Subject: Re: [atoca] My use cases

From: Randall Gellens <[email-masked]>
Date: Sat, 4 Feb 2012 13:14:16 -0800

At 11:38 AM +0200 1/14/12, Hannes Tschofenig wrote:

>  In Section 3 of 
> http://tools.ietf.org/html/draft-ietf-atoca-requirements-02 I have 
> currently listed a few examples to motivate the requirements for 
> the underlying transport protocols. These are:
>
>  a) Point-to-Point Delivery of Alerts, and
>  b) Multicast/Broadcast Alert Delivery

We may be jumping ahead of ourselves, by looking at transport 
semantics before we understand the use cases and requirements.  I 
agree that we'll most likely have these two types of transport, but I 
think we need to have text on:

	- Use cases
	- Authorization: How is authorization to initiate an alert 
determined, and do the entities that need to carry the alert need to 
verify that was authorized?  Do the authorization properties vary in 
the different use cases?
	- Transport: What are the requirements for alerts to be 
transported?  Which entities are responsible for accepting alerts, do 
they need to verify them, and what requirements do these entities 
have for handling the alerts?
	- Delivery: What are the requirements for alerts to be delivered 
and/or presented?

>  I don't see what the impact for an alert transport when a national 
> authority vs. local authority approves the distribution of the 
> warnings.

There may be differences in how alerts are authorized, how a 
transporting entity verifies the authorization, and so forth.

>  I also do not see how the opt-in matters in many cases either, 
> unless it has an impact for the protocols.

There are likely to be differences in the requirements or the ability 
to do opt-in or opt-in with point-to-point versus multicast or 
broadcast.  There may be differences in the ability to scale alert 
handling with opt-in or opt-out at one level or another.

>  So far we have a few requirements listed in Section 4.2 
> "Requirements for Alert Subscription" that IMHO covers the relevant 
> aspects.

It may be beneficial to explicitly derive requirements from the use 
cases in the document, to show why we need certain requirements in 
order to meet certain needs.

-- 
Randall Gellens
Opinions are personal;    facts are suspect;    I speak for myself only
-------------- Randomly selected tag: ---------------
The significant problems that we face today cannot be solved at the
same level of thinking that created them.         --Albert Einstein

---

From: Randall Gellens <[email-masked]>
Date: Sat, 4 Feb 2012 13:17:43 -0800

At 12:48 AM -0500 11/18/11, Brian Rosen wrote:

>  I think that there is no difference we care about between a 
> national authority and a regional or local authority save the 
> notion that we can have all of them.  So whether it's a NOAA 
> weather alert, a state AMBER alert, or a local hazmat alert, they 
> have the same properties = broadcast for the geographic area they 
> affect with no opt-out, opt-in sub/not out of the area.
>
>  I think that once you get beyond the notion of government 
> authority, you are into something I class as "enterprise", and you 
> are likely in the sub/not opt-in only arena.  What differentiates 
> these use cases is that they come from a distribution point that 
> isn't tied to your ISP.

We need to identify the entities that handle alerts, and how they 
verify that an alert is authorized.  There may be differences at 
different government levels in how authorization is determined and 
verified.  For example, national alerts might have a single 
designated authority and a reasonably simple mechanism for verifying 
authorization.

-------------- Randomly selected tag: ---------------
For best results, be sure to double clutch when you paradigm shift.

---

From: <[email-masked]>
Date: Sun, 5 Feb 2012 17:12:34 -0000

Friends,

There is a big difference in law between 'Information' and 'Alerts'. Anyone
can say "Its raining quite a lot, old chap, really, really a lot", but only
'Authorities' can say "flooding expected in this area, evacuate now via
highway 13". 

(Art is an expert on this so I hope he can clarify the position). 

I have been doing a lot of research into this matter, so if you don't mind,
here are my thoughts. 

In many countries, the matter of 'Civil Defence' is a matter of national
security policy and is the remit of the 'Ministry of the Interior' of the
sovereign state in whose territory the disaster is being "Hosted". 

Often, strictly no other authority in the world is lawfully permitted to
give instructions to the public in the territory of that sovereign state,
(regardless of their nationality), other than those who have statuary
instruments from the sovereign government concerned. 

Therefore the matter will be different from Country to Country, and if that
country is a Federal State, from State to State. 

