← Prev in month
← Prev in thread
Next in thread →
Next in month →
Fwd: Re: [ABA-IDM-TASK-FORCE] Report from UN Meeting on Legal IssuesRelating to Identity Management
XACML folks-- At the end (bottom) of this thread is a link to a
new UNCITRAL report on international legal issues around identity
and access management.
The other entries are comments on the report that then veers into
a discussion of blockchain's possible relevance to IAM, including
a few other links for those inclined to dig deeper.
Regards,
Martin
-------- Forwarded Message --------
Subject:
Re: [ABA-IDM-TASK-FORCE] Report from UN Meeting on Legal
IssuesRelating to Identity Management
Date:
Tue, 7 Jun 2016 12:45:08 -0700
From:
Tom Jones <>
Reply-To:
Tom Jones <>
To:
There actually is one very good privacy use
of chaining, which was first used commercially decades ago for
time stamping by BellCore if I remember correctly.
See https://en.wikipedia.org/wiki/Linked_timestamping
When a user gives permission to use an
attribute to a relying party, and that party gives the access
to another party, the block chain would be the perfect way for
the second party to prove that they have a chain of
permissions back to the user.
thx ..tom
From:
Stephen Wilson
Sent: Tuesday, June 7, 2016 4:36 AM
To:
Subject: Re: [ABA-IDM-TASK-FORCE] Report from UN
Meeting on Legal IssuesRelating to Identity Management
Adrian,
The binding of a mark to a digital artefact is adequately
achieved by regular digital signature.
What I do understand is this. Nothing apart from Bitcoin is
actually "on" a blockchain. To record anything else of value
in the ledger requires a broker to bind that thing to ledger
entries, and another broker to bind the user to
their private key(s). In the Bitcoin blockchain there is no
need to bind users to keys because all there is is Bitcoin.
But the reality is different in every other use case.
When you layer a broker, intermediary or trusted third party
onto blockchain, the benefits of the consenus algorithm are
lost. Nakamoto himself said so in the second line of the
abstract to the Bitcoin white paper.
Non Bitcoin use cases plainly have to *start* with trust.
Blockchain doesn't produce trust, nor does it change in any
important the way how trust is mediated.
So back to the entry point for my input to this debate,
namely where I said not to refer to blockchain
books for insights. Many of us on this list have been
examining trust for over twenty years. If we haven't
cracked the nut by now, why should a new crypto currency
algorithm (an anonymous currency at that - think about it)
shed new light on the problem?
If I may, I've said all along there is no problem. Trust is
not someting that matters at the level of technology
protocols. What matters is mechanisms for knowing and
showing pertinent attributes of transacting entitiess.
Cheers,
Steve.
Stephen Wilson
Managing Director
Lockstep Group
E:
M: +61 (0)414 488 851
W: http://lockstep.com.au
T: @steve_lockstep
Lockstep Consulting provides independent specialist advice
and analysis
on digital identity and privacy. Lockstep Technologies
develops unique
new smart ID solutions that enhance privacy and prevent
identity theft.
-----Original Message-----
From: "adrian mccullagh" <>
Sent: Tuesday, 7 June, 2016 2:51pm
To: "Stephen Wilson" <>,
""
<>
Subject: RE: [ABA-IDM-TASK-FORCE] Report from UN Meeting on
Legal IssuesRelating to Identity Management
Hi Stephen,
With respect the greatest Stephen, I actually think you
do not understand blockchain and how it is put together.
The fundamental aspect is not the consensus protocol
whether it is proof of stake or proof of work. Even
though the consensus protocol is an important element
for bitcoin it is not necessarily an element of a
private blockchain.
The real benefit of the blockchain is the ability to
emulate in the digital environment the characteristic of
what occurs in the paper based environment. With paper
or any physical structure once a mark or some
information has been embedded onto a document, it is
very hard if not evidentially impossible to alter the
mark or physical information without leaving a trace on
the physical material. For more detailed explanation
see my papar in the University of New South Wales Law
Review : “Electronic Signatures - Understand the Past to
Develop the Future”.
Since digital information is simply a represenation of
1s and 0s it has always been possible to alter a
document without leaving a trace. See for instance the
case of Scarfo v. US, 2002 Fed court case dealing with
some evidence presented by the FBI. In particular see
the affidavit of special agent Murchison PhD. It has
always been in the digital environment a requirement to
have some secondary document such as a transaction log
to establish changes.
The blockchain is not, as has been stated incorrectly in
my view, imuttable but is tamper evident technology.
