RE: Back to terminology

Hi Randall,

> >"the location recipient has to verify the authenticity of the
> >policies of the owner", this distinction becomes important.

> I'm not sure that we need to get involved in the policies themselves,
> including how they are authenticated. Maybe at a later stage, after
> the initial work is done. As long as our work allows policies to be
> specified and enforced, in a way that meets our requirements for
> security and privacy, I think that may be enough to start with. In
> fact, we must (per our charter) start with the requirements.

Yes, I agree: I'm not sure that we need to get involved in the
policies themselves; as long as our work allows policies to be
specified and enforced...

But in order to enforce the policies the location server
does need to know that they are authentic, or not?

> >OK. My distinction between the different types of Location Recipients
> >("private", "lawful" (= "regulatory") and "operational") is quite
premature.
>
> I especially do not want to get into any awareness within our work of
> legal or regulatory issues. I think that can easily become a rat
> hole. This is one reason to avoid getting into policy details.

We agree on that.

> >At some point or other we will have to consider that not all types of
> >recipients will be subject to the same laws or policies
>
> I'd like to avoid doing that. If an operational entity is forced by
> law or regulation or contract to impose constraints on the policies
> of its users, that's their business. As long as our work permits
> this to occur, it needn't concern us.

We agree on that, for now. I think much later we could think about
other privacy requirements (for instance *notice*) that could apply to
operational or emergency location servers. But I agree: for
now, forget it.

> >certain properly authenticated "lawful
> >location recipients" are always authorized to get any location
information
> >they ask for.
>
> This is a detail of a policy. If we stay out of such matters, we
> avoid a great deal of complexity.

We agree on that.

Jorge
Received on Tue Feb 19 18:11:56 2002