Metadata Distribution Subcommittee of TAC

["Cantor, Scott" <>]

On 10/4/13 10:39 AM, "Ian Young" 
<>
 wrote:
>
>The other thing it's probably worth doing, both in the OSU and MCNC cases
>but also in any survey, is asking people not only whether they have such
>a policy in place but whether there would be any *consequences* to
>allowing that policy to apply to an arbitrary SP which didn't happen to
>belong to an InCommon member.  In other words, to what extent membership
>of InCommon actually makes a difference to the attributes you're prepared
>to release.

In our case, it was a way of getting Registrar approval for release of
directory information. The section 9 requirements made it simpler for me
to make the case. In practice, our registrar has essentially mailed it in
at this point, he seems to have ceded policy control over student data to
a lunatic in my department that runs our risk management area and fails
basic information theory 101.

Since it's directory information, it's by definition public, and I am
likely to open the policy up when the times comes. We do not release
anything non-directory at this time by default, not even affiliation.

>The more privacy-sensitive IdPs over here don't tend to release much to
>all comers at all, but I'm interested to know whether that's behaviour
>spurred by the EU regulatory environment or something more general.

I didn't do it lightly, but the fact is that either I do it or Google
does. You can't fight a war over privacy if you don't even have a soldier
on the battlefield.

-- Scott

Attachment: smime.p7s
Description: S/MIME cryptographic signature