The term imuttable basically means that the information
in the document whether digital or otherwise cannot be
chnaged. That is just not correct. The issue is
whether the changes can ALWAYS be identified. Is there
evidence of the change. This certainly occurs in the
physical environment. The benefit of the blockchain is
that it does not rely on any secondary evidence to
establish that a change has occurred. The blockchain
can actually emulate the paper-based environment which
is its greatest strength. If a change does occur to
any prior block then the chain will metaphorically
speaking be broken which will lead to all parties
involve to investigate which block is affected and when
did the change occur, due to the timestamping of the
prior block and the succeeding block.
As our mutual firend Charlie Morre has been recently
been explaining on other forums the blockchain comprises
now new underlying technology, which I agree, but where
I differ from Charlie is that the combination of hash
algorithms, digital signature mechanisms and merkle
trees together with timestamping is unique. This
combination is new as such a combination had not
previously been described in the way Nakamoto described
it in his/her seminal paper.
So from an Id Management perspective, what needs to be
determined is once an Id has been placed in the
blockchain is that what organisations want, as each
relevant Id should become fixed in the blockchain,
unless an unauthorised change occurs which will become
self evident from the chain itself an thus lead to all
parties onto a train of investigation as to what the
unauthorised change was and when.
Kind Regards
Dr. Adrian McCullagh
Ph.D. LL.B. (Hons) B.App. Sc. (Computing)
ODMOB Lawyers
Email:
Email:
MOB: +61 401 646 486
SKYPE: admac57
The contents of this email are confidential between the
sender and the intended recipient. If you are not the
intended recipient then no rights are granted to you
because of this error and you are requested to promptly
inform the sender of the error and to promptly destroy
all copies of the email in your power, possession or
control. The sender reserves all rights concerning this
email including any privilege, copyright and
confidentiality associated with this email. Even though
an email signature block has been appended to this
email, and despite the Electronic Transactions Act (Qld)
or the Electronic Transactions Act (Cth), the signature
block does not exhibit the senders intention to be bound
by an offer previously sent by the intended recipient,
unless the email specifically states otherwise.
From:
Stephen Wilson
Sent: Tuesday, 7 June 2016 1:38 PM
To:
Subject: Re: [ABA-IDM-TASK-FORCE]
Report from UN Meeting on Legal IssuesRelating to
Identity Management
I would not be guided
by the blockchain books on the question of trust.
Most of what I read
about blockchain is flat out wrong. Don Tapscott's
book in particular embodies many misunderstandings of
what blockchain actually does.
The blockchain was
expressly designed so anyone at all can join the
network and start moving Bitcoin; the integrity of the
blockchain in fact demands that millions of people
join in, unencumbered by registration or
credentialling. Trust is utterly moot in that world.
It has to be, or the system won't scale up
sufficiently.
The blockchain
futurists make an unwarranted leap from the trust-less
blockchain algorithm to posit that some new meta-layer
of trust obtains. Trust does not in fact "[derive]
from the network and even from objects on the
network". Remember that blockchain does one thing
only: it produces consensus on the order of ledger
entries without needing an umpire. That's all. To
find "trust" in that mechanism, no matter how magical
it might appear, is simply fantastical.
See also https://www.constellationr.com/content/blockchain-almost-everything-you-read-about-it-wrong
Cheers,
Steve Wilson.
Lockstep Group
E:
M: +61 (0)414 488 851
W: http://lockstep.com.au
T: @steve_lockstep
Lockstep Consulting
provides independent specialist advice and analysis
on digital identity and privacy. Lockstep Technologies
develops unique
new smart ID solutions that enhance privacy and
prevent identity theft.
-----Original
Message-----
From: "Ken Moyle" <>
Sent: Tuesday, 7 June, 2016 7:47am
To:
Subject: Re: [ABA-IDM-TASK-FORCE] Report from UN
Meeting on Legal Issues Relating to Identity
Management
Martin, we'd
start with defining trust in the limited
business context, which is the expectation that
the other party will behave according to the
four principles of integrity: honesty,
consideration, accountability, and transparency.
See
Don Tapscott
and David Ticoll, The Naked Corporation (New
York: Free Press, 2003).
In his new
book, Blockchain Revolution (Penguin, 2016),
Tapscott views the impact of Blockchain by
contrasting trust in a pre-Blockchain
world--where trust in transactions derived from
individuals, intermediaries , or other
organizations acting with integrity-- with the
emerging Blockchain world, where "trust derives
from the network and even from objects on the
network."
