- cooperation-wg - mailman.ripe.net

My summary of discussion on COM(2012) 238/2
by Patrik Fältström 19 May '13

19 May '13

My summary of the discussion is positive, although when you read the below it sounds negative. Yes, I am worried personally about the proposed regulation, but that has been the case for months -- and increased worried I am after the meeting Thursday. I am though optimistic the question whether I should be worried, or no longer, can be resolved as many people said they will now help looking at the proposal. So yes, concerned, very concerned, but also happy finally discussion starts. So, discussions related to the proposed regulation COM(2012) 238/2 has started also in the organisations and areas which develop protocol and operational practices for the Internet. This happened previous week at the RIPE meeting that took place in Dublin. After some discussions with the EU Commission it was clear they could not participate on site, but on video. Quite irritating I must say that Commission that do issue (basis for) legislation that is quite specific without participating directly in the multi stakeholder discussions that exists on these topics. Last time I had this kind of discussion with COM it was related to the future of E.164 numbers in Europe. You can see a summary of the discussion including exchange of letters here: <http://stupid.domain.name/node/1459> Last time I find COM did participate actively on technical matters was when Per Blixt did come to a RIPE meeting and not only participated but also listened. Andrea Glorioso, Linda Corugedo Steneberg and others have participated in discussions related to Internet Governance of course, although as much in the RIPE community as elsewhere (ICANN, EuroDIG for example). So COM did not send a person this time either, but Andrea Servida that is one of the main persons related to the proposed regulation participated via a video conference. He presented and also responded to questions. Which of course was better than nothing. My view of the situation *before* the meeting you can find here <http://stupid.domain.name/node/1674>. You can find slides used for the cooperation working group here <https://ripe66.ripe.net/programme/meeting-plan/coop-wg/>. The ones interesting are the ones from Andrea Servida and the one from Patrik Fältström named "Article 5". At <https://ripe66.ripe.net/archives/#Thursday> you can see video, transcripts and more. In short, Andrea in my eyes confirmed the proposed regulation is not only about e-ID but much more general and related to all different kind of validation of who one communicate with. Not only e-ID but also "what web site one communicate with". This in turn to many in the room have impact on the models built for Internet at the moment using technologies like RPKI and DNSSEC which are directions there is broad consensus about. Due to the discussions RIPE NCC has decided to investigate whether it is true that the regulation MIGHT have impact on DNSSEC, RPKI or federated identity systems. The review will be done in a number of steps, all so that incremental results can be delivered as there is a lack of time regarding sending feedback to the European Parliament and Council where the proposal is currently discussed. Several country representatives (in a broad meaning), including SE, UK, DE and USA has contacted me and asked what my position is, and as a non-lawyer of course I can not say definitely. The good thing is that finally people do connect this proposed regulation with Internet. Something I claim COM has not done. Because the largest problem is once again that COM has developed a text without participating in the processes that exists for technical development. This implies people do not disagree with the over all problem statement, but to the proposed solution of the problem. When then objecting, it is as if one disagree with the problem existing. A summary of the situation is that the solution that is proposed is that in a combination of Brussels and Member States it is explicitly decided who are to be trust providers, and further that those trust providers must be trusted for various services that require among other things age, citizenship, residency and more (once again, according to Brussels/Member States). A different solution, which is more "modern" and also deployed, is that different systems do require different levels and kind of security. In some areas those are called "federations". Then for each such federation there is a combined certification and accreditation process by which the providers can be approved. Parties can then trust whoever they want as long as they have passed this audit. Decision of trust stays with whoever takes the risk. And here we have not started looking at the questions on the sovereignty member states of EU has in relationship with each other, and the built in contradiction between this and the interest in free movement of goods and services. Or the fact the proposed regulation define for example the following terms (as found by Gordon -- thanks): electronic identification; electronic identification means; electronic identification scheme; signatory; electronic signature; advanced electronic signature; qualified electronic signature; electronic signature creation data; certificate; qualified certificate for electronic signature; trust service; qualified trust service; trust service provider; qualified trust service provider; product; electronic signature creation device; qualified electronic signature creation device; creator of a seal; electronic seal; advanced electronic seal; qualified electronic seal; electronic seal creation data; qualified certificate for electronic seal; electronic time stamp; qualified electronic time stamp; electronic document; electronic delivery service (including proof of sending or receiving the data); qualified electronic deliver service; qualified certificate for website authentication; validation data. I have no idea whether anyone have checked the definition of these terms to see how they match or not match the general view in the world, and for example matches the definitions used in for example trade discussions between EU and USA, within OECD and/or WTO. Anyway, at last the discussion has started, and the first answers on the landscape should come from RIPE NCC that time should have read the document with a lawyers eyes. And we can know whether we should continue to be worried, or whether this is something that indeed is not impacting what is happening on the Internet. Patrik

