text:
This specification defines an API for specifying privacy and integrity policies on data, in the form of origin labels, and a mechanism for confining code according to such policies. This allows Web application authors and server operators to shared data with untrusted—buggy but not malicious—code (e.g., in a mashup scenario) yet impose restrictions on how the code can share the data further.
4.8 Should fetching request be blocked as COWL?
Mechanisms such as CORS and CSP can be used to mitigate these risks by giving authors control over whom they share data with. But, once data is shared, these mechanisms do not impose any restrictions on how the code that was granted access can further disseminate the data.
This document specifies an extension to the current model called Confinement with Origin Web Labels (COWL). COWL provides authors with APIs for specifying (mandatory) access control policies on data, including content, in terms of origin labels. These policies are enforced in a mandatory fashion, transitively, even once code has access to the data. For example, with COWL, the author of https://example.com can specify that a password is confidential to https://example.com (and thus should only be disclosed to https://example.com) before sharing it with a third-party password strength checking service. In turn, COWL ensures that the third-party service, which necessarily computes on the sensitive password, is confined and respects the policy on the password: COWL disallows it from disclosing the password to any origin other than https://example.com.
COWL enforces such policies by confining code at the context-level, according to the sensitivity (i.e., the label) of the data the code has observed. To reap the greatest benefits of COWL, authors will need to compartmentalize applications into multiple contexts (e.g., iframes).
In the existing model, any page served from an origin has the ambient, implicit authority of that origin. This documents generalizes this notion of authority and gives authors explicit control over it with privileges. For example, by default, a page whose origin is https://example.com has the privilege for https://example.com. This gives the page the authority to arbitrarily disseminate data sensitive to https://example.com; to be backwards-compatible, the page is not confined when reading data sensitive to https://example.com. However, COWL allows the author to run the page with "weaker" delegated privileges (e.g., one corresponding the current user at https://example.com) or to drop the privilege altogether.
COWL is intended to be used as a defense-in-depth mechanism that can restrict how untrusted—buggy but not malicious—code handles sensitive data. Given the complexities of browser implementations and presence of covert channels, malicious code may be able to exfiltrate data. Authors should still use discretionary access control mechanisms, such as CSP and CORS, to restrict access to the data in the first place.
Authors should be able to specify confidentiality and integrity policies on data in terms of origin labels: the origins to whom the data is confidential and the origins that endorse the data. This allows authors to share sensitive data with third-party content and impose restrictions on the origins with which it can communicate once it inspects the sensitive data. Dually, it allows authors to share data via intermediate content while retaining its integrity.
Authors should be able to run code with least privilege by restricting the origins the code can communicate with and thus how it can disseminate sensitive data.
Authors should be able to privilege separate applications by compartmentalizing them into separate contexts that have delegated privileges.
An author wishes to use a service, loaded in the form of an iframe, without trusting it (or its dependencies) to not leak her sensitive data. To protect the data, the author associates a confidentiality label with the data, specifying the origins allowed to read the data. The author then shares the newly created labeled object with the untrusted code. In turn, COWL confines the untrusted code once it inspects the sensitive data, as to ensure that it can only communicate according to the author-specified policy (the label).
// Register listener to receive a response from checker, etc.
Once the checker inspects the protected object, i.e., the password, COWL limits the iframe to communicating with origins that preserve the password’s confidentiality (in this case, https://example.com). This policy is enforced mandatorily, even if the https://untrusted.com iframe sends the password to yet another iframe.
Note, until the checker actually inspects the labeled password, it can freely communicate with any origins, e.g., with https://untrusted.com. This is important since the checker may need to fetch resources (e.g., regular expressions) to check the password strength. This is also safe—the checker has not inspected the sensitive password, and thus need not be confined.
Other use cases in this category include password managers and encrypted document editors, for example, where an encryption/decryption layer and a storage layer are provided by distrusting, but not malicious, services. The academic paper on COWL describes these use cases in detail [COWL-OSDI].
A server operator wishes to provide third-party mashups access to user data. In addition to using CORS response headers to restrict the origins that can access the data [CORS], the operator wishes to restrict how the data is further disseminated by these origins. To do so, the operator sends a response header field named Sec-COWL (described in §3.5.2 The Sec-COWL HTTP Response Header Field) whose value contains the sensitivity of the data in the form of a serialized confidentiality label. In turn, COWL enforces the label restrictions on the third-party code.
COWL only allows a https://mashup.com context to read the sensitive response if the label restrictions of the response are respected, i.e., if the code can only communicate with https://provider.com.
Note, COWL only allows the code to inspect the response if the context labels, which dictate the context’s ability to communicate, are more restricting than the labels of the response. A more permissive approach, which does not require the context give up its ability to communicate arbitrarily is to use labeled JSON response. The mashup XHR example shows how authors can accomplish this.
A server operator wishes to isolate content (e.g., of different users) while serving it from a single physical origin. The operator can leverage privileges to ensure that content of one part of the site has different authority from another and, importantly, does not have authority of the physical origin. Concretely, when serving content, the operator can set the content’s context privilege to a weaker, delegated privilege. This ensures that the content are privilege separated.
Having this privilege can be understood as having the authority of user1’s part of the https://university.edu origin. COWL ensures that the content of this user cannot interfere with the content of https://university.edu or another user e.g., user2. For example, the content cannot modify https://university.edu cookies or the DOM of another http://university.edu page.
This delegated privilege also ensures that the content cannot disseminate data sensitive to another user (e.g., user2) arbitrarily— without being confined, it can only disseminate user1’s data on http://university.edu. Of course, this requires the server operator to label sensitive data (e.g., when sending it to the user agent) appropriately (e.g., user2’s data is labeled Label("https://university.edu")._or("user2")).
Note, sub-domains should be used when possible to ensure that content is isolated using the Same-Origin Policy. But, even in such cases, COWL can provide a useful layer of defense.
An author wishes to use a library that is tightly coupled with the page (e.g., jQuery), but not trust it to protect the user’s confidentiality and integrity. With COWL, the author can do this by loading the untrusted library after dropping privileges (from the context’s default privilege). In doing so, the content (and thus the library) loses its implicit authority over the content’s origin.
Note, while this ensures that the context code cannot, for instance, access the origin’s cookies, the author must still associate a confidentiality label with resources (e.g., HTTP responses) to ensure that data is properly protected.
In some cases it is useful for a particular context to have the privilege to disseminate certain category of data. (The or part of labels can be used to easily categorize differently-sensitive data.) To this end, the author should run the context with a delegated privilege instead of the empty privilege. The above §1.2.3 Content isolation via privilege separation shows one such example.
COWL provides developers with a way of imposing restrictions on how untrusted code can disseminate sensitive data. However, authors should avoid sharing sensitive data with malicious code, since such code may be able to exploit covert channels, which are present in most browsers, to leak the data. COWL can only prevent information leakage from code that (e.g., is buggy and) uses overt communication channels.
Similarly, COWL provides no guarantees against attacks wherein users are manipulated into leaking sensitive data via out-of-band channels. For example, an attacker may be able to convince a user to navigate their user agent to an attacker-owned origin by entering a URL that contains sensitive information into the user agent’s address bar.
COWL should always be used as an additional layer of defense to other security mechanisms such as CSP, SRI, CORS, and iframe sandbox.
An origin label, or more succinctly a label, encodes either a confidentiality or integrity security policy as conjunctive normal form (AND’s and OR’s) formulae over origins. Labels can be associated with contexts or with structurally clonable objects.
When associated with a context, the label restricts the origins that the context can communicate with, as detailed in §3.3 Labeled Contexts.
The confidentiality label Label("https://a.com")._or("https://b.com"), when associated with a context, restricts the context to sending data to https://a.com or https://b.com, but no other origins. This context label reflects the fact the context may contain data that is sensitive to either https://a.com or https://b.com; it is thus only safe for it to communicate to these origins.
Note, because the context can communicate data to either origin, another context associated with the more restricting label Label("https://a.com") cannot send it data. Doing so would allow for data confidential to https://a.com to be leaked to https://b.com.
The integrity label Label("https://a.com").or("https://b.com"), when associated with a context, restricts the context to receiving data from (a context or server) that is at least as trustworthy as https://a.com or https://b.com. This context label ensures that the code running in the context can only be influenced by data which either https://a.com or https://b.com endorse.
When associated with an object, a confidentiality label specifies the origins to whom the object is sensitive, while an integrity label specifies the origins that endorse the object. Objects that have labels associated with them are called labeled objects. §3.4 Labeled Objects defines how labels are associated with objects.
Confidentiality: Label("https://example.com"). This label indicates that the object is sensitive to https://example.com.
Integrity: Label("https://a.com"). This label indicates that the object has been endorsed by https://a.com. If https://example.com received the message from an intermediary https://b.com context, this label reflects the fact that the object (produced by https://a.com) was not tampered.
