Date, Time, and Location

Thursday, August 6, 2020
1:00pm ET | 12:00pm CT | 11:00am MT | 10:00am PT

Minutes

eAC wiki: https://spaces.at.internet2.edu/display/eduroam/eduroam+Advisory+Committe

Attendees: Stefan Winter, Rob Gorrell, Jeremy Livingston, David Morton, Kim Owen, Andrew Buker, Theresa Semmens, Jeff Egly

With: Mike Zawacki, Nic Roy, Romy Bolton, Jessica Fink, Shannon Roddy, Kevin Morooney, Ann West

Regrets: Miroslav Milinovic, Neil Johnson

Agenda and Notes

Best Practices Guide (Rob & Kim, Working Group members)

• Link to Guide
• Possible additions to Guide
  
  • Service and support considerations
  • Architecture considerations
  • Content for those just joining the service
  • Performance Tuning based on committee experience
  • Common Issues
  • Other potential additions
    • Topics applicable in particular to US deployments? Currently have K12, CIPA, admin interface - anything else?
    • GDPR concerns, especially from the international community?
      • GeGC and others have been thinking through this. Developed list/statement of data flavors that are transferred and could be regulated by GDPR. Fairly standard across NROs. As a service, eduroam generally tries to require as little user data as possible. I can share that document. Miro might be able to say more about this as it’s more his specialty
    • Canada, ITAAR and similar regulations? 
    • Concerns about including legal in a Best Practices Guide but could provide “things to think about as you deploy eduroam” which would be welcome and less “problematic”
    • Other legal considerations
      • California's new privacy regulations - landscape is evolving
      • eduroam service is not about access to “stuff” it’s about access to local networks. It’s not about transmitting PII. We can include info on keeping outer identities as “anonymous” for example.  Maybe include a primer on how the service works for new users and/or to engage with non-technical stakeholders Consider KALIA and logging requirements. The Internet2 legal team got it - the explanation was very helpful for them and alleviated a lot of their concerns
      • A graphic might be the most useful way to illustrate this
    • Security Settings - On EDUCAUSE lists there’s talk of using splash pages/captive portals encouraging users to make changes to MAC randomization and other security settings, user privacy protections to make life easier for their IT staff. Suggest we recommend strongly against that
      • Maybe provide a few reasons to not turn off privacy features.  We would need a very good reason to turn off/opt out of anonymization (and similar practices) and none has ever been articulated. The logs provide enough information to deal with bad actors. 
      • Having an explanation on why and how eduroam does what it does would be helpful in convincing subscribers. Part of advice could be to not turn off anonymization …. (audio issues). Already exists in the EU documents but still sorting through the impact there
      • Question on vendor/tech features driving operational practices? Not to date, but some interactions like that with Microsoft to that end on Federation side. If OpenRoaming takes off there’s potential for this sort of vendor 
  • Include CUI in this guide
  • Potentially reaching a point where supplemental documentation is needed
    • Seems like we’re developing content that’s geared towards certain community segments and not others.   Don't want to scare them away before they realize it's not so bad
    • Could have audience “tags” for each topic - e.g. if you’re K12 here’s the table of contents for your segment. 
    • Could also create one really big doc and then use that to create smaller documents that are aimed at specific segments of the US eduroam community. 
    • Consensus to focus on basic best practices for an implementer and add more later

• Figuring out how to lay out enough to be useful but not scare people. 
• First round of training will probably inform some of this too?
• Training will be more focused on helping with adoption, what you need to get it up and running, etc. 
• Comments or thoughts from other Best Practices working group members?
• Working group will work on developing Service and Support and Architecture/Tuning sections with consideration for the segment/audience. K12?  Higher Ed? Etc 
• Working group decided to be careful of duplicating information and instead link to existing resources where it exists.
• Need to consider that as we look at adding support and architecture. There’s a wealth of info on those topics so need to make sure we’re aiming people at the best possible material
• Several of these topics belong in the guide. They’re common points of challenge/confusion with new subscribers to the service. Want to make sure they don’t duplicate effort either, and have a consistent understanding of eduroam. 
• Timeline and Deliverables
• By September we need to be wrapping up the initial version of the guide. Need to be sure to be at a point where we are more driving toward presentation than continuing content development.
• May need to set aside important but politically sensitive topics and focus on baseline requirements for new subscribers
• What does the group think is a minimum viable product
  
  • Imagine you’ve just been tasked with turning up eduroam for your institution. What would you need to do your job? Could be a good way to approach this. 
  • Also think we should think about those topics from the standpoint of institution flavors outside of higher ed. How would it look to a K12? Libraries, Museums, Etc.?
  • Consider that those segments may have less technical depth, less staff
  • GEANT is working on “managed SP” that can help deploy SP with almost zero on-site knowledge (hotspots merely needing to put a RADIUS IP/port/secret into their config, all the rest is handled by the service). In Luxembourg we’re dealing with adding K12s as well, so the topic is of interest here. 
  • Consider bringing in outside SMEs to review, make sure we have the right content and presentation 
• AOB
  • Heard 3rd/4th hand that “some” campuses were reducing the cubic footage of eduroam coverage while campuses are closed/something-like-closed.  Has anyone on eAC done this?  Know of anyone else who has done this?
  • Many big ten schools are experiencing the opposite - greater deployments into public areas in particular.  Committee agrees
    • UNC has some interaction/direct engagements with K12s and they’ve come to us about offering service in schools and libraries. 
    • Utah - Lots of interest in extending access to underserved areas, public/government buildings
    • Same in Nevada
    • NDSU - Also hearing interest in getting eduroam into new buildings for existing subscribers. 

• Next meeting, Thursday September 3rd 1pm-2:30pm ET

Intellectual Property Reminder - All Internet2 activities are governed by the Internet2 Intellectual Property Framework.

Public Content Notice - eAC minutes are public documents. Please let the eAC and note taker know if you plan to discuss something of a sensitive nature.