Unabhängiges Landeszentrum für Datenschutz Schleswig-Holstein

Holstenstr. 98 Kiel 24103 Schleswig-Holstein Germany +49-431-988-1220 +49-431-988-1223 rfc@ulikoenig.com https://www.datenschutzzentrum.de

Unabhängiges Landeszentrum für Datenschutz Schleswig-Holstein

Holstenstr. 98 Kiel 24103 Schleswig-Holstein Germany +49-431-988-1220 +49-431-988-1223 uld62@datenschutzzentrum.de https://www.datenschutzzentrum.de

Internet Message e-mail Message Privacy Icon Privicons Human Readable Privacy Policies This document proposes a syntax and semantics as an extension of the Internet Message Format (e-mail message) allowing a Sending User of an e-mail message to express his or her preference for how the message content is to be handled by the Receiving Users. For this purpose, semantics of sets of different character combinations ("Privicons") are described. These can syntactically be integrated either in the first-line of the body, in the subject line and/or in a dedicated header of any e-mail message. The Privicons icon set consists of six different icons. They will be machine-readable. The Privicons concept is partly borrowing its approach from the concept of emoticons. For example, to express that the content may be forwarded and even be published. The Sending User could use the Privicon "[>]", which may be followed by an additional explanations, such as "please share".

Privicons describe a vocabulary of icons as an extension of the Internet Message Format (e-mail message) for users to indicate how their e-mail message should be treated. The icons are based on ASCII symbols so that they can appear as embedded graphics or plain text and include a variety of instructions such as "don't print," "internal use only," and "confidential". It is partly borrowing its approach from the concept of emoticons. For example to express, that the content can be forwarded and even be published, the Sending User could use the Privicon "[>]", which may be followed by an additional explanations, such as "please share". This document proposes a syntax and semantics allowing a Sending User of an e-mail message to express his or her preference for how the e-mail message content should be handled by the Receiving Users. For this purpose, semantics of sets of different character combinations ("Privicons") are described. These can syntactically be integrated either in the first-line of the body, in the subject line and/or in a dedicated header of any e-mail message. The Privicons icon set has six different icons. They will be machine-readable. Importantly, the user can override all requests transmitted by Privicons: The approach is grounded in reminder over hard-coded solutions that indiscriminately restrict speech. Therefore, the icons are merely asking the Receiving User of an e-mail to follow the Sending User's preference. Other than DRM oriented approaches, Privicons embraces the concept of code-based norms approach. This means, that the approach relies on social norms to be followed by the Receiving User, rather than technical enforcement mechanisms. However, technical means may be used to support this (for example, specifications see example e-mail message). Note: The specific character combinations for each Privicon is currently undergoing user testing, it therefore might and will most certainly change during the progression of this draft.

This specification extends - Internet Message Format by defining certain syntax for the first-line(s) of the body, the subject line and an additional header field.

The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in . The term "User Agent" (often also Mail User Agent, UA, MUA) is used as defined in Section-2.3.3 in The terms "Sending User" and "Receiving User" are related to a user using the User Agent either sending or receiving an e-mail message. A Sending User is a user that sends an e-mail message to a Receiving User. A Receiving User is a user that receives an e-mail message from a Sending User. The term "Line" is used as defined by SMTP Section-2.3.8 in thereof The term "full-date" is used as defined by Section-5.6 in . The term Privacy Preference describes the intention the user had when she has sent a specific e-mail message. It can be expressed with the Privicons described in this RFC.

In this section, the syntax if the Privicon e-mail extension is defined. For semantics, please see next section. A User can indicate a Privacy Preference as lined out below in the following ways: by making available selection of the Privicons, which SHOULD be provided by the user agent, by inserting a Privicon in the subject line - by inserting a Privicon in the first-line of the body. An e-mail message fully compliant with this RFC will be called a Privicon Message, it MUST contain a header with Privacy Preferences, SHOULD contain subject with Privicon, SHOULD have first-line and footer and MAY generate an HTML version. The following section describes how the Privicon status of an e-mail message is determined, concerning the privacy preferences described in Overview

Elements separated by a bar ("|") are alternatives, e.g., "yes | no" will accept yes or no. Quotation marks surround literal text. Unless stated otherwise, the text is case-insensitive. " " Some arbitrary text. Will be substituted by a "full-date", . = ("[X]"|"[/]"|"[=]"|"[=0]"|"[=I]"|"[=date]"|"[-]"|"[o]"|"[>]") - the Privicon token. It contains all valid Privicons, the Privicon icon set. I will be substituted by an integer number >= 0. Contains the description of the Privicon as defined in Semantics. Is the e-mail message subject field, see . Is the carriage return/line feed pair written in this document as "CRLF". A line is a series of characters that is delimited with the two characters carriage-return and line-feed; that is, the carriage return (CR) character (ASCII value 13) followed immediately by the line feed (LF) character (ASCII value 10), as described in section2.1 in

An indication of the Privacy Preference can be given in the first line of the body of an e-mail message. The expression MUST be followed by a text giving a short explanation the meaning of the expressions. It is RECOMMENDED to use the following text, although localization into other languages is also encouraged, albeit not lined out in this document. = privicon whitespace "-" whitespace description For example: [X] - Keep private [/] - Don't print [=] - Delete after reading [=0] - Delete after reading [=I] - Delete after I days [=date] - Delete on date [-] - No attribution [o] - Keep internal [>] - Please share After the first-line, a second line, with an additional privacy preference may follow if the combination is permitted.

