# Presentation: 689821

## XML & E-Government

- Public, Open, and Proprietary XML Initiatives Relevant To S. 803
- Simon Y. Blackwell
- CTO, Psoom, Inc.
- Chairperson OASIS XACML TC

## S. 803

- “... a broad framework of measures that require using Internet-based information technology to enhance citizen access to Government information and services ... “

## This Presentation

- Summary level XML initiatives relevant to S. 803
- All of S. 803 + what seems to be missing
- Not a detailed discussion of the pro’s and con’s of various approaches

## Definitions

- Public – Multi-entity initiatives to create generally unencumbered specifications, e.g. IETF, W3C, OASIS
- Open – Single entity reasonably unencumbered specifications, e.g. Sun’s Java, ContentGuard’s XrML
- Proprietary – Single entity, encumbered specifications, e.g. Hailstorm

## Issues

- Efficiency
- Interoperability
- Data Protection

## Efficiency

- Taxonomies, directories and catalogs are mandated by S. 803.
- Defining ontologies, taxonomies, and vocabularies is hard, time consuming work.
- XML supports the creation of focused, reusable subsets by experts in specific areas.
- Government agencies are remarkably absent from Internet standards specification efforts.

## CIQ - Efficiency

- CIQ
- Customer Information Quality
- OASIS
- Sub-specifications
- xNL eXtensible Name Language
- xAL eXtensible Address Language
- xNAL eXtensible Name & Address Language
- xCIL eXtensible Customer Information Language

## CIQ - Efficiency

- Capable of representing:
- Name and address,birth, age, gender, marital status, nationality, occupation, passport info, religion, telephone, vehicle info, etc.
- A customer data standard is not specifically mandated.
- Compliance with Section 207 mandates for integration would be greatly simplified by CIQ use, particularly if SSN or other unique id legislation is not broadened even further.
- Useful data model even if not used for integration.

## GML - Efficiency

- GML
- Geography Markup Language
- OpenGIS.org
- Common geographic representation standards are mandated by Section 209

## GML – Efficiency

- Participants include, but not limited to:
- Oracle
- MapInfo
- U.S. Census Bureau

## Efficiency

- Section 207 supports
- pilot projects to “assist the public, including the regulated community, in electronically submitting information to agencies under Federal requirements”
- “improving the quality and integrity of the data” submitted
- Participation in and promulgation of XML specification efforts will support this end

## Interoperability

- Section 103 makes the CIO Council responsible for standards and guidelines for interoperability, categorizing, enhanced search, security, etc.
- Section 201 seeks inventory
- Section 207 encourages integrated collection and management of data and interoperability

## Interoperability

- Multiple open specification bodies are working to ensure their works are interoperable at the protocol and grammar level.
- IETF Internet Protocols
- W3C Web Standards and Protocols
- OASIS Structured Information Standards

## Interoperability

- Multiple vertical specification bodies are also working independently causing some fragmentation but accelerating the work in their areas of focus.
- LegalXML
- HR-XML
- XNS.ORG
- CPExchange

## Interoperability

- Increasing Focus On Coherent Standards
- X2XML
- XML to XML Mapping Index
- Cross-body co-ordination
- AAArch (IETF), XKML (W3C), SAML (W3C/OASIS), XACML (OASIS)
- RDF, UDDI, ebXML, BOD
- Designing and implementing for data and transactional interoperability

## RDF - Interoperability

- RDF is intended to provide:
- interoperability of metadata
- machine understandable semantics for metadata
- better precision in resource discovery than full text search
- future-proofing applications as schemas evolve
- a uniform query capability for resource discovery
- a processing rules language for automated decision-making about Web resources
- language for retrieving metadata from third parties

## RDF - Interoperability

- Theoretical benefits are high
- Practical short-term benefits beyond the Dublin Core are costly since development requires high levels of abstraction and thinking outside one’s own usage needs
- RDF and other mechanisms provide a potentially uniform means of providing a continuous inventory. Uniform RDF or other schema would need to be mandated prior to inventory.

## Data Protection

- Section 207 “... enable any person to integrate and obtain similar information held by 1 or more agencies under 1 or more Federal requirements without violating the privacy rights of individuals ...”
- Section 218 Privacy Provisions requires statements and impact assessments

## Data Protection

- Encryption
- Authentication – XKMS, SAML
- Policy Expression & Enforcement – P3P, XACML

## XKMS – Data Protection

- Certificate management authority to ensure agency interoperability is mandated by Section 202.

## SAML – Data Protection

- Security Assertion Markup Language
- Required for interoperating servers across domains or sub-domains in order to standardize and simplify authentication and authorization processing

## SAML – Data Protection

- Participants include, but not limited to:
- Baltimore Technologies
- CrossLogix
- HP
- IBM
- Tivoli
- Sun
- University of Washington
- Verisign

## P3P – Data Protection

- Platform for Privacy Preferences – Consumer Oriented
- Machine readable website statements of policy regarding the collection, intended use, and disclosure of a standard set of data elements along the data subject’s capability to opt-in, opt-out or dispute data usage and values.
- Not specifically named; however, the functionality is mandated except where not practical ...

