Subject: [hrpc] re history lessons

From: Sandra Braman <[email-masked]>
Date: Mon, 3 May 2021 09:43:11 -0500

Point taken, Niels, re the archive -- have read most of it but will ensure
it is all read and reviewed for its attention to this particular question;
will return to the list if questions remain.

Another, if I may -- It turns out, according to Mallory and others, code
451 has not actually been useful. What do members of this group make out of
the fact that only one RFC since publication of 8280 has addressed human
rights considerations, and that was the right to bear arms?  Is it expected
that publication of the guidelines document currently in progress will make
a difference?  Any advice regarding where I can turn for explanations of
this?

Thanks again --

Sandra

---

From: Niels ten Oever <[email-masked]>
Date: Mon, 3 May 2021 16:52:25 +0200

On 03-05-2021 16:43, Sandra Braman wrote:
> Point taken, Niels, re the archive -- have read most of it but will ensure it is all read and reviewed for its attention to this particular question; will return to the list if questions remain.

One of the reasons was that security considerations are mandatory for RFCs since 1989, and privacy consideration are not obligatory. Thus referring to security considerations could have set the bar too high for the work on human rights considerations guidelines. More on the relation between security and privacy considerations can be found in the excellent work by Nick Doty on this:

Doty, Nick. “Reviewing for Privacy in Internet and Web Standard-Setting.” In Security and Privacy Workshops (SPW), 2015 IEEE, 185–92. IEEE, 2015.

Doty, Nick. “Enacting Privacy in Internet Standards.” University of California, Berkeley, 2020. https://npdoty.name/enacting-privacy/.

> 
> Another, if I may -- It turns out, according to Mallory and others, code 451 has not actually been useful. What do members of this group make out of the fact that only one RFC since publication of 8280 has addressed human rights considerations, and that was the right to bear arms?  Is it expected that publication of the guidelines document currently in progress will make a difference?  Any advice regarding where I can turn for explanations of this?

Many more drafts have actually been reviewed (with the methodology that is described in the guidelines document), which has impacted drafts. The end-goal is not to get a section, but for the actual considerations to have been made [0].

Best,

Niels

[0] A couple of examples can be found here: https://gitlab.com/gurshabad/documents/-/tree/master

> 
> Thanks again --
> 
> Sandra
> 
> _______________________________________________
> hrpc mailing list
> [email-masked]
> https://www.irtf.org/mailman/listinfo/hrpc
> 

-- 
Niels ten Oever, PhD
Postdoctoral Researcher - Media Studies Department - University of Amsterdam
Research Fellow - Centre for Internet and Human Rights - European University Viadrina
Associated Scholar - Centro de Tecnologia e Sociedade - Fundação Getúlio Vargas
Affiliated Factulty - Digital Democracy Insitute - Simon Fraser University

https://nielstenoever.net - [email-masked] - @nielstenoever - +31629051853
PGP: 2458 0B70 5C4A FD8A 9488 643A 0ED8 3F3A 468A C8B3

Read my latest article on Internet infrastructure governance in New Media & Society here: https://journals.sagepub.com/doi/full/10.1177/1461444820929320

---

From: Mallory Knodel <[email-masked]>
Date: Mon, 3 May 2021 10:53:57 -0400

Hi Sandra,

It would be incorrect to minimise the impact of RFC 8280 and HRPC this 
way, Sandra.

The fact that 451 isn't as technically implementable as authors 
envisioned is orthogonal to its human rights considerations. It 
shouldn't be discounted.

I believe there are more RFCs and I-D that directly cite a human rights 
consideration, but others might chime in on which specifically.

It also won't include the ways in which people engage in draft reviews 
with human rights considerations influenced by RFC 8280. Harder to 
measure, but still worth doing.

-Mallory

On 5/3/21 10:43 AM, Sandra Braman wrote:
> Point taken, Niels, re the archive -- have read most of it but will 
> ensure it is all read and reviewed for its attention to this 
> particular question; will return to the list if questions remain.
>
> Another, if I may -- It turns out, according to Mallory and others, 
> code 451 has not actually been useful. What do members of this group 
> make out of the fact that only one RFC since publication of 8280 has 
> addressed human rights considerations, and that was the right to bear 
> arms?  Is it expected that publication of the guidelines document 
> currently in progress will make a difference?  Any advice regarding 
> where I can turn for explanations of this?
>
> Thanks again --
>
> Sandra
>

-- 
Mallory Knodel
CTO, Center for Democracy and Technology
gpg fingerprint :: E3EB 63E0 65A3 B240 BCD9 B071 0C32 A271 BD3C C780

---

From: Sandra Braman <[email-masked]>
Date: Mon, 3 May 2021 10:15:37 -0500

Appreciate this, Mallory.  Our interpretations of the effects of particular
activities may reasonably differ, but you are also assigning meaning to my
comment that was not there. I did not say I was discounting the code 451
effort, although you and I may disagree regarding what the nature of its
consequences are.

