Subject: [GNAP] Human rights perspective on W3C and IETF protocol interaction

From: Adrian Gropper <[email-masked]>
Date: Tue, 4 Jan 2022 21:02:25 -0500

This is a new thread for a new year to inspire deeper cooperation between
W3C and IETF. This is relevant to our formal objection issues in W3C DID as
well as the harmonization of IETF SECEVENT DIDs and GNAP with ongoing
protocol work in W3C and DIF.

The Ford Foundation paper attached provides the references. However, this
thread should not be about governance philosophy but rather a focus on
human rights as a design principle as we all work on protocols that will
drive adoption of W3C VCs and DIDs at Internet scale.

https://redecentralize.org/redigest/2021/08/ says:

*Human rights are not a bug*
> Decisions made by engineers in internet standards bodies (such as IETF
> <https://www.ietf.org/> and W3C <https://www.w3.org/>) have a large
> influence on internet technology, which in turn influences people’s lives —
> people whose needs may or may not have been taken into account. In the
> report Human Rights Are Not a Bug
> <https://www.fordfoundation.org/work/learning/research-reports/human-rights-are-not-a-bug-upgrading-governance-for-an-equitable-internet/>
>  (see also its launch event
> <https://www.youtube.com/embed/qyYETzXJqmc?rel=0&iv_load_policy=3&modestbranding=1&autoplay=1>),
> Niels ten Oever asks *“how internet governance processes could be updated
> to deeply embed the public interest in governance decisions and in
> decision-making culture”*.
> “Internet governance organizations maintain a distinct governance
> philosophy: to be consensus-driven and resistant to centralized
> institutional authority over the internet. But these fundamental values
> have limitations that leave the public interest dangerously neglected in
> governance processes. In this consensus culture, the lack of institutional
> authority grants disproportionate power to the dominant corporate
> participants. While the governance bodies are open to non-industry members,
> they are essentially forums for voluntary industry self-regulation. Voices
> advocating for the public interest are at best limited and at worst absent.”
> The report describes how standards bodies, IETF in particular, focus
> narrowly on facilitating interconnection between systems, so that *“many
> rights-related topics such as privacy, free expression or exclusion are
> deemed “too political””*; this came hand in hand with the culture of
> techno-optimism:
> “There was a deeply entrenched assumption that the internet is an engine
> for good—that interconnection and rough consensus naturally promote
> democratization and that the open, distributed design of the network can by
> itself limit the concentration of power into oligopolies.
> This has not proved to be the case.”
> To improve internet governance, the report recommends involving all
> stakeholders in decision procedures, and adopting human rights impact
> assessments (a section on *human rights considerations* should become as
> normal as one on *security considerations*).
> The report only briefly touches what seems an important point: that
> existing governance bodies may become altogether irrelevant as both tech
> giants and governments move on without them:
> “Transnational corporations and governments have the power to drive
> internet infrastructure without the existing governance bodies, through new
> technologies that set de facto standards and laws that govern “at” the
> internet not “with” it.”
> How much would having more diverse stakeholders around the table help,
> when ultimately Google decides whether and how a standard will be
> implemented, or founds a ‘more effective’ standardisation body instead?

Our work over the next few months is unbelievably important,

- Adrian

---

From: Bob Wyman <[email-masked]>
Date: Tue, 4 Jan 2022 23:45:42 -0500

Adrian,
Given that you're starting a new thread, I would appreciate it if you could
do some context setting and clarifying:

