Subject: [hrpc] Comments about draft-irtf-hrpc-research-07

From: S Moonesamy <[email-masked]>
Date: Sun, 25 Dec 2016 22:35:11 -0800

Hi Niels, Corinne,

I have a few comments about draft-irtf-hrpc-research-07.  First of 
all I would like to commend Article 19 and the Oxford Internet 
Institute for their efforts to research human rights issues.  I did a 
quick search on ietf.org and the following thread showed up in the 
search results: 
https://www.ietf.org/mail-archive/web/ietf/current/msg98613.html 
People from different parts of the world have different ways of 
looking at topics such as human rights.

The Abstract states that "This documents aims to be a consensus 
document of the Human Rights Protocol Consideration Research Group of 
the Internet Research Task Force (IRTF)".  Will it be the consensus 
of the representatives from companies or organizations from one 
country, a few countries or more than that?

Section 2 cites RFC 2606 for "Open standards Conform".  I gather that 
the reference is a mistake as RFC 2606 does not pertain to open standards.

Section 3.2.3.2.1 is about the removal of DNS records.  The second 
sentence in that section could be read as meaning that the US-based 
registry in charge of .com was involved in the first example which is 
referenced.  The usage of "real-world events" is not clear.  Does it 
mean events which could be described as political or something else?

Section 3.2.3.2.2 using dns.telecomix.org as an example.  The domain 
name does not exist:

   ;; QUESTION SECTION:
   ;dns.telecomix.org.             IN      A

   ;; AUTHORITY SECTION:
   telecomix.org.          3600    IN      SOA     ns3.binero.se. 
registry.binero.se. 1482364800 86400 5400 604800 3600

Section 3.2.3.3.1 discusses about cryptography.  There was an IAB 
appeal related to that in 2014.  Was that mentioned during the 
interviews (Section 3.1.2)?  I could not find a reference to the 
appeal as it is not listed on the IAB web site.

Section 3.3.3.6 discusses about Virtual Private Networks.  A few 
years ago, I asked for feedback about BCP 162 [1] about logging 
recommendations due to the lack of privacy considerations.  Would 
this be viewed as an issue in respect to human rights?

There is the following question in Section 4.1.1.1.5:  "Does your 
protocol allow Unicode encoded in UTF-8 only?"  Does that mean that a 
protocol supporting UTF-8 only does not enable internationalization?

One of the definitions for an "Open Standard" (Section 4.1.1.1.7) has 
the following: "available in multiple complete implementations by 
competing vendors, or as a complete implementation equally available 
to all parties".  How many of the IETF protocols qualify for 
this?  For what it is worth, there is a short thread about standards 
at https://www.ietf.org/mail-archive/web/ietf/current/msg88209.html

A point that may have been missed in that Section is protocol 
maintenance, e.g. is there a process to fix a defect in the 
specification and does that process actually work?

The "know what is being decided" is unfortunately not easy especially 
when decisions are not taken in a timely manner.  What is the use of 
making "his or her voice heard on the issue" if that voice is not 
given due consideration when the decision is taken?  Does the "right 
to non-discrimination" apply here?

There is the following in Section 4.1.1.1.7 "Open standards are 
important as they allow for permissionless innovation, which is 
important to maintain the freedom and ability to freely create and 
deploy new protocols on top of the communications constructs that 
currently exist".  Could the authors please provide an example of 
this "permissionless innovation" in relation to "open 
standards"?  The example referenced in the draft is not about a protocol.

Section 4.1.1.1.8 is about "heterogeneity by design".  On reading RFC 
1958 again I noticed that Section 5.2 of the document list export 
controls as an issue of secondary importance.  The explanation was 
that "all of the technology required to implement Internet standards 
can be fabricated in each country".  Does it affect a technical 
specification when it cannot be implemented due to restrictions 
affecting cryptography?  Is there heterogeneity by design if there 
are restrictions to "extension points" or export controls on a 
"mandatory to implement" feature in a standard?

Section 4.1.1.1.13 discusses about decentralization.  Do points of 
control affect the "right to freedom of expression"?

There is a discussion of an outage at 
https://news.ycombinator.com/item?id=12759520  Is it the protocol, 
namely DNS, which is brittle?

Section 4.1.1.1.9 discusses about privacy considerations and lists 
"Right to non-discrimination" under "Impacts".  This seems to be 
based on the constitution of a country which protects unpopular 
individuals from retaliation -- and their ideas from suppression -- 
at the hand of an intolerant society.  Isn't this about "freedom of 
speech" and anonymity instead of the "right to 
non-discrimination"?   Is it actually "right to non-discrimination" 
or is it the "right to equality"?

I have mentioned previously that people are encouraged to participate 
in the IETF and contribute through mailing lists but are completely 
disenfranchised relative to other people who attend IETF 
meetings.  It is odd if a person were to talk about human rights and 
he/she ignore such issues.

Section 9 states that there are no security considerations as the 
document concerns research.  If there weren't any considerations, 
would several of the participants (Section 3.1.2) opt to remain anonymous?

Regards,
S. Moonesamy