Subject: Re: [hrpc] new title for draft-tenoever-hrpc-political

From: Niels ten Oever <[email-masked]>
Date: Sat, 18 Aug 2018 15:45:01 +0200

Hi chairs,

Small reminder for this e-mail.

Best,

Niels

On 07/27/2018 11:09 AM, Niels ten Oever wrote:
> Hi chairs,
> 
> With unanimous support for 'Notes on networking standards and politics'
> on the list as a title for draft-political, it seems like the final
> hurdle for RG adoption of the document (as discussed in Montreal) has
> been passed, right?
> 
> Can I publish it as RG document with the new title?
> 
> Best,
> 
> Niels
> 
> On 07/20/2018 08:00 PM, Amelia Andersdotter wrote:
>> On 2018-07-20 10:33, Corinne Cath wrote:
>>> I like a.) Notes on networking standards and politics part of this
>>> whole process imho is to get people to read the doc to begin with,
>>> which seems most likely with a clear and recognizable title. my 2
>>> cents, corinne 
>>>
>> yeah, a)
>>
>> +1
>>
>>
>>> On Fri, Jul 20, 2018 at 1:19 AM, Mark Perkins
>>> <marknoumea=[email-masked]
>>> <mailto:marknoumea=[email-masked]..org>> wrote:
>>>
>>>     'Notes on networking standards and politics'
>>>
>>>     get my vote!
>>>
>>>     Mark Perkins
>>>
>>>     On Friday, July 20, 2018, 10:10:27 AM GMT+11, Niels ten Oever
>>>     <[email-masked] <mailto:[email-masked]>> wrote:
>>>
>>>
>>>     Off-list discussion with Stephen resulted in a new option:
>>>
>>>     'Notes on networking standards and politics'
>>>
>>>     That gives us a few options:
>>>
>>>     a) Notes on networking standards and politics
>>>     b) On Value Neutrality and the Politics of Standards
>>>     c) Notes on Value Neutrality and the Politics of Standards
>>>     d) ?
>>>
>>>     Curious to hear what the RG thinks sounds best, new suggestions
>>>     ofc also
>>>     welcome.
>>>
>>>     Best,
>>>
>>>     Niels
>>>
>>>     On 07/20/2018 12:43 AM, Niels ten Oever wrote:
>>>     >
>>>     >
>>>     > On 07/20/2018 12:38 AM, Stephen Farrell wrote:
>>>     >>
>>>     >> Hiya,
>>>     >>
>>>     >> On 19/07/18 23:33, Niels ten Oever wrote:
>>>     >>> Hi all,
>>>     >>>
>>>     >>> Thank you all very much for the spirited discussion at the
>>>     session. To
>>>     >>> resolve the issue with draft political and remove the last
>>>     issue mention
>>>     >>> blocking adoption I would like to propose to rename the draft:
>>>     >>>
>>>     >>> On Value Neutrality and the Politics of Standards
>>>     >>
>>>     >> Meh:-)
>>>     >>
>>>     >> How'd something more like "Some background on networking standards
>>>     >> and politics" work? That seems to describe the content of the draft
>>>     >> better to me, (modulo not having carefully read the latest rev,
>>>     as I
>>>     >> admitted at the mic, so don't take me too seriously.)
>>>     >>
>>>     >> My reason for suggesting that is to try end up with something that
>>>     >> would be less surprising for an IETF (or IEEE 802 or W3C...)
>>>     reader.
>>>     >>
>>>     >
>>>     > Exactly that audience is saying time and again that 'technology is
>>>     > neutral' / 'protocols are neutral' / 'standards are neutral'.
>>>     That is I
>>>     > would like to address that in the title (and the draft).
>>>     >
>>>     > Following work can then address how we could come up with
>>>     approaches to
>>>     > address that.
>>>     >
>>>     >
>>>     >> Cheers,
>>>     >> S.
>>>     >>
>>>     >>
>>>     >>>
>>>     >>> Would that work for you all? I also added a few mentions of value
>>>     >>> neutrality (and the lack thereof) for consistency in the abstract,
>>>     >>> introduction, conclusion and the way forward.
>>>     >>>
>>>     >>> Changes can be seen here:
>>>     >>>
>>>     https://github.com/nllz/IRTF-HRPC/commit/03826cd73959e692bb1f7aa305f9fbdee325dbd2#diff-fb9d617868a367dd946ef225cc5e6de1
>>>     <https://github.com/nllz/IRTF-HRPC/commit/03826cd73959e692bb1f7aa305f9fbdee325dbd2#diff-fb9d617868a367dd946ef225cc5e6de1>
>>>     >>>
>>>     >>> Happy to discuss.
>>>     >>>
>>>     >>> Best,
>>>     >>>
>>>     >>> Niels
>>>     >>>
>>>     >
>>>
>>>     -- 
>>>     Niels ten Oever
>>>     Researcher and PhD Candidate
>>>     Datactive Research Group
>>>     University of Amsterdam
>>>
>>>     PGP fingerprint      2458 0B70 5C4A FD8A 9488
>>>                       643A 0ED8 3F3A 468A C8B3
>>>     _______________________________________________
>>>     hrpc mailing list
>>>     [email-masked] <mailto:hrpc@irtf..org>
>>>     https://www.irtf.org/mailman/listinfo/hrpc
>>>     <https://www.irtf.org/mailman/listinfo/hrpc>
>>>
>>>     _______________________________________________
>>>     hrpc mailing list
>>>     [email-masked] <mailto:[email-masked]>
>>>     https://www.irtf.org/mailman/listinfo/hrpc
>>>     <https://www.irtf.org/mailman/listinfo/hrpc>
>>>
>>>
>>>
>>>
>>> -- 
>>> Corinne Cath
>>> Ph.D. Candidate, Oxford Internet Institute & Alan Turing Institute
>>>
>>> Web: www.oii..ox.ac.uk/people/corinne-cath
>>> <http://www.oii.ox.ac.uk/people/corinne-cath>
>>> Email: [email-masked] <mailto:ccath@turing..ac.uk> &
>>> [email-masked] <mailto:[email-masked]>
>>> Twitter: @C_Cath
>>>
>>>
>>> _______________________________________________
>>> hrpc mailing list
>>> [email-masked]
>>> https://www.irtf.org/mailman/listinfo/hrpc
>>
>>
> 

-- 
Niels ten Oever
Researcher and PhD Candidate
Datactive Research Group
University of Amsterdam

PGP fingerprint	   2458 0B70 5C4A FD8A 9488
                   643A 0ED8 3F3A 468A C8B3

---

From: Tony Rutkowski <[email-masked]>
Date: Sat, 18 Aug 2018 10:39:28 -0400

+1

Very useful and insightful draft.

-t

---

From: Niels ten Oever <[email-masked]>
Date: Sat, 18 Aug 2018 16:52:38 +0200

I find the draft quite confusing for different reasons, but a main
process consideration with this draft is that it is labeled hrpc, while
it aims to be a proposed standard. Which is not possible because hrpc is
part of the IRTF which does not produce standards.

So the authors should probably consider changing their objectives or the
venue of discussion.

Best,

Niels

---

From: Nalini J Elkins <[email-masked]>
Date: Sat, 18 Aug 2018 14:57:12 +0000 (UTC)

>So the authors should probably consider changing their objectives or the

As one of the authors, what WG might you suggest as a proper venue for discussion for the proposed standard portion?
 
Thanks,

Nalini Elkins
CEO and Founder
Inside Products, Inc.
www.insidethestack.com
(831) 659-8360

________________________________
From: Niels ten Oever <[email-masked]>
To: [email-masked] 
Sent: Saturday, August 18, 2018 7:52 AM
Subject: Re: [hrpc] draft-elris-hrpc-righttolife-00

Best,

Niels

---

From: Niels ten Oever <[email-masked]>
Date: Sat, 18 Aug 2018 17:01:06 +0200

> As one of the authors, what WG might you suggest as a proper venue for discussion for the proposed standard portion?

That is not a question for me to answer, since I am not sure it should
have a place in any WG.

If you do think it fits in the IETF, it might be an idea to ask the
[email-masked] list.

Best,

Niels

---

From: Tony Rutkowski <[email-masked]>
Date: Sat, 18 Aug 2018 11:05:51 -0400

The one that has been the most effective these days for that kind of
internet specification is OASIS.  It is were everyone took the Cyber
Treat and Intelligence Sharing "crown jewel - STIX.  It's really easy to
get things going.  It's global.  It has broad industry and government
involvement.  It's fast.  They have well versioned specs that are freely
downloadable with permanent URIs.  You have some the best people in the
business involved and it's chaired by the incredible Rich Struse!  See
https://www.oasis-open.org/committees/tc_home.php?wg_abbrev=cti

In fact, you might even be able to insert your use case into STIX.

--tony

---

From: Nalini J Elkins <[email-masked]>
Date: Sat, 18 Aug 2018 15:12:56 +0000 (UTC)

>In fact, you might even be able to insert your use case into STIX.

Tony, I will talk to you offline about OASIS / STIX
 
Thanks for the information.

Nalini Elkins
CEO and Founder
Inside Products, Inc.
www.insidethestack.com
(831) 659-8360

________________________________
From: Tony Rutkowski <[email-masked]>
To: Nalini J Elkins <[email-masked]>; Niels ten Oever <[email-masked]>; "[email-masked]" <[email-masked]> 
Sent: Saturday, August 18, 2018 8:06 AM
Subject: Re: [hrpc] draft-elris-hrpc-righttolife-00

--tony

---

From: Nalini J Elkins <[email-masked]>
Date: Sat, 18 Aug 2018 15:16:29 +0000 (UTC)

Niels,

Thanks for your comments.

> If you do think it fits in the IETF, it might be an idea to ask the [email-masked] list.

I think I will do so.  First, I will split the current draft into two drafts.  The first as a problem statement or use case which would fall under the charter of HRPC; the second as the proposed standard or solution.  Then, the community can decide whether this fits into anywhere at the IETF.
 
Thanks,

Nalini Elkins
CEO and Founder
Inside Products, Inc.
www.insidethestack.com
(831) 659-8360

________________________________
From: Niels ten Oever <[email-masked]>
To: Nalini J Elkins <[email-masked]>; "[email-masked]" <[email-masked]> 
Sent: Saturday, August 18, 2018 8:01 AM
Subject: Re: [hrpc] draft-elris-hrpc-righttolife-00

Best,

Niels

---

From: Tony Rutkowski <[email-masked]>
Date: Sat, 18 Aug 2018 11:57:53 -0400

Hi Niels,

Just a few questions and concerns about this draft.

Concerning the title, "Notes on networking standards and politics"
doesn't seem to fit the contents of the draft - which deals only with
the IETF.  There are an enormous array of "networking standards" that
have been around in standards bodies since about 1850.  Minimally,
"IETF" should be inserted in the title.  You also use the term
"networking" only three places in the body text in somewhat vague ways -
and never define the term.  On page 5, you refer to "networking
technology, such as protocols."  So it isn't very clear what exactly
what is included under the penumbra of "networking standards."  Lastly,
since your research question asks "are protocols political," the title
should probably read "Notes on IETF protocols and politics" - which
seems to describe the scope and content.

The research question "are protocols political?" Seems a trivial one. 
Of course they are political.  They always have been and always will
be.  Try looking at the  minutes of the first intergovernmental meeting
to develop a treaty for internet communications at Dresden in 1850. 
Lots of politics! :-)  So you might simply begin with the assertion that
they are political...or more precisely, political-economic.

You also seem to ignore the history of what you seem to be dealing with
here - the specs for what was known for years as the DARPA internet (and
before that, the host-to-host protocol network).  See
https://www.cs.princeton.edu/courses/archive/fall08/cos561/papers/cerf74.pdf. 
See also, https://www.darpa.mil/about-us/timeline/tcp-ip

The IETF was created in 1986 (not 1994).  Moreover, the tcp/ip platform
for the first 20 years was hardly open or voluntary.   It ran on DOD and
then additional NSF links - with NSA bit level security for the first
ten years.  Every user, host, address, port, service and network was
well-known and allocated by the NIC.  Every packet was monitored.  That
didn't begin to change until the mid-90s.  As a member of the USG's
InterNIC oversight panel as well as Sprint's internet director, I can
speak to every detail.  Most of the information is publicly available,
so I suggest for references, using actual sources rather than someone's
views citing someone's views citing someone's views...

Your treatment of relevant international treaty provisions in clause 5.1
is without citations or much credibility .   For example, the commentary
about the WTO's used of "standards" has no citations whatsoever.   The
WTO has many diverse treaty instruments.  The most relevant are the GATS
provisions - which were developed in the early 1990s  as a companion to
the ITU 1988 Melbourne treaty provisions to legalize public internets
internationally.  Prior to that, only government sponsored internets
were allowed across borders pursuant to CCITT Rec. D.1.  The GATS
provisions refer to only two standards bodies - the ITU and the ISO - to
prevent anticompetitive assertion of national security constraints.  I
know, because I was the ITU representative to the negotiations and
inserted them!

You also completely ignore the ITU - whose treaty provisions tracing
back to 1850 constitute the foundation for how nation states allow
traffic to enter their national jurisdictions, services to be provided,
radio emissions protected, and communication satellites placed in
orbit.  They have lots of network protocol standards!  The first one in
1850 even had a major protocol political component - they adopted Mr.
Morse's standards!

I'd also encourage a rather more open conceptualisation of human
rights.  See, e.g., draft-rutkowski-hrpc-hraas-00.  (Unless, of course,
there is no interest in the full breadth of international human rights -
which are of considerable concern today.)

Hopefully this helps with the improvement of this draft.

--tony

---

From: Tony Rutkowski <[email-masked]>
Date: Sat, 18 Aug 2018 12:39:43 -0400

Additionally...

Referencing
http://www.circleid.com/posts/20180804_internet_as_non_kinetic_wmd/

The draft fails to deal with the considerable body of information that
portray the global public internet based on IETF protocols as inherently
antithetical to human rights along the lines raised by
draft-elris-hrpc-righttolife-00.

For example, do FSB and GRU agents have a "human right of expression"
without surveillance to use IETF protocols - especially those for
encryption - to bring about regime change in another country?  It is a
rather visible use case today.  Do the continuation of unfettered
end-to-end networking protocol assumptions advance their "expression?" 
Seems like a significant political choice, no?

Or does a national leader have a human right to use those other
protocols to spread racism and xenophobia as a global norm?  The EU
began last year to address the matter and reached an agreement with
social media providers to implement obligations under the several  human
rights instruments treating the propagation of racism and xenophobia.

There seems to be a certain balance lacking in the use cases in the
current internet draft.

--tony

---

From: Niels ten Oever <[email-masked]>
Date: Sat, 18 Aug 2018 19:45:31 +0200

Hi Tony,

On 08/18/2018 05:57 PM, Tony Rutkowski wrote:
> be. 

While this might seem trivial for you, we have had many long discussions
about this in this RG, and this document seems to document and address
exactly those discussion and to provide a shorthand when that discussion
pops up again (it happens quite regularly).

It does not aim to provide a full overview of the history of the
politics of standards, that is why 'Notes on' is prepended.

This has also been discussed at the session in Montreal.

Best,

Niels

---

From: Tony Rutkowski <[email-masked]>
Date: Sat, 18 Aug 2018 14:32:04 -0400

Hi Niels,

This was one of many observations, and the least significant.  

Out of curiosity, did anyone argue that protocol standards are not
political?  Even layer 1 protocol standards are enormously political.

--tony

---

From: Andrew Sullivan <[email-masked]>
Date: Sat, 18 Aug 2018 15:14:31 -0400

I don't believe it is even remotely desirable to limit this draft to IETF 
protocols. I can see a reason to limit it to internetworking protocols (so, 
e.g., phone systems would probably be out, because I don't think they were 
designed in an internetworking way).

Best regards,

A

--
Please excuse my clumbsy thums
----------

---

From: Tony Rutkowski <[email-masked]>
Date: Sat, 18 Aug 2018 15:52:45 -0400

1. The scope seems to be limited to IETF standards over the past 20
years.  It  would seem a stretch to apply more broadly, but you could
try if a lot of changes were made, e.g., treating the scores of other
standards bodies.

2. "Internetworking" is never defined, so who knows what that means?

3.  X.25 data networks, SDH/SONET, SS7, mobile telephony networks are
not designed for internetworking?  Really? :-)

--tony

On 18-Aug-18 3:14 PM, Andrew Sullivan wrote:
> I don't believe it is even remotely desirable to limit this draft to
> IETF protocols. I can see a reason to limit it to internetworking
> protocols (so, e.g., phone systems would probably be out, because I
> don't think they were designed in an internetworking way).
>
> Best regards,
>
> A

---

From: Andrew Sullivan <[email-masked]>
Date: Sat, 18 Aug 2018 17:12:42 -0400

> try if a lot of changes were made, e.g., treating the scores of other

It might well be that section 5 has gradually focussed the discussion
toward IETF standards.  It's not clear to me that this is a good idea,
because (for instance), while W3C standards are only for the web and
not the whole Internet, an _awful lot_ of them are directly relevant
to the material in the draft.  Moreover, the standards-making activity
at W3C is similar to, without being the same as, the IETF style.  In a
different way, the activity of the GSMA might be directly relevant to
internetworking in a few areas (more on this below).  This suggests to
me, however, that the draft needs to spend more time on some of those
other standards efforts (or else, as you say, restrict its focus
exclusively to the IETF.  I just think it would be a much less
interesting result if it applied only to the IETF, because the
obvious response to it would be that any issues it raises would only
be true of the IETF and therefore one just shouldn't use the IETF for
those cases).

> 2. "Internetworking" is never defined, so who knows what that means?

I think it is the activity of making different networks, formally
independent and otherwise notionally contractually unbound to one
another, interoperate through a common substrate protocol with as much
as practical of the intelligence at or near the end of the internet.
TCP/IP is, in this view, an internetworking protocol because it is end to
end yet does not depend on transitive contractual relationships
through the entire path in order to allow network flows.  The ARPANET
NCP is _not_ an internetworking protocol, and neither is something
like the catanet approach with smart gateways.  Similarly, several
"internet of things" protocols (like ZigBee and ZWave) are not really
internet protocols at all, but kinds of local network that require a
gateway which then connects to the internet (or possibly the global
Internet).  Therefore, …

> not designed for internetworking?  Really? :-)

…really, or anyway sort-of-really.  There is an argument to be made
for X.25, though I sometimes wonder whether the VC/PVC approach really
was internetworking given the focus on the DTE.