   - *What do you mean by "Human Rights?" *Hopefully, you won't consider
   that a foolish question. The issue is, of course, that since Internet
   standards are developed in a multicultural, multinational context, it isn't
   obvious, without reference to some external authority, what a
   standards group should classify as a human right. Different cultures and
   governments tend to differ on this subject... As far as I know, the "best"
   source of what might be considered a broad consensus definition of human
   rights is found in the UN's 1948 Universal Declaration of Human Rights
   <https://www.un.org/en/about-us/universal-declaration-of-human-rights>
    (UDHR).
      - Does the UDHR contain the full set of rights that you think should
      be addressed by standards groups? If not, are there additional
rights that
      you think should be considered?
      - In his document, Human Rights Are Not a Bug
      <https://www.fordfoundation.org/work/learning/research-reports/human-rights-are-not-a-bug-upgrading-governance-for-an-equitable-internet/>,
      Niels ten Oever refers to the UN Guiding Principles for Business and
      Human Rights
      <https://www.ohchr.org/documents/publications/guidingprinciplesbusinesshr_en.pdf>,
      which adds to the rights enumerated in the UDHR a number of additional
      rights described in the International Labour Organization’s Declaration
      on Fundamental Principles and Rights at Work
      <https://www.ilo.org/declaration/lang--en/index.htm>. Given that you
      appear to endorse ten Oever's report, do you also propose the
same combined
      set of rights? (ie. UDHR + ILO DFPRW?)
      - Some have argued that the Internet introduces a need to recognize
      rights that have not yet been enumerated either in the UDHR or
in any other
      broadly accepted documents. If this is the case, how is a standards group
      to determine what set of rights they must respect?
   - *What specific aspects of the issues being addressed by this community
   group give rise to human rights issues?* Also, if you accept that one or
   some number of documents contain a useful list of such rights, can you
   identify which specific, enumerated rights are at risk? (e.g. if the UDHR
   is the foundation text, then I assume privacy issues would probably be
   considered in the context of the UDHR's Article 12
   <https://www.un.org/en/about-us/universal-declaration-of-human-rights#:~:text=Article%2012,interference%20or%20attacks.>
   .)
   - *Are you suggesting that this group should formally address the issue
   of rights*, with some sort of process, or just that we should be aware
   of the issues?
      - ten Oever suggests that "Those who design, standardize, and
      maintain the infrastructure on which we run our information societies,
      should assess their actions, processes, and technologies on
their societal
      impact." You apparently agree. Can you say how this should be done?
      - The UN Guiding Principles for Business and Human Rights describe a
      number of procedural steps that should be taken by either governments or
      corporations. Are you aware of a similar procedural description
that would
      apply to standards groups?
      - I think it was in the video that it was suggested that, in
      Internet standards documents, "a section on human rights considerations
      should become as normal as one on security considerations." Do you agree?
      If so, can you suggest how such a section would be written?

bob wyman

On Tue, Jan 4, 2022 at 9:05 PM Adrian Gropper <[email-masked]>
wrote:

>> Niels ten Oever asks *“how internet governance processes could be
>> updated to deeply embed the public interest in governance decisions and in

---

From: Adrian Gropper <[email-masked]>
Date: Wed, 5 Jan 2022 10:11:02 -0500

Bob's are important questions in the context of our specific protocol work.
I do not mean to scope this thread to general W3C or IETF groups or their
governance. *Bold* is used below to link to Bob's specific questions.

I might also argue to limit the scope to protocols and not VC, DID,
biometric templates, or other data models even though effective standards
for these drive quantitative and possibly qualitative improvements in the
efficiency of surveillance because a common language seems essential to
discussing protocols. Adverse consequences of the efficiency of common
interoperable language can be mitigated at the protocol level.

I'm responding in personal terms to Bob's questions. *I urge all of us
engaged in the protocol engineering effort to bring their own perspective
on "Human Rights" and to advocate for specific technical solutions in
specific workgroups.* For example, I have chosen to focus attention on
authorization for verifiable credential issue. I hope others will
prioritize human rights impact of authentication protocols especially where
biometrics could be involved.

*The specific aspects of our protocol work that give rise to human rights
issues relate to the efficiency of standardized digital credentials to
human persons.* What works for drugs in a supply chain or cattle on a farm
can and usually will be misused on people. Also, transferring
responsibility from an issuer to a subject of a VC is a burden that needs
to be recognized and mitigated. With respect to the UDHRs, I would point to
12 (privacy and confidentiality), 13 (anonymity), 14 (limit the reach of
DHS and other state actors), 17 (the right to associate with and delegate
to others), 18 (associate with and delegate to communities one chooses), 20
(association, again), 21 (secret elections), 22 (anonymity), 23 (trade
unions as delegates), 24 (burden of managing decisions in an asymmetric
power relationship with the state or with dominant private platforms), 29
(duties to and scope of the community).