## P3P – Data Protection

- Only real specification driven by the providers of web sites.
- Can be complex to implement
- Informed consent – too informed! Can cause excessive and irritating consumer interaction leading consumers to accept less privacy

## P3P – Data Protection

- Several consumer tools
- ZeroKnowledge
- YOUPowered
- Manages P3P checking + data transfer + anonymizing
- Low levels of acceptance percentage wise

## P3P – Data Protection

- Participants include, but not limited to:
- AT&T
- Citigroup
- AOL
- Microsoft
- IBM
- Truste
- Hewlett Packard
- NCR
- NEC
- Direct Marketing Association

## XACML – Data Protection

- eXtensible Access Control Markup Language
- Conceived to support the separation of policy from applications, data bases, and operating systems.
- Usage oriented doesn’t drive policy regarding collection or disclosure.

## XACML – Data Protection

- Facilitates
- more flexible systems
- policy enforcement in heterogeneous, distributed environments
- granular control
- Introspection
- attach to anything that can be referenced from XML
- controls data and procedure access
- more approachable policy management

## XACML – Data Protection

- Participants include, but not limited to:
- Sun
- IBM
- Verisign
- Hewlett Packard
- Netegrity
- Cisco
- University Of Milan

## Data Exchange & Policy Management Systems

- Single sign-on, identity management, preference management, data transfer and management
- Two Examples, Not Necessarily Only Systems
- XNS – eXtensible Name Service
- Hailstorm
- Consumer Opinion Vs. Consumer Behavior

## Data Exchange & Policy Management Systems

- Data
- Policy
- Centralized vs. Distributed
- Accuracy vs. Latency
- Control and Co-option

## XNS – Data Exchange & Policy Management Systems

- Open But Not Public Specification, XNS.ORG and OneName
- A common protocol, addressing system, and infrastructure for trusted information exchange and synchronization between any two devices on the wired or wireless Internet.

## XNS – Data Exchange & Policy Management Systems

- Decentralized data and policy managed by independent bodies analogous to certificate authorities
- Professed desire to work with IETF, W3C, and OASIS standards

## XNS – Data Exchange & Policy Management Systems

- Claims to support naming & addressing, XML vocabulary, XML protocol, legal & operational infrastructure, development platform, agent linking. Only one other organization claims to support all of these – Microsoft ...

## XNS – Data Exchange & Policy Management Systems

- Pre-dates Microsoft initiatives
- Slow moving, attempting to address this by becoming open
- Patent claims were previously presented as an obstacle to W3C and P3P

## Hailstorm – Data Exchange & Policy Management Systems

- Proprietary Specification - Currently precluded by Section 215, no proprietary systems allowed without a waiver
- Centralized data and policy
- Re-usable component standards, e.g. SOAP, XML + proprietary specifications or extensions

## Hailstorm – Data Exchange & Policy Management Systems

- Various presumably XML formatted components:
- myAddress
- myProfile
- myCalendar
- myWallet, etc.
- Duplicates standard formats being developed by others, e.g. CIQ work

## Hailstorm – Data Exchange & Policy Management Systems

- Ten’s of millions of e-mail addresses that are globally unique. Passport can handle, but how are the issuers involved
- Organized around Passport, contents controlled by Microsoft
- Microsoft controls issuing of Passport

## S. 803 What’s Missing

- “E-nabling” public participation
- Mandating standards for quality of service beyond search results
- design consistency
- availability

## Public Participation

- EML
- Election Markup Language
- OASIS
- No current government participation noted. Industry participants include: Baltimore Technologies, Microsoft, Accenture, Unisys, Cisco

## Public Participation

- Any aspect of providing election or voter services to public or private organizations. The services performed for such elections include but are not limited to:
- voter role/membership maintenance
- citizen/membership credentialing
- Redistricting
- requests for absentee/expatriate ballots
- election calendaring,
- ballot delivery and tabulation
- election results reporting and demographics

## Design - Quality Of Service

- Section 102 discusses integrated service delivery, the “provision of Internet-based Federal Government information or services according to function rather that separated according to the boundaries of agency jurisdiction”
- Additional areas discuss integrated websites and directories while others clearly discuss separate websites, e.g. judiciary.

## Design - Quality Of Service

- Interoperability won’t succeed without a common user interface design metaphor. A common design also conserves resources.
- Only one line is dedicated to ensuring standard navigational methods and design is more than navigation.
- A consistent adequate, but perhaps sub-optimal design across sites is more optimal that lots of optimal designs within sites.

## Availability – Quality of Service

- Government sites are frequently slow and unavailable
- Slow or unavailable sites do not get repeat visitors

## Miscellaneous Comments

- Judiciary: Ilumin, LegalXML
- Directories: XDML
- Suggested reading: Database Nation
- S. 803 – A sometimes odd combination of detail and abstraction that is nevertheless needed to facilitate more effective government in the 21st Century