The best known present application of CAP is the USA FEMA IPAWS OPEN system,
however CAP is a flexible framework and so other member states may have
their own and different "Modus Operandi" from that of the USA. It's not safe
to assume that the way IPAWS OPEN implements CAP in the USA will be the same
as the way than another country does it. 

For example, SAME codes and FIPS codes are not used in the UK, so they will
definitely be different. But CAP was designed for flexibility.   

Certainly IETF has no right to set standards on this matter. Previous
attempts by very august UN agencies to set standards in this very sensitive
area have failed due to *very vigorous* push-back from the member states who
on no account will tolerate any interference in their interior affairs in
this regard, well meaning or not. 

Having said that, it's instructive to review the USA system; IPAWS as one
"illustrative exemplary embodiment" but remember the above rant :-) 

At the present time, in the USA, the vision is for FEMA IPAWS OPEN system to
be a national alert gateway, the IPAWS OPEN gateway. Any alert messages may
be 'pulled' from IPAWS OPEN for subsequent distribution by any participating
network, but IPAWS OPEN is the national federal source of public alert
information. 

Regarding 'Originators', The FEMA IPAWS OPEN website explains the procedure,
so that a prospective originator can become a 'Collaborating Operating Group
(COG) and gain permission to submit proposals to IPAWS OPEN for further
Authentication and Authorisation. There is a list of qualified originators,
and Authorisation includes endorsement from the State Government, among
other requirements.

Here is a link to the procedure;

 http://www.fema.gov/emergency/ipaws/alerting_authorities.shtm

I am absolutely sure that no government in the world will feel any
differently. I have several clients who are looking at this matter, and they
all understand this point well. Likely, the source for each jurisdiction
will be well known and be appointed by the government. Likely there will be
only one (logically one, but they will be clustered for redundancy).

So, just subscribe to the well known 'Alert Gateway' for the jurisdiction of
interest.  

The administrators of the gateway (probably a national or regional
government agency) will guarantee the Authentication and Authorisation of
the senders according to a very complex set of national criteria (which they
may or may not make fully public) and will probably be highly dynamic. These
may take the form of a 'Trust Protocol' matrix of multilateral MoUs or MoAs.

The distributing network (such as the enterprise) needs to have immunity
from prosecution in case they transmit an alert which turns out to be wrong.
The only lawful way for them to do this is to be sure they have a *'Non
Repudiation'* trace back to the jurisdictional "Alert Gateway" for the area
concerned. 

Of course, the participating 'Distribution Network' may have coverage over
areas which cover more than one Jurisdiction, but then it's an easy matter
to get multiple feeds from the Alert Gateways in those jurisdictions as they
will probably be very few. ('Information' may be different).  

Any other solution would be very dangerous IMHO, as the participating
distribution network may find that they are vulnerable to being sued if
their information turns out to be not completely reliable. There are strict
laws about all this. 

But taking it from the "Alert Gateway" means they are covered by the
statutory instruments of the government agency operating the gateway. Thus
they have indemnity from legal action provided they have not altered the
contents of the message in any way.

For example messages in different languages are provided into the gateway
and no network is expected to perform a transformation.  

Information

Information and even 'Civic Information' is different. However member states
are beginning to understand the issues now, so it's likely that there will
be multiple 'Civic Information Gateways' also, for matters which don't
qualify as 'Alerts' but still need mass distribution. My best guess is that
they will be well advertised and that civic or non civic institutions will
proudly point to them for the benefit of any distribution network wishing to
participate.

In some countries, non governmental actors provide valued and trusted
information for the public. In which case, it may be sent to the alert
gateway, or the information gateway at the pleasure of the government. Of
course a distribution network may have its own multilateral arrangement such
as RSS for such less sensitive information feeds.  

CellCast gateways, for example, are designed for either option as each
government will have their own view on this and it will change a lot. 

Warm regards, Mark Wood, DRCF.

---

From: Art Botterell <[email-masked]>
Date: Sun, 5 Feb 2012 10:19:03 -0800

Friends -

As Mark rightly points out, the notion of "authority" is by no means a simple one.  Although we tend to equate it to "governmental authority," in practice that equation is complicated by several factors.  Among them:

1) Delegation:  There are places I know of where at least some of the legal authority to issue public warnings has been delegated to non-government actors within a policy framework.  Thus, although the policy is a function of government authority, the actual warning message needs to be authenticated to a non-governmental source.

