Harrison_Tang: By the way will do you want to take it this time or you want me to do it. ✪

Harrison_Tang: All right I'll I'll uh lead the meeting this time. ✪

Harrison_Tang: All right so uh hello everyone uh to uh this week's w3c meeting um. ✪

Harrison_Tang: From Adobe to present the latest developments on. ✪

Harrison_Tang: Before we get there um just want to quickly go through a couple agenda items uh first of all just a quick reminder on the cola ethics and professional conduct reminder uh just want to make sure that everyone makes respectful comments I think we've been doing that for years uh haven't had an issue uh but uh it's always good to start the meeting with a quick reminder. ✪

Harrison_Tang: Another quick reminder on the intellectual property note. ✪

Harrison_Tang: anyone can. ✪

Harrison_Tang: A steps of contrib. ✪

Harrison_Tang: Ions to any. ✪

Harrison_Tang: Species you work. ✪

Harrison_Tang: Must be member. ✪

Harrison_Tang: Of the she. ✪

Harrison_Tang: With 4 I. ✪

Harrison_Tang: So if you have any questions in regards to getting a w3c account or signing the community contributor license agreement uh please feel free to pin any of the cultures here. ✪

Harrison_Tang: A quick call note uh these meetings are automatically being uh recorded and also transcribed um we will try to publish these meeting notes in the next 24 hours I think we've been pretty good at that uh but if you actually see any errors in regards to the automatic transcription uh please pin uh please pay me and then I'll try to uh correct it if it's a material error. ✪

Harrison_Tang: I will use uh GT chat to cue the speakers during the call so you can type in Q Plus to add yourself to the queue or cue minus to remove I'll be the moderator. ✪

Harrison_Tang: all right. ✪

Harrison_Tang: Uh a quick moment for the introductions or reintroductions so if you're new to the community or you haven't been active and want to re-engage with the community uh please feel free to uh unmute and just uh introduce yourself. ✪

Harrison_Tang: Write any announcements or reminders. ✪

Harrison_Tang: Funny in place. ✪

Harrison_Tang: Thank you man. ✪

Harrison_Tang: Any other uh announcements or reminders. ✪

Harrison_Tang: By a quick uh preview of what's coming at the ccg so next week uh we actually uh got the CEO of I proof uh to talk about biometric authentication so we're going to switch the topic a little bit away uh know well add a new diverse topic uh a little bit more controversial 1 uh but yeah I got the we got a expert in this field in regards to biometric authentication to talk about that. ✪

Harrison_Tang: and then. ✪

Harrison_Tang: The week after that. ✪

Harrison_Tang: Are going to talk about the lithium and post-quantum verifiable credentials. ✪

Harrison_Tang: and the. ✪

Harrison_Tang: Week after that we're going. ✪

Harrison_Tang: Requirements for Enterprise. ✪

Harrison_Tang: And then uh we will have uh Benjamin to talk about VC test Suite on April 2nd. ✪

Harrison_Tang: All right any other announcements or reminders. ✪

Harrison_Tang: Right I think everyone uh can wait for the main agenda so again uh today we're very excited to have lender and Eric Von Dolby uh I'll let them introduce themselves a little bit but I think lender uh you actually uh were 1 of The Architects for the PDF format so uh. ✪

Harrison_Tang: Obviously you're very very well known figure and then we are very very honored to have you here to talk about uh c2p a coalition for Content prominence and authenticity uh thank you the floor is yours. ✪

Leonard_Rosenthol: Thank you and it's it's good to be back I've uh you know a member of this community for quite a long time although a very quiet 1 so it's always nice to be back and uh as it were see some familiar faces so um let me jump in here I'm gonna sort of set the stage give some background uh and talk about the what we've been doing at the content uh at the Coalition for Content provenance and authenticity the ctpa for a while now uh and then I'm going to let Eric really spend most of the time talking about. ✪

Leonard_Rosenthol: Uh what he's been working on which is identity and a new view that we have on identity. ✪

Leonard_Rosenthol: For this work so I'm going to assume everyone can see uh so I'm going to go ahead and jump in here. ✪