SDH/SONET is something on which you happen to be able to build
internets (just as Ethernet is) but it is not actually an
internetworking technology as I am using the term.  It most certainly
_is_ a network technology, so if the draft wants to talk about all
network technologies I agree it ought to be included.  But that seems
to me to be a much larger topic than the draft is discussing, and I
think it will be hard to expand this discussion to include (e.g.)
ITU-T and ISO standards effectively, given that their development
works quite differently.

SS7 is not, in my meaning, an internetworking protocol because phone
systems simply aren't internetworks.  They rely on transitive
contractual relationships (sometimes those contracts are encoded as
treaties or national law, but they're still not merely best efforts
the way internets are).  They are, again, important networks.  They're
also networks that rely on multiple networks connected together.  But
that interconnection does not happen as an internet does.

Finally, some of the parts of the mobile telelphony environment are
internetty, and some other parts are not.  It's hard for me to speak
generically.  I do think that at least many parts of 5G are not
intended to be internet protocols, but instead to substitute the
catanet style of networking for internetworking.  Whether that is a
good idea is an open question (but, fortunately, not one for this
discussion).

Best regards,

A

-- 
Andrew Sullivan
[email-masked]

---

From: Stephen Farrell <[email-masked]>
Date: Sun, 19 Aug 2018 01:39:37 +0100

> Very useful and insightful draft.
My opinion differs.

Over the 30 or so years of the troubles in the north of Ireland (*)
there was a recurring barrier to progress that ended up being called
"whataboutery." [1] I think the idea of creating an IANA registry
to enumerate some ill-defined "bad" things, whilst (inherently!)
being unable to specify how those "bad" numbers interact with
Internet protocols (or anything else) would be similarly unwise.

Luckily, I doubt anything will come of this. Sadly, I can imagine
it may be a temporary distraction.

Cheers,
S.

[1] https://en.wikipedia.org/wiki/Whataboutism

(*) Apologies to anyone who'd prefer I had used the term "Northern
Ireland" - I had to pick one or the other - if there's a follow up
to this, I'll toggle:-) And for almost everyone to whom that seems
like a non-distinction, I'll explain over a beer sometime.

---

From: Melinda Shore <[email-masked]>
Date: Sat, 18 Aug 2018 17:36:39 -0800

>> Very useful and insightful draft.

As does mine, both because I tend to think that we would
like to work in service to online freedom rather than
in service to restricting it, and because at least one of
the examples given is very heavily culturally-determined
and reflects urban western values rather than universal
ones.  The proposal is well-intentioned but unhelpful.

Melinda

-- 
Software longa, hardware brevis

PGP fingerprint: 4F68 2D93 2A17 96F8 20F2
                 34C0 DFB8 9172 9A76 DB8F

---

From: Tony Rutkowski <[email-masked]>
Date: Sun, 19 Aug 2018 07:30:55 -0400

Good start on dealing with a key consideration in this draft.  A section
discussing the subject along these lines seems essential for anything
purporting to deal with the subject.  Minimally, a definition is
necessary.  Simply proffering a research question on whether network
standards are political when the answer is well known, doesn't provide much.

Agreed on the broader organization scope, however, that requires some
substantial understanding of the rather large array of organizations
that produce internetwork standards.

As to the telephone networks being internetworks - it would be devise a
construct that excluded them.  It's worth noting that the backplane
signalling component - currently SS7 or its equivalent  - were the first
large-scale implementation of connectionless datagram protocols - the
basic definition used by DARPA and OSI internets.  The  transport paths
globally for both the networks and signalling get routed through many
diverse networks along the path between endpoints.  There is also the
irony that the first  RFC on tagging DARPA host address - what done by
Jim White and he invokes telephone networks as the model.  A further
irony is the use of ENUM on DARPA internets to resolve telephony end points.

--tony

---

From: Tony Rutkowski <[email-masked]>
Date: Sun, 19 Aug 2018 08:35:25 -0400

This is a good example of where Human Rights as a Service (HRaaS),
draft-rutkowski-hrpc-hraas-00. proves its value.  Many people in
communities peripheral to the international human rights law community,
have varied understanding of exactly what are those rights.  The legal
community admittedly has done a poor job in conveying the knowledge base.

Thus EDCO should have cited UNHR03 - Everyone has the right to life,
liberty and security of person, as well as  ICCPR06  - Every human being
has the inherent right to life [nor] arbitrarily deprived of his life. 
Here there there is no bias or opinion.  These are the provisions in the
public international law of human rights.  EDCO may want to join in the
support for and implementation of the HRaaS draft.

As to how to implement these provisions using EDCO's use cases, they may
want to consider either OASIS or ETSI - which EDCO is joining.  Last
year, we discussed a potential new work item that conveys blocking
notice related information based on human rights of racism and xenophobia.

--tony

---

From: Nalini J Elkins <[email-masked]>
Date: Sun, 19 Aug 2018 14:02:45 +0000 (UTC)

> I tend to think that we would like to work in service to online freedom rather than
> in service to restricting it,.

Certainly, freedom of speech is to be considered as a human right.
Having said that, in the offline world, freedom to say anything at anytime has been balanced by other considerations.  Hence the often cited "one does not have the freedom to cry "fire" in a crowded theater."   Is there a responsibility for the Internet to do similarly?

>and because at least one of the examples given is very heavily culturally-determined
> and reflects urban western values rather than universal ones.  
I would be curious as to which example (human trafficking - slavery or loss of lifeentailed by 3-d printed guns) reflects in your opinion "urban western values"?BTW, I, personally, find that, if anything, my personal values tend to be moreAsian (as that is my background) and that of my co-author to be rural (as thatis his background).   
 
Thanks,
Nalini Elkins
CEO and Founder
Inside Products, Inc.
www.insidethestack.com
(831) 659-8360

---

From: Tony Rutkowski <[email-masked]>
Date: Sun, 19 Aug 2018 10:18:50 -0400

Hi Nalini,

The HRaaS enumerations we're intended to further your admonition.

Network protocols and services inevitably enhance some human rights and
harm others.  An honest and open analysis should list them all -
articulating the weighting given to each and the context to the extent that
is possible. Hence the name HRaaS.

-t

On Sun, Aug 19, 2018, 10:07 AM Nalini J Elkins <
[email-masked]> wrote:

> Having said that, in the offline world, freedom to say anything at
> anytime has been
> balanced by other considerations.  Hence the often cited "one does not
> have the
> freedom to cry "fire" in a crowded theater."   Is there a responsibility
> for the Internet to do
> similarly?
>
>
> I would be curious as to which example (human trafficking - slavery or
> loss of life
> entailed by 3-d printed guns) reflects in your opinion "urban western
> values"?
> BTW, I, personally, find that, if anything, my personal values tend to be
> more
> Asian (as that is my background) and that of my co-author to be rural (as
> that
> is his background).
>
>
> Thanks,
> Nalini Elkins
> CEO and Founder
> Inside Products, Inc.
> www.insidethestack.com
> (831) 659-8360

---

From: Andrew Sullivan <[email-masked]>
Date: Sun, 19 Aug 2018 10:48:20 -0400

Hi,

On Sun, Aug 19, 2018 at 07:30:55AM -0400, Tony Rutkowski wrote:
> basic definition used by DARPA and OSI internets.

The definition that I was using (which you quoted) did not depend on
connectionless datagram protocols.  Indeed, I think you could make an
internet out of a connection-oriented protocol, and I'm not even sure
that a datagram protocol is a necessary condition for an internet
(though it seems like a good idea).  Part of the definition I'm
arguing for here includes a measure of policy consideration: the
non-reliance on transitive and pre-existing contractual relationships
all along the path.  Telephone networks are, in my reading,
fundamentally dependent on such relationships by design.

> Jim White and he invokes telephone networks as the model.

I don't understand how an analogy someone used once is any evidence of
anything in this discussion.

>  A further

There is no question that you can encapsulate other kinds of network
traffic in an internet, but I don't see how that's any kind of
evidence that the other kinds of networks thereby become part of the
used internet.

Best regards,

A

-- 
Andrew Sullivan
[email-masked]

---

From: Tony Rutkowski <[email-masked]>
Date: Sun, 19 Aug 2018 11:15:43 -0400

Very useful discussion of characteristics of a definition.  This should
definitely be in the draft - although the implications with respect to
standards is not clear.

"Non-reliance on transitive and pre-existing contractual relationships
all along the path" seems worth exploring.  Presumably, you mean to
include only layer 3 and above.  The only ones at lower layers that
could apply are radio internets - and those are significantly regulated
and subject to licensing except for local access - although even there,
they are subject to type-acceptance regimes.

Are there any internetworks in existence today that don't rely on
transitive and pre-existing contractual relationships?  I'm not aware of
any, but may be wrong.  Does that disqualify them from being an
internetwork? 

Are treaty instruments applicable as "contracts" among Nation States? 
All Nation States by treaty among all 193 of them, agree that each has
absolute sovereignty within their jurisdiction, and the ITU treaty
instruments are the basis for admitting all extraterritorial
internetwork traffic. communication. 

-t

---

From: "Salz, Rich" <[email-masked]>
Date: Sun, 19 Aug 2018 19:04:54 +0000

>Network protocols and services inevitably enhance some human rights and harm others.  An honest and open analysis should list them all - articulating the weighting given to each and the context to the extent that is possible.

I am somewhat taken aback by this.  If an analysis picks a couple, it’s not honest and open? You seem to be saying that unless it’s exhaustive and analytical (and therefore nobody will disagree with it) it’s flawed and implied not worth doing.  Is that what you really meant?

---

From: Melinda Shore <[email-masked]>
Date: Sun, 19 Aug 2018 11:14:08 -0800

On 8/19/18 6:02 AM, Nalini J Elkins wrote:
> anytime has been balanced by other considerations.  Hence the often
> cited "one does not have the freedom to cry "fire" in a crowded
> theater."   Is there a responsibility for the Internet to do 
> similarly?

Part of the problem here, of course, is that "the Internet" is
undefined for the purpose of this discussion, but you seem to be
asking IANA/whomever to take on a new internet-wide governance
role for which it is not currently responsible.

As I am an engineer, not a lawyer, I'd be grateful for
additional clarification from people who do specialize in these
issues:  I'll note that while the UDHR does mention speech
as a universal right it doesn't lay out any responsibilities associated
with that speech - that is to say, it doesn't plop an asterisk on
"a world in which human beings shall enjoy freedom of speech" with
a note that says "but they can't yell 'fire' in a crowded theater."
Responsible limits on universal rights seem to be specified at
jurisdictional levels, rather than being specified as universal,
themselves.

Another issue is that pretty much by definition you're conflating
instrumentalities with outcomes, and that seems somewhat (!!)
problematic.  I was struck by the fact that you included 3-D printable
guns (and this is where you ran into cultural/jurisdictional woes -
you might find it interesting to take a look at the arguments being
advanced by the Gwich'in Nation with respect to their relationship
with the Porcupine caribou herd in the context of petroleum development
in the western North American arctic) as an example of lethal content
but not, say, instructions for making nerve gas or other genocidal
instruments.

I'd also argue that none of the current content strikes me as
appropriate for a research group.  It might be more appropriate
to try to characterize existing content within the framework you're
trying to construct - if nothing else I think it might tend to
reveal 1) the impossibility of what you're trying to do, and 2)
the cultural biases you're bringing to the discussion.

Melinda

---

From: Tony Rutkowski <[email-masked]>
Date: Sun, 19 Aug 2018 15:14:26 -0400

Yes. Otherwise it is just someone marketing their own product and biases. K
Street is filled with those folks.

-t

On Sun, Aug 19, 2018, 3:04 PM Salz, Rich <[email-masked]> wrote:

> *>*Network protocols and services inevitably enhance some human rights
> and harm others.  An honest and open analysis should list them all -
> is possible.
> I am somewhat taken aback by this.  If an analysis picks a couple, it’s
> not honest and open? You seem to be saying that unless it’s exhaustive and
> analytical (and therefore nobody will disagree with it) it’s flawed and
> implied not worth doing.  Is that what you really meant?
>

---

From: Fred Baker <[email-masked]>
Date: Sun, 19 Aug 2018 14:22:49 -0700

> On Aug 19, 2018, at 7:02 AM, Nalini J Elkins <[email-masked]> wrote:
> 
> Having said that, in the offline world, freedom to say anything at anytime has been
> balanced by other considerations.  Hence the often cited "one does not have the
> freedom to cry "fire" in a crowded theater."   Is there a responsibility for the Internet to do
> similarly?

Speaking for myself, I would argue that human beings have a right to speak, which to is say, to attempt to communicate. We do not have the right to presume someone is listening or cares, we do not have the right to impose our views on someone else, and we do not have the right to speech that harms someone else. Spam and malware come to mind; the parties that create it presumably have a right to do so, but they do not have the right to propagate it in a way that inflicts harm on someone else.

I'm glad you mentioned "responsibility". Personally, I am much more comfortable discussing the responsibilities of someone who uses the Internet to "speak" than with their right to do so.

--------------------------------------------------------------------------------
Victorious warriors win first and then go to war,
Defeated warriors go to war first and then seek to win.
     Sun Tzu

---

From: Tony Rutkowski <[email-masked]>
Date: Sun, 19 Aug 2018 17:23:25 -0400

Hi Melinda,

I am both a lawyer and engineer and have specialized in these issues for
the past 50 years at local, US Federal, and international levels.  The
answer to your question is found in the HRaaS Internet Draft.  There a
finite set of international legal instruments that articulate human
rights.  There are a number of them and they are context dependent and
they co-exist with each other in those different contexts.  Legal
systems are analog, not binary.  There are also "resolvers" which in
different context of "cases in controversy" weigh and apply the multiple
applicable human rights.  They are judicial bodies.

Nalini's use cases are good examples where the human rights weighing
process can give rise to different results.  Indeed, a U.S. Federal
judge in the context of internet protocols weighed UNHDR03 (right to
security of person) against UNHDR19 (right to freedom of expression) and
adjudged the former right significantly outweighed the latter.  
Nalini's use case also underscores why single rights such as expression
can't be cherry-picked out of the ensemble and simply applied as an
abstraction against all other rights.

Nalini also appears to be envisioning a kind of legal-policy body that
was envisioned in the early 1990s as a mirror of the IETF.  Originally
called the Internet Legal Task Force (ILTF), it emerged as the Internet
Law and Policy Forum (ILPF).  It engage a considerable number of people
and organizations over those years to produce useful studies and
recommendations.  Netscape was an early champion - especially its
energetic GC, Roberta Katz - and we would often meet at its West
Middlefield Road headquarters in Mountain View.  One of its notable
achievements was getting global adoption of the X.509 protocol as a
legal basis for trust - arguably furthering multiple human rights.

Hope this helps.

--tony

---

From: Eliot Lear <[email-masked]>
Date: Mon, 20 Aug 2018 12:31:34 +0200

Hi Rich,

On 19.08.18 21:04, Salz, Rich wrote:
> articulating the weighting given to each and the context to the extent
> that is possible.
>
>  
>
> I am somewhat taken aback by this.  If an analysis picks a couple,
> it’s not honest and open? You seem to be saying that unless it’s
> exhaustive and analytical (and therefore nobody will disagree with it)
> it’s flawed and implied not worth doing.  Is that what you really meant?
>

Do you want to system test or unit test?

Eliot

---

From: Nalini J Elkins <[email-masked]>
Date: Mon, 20 Aug 2018 13:37:24 +0000 (UTC)

>Law and Policy Forum (ILPF). 
Thanks, Tony, for your comments.
Melinda,
Tony and I have talked off-list and there are a number of options fora way to proceed.   EDCO is looking into setting up an associatednon-profit to potentially provide a forum to discuss issues whichhave to do with policy as well as protocols.
The organization that Tony brings up is certainly intriguing.    We have not made any decisions.   But, there is no vision of having IANA become some sort of policing bodyfor this kind of "blocking" effort.
Also, this particular draft is not an EDCO policy - it is the individual opinion of the authors.    Thanks,

Nalini Elkins
CEO and Founder
Inside Products, Inc.
www.insidethestack.com
(831) 659-8360

      From: Tony Rutkowski <[email-masked]>
 To: Melinda Shore <[email-masked]>; Nalini J Elkins <[email-masked]>; "[email-masked]" <[email-masked]> 
 Sent: Sunday, August 19, 2018 2:24 PM
 Subject: Re: [hrpc] draft-elris-hrpc-righttolife-00
   
Hi Melinda,

Hope this helps.

--tony

---

From: Nalini J Elkins <[email-masked]>
Date: Mon, 20 Aug 2018 13:45:26 +0000 (UTC)

Fred,

 >that create it presumably have a right to do so, but they do not have the right to propagate it in a way that inflicts harm on someone else.

The reason I had put in the use case of 3-d printed guns is that this is a use case where quite a bit of harm may come to others.  Take the case of India,
where many in my family as well as dear friends, live.  They are able to police their borders as well as internal regions relatively effectively with regard
to the availability of guns.

As you all well know, there is the potential of a fair amount of sectarian strife in India.  Add guns to that volatile mix and to me, it is a disaster in the making.

I, personally feel, that taking the principle of freedom to speech to what I feel is an overreach, there may be a great deal of potential harm to innocent

people.  This is what is motivating me and my co-author to take on this issue.

Thanks,

Nalini Elkins
CEO and Founder
Inside Products, Inc.
www.insidethestack.com
(831) 659-8360

________________________________
From: Fred Baker <[email-masked]>
To: Nalini Elkins <[email-masked]> 
Cc: Melinda Shore <[email-masked]>; "[email-masked]" <[email-masked]>
Sent: Sunday, August 19, 2018 2:22 PM
Subject: Re: [hrpc] draft-elris-hrpc-righttolife-00

---

From: Amelia Andersdotter <[email-masked]>
Date: Mon, 20 Aug 2018 15:50:48 +0200

> be true of the IETF and therefore one just shouldn't use the IETF for

The core issue of research is knowing how to limit yourself. Should an
IRTF RG dig down into political considerations that may have an impact
at W3C, ETSI or 3GPP?

Or rather - is your criticism of the draft such that you are concerned
that activities undertaken in other standardisation fora directly limit
or impact the ability of the IETF or IRTF to exhibit either value
neutrality or political considerations, causing implicitly political
choices made by the IETF to actually not be the moral responsibility of
the IETF as such, but rather a consequence of what peer SDOs are doing?

I'm doubtful that this line of investigation will be fruitful.

