[Modern] Kathleen Moriarty's Discuss on draft-ietf-modern-problem-framework-03: (with DISCUSS and COMMENT)

[Kathleen Moriarty <[e-mail]>]

Kathleen Moriarty has entered the following ballot position for
draft-ietf-modern-problem-framework-03: Discuss

When responding, please keep the subject line intact and reply to all
email addresses included in the To and CC lines. (Feel free to cut this
introductory paragraph, however.)


Please refer to https://www.ietf.org/iesg/statement/discuss-criteria.html
for more information about IESG DISCUSS and COMMENT positions.


The document, along with other ballot positions, can be found here:
https://datatracker.ietf.org/doc/draft-ietf-modern-problem-framework/



----------------------------------------------------------------------
DISCUSS:
----------------------------------------------------------------------

I agree with the SecDir reviewer that a Privacy Considerations section is
needed.  What user data is potentially exposed?  4.3.4 talks about government
access, who else has access?  What concerns are there about the data that is
shared?  What if one of the involved systems is compromised and data is stolen?

It's a well written draft, this appears to be a gap and I didn't see a response
to the SecDir review.  Thanks in advance.

https://mailarchive.ietf.org/arch/msg/secdir/1WiFmubNoAKo3qAhNu4be35g10w


----------------------------------------------------------------------
COMMENT:
----------------------------------------------------------------------

I'm a little surprised to see section 4.3.4 instead of just a statement on how
authorized access to the data is provided.