An indication of the Privacy Preference can be given in the beginning of a subject line of an e-mail message using the following expression: privicon whitespace subject or whatever whitespace privicon whitespace subject For example: [X] This is the subject of the e-mail message [/] This is the subject of the e-mail message [=] This is the subject of the e-mail message [=4] This is the subject of the e-mail message [=1980-01-01] This is the subject of the e-mail message [-] This is the subject of the e-mail message [o] This is the subject of the e-mail message [>] This is the subject of the e-mail message or Re: [X] This is the subject of the e-mail message Fwd: [/] This is the subject of the e-mail message

An indication of the Privacy Preference MAY be given in the header of an e-mail message, for this purpose the following field is defined, extending in section 3.6 in the field definition, thereof. = "Privicon:" whitespace privicon CRLF The possible values of the Privicon token are described in Definitions

Separated by -- The Footer MAY be located within the signature as described in section 4.3 in . It contains a paragraph that describes what the Sending User of the e-mail message intended when she chooses the selected Privicon. A clarification MAY be added that a conflict between header and first-line would lead to the first-line to be authoritative. = CRLF "-- " CRLF footertext = firstLine CRLF description For example: -- [X] - Keep private The "Keep secret" Privicon asks the Receiving User to keep the received e-mail message secret. Note: Footnote may violates Page4 - do not use more than 4 lines signature. The Footnote is just informative not authoritative

When parsed, the authoritative order of the different elements is as follows: first-line in body subject header If only one Privicon is found, it has always the same meaning, no matter if it is defined in first-line in body, subject or header.

After syntax error, the most restrictive case is assumed. For example "Delete after ??? days" will be transformed into "Delete immediately")

In HTML-Messages, the “Privicon” are OPTIONAL represented with graphical icons. Example icons can be found in Annex. Embedded icons MUST be included into the Message and MUST NOT be loaded from an Internet Server. This is important avoid a loss of privacy for the receiving user. It also causes in some cases problems with SSL-Encryption in web based e-mail message user agents (MUA). The graphical representation MUST contain the ASCII-Icon as Alternate-Text. If the "Privicon" is included in the First Line of Body, the “description” MUST also be displayed in next to the Privicon.

The Privicons icon set has six different icons. The meaning of the icons will be described in this section. It is important, that Privicons always just meant to be a nice way of asking somebody to do something.

The "Keep private" Privicon asks the Receiving User to keep the received e-mail message private.

The "Don't print" Privicon asks the Receiving User to not print the received e-mail message.

The "Delete after reading/I days" Privicon asks the Receiving User to delete the e-mail message no later than a specified period. There are four different cases: [=] delete after reading [=0] delete after reading [=I] delete after I days [=date] delete on date "I" and "date" are defined in Terminology and Conventions.

The "No attribution" Privicon asks the Receiving User to not attribute, name or mention the original Sending User of the e-mail message in any kind. At the same time the Receiving User may quote, follow or paraphrase the content, facts and opinions voiced in the original e-mail message. In other words, the Receiving User is free to use the information received, but neither the identity nor the affiliation of the Sending User may be revealed.

The "Keep internal" Privicon asks the Receiving User to present this e-mail message only to those people that are common friends, or otherwise part of a group of people are in a relation to both the Sending User and the Receiving User. Note that the judgement, whether a person belongs to this group is solely upon the Receiving User unless otherwise indicated by the Sending User. The "Keep internal" just indicates, that a Receiving User SHOULD give some further thought on which she is sending the e-mail message to, and that the Sending User does not want the e-mail message to be forwarded arbitrarily.

The "Please share" Privicon asks the Receiving User to share this e-mail message with everyone, as she likes. It may be supplemented by further instructions on licensing for clarifying the copyright status.

Y N X As secondary option, potentially, and if first preference is overruled: [X] [/] [=] [-] [o] [>] [X] X Y Y N N N [/] Y X Y Y Y Y [=] Y Y X Y Y N [-] N Y Y X Y Y [o] N N Y Y X N [>] N Y N Y N X

This document introduces a new field in the e-mail header, as described in the header section.

The extensions to the e-mail message Format described in this document does not change the fundamental nature of the SMTP service and hence does not create any new security exposures in and of itself.