I was recently introduced to a metaphor for the internet as a "lasagna
model", where each layer of communication is independent and autonomous
from other layers of communication, and therefore each has its own
responsibility to optimise for good privacy and security (which was the
particular focus of that interaction). This fits, in my view, with the
general gist of the IETF and it's already ongoing processes.

The "lasagna model" is an allegory for not discarding technical
justifications for security in one layer of the lasagna, only because
there is a theoretical possibility that security may come to be dealt
with in a different layer of the lasagna. When I encountered the
"lasagna" metaphor, it also specifically was accompanied by an
observation that many legalistic regulatory frameworks are in fact badly
suited to "lasagna" technologies: specific regulatory frameworks
frequently assume that responsibilities can simply be shuffled around or
designated to any particular party somewhere in the value chain (this is
also something I see a lot of in Tonys and Nalinis comments, when they
are not dealing with semantic questions).

Part of the thrust of my work with Niels, has been exactly taking into
account the "lasagnesque" qualities of IETF and internetworking
standardisation: rather than obscuring the particular layers of the IETF
from public view, they are raised as relevant in and of themselves.
Broadening the scope to any number of inter-relating lasagna layers
would detract from this illustration.

best regards,

Amelia

-- 
Amelia Andersdotter
Technical Consultant, Digital Programme

ARTICLE19
www.article19.org

PGP: 3D5D B6CA B852 B988 055A 6A6F FEF1 C294 B4E8 0B55

---

From: Vittorio Bertola <[email-masked]>
Date: Mon, 20 Aug 2018 16:26:39 +0200 (CEST)

> Il 20 agosto 2018 alle 15.45 Nalini J Elkins <[email-masked]> ha scritto:
> I, personally feel, that taking the principle of freedom to speech to what I feel is an overreach, there may be a great deal of potential harm to innocent people.  This is what is motivating me and my co-author to take on this issue.

While I respect your motivation and find it reasonable, I do not understand how assigning codes to vaguely defined "types of harmful content" can advance your objective. You do not need a code to make the distribution of certain content illegal; you need a law in your country, and perhaps some well organized technical enforcement mechanism (such as filtering lists to be distributed to the ISPs for implementation at the DNS level, as many countries do, though the IETF is just about to make this impossible thanks to the new DNS-over-HTTPS standard, but that's another story).

If what you mean is that countries should be advised to make certain content illegal, then this really does not belong to the IETF, but rather to the many cybersecurity venues and organizations. The HRPC could perhaps, if it wanted, release a document on the correct balance between freedom of expression and the dangers created by certain content, but IMHO it would be much less effective than work at those organizations. Still, I don't see how defining codes or making high level lists would advance all of this.

I also really think that any kind of content filtering is highly cultural and it is a matter for each country's sovereign decision.

Finally, a note on the "right to life" name in itself: when I first saw the subject, I thought this would be about abortion. Just to show you how much this is cultural and varies around the globe...

Regards,
-- 

Vittorio Bertola | Head of Policy & Innovation, Open-Xchange
[email-masked]
Office @ Via Treviso 12, 10144 Torino, Italy

---

From: Tony Rutkowski <[email-masked]>
Date: Mon, 20 Aug 2018 10:53:57 -0400

Hi Amelia,

Rather ironically, the "lasagna" model you describe seems conceptually
identical to the OSI Model that has remained as the network and
information communication model for the past 40 years.  See
https://www.itu.int/itu-t/recommendations/index.aspx?ser=X and
especially the X.300-series, "Interworking between networks."  And, as
you conjecture, applying legal, technical, and business norms to these
layers is a challenge, but it has worked reasonably well over the past
40 years.  One of those challenges is that the layers typically have had
different bodies and norms applied to them.  The IETF, for example, is
one of maybe a dozen organizations dealing with "lasagna" layers 3-4. 
W3C deals with some of the lasagna toppings. 

An entity like 3GPP which has to produce the massive set of
specifications to operate the entire global mobile infrastructure,
pretty much deals with the all the layers as well as the smartphone user
instruments.  This occurs because they have to provide for an a critical
interoperable global infrastructure of networks and devices that support
6 billion users and innumerable "things," including roaming.  That's why
their specifications are so tightly versioned (now on Rel.15), and the
materials and activities equal to several times everyone else put
together.  It's also all rather transparent at
https://portal.etsi.org/3gpp.aspx?tbid=369&SubTB=369,649,651,653,654,656,659,396,667,373,379,380,381,382,657,843,383,375,384,385,386,387,388,825

Similarly, an entity like ITU has to produce the treaty provisions and
the radio spectrum and telecommunication norms that allow global
networks, radio systems, and satellites to actually enable all the
global interoperability.

So you can indeed narrow your focus on only the the IETF lasagna layer
3-4.  But you should be aware that rapidly emerging NFV-SDN virtual
implementations of all these layers make that focus rather meaningless
in the future.  The ancient OSI Lasagna Model is being largely
obliterated in a new virtual potpourri of slices and containers.  3GPP
is being massively consumed with NFV-SDN instantiations of 5G in Release
16.  So to quote Fleetwood Mac's "Don't Stop" theme song, you might want
to think about tomorrow here.

--tony

---

From: Nalini J Elkins <[email-masked]>
Date: Mon, 20 Aug 2018 14:52:51 +0000 (UTC)

Vittorio,

>While I respect your motivation and find it reasonable, I do not understand how assigning codes to vaguely defined "types of harmful content" can advance your objective. You do >not need a code to make the >distribution of certain content illegal; you need a law in your country, and perhaps some well organized technical enforcement mechanism (such as filtering lists to be >distributed to the ISPs for implementation at the DNS >level, as many countries do, though the IETF is just about to make this impossible thanks to the new DNS-over-HTTPS standard, but that's another story).

Our intent was to develop a set of codes and content filtering through a rough consensus mechanism.  This would, hopefully, weed out much of the culturally determined content.
Then, this would become a recommendation (how TBD) to be distributed to countries / ISPs to filter.  (Again, how, TBD).   Our intent was to start this conversation.   

> If what you mean is that countries should be advised to make certain content illegal, then this really does not belong to the IETF, but rather to the many cybersecurity venues >and organizations. 

What venues would you suggest?  I can certainly approach them.  Please feel free to start conversation privately, if you feel appropriate & if not of general interest to HRPC.

> The HRPC could perhaps, if it wanted, release a document on the correct balance between freedom of expression and the dangers created by certain content, but IMHO it would be >much less effective than work at those > organizations. Still, I don't see how defining codes or making high level lists would advance all of this.

Interesting.  The idea of the lists was to obtain consensus.

> I also really think that any kind of content filtering is highly cultural and it is a matter for each country's sovereign decision.

I would respectfully disagree.   Some content filtering is cultural, other content, not so much.  Definitely, it is a matter of sovereign decision.  Actually, this is why we brought this issue up at HRPC.  There are human rights which are stated in the Universal Declaration of Human Rights (UDHR).  This is in the charter of HRPC.  We are just referring to those rights.

This brings up another issue.  The Internet is global.  My own locality, may for example, ban gambling.  With the Internet, I can gain access to a gambling web site and gamble away all night long, if I choose.

The global nature of the Internet inherently undermines the sovereign rights of each region to make and enforce their own laws.  For example, gun laws.  If your country chooses to have guns, great.  If your country chooses not to, then that should also be great.  But, now, the people in the non-gun supporting countries are losing their rights to live how they choose. 

>Finally, a note on the "right to life" name in itself: when I first saw the subject, I thought this would be about abortion. Just to show you how much this is cultural and varies around >the globe..

Yes, I thought of that.    But was not able to come up with a better name.   Any suggestions welcome!   BTW, this is why a group is better than any one or two people.   If many of us can come to consensus, then it may well be work worth regarding.
 
Thanks,

Nalini Elkins
CEO and Founder
Inside Products, Inc.
www.insidethestack.com
(831) 659-8360

________________________________
 From: Vittorio Bertola <[email-masked]>
To: Nalini J Elkins <[email-masked]> 
Cc: [email-masked]
Sent: Monday, August 20, 2018 7:26 AM
Subject: Re: [hrpc] draft-elris-hrpc-righttolife-00

Regards,
--

---

From: Tony Rutkowski <[email-masked]>
Date: Mon, 20 Aug 2018 11:06:57 -0400

One obvious mechanism is to use a DOI tag.  See
https://en.wikipedia.org/wiki/Digital_object_identifier.  Contact the
DOI Foundation at https://www.doi.org/

This is also Bob Kahn's brainchild and been his passion for the past 20
years as a critical internet need, and widely implemented globally.  For
those younger folks unfamiliar with Bob, he was the guy who
conceptualized tcp/ip, implemented DNS, and started up and ran the
IETF.  So he knows a bit about the subject matter. :-)

--tony

On 20-Aug-18 10:52 AM, Nalini J Elkins wrote:
> What venues would you suggest?  I can certainly approach them.  Please
> feel free to start conversation privately, if you feel appropriate &
> if not of general interest to HRPC.

---

From: Nalini J Elkins <[email-masked]>
Date: Mon, 20 Aug 2018 15:47:52 +0000 (UTC)

>DOI Foundation at https://www.doi.org/ 

Thanks for the pointer, Tony.

I will take a look.
 
Thanks,

Nalini Elkins
CEO and Founder
Inside Products, Inc.
www.insidethestack.com
(831) 659-8360

________________________________
From: Tony Rutkowski <[email-masked]>
To: Nalini J Elkins <[email-masked]>; Vittorio Bertola <[email-masked]> 
Cc: "[email-masked]" <[email-masked]>
Sent: Monday, August 20, 2018 8:07 AM
Subject: Re: [hrpc] draft-elris-hrpc-righttolife-00

--tony

---

From: Amelia Andersdotter <[email-masked]>
Date: Mon, 20 Aug 2018 21:50:38 +0200

Nalini,

On 8/20/18 4:52 PM, Nalini J Elkins wrote:
>
>
> This brings up another issue.  The Internet is global.  My own
> locality, may for example, ban gambling.  With the Internet, I can
> gain access to a gambling web site and gamble away all night long, if
> I choose.
>
Being no political scientist myself, and but a dabbler in that field,
this is not conforming with my understanding of pol.sci. debates since
at least the early 2000s.

There was a brief "libertarian" interlude in the 1990s (I borrow this
conceptualisation from James Boyle in "Foucault in Cyberspace", 1996)
that advanced the idea that the internet was so void of jurisdiction
that no national laws would play any role. This view is now surviving on
its ability to quickly boost the funding of various law and
order-agencies in governments ("cyber"), but is generally recognised as
having been wrong. Even in the 1990s it was questioned (Lessig, Boyle).

But having abandoned the view that the internet is a mysterious place
where mysterious people do ominous things in mysterious ways that are
essentially beyond the reach of government, we may instead ask "what is
in the reach of government?" and "how should that reach manifest
itself?" It must in either case be clear that the reach of government
should not manifest itself by pre-empting the governments' capacity to
choose gambling policies or restrict the gambling policy options
available to governments. For instance - several EU jurisdictions have
opted for various forms of payment restrictions rather than web
blocking: they require payment service providers to "know their
customer" (i.e. is the customer a licensed operator, or not?) rather
than requiring ISPs to "control their customers". The EU Commission
wrote a nice report about this a few years ago.

It would seem to me, then, from a human rights perspective, that it is
less problematic if a commercial operator has to "know" another
commercial operator (both of them being legal persons, and not in
general covered by international human rights law), then if a commercial
operator is assumed to have to control their customers' browsing
behaviours (when those customers may or may not be natural persons,
generally covered by human rights law). Also it would seem to me that
the IRTF does not benefit from setting its foot down on the less-human
rights friendly path.

> The global nature of the Internet inherently undermines the sovereign
> rights of each region to make and enforce their own laws.  For
> example, gun laws.  If your country chooses to have guns, great.  If
> your country chooses not to, then that should also be great.  But,
> now, the people in the non-gun supporting countries are losing their
> rights to live how they choose. 
>

I must reject the idea that "the Internet inherently undermines the
sovereign rights of each region to make and enforce laws".

There are some jurisdictional issues that arise because of the internet,
and that have gained attention in recent days - they will be worked out
in places other than the IRTF.

In the 1980s (as I'm sure Tony will recall) there were extensive
discussions on whether or how to transpose all laws about the
autenticity of documents to electronic documents.

Anecdote warning:

I recall it as a Face-Palm Day of my Life when I read in the preparatory
report of CoE Recommendation 89(5) (what would later become the
Cybercrime Convention), that the entire idea of IT crime was essentially
only launched at the international level because European national
delegations of fraud lawyers had failed for 20 years to harmonise
effectively rules on what constitutes a "document", a "signature" and
"authenticity". It was believed that the electronic environment could
allow them to bypass ancient conceptual differences, if they moved
quickly to create entirely new laws for electronic crime rather than
continue their attempt to reconcile the differences that existed for
physical documents.

best regards,

Amelia

>
> >Finally, a note on the "right to life" name in itself: when I first
> saw the subject, I thought this would be about abortion. Just to show
> you how much this is cultural and varies around >the globe..
>
>
> Yes, I thought of that.    But was not able to come up with a better
> name.   Any suggestions welcome!   BTW, this is why a group is better
> than any one or two people.   If many of us can come to consensus,
> then it may well be work worth regarding.
>  
> Thanks,
>
> Nalini Elkins
> CEO and Founder
> Inside Products, Inc.
> www.insidethestack.com
> (831) 659-8360
>
>
>
> > Il 20 agosto 2018 alle 15.45 Nalini J Elkins
> <[email-masked]> ha scritto:
> > I, personally feel, that taking the principle of freedom to speech
> to what I feel is an overreach, there may be a great deal of potential
> harm to innocent people.  This is what is motivating me and my
> co-author to take on this issue.
>
> While I respect your motivation and find it reasonable, I do not
> understand how assigning codes to vaguely defined "types of harmful
> content" can advance your objective. You do not need a code to make
> the distribution of certain content illegal; you need a law in your
> country, and perhaps some well organized technical enforcement
> mechanism (such as filtering lists to be distributed to the ISPs for
> implementation at the DNS level, as many countries do, though the IETF
> is just about to make this impossible thanks to the new DNS-over-HTTPS
> standard, but that's another story).
>
> If what you mean is that countries should be advised to make certain
> content illegal, then this really does not belong to the IETF, but
> rather to the many cybersecurity venues and organizations. The HRPC
> could perhaps, if it wanted, release a document on the correct balance
> between freedom of expression and the dangers created by certain
> content, but IMHO it would be much less effective than work at those
> organizations. Still, I don't see how defining codes or making high
> level lists would advance all of this.
>
> I also really think that any kind of content filtering is highly
> cultural and it is a matter for each country's sovereign decision.
>
> Finally, a note on the "right to life" name in itself: when I first
> saw the subject, I thought this would be about abortion. Just to show
> you how much this is cultural and varies around the globe...
>
> Regards,
> -- 
>

ARTICLE19
www.article19.org

---

From: [email-masked]
Date: Mon, 20 Aug 2018 16:31:18 -0400

Just as a point of information the entire 3D printed gun issue is
about 99% nonsense media circus.

A gun is basically just a tube and a firing mechanism preferably
outfitted with some sort of handle.

People have made simple guns for decades from sources such as a length
of car whip antenna or similar found metal tubing, a spring, a nail,
and a block of wood etc.

They're generally one-use but so cheap that it hardly matters. A 3D
printed gun is really not much better.

And there's even a term for them, "zip guns", and an entire wikipedia
page detailing them and their history:

  https://en.wikipedia.org/wiki/Improvised_firearm

Ammunition can be more difficult but that issue is the same in either
case.

It's like getting worked up over a 3D printed knife as if one can't
just sharpen a bit of metal etc. and use it as a weapon.

I suppose someone will say but this makes it all easily available to
so many!

I just did that one better, above, no 3D printer or skills to use one
needed!

I guess my real point is to what extent are mythologies which are
generally accepted only for their pure shock effect useful in these
discussions, and is it unreasonable to point them out?

-- 
        -Barry Shein

Software Tool & Die    | [email-masked]             | http://www.TheWorld.com
Purveyors to the Trade | Voice: +1 617-STD-WRLD       | 800-THE-WRLD
The World: Since 1989  | A Public Information Utility | *oo*

---

From: Tony Rutkowski <[email-masked]>
Date: Mon, 20 Aug 2018 17:20:22 -0400

Amelia,

You are asking some of the right questions.  A few observations.

The debates here have been occurring for the past hundred years. 
Consider that a hundred years ago when radio technology allowed for the
creation of instant autonomous radio based internets globally across
national boundaries, the human rights related debates emerged.  That
dialogue increased significantly when global satellite based internets
emerged in the 1960s and packet data internets in the 1970s.  By the
time Sean McBride who is the father of international human right law
chaired his commission under UNESCO in 1978, every permutation of
implementing human rights provisions was being discussed.  The use of
tcp/ip instead of clns, or uunet, or fidonet doesn't really alter the
dialogue or concerns, although arguably, the last two were more
autonomous internetworking protocols.

The fundamental global baseline remains the same.  Each Nation State has
absolute sovereignty over networks, communication traffic, and radio
emissions within their jurisdiction.  It is the most basic enduring
predicate, and the reason why every nation is a party to the related ITU
treaty - agreeing to that fundamental baseline - and new nations that
come into existence sign it immediately.  Only the UPU Convention has
such universality.  That is the simple reality, and no rational nation
is going to relinquish that absolute sovereignty.  Indeed, the principal
challenge today in the emerging world of virtualized networks revolves
around the lack of multilateral agreements dealing with extraterritorial
jurisdiction.

So the challenge is to convince those same Nation States to recognize
enumerated sets of human rights in public international law - to the
extent that is possible in different contexts.  That dialogue continues
in many different multilateral venues - the COE and the EU being
contemporary examples.  One of my Alma Matters - WCL - is a leader.  See
https://www.wcl.american.edu/impact/initiatives-programs/center/

One initiative - basically the energetic passion of a single person over
the past two decades - Andrea Sacs based in the UK - has led to the
landmark human rights provision in the last ITU treaty instrument,
Resolution 175, Telecommunication/information and communication
technology accessibility for persons with disabilities and persons with
specific needs - which was articulated by the UN Human Rights Council. 
It also inspired a similar human rights initiative Res. 179 relating to
online protection of children.  Rec. 2, Unrestricted transmission of
news and the right to communicate, has also inserted in ITU treaty
instruments beginning in 1994.  You can download the basic texts
compilation and search for human rights related provisions at
https://www.itu.int/pub/S-CONF-PLEN-2015.  Who from the human right
community will be an advocate at the next treaty conference in two months?

