Re: [lmap] incoming liaison statement from IEEE Project P802.16.3

Hi Dan, 

thanks for sending the liaison around. I read through it and I have a few remarks. 

It might be useful to highlight that the IETF#86 discussion was a BOF and the purpose of the BOF is not to work out the solution but rather to discuss whether a working group should be formed. As such, it is quite naturual that not all design aspects have been discussed during that meeting. 

With regard to the questions:

Question 1: "we wonder if the LMAP discussions have considered the use of both public and private Measurement Servers

Protocol work, as it is usually done in the IETF, does not imply that a specific entity runs the server. As such, any work that comes out of a (yet-to-be-created) LMAP working group will most likely be run by public and privacy entities. I would in general say that there is a distinction between the protocol aspects and the deployment aspect. Who runs a specific service is a deployment question and not necessarily a protocol design question. 

"Private" in this context is a also a bit confusing because it does not necessarily mean that private only refers to a server run by the same entity that runs the client, particularly if the client is located on the end device (under the control of the end user).

Question 2: "From our perspective, privacy is a core issue and helped to motivate our architecture at the most basic level."

Security and privacy are certainly dealt with in IETF protocols although I have to say that the range of what an acceptable level of privacy and security protection constitutes varies quite significantly between different participants. Even the understanding of what privacy and security is varies quite a lot. I am sure the IEEE in the meanwhile has noticed that as well with their experience in WEP. There are two documents that are worthwhile to look at to make sure that we actually talk the same language: 

For security have a look at RFC 3552 (see http://tools.ietf.org/html/rfc3552) and for privacy take a look at http://tools.ietf.org/html/draft-iab-privacy-considerations-07. 

In Section 7 of the privacy document you can find a couple of questions that are, of course, also applicable to the LMAP work, namely: 

 - Data Minimization
 - User Participation
 - Security
 - General

Have a look at this document since there are not too many documents around that give privacy guidelines for people working in a standards developing context. 

One of the most important parts in this work is certainly the user participation, which typically is easier to accomplish when the architecture allows the end user to actually give consent to the data collection selectively and also allows the end user to revoke their consent at any time. In general, such consent is more difficult to provide when the functionality is provided purely network internally, i.e., when the user does not have any new software running on their end devices. Luckily the measurements are most meaningful when they are truely end-to-end tests rather than testing a sub-set of the end-to-end communication path (which had been earlier in other measurement projects). 

Another important point is certainly what information is collected and provided to third parties. Anonymizing data might be a possibility but truely anonymized data are less meaningful. A future working group will have to certainly look at the trade-offs between the different identifiers involved. 

Ciao
Hannes

PS: I may not know enough about the IEEE but the statement "our project is targeted directly at mobile users (independent of air interface technology)" raised some questions for me. I believe the IEEE could best provide their expertise when they work on radio related technology. 

On Mar 28, 2013, at 10:17 AM, Romascanu, Dan (Dan) wrote:

> Hi,
> 
> Please note the following incoming liaison statement from IEEE Project P802.16.3 concerning the LMAP activity. 
> 
> https://datatracker.ietf.org/liaison/1244/
> 
> Comments and discussions are welcome. 
> 
> Regards,
> 
> Dan
> 
> 
> _______________________________________________
> lmap mailing list
> lmap@ietf.org
> https://www.ietf.org/mailman/listinfo/lmap