Alberto Siena

GORE focuses on stakeholders and their goals Effective in specifying requirements that satisfy some properties (e.g., cost/benefit trade-off, risk, security, …) and match stakeholders needs

New laws, increased pervasiveness of IS Laws are increasingly source of requirements However law prescriptions are NOT stakeholders goals Stakeholders want goals, whereas law prescriptions are imposed to stakeholders Law prescriptions can contraddict goals

The act adhering to, and demonstrating adherence to, a standard or regulation (wikipedia) Recovery-time Requirements-time Run-time Can be proved here Exists here Is conceived here (adhering to) (demonstrating adherence to) Compliance

Phase of the system (-to-be) Compliance characteristicsCompliance type Requirements- time Distribution of responsibilities, such that, if every actor fulfils its goals, then the compliance is ensured Intentional compliance Run-timeRun-time set of actions and processes that actually represent the legal condition for compliance Actual compliance Recovery-timeProved compliance or set of recovery actions that restore the run-time compliance after a violation has been detected Strong compliance

Framework for systematically go from law prescriptions to requirements. Nomos = A language + a method + a set of properties (e.g., intentional compliance) It allows to Reason about how requirements are generated (select among alternatives) Check properties of requirements models wrt. laws

Properties concern the interaction between goals and laws Needed: languages for modeling The models of G and L must be consistent with each other! Requirements (G): i*Laws (L): Nomos

Hohfelds taxonomy of legal concepts (1913) Milestone in juridical literature Rights are the core concepts Rights are entitlement (not) to perform certain actions or be in certain states, or entitlements that others (not) perform certain actions or be in certain states W. N. Hohfeld. Fundamental Legal Conceptions as Applied in Judicial Reasoning. Yale Law Journal 23(1), 1913.

8 fundamental rights: Privilege, Claim, No-claim, Duty, Power, Liability, Immunity, Disability Opposites and correlatives

A legal text can be subdivided into smaller legal statements, called Normative Propositions (NP) Each NP carries the atomic piece of information about a single right NP =,,, A hard formalization is given by Sartor Maps rights to deontic operators

Health Insurance Portability and Accountability Act (HIPAA), art. § (a): A CE may not use or disclose PHI NP = (CE, Individual, claim, Dont disclose PHI)

HIPAA, art. § : (a) A CE may not use or disclose PHI, except as permitted or required by this subpart [...] (1) A covered entity is permitted to use or disclose PHI [...] (i) To the individual; […] (2) A CE is required to disclose PHI: (i) To an individual, when requested [...]; and (ii) When required by the Secretary.

To deal with: conditions, exceptions, etc., that exist in law texts Relative approach rather than absolute approach

Building block for aggregate (intentional) compliance Uses the realization relation between goal and NP Changes according to the nature of the right

Many compliance alternatives Many compliance preferences Many compliance degrees Many compliance alternatives Many compliance preferences Many compliance degrees

1. Bind domain stakeholders with subjects addressed by law 2. Identify legal alternatives 3. Select the normative proposition to realize 4. Identify potential realizations of normative propositions 5. Identify legal risks 6. Identify proof artifacts 7. Constrain delegation of goals to other actors

Traceability Documentability Legal risk identifiability Protected across organizational interactions (delegations)

W. N. Hohfeld. Fundamental Legal Conceptions as Applied in Judicial Reasoning. Yale Law Journal 23(1), Giovanni Sartor. Fundamental legal concepts: A formal and teleological characterisation. Articial Intelligence and Law, 14(1-2):101–142, April Alberto Siena, John Mylopoulos, Anna Perini, and Angelo Susi. The Nomos framework: Modelling requirements compliant with laws. Technical Report TR-0209-SMSP, FBK – Irst, SMSP.pdf, SMSP.pdf