Hope this helps with some of the questions.

--tony

ps. the Cybercrime Convention was borrowed from Abe Sofaer's initiative
at Stanford in the mid-90 within the CISAC effort to prepare the
International Convention to Enhance Protection from Cybercrime and
Terrorism.

---

From: Tony Rutkowski <[email-masked]>
Date: Mon, 20 Aug 2018 18:26:14 -0400

Spent some time going through my reference library to answer the
question - when and where were international human rights treated in a
significant way in the context of emerging internet technologies in the
1980s.  The answer seems to be Mark Feldman's chapter 27, The Right to
Communicate Under International Law, in what was the most seminal work
of the time, the ABA book Toward a Law of Global Communication Networks,
edited by Anne Wells Branscomb.

The late Anne Branscomb was widely regarded as the leading global figure
in this area during the 1980s.  She formed and led the Global Legal
Symposiums convened by the ITU in Geneva over that period.  About 1984,
she pulled together several dozen people under the ABA Section on
Science and Technology, which published the book.  Her remarkable career
can be found at http://branscomb.org/anne-bio.html

So among all the component chapters, it is Feldman that articulates what
amounts to internet human rights law - largely centered around Article
19.  Feldman at the time had left the U.S. Dept of State as its Deputy
Legal Adviser and joined a major Washington law firm and taught at
Georgetown Law school where he remains today.  Perhaps by coincidence,
it was Mark's colleague, Abe Sofaer who headed the Legal Adviser office,
who subsequently went to Stanford's Hoover Institution to pen the first
cybersecurity convention a decade later.

--tony

---

From: [email-masked]
Date: Mon, 20 Aug 2018 21:40:22 -0400

Just a general comment:

It would be helpful when someone says the internet allows this or that
"unprecedented behavior" they ask themselves whether or not the global
telephone network allowed or enabled this over the past 100+ years?

And if it wasn't curtailed pro-actively before, at the protocol level,
why should it be curtailed on the internet?

For example, one could use a phone to place bets in other countries
probably back to when the first betting parlor had a phone installed.

That might have been illegal in the country of origin but other than
very specific crackdowns -- perhaps unilaterally blocking a number or
arresting the gambler -- I don't recall anyone suggesting there should
be some way to stop everyone, pro-actively, from calling any
international number and possibly placing a bet.

Why was that? Where is the parallel history? And if it never existed
why are we creating it anew?

Are some confusing what is inherently a communications medium with the
content it might carry?

Are the protocols being referred to an issue of communications or
content? Or at the very least where overlap might exist can we be very
clear about how this is an overlap and not minting power anew merely
because it feels, to some, like it would be a good result?

That is, other than the trivial observation that if one cuts the
communication wire either metaphorically via protocol modifications or
literally one cuts the content also so, for those who wish to exert
control, it seems like a target of convenience for them.

Cutting the electric power would also stifle the behavior, etc. But no
one has put "who should or shouldn't get electric power" on the table,
or at least not here.

-- 
        -Barry Shein

---

From: Tony Rutkowski <[email-masked]>
Date: Tue, 21 Aug 2018 08:13:39 -0400

Good point. Apparently the numnut US Congress just is only interested in
packets.  From the Act:

‘‘(5) INTERNET.—The term ‘Internet’ means the international computer
network of interoperable packet switched data networks.

---

From: "Salz, Rich" <[email-masked]>
Date: Tue, 21 Aug 2018 12:20:13 +0000

> Apparently the numnut US Congress just …

Let’s avoid insults, no matter how frustrated we are, even if it is our local government because there’s no way of being sure that everyone knows that, in this case, you are a US Citizen.  I don’t, for example.

---

From: Nalini J Elkins <[email-masked]>
Date: Tue, 21 Aug 2018 13:23:26 +0000 (UTC)

>why should it be curtailed on the internet?

 The point (at least that I wanted to make!) is that if countries wanted to curtail it (or any other such activities) then they should be able to do so.  

> Are some confusing what is inherently a communications medium with the content it might carry?

This draft is about content.  At least in my mind, there is no confusion.  I believe that one could validly make the point that this draft should not bediscussed in HRPC because it is not about protocol.  True enough.
But, then where should such matters be discussed?  Do we need a different venue?   What should that be?
I am happy to redo the draft to discuss only the point that some rights need to be balanced with others.  Ex. freedom of speech with safety, for example.
On the other hand, the point from a previous contributor made about how DNS over HTTPS (DoH) and encrypted DNS may prevent countries / ISPs from blocking sites they wish to, for example parental controls, is a good one.  That IS a protocol issue.   I am happy to submit a second draft discussing DoH.   I suppose the tension there is betweenright to privacy vs. right to life / safety or right to self-govern.
What does the group think? 
Thanks,

Nalini Elkins
CEO and Founder
Inside Products, Inc.
www.insidethestack.com
(831) 659-8360

________________________________
 From: "[email-masked]" <[email-masked]>
To: [email-masked] 
Sent: Monday, August 20, 2018 6:41 PM
Subject: Re: [hrpc] draft-elris-hrpc-righttolife-00

Just a general comment:

-- 
        -Barry Shein

---

From: Tony Rutkowski <[email-masked]>
Date: Tue, 21 Aug 2018 09:25:27 -0400

Hi Rich,

I have generally regarded it a duty to criticize governmental
legislative and executive activities that seem inappropriate and
uninformed wherever they are located.  That is pretty American and the
U.S. Congress doesn't get a free pass here.  In the instant example,
"numnuts" is regarded as a humorous term, and the Urban Dictionary comes
close to the common vernacular understanding : someone who is a constant
source of trouble. Usually an individual who screws up, or constant
makes mistakes. Someone who botches a job, event, or situation."

The larger intent, however, was to illustrate in the context of the
definition of terms and Barry's quizzical reflection, how very odd
results can occur.  Apparently if one uses some form of non-packet
connectivity, on-line gambling is entirely licit.

--tony

On 21-Aug-18 8:20 AM, Salz, Rich wrote:
>
> *>* Apparently the numnut US Congress just …
>
>  
>
> Let’s avoid insults, no matter how frustrated we are, even if it is
> our local government because there’s no way of being sure that
> everyone knows that, in this case, you are a US Citizen.  I don’t, for
> example.
>

---

From: Nalini J Elkins <[email-masked]>
Date: Tue, 21 Aug 2018 13:36:41 +0000 (UTC)

>Just as a point of information the entire 3D printed gun issue is about 99% nonsense media circus.

Your point about the current state of technology of 3D printed guns is well made.  On the other hand, I do believe that, even today, they can be fired once and they are also undetectable with metal detectors.  Both of which are extremely troubling to me.

My real concerns are where such technology is likely to go, the speed of improvement, and also how long it takes the standards (or government / policy) world to act.
IMHO, we need to have a real and respectful discussion about these issues.  (As I believe that, by and large, we are having here.)   I also believe that, in some venue, we need to decide as an international group on a consensus basis how to handle such things.   It may well be that some aspects of the discussion are at the IETF / IRTF and other aspects are in another venue.   Technology has outpaced policy throughout history.   But, the speed at which this is happening in the past 20 years and the speed it is likely to go in the next 20 demand, in my opinion, that those in tech start helping with policy.
Thank you all for your time, thoughts and comments.
Nalini Elkins
CEO and Founder
Inside Products, Inc.
www.insidethestack.com
(831) 659-8360

      From: "[email-masked]" <[email-masked]>
 To: Nalini J Elkins <[email-masked]> 
Cc: Fred Baker <[email-masked]>; Melinda Shore <[email-masked]>; "[email-masked]" <[email-masked]>
 Sent: Monday, August 20, 2018 1:32 PM
 Subject: Re: [hrpc] draft-elris-hrpc-righttolife-00

-- 
        -Barry Shein

---

From: Vittorio Bertola <[email-masked]>
Date: Tue, 21 Aug 2018 15:54:54 +0200 (CEST)

> Il 21 agosto 2018 alle 15.23 Nalini J Elkins <[email-masked]> ha scritto: 
> 
> 
> On the other hand, the point from a previous contributor made about how DNS over HTTPS (DoH)  and encrypted DNS may prevent countries / ISPs from blocking sites they wish to, for example parental controls, is a good one.  That IS a protocol issue.   I am happy to submit a second draft discussing DoH.   I suppose the tension there is between
> right to privacy vs. right to life / safety or right to self-govern.

In Montreal, I approached Neils to ask how could I submit DNS-over-HTTPS to the HRPC review team, but then I never had time to do it. I think that the adoption of this protocol could centralize a lot of the world's DNS traffic into the hands of very few operators (basically the four big browser makers), with potential opportunities for security issues, censorship, unauthorized monetization of personal information, mass surveillance, and transfer of sovereignty towards the single country where those few operators are located; and that the IETF has failed to assess this risk properly until now. By the way, the same opinion is held by many in the DNSOP WG and elsewhere among network operators, so I am sure there would be interest outside of this group as well. 
 
Regards,
--

---

From: Bill Jouris <[email-masked]>
Date: Tue, 21 Aug 2018 14:14:35 +0000 (UTC)

It may well be that 3D printed guns was not a great example.  But that still leaves the human trafficking example.  
Regards, Bill Jouris 

Sent from Yahoo Mail on Android 
 
  On Mon, Aug 20, 2018 at 1:32 PM, [email-masked]<[email-masked]> wrote:   
Just as a point of information the entire 3D printed gun issue is
about 99% nonsense media circus.

-- 
        -Barry Shein

---

From: Nalini J Elkins <[email-masked]>
Date: Tue, 21 Aug 2018 14:15:08 +0000 (UTC)

>so I am sure there would be interest outside of this group as well
If you (or anyone else!) is interested in co-authoring such a draft, then I am happy to coordinate a group to do so.   Please send me an email either on the list or unicast.
Or, if anyone wants to send considerations for such a draft, that is fine also.
I will start putting together some thoughts. Thanks,

Nalini Elkins
CEO and Founder
Inside Products, Inc.
www.insidethestack.com
(831) 659-8360

      From: Vittorio Bertola <[email-masked]>
 To: Nalini J Elkins <[email-masked]>; [email-masked] 
 Sent: Tuesday, August 21, 2018 6:55 AM
 Subject: Re: [hrpc] draft-elris-hrpc-righttolife-00

 
Regards,
--

---

From: Niels ten Oever <[email-masked]>
Date: Tue, 21 Aug 2018 16:29:34 +0200

I am completely confused as about what is the aim of this exercise.

Blocking and filtering is not something many countries have problems
with and they are implementing it by forcing Internet infrastructure in
their respective countries to do so (whether it be legally or illegally
according to their own laws and or international standards). A quick
overview of techniques can be found here:
https://tools.ietf.org/html/draft-hall-censorship-tech-05

A way to make content blocking more transparent was brought forward with
HTTP status code 451 in RFC7725.

So I am really not sure what actual problem we're trying to solve here
(and for whom).

If you want to create a RPZ blacklist for content, you can already do
so, and other parties could adopt it if they'd want to.

If you want to set up a public tribunal for content regulation, I really
think IRTF and IETF are not the place for it since it is far outside of
their mandate and expertise. Maybe field the proposal at IGF ?

Best,

Niels

On 08/21/2018 04:15 PM, Nalini J Elkins wrote:
> If you (or anyone else!) is interested in co-authoring such a draft,
> then I am happy to coordinate a group to do so.   Please send me an
> email either on the list or unicast.
> 
> I will start putting together some thoughts.
>  
> Thanks,
> 
> Nalini Elkins
> CEO and Founder
> Inside Products, Inc.
> www.insidethestack.com
> (831) 659-8360
> 
> 
> ------------------------------------------------------------------------
> *From:* Vittorio Bertola <[email-masked]>
> *To:* Nalini J Elkins <[email-masked]>; [email-masked]
> *Sent:* Tuesday, August 21, 2018 6:55 AM
> *Subject:* Re: [hrpc] draft-elris-hrpc-righttolife-00
> 
>> Il 21 agosto 2018 alle 15.23 Nalini J Elkins
> <[email-masked]
> <mailto:[email-masked]>> ha scritto:
>>
>>
>> On the other hand, the point from a previous contributor made about
> how DNS over HTTPS (DoH)  and encrypted DNS may prevent countries / ISPs
> from blocking sites they wish to, for example parental controls, is a
> good one.  That IS a protocol issue.   I am happy to submit a second
> draft discussing DoH.   I suppose the tension there is between
> In Montreal, I approached Neils to ask how could I submit DNS-over-HTTPS
> to the HRPC review team, but then I never had time to do it. I think
> that the adoption of this protocol could centralize a lot of the world's
> DNS traffic into the hands of very few operators (basically the four big
> browser makers), with potential opportunities for security issues,
> censorship, unauthorized monetization of personal information, mass
> surveillance, and transfer of sovereignty towards the single country
> where those few operators are located; and that the IETF has failed to
> assess this risk properly until now. By the way, the same opinion is
> held by many in the DNSOP WG and elsewhere among network operators, so I
> am sure there would be interest outside of this group as well. 
>  
> Regards,
> -- 
> 
> [email-masked] <mailto:[email-masked]>

---

From: Vittorio Bertola <[email-masked]>
Date: Tue, 21 Aug 2018 17:28:01 +0200 (CEST)

> Il 21 agosto 2018 alle 16.29 Niels ten Oever <[email-masked]> ha scritto:
> 
> 

You are talking about Nalini's original draft, right? Because if you are talking about DNS-over-HTTPS, it could make RPZ, and all the country-based content filtering architecture that you describe, completely useless, and move the content filtering for all the planet into the hands of a few centralized operators.

Regards,
--

---

From: Nalini J Elkins <[email-masked]>
Date: Tue, 21 Aug 2018 16:07:34 +0000 (UTC)

>Because if you are talking about DNS-over-HTTPS, it could make RPZ, and all the country-based content filtering architecture that you describe, completely useless, and move the content filtering for all the planet into the hands of a >few centralized operators.
BTW, I am talking to some enterprises and it will create issues for them also.  I am having them give me their concerns. Thanks,

Nalini Elkins
CEO and Founder
Inside Products, Inc.
www.insidethestack.com
(831) 659-8360

      From: Vittorio Bertola <[email-masked]>
 To: Niels ten Oever <[email-masked]>; [email-masked] 
 Sent: Tuesday, August 21, 2018 8:28 AM
 Subject: Re: [hrpc] draft-elris-hrpc-righttolife-00

Regards,
--

---

From: "Salz, Rich" <[email-masked]>
Date: Tue, 21 Aug 2018 16:14:40 +0000

*   BTW, I am talking to some enterprises and it will create issues for them also.  I am having them give me their concerns.

To state the obvious: it would be better if they could come forward themselves, of course.

---

From: Stephen Farrell <[email-masked]>
Date: Tue, 21 Aug 2018 17:26:53 +0100

(Changing the subject, doesn't seem related to Nalini's
draft really)

> To state the obvious: it would be better if they could come forward themselves, of course.

I'd be very surprised if the (real) problems enterprises expect
with DoH related to human rights;-)

HR aspects of the centralisation problem (also a real problem,
but not the same problem, even if triggered by the same tech)
could well be a topic for discussion here though.

S.

---

From: Nalini J Elkins <[email-masked]>
Date: Tue, 21 Aug 2018 16:19:19 +0000 (UTC)

>> BTW, I am talking to some enterprises and it will create issues for them also.  I am having them give me their concerns.
 
> To state the obvious: it would be better if they could come forward themselves, of course.

There will be at least one enterprise present.  I am talking to him about being co-author.  Travel, esp. to Asia, is not easy for everyone (as you know).  But, as I say, will have at least one. 
 
Thanks,

Nalini Elkins
CEO and Founder
Inside Products, Inc.
www.insidethestack.com
(831) 659-8360

________________________________
 From: "Salz, Rich" <[email-masked]>
To: Nalini J Elkins <[email-masked]>; Vittorio Bertola <[email-masked]>; Niels ten Oever <[email-masked]>; "[email-masked]" <[email-masked]> 
Sent: Tuesday, August 21, 2018 9:14 AM
Subject: Re: [hrpc] draft-elris-hrpc-righttolife-00

---

From: [email-masked]
Date: Tue, 21 Aug 2018 13:58:22 -0400

On August 21, 2018 at 09:25 [email-masked] (Tony Rutkowski) wrote:
 > here.  In the instant example, "numnuts" is regarded as a humorous term, and
 > the Urban Dictionary comes close to the common vernacular understanding :
 > someone who is a constant source of trouble. Usually an individual who screws
 > up, or constant makes mistakes. Someone who botches a job, event, or
 > situation."

I've always understood it to be "numbnut" (or plural) where "nut" is
likely a reference to one's head, compare and contrast to numbskull
with very similar meaning.

 > The larger intent, however, was to illustrate in the context of the definition
 > of terms and Barry's quizzical reflection, how very odd results can occur. 
 > Apparently if one uses some form of non-packet connectivity, on-line gambling
 > is entirely licit.

Whether licit or ill the phone system doesn't much attempt to curtail
the activity specifically beyond perhaps the ability to tap or trace a
call or block a number which in many venues requires a specific
judicial order of some sort and applies to most any illegal activity.

Just to make that slightly more concrete in a hypothetical way imagine
if placing a bet involved hitting a characteristic sequence of keys on
your phone independent of the actual phone numbers involved.

Now imagine constant scanning of the phone system for any calls
matching that characteristic sequence of digits being pressed.

That seems closer to what some are proposing for the internet,
essentially some sort of pro-active panoptican investigation and prior
restraint.

And that may come to be, I'm trying not to express an opinion on that
specifically here, but is it a matter for a human rights protocol
discussion except inasmuch as the protocols per se were enabling the
panopticanical behavior?

-- 
        -Barry Shein

---

From: Mallory Knodel <[email-masked]>
Date: Wed, 22 Aug 2018 15:00:12 +0300

> could well be a topic for discussion here though.

I couldn't agree more. A draft on centralisation could encompass issues
such as monopolisation, economic considerations, control, influence and
barriers to entry, among others.