Leonard_Rosenthol: So we're a c2a was founded in 2021 uh as a standards body to focus on developing the technical specifications around content provenance and authenticity again our name uh and so we've been doing this. ✪

Leonard_Rosenthol: For quite a while now we have a partner organization called Cai some of you might be familiar with the content authenticity initiative. ✪

Leonard_Rosenthol: Mentioned them just because sometimes people get them confused you can think of the c2p a as The Architects we Define the standards and do the technical work um at the standards level and the CI is then we think of as the contractors of the builders and that they work on implementations they work on education and Outreach uh around those standards. ✪

Leonard_Rosenthol: Uh a lot of members we are uh at about a hundred members to the ctpa and you can see lots of logos on the screen I certainly won't bore you with those we also have established liaison's uh with the iso Etsy and others so we have tried to coordinate with a lot of other bodies and of course w3c included although those are more informal relationships than formal ones. ✪

Leonard_Rosenthol: We focus on Excuse Me 3 pillars provenance which is of course what we're going to talk most about education. ✪

Leonard_Rosenthol: Also policy uh I'm not going to talk really about the other 2 we're going to talk about provenance and how that applies we also do not do detection uh detection is an arms race uh the better your detector gets the better people try to get better at beating it uh so we don't want to go down that path it is better to declare um the truth the history the origin of content than it is to try to guess. ✪

Leonard_Rosenthol: And of course. ✪

Leonard_Rosenthol: Provenance if you're not familiar with the term the who the what the where the when the how and the why so it's all the information you want about a given piece of content. ✪

Leonard_Rosenthol: When we went into this um work we very clearly did not want to reinvent any Wheels uh we did not want to design anything new but instead rely on prior battle tested techniques and that's why we use well-established cryptography and signature technology well-established packaging and serialization Technologies uh and and even identity related pieces that are Eric we'll talk about. ✪

Leonard_Rosenthol: We do not require cloud storage or distributed ledgers or blockchains but we allow for it uh there are a number of implementations out there today that connect content are uh what we call our manifests or our content credentials with clouds and ledgers and blockchains and that's great and we're all in favor of that but the standard itself. ✪

Leonard_Rosenthol: And we need this to work across the history and the life cycle of any type of asset whether that is an image of video and audio a document 3D arvr text we are again agnostic to format as well. ✪

Leonard_Rosenthol: We are so in 2021 we published our first version version 1.0 of the spec we just this year published version 2 so we're currently at version 2 of the course specification that core specification is 1 of 8 documents. ✪

Leonard_Rosenthol: 2 of them are normative 6 of them are informative so we have explainers and we have guidance documents and we have documents discussing security and harms. ✪

Leonard_Rosenthol: As well as our core spec and these are all available online and you're more than welcome to of course please peruse them file issues concerns about them if you have any reach out to us. ✪

Leonard_Rosenthol: Uh so what is this it is a model for storing and accessing cryptographically verifiable and tamper evident information whose trustworthiness can be assessed based on a defined trust model. ✪

Leonard_Rosenthol: Okay what do we mean what we mean is that we have a way to establish this thing called a Content credential that's the the human term technically under the hood we call this a c2p a manifest. ✪

Leonard_Rosenthol: But basically it's a set of assertions to set of. ✪

Leonard_Rosenthol: Pieces of information uh and they could be anything such as Identity or the actions that were taken or ingredients that were used or you know there are um dozens of predefined assertions and there are the the ability to have custom uh information or assertions so you put together all of these assertions that you'd like about a given piece of ass given piece of content. ✪

Leonard_Rosenthol: You then wrap these up in a claim and so all of each assertion is hashed the claim then hashes the entire assertion store. ✪

Leonard_Rosenthol: And describes a bunch of other information such as who is making the claim what is making the claim when is the claim being made and then that is all digitally signed uh by the claim signature so as you hear we have a Merkel tree like approach of hashes of hashes of hashes all wrapped around with that final signature. ✪

Leonard_Rosenthol: Common well understood technology. ✪

Leonard_Rosenthol: 1 of the things that we've added over the last year or so because of what's happening in the world and this should be no surprise is specific functionality related to generative. ✪