So the
underlying concepts of contract formation and
reliance are unchanged. It is the concept of a
trusted third party that is due for a makeover.
The Microsoft
effort is based on the troublesome notion that
many people in the world are stateless,
unbanked, or both. Yet they are still people,
and they are increasingly likely to rely more
heavily on online services than their
traditional counterparts. Does it continue to
make sense for private banks and government
entities (or for that matter, social networks)
to control the identification and credentialing
of individuals, even if the technological means
exist to give that control to the data subjects
themselves?
Ken Moyle
-------- Original message --------
From: Martin Smith <>
Date: 6/6/2016 1:54 PM (GMT-08:00)
To: Ken Moyle <>,
Subject: Re: [ABA-IDM-TASK-FORCE] Report from UN
Meeting on Legal Issues Relating to Identity
Management
Ken-- Can you
recommend a good source for understanding the
MS/Blockstack/ConsenSys concept you mentioned?
Not sure if
this is related to your point, but I do think it
would be good to minimize the idea of "trust",
as distinct from the idea of enforceable
"recourse". My impression is that the info-tech
community grabbed and persisted the fuzzy
concept of "trust" without understanding that it
doesn't go far without enforceable commitments
and assignment of liability.
So, another
possibly related suggestion: the UNCITRAL report
notes different applications of (or use-cases
of) identity capabilities, distinguishing
between commercial and government requirements
and priorities, for example. A distinction I
have thought relevant is between those use-cases
that only involve financial risk, vs other
risks. (I think of these a "civil" vs
"criminal", but that's just a naive non-attorney
conceptualization.) Financial risk can be
mitigated by commitment of a financial bond to
guarantee performance in a transaction. (Or any
other mechanism that reliably makes the cost of
cheating higher than the reward, or even
quantifies the risk so it can be managed.) Note
that the financial use case also allows for
users to be truly anonymous.
Controlling
non-financial risks (e.g., insider fraud using
genuine credentials, espionage, etc.) requires
something that may help the authorities lay
hands on a physical person (via a binding
between a credential and the subscriber to which
it was issued.)
I can see that
blockchain tech could support the financial
use-case by being an automatic and auditable
enforcer of the release of the bond-- a smart
contract application. I don't (yet) see how it
applies to the "criminal" use-case, but I'm not
very familiar with the tech.
Regards,
Martin
PS--One really
good point in the UNCITRAL report was its
observation that recourse against sovereigns
(vs. private parties) is limited.
On 6/6/2016
1:53 PM, Ken Moyle wrote:
Tom, thanks for this. In response to your
follow-on message below – and relating directly
to Tony’s earlier question about blockchain code
solutions—I wonder if we’re not about to get
leap-frogged entirely on this issue.
The NSTIC model of
interoperable private credentialing authorities
is likely to give way to a much more technically
agile means of asserting and controlling one’s
own individual identity online. For example,
Microsoft is collaborating with Blockstack Labs
and ConsenSys on an open source, self-sovereign,
blockchain-based identity system that allows
people, products, apps, and services to
interoperate across blockchains, cloud
providers, and organizations. Blockchain
technology offers a mechanism for not only
maintaining privacy (as we know from the Bitcoin
blockchain), but also paradoxically allowing for
the public recording of identity attributes
necessary to secure an online transaction.
To get our legal minds
around the possibilities, we would have to cast
aside some of our rigid assumptions about
identity as a state- or corporate-owned concept,
and approach it as a means of participating in
an increasingly “trustless” ecosystem that could
very well offer all the advantages we seek
without the downside privacy and liability risks
that have been holding us back.
Ken Moyle
Managing
Member | K6 Legal PLLC
T: +1.860.980.0056
| M:+1.425.269.8866
www.K6Partners.com | LinkedIn |
Twitter
From:
Federated ID Management Task Force [mailto:]
On
Behalf Of Smedinghoff,
Tom
Sent:
Monday, June 6, 2016 7:02 AM
To:
Subject:
Re: [ABA-IDM-TASK-FORCE] Report from UN
Meeting on Legal Issues Relating to Identity
Management
Jeff
and Martin –
I
agree that privacy is a difficult issue, and
one that is driven to a large extent by
different cultural approaches to the topic.
Given UNCITRAL’s prior reluctance to address
privacy issues, as well as the fact that many
jurisdictions and other groups are addressing
privacy issues, I do not expect UNCITRAL to
try to address privacy in the IdM context.
