Tobias Mahler

• Mahler, Tobias & Solhaug, Bjørnar (2016). En konseptuell modell for ugyldighet, I: Erling Johan Hjelmeng (red.),  Ugyldighet i privatretten - minnebok for Viggo Hagstrøm.  Fagbokforlaget.  ISBN 978-82-450-1808-0.  Kapittel.  s 307 - 335
• McGillivray, Kevin; Esayas, Samson Yoseph & Mahler, Tobias (2016). Is a Picture Worth a Thousand Terms? Visualising Contract Terms and Data Protection Requirements for Cloud Computing Users. Lecture Notes in Computer Science.  ISSN 0302-9743.  9881, s 39- 56 . doi: 10.1007/978-3-319-46963-8_4 Vis sammendrag

  The following article evaluates two models for providing purchasers of online digital content, including cloud computing services, with visual notice of contract terms and data collection practises. Visualisation of contract terms and privacy policies has the potential to provide cloud consumers with an improved means of understanding the contract terms they are accepting when entering into an agreement with a Cloud Service Provider (CSP). The following paper examines two concrete proposals or models for the visualisation of contract terms and privacy practises as compliance tools in the European context. The article focuses primarily on consumer and data protection law. Although the visualisation models are not currently binding or legally required, they start an important conversation on how such terms can be more effectively conveyed.

• Blandhol, Sverre & Mahler, Tobias (2015). Advokaten i fremtiden, I: Sigurd Knudtzon (red.),  Å være advokat.  Universitetsforlaget.  ISBN 9788215025230.  Artikkel.  s 24 - 60
• Esayas, Samson Yoseph & Mahler, Tobias (2015). Modelling compliance risk: a structured approach. Artificial Intelligence and Law.  ISSN 0924-8463.  23(3), s 271- 300 . doi: 10.1007/s10506-015-9174-x Vis sammendrag

  This article presents a structured and systematic approach for identifying and modelling compliance risks. The sophistication with which modern business is carried out and the unprecedented access to a global market means that businesses are exposed to increasing and diverse regulatory requirements in and across jurisdictions. Compliance with such requirements is practically challenging, partly due to the complexity of regulatory environments. One possibility in this regard is a risk-based approach to compliance, where resources are allocated to those compliance issues that are most risky. Despite the need for risk-based compliance, few specific methods and techniques for identifying and modelling compliance risks have been developed. Due to the lack of methodological and tool support, compliance risk identification often involves unstructured brainstorming, with uncertain outcomes. The proposed approach consists of a five-step process for the structured identification and assessment of compliance risks. This process aims at facilitating the identification of compliance risks and their documentation in a consistent and reusable fashion. As part of the process, the article provides a systematic approach for a graphical modelling of compliance risks, which aims at facilitating communication among experts from different backgrounds. The creation of graphical models can be partly automated based on natural language patterns for regulatory requirements. Furthermore, the structuring of the compliance requirement in a template aims at simplifying the modelling of compliance risks and facilitating a potential future automated model.

• Esayas, Samson Yoseph; Mahler, Tobias; Seehusen, Fredrik; Bjørnstad, Frode & Brubakk, Veda (2015). An integrated method for compliance and risk assessment, In Pierangela Samarati & Guevara Noubir (ed.),  2015 IEEE Conference on Communications and Network Security (CNS), Florence, 28-30 September, 2015.  IEEE conference proceedings.  ISBN 978-1-4673-7876-5.  Artikkel.  s 568 - 576 Vis sammendrag

  This paper presents an integrated method for risk and compliance assessment and its evaluation in a case study. The sophistication with which modern business is carried out and the unprecedented access to a global market means that businesses are exposed to diverse regulatory requirements in and across jurisdictions. Compliance with such requirements is practically challenging, partly due to the complexity of regulatory environments. One possibility in this regard is a riskbased approach to compliance where resources are allocated to those compliance issues that are most risky. Despite the need for risk-based compliance, few specific methods and techniques for identifying and modeling compliance risks have been developed. The lack of methodological and tool support means the compliance risk identification often involves unstructured brainstorming, with uncertain outcomes. As part of the integrated method, a structured approach for the identification of compliance risks and their graphical modelling is provided. The main goal of the structured approach is to facilitate the identification and assessment of compliance risks and their subsequent documentation in a consistent and reusable fashion. The method is applied in a case study with the aim of assessing the compliance concerns in adopting cloud services. Our experience in the case study demonstrates that the integrated method enables a better structuring in the identification of compliance risks and yields reusable results. As well, the method facilitates communication among different expertise and mitigates subjectivity in making compliance decisions.