*I'm suggesting that we formally address the issue of human rights as
applied to the VC-API standardization process.* I'm also suggesting that we
use a process in VC-API that formally harmonizes our work with IETF GNAP.

Adrian

On Tue, Jan 4, 2022 at 11:45 PM Bob Wyman <[email-masked]> wrote:

> Adrian,
> Given that you're starting a new thread, I would appreciate it if you
> could do some context setting and clarifying:
>
>       - Does the UDHR contain the full set of rights that you think
>       should be addressed by standards groups? If not, are there additional
>       rights that you think should be considered?
>       Niels ten Oever refers to the UN Guiding Principles for Business
>       and Human Rights
>       <https://www.ilo.org/declaration/lang--en/index.htm>. Given that
>       you appear to endorse ten Oever's report, do you also propose the same
>       combined set of rights? (ie. UDHR + ILO DFPRW?)
>       rights that have not yet been enumerated either in the UDHR or in any other
>    - *What specific aspects of the issues being addressed by this
>    community group give rise to human rights issues?* Also, if you accept
>    that one or some number of documents contain a useful list of such rights,
>    can you identify which specific, enumerated rights are at risk? (e.g. if
>    the UDHR is the foundation text, then I assume privacy issues would
>    probably be considered in the context of the UDHR's Article 12
>    - *Are you suggesting that this group should formally address the
>    issue of rights*, with some sort of process, or just that we should be
>    aware of the issues?
>       should assess their actions, processes, and technologies on their societal
>       - The UN Guiding Principles for Business and Human Rights describe
>       a number of procedural steps that should be taken by either governments or
>       corporations. Are you aware of a similar procedural description that would
>>> assessments (a section on *human rights considerations* should become
>>> as normal as one on *security considerations*).

---

From: MXS Insights <[email-masked]>
Date: Wed, 5 Jan 2022 17:35:11 +0100

Hi Mike,

As a usual ‘watcher’ on the this list, I would be very interested in working with you on such a report.  If this moves forward, please include me in the effort.

