Subject: Re: [hrpc] I-D Action: draft-irtf-hrpc-guidelines-00.txt

From: John Curran <[email-masked]>
Date: Sun, 10 Jun 2018 07:46:07 -0400

On 20 Mar 2018, at 4:37 PM, [email-masked] wrote:
> 
> 
> A New Internet-Draft is available from the on-line Internet-Drafts directories.
> This draft is a work item of the Human Rights Protocol Considerations RG of the IRTF.
> 
>        Title           : Guidelines for Human Rights Protocol Considerations
>        Author          : Niels ten Oever
> 	Filename        : draft-irtf-hrpc-guidelines-00.txt

Folks - 

The <draft-irtf-hrpc-guidelines-00.txt> draft states –

" According to these documents, some examples of human rights relevant
   for ICT systems are human dignity (Art. 1 UDHR), non-discrimination
   (Art. 2), rights to life, liberty and security (Art. 3), freedom of
   opinion and expression (Art. 19), freedom of assembly and association
   (Art. 20), rights to equal protection, legal remedy, fair trial, due
   process, presumed innocent (Art. 7-11), …”

It then goes on to assert – 

" However, by carefully considering the answers to the following
   questions, document authors should be able to produce a comprehensive
   analysis that can serve as the basis for discussion on whether the
   protocol adequately takes specific human rights threats into account.”

If the HT-rt is truly going to produce comprehensive analysis with regard to potential protocol impacts on human rights, then every effort should be made to expand the list of ‘specific human rights’ that are considered to include the full list of potential relevant human rights.   In particular, questions on assessing the potential protocol impact on “right to legal remedy” are absent from the document, despite being specifically mentioned in the list of relevant rights.  It is clear that protocol design can readily impact the ability to obtain legal remedy – e.g. how various tradeoffs between encryption versus attribution can limit the ability to determine actors involved in an Internet-based attack on personal security.   Without questions to assess the potential impact to the right of legal remedy, any “Human Rights” reviews of Internet drafts cannot be considered “comprehensive” in any normal sense of the word. 

Absent such an update to the human rights assessment guidelines, it would be best if the HR-rt team be named "Specific Human Rights Review Team" (SHR-rt) so as to avoid confusion about the restricted nature of the reviews with respect to the range of human rights impacts. 

Thanks!
/John

---

From: Mark Perkins <[email-masked]>
Date: Mon, 11 Jun 2018 00:13:45 +0000 (UTC)

John

I could not more strongly disagree with your interpretation of 'human rights' (besides your confusion between encryption and anonymity).

1. To be clear, human rights do not apply to  corporations (corporate bodies).

2. The 'right' to legal remedy is not a Human Right but a mechanism to aid in the enforcement in the other rights, which is why it is in Article 2 (Human Rights are spelt out in Articles 6-27).

3. In the main, Human Rights are state obligations to refrain from interference with individual rights (negative rights) and only secondarily an obligation to prevent citizens from such interference (positive right).

4. All rights are subject to the test of 'proportionality' (excepting certain rights described in Article 2, which are absolute). This means that one right cannot be enforced to the annihilation of another.

5. Given the importance of encryption and anonymity to freedom of expression and right to privacy, various organisations (eg. Article 19 <https://www.article19.org/resources/un-expert-launches-robust-defence-online-anonymity-encryption/>) and the Special Rapporteur on the promotion and protection of the right to freedom of opinion and expression <www.ohchr.org/EN/HRBodies/HRC/RegularSessions/Session29/Documents/A.HRC.29.32_AEV.doc> have emphasised that the use of encryption and anonymity are essential in the protection of fundamental rights.

6. Even conceding your point about the ability for legal redress for infringement against Human Rights (and NOT for other purposes), this would apply only to anonymity and not encryption.

Mark P.

    On Sunday, June 10, 2018, 10:46:26 PM GMT+11, John Curran <[email-masked]> wrote:  

Folks - 

Thanks!
/John

_______________________________________________
hrpc mailing list
[email-masked]
https://www.irtf.org/mailman/listinfo/hrpc

---

From: John Curran <[email-masked]>
Date: Sun, 10 Jun 2018 23:56:40 -0400

On 10 Jun 2018, at 8:13 PM, Mark Perkins <[email-masked]> wrote:
> ...

Mark - 

The right to effective remedy is in Article 8 of the UN Universal Declaration of Human Rights
<http://www.un.org/en/universal-declaration-human-rights/ <http://www.un.org/en/universal-declaration-human-rights/>>

	"Article 8.
 	Everyone has the right to an effective remedy by the competent national tribunals for acts violating the fundamental rights granted him by the constitution or by law.”

Given language that begins “Everyone has the right” would plainly suggest that 'effective remedy' is indeed a "Human Right”, 

> 6. Even conceding your point about the ability for legal redress for infringement against Human Rights (and NOT for other purposes), this would apply only to anonymity and not encryption.

