RE: On the european response to Snowden

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

There are 3 areas I have been  thinking about, all rather vague but you asked for them.

1) Signalling.
 We saw a bit of this in the DNT discussions. How to create a signal conveying a user's explicit agreement for something or their preferences for something to one or more entities that may exist across multiple origins, in a secure untamperable way. This may eventually be superseded by:

2) Anonymity.
 To ensure privacy we should be able to trawl the net anonymously, but with some identity available through defined transactional processes. For example we may allow a subset of our identity to be discovered by some parties we know about and have reached agreement with. This might just be a broad audience categorisation (male, geek, whatever) or it might be more specific (MEP, a particular child's parent, member of a club). Visible identity changes with circumstances i.e. I could anonymously apply for a loan or agree to pay for a purchase but I would need to be accountable. My legal identity would have to be discoverable in certain agreed circumstances. We may also agree, through membership of a "rule of law" jurisdiction ,that our identity is discoverable by law enforcement under agreed (by society) circumstances.

This may go beyond HTTP, i.e. IPv6 anon. auto configuration everywhere or a new internetworking layer, focus on stopping fingerprinting, and it is a big one. It will need heavy guns.

3) Encryption.

There is talk about making end-to-end encryption illegal. While this may seem silly and is probably a shot across the bows, https everywhere stirs the hornet's nest. I think an answer involves some process whereby https is made more secure (via certificate pinning etc.), available to anyone but that law enforcement is given the means to determine identity through an internationally agreed process i.e. along the lines of 2).

I think any backdooring process will just end up helping the bad guys, so we have full ETO encryption available but if the net can properly ensure privacy and security only a minority will need it.




> -----Original Message-----
> From: David Singer [mailto:singer@apple.com]
> Sent: 27 January 2015 10:50
> To: Mike O'Neill
> Cc: Danny Weitzner; Rigo Wenning; public-privacy@w3.org
> Subject: Re: On the european response to Snowden
> 
> 
> > On Jan 27, 2015, at 11:46 , Mike O'Neill <michael.oneill@baycloud.com>
> wrote:
> >
> > -----BEGIN PGP SIGNED MESSAGE-----
> > Hash: SHA1
> >
> > There is also a international dimension, with transatlantic agreements on
> privacy,  cybersecurity and surveillance being publically discussed, and it is clear
> these things are interrelated, addressing one will always involve consideration of
> the others.
> >
> > There does not have to be a trade-off, no need to forgo privacy for the sake of
> security. We should be able to build a system with them all.
> >
> > What is needed is a clearly expressed “statement of requirements” i.e. we
> want to protect privacy and security within a transparent and democratically
> accountable framework which, for example, allows law enforcement to do its
> job (using warranted surveillance if necessary), but rules out mass surveillance.
> Because the net knows no borders there has to be a transnational component.
> >
> > The W3C could then do its part helping to create the necessary protocols and
> standards, while the politicians take charge of the oversight process and
> creating the legal environment.
> >
> 
> If you have even vague visions for what protocols and standards could help
> here, could you sketch them out?
> 
> David Singer
> Manager, Software Standards, Apple Inc.
> 

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.13 (MingW32)
Comment: Using gpg4o v3.4.19.5391 - http://www.gpg4o.com/
Charset: utf-8

iQEcBAEBAgAGBQJUx4Z3AAoJEHMxUy4uXm2Ju6gIAIjJvKPsA1dlsUJzmswMfHDf
GVmuSPc+ipTOQVvCjfZBhYecD/y8tGGH7YW8gdbQ+q3npemhDC26+e3Re9aKUIfX
uAmyXuMI3C4D658RzTtWj45qCsAkrT+R5ZAL0nKnlQiGjWTZVfwkUlso6A9GTjmC
urkW7Vbt7+5OJFBGhYA0RekyveP7Xmi5mSrdB99c4FQLOtRXECsHBJwF5d0SGJq/
nR3ZGvPkiKK8mXjrIwCTmY3QRNi0QySqLSg5Wc/WKtKtXJz6kuG99Xrakgg6AMKj
GlEDTnXTHkykuXr1x3FO0yvnFtIJqyxkzRNU/Nxzj6ZMSkHVqkEQs8Qgi6CV8V4=
=7evL
-----END PGP SIGNATURE-----

Received on Tuesday, 27 January 2015 12:39:01 UTC