Michael Shea

> On Jan 5, 2022, at 4:53 PM, Mike Prorock <[email-masked]> wrote:
> 
> In the interest of keeping things in scope to the CCG I would be happy to co-author and support a report work item related to something like "Ethical Implications of Digital Credentials".  I share many of the same concerns around fundamental definitions as noted by Bob, and those details could be flushed out while working on such a report.  
> 
> Mike Prorock
> mesur.io <http://mesur.io/>
> On Wed, Jan 5, 2022, 10:14 Adrian Gropper <[email-masked] <mailto:[email-masked]>> wrote:
> Bob's are important questions in the context of our specific protocol work. I do not mean to scope this thread to general W3C or IETF groups or their governance. Bold is used below to link to Bob's specific questions.
> 
> I might also argue to limit the scope to protocols and not VC, DID, biometric templates, or other data models even though effective standards for these drive quantitative and possibly qualitative improvements in the efficiency of surveillance because a common language seems essential to discussing protocols. Adverse consequences of the efficiency of common interoperable language can be mitigated at the protocol level.
> 
> I'm responding in personal terms to Bob's questions. I urge all of us engaged in the protocol engineering effort to bring their own perspective on "Human Rights" and to advocate for specific technical solutions in specific workgroups. For example, I have chosen to focus attention on authorization for verifiable credential issue. I hope others will prioritize human rights impact of authentication protocols especially where biometrics could be involved.
> 
> The specific aspects of our protocol work that give rise to human rights issues relate to the efficiency of standardized digital credentials to human persons. What works for drugs in a supply chain or cattle on a farm can and usually will be misused on people. Also, transferring responsibility from an issuer to a subject of a VC is a burden that needs to be recognized and mitigated. With respect to the UDHRs, I would point to 12 (privacy and confidentiality), 13 (anonymity), 14 (limit the reach of DHS and other state actors), 17 (the right to associate with and delegate to others), 18 (associate with and delegate to communities one chooses), 20 (association, again), 21 (secret elections), 22 (anonymity), 23 (trade unions as delegates), 24 (burden of managing decisions in an asymmetric power relationship with the state or with dominant private platforms), 29 (duties to and scope of the community).
> 
> I'm suggesting that we formally address the issue of human rights as applied to the VC-API standardization process. I'm also suggesting that we use a process in VC-API that formally harmonizes our work with IETF GNAP.
> 
> Adrian
> 
> On Tue, Jan 4, 2022 at 11:45 PM Bob Wyman <[email-masked] <mailto:[email-masked]>> wrote:
> Adrian,
> Given that you're starting a new thread, I would appreciate it if you could do some context setting and clarifying:
> What do you mean by "Human Rights?" Hopefully, you won't consider that a foolish question. The issue is, of course, that since Internet standards are developed in a multicultural, multinational context, it isn't obvious, without reference to some external authority, what a standards group should classify as a human right. Different cultures and governments tend to differ on this subject... As far as I know, the "best" source of what might be considered a broad consensus definition of human rights is found in the UN's 1948 Universal Declaration of Human Rights <https://www.un.org/en/about-us/universal-declaration-of-human-rights> (UDHR). 
> Does the UDHR contain the full set of rights that you think should be addressed by standards groups? If not, are there additional rights that you think should be considered? 
> In his document, Human Rights Are Not a Bug <https://www.fordfoundation.org/work/learning/research-reports/human-rights-are-not-a-bug-upgrading-governance-for-an-equitable-internet/>, Niels ten Oever refers to the UN Guiding Principles for Business and Human Rights <https://www.ohchr.org/documents/publications/guidingprinciplesbusinesshr_en.pdf>, which adds to the rights enumerated in the UDHR a number of additional rights described in the International Labour Organization’s Declaration on Fundamental Principles and Rights at Work <https://www.ilo.org/declaration/lang--en/index.htm>. Given that you appear to endorse ten Oever's report, do you also propose the same combined set of rights? (ie. UDHR + ILO DFPRW?)
> Some have argued that the Internet introduces a need to recognize rights that have not yet been enumerated either in the UDHR or in any other broadly accepted documents. If this is the case, how is a standards group to determine what set of rights they must respect?
> What specific aspects of the issues being addressed by this community group give rise to human rights issues? Also, if you accept that one or some number of documents contain a useful list of such rights, can you identify which specific, enumerated rights are at risk? (e.g. if the UDHR is the foundation text, then I assume privacy issues would probably be considered in the context of the UDHR's Article 12 <https://www.un.org/en/about-us/universal-declaration-of-human-rights#:~:text=Article%2012,interference%20or%20attacks.>.)
> Are you suggesting that this group should formally address the issue of rights, with some sort of process, or just that we should be aware of the issues?
> ten Oever suggests that "Those who design, standardize, and maintain the infrastructure on which we run our information societies, should assess their actions, processes, and technologies on their societal impact." You apparently agree. Can you say how this should be done?
> The UN Guiding Principles for Business and Human Rights describe a number of procedural steps that should be taken by either governments or corporations. Are you aware of a similar procedural description that would apply to standards groups?
> I think it was in the video that it was suggested that, in Internet standards documents, "a section on human rights considerations should become as normal as one on security considerations." Do you agree? If so, can you suggest how such a section would be written?
> bob wyman
> 
> 
> On Tue, Jan 4, 2022 at 9:05 PM Adrian Gropper <[email-masked] <mailto:[email-masked]>> wrote:
> This is a new thread for a new year to inspire deeper cooperation between W3C and IETF. This is relevant to our formal objection issues in W3C DID as well as the harmonization of IETF SECEVENT DIDs and GNAP with ongoing protocol work in W3C and DIF.
> 
> The Ford Foundation paper attached provides the references. However, this thread should not be about governance philosophy but rather a focus on human rights as a design principle as we all work on protocols that will drive adoption of W3C VCs and DIDs at Internet scale.
> 
> https://redecentralize.org/redigest/2021/08/ <https://redecentralize.org/redigest/2021/08/> says:
> 
> Human rights are not a bug
> Decisions made by engineers in internet standards bodies (such as IETF <https://www.ietf.org/> and W3C <https://www.w3.org/>) have a large influence on internet technology, which in turn influences people’s lives — people whose needs may or may not have been taken into account. In the report Human Rights Are Not a Bug <https://www.fordfoundation.org/work/learning/research-reports/human-rights-are-not-a-bug-upgrading-governance-for-an-equitable-internet/> (see also its launch event <https://www.youtube.com/embed/qyYETzXJqmc?rel=0&iv_load_policy=3&modestbranding=1&autoplay=1>), Niels ten Oever asks “how internet governance processes could be updated to deeply embed the public interest in governance decisions and in decision-making culture”.
> “Internet governance organizations maintain a distinct governance philosophy: to be consensus-driven and resistant to centralized institutional authority over the internet. But these fundamental values have limitations that leave the public interest dangerously neglected in governance processes. In this consensus culture, the lack of institutional authority grants disproportionate power to the dominant corporate participants. While the governance bodies are open to non-industry members, they are essentially forums for voluntary industry self-regulation. Voices advocating for the public interest are at best limited and at worst absent.”
> The report describes how standards bodies, IETF in particular, focus narrowly on facilitating interconnection between systems, so that “many rights-related topics such as privacy, free expression or exclusion are deemed “too political””; this came hand in hand with the culture of techno-optimism:
> “There was a deeply entrenched assumption that the internet is an engine for good—that interconnection and rough consensus naturally promote democratization and that the open, distributed design of the network can by itself limit the concentration of power into oligopolies.
> To improve internet governance, the report recommends involving all stakeholders in decision procedures, and adopting human rights impact assessments (a section on human rights considerations should become as normal as one on security considerations).
> The report only briefly touches what seems an important point: that existing governance bodies may become altogether irrelevant as both tech giants and governments move on without them:
> “Transnational corporations and governments have the power to drive internet infrastructure without the existing governance bodies, through new technologies that set de facto standards and laws that govern “at” the internet not “with” it.”
> How much would having more diverse stakeholders around the table help, when ultimately Google decides whether and how a standard will be implemented, or founds a ‘more effective’ standardisation body instead?
> 
>