• Mahler, Tobias (2014). A gTLD right? Conceptual challenges in the expanding internet domain namespace. International Journal of Law and Information Technology.  ISSN 0967-0769.  22(1), s 27- 48 . doi: 10.1093/ijlit/eat018
• Mahler, Tobias (2014). Assessing Legal Risks of Closed Generic Top-Level Domains. European Journal of Law and Technology.  ISSN 2042-115X.  5(3)
• Mahler, Tobias (2014). Rechtsansprüche auf generische Top-Level Domains (gTLDs) nach der Marktliberalisierung - Eine kritische Untersuchung zentraler Begriffe des Domainnamensrechts. Juridikum (Wien).  ISSN 1019-5394.  (4), s 522- 532
• Mahler, Tobias (2013). A Graphical User-Interface for Legal Texts?, In Dan Jerker B. Svantesson & Stanley Greenstein (ed.),  Internationalisation of Law in the Digital Information Society: Nordic Yearbook of Law and Informatics 2010–2012.  Ex Tuto Publishing.  ISBN 978-87-92598-22-6.  Chapter.  s 311 - 327
• Mahler, Tobias (2013). Governance Models for Interoperable Electronic Identities. Journal of International Commercial Law and Technology.  ISSN 1901-8401.  8(2), s 148- 159 Vis sammendrag

  Current implementations of electronic identity in Europe are rather diverse; they include state-driven identity management frameworks as well as private sector frameworks and different forms of public-private collaborations. This diversity may represent a major challenge for the deployment of information society services addressed towards the European internal market. This raises the question: How can we achieve interoperability of electronic identities across Europe, and potentially beyond Europe’s borders? This paper argues that the interoperability of electronic identity could be governed by a multi-stakeholder governance framework that brings together different parties with interests in the provision and use of electronic identities. Such a governance framework could, for example, consist in designing and operating a portal with common functionalities that allows interoperable authentication across multiple domains and contexts. Inspiration for the governance of such a portal could come both from existing successful implementations of electronic identity and from multi-stakeholder institutions that have proven useful in Internet governance.

• Mahler, Tobias (2012). Die Durchsetzbarkeit von Schranken-Schranken der Internetfreiheit, I: Wolfgang Kleinwächter (red.),  Grenzen der Internetfreiheit. MIND Multistakeholder Internet Dialog. CO:LLABORATORY DISCUSSION PAPER SERIES NO. 1, #3.  Internet & Gesellschaft Co:llaboratory.  ISBN 978-3-9503139-6-3.  Replik.  s 69 - 72
• Jøsang, Audun; Fritsch, Lothar & Mahler, Tobias (2010). Privacy Policy Referencing. Lecture Notes in Computer Science.  ISSN 0302-9743.  6264, s 129- 140 Vis sammendrag

  Data protection legislation was originally defined for a context where personal information is mostly stored on centralized servers with limited connectivity and openness to 3rd party access. Currently, servers are connected to the Internet, where a large amount of personal information is continuously being exchanged as part of application transactions. This is very different from the original context of data protection regulation. Even though there are rather strict data protection laws in an increasing number of countries, it is in practice rather challenging to ensure an adequate protection for personal data that is communicated on-line. The enforcement of privacy legislation and policies therefore might require a technological basis, which is integrated with adequate amendments to the legal framework. This article describes a new approach called Privacy Policy Referencing, and outlines the technical and the complementary legal framework that needs to be established to support it.