Mathematically, a label is a conjunctive normal form formula over origins [DCLabels].
A label is in normal form if reducing it according to the label normal form reduction algorithm produces the same value.
Two labels are equivalent if their normal form values are mathematically equal.
A label A subsumes (or is more restricting than) another label B if the result of running the label subsumption algorithm on the normal forms of A and B returns true. Labels are partially ordered according to this subsumes relation.
The current confidentiality label is the confidentiality label associated with the current context. §3.3 Labeled Contexts specifies how labels are associated with contexts.
The current integrity label is the integrity label associated with the current context. §3.3 Labeled Contexts specifies how labels are associated with contexts.
When reading a labeled object, a context gets tainted, i.e., its context labels are updated by invoking context tainting algorithm, to reflect that it has read sensitive (of potentially different trustworthiness) data and should be confined accordingly.
A privilege is an unforgeable object that corresponds to a label. Privileges are associated with contexts and reflect their authority.
Privileges can be used to bypass confinement restrictions imposed by confidentiality labels. In particular, a privilege can be used to bypass the restrictions imposed by any label its corresponding label—the internal privilege label—subsumes.
Consider a context from https://a.com whose current confidentiality label is Label("https://a.com").and("https://b.com"). This label confines the context to only communicating with entities whose labels are at least as restricting as this label. For example, it restricts the context from communicating with a context labeled Label("https://b.com"), since doing so could leak https://a.com data to https://b.com. It similarly prevents the context from communicating with https://a.com.
But, suppose that the context’s current privilege corresponds to Label("https://a.com") (afterall, the context originated from https://a.com). Then, the context would be able to bypass some of the restrictions imposed by the context label. Specifically, the context would be able to communicate with https://b.com; the privilege confers it the right to declassify https://a.com data to https://b.com. Indeed, when taking this privilege into consideration, the effective confidentiality label of the context is Label("https://b.com").
Note, the privilege does not allow the context to bypass any label restrictions. For example, it does not allow the context to communicate with https://a.com since doing so could leak https://b.com data.
To be flexible, COWL uses the context privilege to remove certain restrictions imposed by the context label. To avoid accidentally leaking sensitive context data, authors should use LabeledObjects.
Privileges can also be used to bypass integrity restrictions imposed by integrity labels. In particular, a privilege can be used to endorse an otherwise untrustworthy labeled context (or labeled object) as to allow it to communicate with more trustworthy end-points (another context or server).
Consider an https://a.com context whose current integrity label is Label("https://a.com")._or("https://b.com"). This label confines the context to only communicating with entities that are at most as trustworthy as this label. For example, it restricts the context from communicating with a context whose current integrity label is Label("https://a.com"), since doing so would potentially corrupt https://a.com data (e.g., by allowing https://b.com to influence the computation).
But, if the context’s current privilege corresponds to Label("https://a.com"), the context would be able to bypass some of these integrity restrictions. Specifically, the context would be able to communicate with the more-trustworthy context (labeled Label("https://a.com")) since the privilege confers it the right to endorse (or vouch for) its context on behalf of https://a.com. Indeed, when taking privileges into account, the effective integrity label of the context is Label("https://a.com").
Note, the privilege cannot be used to bypass any integrity restrictions. For example, it does not allow the context to communicate with a context whose integrity label is Label(https://b.com).
Note, browsing contexts have a current privilege that, by default, corresponds to the origin of the context, as described in §3.3 Labeled Contexts. But, authors should set the current privilege to a delegated privilege to follow the principle of least privilege.
The current privilege is the privilege associated with the current context. §3.3 Labeled Contexts specifies how privileges are associated with contexts.
The effective confidentiality label is the label returned by the label downgrade algorithm when invoked with the current confidentiality label and current privilege.
The effective integrity label is the label returned by the label upgrade algorithm when invoked with the current integrity label and current privilege.
Code can take ownership of a privilege priv by setting the current privilege to the privilege produced via the combination of the current privilege and priv. In doing so, it is said that the context owns the privilege.
This sub-section is not normative.
COWL extends browsing contexts and Workers with labels and privileges, which are used when enforcing confinement, i.e., when restricting a context’s network and cross-context messaging communication. This document defines the necessary changes and extensions to existing browser constructs and algorithms to enforce confinement.
Each label is an immutable object represented by a Label object, the interface of which is defined in this section.
A Label MUST have an internal label set, which is a non-empty set of disjunction sets.
A disjunction set is a set of origin URLs.
A label is said to be an empty label if its label set contains a single, empty disjunction set.
Current WebIDL implementation requires an underscore for certain identifiers. Can we rename _or to or?
When invoking the Label() constructor, the user agent MUST return a new empty label.
If the origin argument is not a URL, the constructor MUST throw a TypeError exception [ECMA-262] and terminate this algorithm.
Else, it MUST return a new Label that contains a label set of a single disjunction set, which itself MUST contain the URL corresponding to the origin of the parameter.
The user agent MUST return true if the Label on which the method has been called is equivalent to the other parameter; otherwise it MUST return false.
Let lab be the Label on which the method has been called.
If the priv argument is provided, let lab be lab.and(priv.asLabel()).
Return true if lab subsumes the other parameter and false otherwise.
Let O be the other argument.
Set O to the result of invoking the Label(other) constructor with other as an argument, if the constructor did not raise an exception.
Else, re-throw the exception and terminate this algorithm.
Return a new Label, in normal form, which is equivalent to adding O’s label set to the label set of the Label on which the method was invoked.
Return a new Label, in normal form, which is equivalent to adding each element of each disjunction set of O’s label set to each disjunction set of the label set of the Label on which the method was called.
Let JSON lset be a new JSON array.
Let JSON dset be a JSON array of strings, each corresponding an origin in dset.
Append JSON dset to the JSON lset array.
If obj is not a JSON array of entries, each of which is a JSON array of strings, throw a TypeError exception [ECMA-262] and terminate this algorithm.
If the argument is not a URL, the function MUST throw a TypeError exception [ECMA-262] and terminate this algorithm.
Else, set self to the self argument.
Let lab be a new empty label.
Let dset label be a new empty label.
If str is a "unique", let origin be a globally unique identifier.
Much like FreshPrivilege(), "unique" is used to create a label component that is globally unique.
Else, if str is "self" and self is not null, let origin be self.
Else, if str is a URL, let origin be str.
Else, throw a TypeError exception [ECMA-262] and terminate this algorithm.
Example labels. Intuition for each label’s semantics is given in the context of it being used as a confidentiality label (C) and integrity label (I).
// C: Data confidential to a.com.
// I: Data endorsed/trusted by a.com.
// C: Data confidential to b.com.
// I: Data endorsed/trusted by b.com.
// I: Data endorsed/trusted by a.com and b.com.
// C: Data confidential to either a.com or b.com.
// I: Data endorsed/trusted by either a.com or b.com.
Examples of label comparisons with intuition for the semantics.
// C: Data confidential to a.com (b.com) data is more sensitive than public data.
// I: Data endorsed by a.com (b.com) is more trustworthy than non-endorsed/untrustworthy data.
//    confidential than data that is only sensitive to a.com (b.com).
//    more trustworthy than data endorsed only by a.com (b.com).
//    data that is confidential to b.com (a.com).
//    data that is endorsed by b.com (a.com).
//    a.com or b.com can be read by an entity that can read a.com (b.com) data alone.
//    by either a.com or b.com necessarily trusts data endorsed by a.com (b.com) alone.
Each privilege is an immutable object represented by a Privilege object, the interface of which is defined in this section.
A Privilege MUST have an internal privilege label.
The combination of privileges A and B is a privilege produced by invoking the combine() method on A (respectively, B) with B (respectively, A) as an argument.
A privilege is said to be an empty privilege if its internal privilege label is the empty label. A context is said to be unprivileged if its context privilege is the empty privilege. By setting the context privilege to the empty privilege, a context is said to be dropping privileges.
A privilege P1 is said to be a delegated privilege of P2 if P2’s internal privilege label subsumes P1’s internal privilege label.
Bikeshed does not allow WebIDL’s NamedConstructor. For now, inlining the constructor as a static method.
When invoking the Privilege() constructor, the user agent MUST return a new Privilege that has an internal privilege label set to Label().
Let unique Label be the label produced by invoking the Label(other) constructor with a globally unique identifier.
Return a new Privilege that has an internal privilege label set to unique Label.
The user agent MUST return the internal privilege label of the Privilege on which the method has been called.
Let internalLabel be the internal privilege label of the Privilege on which the method has been called.
Let otherLabel be the internal privilege label of the other argument.
If the internalLabel does not subsume the label argument, throw a SecurityError exception and terminate this algorithm.
Else, return a new Privilege that has an internal privilege label set to label.