-Mallory

-- 
Mallory Knodel
Head of Digital :: article19.org
gpg fingerprint :: E3EB 63E0 65A3 B240 BCD9  B071 0C32 A271 BD3C C780

---

From: Vittorio Bertola <[email-masked]>
Date: Wed, 22 Aug 2018 14:14:41 +0200 (CEST)

> Il 22 agosto 2018 alle 14.00 Mallory Knodel <[email-masked]> ha scritto:
> 
> 

And there's more: transfer of sovereignty (which also means democracy, and the possibility for people in democratic countries to influence what happens online in their country), opportunities for censorship, trumping of cultural values (i.e. forcing the North American definition of appropriateness onto everyone else)... IMHO, the economic consequences of the ongoing centralisation of the Internet, while very important, are not even the most important ones.
 
Regards,
--

---

From: Nalini J Elkins <[email-masked]>
Date: Wed, 22 Aug 2018 13:31:32 +0000 (UTC)

>And there's more: transfer of sovereignty (which also means democracy, and the possibility for people in democratic countries to influence what happens online in their country), >opportunities for censorship, trumping of cultural values (i.e. forcing the North American definition of appropriateness onto everyone else)... IMHO, the economic consequences of >the ongoing centralisation of the Internet, while very important, are not even the most important ones.

I also believe that innovation will be stifled.    This is truly important for the future.   Innovation cannot be in the hands of a few.  (I will explain more in the draft as to how I believe this plays out.)
Also, centralisation (IMHO) leads to monocultures which are inherently fragile.   
I am also getting feedback from IETFers who work at ISPs as well as enterprises as to their thoughts on the topic of DoH and how it impacts them.  I hope to have use cases, current policies, and so on.   It will take me a week or two to pull this draft together.   I look forward to a very interesting discussion in HRPC.

A number of us have had this discussion privately amongst ourselves for quite a while.
Thanks,Nalini

---

From: Tony Rutkowski <[email-masked]>
Date: Wed, 22 Aug 2018 09:52:42 -0400

So if one body - notably 3GPP which is by any measure (venue size,
network coverage, level of activity, global diversity, internetwork
ecosystem, and force & effect of standards) many times larger than all
other standards body put together - does their work deserve analysis by
those engaged here?  Curious.

--tony

On 22-Aug-18 9:31 AM, Nalini J Elkins wrote:
>
>
>
> > Il 22 agosto 2018 alle 14.00 Mallory Knodel <[email-masked]
> <mailto:[email-masked]>> ha scritto:
> >
> >
> >And there's more: transfer of sovereignty (which also means
> democracy, and the possibility for people in democratic countries to
> influence what happens online in their country), >opportunities for
> censorship, trumping of cultural values (i.e. forcing the North
> American definition of appropriateness onto everyone else)... IMHO,
> the economic consequences of >the ongoing centralisation of the
> Internet, while very important, are not even the most important ones.
>
>
> I also believe that innovation will be stifled.    This is truly
> important for the future.   Innovation cannot be in the hands of a
> few.  (I will explain more in the draft as to how I believe this plays
> out.)
>
> I am also getting feedback from IETFers who work at ISPs as well as
> enterprises as to their thoughts on the topic of DoH and how it
> impacts them.  I hope to have use cases, current policies, and so on. 
>  It will take me a week or two to pull this draft together.   I look
> forward to a very interesting discussion in HRPC.
>
> Nalini

---

From: Stephen Farrell <[email-masked]>
Date: Wed, 22 Aug 2018 14:54:24 +0100

Hi Nalini,

On 22/08/18 14:31, Nalini J Elkins wrote:

> few.  (I will explain more in the draft as to how I believe this
> plays out.) Also, centralisation (IMHO) leads to monocultures which
> are inherently fragile. I am also getting feedback from IETFers who
> work at ISPs as well as enterprises as to their thoughts on the topic
> of DoH and how it impacts them.  I hope to have use cases, current
> policies, and so on.   It will take me a week or two to pull this
> draft together.   I look forward to a very interesting discussion in
> HRPC.
> 
> A number of us have had this discussion privately amongst ourselves
> for quite a while. Thanks,Nalini

I guess I'd encourage you or whomever is considering this or
writing drafts to not be too focused on DoH. (There is space
for a draft on the "effects of DoH" but surely that'd be more
effective if done in dnsop or the doh wg itself?) For HRPC,
I think a draft considering the wider issues (some of which
you mention above) could be good, esp if DoH is just one of
the examples used. To give another, DKIM and DMARC, also have
some centralisation effects, as they (and other anti-spam
technologies) have the effect of making it harder to be a
small mail sender and also lead to centralisation of mail
services. I'd say there're a lot of other examples too.

Partly, I'm suggesting that as a DoH-specific draft is more
likely to end up in a bun fight, and would involve a lot
of non-HR things (e.g. exposure of intranet names to the
DoH services), and DoH is also pretty new, whereas the HR
impacts of centralisation of more mature services (e.g.
mail/search) might be easier to base on real experience,
which we don't yet have with DoH. That said, DoH is a fine
example of a privacy mechanism that likely works better
when centralised, and where over-centralisation (whatever
that means) causes new privacy issues, so it's defo of
interest in this discussion too.

Cheers,
S.

---

From: Vittorio Bertola <[email-masked]>
Date: Wed, 22 Aug 2018 16:00:06 +0200 (CEST)

> Il 22 agosto 2018 alle 15.54 Stephen Farrell <[email-masked]> ha scritto:
> 
> 
> Hi Nalini,
> 
> effective if done in dnsop or the doh wg itself?)

There has been quite some discussion of DoH effects on the DNSOP list in the last few days, so I could easily see such draft coming from there. So it makes sense if this group focuses on a more general analysis.

> For HRPC,
> services.

Been there (in personal capacity, as my personal email is self-hosted since 20 years ago), seen that, also very important.
 
Regards
--

---

From: Nalini J Elkins <[email-masked]>
Date: Wed, 22 Aug 2018 14:11:20 +0000 (UTC)

>writing drafts to not be too focused on DoH.
I shall certainly be doing a draft.  Am happy to collaborate with anyone interested to co-author.Or, if multiple drafts are submitted, then the HRPC community can decide if / how to integrate both.
A number of enterprises are interested in the implications of DoH for their operation.  So, if thatbelongs in a separate draft, fine.  It does need to be documented somehow, though.   Also, myoriginal draft will likely depend on DNS names for implementation.  So, whatever venueit ends up in, we will need DNS for our needs.
Happy to put in other examples of centralization and adverse impacts.   
 Thanks,

Nalini Elkins
CEO and Founder
Inside Products, Inc.
www.insidethestack.com
(831) 659-8360

      From: Stephen Farrell <[email-masked]>
 To: Nalini J Elkins <[email-masked]>; Vittorio Bertola <[email-masked]>; Mallory Knodel <[email-masked]>; "[email-masked]" <[email-masked]> 
 Sent: Wednesday, August 22, 2018 6:54 AM
 Subject: Re: [hrpc] centralisation

Hi Nalini,

Cheers,
S.

---

From: Niels ten Oever <[email-masked]>
Date: Wed, 22 Aug 2018 18:24:52 +0200

> barriers to entry, among others.

I was having exactly such a thing in mind as the follow-up document to the political draft.

Cheers,

Niels

-- 

Niels ten Oever

---

From: Mallory Knodel <[email-masked]>
Date: Wed, 22 Aug 2018 20:10:55 +0300

> I was having exactly such a thing in mind as the follow-up document to the political draft.

Great. And the suggestions that Stephen started seem to be separate from
the rest of the thread on the other proposed, maybe two, drafts.

-Mallory

---

From: [email-masked]
Date: Wed, 22 Aug 2018 13:35:46 -0400

Reading the draft again some points leap out at me:

Who and how is this blocked content registry curated?

Is 16 bits arbitrary? It seems small. It's not clear that in this day
and age one needs to limit themselves to indirection through integers
which were mostly a way to speed up software running on miserably slow
hardware.

What might be more useful is a hieararchical space representing some
sort of taxonomy. For example weapons.manufacture.design or
humantrafficking.slavery.sexual etc. Just off the top of my head,
taxonomy design is difficult and requires a lot of careful thought.

What would one do with this information? The terminology "blocked
content" seems provocative. Is it blocked? By whom? How?

What might be more useful is defining a general taxonomy for tagging
content which for example "net nanny"* type programs which end users
might obtain and can use as they see fit.

Even that assumes some sort of stability of the content, what does one
block exactly?

For example, as experience has proven with spammers, internet web site
addresses and domains are fleeting things.

Even the content itself is fleeting -- one might propose using some
sort of fingerprint of the content independent of its location -- but
if a source is even mildly determined to evade this regimen it's not
difficult.

Again, we see this daily with spam which for example evades Bayesian
and similar automated content-based filters by methods such as
introducing visually invisible word salads or even just rewording
their message and other contents (e.g., images) frequently.

Finally I don't know that IANA has any particular venue in all this
other than they do run a lot of registries of various types. But the
curation would seem to require a super-structure far beyond their
mission.

* In the early-mid 1990s as the net blossomed similar topics came up
often regarding sexually explicit material. A number of products arose
which were sometimes referred to as "net nannies" -- one popular one
even used NetNanny as their product name, released in 1995 it's still
available as are several others.

Here is a wikipedia list of about 50 content control software and
services products:

  https://en.wikipedia.org/wiki/Comparison_of_content-control_software_and_providers

-- 
        -Barry Shein

---

From: Nalini J Elkins <[email-masked]>
Date: Thu, 23 Aug 2018 14:28:18 +0000 (UTC)

Barry,
First, let me thank you for your very thoughtful questions.   I will tell you that I do not have all the answers by any stretch of the imagination.  But, the team internally at my company has struggled with some of the same questions that you ask.

> Who and how is this blocked content registry curated?
This is a very good question.  I believe I have the parameters of the body which may need to be tasked with this but I do not have one identified.  That is, I believesuch a body needs to be, at a minimum, international and rough consensus based.   Other aspects may arise as conversations continue.
That this function will be at the IETF is unlikely.  In fact, I am going to ask that conversation on this draft stop on this list (unless others really want to continue).  I amhappy to discuss with anyone privately.  
One thing that Fred Baker said to me many years ago is that the "IETF does not exist to create RFCs.  The IETF exists to solve problems on the Internet.  Sometimes,RFCs come out of that process."   I have never forgotten what he said to me.  Sometimes, drafts are written to start a conversation about a problem that someone sees.   Conversations can be very fruitful in fleshing out ideas and clarifying thoughts.
One of the biggest problems that I see on the Internet today and the future has to do with content rather than protocol.  I pointed out a couple of use cases in mydraft.  You may also wish to look at the article below on "Deep Fakes".  This has to do with another whole set of issues.
https://money.cnn.com/2018/08/08/technology/deepfakes-countermeasures-facebook-twitter-youtube/index.html
On another front, AI manipulation of content is also getting better and better.  One organization that I follow and find tremendously interesting is the Futures Institute in Palo Alto.www.iftf.org.

>From one of their articles:
"[Imagine a world where] conversation bots have been trained to imitate specific people, using data sets collected from public social media posts. These bots are deployedacross social networks, email and text messages in super-targeted, super-personalized propaganda campaigns. They are highly effective in changing opinions and driving action, as personalized messages appearing to be from real friends, family and favorite celebrities are more influential than advertisements."
You may wish to read an article on this topic:
"AI manipulation is on the rise" : RICHARD MACMANUS : Last updated 10:59, February 19 2018 https://www.stuff.co.nz/technology/digital-living/101551642/ai-manipulation-is-on-the-rise 

Fake video and audio is likely to create an entirely new level of disruption.  Deep fakes and conversation bots are also likely to be used in social engineering attacks.This is one of the topics that I spoke on at ETSI in June of this year.  I believe some people are discussing a potential IRTF group on phishing, attacks, and so forth.
I look forward to very interesting discussions there.

Another content issue is things like brain implants in the hippocampus.
>From the article: https://www.nanalyze.com/2016/11/brain-implants-ai-kernel
"Why the hippocampus? If we start to think of the brain as a sort of computer, the hippocampus is where short-term memories in RAM are converted to long term memories and then stored on the brain’s “hard drive” where long term memories are stored." 
Who is working on this? A startup called Kernel started with 100 million dollar seed investment. https://kernel.co/#info  Implants may make it possible to store memories and download later. Where? The “cloud”, of course? Many questions arise.  What if you could download someone else’s memory?  Who might have access to these memories? 
Issues of privacy, security, government access and much more become crucial in the world we may be moving to.
My actual concern is far broader than "blocking" content.  Your question on taxonomy is very pertinent.

Having said all this, your original question had to do with where will the body that creates this registry reside?  I don't know yet.  I am in quite good touch with people at ETSI and ITU.  One of the enterprises which is very involved with my Enterprise Data Center Operators (EDCO) organization is a member of OASIS.  There are academic institutionswhich have centers who may be interested.  At this point, I want to gather a group of thoughtful people who wish to think about this issue.
I suspect that the venue is not the IETF / IRTF and in particular not the HRPC group.  Even though, many of these issues have tremendous impact on human rights, I do not see the desire from many in this group to have this discussion here.  I really do not want to waste other people's time nor my own.  
I believe that if I post a draft in HRPC simply stating that some rights (freedom) are to be balanced by other rights (right to life) that may be something that has some level of interest in this group.  Also, it is conceivable that there may be a meeting of minds (to some extent) on my thoughts on the negative impacts of centralization / control of the Internet into a few hands and the thoughts in this group on that issue.  So, if the conversation has led to those two drafts, then it is enough.

Having said that, I really appreciate the thoughtful comments that a number of people have made, including yours!

> Is 16 bits arbitrary? It seems small. It's not clear that in this day and age one needs to limit themselves to indirection through integers> which were mostly a way to speed up software running on miserably slow hardware.

Entirely arbitrary.   And a very good question.

> What might be more useful is a hieararchical space representing some sort of taxonomy. For example weapons.manufacture.design or> humantrafficking.slavery.sexual etc. Just off the top of my head, taxonomy design is difficult and requires a lot of careful thought.

Indeed.  A vocabulary and set of concepts - a way to talk about these and other issues which I mentioned above is needed.

> What would one do with this information? The terminology "blocked>content" seems provocative. Is it blocked? By whom? How?

Good questions.  I was thinking "blocked" by policy by whoever - nation states?   Products?  Search engines?A conversation needs to be had on this.

> What might be more useful is defining a general taxonomy for tagging> content which for example "net nanny"* type programs which end users

Yes, indeed.   But, also the other content issues I described above.

> Even that assumes some sort of stability of the content, what does one> block exactly?

> For example, as experience has proven with spammers, internet web site> addresses and domains are fleeting things.
Absolutely.  And that is one of the fingerprints of malware (a nonsense domain name obtained very recently).  This may be one of the things thatDNS over HTTPS makes very hard to detect.  So, should the browsers be tasked with detecting this?   How will we do it?

>Even the content itself is fleeting -- one might propose using some> sort of fingerprint of the content independent of its location -- but
> if a source is even mildly determined to evade this regimen it's not> difficult.
> Again, we see this daily with spam which for example evades Bayesian> and similar automated content-based filters by methods such as> introducing visually invisible word salads or even just rewording> their message and other contents (e.g., images) frequently.

It is certainly a war.

>Finally I don't know that IANA has any particular venue in all this> other than they do run a lot of registries of various types. But the
> curation would seem to require a super-structure far beyond their> mission.

Yes.

>* In the early-mid 1990s as the net blossomed similar topics came up> often regarding sexually explicit material. A number of products arose
> which were sometimes referred to as "net nannies" -- one popular one> even used NetNanny as their product name, released in 1995 it's still> available as are several others.
> Here is a wikipedia list of about 50 content control software and> services products:

Sure.  Quite a bit of my life was mis-spent as a software developer writing commercial products.   So, I am always on the prowl for new product opportunities.
But, the problem here, is that exactly the people one might wish to use the product, are the least likely to do so.  That is, something like NetNanny works because the parent (or person in charge of the router or browser or whatever) installs the product and the child (or person wishing to view such content) is unable to bypass it.
In our case, the person (presumably an adult) who wishes to participate in human trafficking, is unlikely to place such controls (the blocking product) on themselves.  In fact, quite the reverse!   It is conceivable that a nation-state could purchase a product and put it in as the great [nation-state] firewall.  But, I imagine that evasion tactics would soon ensue.

In any case, thank you so much for your comments.  I really appreciate the time and energy spent on being so thoughtful.
Nalini Elkins
CEO and Founder
Inside Products, Inc.
www.insidethestack.com
(831) 659-8360

---

From: Niels ten Oever <[email-masked]>
Date: Fri, 24 Aug 2018 17:24:41 +0200

On 08/23/2018 04:28 PM, Nalini J Elkins wrote:
> I believe that if I post a draft in HRPC simply stating that some rights
> (freedom) are to be balanced by other rights (right to life) that may be
> something that has some level of interest in this group.  

This has been discussed at great length in this group, maybe have a look
the mail archive and search for 'balancing'.

This is also part of RFC8280:

   Human rights can be in conflict with each other, such as the right to
   freedom of expression and the right to privacy.  In such cases, the
   different affected rights need to be balanced.  To do this, it is
   crucial that the impacts on rights are clearly documented in order to
   mitigate potential harm.  This research aims to ultimately contribute
   to making that process tangible and practical for protocol
   developers.  Technology can never be fully equated with a human
   right.  Whereas a specific technology might be a strong enabler of a
   specific human right, it might have an adverse impact on another
   human right.  In this case, decisions on design and deployment need
   to take this into account.

and further down:

   Many threats, enablers, and risks are linked to different rights.
   This is not surprising if one takes into account that human rights
   are interrelated, interdependent, and indivisible.

So not sure what can / should be added to this.

Best,

Niels

---

From: Nalini J Elkins <[email-masked]>
Date: Fri, 24 Aug 2018 15:38:04 +0000 (UTC)

Niels,

Thank you for the references.  It is indeed a very good discussion on balancingof rights.
One of the statements below is:

>Human rights can be in conflict with each other, such as the right to  freedom of > expression and the right to privacy.  In such cases, the different affected rights> need to be balanced.  To do this, it is crucial that the impacts on rights are > clearly documented in order to mitigate potential harm.  This research aims to ultimately > contribute to making that process tangible and practical for protocol developers.  > Technology can never be fully equated with a human right.  Whereas a specific > technology might be a strong enabler of a specific human right, it might have> an adverse impact on another human right.  In this case, decisions on design> and deployment need to take this into account.