2) Changing legal contexts:  While in our time the power to advocate public behavior has sometimes been seen as a monopoly of government, there are political philosophies afield in a number of places, including the U.S., that would change that.  Regardless of how we may feel about such movements, viewed against the backdrop of global history the notion of such legal or political authority can't be considered immutable.

3) Reciprocity across jurisdictions: When a hazard spans multiple political jurisdictions, as they often do, and especially in an environment where communications systems like broadcast and the Net also span those boundaries, the problem of defining authority can exceed the powers of any single agency.  At the same time, governmental authority is not always organized in a strict hierarchy; e.g., in California we have numerous "special districts" for parks, utilities and so on that span parts of several political subdivisions and that have legal powers overlapping those of the political subdivision.

4) Legal vs. audience-assigned authority: Although we tend to use the term "authority" as shorthand for "legal authority," there's also the factor of personal or moral authority in the eyes of the affected public.  Radio and television weather forecasters are a salient example of actors who often are viewed as "authorities" by the public. Religious and community leaders sometimes also act in that capacity.  By the same token, it's not unheard of for the authority/credibility of a government to be low or even negative in the eyes of some audiences; sometimes wrongly, sometimes not.

And all that is why, in my view, the real issue isn't so much authority as attribution.  As long as an alert can be traced reliably to its source, different audiences can make their own judgements as to who they trust in their own context and their own time.  And without an irrefutable mechanism for associating a message with its source, any attempt at enforcing policy, even within a governmental framework, is greatly weakened.  (Whether there's ever a legitimate role for anonymous "alerts" is another topic on which sincere folks may differ.)  

Whereas if we set out to enforce certain trust relationships over others we risk getting bogged down... unnecessarily, I believe... in the eternal volatilities of politics.

- Art

On Feb 5, 2012, at 9:12 AM, <[email-masked]> wrote:

> _______________________________________________
> atoca mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/atoca

---

From: "DALY, BRIAN K" <[email-masked]>
Date: Sun, 5 Feb 2012 18:30:23 +0000

To the point " the real issue isn't so much authority as attribution", the other critical issue is liability protection for distribution of the alert, such as what is offered to CMSPs under the WARN Act.

Attribution is part of it, but also the distributor of the alert has to be free from all liability for distribution of that alert so long as it was received from the proper source (Federal Gateway here in the U.S.) and there are sufficient legal liability protections in place (from Congress under the WARN Act).

We consider all non-authority alerts - e.g. from day care centers, schools, etc. - to be information sources unless they are registered alert initiators through FEMA and their information comes from that Federal Aggregator - and has sufficient liability protections as is offered under the WARTN Act.

--------
Brian K. Daly
Director, Core Network & Govn't/Regulatory Standards
AT&T Services, Inc.
+1.425.580.6873
[email-masked]

Rethink Possible

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of Art Botterell
Sent: Sunday, February 05, 2012 10:19 AM
To: [email-masked]
Subject: Re: [atoca] Alert Gateways.

Friends -

- Art

---

From: Art Botterell <[email-masked]>
Date: Sun, 5 Feb 2012 11:32:41 -0800

Of course the details of the liability question can vary from country to country and even from actor to actor.  (E.g., I'd be interested in hearing what Google's policy is, and to see how it evolves over time.)  

And much of the liability conversation is,  necessarily, speculative in nature.  E.g., what, ultimately, is the difference between CMAS and, say, Twitter?  To some extent it's circular:  CMAS is different because... well... because we say it's different (i.e., "official.")  And what does it mean to be "official?"  It means that access to it is limited by political authority.  And how is access limited?  By being able to attribute all inputs to sources that can be verified as having whatever constitutes "official" status.

So ultimately, even the liability protection afforded to corporate carriers in the U.S. in the context of CMAS is based on the ability of the federal government to verify the provenance of each individual message.

My point is merely that the particular arrangement of corporations providing alert distribution under the protection of a national government and by way of a central national gateway is a particular instance, but probably not an immutable pattern on which global standards can rest.  Other organizations and/or governments might take different approaches in other places.  