Note, the Privilege constructors and the combine() and delegate() methods only provide ways for creating privileges. Context code must still take ownership of or set the current privilege to the privilege for it to be used (to bypass label restrictions).
To be backwards-compatible with the Same-Origin Policy, COWL grants each browsing context a default privilege that corresponds to their origin. For example, a page on https://example.com has a privilege whose internal privilege label is Label("https://example.com").
After this point, if the context reads data with a Label("https://example.com") confidentiality label, COWL will restrict it to communicating with https://example.com.
Consider an extension to the password strength checker example of §1.2.1 Confining untrusted third-party services that uses FreshPrivilege()s to ensure that the untrusted checker cannot communicate with any entity other than the parent context.
Once the https://untrusted.com context reads the password it will be tainted by the unique, internal privilege label of priv; the unique origin ensures that it cannot send the password to, for example, public parts of https://example.com. Indeed, only the owner of priv can disseminate the labeled password (result) arbitrarily.
At this point, the context can only arbitrarily disseminate data that is labeled Label("https://university.edu")._or("cowl://user1"); it cannot disseminate data that is sensitive to the university (e.g., which is labeled Label("https://university.edu")) or to another user (e.g., user2’s data is labeled Label("https://university.edu")._or("cowl://user2")).
The confinement mode status, which indicates whether or not COWL confinement is enabled and thus labels should be enforced in the current context.
context confidentiality label reflects the sensitivity of the data that the context has read.
context integrity label reflects the integrity of the data that the context has read.
The context privilege, which encodes the context’s ability to bypass the restrictions of certain labels.
The confinement mode is disabled.
The context confidentiality label is set to the default confidentiality label: empty label.
The context integrity label is set to the default integrity label: empty label.
The context privilege is set to the default privilege: a privilege whose internal privilege label is equivalent to Label(origin), where origin is the string representation of the context or Worker’s origin.
Unless confinement mode is enabled, a context is not subject to confinement.
Unless the current confidentiality label and the current integrity label are non-empty labels, the context’s communication is unrestricted; code is only subject to the restrictions imposed by other mechanism such as the Same-Origin Policy and CSP.
Unless the current privilege is dropped or set to a delegated privilege, code can disseminate data sensitive to the browsing context’s origin, even when confinement mode is enabled. Such data is implicitly declassified using the context privilege. Authors should send LabeledObjects to explicitly communicate the sensitivity (and integrity) of the data they are sharing.
Each context’s COWL state is made available via the COWL interface defined below.
On getting, the user agent MUST return the current confidentiality label.
Let conf be the set confidentiality label.
Let canWrite be the result of invoking the write check algorithm with conf and the current integrity label.
If canWrite is false, throw a SecurityError exception and terminate this algorithm.
Else, set the current confidentiality label to conf.
On getting, the user agent MUST return the current integrity label.
Let int be the set integrity label.
Let canWrite be the result of invoking the write check algorithm with the current confidentiality label and int.
Else, set the current integrity label to int.
On getting, the user agent MUST return the current privilege.
On setting, the user agent MUST enable confinement mode and set the current privilege to the set privilege.
On invocation, the user agent MUST enable confinement mode by setting the current context’s COWL state confinement mode status.
Below are several examples showing how to use the COWL API. The §3.2.3 Examples illustrate the use of context privileges.
At this point, no confinement restrictions are applied—COWL is backwards compatible with the existing model. But, the context labels can be set to restrict communication.
At this point, the context can only communicate with https://provider.com. The data provider can ensures that the context is appropriately labeled as such before it can inspect an HTTP response by setting response labels using the Sec-COWL response header.
A LabeledObject interface represents an immutable object that is protected by a confidentiality and integrity label, i.e., the object has associated labels.
This API is designed to be used in conjunction with other APIs and elements on the web platform. In particular, postMessage(), Web Workers, and XMLHttpRequest (e.g., with an overloaded send() method for LabeledObject arguments).
A LabeledObject MUST have an internal protected object, a confidentiality label, and an integrity label. The interface is defined below.
Let obj clone be the result of obtaining a structured clone of the obj argument.
Let conf be the confidentiality member of the labels argument, if it is set. Otherwise, let conf be the current confidentiality label.
Let int be the integrity member of the labels parameter, if it is set. Otherwise, let int be the current integrity label.
Let canWrite be the result of invoking the write check algorithm with the conf and int labels.
If canWrite is false, the constructor MUST throw a SecurityError exception and terminate this algorithm.
Else, the user agent MUST return a new LabeledObject, with the protected object set to obj clone, the confidentiality label set to conf, and the integrity label set to int.
Because COWL enforces labels at context boundaries, there is usually no reason to label an object and then use the labeled object within the same context. LabeledObjects are mainly useful for sending sensitive data to an untrusted context, e.g., via cross-document messaging, as a way to ensure that the data’s confidentiality and integrity (as specified by the labels) are respected by the untrusted context. Hence, the LabeledObject() constructor only accepts objects that can be structurally cloned.
On getting, the user agent MUST return the LabeledObject’s confidentiality label.
On getting, the user agent MUST return the LabeledObject’s integrity label.
Invoke the context tainting algorithm with the LabeledObject’s confidentiality and integrity labels.
The context can’t violate the confidentiality of the data (as specified by the confidentiality label) by communicating arbitrarily once it reads data labeled as such.
The context can’t violate the integrity of entities more trustworthy than the data. (The trustworthiness of the data is specified by the integrity label.) In particular, once the context reads the data and gets tainted, the rest of the computation is restricted to writing to entities that are at most as trustworthy as the data, since the read data may have influenced the computation.
Let obj be the protected object of the object on which the method was invoked.
Let conf be the confidentiality label of the object on which the method was invoked.
Let int be the integrity label of the object on which the method was invoked.
Let newConf be the confidentiality member of the labels argument, if it is set. Otherwise, let newConf be conf.
Let newInt be the integrity member of the labels parameter, if it is set. Otherwise, let newInt be int.
Let privs be the internal privilege label of the current context privileges.
If newConf.subsumes(conf, privs) returns false or if int.subsumes(newInt, privs) returns false, the method MUST throw a SecurityError exception and terminate this algorithm.
Note, these checks ensure that the new labels of the object are at least as restricting as the original labels, taking into consideration the privileges of the context.
Else, return a new LabeledObject, with the protected object set to obj, the confidentiality label set to newConf, and the integrity label set to newInt.
Below are several examples showing the usage of LabeledObjects. §1.2.1 Confining untrusted third-party services gives an example of how LabeledObjects can be used to confine third-party libraries (e.g., a password strength checker). §3.6.1.1 Examples and §3.6.2.1 Examples show how LabeledObjects are used with the XMLHttpRequest constructor.
Note that before getting the first protectedObject, the iframe can communicate arbitrarily, e.g., to fetch map tiles. But once it inspects the confidential locations COWL confines the code—it restricts it to only communicating with https://police.gov. Importantly, it can keep receiving messages from its parent context via postMessage() to, for instance, move a car.
The author of https://example.com wishes to ensure that a particular JSON object conforms to a set of validation filters before submitting it to a remote server. (Consider, for example, a form validator that checks if an email address is valid.) To this end, it labels the JSON and sends the labeled object to (e.g., a Worker or iframe) that performs the validation.
// endorsed by the current (sub-)origin.
The author of https://example.com can then pass the endorsed object to other validators or end-point (e.g., a server), who can, in turn, further endorse the object or verify the origins that have endorsed it.
The Sec-COWL HTTP request and response headers are used by user agents and servers to convey label metadata to servers and user agents, respectively.
Label metadata is either labeled context metadata or labeled data metadata.
the serialized context privilege’s internal privilege label given by the ctx-privilege directive.
ctx-directive-name  = "ctx-confidentiality" / "ctx-integrity" / "ctx-privilege"
data-directive-name = "data-confidentiality" / "data-integrity"
disjunction-set     = "[" [ source-expression *( "," [ source-expression ] ) ] "]"
empty-label         = "[" *WSP "[" *WSP "]" *WSP "]"
The parsing algorithms for label metadata are given in §4.10 Parse labeled data metadata and §4.11 Parse labeled context metadata .
The user agent MUST send a header field named Sec-COWL along with requests if confinement mode is enabled. The value of this header MUST contain the labeled context metadata of the context that performed the request. This labeled context metadata MUST include the current context confidentiality label, context integrity label, and context privileges. The user agent MAY send another header with this field name whose value is labeled data metadata (e.g., when sending labeled objects with XMLHttpRequest).
Request header from a http://a.com page that has read data sensitive to http://b.com.
A request sent from a public, untrustworthy http://university.edu context that owns a delegated privilege and a FreshPrivilege().
The header value may contain labeled context metadata which can be used to set the initial COWL state of a context; or it may contain labeled data metadata which specifies the sensitivity of the response (which COWL then uses to determine whether or not to block the response).
