Trust & Identity Strategy Update GÉANT General Assembly, October 2015

Overview Background The Elaborated Strategy Progress update On going and anticipated work

Background Proposal to establish a strategic committee on Trust & Identity in October 2013 at the Zurich NREN PC Trust & Identity Committee (TIC) formed in March 2014 at the Lisbon NREN PC Andreas Dudler (SWITCH), Valentino Cavalli (GEANT), Josh Howlett (Jisc & Chair), Floor Jas (SURFnet), Valter Nordh (SUNET); with invaluable support from Linda Mesch (GEANT) A “high-level” strategy was approved, setting out strategic goals to Harmonise our national Trust & Identity initiatives Operate Trust & Identity systems for global research & education Facilitate open global cross-sector systems for Trust & Identity

Elaborated strategy The “high level” strategy sets out some key goals but provides little guidance as to how these could be achieved The “Elaborated strategy” complements the high-level strategy by pointing in some key directions where focus is needed The Elaborated Strategy was originally intended to have been approved by the NREN PC in Q1 2015, but events have prevented that

Progress update Following the approval of the “high-level” strategy, the development of the “Elaborated strategy” has: Provided direction & text for the FPA and GEANT Strategy 2020 Influenced the preparation of AARC and SGA2 whitepaper by leading the proposals towards specific areas of focus, and review and input from TIC Framed our engagement with Internet2’s TIER initiative at the EU level Provided a space allowing us to begin to strategise at the EU level on matters of significance in the area At no cost to the community

On going and anticipated work It will take some time for the strategy to “bite”; in the meantime we anticipate tracking the progress of its implementation We will act where needed to maintain and build momentum, in collaboration with the relevant community initiatives (e.g. REFEDS) Engagement with Internet2 TIER most likely to move to the operational level, with input from TIC where needed Engage in discussions on governance and funding to promote sustainability of services and products that are often dependent on a subset of their users e.g., GEANT eduGAIN is used globally but funded exclusively by EC/NRENs e.g., Shibboleth is used globally, and extensively within Europe, but funded primarily by Jisc & Internet2 e.g., REFEDS has participation from NRENs and Industry globally, but funded by a small number of organisations Contribute towards increasing the profile of the NRENs’ work among key external stakeholders e.g., EC, research e-Infrastructures, Industry, service providers, etc. Since the NRENPC ceased to exist, the TIC has defaulted to a European collaboration of NRENs

An academic or student at almost any British university these days benefits from a federated identity management system run by their university. These systems in turn comply with open standards and benefit from technical and contractual mediation performed by organisations such as the UK Access Management Federation. This global infrastructure allows users to do everything in the federated world that they can do in the walled gardens of Facebook or Google. For example, they can access a myriad of services via a single user name and password and work and chat together in real time. As with the internet itself, federated identity management is a technology that has been pioneered by the academic and research world but is open to any organisation to use. The ECJ’s ruling therefore threatens nothing except the colonising approach favoured by the Silicon Valley giants. Small companies such as mine that take personal data seriously and already comply with national legislation around the world look forward to competing with Big Tech on a level playing field. William Cullerne Bown Director, *Research London EC2, UK Sir, The FT’s editorial raises the prospect of a Balkanised internet in your editorial on the European Court of Justice’s Safe Harbour ruling (“Europe’s costly judgment on data protection”, October 7) and suggests it is smaller firms that will suffer. As one of the smaller firms affected, I suggest you take a closer look at the technologies involved. There are two ways of managing identity and associated personal data in a cloud environment: centralised and federated. Centralised is the way that Silicon Valley does it. Federated is the way that the academic and research world does it. Centralised takes all the data and holds it in one database. Federated leaves nearly all the data in the home organisation and moves around only the minimum that is needed for the services that are actually wanted by the user. Centralised confers great power and wealth on the company at the centre. Federated has no centre. Centralised raises all the problems around personal data that the ECJ highlighted. Federated avoids them. A letter to the Financial Times (12 October 2015) illustrating the growing societal significance of Trust & Identity