In alphabetical order: Andreas M. Brændhaugen, Designer, San Francisco Laurent Bussard, European Microsoft Innovation Center Ryan Calo, Stanford University Alissa Cooper, Oxford Internet Institute Ethan Forrest, Stanford University Marit Hansen, Unabhängiges Landeszentrum für Datenschutz Schleswig-Holstein Alexey Melnikov, Isode Ulrich Pinsdorf, European Microsoft Innovation Center Thomas Rössler, W3C Max Senges, Google Inc. Hannes Tschofenig, Nokia Siemens Networks

This is an example Privicon e-mail message.

Date: Mon, 05 Jul 2010 23:59:00 +0200 From: Ulrich Koenig To: Jan Schallaboeck Subject: [>] last update for Privicons RFC Privicon: [>] Content-Type: text/plain; charset=ISO-8859-15 Content-Transfer-Encoding: quoted-printable [>] Please share Hey Jan, please check the IETF Website for our Privicons RFC! ;) best Ulrich --=20 [>] Please share The "Please share" Privicon asks the Receiving User to share this e-mail message with everyone she likes.]]>

This section gives developers of e-mail message user agents (MUA) or plug-ins for MUAs instructions how to integrate the Privicons in the client. An MUA implementing this RFC MUST enable the user at any time to overrule the received Privicon. The user SHOULD also be able to set a default for always overruling in her client. The rest of the instructions in this section are OPTIONAL. If the user agent displays an e-mail message that contains one or more Privicons it SHOULD display the icon and its meaning in a salient way. If the icon is displayed by the user agent it MAY hide the Privicon in Subject and Body of the e-mail message. The user agent MAY localise the explaining text.

A confirm pop-up or any other visible notion that yields active interaction by the user (i.e. clicking a button). The user SHOULD be able to disable a part or all confirmations. A pop-up, or any other visible notion, that SHOULD yield confirmation. Such notification SHOULD be enabled by default. The user SHOULD be able to disable the notification by default.

The "Keep private" Privicon asks the Receiving User to keep the received e-mail message secret.

If the Receiving User wants to forward or reply-to the e-mail message to a third person, that is not the original Sending User, than the Receiving User MUST be informed, that she is going to violate the included Privicon and she MUST confirm that she is willing to do this before the e-mail message is sent. OPTIONAL: Transparency applies.

If the Receiving User wants to print the e-mail message, she MUST be informed that she is going to violate the included Privicon and she MUST confirm that she is willing to do this before printing is started.

If the Receiving User closes the e-mail message, she MUST be informed, that the e-mail message SHOULD be deleted after X days. The user MUST confirm whenever she closes the e-mail message, hat the e-mail message is deleted immediately. The client SHOULD enable the user to choose a default option. Note: if e-mail messages are displayed in list mode, then the confirmation will be raised, when opening the next e-mail message.

The above confirmation MUST ask the user, whether ignore, do not decide now, ask me again next time, delete or move into a "to be deleted" folder, as indicated in the preferences or ask again after a specified period.

The above confirmation MUST ask the user, whether ignore, do not decide now, ask me again next time, delete now, delete after X days automatically or ask me in X days.

The above confirmation MUST ask the user, whether ignore, do not decide now, ask me again next time, delete now, delete on date automatically or ask me on date.

If the Receiving User wants to forward or reply to a third person or store the e-mail message, she MUST be informed, that the Sending User doesn't want to be mentioned and MUST confirm that she is willing to overrule the Sending Users wish or remove any occurrence of the Sending User in the e-mail message (Header and Body). The removal of the Sending User MAY be done by the user agent automatically. OPTIONAL: Transparency applies.

If the Receiving User has defined what "internal" means to her, the following rules in the "Keep internal" subsection only apply if at least one of the Receiving Users are not part of her internal definition. If the Receiving User wants to forward or reply the e-mail message to a third person, the user MUST be informed that she SHOULD check if the third person is really part of the group that the Sending User intended to be internal and MUST confirm that she really to send this e-mail message. OPTIONAL: Transparency applies.

The client SHOULD notice the user, that the content of the e-mail message can be published. If the Sending User has transmitted a license for publishing the content, it SHOULD also be displayed.

Note this may be for further versions, but might yield legal implications: Before opening the e-mail message containing a Privicon, the User Agent SHOULD inform the user what the user is asked to do with the option to reject the e-mail message. To reject an e-mail message means the Sending User is notified, that the e-mail message is rejected and has been deleted at User Agent's side before reading. Not to reject the e-mail message does not mean, that the receiving user accepts the requested conditions, see .

If a Receiving User forwards or replies an e-mail message containing a Privicon to a third person, the original Sending User OPTIONAL get a copy via carbon copy or a blind carbon copy by default. The Receiving User MUST be able overrule this. She also SHOULD be able to disable the default sending of a copy in the user preferences.

There is a graphical representation of the Privicons, that MAY be used by MUAs, see Figure.