Re: [CDNi] Ben Campbell's Discuss on draft-ietf-cdni-logging-25: (with DISCUSS and COMMENT)

[Ben Niven-Jenkins <[e-mail]>]

> On 19 May 2016, at 00:46, Stephen Farrell <[e-mail]> wrote:
> On 19/05/16 00:38, Ben Niven-Jenkins wrote:
>> Hi Ben,
>> 
>> I’ll let the authors respond to most of your comments but I wanted to
>> respond to one of them, see below.
>> 
>>> On 18 May 2016, at 23:32, Ben Campbell <[e-mail]> wrote: 
>>> ----------------------------------------------------------------------
>>> 
>>> 
> DISCUSS:
>>> ----------------------------------------------------------------------
>>> 
>>> 
> - 7.3: "Making detailed CDNI logging
>>> information known to the uCDN does not represent a particular
>>> privacy concern because the uCDN is already exposed at request
>>> redirection time to most of the information that shows up as CDNI
>>> logging information (e.g., enduser IP@, URL, HTTP headers - at
>>> least when HTTP redirection is used between uCDN and dCDN)."
>>> 
>>> I agree this is mostly true for HTTP redirection. But as you
>>> mention, the assertion seems to fall down for DNS redirection,
>>> where the uCDN may have considerably less information. I think some
>>> different guidance for that case may be needed.
>> 
>> True, but…making detailed CDNI logging information known to the uCDN
>> does not expose any more information to the uCDN than if the uCDN had
>> chosen to perform the content delivery itself.
>> 
>> Typically when entity A contracts out work to entity B, entity A is
>> entitled to see all records produced by entity B on entity A’s
>> behalf.
> 
> I don't accept that that applies to all of the information that
> could be at issue here. For example if A is in the US and B is in
> the EU then things are not that simple.

You are correct that there are laws that may prevent the export of personal data from one country to another. AFAIK no IETF protocol that exchanges personal data or privacy impacting data has additional technical mechanisms to account for such laws (and I can not recall reading text in a technical specification RFC that discussed the impacts of such laws on the protocol being specified) so I don’t see how the presence of such laws is relevant to the technical specification of the CDNI logging interface.

Ben