Leonard_Rosenthol: Right content to identify itself as having either been created by or participating in Modified by uh generative AI systems uh we do not only generative AI but regular AI all the way from the. ✪

Leonard_Rosenthol: All the way. ✪

Leonard_Rosenthol: Again in this particular case generative AI big big fancy terms people like it it's in the news. ✪

Leonard_Rosenthol: Uh we can establish whether or not or it is established as part of that provenance whether a given asset is created. ✪

Leonard_Rosenthol: Or Modified by Ai and potentially even wear um that took place we allow the establishment of what we call the recipe so not only what was created but how did you get there for example if you used a prompt like in a text image system or you provided a reference image all of that kind of thing could go in there that's the recipe. ✪

Leonard_Rosenthol: And then there's the other side of the coin which is to comply with laws like the European TDM text and data mining law we also support the ability for creators Publishers and others to identify whether or not content can be trained or used for training or not and under what circumstances so complete mechanism for doing all of this and again this is all part of parcel of those assertions that I was talking about previously. ✪

Leonard_Rosenthol: As I mentioned we support a lot of different formats some of the ones this is not a comprehensive list but you can see lots of different image formats video formats audio documents and even fonts themselves uh can have a manifest or content credential associated with it uh you can even do it to plain text or Json or anything can be. ✪

Leonard_Rosenthol: Have a manifest uh if it's not embedded and for that reason you can also store these in file systems clouds dlts you can reference them by URL or HTTP header or the like so very very flexible system as I mentioned allows for clouds allows for dlts doesn't require it um so you can mix and match these pieces in a lot of different ways uh and that's what people have done so far. ✪

Leonard_Rosenthol: Uh this as I mentioned if it wasn't clear the idea is that provenance grows over time so you get a manifest a creation you add another 1 at editing another 1 of publishing Etc and so when the user has finally consuming the content they can see the complete history the complete provenance of that asset. ✪

Leonard_Rosenthol: Uh just briefly the cryptography we today uses based on the same model as the web. ✪

Leonard_Rosenthol: Hashes uh we support a number of them you know certainly the shop family is the most popular we use x509 certificates and again we're modeled after things like browsers PDF Etc things that people know understand under well established. ✪

Leonard_Rosenthol: But at the end of the day trust isn't a yes or no it's not a minority value a human has to make the final decision about whether or not they trust a given asset instead we provide so all of these assertions all of the cryptography all of these pieces represent a series of signals we call Trust signals that a user can view as part of the process and you saw a UI that exists today for showing it. ✪

Leonard_Rosenthol: Not a mandate. ✪

Leonard_Rosenthol: 1 that we. ✪

Leonard_Rosenthol: And the user. ✪

Leonard_Rosenthol: Make the final decision uh and this is necessary because even you take 2 individuals looking at the exact same set of signals and they could make 2 very different decisions uh the example I like to give is uh here in the United States. ✪

Leonard_Rosenthol: If a Take 2 people and you they have a verified piece of content from CNN 1 will say I trust CNN the other will say I don't trust CNN so it has nothing to do with the veracity uh or the provenance of the content it has to do with their trust of the signer and that makes perfect sense and that's as it should be. ✪

Leonard_Rosenthol: 1 of the downsides however provenance is that it can become detached uh unfortunately 1 of the things that a lot of systems today do is they strip uh provenance they strip metadata because they don't know about it it's new it's different um they've never seen it before um and they don't do it on purpose they just strip everything because they assume if it's not the actual image or it's not the actual video don't need it throw it away uh and so the. ✪

Leonard_Rosenthol: It's necessary to also consider how do you connect that provenance to an asset when it has been stripped or detached. ✪

Leonard_Rosenthol: And so we talked about a 3-legged stool in addition to that provenance which is always there we want to connect that with watermarking technology and we want to connect that with fingerprinting technology. ✪

Leonard_Rosenthol: And so we are working right now on a standard that connects open-source as well as closed. ✪

Leonard_Rosenthol: Source commercial approaches the watermarking across various asset types. ✪

Leonard_Rosenthol: And establish standards so that there can be a common way to represent the uh. ✪

Leonard_Rosenthol: Manifest within a word or Mark find it and retrieve it regardless of which approach is used so that's 1 of our biggest efforts right now. ✪