However, I have difficulty imagining any system of alerting, be it an open end-to-end architecture, a heavily-regulated intermediary or something in between, that won't require a credible scheme for message attribution.

- Art

---

From: "Carl Reed" <[email-masked]>
Date: Sun, 5 Feb 2012 15:12:41 -0700

Interesting how provenance is a key aspect of alerts/warnings. I am somewhat 
involved in the W3C Provenance working group. They are defining a conceptual 
model and language for communicating provenance. I provided them a number of 
geo centric provenance use cases. This discussion provides another 
(critical) use case.

Anyone have any thoughts on how best to "insert" the message attribution 
(provenance) requirements into the W3C??

The reason I ask is that the majority of the provenance WG members are not 
alerting or geo literate.

Cheers

Carl

-----Original Message----- 
From: Art Botterell
Sent: Sunday, February 05, 2012 12:32 PM
To: [email-masked]
Subject: Re: [atoca] Alert Gateways.

Of course the details of the liability question can vary from country to 
country and even from actor to actor.  (E.g., I'd be interested in hearing 
what Google's policy is, and to see how it evolves over time.)

And much of the liability conversation is,  necessarily, speculative in 
nature.  E.g., what, ultimately, is the difference between CMAS and, say, 
Twitter?  To some extent it's circular:  CMAS is different because... 
well... because we say it's different (i.e., "official.")  And what does it 
mean to be "official?"  It means that access to it is limited by political 
authority.  And how is access limited?  By being able to attribute all 
inputs to sources that can be verified as having whatever constitutes 
"official" status.

So ultimately, even the liability protection afforded to corporate carriers 
in the U.S. in the context of CMAS is based on the ability of the federal 
government to verify the provenance of each individual message.

My point is merely that the particular arrangement of corporations providing 
alert distribution under the protection of a national government and by way 
of a central national gateway is a particular instance, but probably not an 
immutable pattern on which global standards can rest.  Other organizations 
and/or governments might take different approaches in other places.

However, I have difficulty imagining any system of alerting, be it an open 
end-to-end architecture, a heavily-regulated intermediary or something in 
between, that won't require a credible scheme for message attribution.

- Art

On Feb 5, 2012, at 10:30 AM, DALY, BRIAN K wrote:

> To the point " the real issue isn't so much authority as attribution", the 
> other critical issue is liability protection for distribution of the 
> alert, such as what is offered to CMSPs under the WARN Act.
>
> Attribution is part of it, but also the distributor of the alert has to be 
> free from all liability for distribution of that alert so long as it was 
> received from the proper source (Federal Gateway here in the U.S.) and 
> there are sufficient legal liability protections in place (from Congress 
> under the WARN Act).
>
> We consider all non-authority alerts - e.g. from day care centers, 
> schools, etc. - to be information sources unless they are registered alert 
> initiators through FEMA and their information comes from that Federal 
> Aggregator - and has sufficient liability protections as is offered under 
> the WARTN Act.
>
> --------
> Brian K. Daly
> As Mark rightly points out, the notion of "authority" is by no means a 
> simple one.  Although we tend to equate it to "governmental authority," in 
> practice that equation is complicated by several factors.  Among them:
>
> 1) Delegation:  There are places I know of where at least some of the 
> legal authority to issue public warnings has been delegated to 
> non-government actors within a policy framework.  Thus, although the 
> policy is a function of government authority, the actual warning message 
> needs to be authenticated to a non-governmental source.
>
> 2) Changing legal contexts:  While in our time the power to advocate 
> public behavior has sometimes been seen as a monopoly of government, there 
> are political philosophies afield in a number of places, including the 
> U.S., that would change that.  Regardless of how we may feel about such 
> movements, viewed against the backdrop of global history the notion of 
> such legal or political authority can't be considered immutable.
>
> 3) Reciprocity across jurisdictions: When a hazard spans multiple 
> political jurisdictions, as they often do, and especially in an 
> environment where communications systems like broadcast and the Net also 
> span those boundaries, the problem of defining authority can exceed the 
> powers of any single agency.  At the same time, governmental authority is 
> not always organized in a strict hierarchy; e.g., in California we have 
> numerous "special districts" for parks, utilities and so on that span 
> parts of several political subdivisions and that have legal powers 
> overlapping those of the political subdivision.
>
> 4) Legal vs. audience-assigned authority: Although we tend to use the term 
> "authority" as shorthand for "legal authority," there's also the factor of 
> personal or moral authority in the eyes of the affected public.  Radio and 
> television weather forecasters are a salient example of actors who often 
> are viewed as "authorities" by the public. Religious and community leaders 
> sometimes also act in that capacity.  By the same token, it's not unheard 
> of for the authority/credibility of a government to be low or even 
> negative in the eyes of some audiences; sometimes wrongly, sometimes not.
>
> And all that is why, in my view, the real issue isn't so much authority as 
> attribution.  As long as an alert can be traced reliably to its source, 
> different audiences can make their own judgements as to who they trust in 
> their own context and their own time.  And without an irrefutable 
> mechanism for associating a message with its source, any attempt at 
> enforcing policy, even within a governmental framework, is greatly 
> weakened.  (Whether there's ever a legitimate role for anonymous "alerts" 
> is another topic on which sincere folks may differ.)
>
> Whereas if we set out to enforce certain trust relationships over others 
> we risk getting bogged down... unnecessarily, I believe... in the eternal 
> volatilities of politics.
>
> - Art
>
>