• Jøsang, Audun; Fritsch, Lothar & Mahler, Tobias (2010). Privacy Policy Referencing, In Sokratis K. Katsikas; Javier Lopez & Miguel Soriano (ed.),  TrustBus, Trust, Privacy and Security in Digital Business, 7th International Conference, TrustBus 2010, Bilbao, Spain, August 30-31, 2010. Proceedings, Lecture Notes in Computer Science 6264.  Springer.  ISBN 978-3-642-15151-4.  Conference Paper.
• Mahler, Tobias & Ranheim, Malin Renate (2010). Datalagringsdirektivet og den tyske grunnloven. Lov & Data.  ISSN 0800-7853.  (102), s 19- 23
• Mahler, Tobias; Ranheim, Malin Renate & Cojocarasu, Dana Irina (2010). Hvordan vurderer nasjonale domstoler datalagringsdirektivet opp mot grunn- og menneskerettigheter?, I: Dag Wiese Schartum (red.),  Overvåking i en rettsstat.  Fagbokforlaget.  ISBN 978-82-450-1048-0.  Kapittel 7.  s 149 - 166 Vis sammendrag

  Datalagringsdirektivet har vært omdiskutert helt siden det første forslaget ble fremmet. Et sentralt punkt for direktivets motstandere er at det strider mot menneskerettighetene i den europeiske menneskerettighetskonvensjonen (EMK) og respektive grunnrettighetskataloger i nasjonale forfatninger. I skrivende stund er direktivets fremtid åpen. EU skal evaluere direktivet, og mens noen land fortsatt diskuterer om og eventuelt hvordan direktivet skal gjennomføres, har andre land allerede fått prøvd sine datalagringslover for domstolene. På nåværende tidspunkt har verken den europeiske menneskerettighetsdomstolen i Strasbourg, (EMD) eller EU domstolen i Luxemburg, (EUD) tatt stilling til om direktivet eller datalagringslovene strider mot menneskerettighetene. Denne artikkelen omhandler tre dommer fra henholdsvis Bulgaria, Romania og Tyskland, som alle har erklært de respektive nasjonale lovene for grunnlovsstridige. Vi er ikke kjent med saker der datalagringslover har blitt prøvet uten at den respektive domstolen har funnet brudd med menneskerettighetene. Til tross for at domstolenes argumentasjon kretser rundt direktivets gjennomføring i nasjonalt rett, har de fleste av argumentene i disse dommene en overføringsverdi på flere plan. For det første kan de brukes som en veiledning for eventuelt å gjennomføre direktivet på en måte som ikke strider mot menneskerettighetene. Dette forutsetter imidlertid at man, som i den tyske dommen, mener at det i det hele tatt er mulig å gjennomføre direktivet uten å krenke retten til privatliv etter EMK art 8. Alternativt kan argumentene i dommene få betydning dersom andre lands datalagringslover blir et tema ved en nasjonal eller europeisk domstol. Og for det tredje vil EUs evaluering av direktivet også måtte ta stilling til hvorvidt direktivets virkeområde bør utvides for å inkludere teknologier og bruksmåter (for eksempel sosiale medier) som per i dag ikke er direkte omfattet av lagringsplikten. På denne bakgrunn mener vi det er av interesse å sammenligne de sentrale argumentene fra de tre dommene og analysere overføringsverdien, bl.a. i lys av EMDs rettspraksis.

• Mahler, Tobias (2009). Una definición de riesgo legal. Foro de Derecho Mercantil: Revista Internacional.  ISSN 1794-0427.  (22), s 78- 113
• Arenas, A; Wilson, M; Crompton, S; Mahler, Tobias; Schubert, L & Cojocarasu, Dana Irina (2008). Bridging the gap between legal and technical contracts. IEEE Internet Computing.  ISSN 1089-7801.  12
• Mahler, Tobias (2008). The State of the Art of Contractual Risk Management Methodologies, In Helena Haapio (ed.),  A Proactive Approach to Contracting and Law.  Turku University Applied Sciences.  ISBN 9789522160171.  Proactive/Preventive Law and Proactive Contracting: Theory and Practice.  s 57 - 74
• Mahler, Tobias & Olsen, Thomas (2007). Reputation Systems and Data Protection Law, In Nimma Sudarashan (ed.),  Data Privacy and Protection : Issues and Perspectives.  The Icfai University Press.  ISBN 81-314-1375-6.  Chapter 2.  s 38 - 51
• Olsen, Thomas & Mahler, Tobias (2007). Identity management and data protection law: Risk, responsibility and compliance in "Circles of Trust". Computer Law and Security Review.  ISSN 0267-3649.  23(4& 5) . doi: 10.1016/j.clsr.2007.05.009 Vis sammendrag