I do not have a specific position regarding the appropriate balancing (i.e. proportionality test) that should be provided to the right of effective remedy versus other human rights, but note that an analysis of impacts to human rights from a given protocol that based on a selected subset of rights should not be considered “comprehensive”, and hence the work of an HR-rt team assessing such impacts is likely to be misunderstood in a similar manner of not otherwise specifically called out. 

Thanks,
/John

---

From: Mark Perkins <[email-masked]>
Date: Mon, 11 Jun 2018 05:01:33 +0000 (UTC)

Hi John

You are correct regarding the Universal Declaration, which is only 'declaratory'. I was referring to the signed treaty - the International Covenant on Civil and Political Rights - and its enforcement mechanisms.

You quote my point 6 (encryption vs anonymity), but I assume from your following comment you meant to quote my point 4 regarding proportionality.

I do have a specific position regarding the proportionality test, as do Article 19 and the Special Rapporteur. Given the possible misunderstanding that you have pointed out, I would suggest that the 'Guidelines for Human Rights Protocol Considerations' should specifically cite the Special Rapporteur when refering to encryption/anonymity.

Regards
Mark P.

    On Monday, June 11, 2018, 2:56:59 PM GMT+11, John Curran <[email-masked]> wrote:  

...

Mark - 
The right to effective remedy is in Article 8 of the UN Universal Declaration of Human Rights<http://www.un.org/en/universal-declaration-human-rights/>
 "Article 8.
  Everyone has the right to an effective remedy by the competent national tribunals for acts violating the fundamental rights granted him by the constitution or by law.”
Given language that begins “Everyone has the right” would plainly suggest that 'effective remedy' is indeed a "Human Right”, 

Thanks,/John

---

From: John Curran <[email-masked]>
Date: Mon, 11 Jun 2018 01:20:46 -0400

Mark -

Are you suggestion that the IETF conduct reviews of human rights impacts for protocols but that such “comprehensive” assessments do not need to consider the human right of effective remedy?

I am fine if the reviews exclude the human right to effective remedy, but then believe that care must be taken to make sure such reviews are not represented as “comprehensive”.  Alternatively, assessment of impacts to the right to effective remedy could be included - either outcome is reasonable so long as it avoids inadvertent misrepresentation. 

Thanks!
/John

> On Jun 11, 2018, at 1:01 AM, Mark Perkins <[email-masked]> wrote:
> 
> Hi John
> 
> <http://www.un.org/en/universal-declaration-human-rights/>
> 
> 	"Article 8.

---

From: Stephen Farrell <[email-masked]>
Date: Mon, 11 Jun 2018 10:01:15 +0100

Hiya,

I don't have a position on the UDHR aspects of the discussion but
I have a comment on terminology and I'm not clear what's behind the
text below...

On 10/06/18 12:46, John Curran wrote:
> It is clear that protocol design can readily impact the ability to
> obtain legal remedy – e.g. how various tradeoffs between encryption
> versus attribution can limit the ability to determine actors involved
> in an Internet-based attack on personal security.

I think the above mixes too many things together to be any kind of
example that might be useful in the discussion.

John, it's not clear to me if you're bemoaning:

- folks' ability to use confidentiality mechanisms
- use of combinations of standard and non-standard protocols
  in ways that didn't first ask for permission from someone
  (and thus are hard to disentangle)
- the fact that it is hard to correlate source addresses with
  entities one might sue or complain about to your chosen local
  authorities
- or something else

But regardless of what is or is not a human right, I think that reviews
considering human rights in this context clearly also need to consider
the ability to run networks that are constantly under attack, so I think
most of this is moot really.

On terminology: use of the term "anonymity" here is not useful either.
(I think Mark is the person who did that first in this thread, sorry
if I got that wrong.) I find it really hard to know when or if someone
using that term understands the tremendous difficulties in attempting
to be really anonymous. And I have seen people mistakenly use that term
when they really just meant use of ciphertext instead of plaintext. So
it'd be better to not use that term at all in these discussion I think.
(It's much easier to talk accurately about use of pseudonyms anyway:-)

Cheers,
S.

---

From: Eliot Lear <[email-masked]>
Date: Mon, 11 Jun 2018 06:33:52 -0400

On 11.06.18 01:01, Mark Perkins wrote:
> Hi John
>
> You are correct regarding the Universal Declaration, which is only
> 'declaratory'. I was referring to the signed treaty - the
> International Covenant on Civil and Political Rights - and its
> enforcement mechanisms.

This draft itself uses the UDHR as a basis.  John's point is that there
is a tension between these various rights.  Similarly, Section 3.2.4
references BCP72 and talks about a "Right to security", but we haven't
had a real discussion of what that means.