Leonard_Rosenthol: There are lots of implementations of the technology already out there today uh large companies of course you may know of adobe and Microsoft Hardware manufacturers such as Qualcomm Leica has an embedded in their cameras open-source tooling like xif Tool uh and many others uh are out there already implementing this technology uh and many more to come people have announced support including open AI Google and others. ✪

Leonard_Rosenthol: So let me just wrap up and then I'm going to let Eric jump in to give you an idea of where identity fits into this and where we're going because I know that's the most important thing to many of you so as I said we are establishing the core standards to establish provenance in a variety of different um content types including live and streaming content and we are not only working to standardize it ourselves I didn't mention this but we're also working with the iso so that for those countries that require something through a formal uh sdo uh that can also be addressed. ✪

Leonard_Rosenthol: So I'm going to stop here Eric I'm going to go ahead and turn things over to you and then we'll take Q&A at the end. ✪

Leonard_Rosenthol: The screen with an arrow at the bottom toolbar. ✪

Leonard_Rosenthol: No not yet. ✪

Harrison_Tang: You're sharing your screen. ✪

Leonard_Rosenthol: We did and then you switched over to Slack. ✪

Leonard_Rosenthol: Yeah and I think as Eric said I think right now this is the identity work uh is 1 of the you know the highest priorities in our in our area and so getting all of the help that we can get there is is absolutely welcome uh and I think article put them in chat if he gets a chance but uh the the new identity specification that he talked about is publicly viewable and draft format and I know he would absolutely love all us speak for him but would absolutely love all of the uh feedback file issues and the male uh whatever is easiest so uh that would be a huge help. ✪

Leonard_Rosenthol: Uh in that area. ✪

https://creator-assertions.github.io/identity/ ✪

Harrison_Tang: All right Dimitri your next on the queue. ✪

<eric_scouten_(adobe)> Meeting info: https://creator-assertions.github.io/#_meeting_schedule

Leonard_Rosenthol: So I I'll take the first 1 since that's my fault and I or take the second 1. ✪

Leonard_Rosenthol: uh yes. ✪

Leonard_Rosenthol: A quick history when when we started the work we were using Json as our serialization format and so uh I connected up with Manu and so as far as I know my name is still on the hash link draft uh specification for actually how to to do that as a single URL. ✪

Leonard_Rosenthol: And that was where we started. ✪

Leonard_Rosenthol: Switched our serialization from Json to sibur we recognized that we could take advantage of sibur binary structure so we've defined our own object you know see where object with fields for algorithm and hash so it's the same Concepts but it's now expressed as a sibur object instead of a single string um same ideas though. ✪

Leonard_Rosenthol: Honestly we had no nobody's approached us about being interested in using it in addition but we would have no objection to doing that at all. ✪

Leonard_Rosenthol: You to do it. ✪

Leonard_Rosenthol: Great send yeah. ✪

<harrison_tang> We just had a presentation where one claims that DID DHT (Distributed Hash Table) is the DID method to rule them all :D

Leonard_Rosenthol: I will say 1 other thing that uh so Eric is right that the the primary focus for DS is is over an identity that said there is still a a support for using a did as a Content identifier in the core ctba spec so every asset is assigned a unique identifier and and and it can be any identifier we don't mandate where it comes from what it looks like anything we just say stick and identifiers here and tell us where it's coming from and did our 1 of a series of of options that we suggest here's a couple of the shoes from uh dids handles DOI and iscc are 4 that we call out but even those aren't mandated. ✪

Harrison_Tang: Hi Mammoth I think you're on the queue. ✪

Leonard_Rosenthol: Yeah happy to do that so there there's no mandate on to when redaction takes place the idea is that somewhere later on in the life cycle of an asset the current I won't use the word holder the current person who has the asset and wants to continue it through its life cycle recognize that there is some information currently in the provenance that needs to be removed so the the normal example of this is that um your the a publisher is about the public a photo taken in a war zone and recognizes that the photographer's name is still in there and if they left it in that could be detrimental to their health so they want to redact out that information before they send it on um you that might also include you know removing or blurring of face or you know some other aspect but that's that was the use case why we put it in there. ✪