I have so far looked only at RFCs for mention of 8280; there is just the
one. Would appreciate it if others could point me to Internet drafts that
do. Was fascinated to see that the only RFC mentioning 8280 does so by
focusing on the right to bear arms.

I agree with you that it would be a great research project for someone to
analyze discussions of drafts that do mention human rights considerations,
and what the reasons were for not ultimately including that section in
documents ultimately published. Actually, that could be useful as input
into future HRPC efforts.

On Mon, May 3, 2021 at 9:53 AM Mallory Knodel <[email-masked]> wrote:

> The fact that 451 isn't as technically implementable as authors envisioned
> is orthogonal to its human rights considerations. It shouldn't be
> discounted.
>
> with human rights considerations influenced by RFC 8280. Harder to measure,
> but still worth doing.
>
> -Mallory
> hrpc mailing [email-masked]://www.irtf.org/mailman/listinfo/hrpc <https://urldefense.com/v3/__https://www.irtf.org/mailman/listinfo/hrpc__;!!KwNVnqRv!Wn2KbOw-vOxRhfqX1jGrSQQ6XHuw-3vAOzK3FbU_cYLASdrjLliaZDyzmJ0Nsw$>
>
> --
> Mallory Knodel

---

From: Ted Lemon <[email-masked]>
Date: Mon, 3 May 2021 11:19:29 -0400

Which rfc is on the right to bear arms?

> On May 3, 2021, at 11:16, Sandra Braman <[email-masked]> wrote:
> 
> 
> Appreciate this, Mallory.  Our interpretations of the effects of particular activities may reasonably differ, but you are also assigning meaning to my comment that was not there. I did not say I was discounting the code 451 effort, although you and I may disagree regarding what the nature of its consequences are.
> 
> I have so far looked only at RFCs for mention of 8280; there is just the one. Would appreciate it if others could point me to Internet drafts that do. Was fascinated to see that the only RFC mentioning 8280 does so by focusing on the right to bear arms.
> 
> I agree with you that it would be a great research project for someone to analyze discussions of drafts that do mention human rights considerations, and what the reasons were for not ultimately including that section in documents ultimately published. Actually, that could be useful as input into future HRPC efforts.
> 
> 
> 
> 
>> It would be incorrect to minimise the impact of RFC 8280 and HRPC this way, Sandra.
>> 
>> The fact that 451 isn't as technically implementable as authors envisioned is orthogonal to its human rights considerations. It shouldn't be discounted.
>> 
>> I believe there are more RFCs and I-D that directly cite a human rights consideration, but others might chime in on which specifically.
>> 
>> It also won't include the ways in which people engage in draft reviews with human rights considerations influenced by RFC 8280. Harder to measure, but still worth doing. 
>> 
>> -Mallory
>>

---

From: Mallory Knodel <[email-masked]>
Date: Mon, 3 May 2021 11:23:53 -0400

On 5/3/21 11:15 AM, Sandra Braman wrote:

> documents ultimately published

No one has yet done this research so it can't be included or cited.

We do not have any current work items on it either but would openly 
encourage and welcome them,

-M

---

From: Sandra Braman <[email-masked]>
Date: Mon, 3 May 2021 10:37:30 -0500

8492.  Ciphersuites as weapons that can be used for protection.

On Mon, May 3, 2021 at 10:19 AM Ted Lemon <[email-masked]> wrote:

> Appreciate this, Mallory.  Our interpretations of the effects of
> particular activities may reasonably differ, but you are also assigning
> meaning to my comment that was not there. I did not say I was discounting
> the code 451 effort, although you and I may disagree regarding what the
> nature of its consequences are.
>
>> envisioned is orthogonal to its human rights considerations. It shouldn't
>> be discounted.
>>
>> ensure it is all read and reviewed for its attention to this particular
>> question; will return to the list if questions remain.
>>

---

From: Gurshabad Grover <[email-masked]>
Date: Mon, 3 May 2021 21:08:54 +0530

To my knowledge, all RFCs and I-Ds that have a human rights
considerations section (up until a while ago, at least) are listed here:
https://github.com/IRTF-HRPC/reviews/blob/main/drafts_RFCs_with_HRCs.md

(RFC8492 is the one that pokes fun at the section and links it to the
right to bear arms).