  Today, we are expected to remember a different user name and password for almost every organisation or domain we want to access on the Internet. Identity management seeks to solve this problem by making digital identities transferable across organisational boundaries. The basic idea is that the participating organisations will set up a collaboration (or circle of trust), which involves both identity providers and other service providers. However, there is a risk that identity management may reduce the users' level of privacy: can the collaborating organisations collect personal information and create a profile which includes the user's interaction with all collaborators? Who is responsible for the processing of personal data if many organisations collaborate? How can the user make informed decisions and consent to the processing of his data? This article seeks to address these issues from the perspective of European data protection law. The paper is split into two parts. This is part I, which introduces and analyses identity management with a focus on technical issues and risks to privacy. Part II will concentrate on data protection law, addressing the roles and responsibilities of collaborators and will analyse how to ensure a compliant interaction with the end-user.

• Olsen, Thomas; Mahler, Tobias; Seddon, Clive; Cooper, Vicky; Williams, Sarah; Valdes, Miguel & Arias, Sergio Morales (2007). Privacy & Identity Management : Data Protection Issues in Relation to Networked Organisations Utilizing Identity Management Systems. Complex.  ISSN 0806-1912.  (4) Vis sammendrag

  Today, we are expected to remember a different user name and password for almost every organisation or domain we want to access on the Internet. Identity management seeks to solve this problem by making digital identities transferable across organisational boundaries. The basic idea is that the participating organisations will set up a collaboration (or circle of trust) which involves both identity providers and other service providers. However, there is a risk that identity management may reduce the users' level of privacy: Can the collaborating organisations collect personal information and create a profile which includes the user's interaction with all collaborators? Who is responsible for the processing of personal data if many organisations collaborate? How can the user make informed decisions and consent to the processing of his data? This report seeks to address these issues from the perspective of European data protection law.

• Vraalsen, Fredrik; Mahler, Tobias; Lund, Mass Soldal; Hogganvik, Ida; den Braber, Folker & Stølen, Ketil (2007). Assessing Enterprise Risk Level : the CORAS Approach, In Djamel Khadraoui & Francine Herrmann (ed.),  Advances in Enterprise Information Technology Security.  IGI Global.  ISBN 978-1-59904-090-5.  Chapter XVIII.  s 311 - 333
• Mahler, Tobias & Vraalsen, Fredrik (2006). Legal Risk Management for an E-Learning Web Services Collaboration. Complex.  ISSN 0806-1912.  (3), s 503- 523
• Bing, Jon & Mahler, Tobias (2006). Contractual Risk Management in an ICT Context Searching for a Possible Interface between Legal Methods and Risk Analysis, In Olav Torvund & Kirsti Pettersen (ed.),  Yulex 2006.  Unipub forlag.  ISBN 82-7226-100-6.  Artikkel.  s 117 - 138
• Mahler, Tobias & Bing, Jon (2006). Contractual risk management in an ICT context searching for a possible interface between legal methods and risk analysis. Scandinavian Studies in Law.  ISSN 0085-5944.  49, s 339- 357
• Vraalsen, Fredrik; Lund, Mass Soldal; Mahler, Tobias; Parent, Xavier & Stølen, Ketil (2005). Specifying legal risk scenarios using the CORAS threat modelling language - Experiences and the way forward. Lecture Notes in Computer Science.  ISSN 0302-9743.  3477
• Mahler, Tobias & Olsen, Thomas (2004). Reputation Systems and Data Protection Law, In Paul Cunningham & Miriam Cunningham (ed.),  eAdoption and the Knowledge Economy : Issues, Applications, Case Studies.  IOS Press.  ISBN 1-58603-470-7.  Kapittel.  s 180 - 187

Se alle arbeider i Cristin

• McGillivray, Kevin; Esayas, Samson Yoseph & Mahler, Tobias (2016). Give Me a Sign: Expressing Contract Terms and Data Protection Requirements Visually in Cloud Computing. Senter for Rettsinformatikk.  ISBN 9788272261428.  20 s.

Se alle arbeider i Cristin

• Esayas, Samson Yoseph; Mahler, Tobias & Solhaug, Bjørnar (2015). An Integrated Approach for Compliance and Security Risk Assessment. Lov & Data.  ISSN 0800-7853.  121, s 32- 35 Vis sammendrag

  Organizations that rely on ICT infrastructures need to maintain a high level of information security and protection from cyber-attacks. This is not only due to the self-interest of protecting business critical infrastructures; it is also due to laws that deal with information security. For this reason, technical and legal risks often need to be understood in combination. The RASEN project proposes an approach to integrate compliance and security risk assessment.

