Subject: [hrpc] Human Rights Research Group Call on draft-irtf-hrpc-research-07

From: avri doria <[email-masked]>
Date: Sun, 4 Dec 2016 13:54:21 -0600

Hi,

With this note, I am starting a Research Group call on the draft

https://tools.ietf.org/html/draft-irtf-hrpc-research-07

  Research into Human Rights Protocol Considerations

While RFC 5743 "Definition of an Internet Research Task Force (IRTF) Document Stream" does not mandate a Last Call or any specific action to prove that a document has the correct maturity and review for publication, it is safe to think of this call as similar to a first IETF last call.  If substantive changes to the document are produced based on the reviews we get, there will probably be another call on a later revision of the draft. If, or when, there are no substantive changes made we will be able to move on to IRSG Review of the draft.  If we don't get a wide enough review, we will need to figure out what to do next.

Given that I am hoping to use this call as a way to get a larger audience to review that draft, and the fact that we are coming into one of the global holiday times, I will leave this call open until 9 Jan 2017.

Please send all comment to the HRPC email list: [email-masked].  I do hope that some good discussions occur on this list where the resolution to any issues may be forged. Discussion has been shown to improve this draft.

Happy reviewing

Avri Doria

BTW, I copied the IRSG list on this hoping to get wider review group.

---

From: Stephane Bortzmeyer <[email-masked]>
Date: Tue, 6 Dec 2016 19:18:48 +0100

On Sun, Dec 04, 2016 at 01:54:21PM -0600,
 avri doria <[email-masked]> wrote 

>   Research into Human Rights Protocol Considerations

I've read -07 and I find it fine. I won't repeat my comments about
previous versions but, for this one, I specially like the section 6,
which now nicely captures the various positions on the relationship
between HR and protocols.

Editorial:

> the questions posed in the considerations Section 4 part of this
> document

Just "section 4" instead of "considerations Section 4 part"?

> peer-to-peer remains imporant

important

Also, mention of RFC 1766 should be replaced with RFC 4646.

Personal remarks:

Mentioning NETmundial seems useless, it was just "governance circus".

---

From: Stephane Bortzmeyer <[email-masked]>
Date: Sat, 10 Dec 2016 09:24:22 +0000

>   Research into Human Rights Protocol Considerations

This is Human Rights Day, good opportunity to read the draft and post
reviews :-)

---

From: Andrew Sullivan <[email-masked]>
Date: Thu, 29 Dec 2016 21:20:08 -0500

Dear colleagues,

This is my much-overdue response to draft-irtf-hrpc-research.  I
apologize for the dilatory notes.  I have failed to send these remarks
on every previous occasion, partly because the authors are much better
at turning around drafts than I am at completing my reviews.

I should say that in general I think this is a useful draft and even
if the authors reject my suggestions I would have no objection to the
RG publishing the draft.

Part of the reason that I have struggled with this draft is because,
while I do not really disagree with many of its conclusions or
recommendations, I have a number of concerns about how it gets to
those conclusions.  I've made some oblique references to these points
in various mic lines and list postings, but I haven't done a good job
of laying out the concern, so this is an effort to do it more
completely.

My concern is that the draft cannot decide whether it is a human
rights ethics _for_ the Internet protocols, or a HR ethics _of_
the Internet protocols.

The trouble shows up early on.  For instance, section 1 says, "The
purpose of the Internet to be a global network of networks that
provides unfettered connectivity to all users and for any content
[RFC1958]" In my reading, RFC 1958 does not actually offer a claim
about the purpose of the Internet.  Perhaps of greater concern, RFC
1958 explicitly notes that its own purpose is not "to lay down dogma
about how Internet protocols should be designed".  That is, while RFC
1958 is about "architecture", it strives not to be prescriptive.  It's
therefore strange to see it cited as the source for "this objective"
of the Internet.

Now, it is true that RFC 3935 says, "The Internet isn't value-neutral,
and neither is the IETF."  But the rest of the text is in fact silent
on _which_ values the Internet has, because the document is about the
IETF, and not the Internet.  And while RFC 3935 continues to talk
about the technologies that the IETF "choose[s] to create" as opposed
to ones that are possible, it seems to me that it actually expresses
implicitly a value of the Internet as such.  That value can found an
ethic all of its own.

If there is an ethic of the Internet, it is this: that more
internetworking is better because that makes the Internet better
connected.  This is a (more or less) pure engineering value that follows
directly from the recognition of network effects.  Once you have
network effects, a given network is more valuable from the connections
it can make.  But that has special consequences for the Internet,
because internetworking is not flat.  It is instead networking of
networks, which means that any given connection to the Internet must
always be treated as the connection of another network.  This requires
a formal indifference to the nature of the network on the other
side of that connection, an acknowledgement that the newly-connected
network might be patchy or unreliable, and also an assumption that the
network so connected is not itself the locus of intelligence.  We're
not building the Catanet.

