Subject: [dispatch] Draft on TRIP IANA registry & postal addresses

From: Jari Arkko <[email-masked]>
Date: Wed, 18 Jul 2018 10:53:20 -0400

Ted and I have written a draft to update one IANA registry that
(we think unnecessarily) calls for registering postal addresses
for people who request code points. We think this should
not be done for privacy, GDPR, exception at IANA, etc. 
reasons.

We’d love to get feedback, and if there’s no roadblocks,
move pretty quickly to asking the working group or the ADs
to take the draft forward.

Jari

> Name:		draft-arkko-trip-registry-update
> Revision:	00
> Title:		Update to the TRIP IANA Registry Rules Regarding Postal Addresses
> Document date:	2018-07-16
> Group:		Individual Submission
> Pages:		3
> URL:            https://www.ietf.org/internet-drafts/draft-arkko-trip-registry-update-00.txt
> Status:         https://datatracker.ietf.org/doc/draft-arkko-trip-registry-update/
> Htmlized:       https://tools.ietf.org/html/draft-arkko-trip-registry-update-00
> Htmlized:       https://datatracker.ietf.org/doc/html/draft-arkko-trip-registry-update
> 
> 
> Abstract:
>   This memo updates the IANA registry rules for the Telephony Routing
>   over IP (TRIP) protocol, by no longer requiring that postal addresses
>   be included in contact information.
> 
>   This memo updates RFC 3219.

---

From: Cullen Jennings <[email-masked]>
Date: Wed, 18 Jul 2018 11:21:31 -0400

100% support this draft and it looks done to me. It seems like a good draft to be AD to sponsor but if the ADs would prefer it to go through the WG, I think we should  adopt it if they are no objections. 

> On Jul 18, 2018, at 10:53 AM, Jari Arkko <[email-masked]> wrote:
> 
> _______________________________________________
> dispatch mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/dispatch

---

From: Mary Barnes <[email-masked]>
Date: Wed, 18 Jul 2018 13:14:03 -0500

As an individual, I agree with this proposal.  Including the addresses was
a carryover from the telecom world where all the registries required (and
still do) postal addresses.

As chair, it's probably within scope of being a WG document since it's
related to a registry.

Regards,
Mary

---

From: Larry Masinter <[email-masked]>
Date: Wed, 18 Jul 2018 14:05:45 -0700

Postal addresses should be part of "information about the organization that will administer the ITAD" (RFC 3219 Section 13.5).  What is the privacy benefit for such an organization to not reveal its postal address, if it has one?

TRIP Attributes requires a Specification ("RFC or equivalent"), which have authors, who often provide a postal address in their contact info. So what is the privacy benefit for those registering the type?

In general, you have to trade off privacy vs. security and robustness of process. For example, the successful use of "NOTE WELL" notices rather than explicit consortia-membership agreements depends to some degree on the ability to connect a posting to a registry to an individual who agrees to be bound by the terms in NOTE WELL. (Otherwise, what's the point?)

Why is address useful? Hard to make up new ones, and gives a clue about jurisdiction of the contributor.

To those reviewing IETF RFCs for unneeded use of addresses: consider this in your evaluation of postal or physical address privacy issues. 

Larry
--
https://LarryMasinter.net

---

From: Ted Hardie <[email-masked]>
Date: Wed, 18 Jul 2018 17:33:57 -0400

Hi Larry,

On Wed, Jul 18, 2018 at 5:05 PM, Larry Masinter <[email-masked]> wrote:

> Postal addresses should be part of "information about the organization
> that will administer the ITAD" Section 13.5)
>

That's the section of RFC 3219 that this draft modifies, and that's why it
is listed as updating the RFC.

> .  What is the privacy benefit for such an organization to not reveal its
> postal address, if it has one?
>
>
I think our thinking is more-or-less the reverse of this:  what public
benefit is publication of this data serving?  In the case of this registry,
the use of this data did not require the postal address at all, and the
electronic contact information is also available.  Continuing to collect it
when it is not used seems to be un-needed.

> TRIP Attributes requires a Specification ("RFC or equivalent"), which have
> authors, who often provide a postal address in their contact info. So what
> is the privacy benefit for those registering the type?
>
> ITAD numbers don't actually require this, but are first come first served,
requiring only completing a form:

https://www.iana.org/form/trip-itad

regards,

Ted Hardie

---

From: S Moonesamy <[email-masked]>
Date: Wed, 18 Jul 2018 17:14:44 -0700

Hi Jari,
At 11:14 AM 18-07-2018, Mary Barnes wrote:
>As an individual, I agree with this 
>proposal.Â  Including the addresses was a 
>carryover from the telecom world where all the 
>registries required (and still do) postal addresses.

The Introduction Section mentions "privacy 
benefit" with respect to postal addresses.  If I 
understood corectly, the issue is about 
PII.  Should both postal and email addresses be 
considered instead of postal addresses only?

Regards,
S. Moonesamy

---

From: Jonathan Rosenberg <[email-masked]>
Date: Thu, 19 Jul 2018 13:38:20 -0400

Im supportive of this. When we specified TRIP oh-so-long-ago there wasnt
really a technical need - it just seemed a reasonable thing to do to
collect the address. GIven the new sensitivies to PII it makes sense to
change this. Worth noting that I dont think there are any real TRIP
depoyments, so this is largely a cleanup exercise I think.

-Jonathan R.

On Wed, Jul 18, 2018 at 10:53 AM Jari Arkko <[email-masked]> wrote:

> > URL:
> https://www.ietf.org/internet-drafts/draft-arkko-trip-registry-update-00.txt
> > Status:
> https://datatracker.ietf.org/doc/draft-arkko-trip-registry-update/
> > Htmlized:
> https://tools.ietf.org/html/draft-arkko-trip-registry-update-00
> > Htmlized:
> https://datatracker.ietf.org/doc/html/draft-arkko-trip-registry-update
> >
> >
> > Abstract:

-- 
Jonathan Rosenberg, Ph.D.
[email-masked]
http://www.jdrosen.net

---

From: Jari Arkko <[email-masked]>
Date: Fri, 20 Jul 2018 08:35:29 -0400

SM,

> The Introduction Section mentions "privacy benefit" with respect to postal addresses.  If I understood corectly, the issue is about PII.  Should both postal and email addresses be considered instead of postal addresses only?

Good question.

However, we are targeting only one change with regards to this draft, the postal addresses. This registry is to my knowledge the only one that current requires postal addresses, and we want to fix that because that keeps showing up as an exception in IANA’s explanation of how they handle privacy, how they deal with GDPR, etc.

There’s another and potentially bigger question of many registries including email addresses; the position that we have taken is that those addresses are necessary for the public benefit that these registries provide, e.g., by allowing us to reach out to the people who made requests and ask them about their usage. Nevertheless, it was not the purpose of this draft to go into the email question, and if any change were to be made there, it should probably apply more broadly than the TRIP registry. And be in another draft :-)

Hope this clarifies,

Jari