• Mahler, Tobias (2015). Desafíos de la Privacidad Digital (panel).
• McGillivray, Kevin; Esayas, Samson Yoseph & Mahler, Tobias (2015). Using Technology to Enhance Confidentiality and Regulatory Compliance by Design. Lov & Data.  ISSN 0800-7853.  123(3), s 21- 24
• Weitzenboeck, Emily Mary; Mahler, Tobias & Jones, Andrew J.I. (2015). Introduction. Artificial Intelligence and Law.  ISSN 0924-8463.  23(3), s 197- 199 . doi: 10.1007/s10506-015-9171-0
• Mahler, Tobias (2014). New Generic Top Level Domains: Legal and Economic Issues.
• Mahler, Tobias (2014). Visualisation of legal norms, In  Jon Bing: En Hyllest/A Tribute.  Gyldendal Norsk Forlag A/S.  ISBN 9788205468504.  Chapter.  s 137 - 153
• Mahler, Tobias (2013). New gTLD Agreement.
• Mahler, Tobias (2013). Public Policy Issues Regarding New Generic Top Level Domains.
• Mahler, Tobias (2013). Vurdering av personvernkonsekvenser -- Privacy Impact Assessment.
• Mahler, Tobias (2013). eSociety Legal Issues.
• Mahler, Tobias (2012). A Graphical User Interface for Legal Texts?.
• Mahler, Tobias (2012). Criteria for Assessing ICANN’s New TLD Program.
• Mahler, Tobias (2012). From Delegation to Allocation: On the Law and Economics of gTLD Policy.
• Mahler, Tobias (2012). Internet Governance and new gTLDs.
• Mahler, Tobias (2012). Managing legal risks of new gTLDs.
• Mahler, Tobias (2012). New top-level domains: Regulatory issues, dispute resolution and rights protection.
• Mahler, Tobias (2012). Nye Internett Toppdomener.
• Mahler, Tobias (2011). Analyse av kontraktsrisiko.
• Mahler, Tobias (2011). Datalagringsdirektivet slik tyske og rumenske domstoler har vurdert det.
• Mahler, Tobias (2011). Hvordan kan rettslige spørsmål integreres i en risikovurdering?.
• Mahler, Tobias (2011). Legal Risk Assessment of Introducing a New Internet Top-Level Domain. Vis sammendrag

  Internet top-level domains such as .com, .org, .de and .uk are central for the functioning of the Internet. So far, their number has been very limited, but this will change in the proximate future. After years of discussions, the Internet Corporation for Assigned Names and Numbers (ICANN) is opening up the application process for new generic top-level domains (gTLDs). Proposals are likely to include both genuinely generic names such as .music, .bike or .bank and geographic names and abbreviations such as .berlin, .paris and .nyc. In addition, several major corporations are expected to register their brand names as top-level domains. The introduction of a new gTLD is sought by many applicants in order to offer registry services in an expanding market for Internet domain names. In some cases new gTLDs may also facilitate novel and innovative business models. On the other hand, applying for a new gTLD can be quite costly, since an applicant has to disburse inter alia a substantial application fee and possible costs of an auction, in addition to start-up costs. Applicants therefore need to carefully assess and manage risks related to the project of introducing a new gTLD. From the applicant’s perspective, relevant risks can be related to the business model, to the applicant’s financial situation or to operational, technical and legal issues. The assessment of legal risks – which is the key focus for this paper – is essential for any applicant, for at least two reasons. First, it is in the interest of the applicant to identify and manage legal risks in an early phase when cost-efficient proactive action is still possible. In addition, all applicants even need to include a contingency plan in their applications, and the quality of this plan will count for the application’s success. This explicitly includes the relevance of any regulation, law or policy that might impact the project. Applicants are evaluated based on a scoring system, and in order to achieve the highest score, they must show that they have thoroughly identified the key risks and the chances that each will occur, including legal risks.