COWL blocks the response unless the current context’s labels are at least as restricting.
To process this header, the user agent MUST use the Process response to request as COWL algorithm when performing a fetch, as described in §3.7.1 Modifications to Fetch.
The XMLHttpRequest specification SHOULD contain the modifications described below to enable the rest of this specification’s work [XHR].
Let obj be the protected object of the lobj argument.
Let conf be the confidentiality label of the lobj argument.
Let int be the integrity label of the lobj argument.
Let privs be the current context privileges.
Let remoteConf be the label returned by the Label(origin) constructor called with the url associated with the request.
If responseConf.subsumes(conf, privs) returns false, throw a SecurityError and terminate this algorithm.
The user agent SHOULD warn the user that the script attempted to leak data to a remote server.
Set the Content-Type header to `application/labeled-json`.
Append a header named Sec-COWL to the author request headers associated with the object this methods was called on. The value of the Sec-COWL header MUST be labeled data metadata containing the confidentiality and integrity labels of the lobj argument.
Invoke the send() method on the object this method was called on with json as an argument.
Note, that send() throws an exception in step 4 if obj cannot be serialized. User agents MUST ensure that all protected objects can be serialized at the time of creating LabeledObjects.
This algorithm does not check if the integrity label of the object subsumes the server’s integrity label. It is the server’s responsibility to ensure that untrustworthy data does not affect its computation in an unsafe way. Indeed, the only reason for checking the confidentiality labels is because the user agent has no way to ensure that the server will respect the confidentiality of the data.
The server can then verify the integrity label of the request and ensure that, if the user agent is conformant, the data was endorsed by https://validator.com.
An XMLHttpRequest has associated response LabeledObject object.
If the response LabeledObject object is non-null, return it.
If responseType is not "labeled-json" or the final MIME type is not application/labeled-json, return null.
Let bytes be the response’s body.
If bytes is null, return null.
Let JSON text be the result of running utf-8 decode on byte stream bytes.
If the JSON object is missing any of the three entries: "object", "confidentiality", or "integrity" return null.
Let protected object be the value of the "object" entry.
Let self be the url associated with the response.
Let conf be the label returned by calling the fromJSON() function with the "confidentiality" entry of the JSON object and self. If the function threw an exception, return null.
Let int be the label returned by calling the fromJSON() function with the "integrity" entry of the JSON object and self. If the function threw an exception, return null.
Let responseInt be the label returned by the Label(origin) constructor called with self.
If responseInt does not subsume int, return null.
Should the user agent warn the user if the server provided an integrity label that it is not allowed to provide?
Set the labeled JSON response to a newly created LabeledObject whose protected object is protected object, confidentiality label is conf, and integrity label is int.
Return the labeled JSON response.
↪ If responseType is "labeled-json"
Set response LabeledObject object to null.
§1.2.2 Sharing data with third-party mashups gives an example of a mashup scenario wherein the data provider uses the Sec-COWL HTTP response header to ensure that the mashup integrator can only read the HTTP response if it is sufficiently confined. A more permissive approach is to send a labeled JSON response.
The confidentiality label specifies that the object is confidential to https://provider.com and should not be disseminated arbitrarily.
Here, COWL sets the response to a new LabeledObject, but does not taint the context with the response label. Indeed the https://mashup.com integrator can perform many other requests to different origins. Only when the protected objects of these labeled objects are used will COWL taint the context and impose the label restrictions.
Once the receiver inspects the protectedObject of the response, COWL taints the context and ensures that it cannot communicate with anybody.
To enforce confinement, COWL ensures that code in a context cannot send data (e.g., via cross-document messaging or by performing a fetch) to contexts or servers that do not preserve the confidentiality of the data. Similarly, COWL ensures that a context cannot receive data from a context or server that is less trustworthy.
If should fetching request be blocked as COWL returns blocked, set response to a network error.
If process response to request as COWL returns blocked, set response to a network error.
Let conf be the current context’s effective confidentiality label.
Let int be the current context’s effective integrity label.
Let dstState be the COWL state associated with the Document of the Window object on which the method was invoked.
If confinement mode for dstState is enabled, let dstConf be the dstState effective confidentiality label.
Else, let dstConf be the Label returned by the label upgrade algorithm when invoked with the dstState context confidentiality label and context privilege.
Note, if the receiver has not enabled confinement mode, COWL flexibly assumes that it can receive data sensitive to its origin (in using the label upgrade).
Let dstInt be the dstState effective integrity label.
If dstConf does not subsume conf or if int does not subsume dstInt, then abort the remaining steps silently.
Let dstState be the COWL state associated with the owner of the target port the Message Port postMessage() was called on.
Let dstInt be the state effective integrity label.
If dstConf does not subsume conf or if int does not subsume dstInt, then abort the remaining steps.
The user agent MUST ensure that if content has access to another content from the same origin, but either ends up enabling confinement mode and has a non-empty label, access must be revoked and the two must be considered as if they are of different origins. Th current version of this document specifies this requirement in terms of the sandboxed origin browsing context flag.
Implementation-wise, this may pose a challenge for certain browsers. An alternative design may disallow enabling confinement mode if the browsing context has any references to or from another same-origin content. Feedback on this would be very welcome.
Should COWL restrict communication via less overt channels (e.g., height/width of an iframe, URL fragment, or even)index in window.top.frames)? Maybe as optional modifications to HTML? Feedback on this would be very welcome.
Let lset be the label set of an empty label.
Remove every disjunction set in lset that dset is a subset of.
Return a newly created Label whose label set is lset.
Note, this algorithms assumes that disjunction sets and label sets do not have duplicate elements, much like mathematical sets.
If, for each disjunction set b in the label set of B there is disjunction set a in the label set of A such that a is a subset of b, return true.
Note, when interpreting labels as mathematical formulae, label subsumption is logical implication: A subsumes B is equivalent as A implies B, i.e, A⇒B.
Let privLabel be the internal privilege label of priv.
Let cur be a newly create Label whose label set is dset.
If privLabel does not subsume cur, add dset to lset.
Note, label downgrade removes every disjunction set permitted by priv. This is used to safely declassify data labeled label.
Note, label upgrade is the dual of label downgrade. This can be used to safely endorse data labeled label (and thus potentially already endorsed).
Let currentConf be the current context confidentiality label.
Let currentInt be the current context integrity label.
Set the context confidentiality label to the Label returned by the by the label downgrade algorithm when invoked with currentConf.and(confidentiality) and current privilege.
Set the context integrity label to the Label returned by the by the label downgrade algorithm when invoked with currentInt._or(integrity) and current privilege.
Let currentConf be the current context’s effective confidentiality label.
Let currentInt be the current context’s effective integrity label.
If objConf does not subsume currentConf or if currentInt does not subsumes objInt, return false.
If input is a Label object, let output be a newly constructed Label object with the same label set as that of input.
If input is a Privilege object that was constructed with the FreshPrivilege() constructor, let output be a newly constructed Privilege object with the same internal privilege label as that of input.
To prevent attacks that launder page privileges, the current version of COWL only allows transferring fresh privileges.
We can be more permissive and allow transferring all but default privileges. Feedback on this would be welcome.
If input is a LabeledObject object, let output be a newly constructed LabeledObject object with the same internal protected object, confidentiality label, and integrity label as that of input.
Note, cross-context messaging constructs such as postMessage() use the structured clone algorithm (e.g., see the internal structured cloning algorithm). This algorithm is used to allow authors to transfer COWL object, such as LabeledObjects, to other contexts.
4.8. Should fetching request be blocked as COWL?
Note: this algorithm is used to determine whether a request should be entirely blocked, because it may potentially leak sensitive data to an unauthorized server.
Let context be the client associated with the request.
If context is null, let context be the incumbent settings object.
Note, the client associated with the request is null when navigating, so we use the incumbent settings object to get the COWL state of the context that initiated the request.
Let state be the COWL state retrieved via the environment settings object context.
If the state confinement mode is not enabled, return allowed and terminated this algorithm.
Let conf be the state effective confidentiality label.
Let dstConf be the Label created by invoking the Label(origin) constructor with the url associated with the request.
If dstConf subsumes conf, return allowed.
If the request is a navigation request and the request’s context frame type is top-level the user agent MAY return allowed, but MUST indicate to the user that data labeled conf may have been leaked due to the navigation. It is RECOMMENDED that user agents give users the options to block the navigation, e.g., via a pop-up dialog.
We can simply disallow leaks via top-level navigation at the cost of potentially forcing users to navigate away by closing tabs or inputting another URL via the address bar. Feedback on this would be welcome.
Note, the integrity label of the current context is not used in this algorithm since, conceptually, the integrity label of a server is the empty label and, thus, always subsumed. Server operators should check the Sec-COWL request header to ensure untrustworthy data does not affect the computation in an unsafe way.