Leonard_Rosenthol: That said there. ✪

Leonard_Rosenthol: Why uh you might want to do it in various use cases or flows so no don't care when um but if you choose to there's a defined way to do it. ✪

Leonard_Rosenthol: No no then it would not be good redaction. ✪

Leonard_Rosenthol: Yes it happens within when you in the establishment of the provenance each piece is linked to the other through what we call you I use the term ingredient before so 1 type of ingredient is a parent ingredient which is how the the things chained to each other. ✪

Harrison_Tang: Money you're next. ✪

Harrison_Tang: Okay alright alright. ✪

Leonard_Rosenthol: Yeah great question so the recommendation and it's not the it's not mandated in any way but our our preferred model is that the Manifest goes inside the asset so in this case the Manifest goes into the PDF and the specification the c2a spec says in the case of PDF it goes here so it gives you a specific place in the PDF data structures and it does that for all of those formats I listed earlier so here's how to put it in a JPEG here's how to put it in an MP4 video Etc um but you don't have to if there are reasons why you would like to keep the 2 detachable you want to keep the Manifest in the cloud or put it on a DLT you can do that too but the normal scenario is it goes into a specific place in the PDF for your example and that manifest is itself is signed it's a self-contained blob which includes a digital signature in the case of PDF you can also apply. ✪

Leonard_Rosenthol: apply a PDF signature. ✪

Leonard_Rosenthol: On top of that. ✪

Leonard_Rosenthol: And then connect the 2 as well um so there's actually in in the spec talks about the details of of how the 2 types of signatures working in conjunction with each other. ✪

Harrison_Tang: So I have a related question so let's say a document has a long history of edits or Forks uh in other words uh there's a lot of manifest there's all those manifests go with the document and if so are there like implications to the Speed and Performance when you're checking the prominence. ✪

Leonard_Rosenthol: Excellent question so again as we mentioned it's not mandatory that it all be included uh you know again you could start sticking out in the cloud if you've got certain workflows but uh yes if it all goes there and it's got a long history that could get large uh we do support compression uh so we have a a model for compressed manifests. ✪

Leonard_Rosenthol: Specifically and then with respect to validation there's the only thing that's required to be validated. ✪

Leonard_Rosenthol: Is the top level manifest what we call the active manifest there is no mandate to walk the entire chain at validation time usually because usually the user just cares has this thing been modified since the last time and tell me who signed it and and that's what I care about however there are user experiences where you can dive into it and walk the entire chain and then in that case you would probably do level by level or ingredient by ingredient validation and again that's all described in the spec. ✪

Harrison_Tang: Got it thank you. ✪

Harrison_Tang: Mash you're next on the queue. ✪

Mahesh_Balan_-_pocketcred.com: Yes um great presentation thank you guys uh just uh had a question about verification um as a user when I view a document a video is is the verification run as part of this and then a logo displayed I mean how does that work for a regular person who doesn't want to kind of open up the whole you know the Manifest and things of that nature. ✪

Leonard_Rosenthol: Absolutely it's a great question so uh the user we have a whole 1 of those documents I mentioned before is called our user experience guidelines and so it goes into quite a lot of detail uh about the questions you asked you're asking and so the way we address it is we have um multiple levels. ✪

Leonard_Rosenthol: So in ux so we L1 level 1 is just what we call pin it's a simple logo or icon that would be associated with it so user could look very quickly and see yes this piece of content has credentials or it doesn't have credentials and potentially are those credentials valid or not valid or what you know there's a little X or something on them so like very quick view. ✪

Leonard_Rosenthol: There's a level 2 which is where depending on the experience rather than just putting up that pin uh ux could display information like who was the signer so it might say you know and the time and date in addition to the logo uh and you know that depends on the the user experience scenario and then levels 3 and level 4 is where you get into all of the details of the Manifest and the histories and the you know ingredients and everything so yes is the short is the short answer and hopefully the longer 1 also gave you some context. ✪

https://contentcredentials.org ✪

<leonard_rosenthol> shows how the UX works ^^

Leonard_Rosenthol: I'll give you my opinion so this is a personal opinion it's not the opinion of an organization my personal opinion is that I believe it is important that content provide provenance just like if I were to go buy something at an auction I want the like the pictures on the wall behind me all came with Providence I know where they came from I know that they're real and certified I personally want to see that on my content so that when I care I can go and look for it so if I happen to be on a website that I trust um you know if I go to the BBC for example I trust the BBC I'm on their site I'm not so concerned that every single picture and every single video I'm looking out on that site has prominence because I trust the site. ✪