In my reading this actually suggests documentation of the impact of rightson specific topics, please let me know if I am not interpreting this correctly.So, if a particular protocol enables certain rights but has an adverseimpact on others, should this not be further described?  Is that not whatthe above paragraph actually says?
Possibly, this documentation should go into the "centralization" draft but maybe we should wait until we have the concrete examples and draftsin hand.

Thanks,

Nalini Elkins
CEO and Founder
Inside Products, Inc.
www.insidethestack.com
(831) 659-8360

________________________________
 From: Niels ten Oever <[email-masked]>
To: [email-masked] 
Sent: Friday, August 24, 2018 8:24 AM
Subject: [hrpc] on balancing of rights - was: Re: draft-elris-hrpc-righttolife-00

and further down:

Best,

Niels

---

From: Seth Johnson <[email-masked]>
Date: Fri, 24 Aug 2018 12:32:01 -0400

A balancing standard is less strong than strict scrutiny, for
instance.  Standards of review should be made central to the
discussion, rather than stating things in general terms like this.  If
you state things like human rights are interdependent while discussing
balancing, you tend to direct understanding toward a generalization
that takes us away from the way courts apply rights.  The difference
between negative and positive rights, for instance, helps explain
that, and in general a treatment of standards of review brings
practical insight.

Positive rights (where a constitution [or other instrument] says "you
have the right of x") tend to be always balanced, not only against
other rights, but against government powers.  Negative rights (where
rights are reserved from the constitutional act, as in "[the
government] shall not abridge the [presumptively pre-existing] right
of x") are treated as only subject to the government's powers inasmuch
as the government's acts are inherent to governing, and even then only
if "narrowly tailored."

---

From: Seth Johnson <[email-masked]>
Date: Fri, 24 Aug 2018 12:41:11 -0400

> as the government's acts are inherent to governing, and even then only

Inherent meaning unavoidable and a compelling state interest, as in
you can't have a government at all unless it can do the kind of act in
question -- and again, even in that instance, since the government is
acting where it has been limited by the fundamental right in the
founding document, the act can only stand if it's narrowly tailored so
it affects the right to the least extent possible.  Balancing
standards don't conceive the limit on what the government does that
way.

---

From: Seth Johnson <[email-masked]>
Date: Fri, 24 Aug 2018 13:56:14 -0400

> continue their attempt to reconcile the differences that existed for

That's a little-understood piece of what's in fact at the core of what
free trade and globalization in that name are really about.
Constructive conversations will begin there.  But only once those
pursuing a short-sighted version of what free trade means (those
running the show so far, that is) expand their conception.

This relates to human rights, too, but not in the way those who pursue
"common policy" that would invade local sovereignty think.

Seth

---

From: Fred Baker <[email-masked]>
Date: Fri, 24 Aug 2018 17:34:41 -0700

The only thing I would add there is that the Internet is an environment in which very human things happen, not a new place in the legal sense. People used to carry pornography in brown paper bags; now they carry it in VPNs. People used to buy drugs on street corners; now they buy them online. People used to plan crimes in hushed meetings in dark and shadowy places; now they use communication vehicles that hide the content. What people do hasn't changed; how and where they do it has. So from my perspective, forensic means and legal remedies should be extensions of existing law, not new laws.

> On Aug 24, 2018, at 10:56 AM, Seth Johnson <[email-masked]> wrote:
>

---

From: Andrew Sullivan <[email-masked]>
Date: Fri, 24 Aug 2018 21:47:49 -0400

Hi Fred,

In general, I agree with the conclusion that the basic framework ought
to be the same ones we use for other things.  I also agree, in
general, that the Internet is not a "new place" in a legal sense
(i.e. natural persons and legal persons are still actors, and nothing
has changed about that by introducing the Internet).  But I am not too
sure that I agree with all of the premises you use to get to your
conclusion, and slightly different premises might yield a slightly
different conclusion.

On Fri, Aug 24, 2018 at 05:34:41PM -0700, Fred Baker wrote:
> The only thing I would add there is that the Internet is an
> environment in which very human things happen, not a new place in
> the legal sense. People used to carry pornography in brown paper
> bags; now they carry it in VPNs. People used to buy drugs on street
> corners; now they buy them online. People used to plan crimes in
> hushed meetings in dark and shadowy places; now they use
> communication vehicles that hide the content. What people do hasn't
> changed; how and where they do it has.

It is certainly true that many of the things people historically did
they now do online, and are simply repeating the same tactics they
previously used, updated for the new circumstances.  But it is not
true that people are _only_ doing things they used to do.  I can think
of two fairly evident novelties.

First, there are techniques that did not used to be possible, but that
came to be possible with ubiquitous connectivity and electronic
transaction.  For instance, mass social manipulation through media
networks was just not possible in the past, because the mass media
didn't work that way: the persuasive power of social media comes from
their intimacy, whereas mass media are persuasive because of the
common messsage shared with a mass audience.  Similarly, mass
injection of vulnerabilities in devices that could all be exploited at
the same time was at the very least extraordinarily difficult if not
completely impracticable.  These seem like things that are genuinely
new, and they might need new social responses.  (This extends, of
course, to things that only happen in the new environment _because_ of
that new environment, such as attacks on the Internet infrastructure
itself.)

Second, there are things that people used to do with great difficulty,
but that are now so trivial as to make them a new kind of action.  I
believe there was a US court, for instance, that ruled in the last
year that certain kinds of searches didn't used to require a warrant
because they were so difficult for police to undertake; so, now that
they're easy to do electronically, oversight in the form of a warrant
is needed. Similarly, it used to be that if you wanted to harass
someone, you took the risk of being in the same jurisdiction with your
target, or else undertook the harassment at great expense, or else
opened yourself to trivial countermeasures (the latter two, for
instance, on the phone).  But on the Internet this sort of attack can
be undertaken comfortably from a jurisdiction that simply won't
prosecute you.  This is not merely an issue with personal harassment:
elctronic fraud and impersonation have similar properties.  That seems
to be an example of something where there are only poor analogies with
prior law, and so arguably there is something to do about them.  (To
be clear, however, I don't think even a little bit that an IANA
registry is such a thing to do.)

>So from my perspective, forensic means and legal remedies should be
>extensions of existing law, not new laws.

Therefore, with the above arguments in place, I'd say that we should
err on the side of extending (or in many cases simply relying on) the
existing law, but that we should admit that in a few rare cases there
are new conditions where we need to "forge[] new instruments of
citizen action", as Ralph Nader put it.

In such cases, though, we had better be careful what we do, lest we
create conditions that lead to perverse outcomes.  (The exeption of
"light trucks" from the CAFE and safety requirements in the US
automotive market is arguably as responsible as anything else for the
rise of the SUV.)  And we must be alert in such debates to the people
who never liked the open Internet, and want to use this as their
opportunity to undermine it.

Best regards,

A
-- 
Andrew Sullivan
[email-masked]

---

From: Fred Baker <[email-masked]>
Date: Fri, 24 Aug 2018 22:32:36 -0700

> that new environment, such as attacks on the Internet infrastructure

In this case, is the issue the attack in question, or the jurisdiction? I think I might use this as an argument toward normalization of laws. I'm thinking of a discussion that happened in the Nairobi IGF a few years ago, in which the UK GCHQ was arguing for normalization of laws regarding criminal investigation among the commonwealth countries. If a crime can cross jurisdictional boundaries, it might be nice for the jurisdictions to be able to cooperate to deal with them. I'm not arguing for a single world government or international law, but if differences in jurisdiction are the root of the problem, I might start there in fixing it.

> registry is such a thing to do.)

I'm one of those people that think judicial oversight is a good thing. So again, if the issue is that law doesn't require judicial oversight and should, maybe that's the first problem to fix.

Long rant on FISA and etc available on request.

> create conditions that lead to perverse outcomes.

My issue, though, is that I hear with some regularity that the involvement of the Internet makes a case for a new law. By way of example, I had that discussion with an FRC lawyer on one occasion. She was arguing for yet another obscenity law. I don't favor obscenity any more than she did, but I didn't follow her logic, given the history of obscenity laws in the US. Her argument: if she had a new law, she had another opportunity to stand in front of a judge and argue the case. The argument wasn't that the issue differed in any important way, it was that a new law meant a new case, cold stop. When we see a case in which a new law is in fact called for, or the application of a procedure that wasn't necessary before becomes necessary, fine. But what I see is in many cases a knee-jerk reactions. That doesn't fly.

---

From: Nalini J Elkins <[email-masked]>
Date: Sat, 25 Aug 2018 05:38:46 +0000 (UTC)

Andrew,
> (To be clear, however, I don't think even a little bit that an IANA registry is such a thing to do.)

This feels a bit discounting to me.   I suggested an IANA registry because that appeared to me to be the only way to get such a conversation started.
I could not see the proper venue in the IETF for this discussion so I made the decision that I did.    What probably really should be done is as we do with other engineering problems, is to discuss the nature of the problems facing us.  
As I have said before, my opinion is that these problems have to do with content far more than protocols.   In the next twenty years, we are likely to see many more changes in:
- how we work,- how we vote / govern ourselves,- how we eat,- how we make things,- how we entertain ourselves,- how we heal ourselves (medicine),
and much more.  All of these will be heavily influenced by technology and have the Internet as an omnipresent pre-requisite.
We should be talking about this.    But, we cannot just be limited to protocols and make certain rights (freedom of speech / privacy) supercede all other rights.  This problem is at the intersection of policy, protocols, rights and norms.   I don't believe that we have the vocabulary, concepts or forum for such a discussion.  Should we develop this?   How should we do it?  Who should do it?
I am working with the Institute for the Future on an ethical way of assessing technology.  They suggest 8 areas which pose risk:
- Truth, Disinformation, Propaganda- Hateful & Criminal Actors- Implicit Trust & User Understanding- Data Control & Monetization- Addiction & the Dopamine Economy- Economic & Asset Inequalities- Machine Ethics & Algorithmic Biases- Surveillance State
At the IETF, we often concentrate on only one or two of these issues, when in reality, it is a far more complex and nuanced problem.
You brought up the asynchronous nature of the Internet:
>Second, there are things that people used to do with great difficulty,>but that are now so trivial as to make them a new kind of action.
Actions both good and bad can be greatly amplified.
Fred is right though in that there may be "nothing new under the sun", in the sense that human beings have always had the capacity to help and harm.  But, both of those can be greatly, and potentially asynchronously, amplified by the Internet.   Human nature has not changed, but the impact it can have, may well have changed.
It is likely also true that many of us, I count myself among them, have essentially mundane and bourgeois concerns.  I want my child, my family and my friends to be healthy andsafe.   The more unsafe the Internet feels, the more technology outpaces policy, more likely people, who were possibly not concerned before, are likely to want to becomeactive just to try to keep themselves and their families safe.   You may recall "Mothers Against Drunk Driving" and other such citizen groups.  
 Thanks,

Nalini Elkins
CEO and Founder
Inside Products, Inc.
www.insidethestack.com
(831) 659-8360

________________________________
 From: Andrew Sullivan <[email-masked]>
To: [email-masked] 
Sent: Friday, August 24, 2018 6:48 PM
Subject: [hrpc] Nothing new under the sun? (was Re: draft-elris-hrpc-righttolife-00)

Hi Fred,

Best regards,

A
-- 
Andrew Sullivan
[email-masked]

---

From: Stephen Farrell <[email-masked]>
Date: Sat, 25 Aug 2018 08:39:26 +0100

Hiya,

I'd also like to agree with a couple of conclusions here (not
sure if like Andrew I disagree with any premises).

On 25/08/18 06:32, Fred Baker wrote:
> if differences in jurisdiction
> are the root of the problem, I might start there in fixing it.

I agree that figuring out how to handle jurisdictional issues
is what governments ought try work on.

Doing that is way out of scope for the IETF/IRTF. I've no idea
if there's even any useful technical input on which we could
reach consensus (other than "hey, things'll keep changing,
sorry";-). If there were something on which we had a chance
to reach consensus, I don't think that'd be done in the hrpc
as many jurisdictional issues don't relate to HR.

> 
> But what I see is in many cases a knee-jerk
> reactions. That doesn't fly.

Agreed again. If the huge increase in multi-jurisdiction events
caused by the Internet is the cause of issues, then adding new
relevant laws in individual jurisdictions has to make that
problem harder and not easier (given the likely variation).

S.

---

From: Eliot Lear <[email-masked]>
Date: Sat, 25 Aug 2018 10:59:12 +0200

> is what governments ought try work on.

+1.
>
> Doing that is way out of scope for the IETF/IRTF.

+1.

>  I've no idea

Jurisdiction can be viewed in the light of societal norms.  Those norms
include how HR are respected.  Because different norms exist in
different societies, different capabilities are sometimes require to
meet those different standards.  Our challenge is that there is but one
Internet, and it doesn't know the difference.

Our community has generally argued that we do not want international
governance, mostly as a tactical matter, due to where that would lead. 
Implicit in that view, however, is an agreed set of norms of our own. 
And yet when we look over the work in this RG, most of the supporting
material leverages international agreements and conventions.

If we could untie this juggernaut with technical means, that would be a
fine use of RG time.

Eliot

---

From: Tony Rutkowski <[email-masked]>
Date: Sat, 25 Aug 2018 07:33:05 -0400

1. The core public international law exists.  It was put in place in
1988 at Melbourne, and additional provisions added the following year in
1989.   Every nation has signed those treaty instruments And yes, there
was a lot of technical input - especially at the treaty conference where
the KGB and GRU insisted additional technical provisions be added after
the Morris Worm incident.  You were there, right?

2. Those provisions were embellished in the 1990s by the GATS and then
in 2001 by the Cybercrime Convention - which are signed by a lesser
number of nations.  There are also the MLAT provisions - for which the
existing provisions and views were extensively covered in the SCOTUS
docket in 17-2, and now continued in the COE TC-Y.   See
https://www.supremecourt.gov/docket/docketfiles/html/public/17-2.html

3. It's outside the scope of this group, but you should be aware of two
ongoing related treaty making activities that can alter the provisions -
the ITU Plenipotentiary Conference in November, and the COE TC-Y 2nd
Additional Protocol group.

4. The greatest emerging challenge is the treaty arrangements for
instantiating extraterritorial NFV/SDN infrastructure and services.

5. A relatively comprehensive history on jurisdiction can be found at
https://www.lawfareblog.com/anthony-rutkowski-international-signals-intelligence-law-provisions-and-history-lawfare-research

-t

ps. if anyone from the UK was discussing extraterritorial jurisdiction
for criminal matters, it was likely someone from the Home Office.  For
years, they led the related intergovernmental group.

---

From: Tony Rutkowski <[email-masked]>
Date: Sat, 25 Aug 2018 08:21:25 -0400

https://www.coe.int/en/web/cybercrime/-/paraguay-ratifies-the-convention-on-cybercrime-and-the-additional-protocol-on-xenophobia-and-racism

Small but deliberate steps toward a desirable goal.  The Additional
Protocol on Xenophobia and Racism is more important than ever these days.

-t

---

From: Andrew Sullivan <[email-masked]>
Date: Sat, 25 Aug 2018 09:30:10 -0400

On Fri, Aug 24, 2018 at 10:32:36PM -0700, Fred Baker wrote:
> In this case, is the issue the attack in question, or the
> jurisdiction?

That's a false dichotomy.  It's also the relationship between the two
things, and anyway these are cases where the very thing itself wasn't
even possible before the Internet, because the Internet is implicated
in the thing.  For instance, the manipulation of social media wasn't a
thing under national jurisdiction before, either, because it wasn't a
thing at all.

> I think I might use this as an argument toward normalization of
> laws.

Well, maybe, but I do not believe it is realistic to argue that, as
long as there is imperfect international normalization of law, no law
should be written.  Different governments are bound to have different
stances on some of these matters, and it's not clear that we are going
to be able to come to agreement on the right answer at a global level.

> I'm one of those people that think judicial oversight is a good
> thing. So again, if the issue is that law doesn't require judicial
> oversight and should, maybe that's the first problem to fix. 

Sure, but that is merely one example.  The point is that differences
of degree, if they add up enough, can amount to a difference in kind,
because certain kinds of action that used to be effectively impossible
are now trivial.  This isn't unusual.  Trains, planes, and automobiles
all brought new kinds of rules and laws in part because things that
were not remotely interesting in an era of horse and human power were
suddenly urgent for the new ages.  (In the early 1900s, there was no
such thing as "jaywalking": it wasn't even an idea.)

> My issue, though, is that I hear with some regularity that the
> involvement of the Internet makes a case for a new law.

Sure, and I think we are in agreement.  Where the Internet is merely
accidentally implicated in something that is already legal or illegal,
the burden falls on those who would like a new law to show why it is
needed -- what's the difference that makes the difference?  But when
the Internet is essentially implicated in the policy question, it
seems obvious to me that the policy question needs to engage with that
fact.  That does not, of course, entail that new laws, treaties, or
government action of other kinds would be necessary in such cases.

Best regards,

A

-- 
Andrew Sullivan
[email-masked]

---

From: Andrew Sullivan <[email-masked]>
Date: Sat, 25 Aug 2018 09:37:38 -0400

On Sat, Aug 25, 2018 at 05:38:46AM +0000, Nalini J Elkins wrote:
> 
> This feels a bit discounting to me.   I suggested an IANA registry because that
> appeared to me to be the only way to get such a conversation started.
> 

I am sorry to have made you feel discounted.  That was not my
intention, yet I can see how what I wrote could be read that way and I
apologise unreservedly.

I think the disagreement we have about your tactic is that IANA is
generally a registry for technical parameters, and I don't believe
that any of these issues is likely to yield to a tech fix.  That is, I
doubt that most of these policy questions are sufficiently clear that
we could even know what engineering questions could be answered.  (I
don't believe in a hard separation between technical and policy
issues.  But for policy issues with a large technical component, if we
are going to apply engineering techniques we will need to have some
idea of what problem it is we are trying to solve, and I doubt we have
that yet.)

Best regards,

A

-- 
Andrew Sullivan
[email-masked]

---

From: Nalini J Elkins <[email-masked]>
Date: Sat, 25 Aug 2018 14:10:47 +0000 (UTC)

Andrew,
>> >> This feels a bit discounting to me.  I suggested an IANA registry because that>> appeared to me to be the only way to get such a conversation started.>> 
> I am sorry to have made you feel discounted.  That was not my> intention, yet I can see how what I wrote could be read that way and I> apologise unreservedly.
Thank you.  

