Welcome to JTC 1’s 4th quarterly newsletter, for exciting activities and news from October to December 2024.
Heading toward the back end of the calendar year brings a lot of plenary meetings, including JTC 1’s 45th meeting held in Seoul, Korea, for which the plenary highlights document has been released. The link to the highlights document is given at the end of this paper. This quarter there is news about a significant and exciting step forward in Consumer engagement, a short write-up on the CrowdStrike incident and why JTC 1 is relevant, a recap with links to the 2024 World Standards Day event on Trustworthiness, and information relating to more events on Trustworthiness. We also highlight the Mobile Driving License application and we celebrate the 2024 award winners and our growing social community.
Focus on Consumer protection
As a result of the JTC 1 plenary in November 2024 there has now been a step forward to assist with the engagement with consumers and consumer groups with the establishment of the following subcommittee, (subject to approval by ISO/TMB and IEC/SMB):
SC 44 Information technology – Consumer protection in the field of privacy by design
Scope: Standardization of consumer protection in the field of privacy by design for products, goods and services, including their data lifecycles.
The proposal also designates the UK National Body as the Secretariat and Jan Schallaböck from Germany as the subcommittee chair.
ISO/IEC JTC 1
World Standards Day 2024 (WSD)
It was a pleasure to have so many participants during the 2024 JTC 1 World Standards Day events on October 15th and 16th. We had approximately 160 attendees in total over both sessions. We also extend a huge “thank you” to all the speakers that gave their time to present a variety of viewpoints from many different and diverse areas.
This year’s theme was:
“How do standards enable trustworthiness?”
Trust in the age of Cloud, Data, AI and Cybersecurity.
Standards play a crucial role in establishing trustworthiness, especially in the context of cloud computing, data, AI and cybersecurity. They provide a framework for consistency, reliability, and transparency, which are essential for building trust. They ensure that systems operate consistently and predictably, which is paramount for users to place their confidence in digital technologies. This fosters an environment where users can trust the technology they interact with, which is especially important in today’s digital landscape where AI plays an increasingly significant role.
And in alignment with the theme, speakers shared their insights on Demystifying and showing a path how AI risks can be managed with the help of standards, enablement of trustworthiness i.e. trustworthiness in cybersecurity and privacy, and trustworthiness of smart systems, to name a few.
All the presentations are available on the jtc1info.org website along with links to the recordings of the workshops. These can be found here: https://jtc1info.org/wsd2024/
We are already looking forward to planning the 2025 event, and we encourage you to look out for the call for contributions to establish 2025’s Theme for world standards day.
Our WSD 2024 presenter wall of fame is as follows:
AG 1 Communications
Mobile Driving License (mDL) application
Issuing authorities and relying parties around the world have been moving toward the use of digital credentials for authentication of a person’s identity. As a result of this movement, ISO/IEC/JTC1/SC17/WG10 Cards and security devices for personal identification/Motor vehicle driver licence and related documents is developing the international standard by which a mobile device can be leveraged to transfer (or cause to be transferred) driver’s license information to an mDL verifier, who cryptographically authenticates the information using the Issuing Authority’s public key. Although this work specifies an mDL solution, falling within the standard ISO/IEC 18013 Personal Identification – ISO Compliant Driving License (mDL), it was intentionally designed to support any type of mobile identity credential or mdoc.
The mDL standard is set forth in parts 5 – 7 in ISO/IEC 18013. Part 5 standardizes the proximity, or in-person, use of an mdoc while Part 7 standardizes mdoc use over-the-internet. WG10 is also working on Part 6 that will provide test methods to be used in conformance testing of the mdoc solution against the international standard. WG10 continually uses information provided from implementations to improve the standard. Currently WG10 is looking at improvements for Part 7, over-the-internet use, in the areas of APIs and data transport protocols over those APIs.
The ISO/IEC 18013 standard has been leveraged by many issuing authorities around the world. In the U.S. and Canada, Australia, Japan, and many countries in Europe, ISO/IEC 18013 is the standard that issuing authorities are using to implement their primary identity documents to include mDLs and other mdocs.
Michael McCaskill
The CrowdStrike incident
Late on the night of 18 July 2024, many reports emerged of Windows computers displaying the blue screen of death. Only Windows based computers appeared to be affected. There were no reports of Mac or Linux based computers being impacted. Within a few hours the security firm CrowdStrike confirmed that a faulty security update for its Falcon sensor caused Windows computers, with that software installed, to crash.