Now, it seems to me that there are two stances that the draft takes
with respect to why human rights ought to matter for Internet
protocols.  One of them is more troublesome for the draft's purpose
than the other.  The first is that there are human rights, and that
Internet protocols need to be built to support them.  We might call
this the "extrinsic value" position.  The second is that there are
human rights, and the expression of them aligns nicely with the
(above-outlined) positive engineering value of the Internet; we might
call this the "concordant value" position[1].  We can see this tension in
the following bit from section 1:

   Therefore, important human rights enabling characteristics
   of the Internet might be degraded if they're not properly defined,
   described and protected as such.  And, the other way around, not
   protecting human right enabling characteristics could also result in
   (partial) loss of functionality and connectivity, and other inherent
   parts of the Internet's architecture of networks.[2]

The first sentence of these is a claim about extrinsic values and why
Internet protocol designers ought to care about those.  The second is
about how protecting human rights contributes to the values of the
Internet.  My basic concern is that this dual motivation at once
threatens both the goal (of 3935) and the effort.  The goal is
threatened because the extrinsic motivation changes the meaning of
"work better".  The effort is threatened because it obscures the
engineering value of "the network for its own sake", and subsumes that
value beneath externally-supplied values.

For the draft, a consequence of all the above is that the motivation
for the human rights considerations is not clearly stated in terms
that a sceptic might endorse.  The comparison with the security and
privacy considerations is instructive.  Those seem, to my eye, to be
motivated by the value of security or privacy (as appropriate), but
the failure to take them into consideration is framed mostly in terms
of the harm _to the Internet_ that arises if the issue is not taken
into account.  Perhaps in the case of the hrpc draft the extrinsic
motivations are more reasonable, because this is not an IETF
document.  But if one thinks that technologies are neutral, and that
it is the _use_ of the technologies that can trample on rights, the
focus on human rights might sound like an attempt to make the IETF
into a political actor.

In order to make this clearer, it might help if the draft discussed
more plainly three possible interactions: how considering rights
might be good for the purposes of the Internet protocols (perhaps
because it makes them more useful and therefore more likely to be
adopted, or because it makes them more resilient to certain kinds of
attacks, or whatever); how considering rights might be useful in
extrinsic value terms (this seems mostly to be what section 3 does);
and how considering rights might be good for the overall
socio-political environment into which the Internet is deployed (some
of section 1 and some of section 6 seems to be doing this).

Finally, in my view, that very section 6 continues to be troublesome.
It argues that protocols _are_ politics despite outlining some views
that do not seem to support such a view at all.  It says

   However, these protocols and standards do not
   exist outside of their technical context nor outside of their
   political, historical, economic, legal or cultural context.  This is
   best exemplified by the way in which protocols have become part and
   parcel of political processes and public policies

The first of these sentences is trivially true: _nothing_ exists
outside if its context, so protocols and standards don't either.  But
the best exemplification of that is not that people use protocols as
part of their political arguments or public policies.  Indeed, if one
believed that protocols are merely tools and that it is the use of the
tool (not the tool as such) that determines its political
consequences, one could argue that protocols need to be _protected_
from being dragged into such discussions.  So there is a faint hint of
circularity in section 6's reasoning about why rights are important
for protocols.  This may be because the section never really takes
seriously the position that a tool need not itself have a value
charge, and that the value comes entirely in its use.  It's true that
this view of technology fell out of fashion at least after the second
War and arguably earlier.  But it's a position entirely in keeping
with the Aristotelian tradition.  Moreover, it is rather far from
obvious to me that some of the citations in the section actually agree
with the positions in whose support they are being cited.

This leads to a problem for the following recommendation:

        At this point
   is difficult to say whether hard-coding human rights into protocols
   is wise or feasible.  It is however important to make conscious and
   explicit design decisions that take into account the human rights
   protocol considerations guidelines developed above.  This will ensure
   that the impact protocols can have on human rights is clear and
   explicit, both for developers and for users.  In addition, it ensures
   that the impact of specific protocol on human rights is carefully
   considered and that concrete design decisions are documented in the
   protocol.

Why is it important to make the design decisions this way?  Why is it
important that the impact on human rights is clear and explicit?  If a
protocol designer thinks the protocol's _use_ is what makes for the
consequences for others' rights, what is the motivation for that
individual to think about the rights-effects?  (Motivating this all in
terms of the consequences for the network might be effective in this
case.)

I hope these remarks are useful to the authors.

Best regards,

A

[1] As an aside, there's an "intrinsic value" position: that the
Internet inherently is a mechanism for expressing human rights in its
very nature, and so only human rights values are Internet protocol
values.  I don't think the draft proposes this, though I note that
there are people who feel strongly that the Internet _should_ work
this way.  That's a political problem for the IETF, perhaps, but it's
not an issue for this draft.

[2] It's worth noting that the opening of this paragraph contains
historical claims that are in really deep need of citations, because I've
read almost nothing about the early Internet that suggests "everyone"
could join, much less contribute code.  The DoD near-end-of-ARPANET
project certainly didn't let "everyone" join.  The NSFnet AUP was
_entirely_ clear that not "everyone" could join or contribute code,
even if the AUP was honoured more in the breach.  The late-1990s and
early-2000s open source literature has obscured the difficulty for
mere mortals of connecting to the Internet in earlier periods.  I was
a motivated-to-connect undergraduate in Ontario, Canada in the late
1980s/early 1990s, and the best I could do was a commercial dial-up
system that provided a kind of gateway to parts of the Internet
(undergraduates didn't rate connection to ONet in those days).

-- 
Andrew Sullivan
[email-masked]