1 0

Agenda item on electronic identification and trust services
by Gordon Lennox 09 May '13

09 May '13

The European Commission has made a proposal for a Regulation "on electronic identification and trust services for electronic transactions in the internal market" - COM(2012) 238 final. I am very pleased that the co-chairs have put this draft regulation on the agenda and that indeed Andrea Servida, who is responsible in DG Connect for the Task Force “Legislation Team (eIDAS)”, will make a presentation. While I most certainly do not wish to prejudge what Andrea will say I think a bit of "marketing" might be useful - to explain a bit more why I personally think this regulation is of importance to the RIPE community now. So let me start with a bit of "EU 101". At its simplest the Commission proposes legislation, after obviously having consulted and reflected and so on, and it is then for the Council (the member states directly) and the Parliament to possibly modify and then adopt the legislation. There are then three basic instruments open to the Commission. There is the Directive which once agreed at the EU level, is normally transposed into national law. That means further discussion at the national level. There is the Regulation which become EU legislation on adoption. There is the Decision which is directed towards a specific member state or entity. This proposed Regulation is to an extent a follow-on and replacement for a previous Directive - 1999/93/EC on a "Community framework for electronic signatures". It seems agreed that the signatures Directive did not fully deliver. This Regulation will replace that "e-signature Directive" from 1999 - and nullify the previously transposed legislation? In the press release for this proposal European Commission Vice President Neelie Kroes said "People and businesses should be able to transact within a borderless Digital Single Market, that is the value of Internet. Legal certainty and trust is also essential, so a more comprehensive eSignatures and eIdentification Regulation is needed. ... This proposal will mean you can make the most of your e-ID, if you have one. With mutual recognition of national e-IDs and common standards for trust services and eSignatures, we can prevent a national carve-up of the Internet and online public services and make life easier for millions of businesses and even more citizens. " So the proposal has been made by the Commission and it is currently being discussed in Council and in Parliament. I have had though a variety of conversations recently about the proposal and they have thrown up a number of concerns. The proposal seems complex and different people seem to take quite different things away from it. This is perhaps linked to questions about the scope of the regulation. There are perhaps two main dimensions to regarding the scope. First there are the actors and users. Is it only about the public sector? Is it about the public sector and a particular bit of the private sector or any bit of the private sector, in the EU or elsewhere, that might find it useful? Or will the private sector be specifically precluded from using some of the services? Secondly the range of services. The regulation includes a number of definitions: electronic identification; electronic identification means; electronic identification scheme; signatory; electronic signature; advanced electronic signature; qualified electronic signature; electronic signature creation data; certificate; qualified certificate for electronic signature; trust service; qualified trust service; trust service provider; qualified trust service provider; product; electronic signature creation device; qualified electronic signature creation device; creator of a seal; electronic seal; advanced electronic seal; qualified electronic seal; electronic seal creation data; qualified certificate for electronic seal; electronic time stamp; qualified electronic time stamp; electronic document; electronic delivery service (including proof of sending or receiving the data); qualified electronic deliver service; qualified certificate for website authentication; validation data. There are then articles on notification, coordination and liability, and on supervision, mutual assistance and security requirements, and so on. And all this has to be read keeping in mind that legislators like to have "technology neutral" text and not to refer to specific standards for example. There two other things I would draw to your attention though. One is fairly explicit in the proposal and that is that the regulation when adopted will confer on the Commission the power to adopt delegated acts. This kind of thing is not that unusual. But some see this, in this instance, as adding an additional degree of uncertainty, leaving some things unclear. The other is the issue of "agreed text". Any legislation in the coming years - and that can be 10-15 years or more in this case - and anywhere in the EU will be effectively constrained by these definitions for things like electronic signature and electronic seal and so on. Again this is quite normal. But you need to be aware of it. I hope all that means that many of you will be there for a productive WG session in Dublin with good questions for Andrea after his presentation. I look forward to seeing you there. In the meantime, thanks again to the co-chairs and to Andrea for agreeing to speak. Fáilte go Baile Átha Cliath, Gordon