---

From: Ted Thibodeau Jr <[email-masked]>
Date: Wed, 5 Jan 2022 14:04:27 -0500

On Jan 5, 2022, at 10:11 AM, Adrian Gropper <[email-masked]> wrote:
> 
> transferring responsibility from an issuer to a subject of a VC

For the eleventeenth time, the SUBJECT of a VC has NO CONTROL 
over anything to do with that VC.  The only entities with control 
of any kind are the Issuer, the Holder(s), and the Verifier.
In the wilderness of the World Wide Web, ANYONE CAN SAY ANYTHING 
ABOUT ANYTHING.  (This is not so different from the wilderness 
of paper-space.)

I could Issue a VC today, with you, Adrian, as the Subject, 
which contains anything I care to say about you.  I could say 
that you, Adrian, are the 14th moon orbiting Sol III (a/k/a 
the third planet orbiting our sun, a/k/a Planet Earth).  This 
is not actually a fact, of course, but I may nonetheless Assert 
it, and I may do so in a VC, which simply allows anyone to 
Verify that I did in fact Issue that Assertion within that VC.

I could Issue this VC with or without the knowledge of you,
the Subject, to any Holder of my choosing, who may Present
it to any Holder or Verifier of *their* choosing, without 
any alert to you, the Subject.

There is *nothing* that the CCG nor the VCWG nor the IETF nor
the UN nor the USGovt nor any other entity can do to prevent
me from doing so.  The USGovt *may* pass laws that impose 
penalties upon me or others who make such untrue assertions 
in VCs, but, to date, they have not, and there would be some 
lengthy freedom of speech litigation if such were enacted and
someone then attempted enforcement -- and this is the *most*
possible path to such restrictions.

Your various efforts will have much greater effect, perhaps
even delivering the results you want, if you digest this,
and work it into your various writings and excoriations of
the various WGs and CGs and other audiences you address.
Failure to integrate this reality into your output will
only lead to frustration on all sides, and failure to
reach any of your declared goals.

