Re: [Secdispatch] Open Ethics Transparency Protocol

[Eric Rescorla <[e-mail]>]

Leading with the [SEC]DISPATCH questions, I don't think we should do
anything here. I would feel differently if there were a significantly
stronger showing of general interest and more evidence that this could
be practically achieved.


I had a fair amount of trouble figuring out what this document was
trying to achieve. My best understanding is that this is intended to
be a machine-readable description of the data processing practices of
a given entity. The current document seems to mix several things:

- A mechanism for retrieving these statements via HTTP
- A schema for the contents of these statements
- A log-based transparency system

The details of all of this are fairly thin and I doubt could be implemented
interoperably. For instance, here's the section on Immutable storage:

   Both the signature integrity hash and the Disclosure SHOULD be stored
   in the log-centric root database and MAY be mirrored by other
   distributed databases for redundancy and safety.

This doesn't seem to define a specific protocol.


My primary question is whether this is a good idea. I have two primary
concerns:

1. Is there real demand for this?
2. Is it going to work.

On the former front, I'd like to hear whether there is a critical mass
of sites which would publish this kind of label. AFAICT nobody has
jumped in to say so on the thread. That seems like a prerequisite for
any IETF activity here.


On the latter piece, the main prior art that I am aware of in
attempting to provide machine-readable descriptions of this sort is
P3P, and I think it's generally agreed that that didn't work out. It's
not clear to me that it's really possible to define a sensible
taxonomy of this kind of information processing.

The description of what goes in the JSON is quite thin and doesn't
seem anywhere near detailed enough to understand the information
processing that a given entity performs.  The label generator linked
to in this draft has a bunch of multiple choice questions, e.g.,

  [ ] Open Source Code
  [ ] Proprietary Source Code

  Code development and reuse

  Please describe choices made for development and for use of existing code
libraries.

First, it's not clear why they are mutually exclusive, as I could use
both. Second, it seems like nearly all the interesting information is
going to be in the freeform portion, which badly undercuts the whole
enterprise.

-Ekr











On Mon, Jan 31, 2022 at 8:13 AM <[e-mail]> wrote:

> Hi everyone,
> Nikita Lukianets from the Open Ethics initiative here.
>
> I've been working on the mechanisms to enable transparency for data
> collection and data processing practices for autonomous systems and
> specifically, those powered by machine learning models. Since 2020 I
> have started to draft a guiding document to reflect ways disclosures
> could be submitted, verified, and exchanged. Eventually, I would like to
> see how this work could result in an open standard.
>
> I've chosen IETF as a home for this work as AI-powered applications are
> becoming ubiquitous. Therefore, we should start looking at them from the
> internet standard and supply chain perspectives.
> There's an emergent need to bring a legally-agnostic and standardized
> way to describe these systems from privacy, security, fairness,
> datasets, and explainability stances.
>
> The idea is simple
> * Following the example of the food (construction, pharma, electrical
> appliance) industry, we need every application to (voluntary) disclose
> the "ingredients", e.g. how data is collected and outputs are produced.
> * We need to have a standard way (protocol) to represent each disclosure
> in human- and machine-readable formats, validate, verify and process
> them.
> * Complex apps will involve chaining the disclosures for the components
> involved.
>
>
> My motivation is to continue the discussion here and get feedback
> allowing us to iterate on the protocol. I'd like to bring this
> discussion to a relevant group or/and welcome the creation of the new
> one, also potentially bringing the conversation to the IETF meeting in
> Vienna.
>
> Below are the links with more info
> Article to bring the context, in plain English
>
> https://lukianets.medium.com/why-algorithmic-transparency-needs-a-protocol-2b6d5098572f
>
> The IETF I-D
>
> https://datatracker.ietf.org/doc/draft-lukianets-open-ethics-transparency-protocol/
>
> GitHub repo
> https://github.com/OpenEthicsAI/OETP
>
> Thanks a lot for your help and thoughts
>
>
> Nikita Lukianets
> Founder, CTO PocketConfidant
> Founder Open Ethics initiative
> Twitter: @nikiluk
> https://fr.linkedin.com/in/nikiluk
> Schedule a 30 min call: https://lukianets.com/meet/
>
> _______________________________________________
> Secdispatch mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/secdispatch
>