-Gurshabad

On 5/3/21 8:49 PM, Ted Lemon wrote:
>> particular activities may reasonably differ, but you are also
>> assigning meaning to my comment that was not there. I did not say I
>> was discounting the code 451 effort, although you and I may disagree
>> regarding what the nature of its consequences are.
>>
>> I have so far looked only at RFCs for mention of 8280; there is just
>> the one. Would appreciate it if others could point me to Internet
>> drafts that do. Was fascinated to see that the only RFC mentioning
>> 8280 does so by focusing on the right to bear arms.
>>
>> I agree with you that it would be a great research project for someone
>> to analyze discussions of drafts that do mention human rights
>> considerations, and what the reasons were for not ultimately including
>> that section in documents ultimately published. Actually, that could
>> be useful as input into future HRPC efforts.
>>
>>
>>
>>
>> On Mon, May 3, 2021 at 9:53 AM Mallory Knodel <[email-masked]
>> <mailto:[email-masked]>> wrote:
>>
>>     Hi Sandra,
>>
>>     I believe there are more RFCs and I-D that directly cite a human
>>     rights consideration, but others might chime in on which specifically.
>>
>>     It also won't include the ways in which people engage in draft
>>     reviews with human rights considerations influenced by RFC 8280.
>>     Harder to measure, but still worth doing.
>>
>>     -Mallory
>>
>>>     Point taken, Niels, re the archive -- have read most of it but
>>>     will ensure it is all read and reviewed for its attention to this
>>>     Another, if I may -- It turns out, according to Mallory and
>>>     others, code 451 has not actually been useful. What do members of
>>>     this group make out of the fact that only one RFC since
>>>     publication of 8280 has addressed human rights considerations,
>>>     and that was the right to bear arms?  Is it expected that
>>>     publication of the guidelines document currently in progress will
>>>     make a difference?  Any advice regarding where I can turn for
>>>     explanations of this?
>>>
>>>     Thanks again --
>>>
>>>     Sandra
>>>
>>>     [email-masked] <mailto:[email-masked]>
>>>     https://www.irtf.org/mailman/listinfo/hrpc <https://urldefense.com/v3/__https://www.irtf.org/mailman/listinfo/hrpc__;!!KwNVnqRv!Wn2KbOw-vOxRhfqX1jGrSQQ6XHuw-3vAOzK3FbU_cYLASdrjLliaZDyzmJ0Nsw$>
>>
>>     -- 
>>     Mallory Knodel

---

From: Sandra Braman <[email-masked]>
Date: Mon, 3 May 2021 10:59:03 -0500

Thanks yet again, Gurshabad. So not an undoable list of drafts (7), and
only the one RFC, as of 5 months ago. Appreciated.

On Mon, May 3, 2021 at 10:40 AM Gurshabad Grover <[email-masked]>
wrote:

> https://urldefense.com/v3/__https://github.com/IRTF-HRPC/reviews/blob/main/drafts_RFCs_with_HRCs.md__;!!KwNVnqRv!QL458dtCkoJWt0Gd3bE850O8FEeq61n9zhqLSRUEkrkgOMzP-81bK1e3iWZ9XQ$
>
> https://urldefense.com/v3/__https://www.irtf.org/mailman/listinfo/hrpc__;!!KwNVnqRv!QL458dtCkoJWt0Gd3bE850O8FEeq61n9zhqLSRUEkrkgOMzP-81bK1cB2R513g$
> <
> https://urldefense.com/v3/__https://www.irtf.org/mailman/listinfo/hrpc__;!!KwNVnqRv!Wn2KbOw-vOxRhfqX1jGrSQQ6XHuw-3vAOzK3FbU_cYLASdrjLliaZDyzmJ0Nsw$
> >
> >>
> >>     --
> >>     Mallory Knodel
> https://urldefense.com/v3/__https://www.irtf.org/mailman/listinfo/hrpc__;!!KwNVnqRv!QL458dtCkoJWt0Gd3bE850O8FEeq61n9zhqLSRUEkrkgOMzP-81bK1cB2R513g$
> >
> https://urldefense.com/v3/__https://www.irtf.org/mailman/listinfo/hrpc__;!!KwNVnqRv!QL458dtCkoJWt0Gd3bE850O8FEeq61n9zhqLSRUEkrkgOMzP-81bK1cB2R513g$
> >
>

