Replies inline...
>Section 2.2, about subject nationality: It uses "RECOMMENDED" for the
use of ISO country codes. Maybe this should be MUST to make it more
interoperable?
JT: We had thought that it might be better to leave it up to
implementers to decide if they should use 2- or 3-letter country codes.
>Also, it's unclear to me whether the "nationality" attribute lists only
those nations where the subject is currently a citizen, or all
nationalities the subject has possessed. It doesn't say the latter, but
I am asking because there is also a "current-nationality". What's the
difference? Is the difference that current nationality is single valued
while "nationality" may be multi valued. But then, why would the most
recently assigned nationality be special?
JT: Current nationality is used for EAR; all nationalities are
considered for ITAR. We would expect that all nationalities would be
returned in a bag of attribute values for ITAR decisions.
>Section 2.2.3, the location attribute: Do you need a value for if the
subject is located outside any country, like on international waters?
BTW, the same about citizenship. there are people who have no
citizenship.
JT: It is my understanding that you couldn't legally ship to
"international waters" or to a person without citizenship status. Cases
where null values in those attributes occur should yield a "Deny"
decision.
>BTW, the location attribute may be difficult to authenticate securely
since it very easy to proxy a network connection through a middle man
located wherever in the world.
JT: Agreed. We're hoping that mechanisms that provide better assurance
will be developed.
>2.2.5: what is the definition of a "US person". Maybe you can refer to
some EC law which defines it?
JT: See http://www.access.gpo.gov/bis/ear/pdf/744.pdf
>General: Would it be good if there were some general text which
explains why these attributes are sufficient and/or useful for the
purposes of export control?
JT: See http://www.bis.doc.gov/licensing/exportingbasics.htm. This is a
really good resource.
Thanks