> I think the disagreement we have about your tactic is that IANA is> generally a registry for technical parameters, and I don't believe> that any of these issues is likely to yield to a tech fix. 
Maybe.  I think that a tech fix is potentially a part of the solution.I also think that the technical components of these issues aresufficiently complex that it needs a very technically savvygroup to discuss them.

> That is, I doubt that most of these policy questions are sufficiently clear that> we could even know what engineering questions could be answered.> (I don't believe in a hard separation between technical and policy> issues.  But for policy issues with a large technical component, if we> are going to apply engineering techniques we will need to have some> idea of what problem it is we are trying to solve, and I doubt we have> that yet.)  
I agree.  And, as I said in another note is:
"What probably really should be done is as we do with other engineering problems, is to discuss the nature of the problems facing us."
I should have taken a stab at that rather than proposing a solution (theIANA registry) but that is 20-20 hindsight.
But, not only do we need use cases, we need to describe what the potentialimpact is.  We also do not know that the problem is always human rights issue. It may be something entirely different.
Actually, I don't even know if this discussion (or the potential draft oncentralization of control of the Internet) belongs in HRPC.  I have no ideawhere it does belong.  I feel it is important.  I hope that we can reach consensuson something and not just say something like "things'll keep changing,sorry";-)."

Nalini

---

From: Tony Rutkowski <[email-masked]>
Date: Sat, 25 Aug 2018 11:12:03 -0400

These recitations of the history are not really accurate.

The first multilateral focus on "internet social media" are traceable to
concerns expressed in the 1920s by the then USSR which feared that that
radio based instantiated social media could adversely affect human
rights.  An international organization and treaty were created - largely
among USSR allies.  The potential for harm to the infrastructure ("DOS"
radio interference attacks) eventually led to a variety of treaty
provisions in the international Radio Regulations to help mitigate the
problem.  However, during the 1930s, the Third Reich effectively used
radio social media to propagate xenophobia and the fears became real.  
See
https://www.irishtimes.com/opinion/dangers-of-nazi-era-xenophobia-stalk-europe-again-1.3390924?mode=amp

The same concerns arose in the 1960s with the advent of satellite based
internets, and then with packet internets in the 1970s, with similar
treaty based solutions effected.  These concerns were all discussed over
a two year period of the McBride Commission and found in the lengthy
report published in 1980. 

Beginning in the mid-90s, the problems again were manifested on tcp/ip
based internets.  The concerns were raised in a variety of prominent
multilateral fora - initially the 10-14 Nov 1997 UNHCR Geneva
Conference, "Seminar on the role of Internet with regard to the
provisions of the International Convention on the Elimination of All
Forms of Racial Discrimination."

The technology and protocols change.  The generations of people change. 
Few know or care about the history.  The multilateral dialogue and
mitigations are pretty much the same. 

-t

ps. a potential specific technical solution to Nalini's use case in the
context of the EU can be found in the attached 2016 ETSI contribution.

---

From: Bill Jouris <[email-masked]>
Date: Sat, 25 Aug 2018 18:37:31 +0000 (UTC)

The thing is, these are issues where technology is heavily involved.  Experience shows that we have just a couple of options: 
- we can try to work out some technical solutions. 
- we can at least clarify what the technical issues are, what are possible approaches, and what are NOT viable approaches.- we can decline to wade into the morass.  And then, when things go south, rules will get made by legislators (who, overwhelmingly, are clueless about technology) or administrators (who aren't generally much better).  And we will be stuck with whatever kludge they invent . . . even if it isn't technically possible.
I would think that we would prefer to go with one of the first two.  If only in our own interest -- do YOU want to be the guy who is charged with implementing something that appeared out of the fevered brain of some lawyer who barely passed high school science?  Or implementing the preferences of whichever company managed to lobby the legislature most effectively?   

Yes, legal considerations will have to come into the implementation.  But if we are too hesitant, those will be the only considerations.  And that way lies a horrid mess.  

Bill Jouris 

      From: Andrew Sullivan <[email-masked]>
 To: [email-masked] 
 Sent: Saturday, August 25, 2018 6:30 AM
 Subject: Re: [hrpc] Nothing new under the sun? (was Re: draft-elris-hrpc-righttolife-00)

Best regards,

A

-- 
Andrew Sullivan
[email-masked]

---

From: [email-masked]
Date: Sat, 25 Aug 2018 15:36:00 -0400

Two quick thoughts which come to mind are:

1. The old technical adage: Mechanism! Not Policy!

2. When does quantity become quality?

On #1 it's a nice starting point but can take a lot of thought to turn
into an operational definition.

On #2 my first thought is email spam. Some paper junk mail may have
been annoying* at times but the automation and nearly cost-free nature
of email and the attention it demands probably moves it to a new
quality of abuse by its sheer quantity and pervasiveness.

* Sometime in the 1990s someone grabbed our superficial customer list,
just names, and had them all added to a paper catalogue mailing list
but all with our office address.

This resulted in the post office showing up one day with dozens of
those large white fiberglass boxes which take two people to carry
marching them into our office filled with those catalogues.

I tried to refuse them but apparently you cannot "refuse" a USPS
delivery. As they said "we (USPS) don't want them! what are we
supposed to do with them?!"

Fortunately the catalogue company wanted them back so sent a
third-party to retrieve them.

Quantity can indeed become quality.

-- 
        -Barry Shein

---

From: Tony Rutkowski <[email-masked]>
Date: Sat, 25 Aug 2018 15:55:47 -0400

That sounds a lot like what the OSI internet standards community sought to
do. Much of what they did was before it's time. It's called thinking ahead
about the adverse consequences.  Because the DARPA internet community lived
in its own security bubble, they never had to worry about the adverse
consequences.

-t

-t

On Sat, Aug 25, 2018, 2:37 PM Bill Jouris <b_jouris=
[email-masked]> wrote:

> The thing is, these are issues where technology is heavily involved.
> Experience shows that we have just a couple of options:
> - we can at least clarify what the technical issues are, what are possible
> approaches, and what are NOT viable approaches.
> - we can decline to wade into the morass.  And then, when things go south,
> rules will get made by legislators (who, overwhelmingly, are clueless about
> technology) or administrators (who aren't generally much better).  And we
> will be stuck with whatever kludge they invent . . . even if it isn't
> technically possible.
>
> I would think that we would prefer to go with one of the first two.  If
> only in our own interest -- do YOU want to be the guy who is charged with
> implementing something that appeared out of the fevered brain of some
> lawyer who barely passed high school science?  Or implementing the
> preferences of whichever company managed to lobby the legislature most
> effectively?
>
> Yes, legal considerations will have to come into the implementation.  But
> if we are too hesitant, those will be the only considerations.  And that
> way lies a horrid mess.
>
> Bill Jouris
>
>
> ------------------------------
> *From:* Andrew Sullivan <[email-masked]>
> *To:* [email-masked]
> *Sent:* Saturday, August 25, 2018 6:30 AM
> *Subject:* Re: [hrpc] Nothing new under the sun? (was Re:
> draft-elris-hrpc-righttolife-00)
>
> Sure, but that is merely one example..  The point is that differences

---

From: [email-masked]
Date: Sat, 25 Aug 2018 16:17:21 -0400

The internet is an exercise in long-arm jurisdiction writ big.

(I thought someone should introduce that law school 101 term.)

-- 
        -Barry Shein

---

From: [email-masked]
Date: Sat, 25 Aug 2018 17:33:27 -0400

I've often said that the problem with the law (and by extension
legislation in general) is that if a judge orders you to raise your
right foot in their court you would be well-advised to raise that foot
or be held in contempt.

And if that judge orders you to also raise your left foot in the air
then you have a big problem, not the judge.

That is, the law is only voluntarily tempered by physical realities.

To that extent it is a good idea for those with technical
understanding to at least work out the realities of mitigating human
rights and related issues.

This isn't entirely hypothetical.

Remember when then FBI director Comey (et al, it's come up since he
left) began insisting that backdoors be placed in encryption methods
used by phones etc. to assist in investigations.

The plea used demagoguery basically describing horrible cases whose
investigation was allegedly thwarted by device encryption (e.g., the
iphones of the San Bernadino terrorists, 14 killed, 22 wounded
seriously, later access turned out to be probably useless.)

Of course, needs, no matter how urgent do not create solutions. They
may motivate them, but they don't create them.

Depressingly some pretty good papers have been written by the
technical community explaining why this "backdoor" might be either
impossible or at least a cure worse than the disease but apparently
those who think backdoors are a good idea couldn't or wouldn't
understand those papers so just continue their quest.

I have no idea how to get around that. Ultimately physical and
engineering realities are a good base to work from but still need
effective champions.

-- 
        -Barry Shein

---

From: Andrew Sullivan <[email-masked]>
Date: Sat, 25 Aug 2018 18:26:33 -0400

Hi,

> These recitations of the history are not really accurate.

To begin with, given that they're not actually recitations, I don't
know how to parse that sentence.  But your accusation is a serious
one, so I would like to take it seriously.  Unfortunately, your
argument starts out by equivocating, or begging the question, or maybe
both.

> rights.

As I noted upthread, "[M]ass social manipulation through media
networks was just not possible in the past, because the mass media
didn't work that way: the persuasive power of social media comes from
their intimacy, whereas mass media are persuasive because of the
common messsage shared with a mass audience."  It is certainly true
that someone might have referred to radio as "social media", but I was
quite explicitly distinguishing contemporary "social media" from
traditional mass media.  There is no question that mass media has been
used in the past to influence mass populations in various ways.  But
the mechanism those media use and the mechanism that contemporary
"social media" use are quite different, in a way that makes the
difference.  

> treaty based solutions effected.

I think we have already spent some time on this list exploring our
different respective uses of "internet", and I think it is at least
disingenuous for you to fall back on your preferred use of the term in
order to claim I am perpetrating "inaccuracy".  I don't, obviously,
mind even a little bit if people disagree with me.  But you're using
your preferred meaning to close a "fact of the matter" (the "accurate"
one) in the above, and I think it is not a legitimate rhetorical move.

> mitigations are pretty much the same. 

I am not too convinced that the answer here is multilateral anything.

Regards,

A

-- 
Andrew Sullivan
[email-masked]

---

From: Tony Rutkowski <[email-masked]>
Date: Sat, 25 Aug 2018 19:06:43 -0400

Hi Andrew,

It really doesn't matter much what you or I think the multilateral
provisions should be. Public international law exists, is being legislated,
and will form the basis for actions.  I have been discovering, writing,
advising, teaching, and shaping it for 45 years.  It is a journey of
constant discovery.  Please do the same and provide your own perspective.

-t

---

From: Nalini J Elkins <[email-masked]>
Date: Sun, 26 Aug 2018 15:51:25 +0000 (UTC)

> Ultimately physical and engineering realities are a good base to work from but still need effective champions.

Yes.  Thank you for your reflective comments.   I am thinking to myself about how to proceed.   I may ask people,if interested, to join in an actual bar in Bangkok, just to talk.  Nothing official, in any sense.
I, too, think that engineers need to take the lead here.
Also, not to derail the topic in any way but I am happy to talk offline to anyone about the needs of enterprises for diagnostic needs.   I say that because sometimes what we have asked for has also been called a "backdoor".  I amhappy to read and pass on any papers that may help us transition to a happier state of events.  Of course, often,the devil is in the details, here.   But, please, let's do take this offline. Thanks,

Nalini Elkins
CEO and Founder
Inside Products, Inc.
www.insidethestack.com
(831) 659-8360

      From: "[email-masked]" <[email-masked]>
 To: Bill Jouris <[email-masked]> 
Cc: "[email-masked]" <[email-masked]>
 Sent: Saturday, August 25, 2018 2:34 PM
 Subject: Re: [hrpc] Nothing new under the sun? (was Re: draft-elris-hrpc-righttolife-00)

-- 
        -Barry Shein

---

From: Vittorio Bertola <[email-masked]>
Date: Mon, 27 Aug 2018 10:52:20 +0200 (CEST)

> Il 25 agosto 2018 alle 15.30 Andrew Sullivan <[email-masked]> ha scritto:

Also, often different governments have different stances not because one is better (more democratic, more open, more technically competent) than the other, but because they reflect different cultures that should have a right to preserve themselves and not be assimilated by the one that dominates the Internet's technology and business development.

This is why I'm starting to think that, after all, there would be quite some advantages if the Internet were built so to ensure that each country can assert sovereignty over what its citizens do online, no matter where the service provider is located. The idealistic vision of the pioneers of the 90s - the declaration of independence of the cyberspace, but also the ideal of a peaceful globalized world united through the Internet - is starting to look more like a nightmare; and at least in many parts of Europe, people don't want to be globalized any more.

Regards,
--

---

From: Vittorio Bertola <[email-masked]>
Date: Mon, 27 Aug 2018 10:56:57 +0200 (CEST)

> Il 26 agosto 2018 alle 0.26 Andrew Sullivan <[email-masked]> ha scritto:
> It is certainly true

Also, getting back to the issue of centralisation, "social media" sports a degree of centralisation on a global scale that "mass media" never had and never has even today. Even the biggest multinational media conglomerates never had the ability to influence (control, censor) the public debate throughout the whole world that Facebook has today.

Regards,
--

---

From: Tony Rutkowski <[email-masked]>
Date: Mon, 27 Aug 2018 06:42:15 -0400

The GRU figured that out early.  It doesn't take a genius to Red Team
this stuff.

---

From: Tony Rutkowski <[email-masked]>
Date: Mon, 27 Aug 2018 07:00:23 -0400

Actually, all the nations of the world are gathering in about eight
weeks to write some public international law.  There are even
international human rights provisions on the agenda.  See
https://www.itu.int/pub/S-CONF-PLEN-2015

You can get admission as an NGO or join a national delegation.  You can
also follow along by going to the website. 
https://www.itu.int/web/pp-18/en/

You can also exist do what Trump does - reject all multilateral
cooperation and just pursue a world of bully bilateralism.  However,
human rights are not on that agenda.

--tony

---

From: Andrew Sullivan <[email-masked]>
Date: Mon, 27 Aug 2018 07:15:16 -0400

On Mon, Aug 27, 2018 at 10:52:20AM +0200, Vittorio Bertola wrote:
> 
> Also, often different governments have different stances not because
> one is better (more democratic, more open, more technically
> competent) than the other, but because they reflect different
> cultures

I think I stated what I did pretty neutrally; there are lots of
reasons why governments might disagree about these things.  It could
be just an accident.  I don't think the reasons are relevant when
noting that complete international agreement cannot be the _sine qua
non_, since if that is the requirement the answer will always be "non".

> This is why I'm starting to think that, after all, there would be
> quite some advantages if the Internet were built so to ensure that
> each country can assert sovereignty over what its citizens do
> online, no matter where the service provider is located.

This strikes me as a cure considerably worse than the disease.  One of
the features that is nice about the Internet as it was deployed what
Zittrain called its generativity.  It is a technology that enables new
invention and new for creating.  This is to a large extent a
consequence of the technique of putting maximal intelligence at the
edge: since that's where a user can be, the "permissionless
innovation" that follows allows a great deal of creativity to
flourish.

There are many things that governments are good at, but resisting the
urge to control things in favour of the current state of affairs is
not among them.  Indeed, in one view of matters, we have governments
precisely _in order_ to channel that conservative instinct of
societies and cultures.  But this suggests that, if we built a new
network (no longer the Internet) that was organized along national
boundaries with strict citizen-aligned permissions and controls, we
wouldn't get the generative Internet we have [1].  Indeed, what we'd
probably get is something that resembles the pre-Internet phone system
[2] at the height of its development.  There are discrete advantages
to that system, but also discrete disadvantages.

[1] Or, by some lights, "had" -- I disagree, please note, with that view.

[2] i.e. the Internet as I've been using the term, not as Tony
Rutkowski has.

>  and at least in many parts of Europe, people don't want to be
>  globalized any more.

It is interesting to me how frequently people seem to want to "fix"
the technology in order to address social consequences of an
invention.  I will observe that, when we had a problem of
concentration in railways, most jurisdictions didn't decide that every
railroad needed to run on a separate gauge in order to decrease
interoperability and thereby improve the chances of competition among
operators.

Best regards,

A

-- 
Andrew Sullivan
[email-masked]

---

From: Eliot Lear <[email-masked]>
Date: Mon, 27 Aug 2018 13:24:41 +0200

Hi Vittorio

> This is why I'm starting to think that, after all, there would be quite some advantages if the Internet were built so to ensure that each country can assert sovereignty over what its citizens do on…

Can we take it for granted that, in this forum, we are not going to
resolve the gaping chasm between global norms and sovereignty of
nations?  At least not at a policy level.  Can we perhaps then focus on
mechanisms that might provide for some flexibility in addressing those
chasms?

Eliot

---

From: Andrew Sullivan <[email-masked]>
Date: Mon, 27 Aug 2018 08:07:48 -0400

> mechanisms that might provide for some flexibility in addressing those

I think so, but I also want to draw a distinction between identifying
issues that have technical implications or sources, and identifying
technical things we can do.

Dave Clark has argued that it is the responsibility of technical
experts to lay out all the technically possible scenarios for policy
makers and ensure that they understand them, and then to stop at that
line.  After that point, the technical expert is no longer
participating in the debate as a technical contributor, but instead as
an interested citizen.  He argued further that blurring these
functions undermines the role of technical expertise, because
policymakers can't tell when they're getting neutral advice vs. when
they are getting advocacy.

I am not sure the line is as bright as he seems to think (I read some
Foucault in grad school ;-) ), but I believe the distinction is still
useful.  I worry that our discussions in this RG sometimes do not
attend to the distinction quite enough.

In that line, then, I wonder whether there is anything _technical_ to
do about the kind of concentration we see particularly in the web
application layer.  I have argued elsewhere that the logic of web
applications means they tend toward monopoly, because of network
effects.[1]  If this is true, then there is really nothing _technical_
that can be done about that except to break the network.  Everything
about it actually needs social and legal remedies.  I can imagine
people working out new definitions of anti-trust, for instance, to
meet these actual technical conditions.  And maybe there are technical
facts to be explicated more completely for policymakers.  But I don't
actually see what the technology _per se_ ought to do about this,
if I am correct about the economy of web applications.

[1] To recap: we can think of two kinds of application:
protocol-based applications and web applications.  MUAs are an obvious
example of the first, and Facebook an obvious example of the second,
but there are lots of other examples.  Unlike protocol-based
applications, web applications make the entire application available
over an access protocol (basically https).  That means that there is
never a real need to be filled in making an interoperable system, and
everything in the virtuous circle favouring deployment that works for
protocol-based applications (see RFC 5218) is actually equally
satisfied by just adding more users to the single web application.