---

From: Colin Perkins <[email-masked]>
Date: Wed, 5 May 2021 23:28:30 +0100

> On 3 May 2021, at 16:38, Gurshabad Grover <[email-masked]> wrote:
> 

(RFC 8492 was published on the Independent Stream, I believe, and isn’t an IETF consensus document)

An interesting piece of analysis might be to look not just at the documents that cite RFC 8280, but rather at the extent to which the topics discussed in that RFC are considered during development of IETF standards. It may be possible, for example, to study the mailing list archives, meeting minutes, or the text of the drafts, to see if consideration of related topics has increased over time, irrespective of whether there’s a formal human rights considerations section.

Colin 

-- 
Colin Perkins
https://csperkins.org/

---

From: Corinne Cath <[email-masked]>
Date: Thu, 6 May 2021 10:07:03 +0300

Hiya,

I think part of the question is also whether the inclusion of a human
rights section in RFCs is the only way to judge the effects of the HRPC
group.

In my PhD, I track the ways in which having these discussions in the
IETF/IRTF has changed the sensibilities of engineers in terms of what type
of "social" concerns they consider to be relevant to their work.

This is much harder to measure quantitatively, as it speaks to change in
naturalized ways of seeing the world, but in addition to doing ethnographic
work like I did, I think it might also be interesting to do further
analysis of mailinglists as Colin suggests.

I would remark that in my 3 years of fieldwork in the IETF, I did on more
than one occasion find that engineers said one thing on a mailinglist and a
different thing in the relative privacy of our one-on-one interviews.

Happy to share more of my work when I have done by formal defense later
this year.

Kind regards,

Corinne

On Thu, May 6, 2021 at 1:29 AM Colin Perkins <[email-masked]> wrote:

> An interesting piece of analysis might be to look not just at the
> documents that cite RFC 8280, but rather at the extent to which the topics
> discussed in that RFC are considered during development of IETF standards.
> It may be possible, for example, to study the mailing list archives,
> meeting minutes, or the text of the drafts, to see if consideration of
> related topics has increased over time, irrespective of whether there’s a
> formal human rights considerations section.
>
> Colin
>
>
>
> > -Gurshabad
> >
> >>>>    https://www.irtf.org/mailman/listinfo/hrpc <

-- 
Corinne Cath - Speth
Ph.D. Candidate, Oxford Internet Institute & Alan Turing Institute

Web: www.oii.ox.ac.uk/people/corinne-cath
Email: [email-masked] & [email-masked]
Twitter: @C_CS

---

From: Eliot Lear <[email-masked]>
Date: Thu, 6 May 2021 11:00:07 +0200

Hi Corinne,

First and foremost, best wishes on your defense!

> On 6 May 2021, at 09:07, Corinne Cath <[email-masked]> wrote:
> 
> Hiya,
> 
> I think part of the question is also whether the inclusion of a human rights section in RFCs is the only way to judge the effects of the HRPC group.

Yes.

> 
> In my PhD, I track the ways in which having these discussions in the IETF/IRTF has changed the sensibilities of engineers in terms of what type of "social" concerns they consider to be relevant to their work.
> 
> This is much harder to measure quantitatively, as it speaks to change in naturalized ways of seeing the world, but in addition to doing ethnographic work like I did, I think it might also be interesting to do further analysis of mailinglists as Colin suggests.

I would add one other aspect, and this is entirely subjective, anecdotal, and I could be entirely wrong, but… my feel is that the participant mix at the IETF has changed dramatically over the last twenty years, with less of a focus on L3 technologies, and more of a focus on transport and security.  People have argued that the neck of the hourglass is now HTTP and not IP.  With the advent of LetsEncrypt and with centralization of services, this has permitted something of a focus on HR at those layers where it simply wasn’t previously practicable.

Another possibility to consider is that there may have been a bit of a Gartner hyper effect in play, where you get that initial zing of interest a’la Edward Snowden, then a lull, and then slow but steady adoption of more mature principles.  And some of that is well above us and well into the application layer (a’la https://www.washingtonpost.com/technology/2021/05/05/apple-airtags-stalking/ <https://www.washingtonpost.com/technology/2021/05/05/apple-airtags-stalking/>).  One wonders what the IETF could ever do about such a thing.  But certainly there are things within our control, and the application of RFC 8280 over time will be worth studying.