I believe that some of your efforts have value.  (I don't
know the totality of your efforts, so cannot say this about
everything you will do or have done.)  I would like to see
these benefit the world.  I do not believe that will happen
if you continue to ignore the hard-won vocabulary developed
by the CCG, VCWG, DIDWG, and related efforts.

Be seeing you,

Ted

--
A: Yes.                          http://www.idallen.com/topposting.html
| Q: Are you sure?           
| | A: Because it reverses the logical flow of conversation.
| | | Q: Why is top posting frowned upon?

Ted Thibodeau, Jr.           //               voice +1-781-273-0900 x32
Senior Support & Evangelism  //        mailto:[email-masked]
                             //              http://twitter.com/TallTed
OpenLink Software, Inc.      //              http://www.openlinksw.com/
         20 Burlington Mall Road, Suite 322, Burlington MA 01803
     Weblog    -- http://www.openlinksw.com/blogs/
     Community -- https://community.openlinksw.com/
     LinkedIn  -- http://www.linkedin.com/company/openlink-software/
     Twitter   -- http://twitter.com/OpenLink
     Facebook  -- http://www.facebook.com/OpenLinkSoftware
Universal Data Access, Integration, and Management Technology Providers

---

From: Adrian Gropper <[email-masked]>
Date: Wed, 5 Jan 2022 14:46:08 -0500

I completely agree with Ted. Unfortunately, Holder is even more misleading
than Subject because it applies to the Issuer as well as the controller of
a VC. This is the problem with linking control with possession.

In the human rights context of this thread, we might consider ways that
Subject is verified. Is it though a biometric? Control of a private key?
Control of a legally mandated device such as an ankle bracelet? Control of
a device like Apple Wallet with certified biometric controls?

Choice of words aside, the linkage of control to possession in the context
of CCG is not a matter of ethics. Standardized digital credentials exist in
the context of state-controlled mobile driver's license credentials and
privately controlled $3Trillion wallet platforms. The NY Times describes
the tension between these sovereigns around the world almost every day. I
might stipulate that DHS and Apple are both ethical within the scope of
CCG. A verifiable VC issued as a COVID credential in New Zealand presumes
that a state document was verified and the mobile wallet used to present it
was certified. Otherwise, we're just engaging in security theater like much
of what passes for digital credentials today.

Translated to protocol work related to CCG, ethics and human rights are
different issues. Paraphrasing Heinz vonFoerster, we might say that the
ethical imperative of the CCG is to maximize the number of effective
choices on behalf of the Subject as they face the sovereign Issuers and
Verifiers and the equally sovereign private platforms.

Adrian

On Wed, Jan 5, 2022 at 2:04 PM Ted Thibodeau Jr <[email-masked]>
wrote:

> <[email-masked]>

---

From: Alan Karp <[email-masked]>
Date: Wed, 5 Jan 2022 11:53:07 -0800

RFCs have a Security Considerations section.  Are you suggesting that these
groups include a Human Rights Considerations section in addition?

--------------
Alan Karp

On Wed, Jan 5, 2022 at 7:14 AM Adrian Gropper <[email-masked]>
wrote:

> Bob's are important questions in the context of our specific protocol
> work. I do not mean to scope this thread to general W3C or IETF groups or
> their governance. *Bold* is used below to link to Bob's specific
> questions.
>
> human persons.* What works for drugs in a supply chain or cattle on a
> farm can and usually will be misused on people. Also, transferring
> applied to the VC-API standardization process.* I'm also suggesting that
> we use a process in VC-API that formally harmonizes our work with IETF GNAP.
>
> Adrian
>
>>       - Some have argued that the Internet introduces a need to
>>       recognize rights that have not yet been enumerated either in the UDHR or in
>>       any other broadly accepted documents. If this is the case, how is a
>>       standards group to determine what set of rights they must respect?
>>    community group give rise to human rights issues?* Also, if you
>>    accept that one or some number of documents contain a useful list of such
>>    rights, can you identify which specific, enumerated rights are at risk?
>>    (e.g. if the UDHR is the foundation text, then I assume privacy issues
>>    would probably be considered in the context of the UDHR's Article 12
>>    issue of rights*, with some sort of process, or just that we should
>>    be aware of the issues?
>>> This is a new thread for a new year to inspire deeper cooperation
>>> between W3C and IETF. This is relevant to our formal objection issues in
>>> W3C DID as well as the harmonization of IETF SECEVENT DIDs and GNAP with
>>> ongoing protocol work in W3C and DIF.
>>>
>>> The Ford Foundation paper attached provides the references. However,
>>> this thread should not be about governance philosophy but rather a focus on
>>>> “There was a deeply entrenched assumption that the internet is an
>>>> engine for good—that interconnection and rough consensus naturally promote

