Re: [dispatch] [Secdispatch] [art] Open Ethics Transparency Protocol

Greetings!

I agree with the prior assessment that this is similar to the Software Bill
of Materials work, at least in objectives. That is flexible in terms of
what formats will be acceptable (3) to provide a manifest on software and
many have selected SPDX, then it's digitally signed (code signing). There's
another proposal for this upcoming meeting that will link these for use in
supply chain assurance using Remote Attestation. It might be worth
reviewing that proposal to look for similarities in addition to reviewing
the document from the NTIA on the minimum set of elements for an SBOM.

There's a requirement in the US to any organization that sells to the
federal government to provide an SBOM related to the US executive order
from May 2021.  As such, there's traction on this approach already. With
that said, EKR also pointed out the proposal in this thread is at the
application layer. There may be a possibility for your work to use the
standards being adopted that could accelerate your progress. The next part
would be to determine if that work requires adoption and further
standardization or if the existing formats suffice for what needs to be
interoperable.

At this point, I don't see a time slot being useful, but please respond
with your thoughts if I'm missing something. I hope this is helpful.

Thank you,
Kathleen
co-chair of SecDispatch

On Sun, Mar 13, 2022 at 9:39 PM Dale R. Worley <worley@ariadne.com> wrote:

> n.lukianets@openethics.ai writes:
> > Nikita Lukianets from the Open Ethics initiative here.
> >
> > I've been working on the mechanisms to enable transparency for data
> > collection and data processing practices for autonomous systems and
> > specifically, those powered by machine learning models. Since 2020 I
> > have started to draft a guiding document to reflect ways disclosures
> > could be submitted, verified, and exchanged. Eventually, I would like to
> > see how this work could result in an open standard.
>
> I have feelings which are similar to other respondents.  I phrase it
> that the IETF is not the correct place for this work because the central
> problem is at the application layer (and possibly above that, at the
> political layer ... and certainly above that, at the cultural layer):
> being transparent presupposes a suitable way to describe "data
> collection and data processing practices" in "disclosures".
>
> Once somebody defines a way to represent these disclosures as concrete
> document objects, then there may be some protocol issues regarding how
> to "submit, verify, and exchange" them.  But that still seems to be more
> like the presentation layer, how you associate disclosure documents with
> web sites etc. which they describe, which sounds like a W3C specialty.
>
> Dale
>
> _______________________________________________
> Secdispatch mailing list
> Secdispatch@ietf.org
> https://www.ietf.org/mailman/listinfo/secdispatch
>

-- 

Best regards,
Kathleen