If a request proceeds, we still might want to block the response based on the labeled data metadata of the response. For example, if the current confidentiality label does not subsume the confidentiality label of the response, the user agent MUST block the response since it could otherwise violate the confidentiality of the response data. (The dual holds for integrity.) This algorithm is used to make the determination of whether or not a response is blocked.
This algorithm is also used to set the COWL state for new documents and Workers according to server-supplied the labeled context metadata.
If the response’s header list has no header whose name is Sec-COWL, return allowed and terminate this algorithm.
Let destination be the request’s destination.
Let type be the request’s type.
Note, the client associated with the request is null when navigating, so we use the incumbent settings object to get or set the COWL state of the context that initiated the request.
Let metadata be the first header whose name is Sec-COWL in the response’s header list.
Let self be the serialization of the origin retrieved via the environment settings object context.
Let conf, int, priv be the result of calling the parse labeled context metadata algorithm with metadata and self.
If either conf, int, or priv are null, return blocked.
Set the state context confidentiality label to conf.
Set the state context integrity label to int, if the state effective integrity label subsumes int.
Note, by performing the label subsumption check before setting the context privilege (next step), the context integrity label can be upgraded from the empty label, while allowing the context privilege to also be dropped.
Set the state context privilege to priv, if priv is a delegated privilege of the state context privilege.
Should the user agent warn the user if the server provided a privilege that it is not allowed to provide?
Enable confinement mode for state.
Let conf and int be the results of calling the parse labeled data metadata with metadata and self.
If either conf or int is null, return blocked and terminate this algorithm.
If the state effective confidentiality label subsumes conf and int subsumes the state effective integrity label, return allowed.
Note, COWL conservatively blocks a response that is potentially more confidential or less trustworthy than the context making the request. In future versions of COWL, certain responses (e.g., images) which are only not as trustworthy as the context integrity label may be allowed by the user agent.
Let label value be the label returned by calling the fromJSON() function with the directive value and self. If the function threw an exception, ignore this instance of the directive and continue to the next token.
If directive name is data-confidentiality and conf is null, let conf be label value.
Else, if directive name is data-integrity and int is null, let int be label value.
Else, ignore this instance of the directive and continue to the next token.
To make it easier for developers to debug applications, user agents SHOULD report the directives that were ignored.
If directive name is ctx-confidentiality and conf is null, let conf be label value.
Else, if directive name is ctx-integrity and int is null, let int be label value.
Else, if directive name is ctx-privilege and priv is null, let priv be a newly created privilege whose internal privilege label is set to label value.
Return conf, int, and priv.
Thanks to Dan Boneh, Brendan Eich, Brad Hill, Dave Herman, Bobby Holley, Brad Karp, Jonathan Kingston Petr Marchenko, David Mazières, Devon Rifkin, Alejandro Russo, and Brian Smith for influencing (directly or otherwise) the design of COWL and/or their comments on this document.

matches: §3 §1 §3 §3 §3 §3 §3 §3 §1 §3 §1 §3 §3 §4 §4 §3 §1


Plaintiff Christopher Salgado filed an adversary complaint against debtor-defendant David E. Lenoci, II, seeking a determination that a state court judgment debt for battery is not dischargeable under 11 U.S.C. § 523(a)(6). Salgado alleged that Lenoci struck him in the face with a baseball bat during a fight, while Lenoci claimed that someone else struck Salgado with a bicycle kickstand. At a bench trial, the Court admitted various documents into evidence and heard the testimony of Salgado, his brother, and Lenoci. After considering the evidence and testimony, the Court determined that the doctrine of issue preclusion did not bar Lenoci from disputing that he struck Salgado because: (1) Lenoci did not have a full and fair opportunity to be heard in the prior criminal and civil state court cases that arose from the same facts, and (2) the records from the prior suits lacked specific findings as to which issues had been actually litigated and determined. Turning to the merits of Salgado’s § 523(a)(6) claim, the Court found that Salgado and his brother were more credible than Lenoci. Thus, the Court accepted Salgado’s version of the story and found both that Lenoci injured Salgado and that Lenoci’s actions were willful and malicious. Accordingly, the Court concluded that the state court judgment debt was not dischargeable under § 523(a)(6).
Debtor George Burciaga filed an adversary complaint against chapter 7 trustee Alex D. Moglia, seeking a determination that certain severance pay is not property of the estate under 11 U.S.C. § 541(a)(1) but, rather, constitutes excluded post-petition earnings under 11 U.S.C. § 541(a)(6). The parties subsequently filed cross-motions for judgment on the pleadings. The Debtor argued that the severance pay is not property of the estate because his receipt of that pay was contingent on his execution of a separation agreement and his subsequent compliance with the post-petition conditions outlined therein. The Trustee argued that the severance pay is property of the estate because it is based on both the Debtor’s pre-petition employment and pre-petition termination from that employment. Applying the U.S. Supreme Court’s "sufficiently-rooted test" in Segal v. Rochelle, 382 U.S. 375 (1966), the Court found that the severance pay is both pre-petition property of the bankruptcy estate and post-petition earnings for services excluded therefrom and concluded that a fair allocation of the pay between the estate and the Debtor is 50/50. As such, the Court granted in part and denied in part both parties’ motions for judgment on the pleadings.
Plaintiffs Richard and Elizabeth Reuland (the “Reulands”) filed an adversary complaint against the Internal Revenue Service (the “IRS”), seeking (1) a determination that the IRS had violated the discharge injunction by attempting to collect certain tax debt that had been discharged through their chapter 13 bankruptcy case, (2) a permanent injunction against the IRS barring future attempts to collect that debt, and (3) attorney’s fees and costs. The IRS moved to dismiss the complaint pursuant to Federal Rule of Civil Procedure 12(b)(6) for failure to state a claim upon which relief can be granted because the tax debt at issue is not dischargeable pursuant to 11 U.S.C. §§ 1328(a)(2) and 523(a)(1)(B)(ii) (excepting from discharge debts for tax returns filed both late and less than two years before bankruptcy). The Reulands conceded that the tax debt was nondischargeable pursuant to those provisions. They argued, however, that under United Student Aid Funds, Inc. v. Espinosa, 559 U.S. 260 (2010), the tax debt at issue was discharged because their plan provided for the debt and the IRS failed to object to or appeal confirmation. In response, the IRS argued that Espinosa was inapplicable because the Reulands’ plan did not contain any specific language purporting to discharge the tax debt. After distinguishing Espinosa from the Reulands’ case and considering other cases with similar facts, the Court held that the tax debt at issue had not been discharged because it is nondischargeable under §§ 1328(a)(2) and 523(a)(1)(B) and the Reulands’ plan did not contain specific language that provided for the discharge of the debt. Thus, the Court granted the IRS’s motion, and dismissed the Reulands’ complaint with prejudice because, as a matter of law, it failed to state a claim upon which relief can be granted.
Raymond Michael Chuipek filed an adversary complaint against his former employer Scott C. Gilmore, seeking a determination that a debt owed to him by Gilmore by virtue of a state court judgment entered on a jury verdict was not dischargeable pursuant to § 523(a)(2)(6). Chuipek subsequently filed a motion for summary judgment, arguing that the questions answered by the jury were sufficient to meet the willful and malicious standard of § 523(a)(2)(6) and that, thus, Gilmore was precluded from re-litigating the factual issues decided in the state court under the doctrine of collateral estoppel. Gilmore contended that although the jury found in Chuipek’s favor, there was no finding of subjective intent to willfully and maliciously injure Chuipek. Therefore, Gilmore asserted, collateral estoppel could not be applied. Based on a close inspection of the entire state court record, the Court found that the facts necessarily implied by the jury’s verdict established that Gilmore’s conduct was willful and malicious and that it caused injury to Chuipek for purposes of § 523(a)(6). Accordingly, the Court concluded that the prior case presented the same issues and that collateral estoppel applied to the factual record in the nondischargeability action, thus barring Gilmore from relitigating the underlying facts decided in the state court case. As such, the Court granted Chuipek’s motion and entered judgment in his favor.