One other comment:

The document really needs a scrub on terminology.  For instance, Section
3.2.13 talks about reliability and degradation, when the example really
discusses downgrade attacks.  The second example (TCP ACKs) is not well
connected to the point.

Eliot

---

From: Mark Perkins <[email-masked]>
Date: Wed, 13 Jun 2018 00:19:20 +0000 (UTC)

Stephen

On terminology, it was me who first used the term "anonymity' in this discussion. It was a logical leap (without explanation) from Johns connecting attribution to legal redress. Pseudonymity has not much impact on legal redress unless it can be connected to a real human; if it cannot be so connected, the human remain anonymous...

I agree with your points regarding clarity, something the "Anonymity, Human Rights and Internet Protocols" draft deals with.

However, I disagree with your view that the "need to consider
the ability to run networks that are constantly under attack" renders this moot. Attribution (in terms of legal redress) is NOT necessary for this purpose...

Eliot

The draft does not use the UDHR as a basis. It refers to the UDHR, the ICCPR and other treaties, but only cites examples from the UDHR. These examples are all found in the ICCPR excepting:

'appropriate social and
international order', which is the purpose of the treaties;

'participation in cultural life...' which is dealt with in another treaty - the International Covenant on Economic, Social and Cultural Rights.

I totally agree that there is a tension between these various rights, something recognised by the various enforcement & monitoring bodies of the treaties. This why I prefer to refer to the treaties rather than the UDHR, it enables reference to General Comments and agreed analyses of the treaties and the tensions between the rights contained in them, something the UDHR does not.

Perhaps we should look at whether our examples should come from the Treaties rather than the UDHR. The majority of countries are signatories to the ICCPR and other relevant treaties, while the UDHR is only by default due to countries UN membership.

As to 'a scrub on terminology', I totally agree; have attempted to aid in proof-reading and polishing myself, but is clearly not finished.

In fact, your reference to 3.2.4 and Right to Security illustrates this point as it seems to conflate / confuse network security with the 'Right to security' with not explanation...

Regards
Mark P.

    On Monday, June 11, 2018, 9:34:06 PM GMT+11, Eliot Lear <lear=[email-masked]> wrote:  

 

  Hi John

 This draft itself uses the UDHR as a basis.  John's point is that there is a tension between these various rights.  Similarly, Section 3.2.4 references BCP72 and talks about a "Right to security", but we haven't had a real discussion of what that means.
 
 One other comment:
 
 The document really needs a scrub on terminology.  For instance, Section 3.2.13 talks about reliability and degradation, when the example really discusses downgrade attacks.  The second example (TCP ACKs) is not well connected to the point.
 
 Eliot

---

From: Stephen Farrell <[email-masked]>
Date: Wed, 13 Jun 2018 01:57:32 +0100

Hiya,

On 13/06/18 01:19, Mark Perkins wrote:
> Stephen
> 
> On terminology, it was me who first used the term "anonymity' in this
> discussion. It was a logical leap (without explanation) from Johns
> connecting attribution to legal redress. Pseudonymity has not much
> impact on legal redress unless it can be connected to a real human;
> if it cannot be so connected, the human remain anonymous...

That's not the problem I was describing. The problem I was trying to
get at is that anonymity is almost impossible, *technically*. For me,
that does not mean we ought give up and aim for a fully identified
network, rather the opposite - I figure we ought be figuring out how
to make less easily identifiable networking more usable, both for
people using network services and for people managing networks. (That
latter set of folks may currently disagree with me that the less they
have access to superfluous data related to people using their services,
the better off they are as administrators - but if so, they're wrong;-)

> 
> I agree with your points regarding clarity, something the "Anonymity,
> Human Rights and Internet Protocols" draft deals with.

Last I checked, I didn't think that draft had approached the right
balance. But I may be mis-remembering.

> 
> However, I disagree with your view that the "need to consider the
> ability to run networks that are constantly under attack" renders
> this moot. Attribution (in terms of legal redress) is NOT necessary
> for this purpose...

The "this" there isn't the same thing, and in any case I said "most
of this" - meaning "this" == "the argument." I agree that strongly
attributable networking does not need to be ubiquitous to counter
attacks. However, I think it's likely true that defenders need in
some cases to be able to re-identify attackers (at least to the
level of categorising attack vs. kosher traffic) to mount effective
defenses, e.g. against (D)DoS. I figure it's that latter that makes
discussion of John's stated concerns moot. (Put another way - there
is no danger whatsoever that a rogue-HR-review would be taken
seriously if it made technically stupid recommendations or claimed
that technically necessary things "MUST NOT" be done. IMO, given
that isn't a danger, discussion of it as a danger is moot.)

Cheers,
S.

