Re: Proposed W3C Charter: Privacy Interest Group (PING) (until 2019-08-04)

I wanted to offer some additional context on what precisely we were asking
for here. Google believes a core need for the PING charter is to establish
a formal model of privacy concerns, which should be a living, growing
framework expressing best practices and understanding of privacy concerns.
This should enable web platform API designers to understand privacy at a
deeper level and avoid problems in their API designs, or at least identify
them before getting to the review stage.  This model should have the same
kind of relationship to the horizontal reviews that the PING will do that
the TAG's Design Principles (https://w3ctag.github.io/design-principles/)
have to TAG reviews.

Hopefully the need for this model is not controversial, as the group (as I
understand it) has already adopted Jeffrey Yasskin's proposal as the
beginnings of such a model in their domain (
https://github.com/w3cping/privacy-threat-model).  We still think this is
an essential deliverable to capture in the charter for the PING, and
believe needs to be a critical focus for the PING group.

To be clear: Google does NOT have concerns about the PING reviewing web
platform specifications. Quite the opposite, and I think the conversations
last week at TPAC—both in the PING meeting and in the Internationalization
meeting about generalized horizontal review process—were quite productive.
We do have slight concerns about the additional workload that might entail
for the PING group, but we have been actively working to increase our
participation in the PING to help account for that.  (And for the record, I
understand the proposed process changes mentioned in our objection have not
been adopted; that was the information we were working from at the time.)

As I've indicated to Sam, we have general concerns over long charter
periods, but for this interest group this is not a blocking concern; this
would not have led to Formal Objection by itself.

-Chris

Samuel Weiler <weiler@w3.org> wrote:
>During AC review of the proposed new Privacy Interest Group (PING)
>charter, Google filed a Formal Objection.  Below is the text, provided
>per Section 3.3.2 of the Process.
>
>-- Sam Weiler, W3C/MIT
>
>
>    We are primarily concerned that the PING is attempting to insert
>     itself as a required step for all specifications as per
>(
https://github.com/w3cping/administrivia/blob/process-changes-2019q3/README.md#privacy-review
)
>     without first
>     focusing on creating a well-developed formal model that can give
>     actionable advice for developers to assess the privacy risks of
>     their features.  Although we certainly believe effective and
>     constructive review guidance is
>     essential, only focusing on anti-patterns is not by itself a
>     solution. We'd like to see the PING focus on guidance for what a
>     true privacy-preserving browser might look like based on a
>     high-quality model of platform surface area - e.g.
>     removing hardware, screen resolution, and CPU distinguishers to the
>     greatest extent possible, outlining network-level analysis and the
>     inability to provide privacy from network actors without
>     network-channel-noise creation, and
>     discussing the role of powerful features, 3ps, and various page
>     construction techniques that need to be defeated for true privacy
>     preservation.
>
>     Simply establishing themselves as an authoritarian review group
>     without formally establishing self-serve guiding principles will
>     cause significant unnecessary chaos in the development of the web
>     platform.  Although we would like the PING to
>     take a strong role in horizontal review, we are uncomfortable
>     investing it with Process authority without more experience.
>
>     Additionally, we find the 3+ year charter time frame for the
>     PING group to be excessive, as this is a significantly different
>     charter than it has been previously.  We would like to suggest that
>     the charter end date be moved up to 31
>     December 2021.