---

From: Art Botterell <[email-masked]>
Date: Sun, 5 Feb 2012 14:45:20 -0800

Hi Carl -

Not sure how the W3C is using the term exactly, but the use of the word "provenance" seems frequently to imply a transitive-trust approach to ensuring data quality.  The provenance, to use the noun form, is a description of the "chain of custody" of some particular datum or collection of data.  That's a familiar approach, but like any chain it's subject to breakage at any point.

Whereas "attribution" (at least in the sense I learned in back in journalism school) refers only to the original source and is agnostic as to the subsequent path of the information; it's the sort of scheme we sometimes implement using digital signatures.

Ultimately both approaches are only as good as the confidence we can have in our identification of the various actors.  For several reasons, liability included, I personally prefer end-to-end arrangements over those that give multiple actors a chance to color the content undetected.  However, there are plenty of datasets, not least geospatial datasets, that weren't signed originally, and in those cases some sort of provenance is probably the best that can be done.

At some point this turns into another one of those "end-to-end versus money-in-the-middle" debates.  Probably the best we can hope for is to minimize the extent to which provenance and authentication become conflated.  They're related but not necessarily the same.

- Art

On Feb 5, 2012, at 2:12 PM, Carl Reed wrote:

> Interesting how provenance is a key aspect of alerts/warnings. I am somewhat involved in the W3C Provenance working group. They are defining a conceptual model and language for communicating provenance. I provided them a number of geo centric provenance use cases. This discussion provides another (critical) use case.
> 
> Anyone have any thoughts on how best to "insert" the message attribution (provenance) requirements into the W3C??
> 
> The reason I ask is that the majority of the provenance WG members are not alerting or geo literate.
> 
> Cheers
> 
> Carl
> 
> 
> -----Original Message----- From: Art Botterell

---

From: Martin Thomson <[email-masked]>
Date: Mon, 6 Feb 2012 16:34:06 -0800

This thread really boils down to one thing from my perspective.  The
set of entities that are trusted to provide alerts vary based on a
number of factors:

the alert recipient
the subject, or the entity affected by the alert, which in many cases
is the same as the alert recipient
the location of the subject, which might have an influence on the next...
the originator of the alert, which may have something to say about on
the next...
the nature and content of the alert

And the entity that delivers the packet is not on this list.  Hence
the point on "provenance", which is quite relevant.

To the largest extent possible, avoiding making judgements on these is
our responsibility. Any technical mechanism needs to ensure that
information is made available so that informed decisions are possible.

There may well be cases where a service provider (for instance)
provides a recipient with some information that informs their
decisions about trust, but we can be very careful about how we
structure these things.  And I think that we have to be.

If (for example) we provide a means for a network operator to provide
their users with a set of certificates for users as a way to aid users
in filtering out spam alerts, then the semantics can't be something
like "here are your trust anchors". Something more appropriate would
be: "these entities are trusted by our network", or weaker still:
"these alert sources are legal in this jurisdiction".  And I'm not
even sure that is exactly the right phrasing/semantic either.

--Martin