Most likely, it will defer to applicable law
(as the eIDAS regulation does expressly and
the Virginia law does implicitly),
In
particular, Paragraph 53 of the UNCITRAL
Report seems to clearly signal that it will
likely not address privacy –
“53.
An important aspect of IdM relates to privacy
and data protection. Policy approaches to that
complex topic may vary significantly and
several initiatives aim at reconciling them.
In practice, existing legislation on IdM
recognizes the existence of specific privacy
law and defers to its application. Against
that background, and in view of the fact that
work on IdM systems and trust services should
not extend to matters outside UNCITRAL’s
mandate,
it
is doubtful that UNCITRAL could
efficiently deal in detail with those
matters at the present stage.”
Thanks,
Tom
From: Martin
Smith [mailto:]
Sent:
Saturday, June 04, 2016 12:06 PM
To:
Smedinghoff, Tom
Cc:
j stollman;
Subject:
Re: [ABA-IDM-TASK-FORCE] Report from UN
Meeting on Legal Issues Relating to
Identity Management
Tom--
Excellent
comment by Jeff S. I particularly liked seeing
" . . . some countries (e.g., ) trust their
governments more than business to do the right
thing. Others (including the US) favor
business over government " as I think that
explains a lot of differences in view when US
and European folks discuss these things.
There
may be some reasons for optimism about the
prospects for providing identity services
internationally, however. I believe the
technology can allow users and relying-party
information services to select features that
are acceptable to them based on their own
local laws and risk preferences, as long as
those choices are offered and made
transparent. (Effective transparency is not a
trivial problem, but . . .) Technological
flexibility and informed choice might
substitute for tight harmonization of
policies/regulations across jurisdictions.
It
would also allow a sort of "market" mechanism
to work: if a user or RP could not participate
in a transaction because of the profile of
privacy/etc. features they established, then
the costs to them of insisting on those
features would become apparent and they might
decide to relax their requirements. I believe
something like this happened a few years ago
in the context of sharing of law-enforcement
information between US States. One State
passed a Sunshine law that would require their
LE organizations to make info received from
other States public. Other States reacted by
declining to share the info with the Sunshine
State. I believe I heard that the latter ended
up changing their Sunshine law.
Thanks
for sending out the new Report, and
congratulations!
Martin
On 6/4/2016 11:56 AM, j
stollman wrote:
Tom,
One point that I believe
needs to be explicited stated with
regard to IdM generally with special
consideration for privacy is the
disparate regional views on trust. I
harken back to Larry Ponemon's study
several years back comparing views
about trust and privacy from a wide
variety of countries (19). People in
countries such as Germany had strong
biases to retain privacy. In Latin
America, concerns were much lower.
Similarly, some countries (e.g., ) trust
their governments more than business to
do the right thing. Others (including
the US) favor business over government.
The research points out the difficulties
in formulating one-size-fits-all targets
for the vexing problems of IdM and
privacy. I have attached a copy for
everyone's consideration.
Jeff
---------------------------------
Jeff Stollman
1 202.683.8699
Truth
never triumphs — its opponents
just die out.
Science
advances one funeral at a time..
Max Planck
On Fri, Jun 3, 2016 at 7:38
PM, Tim Reiniger <>
wrote:
Congratulations,
Tom! This is a remarkable
achievement.
Tim
Sent from my iPhone
On Jun 3, 2016, at 12:35 PM,
Smedinghoff, Tom <>
wrote:
On April 21-22,
2016 the United Nations
Commission on International
Trade Law (UNCITRAL) held a
colloquium in Vienna to
discuss Legal Issues
Relating to Identity
Management and Trust
Services.
The UNCITRAL
Secretariat’s paper
regarding the results of
that colloquium has just
been posted on the UNCITRAL
website at
http://www.uncitral.org/uncitral/en/commission/sessions/49th.html as
document
A/CN.9/891
- Legal Issues Related
to Identity Management
and Trust Services.
It’s at the bottom of the
list of documents submitted
for the Commission meeting
in New York on 27 June-15
July 2016. A copy is also
attached.
The UNCITRAL
Working Group IV is expected
to begin a project to
address the legal issues
regarding identity
management at its fall
meeting in Vienna.
If anyone has
any comments or input
regarding this Report or the
upcoming project please let
me know.
Thanks,
Tom
Thomas J.
Smedinghoff
Locke Lord
LLP
111 S. Wacker
Drive
Chicago, Illinois 60606
312-201-2021
Direct
312-545-1333
Mobile
www.lockelord.com
← Prev in month
← Prev in thread
Next in thread →
Next in month →