1 0

WTPF in Geneva
by Patrik Fältström 06 May '13

06 May '13

Parallell with the RIPE Meeting in Dublin is the WTPF meeting in Geneva. We will on the Thursday get a report from RIPE NCC on what they have done and many of us do follow remotely very close what is happening. I encourage everyone to, for example, have a look at this document and others that describe one view of the Internet that for example does not match my personal view. You can find other documents, all public, here: <http://www.itu.int/md/S13-WTPF13-INF/en> Patrik

3 12

Agenda for upcoming Cooperation WG - at RIPE 66
by Maria Häll 03 May '13

03 May '13

Hi all Coop WG colleagues See agenda for the session below. 1. RIPE NCC External Relations Update - Paul Rendek, Chris Buckridge, RIPE NCC 2. eID and Trust Services Regulation in the EU - Daphné Lévêque, European Commission DG CONNECT 3. Building Cooperation with the Academic Networks Community - Maria Häll, SUNET 4. Public/private Cooperation on Internet Issues: The Irish Experience - Michele Neylon, Blacknight Internet Solutions Ltd 5. AOB See you at Cooperation WG session at RIPE 66, Thursday 16 May 11-12.30 Have a nice weekend! _________________________________ Best regards, Maria Häll CEO/Föreståndare SUNET - Swedish University Network Email: maria(a)sunet.se Mobile: +46 70 535 41 38 Web: www.sunet.se

1 0

[news] RIRs Submit Remarks to ITU WTPF-13
by Paul Rendek 01 May '13

01 May '13

Dear colleagues, On 29 April 2013, the RIPE NCC, as a sector member of the International Telecommunication Union (ITU), formally submitted a document to the ITU Secretariat on behalf of the five Regional Internet Registries (RIRs). The document addresses a range of issues that will be discussed at the upcoming ITU World Telecommunication/ICT Policy Forum 2013 (WTPF-13): https://www.ripe.net/internet-coordination/internet-governance/multi-stakeh… In mid-April, various RIPE community members gave feedback on a draft of this document. It was updated ahead of its official submission and now includes more detailed information to address some of the opinions discussed by the Informal Expert Group (IEG) that was convened in preparation for the WTPF-13. An annex has been added outlining the efforts of the five RIRs to support the deployment of IPv6 and IPv6 capacity building. Representatives of all five RIRs will be present at WTPF-13 and, as always, are available for consultation on any of the points raised in this document, as well as any other aspects of RIR business. RIPE community members are encouraged to comment or raise questions on the RIPE Cooperation Working Group mailing list. Best regards, Paul Rendek Director of External Relations RIPE NCC

1 0

Changed copyright rules for orphaned work in UK?
by Patrik Fältström 01 May '13

01 May '13

See this, might interest people on this list: <http://www.theregister.co.uk/2013/04/29/err_act_landgrab/> Patrik

2 1

Re: [cooperation-wg] [ncc-announce] [news] RIRs Publish Response to ITU WTPF Opinions on Internet Governance
by Nick Hilliard 26 Apr '13

26 Apr '13

Paul, The various IXP associations may be interested in working with the NROs on a statement on Option 1: "Promoting Internet Exchange Points (IXPs) as a long term solution to advance connectivity". As it stands, the RIR_WTPF13_2 document suggests that the NRO gives the ITU blanket support for their position: "The RIRs support this Opinion." There are pre-existing structures in place for fostering IXP growth, and the ITU's involvement in creating new structures would probably be quite unhelpful. Nick On 23/04/2013 09:34, Paul Rendek wrote: > [Apologies for duplicates] > > Dear colleagues, > > The International Telecommunication Union (ITU) will hold the Fifth World Telecommunication/ICT Policy Forum (WTPF) in Geneva this May. This event is being convened specifically to look at Internet-related public policy matters. > > The primary input document to this meeting is a report by the ITU Secretary General, including six Opinions agreed to by an Informal Experts Group (IEG) that met three times over the past year. These Opinions touch on issues including management of Internet number resources, encouraging IPv6 adoption, support for Internet Exchange Points (IXPs), multi-stakeholder governance and Enhanced Cooperation. > > The five Regional Internet Registries (RIRs) have drafted responses to the five Opinions that relate directly to the RIRs' areas of expertise and coordination. A document containing these responses has been published at: > http://www.nro.net/wp-content/uploads/RIR_WTPF13_2.pdf > > The full Secretary General's report (including the six Opinions) is available at: > http://www.itu.int/md/S13-WTPF13-C-0003/en > > I invite you to post any questions or comments regarding this document to the RIPE Cooperation Working Group mailing list (cooperation-wg(a)ripe.net). > > Best regards, > > Paul Rendek > Director of External Relations, RIPE NCC > > > >