• Mahler, Tobias (2011). Legal Risk Management as a Methodical Perspective on Uncertainty and Complexity.
• Mahler, Tobias (2011). New generic Top-Level-Domains (gTLDs).
• Mahler, Tobias (2011). Rettslige krav til risikovurderinger for IDforvaltning.
• Mahler, Tobias (2010). Juridisk risikostyring i ID-systemer: Verktøybasert kontraktanalyse.
• Mahler, Tobias (2010). Juristisches Risikomanagement: Eine Methode zur Ergänzung rechtlicher Analysen?.
• Mahler, Tobias (2010, 14. mai). Lagringsdirektivet kan koste 2 Mrd.  Computerworld.
• Mahler, Tobias (2010). Legal Risk Management. Developing and Evaluating Elements of a Method for Proactive Legal Analyses, With a Particular Focus on Contracts. Doktoravhandlinger forsvart ved Det juridiske fakultet, Universitetet i Oslo. 34.
• Mahler, Tobias (2010). The lawyer in 2020.
• Mahler, Tobias (2009). Hvordan analysere legale risikoaspekter i tillitshåndtering?.
• Mahler, Tobias (2009). Jurister på vei til Neandertal? Omtale av Richard Susskind: The end of lawyers?. Lov & Data.  ISSN 0800-7853.  (2), s 20- 21
• Mahler, Tobias (2009). Legal risk management.
• Mahler, Tobias (2009). Rettslige risikovurderinger: metoder og modeller.
• Mahler, Tobias (2009). Visualising Legal Risk.
• Mahler, Tobias (2009). Visualising legal risk.
• Mahler, Tobias (2008). A method for legal risk management, exemplified in a case study on IT outsourcing.
• Mahler, Tobias (2008). Defining Legal Risk, In Soili Nystén-Haarala (ed.),  Corporate Contracting Capabilities : Conference proceedings and other writings.  University of Joensuu, Department of Law.  ISBN 978-952-219-126-7.  KAPITTEL.  s 51 - 77 Vis sammendrag

  What is legal risk? This category of risk is often mentioned in the context of enterprise risk management and financial risk management. Legal risk also is a central concept in legal risk management. However, the definitions given for legal risk differ widely, and no generally accepted notion of legal risk seems to exist. The objectives of this paper are to review, systematize and analyse existing definitions of legal risk. This paper proposes a context-independent definition and classification of legal risk, based on norm theory.

• Mahler, Tobias (2008). How can we analyze contractual risk?. Contracting Excellence.  ISSN 1937-9765.  1(5), s 15- 16
• Mahler, Tobias (2008). Rettslig risiko og compliance.
• Mahler, Tobias (2007). A Case Study on Legal Risk Management in ICT Outsourcing.
• Mahler, Tobias (2007). Defining Legal Risk. Vis sammendrag

  What is legal risk? This category of risk is often mentioned in the context of enterprise risk management and financial risk management. Legal risk also is a central concept in legal risk management. However, the definitions given for legal risk differ widely, and no generally accepted notion of legal risk seems to exist. The objectives of this paper are to review, systematize and analyse existing definitions of legal risk. This paper proposes a context-independent definition and classification of legal risk, based on norm theory.

• Mahler, Tobias (2006). Privacy and Identity Management.
• Mahler, Tobias (2006). Sikkerhetspolicies som normative virkemidler for å oppnå informasjonssikkerhet.
• Mahler, Tobias (2006). The concept of legal risk in the context of legal risk management.
• Mahler, Tobias (2006). TrustCoM, et EU-prosjekt om rammeverket for virtuelle organisasjoner og elektroniske markedsplasser. Juridisk risikoanalyse av eLearning case.
• Mahler, Tobias; Arenas, Alvaro & Schubert, Lutz (2006). Contractual Frameworks for Enterprise Networks & Virtual Organisations in E-Learning. Vis sammendrag

  The increasing demand for business collaborations over the Internet (eBusiness) requires prospective partners to set up their cooperation in a timely fashion, without loosing time with negotiating complicated legal contracts. On the other hand, if problems arise, collaborators will want to fall back on a contractual framework that adequately addresses the main legal issues. Electronic collaborations cover a wide variety of application domains, potentially involving parties from different countries and thus from different legal backgrounds – much more complex than what most approaches to electronic contracts are able to cover, since they mainly focus on specifying selected operational terms. This paper will therefore outline an approach towards a contractual framework that combines operational electronic contracts with a more long-term legal framework, which caters for both organisational and business issues of electronic collaborations. This will be exemplified with a business scenario in the field of eLearning.