> 
> Eliot
> 
> The draft does not use the UDHR as a basis. It refers to the UDHR,
> the ICCPR and other treaties, but only cites examples from the UDHR.
> These examples are all found in the ICCPR excepting:
> 
> 'appropriate social and international order', which is the purpose of
> the treaties;
> 
> 'participation in cultural life...' which is dealt with in another
> treaty - the International Covenant on Economic, Social and Cultural
> Rights.
> 
> I totally agree that there is a tension between these various rights,
> something recognised by the various enforcement & monitoring bodies
> of the treaties. This why I prefer to refer to the treaties rather
> than the UDHR, it enables reference to General Comments and agreed
> analyses of the treaties and the tensions between the rights
> contained in them, something the UDHR does not.
> 
> Perhaps we should look at whether our examples should come from the
> Treaties rather than the UDHR. The majority of countries are
> signatories to the ICCPR and other relevant treaties, while the UDHR
> is only by default due to countries UN membership.
> 
> As to 'a scrub on terminology', I totally agree; have attempted to
> aid in proof-reading and polishing myself, but is clearly not
> finished.
> 
> In fact, your reference to 3.2.4 and Right to Security illustrates
> this point as it seems to conflate / confuse network security with
> the 'Right to security' with not explanation...
> 
> Regards Mark P.
> 
> 
> 
> On Monday, June 11, 2018, 9:34:06 PM GMT+11, Eliot Lear
> <lear=[email-masked]> wrote:
> 
> 
> 
> 
> 
> This draft itself uses the UDHR as a basis.  John's point is that
> there is a tension between these various rights.  Similarly, Section
> 3.2.4 references BCP72 and talks about a "Right to security", but we
> haven't had a real discussion of what that means.
> 
> One other comment:
> 
> The document really needs a scrub on terminology.  For instance,
> Section 3.2.13 talks about reliability and degradation, when the
> example really discusses downgrade attacks.  The second example (TCP
> ACKs) is not well connected to the point.
> 
> Eliot _______________________________________________ hrpc mailing
> list [email-masked] https://www.irtf.org/mailman/listinfo/hrpc
> 
> 
> 
> 
> _______________________________________________ hrpc mailing list 
> [email-masked] https://www.irtf.org/mailman/listinfo/hrpc
>

---

From: John Curran <[email-masked]>
Date: Tue, 12 Jun 2018 19:58:19 -0500

Mark - 
 
If one has been told that "the IETF has done a comprehensive review of a protocol for potential human rights impacts”, then it is quite a reasonable expectation that human rights in the UDHR have been considered.  It may be that the rights contained therein aren’t impacted by the protocol in question or are impacted in a manner that is deemed reasonable given the consideration due other human rights, but some consideration is due if there are impacts. 

If the group wants to restrict its analysis to a subset of rights in UDHR, or a specific set of human rights and interpretations contained elsewhere, that also seems reasonable, but probably shouldn’t be considered comprehensive, or promoted as such.   

For example, it is certainly possible to create perfectly functional protocols that provide for dynamic assignment and mapping of identifiers, and do not maintain logs or state that allows attribution of Internet actor at a later point in time.  Such a protocol would certainly have an impact on the human right to an effective remedy (for those who have their security violated by an Internet actor via such means) - regardless of the presence or absence of “effective remedy” in ICCPR.

i.e. it would probably be best to not reference the work of HT-rt as “a comprehensive analysis of the potential protocol impacts to human rights” (as one cannot both be comprehensive and omit well-recognized human rights) but instead simply as an assessment of potential impacts to human rights noted in the International Covenant on Civil and Political Rights. 

Thanks,
/John

---

From: Mark Perkins <[email-masked]>
Date: Sun, 24 Jun 2018 06:08:12 +0000 (UTC)

Stephen

"That's not the problem I was describing."

MP> We seem to be on the same wavelength, but talking about different contexts of anonymity; exactly why we need to be clear about terminology!

"I didn't think that draft had approached the right
balance."

MP> Perhaps it has not reached the right balance, but I think it is in this draft rather than the guidelines that anonymity should be addressed.

"(Put another way - there
is no danger whatsoever that a rogue-HR-review would be taken
seriously if it made technically stupid recommendations or claimed
that technically necessary things "MUST NOT" be done. IMO, given
that isn't a danger, discussion of it as a danger is moot.)"

MP> Here we agree, BUT any HR review should be at least adressing the issues and justifying why certain things are 'technically necessary' and should take priority over a HR issue. And by 'technically necessary', I do not mean 'just because we have always done it that way', or 'we are too lazy to try other methods', or any of the other BS used by eg. ICANN / Krebs / trademark owners in the current WHOIS GDPR situation.

Best regards
Mark P.

    On Wednesday, June 13, 2018, 11:58:02 AM GMT+11, Stephen Farrell <[email-masked]> wrote:  

Hiya,

Cheers,
S.

hrpc mailing list
[email-masked]