8 8

EU proposa on qualified signatures
by Patrik Fältström 26 Apr '13

26 Apr '13

All, There is as some of you might know a discussion in EU related to e-ID and a new proposed regulation on trust services. One summary of the situation is made by member of the European Parliament Amelia Andersdotter that criticizes the proposal that is on the table for the parliament. I have personally had problems with the original directive, and this proposal even more as it tries to enforce onto people and organisations who to trust. Or more specifically, who you should trust as a trusted third party. I think federated solutions are better as "one size does not fit all", and with federated solutions one can more easily build services the way "it was intended" on the Internet. Anyway, here is the summary by Amelia, and maybe we should spend some time on this in Dublin, if people are interested? http://ameliaandersdotter.eu/eid-and-trust-services-regulation/ Patrik

2 2

RIRs Publish Response to ITU WTPF Opinions on Internet Governance
by Paul Rendek 23 Apr '13

23 Apr '13

[Apologies for duplicates] Dear colleagues, The International Telecommunication Union (ITU) will hold the Fifth World Telecommunication/ICT Policy Forum (WTPF) in Geneva this May. This event is being convened specifically to look at Internet-related public policy matters. The primary input document to this meeting is a report by the ITU Secretary General, including six Opinions agreed to by an Informal Experts Group (IEG) that met three times over the past year. These Opinions touch on issues including management of Internet number resources, encouraging IPv6 adoption, support for Internet Exchange Points (IXPs), multi-stakeholder governance and Enhanced Cooperation. The five Regional Internet Registries (RIRs) have drafted responses to the five Opinions that relate directly to the RIRs' areas of expertise and coordination. A document containing these responses has been published at: http://www.nro.net/wp-content/uploads/RIR_WTPF13_2.pdf The full Secretary General's report (including the six Opinions) is available at: http://www.itu.int/md/S13-WTPF13-C-0003/en I invite you to post any questions or comments regarding this document to the RIPE Cooperation Working Group mailing list (cooperation-wg(a)ripe.net). Best regards, Paul Rendek Director of External Relations, RIPE NCC

1 0

Comment on eid-and-trust-services-regulation
by Alessandro Vesely 22 Apr '13

22 Apr '13

Amelia, I read your blog (see link in the post below) and wish to thank you for your work and for your amendments to the eIDSA. In particular, I support how you'd move art. 11 to art. 4a and the additions brought there. It seems that, if techniques like OAuth 2.0 or similar --based on pseudonyms like email addresses-- take root, then mailbox providers may become the trust service providers of choice for a number of mundane transactions, including shopping and subscriptions to newsletters and mailing lists. The ability to generate pseudonyms ad-hoc (the part before the "@") can allow complete anonymity, and possibly trace unwanted leakage of the pseudonym itself. In addition, a provider chosen by the data subjects can register such transactions on their behalf: Any other method for acquiring consent ends up being registered on the processor's side only, which I consider unfair of Directive 95/46/EC. Regards A mailbox provider -------- Original Message -------- From: Patrik Fältström <patrik(a)frobbit.se> Date: Mon, 22 Apr 2013 10:00:07 +0200 To: cooperation-wg(a)ripe.net <cooperation-wg(a)ripe.net> Subject: [cooperation-wg] EU proposa on qualified signatures All, There is as some of you might know a discussion in EU related to e-ID and a new proposed regulation on trust services. One summary of the situation is made by member of the European Parliament Amelia Andersdotter that criticizes the proposal that is on the table for the parliament. I have personally had problems with the original directive, and this proposal even more as it tries to enforce onto people and organisations who to trust. Or more specifically, who you should trust as a trusted third party. I think federated solutions are better as "one size does not fit all", and with federated solutions one can more easily build services the way "it was intended" on the Internet. Anyway, here is the summary by Amelia, and maybe we should spend some time on this in Dublin, if people are interested? http://ameliaandersdotter.eu/eid-and-trust-services-regulation/ Patrik

2 1