Best regards,

A

-- 
Andrew Sullivan
[email-masked]

---

From: Eliot Lear <[email-masked]>
Date: Mon, 27 Aug 2018 14:23:33 +0200

Hi Andrew,

> if I am correct about the economy of web applications.

First, I generally agree with the notion that there should be a
distinction between technical advice and citizenry.  I do not know how
bright the line should be.  I would go so far to say that just because
one is an expert of some form does not mean that one can't also hold
views as a citizen on the very topic.   Where things run amok, however,
is when we have political advocacy masquerading as technical
argumentation.  Policy makers do need a good source of technical
knowledge, and if they think someone is "tainted", then they will go
elsewhere.

All of this having been said, you used a very narrow example.  It could
be that the technical guidance we need to give is how to open up closed
platforms.  It's then up to governments to address those monopolies.  Or
not.  In some ways we have provided some of That, and to be sure, AT&T
certainly provided some of that themselves during the breakup in the '80s.

Eliot

---

From: Andrew Sullivan <[email-masked]>
Date: Mon, 27 Aug 2018 08:56:41 -0400

On Mon, Aug 27, 2018 at 02:23:33PM +0200, Eliot Lear wrote:
> All of this having been said, you used a very narrow example.

Yes, but …

>  It could
> platforms.

…my point is that these platforms might be different (my hypothesis is
that they are).  One way to open a closed platform of (say) network
communications is to use open standards (FSVO "open", &c. &c. --
that's not germaine to the point I'm making here).  But if the economy
and logic of web applications means that they're intrinsically natural
monopolies, then we have a different problem and that requires a
different solution. 

This is, after all, a research group.  There is a possible research
topic about whether open protocols are actually better for networks as
such, though my own feeling is that the literature has had something
to say about this.  But in cases where the application is built
entirely atop an open, interoperable system, but is itself _not_ a
thing that tends toward interoperation of openness, there might be a
topic that needs exploration.
 
Best regards

A

-- 
Andrew Sullivan
[email-masked]

---

From: Tony Rutkowski <[email-masked]>
Date: Mon, 27 Aug 2018 09:06:56 -0400

Hi Andrew,

Could you explain the "as it was deployed" part?  When exactly?  And
what do you define as "the Internet"? 

What is fascinating about the late 90s period that the Berkman altruists
became engaged, is that at the same time, the major companies and White
House were envisioning global economic dominance, the foreign
intelligence communities were weaponizing it, the global criminal gangs
were building out new capabilities, and the average end user was was
being set up as cyber cannon fodder.  Permissionless innovation did
indeed allow for a great deal of creativity to flourish!  Those with the
greatest resources have learned to exploit it well.

--tony

---

From: Andrew Sullivan <[email-masked]>
Date: Mon, 27 Aug 2018 09:09:19 -0400

Hi Tony,

> what do you define as "the Internet"? 

I think you and I already discussed this at some length, so I think
the answers to those questions are already in the archives and I won't
bore the list participants with a recapitulation.

Best regards,

A

-- 
Andrew Sullivan
[email-masked]

---

From: Eliot Lear <[email-masked]>
Date: Mon, 27 Aug 2018 15:17:55 +0200

Hi Andrew,

> monopolies, then we have a different problem and that requires a

A perhaps lousy analogy is that nobody would need tax software if there
were no taxes.  But there are and the software is tailored to the laws
in place.   If web app platforms tend toward natural monopoly there
might not be much for us to do unless governments decide to establish
laws and regulations that would require technology as part of the
mechanism.  Of course, this group could offer technology as an example
or proof of concept, and governments could pick and choose whether to
employ.  To look at a different aspect of this space, If I read
correctly through the media hype, that seems to be what Stefan Savage @
UCSD has in mind with data at rest and law enforcement.  I personally
think that's a cool area to examine, but the citizen in me worries that
whatever the results are, it will make it easier for some countries to
gain access to information I'd rather they not have.  I'm not sure my
worry should be the focus of this RG, but it does enter into  whether
enough people want to engage in an activity.

Eliot

---

From: Tony Rutkowski <[email-masked]>
Date: Mon, 27 Aug 2018 09:42:18 -0400

Hi Andrew,

It appears as if your definitive statement on "the Internet" is actually
found in your 24 Jan 2018 response to Niels rather than me. 
https://www.ietf.org/mail-archive/web/hrpc/current/msg01164.html

It appears to encompass almost anything and everything - which
admittedly makes "as it was deployed" concept or "when" rather
meaningless.  Which seems about right. :-)

Encouraging respect for and implementation of human rights is the hard
part - which Vittorio's postings nicely underscore.  In a world where
national politicians and their intelligence services exploit tribalism,
racism, xenophobia, and antipathy towards globalism for their personal
gain, human rights of the most vulnerable suffer greatly.

--tony

---

From: Nalini J Elkins <[email-masked]>
Date: Mon, 27 Aug 2018 14:02:34 +0000 (UTC)

Andrew,
> But if the economy and logic of web applications means that they're intrinsically natural> monopolies, then we have a different problem and that requires a different solution. 
They may or may not be intrinsic natural economies but they are certainly enhanced by intentional resorting to the "dopamine economy".   
Reference to just one article on this topic.
https://eand.co/the-dopamine-economy-336b239272ef
"By dopamine economy, I mean this. We’ve gone beyond creating “consumers” — that was the mad men did: today, we’ve created addicts of the algorithm. People who desperately check their smartphones hundreds of times a day, whose fixated eyes never leave screens, who obsessively-compulsively spend more time in fantasylands than with their families, chasing the breathtaking adrenalin high of dopaminergic release. It’s a model of what it means to human, an institutional form, where people desperately seek ever higher and quicker and sharper highs, and find lower and harsher and darker lows. But is it good for us, let alone them?"
I also recently saw this in an email from the local ISOC chapter.  
"Google, Facebook, Microsoft, and Twitter partner for ambitious new data project" 
https://www.theverge.com/2018/7/20/17589246/data-transfer-project-google-facebook-microsoft-twitter
I wonder if this concerns anyone other than me?  This is a project so that people can move data seamlessly from one platform to another.
I wonder how one becomes a "platform" with access to this data?  Thanks,
 
Nalini Elkins
CEO and Founder
Inside Products, Inc.
www.insidethestack.com
(831) 659-8360

---

From: Vittorio Bertola <[email-masked]>
Date: Mon, 27 Aug 2018 17:20:06 +0200 (CEST)

> Il 27 agosto 2018 alle 13.15 Andrew Sullivan <[email-masked]> ha scritto:
>
> One of

Sure, I know this, I've been explaining it and praising it for the last 20 years. The problem, however, is that recently this "generativity" seems to be generating uncontrolled scary things even more frequently than good ones.

> not among them. 

I don't like governments very much, but at least I get to discuss and vote on what they do. Where do I get to discuss and vote on what Facebook does? It influences my life a lot.

Also, if the current state of affairs is better than the upcoming one, resistence is actually a positive thing. So yours is not an argument against governmental intervention unless you think that the future will necessarily always be better than the past.

> Indeed, in one view of matters, we have governments
> wouldn't get the generative Internet we have [1]. 

Still better than becoming "cyber cannon fodder", as Rutkowski puts it. By the way, that's the political spirit underlying the GDPR: we'd rather pass on the wonderful opportunities of the data economy, if it can't be implemented in a way that respects our rights and our sovereignty.

But I don't want to be so negative: I do see the trend of many governments towards nationalism and populism (actually, it's an obvious counter-reaction to uncontrolled globalization); and I do recognize that the Internet has brought marvelous advances to humanity.

So the best thing would be to avoid any of the two extreme positions: #1 let's keep governments out of the Internet and even build policies and technologies to deprive them of any practical possibility to do anything, and #2 let's get rid of this "multistakeholder" principle and bring everything back to multilateral agreements at the ITU. But this also means that the "technical community" has to design technologies taking a certain amount of sovereignty and cultural differences into account, while sometimes it looks like the "technical community" has an overt political agenda against governments and national states.

Regards,
--

---

From: [email-masked]
Date: Mon, 27 Aug 2018 13:22:00 -0400

One problem with trying to limit one's opinion to objective technical
details is that a lot of this involves engineering and engineering
almost always involves an estimate of costs generally in terms of time
or money but other costs come into play (e.g., feasibility of
acceptance, even political realities to generate a useful list of
possible solutions.)

Sometimes it's easy, even trivial. We can't solve the halting problem,
and for any P we can't produce an equivalent NP, etc. It doesn't
matter how many lives or money depend on the solution, and much does,
particularly on the latter P=NP? problem.

Sometimes it's hard. Can we design an encryption protocol with a
backdoor? Yes, easy. Can we design one which satisfies this laundry
list of common needs? We don't think so. We can't prove that we can't.
We can't tell you what it might cost to try even to any reasonable
approximation. It might, if it's even possible, have to wait for some
genius insight rather than just throwing money at the problem. etc.

Perhaps that's a sufficient answer, technically, but it's largely a
list of non-answers, we...don't...know.

A lot of technical mitigation of social issues on the web have this
unknowable character. Can we automate weeding out of bullying among
the roughly 50B facebook posts per day? We don't know. What might it
cost? We don't know. etc.

-- 
        -Barry Shein

---

From: [email-masked]
Date: Mon, 27 Aug 2018 13:30:29 -0400

Perhaps one of the best comments on this "dopamine" economy comes from
William S Burrough's 1959 novel "Naked Lunch", by "junk" he meant
heroin or similar.

    The junk merchant doesn't sell his product to the consumer, he
    sells the consumer to his product. He does not improve and
    simplify his merchandise. He degrades and simplifies the client.

-- 
        -Barry Shein

---

From: Nalini J Elkins <[email-masked]>
Date: Mon, 27 Aug 2018 19:27:16 +0000 (UTC)

+1

> I don't like governments very much, but at least I get to discuss and vote on what they do. Where do I get to discuss and vote on what Facebook does? It influences my life a lot.

Not to mention Google?  Who exactly elected them to anything?

You may wish to read about the "City of the Future" in Toronto.

https://www.politico.com/magazine/story/2018/06/29/google-city-technology-toronto-canada-218841

Google is helping to build it and will likely store the data.

Do we care about this?   Is the line between big tech and government blurring?
 
Thanks,

Nalini Elkins
CEO and Founder
Inside Products, Inc.
www.insidethestack.com
(831) 659-8360

________________________________
From: Vittorio Bertola <[email-masked]>
To: Andrew Sullivan <[email-masked]>; [email-masked] 
Sent: Monday, August 27, 2018 8:20 AM
Subject: Re: [hrpc] Nothing new under the sun? (was Re: draft-elris-hrpc-righttolife-00)

Regards,
--

---

From: Andrew Sullivan <[email-masked]>
Date: Mon, 27 Aug 2018 16:05:53 -0400

Hi,

> Google is helping to build it and will likely store the data.

As an actual Toronto resident, I would like to point out two things:

    1.  It turns out that the Waterfront Toronto person who was so
    deeply committed to Google's parent corporation Alphabet has
    (depending on whom you believe) left for greener pastures; or been
    forced out due to public pressure about the governance model, the
    way the terms with Sidewalk Labs favoured Sidewalk Labs (the
    Alphabet subsidiary) owning the data, and so on.  And indeed, the
    basic pilot agreement between Waterfront Toronto and Sidewalk Labs
    has been modified.  This link might be instructive (though it is
    not written neutrally):
    http://spacing.ca/toronto/2018/07/31/lorinc-waterfront-toronto-gets-tough-with-sidewalk-labs/

    2.  Literally none of the developments in that story involve
    directly technical questions.  They involve what is technically
    _possible_ and they involve technically literate people making
    their claims as citizens.   But as near as I can tell this is the
    same basic kind of argument as happens when someone wants to build
    a garbage incinerator, a new expressway, a new tram line, a new
    one-stop subway extension for $3.5B and counting [1], or a new
    subdivision on virgin land.  Citizens want to participate in the
    governance of where they live, because the choices people make about
    built infrastructure (which certainly includes various kinds of
    Internet services) will affect those citizens for a long time.
    
    Yet people have argued that it is somehow a difference in kind in
    this case, because Internet or Google or something.  In my
    opinion, that is not a reasonable or realistic stance to take, any
    more than those who wanted to ban the automobile over a century
    ago were being realistic or reasonable.  The realistic and
    reasonable stance (which is the one that won out here) is that
    there is some potential here, and we sould investigate it, but we
    should do it in the civic-engagement way that makes for good
    development in cities.  Secretive government agencies doing to the
    citizenry what's good for them has never developed good places to
    live; and that was true when Robert Moses did it, long before the
    Internet was a gleam in anyone's eye.  (The same reasoning is why
    I think claims that multilateral approaches are better than the
    multistakeholder one for Internet governance are so obviously
    mistaken.)

[1] It's a sensitive topic in Toronto right now.

Best regards,

A

-- 
Andrew Sullivan
[email-masked]

---

From: Nalini J Elkins <[email-masked]>
Date: Mon, 27 Aug 2018 20:25:11 +0000 (UTC)

Andrew, 

Thanks for the additional information. 

> Secretive government agencies doing to the citizenry 
> what's good for them has never developed good places to 
> Internet was a gleam in anyone's eye. 

We need transparency and civic engagement on all levels. 

I do not believe that I was advocating secretive government agencies. 
I will review my post to see if that is what I was suggesting. 

Anecdote alert: 

In my area, I work with the NAACP on the Poor People's Campaign. 
This is an attempt to give a group of people, who are often left 
out of the public dialog, a voice in city government. 

There is no end of lack of transparency at all levels.    But, it is 
potentially much harder to bring a for-profit company to account. 

Thanks,

Nalini Elkins
CEO and Founder
Inside Products, Inc.
www.insidethestack.com
(831) 659-8360

---

From: Andrew Sullivan <[email-masked]>
Date: Mon, 27 Aug 2018 16:31:04 -0400

> I will review my post to see if that is what I was suggesting. 

No, that remark was in response to something someone else said in the
thread, about preferring "multilateral" solutions.  My apologies that
it wasn't clear that I was making that more general point instead of
replying only to you.

Best regards,

A

-- 
Andrew Sullivan
[email-masked]

---

From: Nalini J Elkins <[email-masked]>
Date: Mon, 27 Aug 2018 20:40:37 +0000 (UTC)

> My apologies that it wasn't clear that I was making that more general point instead of
> replying only to you.

Thanks for the clarification.
 
Nalini

---

From: Bill Jouris <[email-masked]>
Date: Tue, 28 Aug 2018 00:15:47 +0000 (UTC)

Allow me to observe that, when someone sets up a new garbage dump there may be various problem as a result.  But one of them does not derive from the trash company making money by selling information about the people whose trash they are collecting.  Indeed, typically they are forbidden by law from doing so. 
It really is a difference in kind that we are looking at here.
Bill Jouris 

  On Mon, Aug 27, 2018 at 1:06 PM, Andrew Sullivan<[email-masked]> wrote:   Hi,

    

Best regards,

A

-- 
Andrew Sullivan
[email-masked]

---

From: "[email-masked]" <[email-masked]>
Date: Mon, 27 Aug 2018 21:04:29 -0400

Hi,

On Tue, Aug 28, 2018 at 12:15:47AM +0000, Bill Jouris wrote:
> Allow me to observe that, when someone sets up a new garbage dump there may be
> various problem as a result.  But one of them does not derive from the trash
> company making money by selling information about the people whose trash they
> are collecting.  Indeed, typically they are forbidden by law from doing so. 
> 

I fear this argument from analogy fails in two ways.

First, what you are arguing is that trash companies do not make money
from the potential revenue stream of selling information about those
whose trash they have collected because of laws.  This illustrates
rather nicely, I think, one of the central points I've been making: in
the ordinary prosaic world, we outlaw certain kinds of behaviour in
order to discourage it.  I have not yet seen the argument as to why
these kinds of behaviours by private organizations cannot themselves
be outlawed or regulated in some ways.  That is, IMO, _not_ regulation
of the Internet, but regulation of legal or natual persons in some
way.  We might debate whether this or that proposed regulation is a
good one, but the key point is that this is not obviouly a difference
in kind: it's just reglation of (in the main) corporation's business
practices.  The failure of the argument in this case is that the
conclusion doesn't hold: the premises don't show a difference in kind.

But second, you have conflated the derivative product in one industry
with the derivative product in all industries.  The trash industry
doesn't make money by selling information about people whose trash
they collected because that's not the secondary stream.  The secondary
stream in the trash business is latent energy and latent materials in
the primary stream.  Some trash companies make money from selling
electricity or heat derived from the garbage they collect.  Some trash
companies make money from sorting and selling the resources found in
their collection stream; indeed, the entire economic model of most
municipal recycling programs relies on that derivative revenue stream.
So in fact, the disanalogy you are drawing is no disanalogy at all,
which means that the argument fails in its own terms.

I am by no means intending to be an apologist for some negative
consequences of the way the Internet or associated businesses that
have come to public consciousness recently.  I am, however, with Fred
in asking what is so different about many of these cases, and I think
we can often answer that existing laws or at least legal frameworks
already apply just fine.  There is no need for special "Internet" laws
in many cases.

Best regards,

A

-- 
Andrew Sullivan
[email-masked]

---

From: [email-masked]
Date: Mon, 27 Aug 2018 22:56:55 -0400

Off-hand I've never heard of a trash company being forbidden from
selling information about those they pick up trash from but I can't
say it's a topic I've ever put any time into.

I know in some localities, for example, you are required to use trash
bags (or similar) sold to you by the trash company and only
those. Presumably they keep track of those purchases.

So I wouldn't be shocked if they sold the information about this usage
or perhaps other measures (weight etc) to someone who might be
interested.

Perhaps the municipality if it's a private trash company.  Or some
marketing data organization which believes they've found some
interesting correlation between your trash volume and products you
might be interested in -- are people who produce a lot of trash very
clean or very dirty?

But maybe examples exist, it's really besides the point.

Probably more important is the relative locality of this information.

Trash is a very local function even though the data may be useful in a
broader context. If you toss a candy wrapper in a trash can downtown
it's highly unlikely the trash company can add that to your household
or personal output.

But internet activity can be tracked and correlated at a very fine
level of granularity and ubiquity whether you are glancing at products
on your smart phone while sitting in a cafe in Lower Slobbovia or via
your home systems...assuming you don't actually live in Lower
Slobbovia.

-- 
        -Barry Shein