Plaintiff Tillman Enterprises, LLC (“Tillman”) filed a three-count adversary complaint against Todd S. Horlbeck (“Horlbeck”), seeking a determination that a debt owed to it by Horlbeck for alleged securities violations and fraud was not dischargeable pursuant to 11 U.S.C. §§ 523(a)(19), (a)(2)(A), and (a)(2)(B). After Tillman amended the complaint and Horlbeck’s motion to dismiss was denied, the parties’ filed cross-motions for summary judgment. No material facts were in dispute. Tillman argued that Horlbeck had violated securities laws by reporting inflated account values while managing a hedge fund in which Tillman had invested. In addition, Tillman alleged that Horlbeck misrepresented and omitted material information while the parties negotiated the settlement of those securities claims. Horlbeck admitted to reporting inaccurate values but contested whether Tillman could prove the requisite elements of its claims. After establishing that it had jurisdiction to determine liability for the violation of securities laws under § 523(a)(19), the Court found that Tillman had failed to prove that Horlbeck violated any securities laws. As such, the Court granted Horlbeck’s motion for summary judgment under § 523(a)(19) and denied Tillman’s cross-motion. Turning to §§ 523(a)(2)(A) and (a)(2)(B), the Court first found that Tillman could maintain claims under both subsections because they were based on separate alleged misrepresentations. On the merits, the Court found that Horlbeck had failed to disclose liabilities on a financial statement, and that he had misrepresented information about a regulatory investigation and his management of the hedge fund. Tillman, in turn, had relied on those misrepresentations and omissions while deciding to enter into a settlement agreement and extend credit under a promissory note. Thus, the Court found that the debt Horlbeck owes under the settlement agreement and promissory note is not dischargeable under §§ 523(a)(2)(A) and (a)(2)(B), granted Tillman’s motion for summary judgment, and entered judgment in its favor.
Plaintiff David R. Brown (the “Trustee”) filed an adversary complaint against Robert J. Ferrari (the “Debtor”), seeking a denial of the Debtor’s discharge pursuant to 11 U.S.C. §§ 727(a)(2)(A), (a)(3), and (a)(5). The Trustee argued that the Debtor was not entitled to a discharge because: (1) he transferred or removed equity in his home within one year of filing his bankruptcy petition with intent to hinder, delay, or defraud creditors by executing a junior mortgage on the home in favor of his friend; (2) he failed to keep or preserve books and records from which his financial condition could be ascertained; and (3) he failed to satisfactorily explain the loss or disposition of almost $250,000 that he allegedly borrowed from his friend. After conducting an evidentiary hearing, the Court found that, given the documentary evidence and testimony at trial, the Debtor’s records were inadequate to allow the Court, the Trustee, and the Debtor’s creditors to trace his financial dealings with any kind of accuracy and that the Debtor did not offer any reasonable justification for his failure to keep or preserve financial records. Thus, the Court held that that failure supported denial of the Debtor’s discharge under § 727(a)(3). The Court further found that the Debtor failed to provide a satisfactory explanation for the disposition of both the equity in his home and the loan proceeds from his friend. Accordingly, the Court also held that the Debtor was not entitled to a discharge pursuant to § 727(a)(5). Although the Court found that the removal of equity from the Debtor’s home was a transfer for purposes of § 727(a)(2)(A), the evidence did not sufficiently establish that the Debtor actually intended to defraud his creditors. As such, the Court did not find in the Trustee’s favor on the § 727(a)(2)(A) count of the complaint and, thus, that count was dismissed.
Plaintiff City of Chicago (the “City”) filed an adversary complaint against debtor Ronald Spielman (“Spielman”), seeking a determination that a debt owed to it by Spielman by virtue of a federal district court default judgment was not dischargeable pursuant to §§ 523(a)(2)(A) and (a)(7). The City subsequently filed a motion for summary judgment on both counts of its complaint. No material facts were in dispute. The City contended that the district court’s order for default judgment against Spielman under the City’s False Claims Ordinance precluded relitigation of the claims in the adversary proceeding due to principles of collateral estoppel. Spielman argued that because a default judgment was entered, the claims were not actually litigated and that, thus, collateral estoppel could not be applied against him. The Court found that the district court’s default judgment precluded further litigation of the claims because the district court made findings of fact, Spielman had a full and fair opportunity to litigate the claims, and, in fact, he did litigate the City’s final motion for default judgment, which was decided on its merits. Accordingly, the Court granted the City’s motion on both counts of the complaint and entered judgment in favor of the City.
Plaintiff Old Republic National Title Insurance Company (“Old Republic”) filed an adversary complaint against debtor Fares Fakhuri (“Fakhuri”), seeking a determination that a debt owed to it by Fakhuri by virtue of a state court judgment was not dischargeable pursuant to §§ 523(a)(2)(A) and (a)(2)(B). Old Republic subsequently filed a motion for summary judgment on both counts of its complaint. No material facts were in dispute. Old Republic contended that the state court made findings that Fakhuri committed fraud and that Fakhuri falsely represented that the title to his property was clear, while concealing the fact that there was a lien on the property. Fakhuri failed to contest these arguments. The Court found that the state court’s default judgment was not preclusive as it made no findings of fact, but that Old Republic established that Fakhuri made false representations in connection with the title to the property within the meaning of § 523(a)(2)(A). As §§ 523(a)(2)(A) and (a)(2)(B) are mutually exclusive causes of action, judgment could not also be granted as to § 523(a)(2)(B). Accordingly, the Court granted Old Republic’s motion as to the § 523(a)(2)(A) count, entered judgment on that count in its favor, and dismissed the § 523(a)(2)(B) count.
Jacob Thazhathuputhenpurac (the “Plaintiff”) filed an adversary complaint against former business partner Thomas Abraham (the “Debtor”), seeking a determination that a debt owed to him by the Debtor by virtue of a state court judgment was not dischargeable pursuant to §§ 523(a)(2)(A) and (a)(4) and objecting to the Debtor’s discharge under § 727(a)(3). Both parties subsequently filed cross-motions for summary judgment, the Plaintiff on the two nondischargeability counts and the Debtor on all three. No material facts were in dispute. The Plaintiff argued that the Debtor was precluded from re-litigating the factual issues decided by the state court under the doctrine of collateral estoppel. The Debtor contended that the elements needed to prevail pursuant to the statute under which the state court complaint had been brought were not identical to those required under §§ 523(a)(2)(A) and (a)(4) and that, thus, collateral estoppel was not applicable. The Court found that the factual issues sought to be precluded were the same as those that came before the state court for purposes of collateral estoppel and that the state court’s findings of fact established, as a matter of law, all of the elements required for nondischargeability under §§ 523(a)(2)(A) and (a)(4). Accordingly, the Court granted the Plaintiff’s motion, entered judgment in his favor, and denied the Debtor’s motion.
Plaintiffs Estate of Rose M. Drabik, Mary Elizabeth Smith, Mary Katherine Paul, and chapter 7 trustee Brenda Porter Helms (collectively, the “Plaintiffs”) filed an adversary complaint against James T. Drabik (the “Debtor”), seeking a denial of the Debtor’s discharge pursuant to 11 U.S.C. §§ 727(a)(3) and (a)(4). The Plaintiffs argued that the Debtor was not entitled to a discharge because he failed to keep or preserve information from which his financial condition could be ascertained and because he provided false, misleading, or inaccurate information in his initial bankruptcy petition, schedules, and statement of financial affairs. After conducting an evidentiary hearing, the Court found that, given the documentary evidence and testimony at trial, the Debtor’s records were inadequate to allow the Court, the trustee, and the Debtor’s creditors to trace his financial dealings with any kind of accuracy and that the Debtor did not offer any reasonable justification for his failure to keep or preserve financial records. Thus, the Court held that that failure supported denial of the Debtor’s discharge under 11 U.S.C. § 727(a)(3). The Court further found that the Plaintiffs established that the Debtor “made a false oath or account” by filing initial bankruptcy documents with misstatements and omissions and that, together, those misrepresentations established a pattern of reckless indifference to the truth. Accordingly, the Court also held that the Debtor was not entitled to a discharge pursuant to 11 U.S.C. § 727(a)(4)(A). Based on these findings, the Court entered judgment in favor of the Plaintiffs and against the Debtor and, as such, denied the Debtor’s discharge.


After the outcry witness became unavailable to testify at trial, did the trial court improperly admit the outcry witness’s testimony from a pretrial CCP art. 38.072 hearing?
Yes. The defendant did not have an adequate opportunity to cross-examine the outcry witness’s credibility at the pretrial hearing and admitting prior testimony from the unavailable witness violated the 6th Amendment. A pretrial hearing conducted under CCP art. 38.072, § 2(b)(2) is intended only to determine the reliability of the complainant’s out of court statement based on time, content, and circumstances of the statement. The fact finder at trial determines the credibility of the outcry witness.
This opinion does not decide that this particular Article 38.072, § 2 (b)(2) hearing was not sufficient to protect the defendant’s confrontation rights. Rather, the court has decided that all Article 38.072, § 2(b)(2) hearings will not be sufficient to protect a defendant’s confrontation rights. By so holding, the court has limited the scope of such a hearing. Thus, this decision is important, not only as a right-to-confrontation decision, but also as a decision on the proper way to view such a pretrial hearing. The court holds out the possibility that other pretrial hearings might be sufficient to protect a defendant’s confrontation rights, but I would not bet on it. Be very careful in relying upon testimony from such a pretrial hearing as a substitute for live testimony during the actual trial. This was clearly a very difficult case to try, and now it will be made even more difficult with the court’s holding.