Leonard_Rosenthol: But if I'm on Facebook or Instagram or pick your favorite social media. ✪

Leonard_Rosenthol: See all sorts. ✪

Leonard_Rosenthol: Of things coming. ✪

Leonard_Rosenthol: Through that I don't necessarily trust the sender or it's a friend of a friend or whatever and then yes I would want to see that information um that said I don't think we ever want it mandated I think mandating that gets us into all sorts of you know um you know controlled democracies or whatever uh totalitarian in regimes and that doesn't work. ✪

Leonard_Rosenthol: And care about it it makes for a better world. ✪

Harrison_Tang: So so I have a quick follow-up question actually I have 2 questions uh 1 is uh I'm assuming some creators probably would love this because they will be able to show that they are the original creator of this content and actually gets on licensing uh money out of it so I'm curious if uh this uh. ✪

Harrison_Tang: Uh this actually has the ability to actually coupled with payments and then the second is uh a little bit unrelated which is leather in your previous presentation in your in your presentation you showed like a 3 3 pillars right is provenance the second 1 is watermarking and third 1 is fingerprinting like what is fingerprinting because we went over a provenance you show a slide on watermarking can you clarify what fingerprinting is. ✪

Leonard_Rosenthol: Absolutely so uh and I'll I'll answer them in that order so the the first question is that that c2p a very specifically does not want to get into the business of DRM or payments or Rights Management or anything in that field um. ✪

Leonard_Rosenthol: The underlying technology is absolutely designed to allow for it if someone wants to build upon it uh and in fact we've talked to a number of companies out there already who are in the midst of building um. ✪

Leonard_Rosenthol: Ownership authorship Payment Systems Etc that leverage our provenance technology so. ✪

Leonard_Rosenthol: Yes and no in that regard uh with respect to payments uh so fingerprinting is really just a fancy term for similarity um checking so if you think about going on to a Google or a Bing or whatnot and doing you know have you ever seen an image like this 1 before uh that's what fingerprinting is it says find me something like this. ✪

Leonard_Rosenthol: Uh and so that way if you the watermark has been destroyed the provenance has been destroyed find me something that looks like this and then again as a human I can make a determination. ✪

Harrison_Tang: Got it thank you and we'll take 1 last question Ted. ✪

<tallted_//_ted_thibodeau_(he/him)_(openlinksw.com)> You might be interested in the W3C Credible Web CG. Currently meeting roughly quarterly. https://credweb.org/

TallTed_//_Ted_Thibodeau_(he/him)_(OpenLinkSw.com): I just quickly um you had mentioned something a minute ago about uh credibility on the web uh you might find interesting the credible web community group uh which have thrown a link into chat for. ✪

Leonard_Rosenthol: Yeah good calling that out that you you know you and I have both been members of that group since its Inception. ✪

TallTed_//_Ted_Thibodeau_(he/him)_(OpenLinkSw.com): Oh okay great. ✪

Leonard_Rosenthol: Thank you for you for calling it out I know it's gone through some waves and ups and downs uh but yeah it is a very important organization and I'm hoping that we we can kick it back off. ✪

Harrison_Tang: All right thank you thank you landlord thank you Eric for a great presentation and also thank you for uh leading this great discussion uh thanks for taking the time it's definitely very very interesting. ✪

Harrison_Tang: We will publish the meeting minutes and the recordings both video and audio recordings in the next 24 hours and if you have any questions feel free to uh I guess uh reach out to. ✪

Harrison_Tang: This concludes this week's uh. ✪

<eric_scouten_(adobe)> scouten@adobe.com

Harrison_Tang: ctg meeting. ✪

Harrison_Tang: We'll see you next week. ✪

Harrison_Tang: Thanks a lot. ✪