• Mahler, Tobias & Vraalsen, Fredrik (2006). Legal Risk Management for an E-Learning Web Services Collaboration.
• Olsen, Thomas & Mahler, Tobias (2006). Privacy and Identity Management.
• Cooper, Vicky; Conte, Marco & Mahler, Tobias (2005). Legal Issues in SME Clusters.
• Mahler, Tobias (2005). Searching for interfaces between legal methods and risk analysis.
• Mahler, Tobias (2005). TrustCoM - Rechtliche Voraussetzungen für Vertrauen in virtuellen Organisationen.
• Mahler, Tobias & Vraalsen, Fredrik (2005). Legal Risk Analysis with Respect to IPR in a Collaborative Engineering Virtual Organization. Vis sammendrag

  Establishing and operating a virtual organization implies a number of challenges from many different perspectives, including socio-economic, organizational, legal and computational issues. This paper focuses on the legal aspects with a particular view on legal risks with respect to intellectual property rights. A risk analysis with respect to legal issues can either be based on abstract legal reasoning or it can focus on the business reality and the specific characterizations of the virtual organization. This paper follows the latter approach; it presents selected findings of a legal risk analysis of a business scenario in the collaborative engineering field. The legal risk analysis was performed in collaboration between lawyers and other professionals in order to highlight how different legal and non-legal aspects relate to each other. Graphical models of risks and treatments were utilized in order to reduce communicational barriers between experts in this multidisciplinary setting.

• Olsen, Thomas; Mahler, Tobias; Seddon, Clive; Cooper, Vicky; Williams, Sarah; Valdes, Miguel & Arias, Sergio Morales (2005). Privacy in Relation to Networked Organisations and Identity Management. Yulex.  ISSN 1503-5999.  s 57- 67 Vis sammendrag

  This paper summarizes the findings of the study on privacy in relation to networked organisations and identity management, carried out by the Legal-IST project (www.legal-ist.org). The focus of the study is on privacy and data protection aspects of networked organisations and on the use of identity management technologies, in particular multi-organisation single sign-on and federated identity management. In principle, both networked organisations and organisational networks to facilitate identity management may involve the processing of personal data, particularly if the networks are set up to serve consumers. From a data protection perspective, the main issue to be addressed is how the responsibility for processing personal data can be shared among the participants and the degree to which a network participant is legally responsible for collective processing of personal data. The study provides an analysis of the networking parties’ duties and roles under data protection law and provides guidelines and model contracts to comply with the legal framework. The European data protection framework for collaborative networks is highlighted, including selected recommendations of the Art 29 Working Party of the European Directive on Data Protection. Organisational networks to facilitate identity management are discussed both in relation to government-built networks and, in particular, in relation to identity management schemes set up by a network of enterprises

• Vraalsen, Fredrik; Lund, Mass Soldal; Mahler, Tobias; Parent, Xavier & Stølen, Ketil (2005). Specifying Legal Risk Scenarios Using the CORAS Threat Modeling Language. Experiences and the Way Forward.
• Wilson, Michael; Arenas, Alvaro; Chadwick, David; Dimitrakos, Theo; Doser, Jürgen; Golby, David; Geuer-Pollman, Christian; Haller, Jochen; Mahler, Tobias; Martino, Lorenzo; Parent, Xavier; Ristol, Santi; Sairamesh, Jakka; Schubert, Lutz; Stølen, Ketil & Tuptuk, Nilufer (2005). The TrustCoM Framework v0.5.
• Mahler, Tobias (2004). Bruk av CORAS for juridisk risikoanalyse.
• Mahler, Tobias (2004). Tillit og sikkerhet i virtuelle organisasjoner -- fra et juridisk perspektiv.
• Mahler, Tobias & Olsen, Thomas (2004). Omdømmesystemer.
• Mahler, Tobias & Olsen, Thomas (2004). Reputation Systems and Data Protection Law.
• Mahler, Tobias & Olsen, Thomas (2004). Rettslige problemer knyttet til bruk av anonymitetsservere på Internett.
• Mahler, Tobias & Olsen, Thomas (2004). Reputation Systems and Data Protection Law. Vis sammendrag

  Reputation systems can be used to provide relevant information about others when we interact with persons we do not know. However, reputation systems are challenged by concerns about privacy and data quality. This paper assesses how data protection law affects the design and the operation of reputation systems.

Se alle arbeider i Cristin