2024‐12‐13 Minutes - openid/death-and-the-digital-estate GitHub Wiki

2024-12-13 Agenda

Welcome and antitrust policy reminder
Meeting notes
- Note taker? (Eve / Mike taking notes, so blame them for omissions)

Attendees
- Dean H. Saxe (Beyond Identity)
- Sean Miller (RSA)
- Mike Kiser (SailPoint)
- Eve Maler (Venn Factory)
- Ian Glazer (Man About Town)
- Tom Sato
- Debbie Mac
- Victor Lu
- Grace Klutke
- Lorrayne Auld
- George Fletcher

Agenda bashing
Update on the state of our GitHub Repo & migration to OIDF control
- Wiki
  - We need help to build/organize the GitHub wiki
  - Contact a chair to get access / contribute / with questions
DADE CG meetings update
- Second meeting time added to provide an APAC friendly option. Wednesday at 11 PM GMT (10:00 EAT / 08:00 JST / 00:00 CET / 6 PM EDT / 3 PM PDT) starting January 8, 2025
- Meetings will alternate every other week
- We'll monitor feedback and adjust meeting times further, if needed
Recent Updates / Stream Notes from this Meeting
- Dean created a folder and template for adding processes for defining legacy contacts
  - Added multiple processes - Apple, GitHub, Facebook, LinkedIn, Google Workspaces, 1Password
    - Dean states that the process is different for almost every provider
    - Previous experience is informative - LinkedIn account for Vittorio, for instance
    - Google Workspace - no mechanism for a legacy contact, but can make someone super admin / billing admin
    - 1Password - no legacy admin assignment, but via the "family setup" there's a way to connect things. Paying through apple app store means that recovery requires payment through the apple store
    - UPSHOT: lots of effort to set everything up to function properly
  - What about verifiable creds for recovery or "death certification?"
  - Eve: systems will vary based on what the architecture is: Apple or others that are hardware-centric will have a different model than, say, github which would be more SaaS based
    - A taxonomy would be an interesting contribution in the Wiki
  - What other orgs might play a role here?
  - What about larger notice / publicity? News outlets, etc?
  - Ian: suggests a whitepaper / how to document published by OpenID or some such? (maybe CISA
    - OIDF is going through the budgeting process (might be a good to put in a placeholder request)
    - Ian volunteers to get the initative started via funding, etc from a board perspective
    - Also added to the request are PR/ media-related initiatives
  - Please add additional services as pull requests. Having this information will help the CG deliver educational materials.
DADE CG deliverables
- Document the current state of the art for managing individual choices for handling individuals’ digital estates.
  - In progress
  - Currently very US-centric, we need more data from non-US services
    - Sean perhaps to contribute (similar) things from the great North (Canada)
    - Kiser to potentially pull in EMEA / Spain background
- Develop educational information to raise awareness of the challenge and empowering individuals to assert control over their digital legacies
  - OIDF materials for Cyber Security Awareness Month (October 2025) https://github.com/openid/death-and-the-digital-estate/issues/23
    - Add feedback to the issue to determine what materials can be delivered.
    - Continue legacy contacts on popular platforms work as started in Issue 18
    - Dean: please contribute ideas to what might be possible for October- planning ahead is helpful, and will be useful in getting other orgs involved
- Document individuals' experiences with handling the digital estates of others
  - Seeking volunteers willing to document experiences
  - If anonymity is needed, contact the co-chairs directly to discuss options
  - If sufficient data is collected, it may be added to the Cyber Security Awareness Month materials
  - Dean: we're constantly looking for additional contributions / feedback / use cases
- Document the current state of government regulations
  - No update
  - Grace / Eve may have contacts
  - Eve will reach out to her connections for input (Tim Reiniger, Charisse Castagnoli)
  - Ian: What is the ask here?
    - Contact that helped write the digital trust with the ABA and the legal perspective
    - Dean: we dont' really know what is helpful / needed
    - Ian: caputuring a conversation would be helpful
    - Kiser: will pull in cyber lawyer friend to grant perspective
    - Dean: maybe Jeremy Grant might have thoughts? Or maybe Bill Foster? (might be early, but good to call out)
- Development of use cases
  - Use Cases
- Identify and document use cases that are out of scope for DADE CG
  - No update
  - Kiser: will add a section in the wiki about AI usage and recreation of personas/ identities for family usage (authorized and unauthorized)
    - Then we can think about scope for this developing area
  - Dean: Agentic AI may also be in play - what about these actors "acting on behalf of" if the authorizer is no longer around to "opt in?"
  - Dean: IDPro slack channel incorporates a different set of people / additional context an dinfo
- Develop proposed high level data flows
  - No update
2025 Conferences & DADE
- Dean: talking about doing a panel discussion / update for conferences (particularly Identiverse )
- We'll rip off the identiverse update for use at EIC
- Eve is covering SXSW
- Dean: How to reach out to Gartner?
  - Request a briefing - see what analyst picks it up?
  - Ian will hunt them down and establish communications
    - EIC is a great format - b/c the use cases are different and digital identity is more advanced (eIDAS, etc.)
    - Or China, or India . . .
    - We should ask Adam Cooper / Kristina Yasuda, etc. etc.
    - Victor: I have a background in China - can help with language... (Mandarin)
- George: there's both the aspect of "unexpected loss" but also "incapacitation / agency in handling affairs"
  - How do we tease out those different aspects?
  - Without a statement of intent, it's more difficult than if they're "still around" in some capacity
  - Also impactful is whether or not your relationship is recognized by authorities
Any Other Business