Eliot

---

From: Niels ten Oever <[email-masked]>
Date: Thu, 6 May 2021 15:40:02 +0200

Adding to the suggestions for draft-braman-evaluation-RFC8280, it might also be interesting to take into account the impact RFC8280 had outside the IETF, such as being named, as the first I-D/RFC afaik, in a report by the Special Rapporteur for Freedom of Expression. Similarly, approaches such as those being developed in RFC8280 are now also inherent part of draft legislation that is tabled in the European Parliament: https://www.europarl.europa.eu/doceo/document/TA-9-2021-0073_EN.html
Looking forward to hear what the theoretical framework will look like to assess this case of norm-diffusion!

Best,

Niels

On 06-05-2021 09:07, Corinne Cath wrote:
> I would remark that in my 3 years of fieldwork in the IETF, I did on more than one occasion find that engineers said one thing on a mailinglist and a different thing in the relative privacy of our one-on-one interviews.
> 
> Happy to share more of my work when I have done by formal defense later this year.
> 
> Kind regards,
> 
> Corinne
> 
> 
> 
> 
> On Thu, May 6, 2021 at 1:29 AM Colin Perkins <[email-masked] <mailto:[email-masked]>> wrote:
> 
> 
> 
>     > On 3 May 2021, at 16:38, Gurshabad Grover <[email-masked] <mailto:[email-masked]>> wrote:
>     >
>     > https://github.com/IRTF-HRPC/reviews/blob/main/drafts_RFCs_with_HRCs.md <https://github.com/IRTF-HRPC/reviews/blob/main/drafts_RFCs_with_HRCs.md>
>     >
>     >>> On May 3, 2021, at 11:16, Sandra Braman <[email-masked] <mailto:[email-masked]>> wrote:
>     >>>
>     >>> 
>     >>> On Mon, May 3, 2021 at 9:53 AM Mallory Knodel <[email-masked] <mailto:[email-masked]>
>     >>> <mailto:[email-masked] <mailto:[email-masked]>>> wrote:
>     >>>
>     >>>    Hi Sandra,
>     >>>
>     >>>>    [email-masked] <mailto:[email-masked]> <mailto:[email-masked] <mailto:[email-masked]>>
>     >>>>    https://www.irtf.org/mailman/listinfo/hrpc <https://www.irtf.org/mailman/listinfo/hrpc> <https://urldefense.com/v3/__https://www.irtf.org/mailman/listinfo/hrpc__;!!KwNVnqRv!Wn2KbOw-vOxRhfqX1jGrSQQ6XHuw-3vAOzK3FbU_cYLASdrjLliaZDyzmJ0Nsw$ <https://urldefense.com/v3/__https://www.irtf.org/mailman/listinfo/hrpc__;!!KwNVnqRv!Wn2KbOw-vOxRhfqX1jGrSQQ6XHuw-3vAOzK3FbU_cYLASdrjLliaZDyzmJ0Nsw$>>
>     >>>
>     >>>    --
>     >>>    Mallory Knodel
>     >>> https://www.irtf.org/mailman/listinfo/hrpc <https://www.irtf.org/mailman/listinfo/hrpc>
>     >>
>     >> https://www.irtf.org/mailman/listinfo/hrpc <https://www.irtf.org/mailman/listinfo/hrpc>
>     >>
>     >
>     > https://www.irtf.org/mailman/listinfo/hrpc <https://www.irtf.org/mailman/listinfo/hrpc>
> 
> 
> 
>     -- 
>     Colin Perkins
>     https://csperkins.org/ <https://csperkins.org/>
> 
> 
> 
> 
>     https://www.irtf.org/mailman/listinfo/hrpc <https://www.irtf.org/mailman/listinfo/hrpc>
> 
> 
> 
> -- 
> Corinne Cath - Speth
> Web: www.oii.ox.ac.uk/people/corinne-cath <http://www.oii.ox.ac.uk/people/corinne-cath>
> Email: [email-masked] <mailto:[email-masked]> & [email-masked] <mailto:[email-masked]>
> Twitter: @C_CS
>

---

From: Mallory Knodel <[email-masked]>
Date: Thu, 6 May 2021 09:50:05 -0400

I really like the norm-diffusion concept for evaluation [0]. ISTM it 
would be a lot more appropriate for what we're doing in HRPC since we 
tend to be heavier, in spirit, on the HR than the P.

-M

[0] 
https://journals.sagepub.com/doi/abs/10.1177/1354066117720794?journalCode=ejta