Device Identifier Meeting Minutes 2023-12-15

Attendees & Representation

Agenda

• Review of previous meeting minutes
• Discussion on requirements for IMEI Fraud
• Review of Device Identifier API status
• AOB

Discussion on IMEI Fraud API

• See API Proposal submission here
• Open Discussions:
  • #37: IMEI Fraud API Input
    • Proposal is just to use a single "IMEI" field, which would accept either IMEI or IMEISV
  • #34: What values should the IMEI Fraud API respond with to indicate reported ownership status?
    • The GSMA appear to have an existing Device Check service, which includes an API. How does the CAMARA proposal differ from this?

Review of Device Identifier API status

• Current "work in progress" version can be found here
• New PRs:
  • PR #41: Upload presentation on GSMA Device Check API
  • PR #42: Add linting rules and update YAML to be compliant
  • PR #43: Updates linting / OAS validation rules

All approved and merged as only relating to sub-project management / documentation

• Open PRs:
  • PR #44: Create README.md
• New Issues
  • None
• Open Issues:
  • Issue #40:  Proposed renaming of device identifier API
    • Using sub-project three letter code dvi as API name not scalable as additional APIs are added to the sub-project
    • Proposal is to use device-identifier as the new name
    • To be agreed in meeting
  • Issue #30: Defined scopes and meanings, being discussed in Issue 
    • Proposal is to have two scopes - one for all information, and one for TAC, Make and Model only
    • Brian: Should separate paths be defined rather than have a single path which accepts two scopes?
    • Please comment if you have a view
  • Issue #21: API Definition Terminology
    • Issue is out of date
    • ACTION: Eric to update issue text (still open)
• Open Discussions:
  • Discussion #35: Age of information or device connectivity status
    • Vodafone's implementation checks in "real time", so device must be connected and "age of information" would be 0
      • The current API design implicitly assumes these values
    • Other implementor's solutions may rely on cached data possibly be out of date, and hence require such a field
    • Please comment if you have a view
  • Discussion #36: Alternative device identifiers
    • An alternative proposal is to salt the IMEI with an API consumer specific salt and then hash it
    • This would a less useful identifier (only useful to the API consumer) but easier to justify providing under an opt-out or no consent basis
    • Use cases for such an alternative identifier are not clear
    • Please comment if you have a view

AOB

• Additional sub-project codeowners required - any volunteers?
• Next meeting to be held Friday 15th December 2023 @ 09:00 GMT
• One day, meetings will be held using the LFX Zoom service, but not yet