Vu Hoang Nguyen

Securing uniqueness of rights e-documents: a deontic process perspective

We typically think of documents as carrying information. However, certain kinds of documents do more than that: they are not only informative but also performative in that they represent rights. When these documents are in paper form or some other physical medium, holding the document indicates holding the right. Since the document represents a right, a hazard is that by duplicating the document, one may fraudulently claim a new right. For this reason, physical documents that represent rights are both tamper resistant and copy resistant. However, problems arise when such performative documents are converted to electronic form: duplicates are bit for bit perfect and undetectable. Thus, the normal heuristic of uniqueness of the document token as representing the uniqueness of the right no longer holds for performative electronic documents. This is especially challenging when the rights are transferable, as with various financial instruments such as stocks and bonds. This paper presents an analysis, based on deontic logic, about the necessary requirements for electronic documents and their corresponding electronic procedures in order to guarantee the uniqueness of rights and prevention of fraud. A design is sketched, based on a notion we call digital parchment, which offers improved flexibility.

Towards Open Exchange of Procedural Controls Among Institutions

This paper presents an automated technique for transforming business procedures, adding, replacing or removing procedural controls. This technique may also serve as a basis for sharing best practice auditing and control procedures among institutions. Stated more bluntly, the problem we consider is bureaucracies, and what a pain they are. Yet all bureaucracies are not created equal – some are less painful than others, even though they seem to do as good a job or even better. Why isn’t best practice shared? Well, clearly competing enterprises do not like to give away their tricks. On the other hand, there are many non-competing institutions, such as libraries, customs agencies, and even universities. Why don’t they learn best practice procedures from one another? To some extent they do – but it tends to be at the level of sharing high level ideas, rather than sharing detailed blueprints or detailed specifications. We propose not only the sharing of specifications, but the sharing of actual implemented components, that can be modified as needed to fit specific contexts. By institutions we include government agencies such as customs, police, educational institutions, etc. that have operational functions in common. Typically, private organizations are less open to sharing procedural control solutions, because of competitive pressures. However, in cases where governmental regulation is imposed on the entire industry (e.g. SOX), there may be more incentive to share solutions. Indeed, novel control solutions may suggest a new business models and entreprenurial opportunities.

An Aspect Architecture for Open Exchange of Administrative Controls for Business Processes

Besides business objectives, organizations also have control goals concerning how these objectives are met. To achieve control goals, many organizations insert control activities into their business processes. Over time, controls pile up and tangle with other activities; making it difficult to manage and reengineer evolving processes. In this paper, we propose an architecture that enables a clear separation of controls from operational activities. The proposed architecture aims to support the open exchange of control solutions among similar organizations that wish to exchange detailed knowledge about organizational control techniques.

Towards Deontic Knowedge-Based Tools for (Re-)Design of Inter-Organizational Procedures

Inter-organizational procedures are put in place to ensure compliance in contractual relationships. They thus control the interests of each party over the behavior of the other parties. Historically, controls emerged from experience: when something went wrong, a control was invented to avoid the problem in the future. But this trial and error approach tends to be slow, patchwork, as well as backward-looking, with no systematic review of possible control risks. Here a more analytical approach is proposed to the identification of control requirements for inter-organizational procedures. The approach involves abstracting the process to identify its basic deontic elements. A model checking approach is then applied to identify needed controls.