The next day CrowdStrike issued an advisory confirming that a faulty content update was responsible and that the problem was limited to Windows computers. The advisory contained instructions on how to remediate affected systems and identify systems that could possibly have been impacted. At about the same time Microsoft reported a significant outage in its Azure Central US region. The CEO of Microsoft Satya Nadella posted a message on the social media platform X saying that Microsoft was aware of the CrowdStrike incident and was working with them to restore systems.
This was reportedly the biggest outage of IT systems the world had seen leaving millions of computers dysfunctional and disrupting many critical systems. For instance, airlines were unable to operate since their IT systems were down. The media was full of distressing images of distraught passengers stranded at very many airports.
So, what happened? It is understood from CrowdStrike’s internal investigations, that a software update to their flagship product, the Falcon sensor, was buggy. This buggy update was automatically applied as part of their automatic update process. This revelation led to the question of how a buggy update could have been released without it being tested? It turns out that there were two types of updates. The first kind are called “templates”. These are thoroughly tested and are released relatively infrequently. Another type of update called a “template instance”, are not tested as thoroughly before being released. The bug in the specific template instance that caused that outage was not detected by the relatively less rigorous testing and that caused millions of computers to malfunction globally.
Is this only a CrowdStrike thing? No! The whole software industry is moving towards a DevOps model where frequent and rapid changes to software systems is the norm and is done with no user intervention and often without user awareness. It is this DevOps model that needs to operate more reliably with a software testing regime. This is where the ISO/IEC/IEEE 29119 series of standards on Software Testing and ISO/IEC/IEEE 16085-2020 can play a very important role in making sure such types of incidents are prevented from occurring.
Sundeep Oberoi
Continuing the theme of Trustworthiness
AFNOR is pleased to announce that it will be hosting the ISO/IEC JTC 1/WG 13 Trustworthiness biannual meeting from March 3 – 7, 2025, in Paris. This event will be a vital milestone for WG 13, building on the objectives and strategic goals presented during the November JTC 1 Plenary in Seoul. The upcoming WG 13 meeting offers a unique opportunity to strengthen WG 13’s mission and focus on the following immediate objectives:
Developing a common understanding among WG 13 experts: Establishing a shared perspective on trustworthiness and its role across various domains.
Increasing participation with broad expertise: Encouraging collaboration from diverse professionals to enrich the discussions and outputs.
Gaining a conceptual understanding of trustworthiness and its relationship to trust: Exploring these interrelated concepts to solidify the foundation of ongoing and future projects.
We encourage experts to register for the meeting as this is an exceptional chance to:
- Contribute to shaping horizontal International Standards in trustworthiness that can enable a common approach for developing and using vertical standards.
- Collaborate with global experts that may contribute to a wider understanding of applying trustworthiness and expand professional networks.
- Influence the alignment of trustworthiness concepts with real-world applications.
Norbert Bensalem and Johann Amsenga
The Social side of Standardization
| It took a long time to come to fruition, but after months of discussions between two JTC 1 members and a little help from a third helping with international facilitation, JTC 1 members came together to run the 2024 Seoul Peace Marathon, in Korea during the week of the November JTC 1 plenary. This was the first step in establishing a JTC 1 social group for running and will organise social running events during face-to-face plenary events going forward, whether they be JTC 1 or Subcommittee plenaries. The next scheduled group run is targeted for Berlin in March 2025, in conjunction with the SC 38 plenary meeting, followed by JTC 1 plenary in May in Singapore. A walking event is also being planned for May. The group is open to anyone who would like to join please contact AG 1. |  |
AG 1 Communications
Awards 2024
| As a reminder, congratulations to all the following JTC 1 participants in recognition for being awarded the IEC 1906 award in 2024:
HOLLAND, Tony – United Kingdom |
 |
Additional links
JTC 1 plenary, November 2024 highlights: https://jtc1info.org/iso-iec-jtc-1-plenary-highlights-45th-meeting-in-seoul-korea/
As always, thanks goes out to all our contributors to this quarter’s newsletter, the AG 1 team for getting it ready, and don’t forget that you can submit articles to be included in the next quarterly newsletter using the online submission form at JTC1info.org, we’d love to hear from you.
Deadline for the contributions to the next newsletter is March 10th 2025.
Recent Comments