6th European Conference - Academic Conferences

Harm Schotanus et al.
In the remainder of this paper we will often use the term information domain. This is defined as a
collection of information under one responsibility (e.g. a nation, or organisation) that operates for a
single purpose (e.g. a mission) and has a single security policy.
2. Meta-information and labelling
A new information management strategy could be based on mechanisms that make decisions based
on meta-information instead of on the information itself. By adding relevant meta-information, the user
can effectively control on what conditions information can be released.
Meta-data or meta-information is information about information. For example, a military security
marking (such as NATO SECRET) on the top and bottom of each page of a document is a form of
meta-information because it conveys the classification of the document, in other words it is (security
specific) meta-information about other information. To enable regulated sharing of information
between different information domains or with partners in a coalition, meta-information can be used to
describe certain properties of information objects. These properties can be used to enforce decisions
in a release mechanism whether information should or should not be shared. The meta-information is
often called a label, and the process of creating a label is called labelling. This reflects two important
concepts:
Sharing information between coalition partners presumes a way of deciding whether a specific
information object may or may not be shared.
For each information object a set of properties can be determined that can form a basis decision
process for sharing information.
The crucial concept in our labelling approach is that we separate the logic to enforce decisions from
the intelligence to determine the properties of the information. This means we can reduce the
complexity of the decision making process.
2.1 Examples of meta-information
The use of properties of the information in addition to the original information, creates new
possibilities. If information objects such as files carry meta-information, for example the type-of-file
(presentation, document or image), file extension (ppt, doc, pdf, jpg), author, security marking, timeof-creation,
then these meta-information properties can be used for making decisions in several
scenarios [see Figure 1].
Figure 1: Examples of information with their meta-information
Because our aim is to both facilitate regulated sharing mechanisms and to present the power and
flexibility of meta-information, we categorised these new possibilities in two categories: use cases
within a single information domain and use cases in federated information domains.
Many software applications already store meta-information within information objects. Image files for
example carry resolution information while photos carry the camera manufacturer and model that was
used to take the photo. One problem with proprietary file formats and closed-source applications (e.g.
Microsoft Word) is that the meta-information cannot be easily accessed outside the native software
application because the file is a black box. A second problem is that each file format will have its own
approach to storing meta-information. That implies that a labelling solution has to be adjusted for
every format. A solution for this problem is an application-independent approach where information is
stored in a separate object. Storing meta-information separately from information objects in a
standardised format also improves the flexibility to work with meta-information without having to
depend on the knowledge of the file format or implementation in software.
In certain use-case scenarios where third parties need to process another one’s meta-data, a
standardized specification for conveying the meta-data is needed. NATO has proposed a standard
based on XML labelling (Eggen 2010)(Oudkerk 2010). On september 1 st 2009 POWDER (Protocol for
Web Description Resources) became a W3C recommendation (POWDER 2009). The POWDER suite
229