some leeway.  Nobody will coerce you to sign the  
> attendance list.  If you are going to the mic, you do have to  
> identify yourself.  If you have any other concerns, please read the  
> messages posted by Doug Ewell and Tony Hain on this thread on how to  
> restrict what information is collected about you.
>

---

From: Alissa Cooper <[email-masked]>
Date: Tue, 8 Sep 2009 17:45:08 -0400

I view having the policy in place as the first step. Once there's a  
policy, we can think about formalizing a process to update the policy.  
Ideally, when a new experiment introduces a new kind of data  
collection or use, we would think about the privacy impact in advance  
of launching the experiment, and adjust the policy accordingly. But it  
should no doubt be fluid.

This is not rocket science -- it's the process that many other  
organizations and companies use to address privacy. They develop a  
policy that covers existing practices, and when a new practice comes  
along, they analyze the impact of the new practice and whether the  
policy needs to change, and then they change the policy if necessary.  
This process might or might not result in constraining what happens to  
collected data, but the value is derived from having done the  
analysis, whether or not that analysis affects the ultimate outcome.

Alissa

On Sep 2, 2009, at 6:10 PM, Marshall Eubanks wrote:

>> This entire thread is perfectly illustrative of why the IETF needs  
>> a privacy policy. Without one, it is entirely unclear how the data  
>> In our protocol development work, many of us try very hard to  
>> design privacy and security features in from the outset, whether  
>> we're designing a highly experimental prototype or a core protocol.  
>> The same should be true for the design of data collection  
>> mechanisms and practices associated with IETF meetings.
>>
>
> In my opinion, these experiments are as much or more organizational  
> as they are technological. In fact, I would assume that the  
> technology is likely to work. The real questions concern the  
> organization, have to be brought to the surface, weighed and  
> discussed by the community, and the answers improved based on  
> experience. Or, to put it another way, I expect that the privacy  
> policy (and maybe the document retention policy) will be informed  
> and hopefully improved by the results of this experiment.
>
> Regards
> Marshall
>
>> Alissa
>>
>>
>>
>>
>>
>>
>>

---

From: Ole Jacobsen <[email-masked]>
Date: Tue, 8 Sep 2009 16:21:02 -0700 (PDT)

Alissa,

It's not totally clear because it is an EXPERIMENT and typically one 
does not develop a bunch of policies for how a particular technology
might be used once it's "up and running" --- if we were to adopt it
prior to actually running the experiment. There is clearly, today,
no legal requirement that we retain the data from the experiment as
a substitute for bluesheets since we are not replacing the bluesheets
by RFID technology --- even if we are experimenting with how that
would work. (Obviously, the secretariat will need to securely retain
or destroy the data once the experiment is over, I don't see that as
being any different from all the other information which is collected
as a result of running an IETF meeting).

I agree that more details about the experiment need to be provided,
and they will be, it is still being worked out. And, you can opt out.

In the meantime, please see:

http://www.inet.info.hiroshima-cu.ac.jp/ietf76-exp/index.html#bluesheet

On Tue, 8 Sep 2009, Alissa Cooper wrote:

> It is unclear to me whether the data retention policy applies to the RFID
> data. Perhaps it counts as "Blue Sheets," in which case the data is retained
> permanently, but that is not immediately obvious from reading the policy. The
> note on the supplemental RFID page makes it sound as though the RFID data
> might not ultimately be stored electronically, but it's not totally clear.
> 
> Alissa
> 

Ole

Ole J. Jacobsen 
Editor and Publisher,  The Internet Protocol Journal
Cisco Systems
Tel: +1 408-527-8972   Mobile: +1 415-370-4628
E-mail: [email-masked]  URL: http://www.cisco.com/ipj

---

From: Ted Hardie <[email-masked]>
Date: Tue, 8 Sep 2009 18:27:10 -0700

At 4:21 PM -0700 9/8/09, Ole Jacobsen wrote:
>prior to actually running the experiment.

Hi Ole,

I think you are still missing Alissa's point.  She's asking for a privacy
policy to be in place that describes how the IETF uses the data it collects.
*How* it collects the data is secondary to that statement.  The experiment
seems to me to be about a how, not about a "what it does". 

She's also been pretty clear that it could say something like "the IETF
collects data for  experimental understanding of folks' willingness to
wave badges at boxes" and satisfy her. Less flippantly, she's saying that
getting a stated policy is job one.  What is says and how it is updated are,
to some degree secondary (because having a stated policy allows folks
to judge whether or not to share the data by, for example, participating
in the experiment).
			regards,
				Ted

>There is clearly, today,

---

From: Joel Jaeggli <[email-masked]>
Date: Thu, 10 Sep 2009 05:05:08 -0700

> 2. Is the information on the tag in the clear or encrypted?

normal 125khz tags don't contain much data. The radio equivalent of a 1
dimensional barcode is just a serial number. any data is a product of
association with that token stays in the network rather than the chip.
These are vulnerable to (trivial) replay attacks. but challenge response
requires more logic. more powerful card systems of course exist in
profusion it's just a matter of picking one.

---

From: Eric Rescorla <[email-masked]>
Date: Fri, 11 Sep 2009 06:50:11 -0700

At Thu, 10 Sep 2009 05:05:08 -0700,
> profusion it's just a matter of picking one.

Yes. This is why I asked.

-Ekr

---

From: Ole Jacobsen <[email-masked]>
Date: Wed, 23 Sep 2009 09:16:37 -0700 (PDT)

I have asked Osamu and Kato to answer. Stay tuned.

Ole

Ole J. Jacobsen

On Wed, 23 Sep 2009, Samuel Weiler wrote:

> I'm interested in the answers to the questions asked by EKR a couple of weeks
> ago...
> 
> I'd also like to know which frequency band these tags use: are these 125kHz or
> 13.56MHz tags?
> 
> -- Sam
> 
> On Mon, 7 Sep 2009, Eric Rescorla wrote:
> 
> > Alexa,
> >

---

From: Bill Manning <[email-masked]>
Date: Wed, 23 Sep 2009 16:06:25 -0700

the japanese equivalent of the OMROM V600-D23P71

--bill

-- 
--bill

Opinions expressed may not even be mine by the time you read them, and
certainly don't reflect those of any other entity (legal or otherwise).

---

From: Samuel Weiler <[email-masked]>
Date: Wed, 23 Sep 2009 11:50:22 -0400 (EDT)

I'm interested in the answers to the questions asked by EKR a couple 
of weeks ago...

I'd also like to know which frequency band these tags use: are these 
125kHz or 13.56MHz tags?

-- Sam