Did the transaction need to be consummated to support a jury finding that the defendant “used” a debit card in violation of PC §32.31(b)(1) (debit card abuse)?
No. The defendant used the card when it was swiped through the card reader. The statutory terms “use” and “present” in PC §32.31(b)(1) may overlap in meaning in that a person may both use and present a debit card in the same conduct. Definitions of these terms do not depend on whether the defendant obtained a benefit. The plain language of the statute requires that an individual need only have utilized the card for the intended purpose of obtaining a benefit.
Judge Price agreed with the majority that “use” was not intended to require proof of acquisitive conduct, but regarded PC §32.31(b)(1) as ambiguous. He explained the difficulty of differentiating “use” and “present” in a way to give independent significance to both terms.
This should be a very helpful decision in confronting claims that words should be given very restrictive meanings. The bottom line is that a suspect can “use” a credit or debit card, even though the transaction does not go through.
Did the trial incorrectly dismiss the indictment on the grounds that a 23-year delay between the murder and the indictment violated the defendant’s right to due process?
Yes. The defendant has the burden of proving both prejudice and that an intentional delay was designed to give the State a tactical advantage. Absent proof of an improper purpose, the simple fact that a lengthy delay has occurred for no other reason than a difference of opinions amongst prosecutors does not violate due process.
The facts of this case may not come up very often. In many “cold cases,” a defendant has been indicted early on, and he can make a speedy trial claim. In this case, the defendant could not make a speedy trial claim because she was not indicted until the State ultimately decided to prosecute. Good for the court to nail down that a defendant must show some sort of bad faith or bad intent on the part of the State before she can prevail on this type of due process claim.
Did the trial court wrongly grant expunctions in cases evolving from a single arrest that charged DWI and assault of a public servant?
Yes. The plain language of the former expunction statute only speaks to expunging the records relating to an arrest—not to individual records relating to a charge arising from an arrest—and the assault charge had not been dismissed, so the defendant did not qualify for an expunction.
This is a well-reasoned and thoroughly researched decision. But Article 55.01 has changed substantially from the version that was applicable in this case, so it is important that you look to the new wording of the current statute if the current version of the statute applies to your case.
Under the federal and state constitutions, is the offense of improper photography or visual recording (PC §21.15(b)(1)) facially unconstitutional or overbroad and vague?
No. The state constitutional claims are forfeited. Also, (1) the statute is not a regulation of speech or expression but rather of the intent of the photographer and therefore does not violate the 1st Amendment; (2) the statute does not restrict a substantial amount of constitutionally protected speech and therefore is not overbroad; and (3) the statute is sufficiently definite to avoid impinging on 1st-Amendment freedoms, to avoid the possibility of arbitrary arrests and convictions, and to provide fair notice of the conduct proscribed, and therefore is not vague.
With the advent of new technology, this type of crime is going to become more and more common. So it is good that we have a decision that does a good job of defeating these common constitutional claims. This was a pretrial attack on the constitutionality of the statute, so we do not know the facts of the case. But one wonders how any defendant would have any real constitutional defense to such conduct.
May a county bail bond board enact a rule that restricts a bail bond licensee from employing an individual who is currently on probation or parole, or who is the defendant in a pending criminal case?
No. The rule exceeds the authority of the board because it impermissibly imposed requirements additional to and in conflict of Occupations Code §1704.302(c).
Well, it appears that the statute should be changed then to allow a bail bond board to exclude such individuals from employment by a bondsman. It does not make much sense that a bail bond board would have no authority whatsoever to restrict the employment of a probationer, parolee, or current criminal defendant.


Appellant, an Ohio corporation owning and operating department stores in Ohio and maintaining there private warehouses where it stores stocks of merchandise to be sold in its stores, challenged in the Ohio courts the validity of an ad valorem state tax on the contents of its warehouses. It claimed that it was denied the equal protection of the laws guaranteed by the Fourteenth Amendment because Ohio exempted from such taxation merchandise belonging to nonresidents "if held in a storage warehouse for storage only." The trial court sustained the tax. The State Supreme Court held that appellant lacked standing to raise this constitutional question and affirmed the judgment.
1. Appellant had standing to prosecute its constitutional claim. Pp. 358 U. S. 525-526.
2. The exemption from taxation of merchandise belonging to a nonresident when "held in a storage warehouse for storage only" did not deny to appellant, a resident of the State, the equal protection of the laws guaranteed by the Fourteenth Amendment. Wheeling Steel Corp. v. Glander, 337 U. S. 562, distinguished. Pp. 358 U. S. 526-530.
166 Ohio St. 116,140 N. E. 2d 411, affirmed.
. . . if held in a storage warehouse for storage only" denies to appellant, a resident of the State, the equal protection of the laws guaranteed by the Fourteenth Amendment of the Constitution.
The facts are stipulated. So far as pertinent, they are that appellant, Allied Stores of Ohio, Inc., an Ohio corporation, owns and operates a department store in each of four Ohio cities. It also maintains in each of those cities a private warehouse where it stores stocks of merchandise of the kinds sold in its stores. As needed, merchandise is transferred from the warehouse to the store, and when merchandise is sold by sample in the store -- usually a heavy or bulky article -- it is delivered from the warehouse directly to the customer.
"As used in Title LVII of the Revised Code:"
"(A) Personal property is 'used' within the meaning of 'used in business' . . . when stored or kept on hand as material, parts, products, or merchandise; but merchandise or agricultural products belonging to a nonresident of this state is not used in business in this state if held in a storage warehouse for storage only. . . . [Footnote 1]"
lacked standing to raise the constitutional question presented and affirmed the judgment. 166 Ohio St. 116, 140 N.E.2d 411. The case comes here on Allied's appeal.
"[w]hether a pleading sets up a sufficient right of action or defense, grounded on the Constitution or a law of the United States is necessarily a question of federal law, and where a case coming from a state court presents that question, this court must determine for itself the sufficiency of the allegations displaying the right or defense, and is not concluded by the view taken of them by the state court."
First National Bank of Guthrie Center v. Anderson, 269 U. S. 341, 269 U. S. 346; Staub v. City of Baxley, 355 U. S. 313, 355 U. S. 318.
"In our opinion, it is not necessary to consider the constitutional question raised by the taxpayer in the instant case, because, if its contention with regard to that question is sound, it necessarily leads to the conclusion that the entire proviso in subdivision (A) of Section 5701.08, which read"
"but merchandise or agricultural products belonging to a nonresident of this state is not used in business in this state if held in a storage warehouse for storage only,"
this, the court was following its prior decisions on the question. General Cigar Co. v. Peck, 159 Ohio St. 152, 111 N.E.2d 265 (1953), and B. F. Goodrich Co. v. Peck, 161 Ohio St. 202, 118 N.E.2d 525 (1954), had so held. In the latter case, the court had answered a contention that the proviso was invalid for undue preference of nonresidents by saying 'such an argument should be addressed to the General Assembly, and not to this court.' 161 Ohio St. at 210, 118 N.E.2d at 530. Those interpretations, for present purposes, became a part of the proviso. Wheeling Steel Corp. v. Glander, 337 U. S. 562, 337 U. S. 566. The proviso is the basis of appellant's claim of denial of the equal protection of the laws. With the proviso thus validly remaining in the statute, it is quite immaterial that appellant's claim necessarily would fall if it were out. It follows that appellant does have standing to prosecute its constitutional claim."
State may impose different specific taxes upon different trades and professions, and may vary the rate of excise upon various products. It is not required to resort to close distinctions or to maintain a precise, scientific uniformity with reference to composition, use or value. Bell's Gap R. Co. v. Pennsylvania, 134 U. S. 232, 134 U. S. 237; Magoun v. Illinois Trust & Savings Bank, 170 U. S. 283, 170 U. S. 293; Southwestern Oil Co. v. Texas, 217 U. S. 114, 217 U. S. 121; Brown-Forman Co. v. Kentucky, 217 U. S. 563, 217 U. S. 573; Sunday Lake Iron Co. v. Wakefield, 247 U. S. 350, 247 U. S. 353; Heisler v. Thomas Colliery Co., 260 U. S. 245, 260 U. S. 255; Oliver Iron Mining Co. v. Lord, 262 U. S. 172, 262 U. S. 179; Stebbins v. Riley, 268 U. S. 137, 268 U. S. 142; Ohio Oil Co. v. Conway, 281 U. S. 146, 281 U. S. 159; State Board of Tax Comm'rs of Indiana v. Jackson, 283 U. S. 527, 283 U. S. 537.
"To hold otherwise would be to subject the essential taxing power of the State to an intolerable supervision, hostile to the basic principles of our government and wholly beyond the protection which the general clause of the Fourteenth Amendment was intended to assure."
Ohio Oil Co. v. Conway, supra, 281 U.S. at 281 U. S. 159.
