Policy-Discussion

[Evaldo Gardenali <evaldo AT gardenali.biz>]

One could mail the ones that were assured by said person and ask them to 
get more assurances as they are going to lose said points soon, and then 
they can replace the "grey" points with good ones.

Evaldo

Ian G escreveu:
> Teus Hagen wrote:
> > What follows is a cut/paste of an email exchange I had with someone (a
> > CAcert Assurer) who reported that his Assurance Form archive was stolen
> > (from his parked car).
> >
> > Question: is there any policy rule on this?
>
>
> I'm unsure of the precise question here, but maybe that's 
> part of the question :)
>
>
>
> Past policy was that on request from CAcert, an Assurer 
> should send forms to CAcert.  That's slowly being modified 
> to "on request, Assurer does what an Arbitrator directs, 
> including sending the forms in."
>
> The question seems to be, does the absence of forms in any 
> material way impact the *quality* of the past Assurance and 
> the overall Web of Trust?
>
> One could say, no, the theft / loss had nothing to do with 
> any Assurance.  Therefore low risk.
>
> But, how can one be sure?  A valid attack would be to slip 
> an assurance through with false doco, then steal the forms 
> to hide the trail after the points have been issued.
>
> So a valid defence would be to remove all points so 
> allocated.  Which might be no bad thing as many people will 
> be "in the spirit" and will have (a) enough points and (b) 
> enough capability to get future points, or (c) will not be 
> using the system much anyway.
>
> At the margin there will be some caught in the net.  They'll 
> be unhappy.
>
> These are tricky issues.  Is it possible to write a policy 
> that tells what to do here?  Or should this simply be a 
> filed dispute, against self, that asks the Arb to look at 
> the facts and give a ruling?
>
>
> > Problem: (part of) archive of assuree's forms got stolen from Assurer.
> >
> > My suggested policy: make a report of stolen Assuree's forms (can be
> > collected and traced by the Assurer from his "trust points list".
>
>
> OK, would seem reasonable.
>
>
> > This
> > can be done via signed email. If you want to include scanned copy police
> > report. This is merely a proof that Assurer has taken proper actions.
>
>
> I would say that "include any supporting doco."
>
> Is a police report helpful here?  Firstly, we are in the 
> business of trusting our Assurers, so we want their word to 
> be good enough.  Secondly, we want them to act fast, not 
> wait until some bureaucrat gets some bothersome report typed 
>   up and signed by some other bureaucrat ....
>
>
> > Assurer should have proof of theft (police report) and Assurer should
> > keep that police report as well copy of email with traces of those
> > stolen forms.
> >
> > So if a check of assuree's forms is needed at some point in the future
> > there is a track record why they are missing.
>
>
> Personally, I'd wonder what if there is a problem with just 
> killing the points?  Make the Web of Trust work for us! 
> Send out a tiger team of Assurers to find and assure the 
> secondary victims :)
>
>
> > This type of policy should be included (if not done already) in the
> > policy rules.
> >
> > Web of Trust of CAcert shows here it's strong points.
> >
> > This is my suggestion of action in this case.
>
>
> It's definately a good question for a FAQ!
>
>
> iang
> _______________________________________________
> Have you subscribed to our RSS News Feed yet?
>
> CAcert-Policy mailing list
> CAcert-Policy AT lists.cacert.org
> http://lists.cacert.org/cgi-bin/mailman/listinfo/cacert-policy