Re: [Secdispatch] Open Ethics Transparency Protocol

[Michael Richardson <[e-mail]>]

[e-mail] wrote:
    > I've been working on the mechanisms to enable transparency for data
    > collection and data processing practices for autonomous systems and
    > specifically, those powered by machine learning models. Since 2020 I
    > have started to draft a guiding document to reflect ways disclosures
    > could be submitted, verified, and exchanged. Eventually, I would like
    > to see how this work could result in an open standard.

Are you talking about security disclosures?
Or something else?
I read the connected links and I think it has something to do with disclosing
risks with Machine Learning systems.

    > I've chosen IETF as a home for this work as AI-powered applications are
    > becoming ubiquitous. Therefore, we should start looking at them from
    > the internet standard and supply chain perspectives.  There's an
    > emergent need to bring a legally-agnostic and standardized way to
    > describe these systems from privacy, security, fairness, datasets, and
    > explainability stances.

...

    > The idea is simple * Following the example of the food (construction,
    > pharma, electrical appliance) industry, we need every application to
    > (voluntary) disclose the "ingredients", e.g. how data is collected and
    > outputs are produced.  * We need to have a standard way (protocol) to

Sounds like a kind of (software) Bill of Materials.
SBOM is not really occuring inside the IETF, but rather at places like NIST.

We have some of it in the MUD (RFC8520) space, some in SACM (CoRIM), but
mostly it is at NIST/NTIA.   I don't think SBOM fits at all though.

    > Below are the links with more info Article to bring the context, in
    > plain English
    > https://lukianets.medium.com/why-algorithmic-transparency-needs-a-protocol-2b6d5098572f

I read this, but and while it explained some of the why, it didn't make it
clear what your how is.

    > The IETF I-D
    > https://datatracker.ietf.org/doc/draft-lukianets-open-ethics-transparency-protocol/

I scanned your document.  You have a pretty good grasp of a reasonable
syntax, and in some ways it is similiar to securitytxt in syntax.
But, I don't really understand the semantics of the content, and your example
in section 5 didn't help me at all.

I think you need a more detailed, more well worked set of examples to
motivate things.  Avoid getting into the syntax: how would practices be
described, attested to, etc?

--
Michael Richardson <[e-mail]>   . o O ( IPv6 IøT consulting )
           Sandelman Software Works Inc, Ottawa and Worldwide