But there is a point beyond which the State cannot go without violating the Equal Protection Clause. The State must proceed upon a rational basis, and may not resort to a classification that is palpably arbitrary. The rule often has been stated to be that the classification "must rest upon some ground of difference having a fair and substantial relation to the object of the legislation." F. S. Royster Guano Co. v. Virginia, 253 U. S. 412, 253 U. S. 415; Louisville Gas & Electric Co. v. Coleman, 277 U. S. 32, 277 U. S. 37; Air-Way Electric Appliance Corp. v. Day, 266 U. S. 71, 266 U. S. 85; Schlesinger v. Wisconsin, 270 U. S. 230, 270 U. S. 240; Ohio Oil Co. v. Conway, 281 U. S. 146, 281 U. S. 160.
"If the selection or classification is neither capricious nor arbitrary, and rests upon some reasonable consideration of difference or policy, there is no denial of the equal protection of the law."
Co v. Kentucky, 217 U. S. 563, 217 U. S. 573. State Board of Tax Comm'rs of Indiana v. Jackson, 283 U. S. 527, 283 U. S. 537. That a statute may discriminate in favor of a certain class does not render it arbitrary if the discrimination is founded upon a reasonable distinction, or difference in state policy. American Sugar Refining Co. v. Louisiana, 179 U. S. 89; Stebbins v. Riley, 268 U. S. 137, 268 U. S. 142.
Coming directly to the concrete problem now before us, it has repeatedly been held and appears to be entirely settled that a statute which encourages the location within the State of needed and useful industries by exempting them, though not also others, from its taxes is not arbitrary, and does not violate the Equal Protection Clause of the Fourteenth Amendment. Bell's Gap R. Co. v. Pennsylvania, supra, 134 U.S. at 134 U. S. 237; Ohio Oil Co. v. Conway, 281 U.S. at 281 U. S. 159; Williams v. Baltimore, 289 U. S. 36; Colgate v. Harvey, 296 U. S. 404, 296 U. S. 439 (dissenting opinion). Similarly, it has long been settled that a classification, though discriminatory, is not arbitrary nor violative of the Equal Protection Clause of the Fourteenth Amendment if any state of facts reasonably can be conceived that would sustain it. Lindsley v. Natural Carbonic Gas Co., 220 U. S. 61, 220 U. S. 78; Quong Wing v. Kirkendall, 223 U. S. 59; Rast v. Van Deman & Lewis Co., 240 U. S. 342, 240 U. S. 357; State Board of Tax Comm'rs of Indiana v. Jackson, 283 U.S. at 283 U. S. 537.
been the purpose and policy of the State Legislature, in adopting the proviso, to encourage the construction or leasing and operation of warehouses in Ohio by nonresidents, with the attendant benefits to the State's economy, or to stimulate the market for merchandise and agricultural products produced in Ohio by enabling nonresidents to purchase and hold them in the State for storage only, free from taxes, in anticipation of future needs. Other similar purposes reasonably may be conceived. Therefore, we cannot say that the discrimination of the proviso which exempted only the "merchandise or agricultural products belonging to a nonresident . . . if held in a storage warehouse for storage only" was not founded upon a reasonable distinction, or difference in state policy, or that no state of facts reasonably can be conceived to sustain it. For those reasons, it cannot be said, in the light of the settled law as shown by the cases cited, that the questioned proviso was invidious or palpably arbitrary and denied appellant the equal protection of the laws within the meaning of the Fourteenth Amendment.
"the inequality [was] not because of the slightest difference in Ohio's relation to the decisive transaction, but solely because of the different residence of the owner."
337 U.S. at 337 U. S. 572. As we have shown, that is not the situation here. Here, the discrimination against residents is not invidious nor palpably arbitrary, because, as shown, it rests not upon the "different residence of the owner," but upon a state of facts that reasonably can be conceived to constitute a distinction, or difference in state policy, which the State is not prohibited from separately classifying for purposes of taxation by the Equal Protection Clause of the Fourteenth Amendment.
MR. JUSTICE STEWART took no part in the consideration or decision of this case.
"and merchandise or agricultural products shipped from outside of this state and held in this state in a warehouse or a place of storage for storage only and for shipment outside of this state are not used in business in this state."
126 Ohio Laws, p. 78.
"by taking the amount in value on hand, as nearly as possible, in each month of the next preceding year in which he has been engaged in business, adding together such amounts, and dividing the aggregate amount by the number of months that he has been in business during such year."
Title 57, Page's Ohio Rev.Code Ann.1953, § 5711.15.
The Supreme Court of Ohio has held that a foreign corporation, although authorized to do and doing a local business in Ohio, is a nonresident within the meaning of the proviso here in question. B. F. Goodrich Co. v. Peck, 161 Ohio St. 202, 204, 118 N.E.2d 525, 527.
"[was] that intangibles of nonresident owners [were] assigned a situs within the taxing reach of Ohio while those of its residents [were] assigned a situs without. [Thus], [t]he exempted intangibles of residents [were] offered up to the taxing power of other states which may embrace this doctrine of a tax situs separate from residence, [but] no other state [ever] sought to take advantage of the 'reciprocity' proffer."
Wheeling Steel Corp. v. Glander, supra, 337 U.S. at 337 U. S. 573-574.
MR. JUSTICE BRENNAN, with whom MR. JUSTICE HARLAN joins, concurring.
cannot reach that conclusion without developing the ground on which Wheeling is distinguishable.
Why is the "different residence of the owner" a constitutionally valid basis for Ohio's freeing the property of the foreign corporation from the tax in this case, and an invalid basis for its freeing the property of the domestic corporation from the tax involved in the Wheeling case?
I think that the answer lies in remembering that our Constitution is an instrument of federalism. The Constitution furnishes the structure for the operation of the States with respect to the National Government and with respect to each other. The maintenance of the principles of federalism is a foremost consideration in interpreting any of the pertinent constitutional provisions under which this Court examines state action. Because there are 49 States, and much of the Nation's commercial activity is carried on by enterprises having contacts with more States than one, a common and continuing problem of constitutional interpretation has been that of adjusting the demands of individual States to regulate and tax these enterprises in light of the multistate nature of our federation. While the most ready examples of the Court's function in this field are furnished by the innumerable cases in which the Court has examined state taxation and regulation under the Commerce and Due Process Clauses, still the Equal Protection Clause, among its other roles, operates to maintain this principle of federalism.
an ad valorem property tax, Wheeling teaches that a distinction which burdens the property of nonresidents but not like property of residents is outside the constitutional pale. But this is not because no rational ground can be conceived for a classification which discriminates against nonresidents solely because they are nonresidents: could not such a ground be found in the State's benign and beneficent desire to favor its own residents, to increase their prosperity at the expense of outlanders, to protect them from, and give them an advantage over, "foreign" competition? These bases of legislative distinction are adopted in the national policies of too many countries, including from time to time our own, to say that, absolutely considered, they are arbitrary or irrational. The proper analysis, it seems to me, is that Wheeling applied the Equal Protection Clause to give effect to its role to protect our federalism by denying Ohio the power constitutionally to discriminate in favor of its own residents against the residents of other state members of our federation. On the other hand, in the present case, Ohio's classification based on residence operates against Ohio residents, and clearly presents no state action disruptive of the federal pattern. There is, therefore, no reason to judge the state action mechanically by the same principles as state efforts to favor residents. As my Brethren's opinion makes clear, a rational basis can be found for this exercise by Ohio of the latitude permitted it to define classifications under the Equal Protection Clause. One could, in fact, be found in the concept that it is proper that those who are bound to a State by the tie of residence and accordingly the more permanently receive its benefits are proper persons to bear the primary share of its costs. Accordingly, in this context, it is proper to say that any relief forthcoming must be obtained from the State Legislature.
To the same effect as the Wheeling case are Southern R. Co. v. Greene, 216 U. S. 400, and Hanover Fire Ins. Co. v. Harding, 272 U. S. 494.
The Court distinguished ad valorem property taxes, levied on a foreign corporation permitted to do a local business, from an original entry privilege tax on a foreign corporation. 337 U.S. at 337 U. S. 571-572.
"A corporation which is allowed to come into a state and there carry on its business may claim, as an individual may claim, the protection of the Fourteenth Amendment against a subsequent application to it of state law."
Connecticut General Life Ins. Co. v. Johnson, 303 U. S. 77, 303 U. S. 79-80.
The statute in Wheeling "discriminated" against nonresidents in the same way that the present statute "discriminates" against residents. What my Brethren describe as the forbidden purpose of the distinction in Wheeling seems to me clearly to be only a rejected argument made by the State to show that there was no discrimination in fact. 337 U.S. at 337 U. S. 572-574. I see no indication in Wheeling that the Court's condemnation of the tax was based solely on its rejection of the "reciprocity" argument.