---

From: Bob Wyman <[email-masked]>
Date: Wed, 5 Jan 2022 15:52:15 -0500

Alan Karp asked:

> "RFCs have a Security Considerations section.  Are you suggesting that
> these groups include a Human Rights Considerations section in addition?"

The IETF's RFC 8280 <https://www.rfc-editor.org/info/rfc8280> outlines
"Research
into Human Rights Protocol Considerations" and Internet Draft
draft-irtf-hrpc-guidelines
<https://datatracker.ietf.org/doc/draft-irtf-hrpc-guidelines/> (now in
version 10) proposes to update RFC 8280 with "Guidelines for Human Rights
Protocol and Architecture Considerations." Presumably, these documents
could provide the foundation for any "Human Rights Considerations" section
that might be included in specifications, etc.

Adrian, would sections conforming to the guidelines in
draft-irtf-hrpc-guidelines
<https://datatracker.ietf.org/doc/draft-irtf-hrpc-guidelines/> satisfy your
concerns?

bob wyman

Research into Human Rights Protocol Considerations

On Wed, Jan 5, 2022 at 2:53 PM Alan Karp <[email-masked]> wrote:

> RFCs have a Security Considerations section.  Are you suggesting that
> these groups include a Human Rights Considerations section in addition?
>
> --------------
> Alan Karp
>
>
>>>    - *What do you mean by "Human Rights?" *Hopefully, you won't
>>>    consider that a foolish question. The issue is, of course, that since
>>>    Internet standards are developed in a multicultural, multinational context,
>>>    it isn't obvious, without reference to some external authority, what a
>>>       - The UN Guiding Principles for Business and Human Rights
>>>       describe a number of procedural steps that should be taken by either
>>>       governments or corporations. Are you aware of a similar procedural
>>>       description that would apply to standards groups?

---

From: Adrian Gropper <[email-masked]>
Date: Wed, 5 Jan 2022 15:57:04 -0500

In this thread, my focus is the relationship between CCG and GNAP. RFCs are
considered in the broader context of an Internet security layer such as Sam
Smith and KERI are addressing. My proposal is that CCG will be well-served
by adopting GNAP (and RAR) in as many protocol efforts as it can. If CCG
does not outsource some protocol concerns to GNAP and other RFCs, then I
believe other groups will bypass CCG-related protocols as we are already
seeing in EU and ISO with mDL.

The VC and DID work on data models and related registries is valuable with
or without CCG protocol tie-ins. If I were to suggest a formal CCG work
item, it would be to develop which specific authorization and
authentication protocols should be layered on top of GNAP and RAR.

Adrian

---

From: Bob Wyman <[email-masked]>
Date: Wed, 5 Jan 2022 16:25:51 -0500

Adrian,
I'm confused by your latest comments. Could you please explain how CCG's
adoption of GNAP would facilitate "a focus on human rights as a design
principle" (i.e. the goal you stated in your original message) Please
forgive me if I'm missing something important in what you've said.

bob wyman

On Wed, Jan 5, 2022 at 3:57 PM Adrian Gropper <[email-masked]>
wrote:

> In this thread, my focus is the relationship between CCG and GNAP. RFCs
> are considered in the broader context of an Internet security layer such as
> Sam Smith and KERI are addressing. My proposal is that CCG will be
> well-served by adopting GNAP (and RAR) in as many protocol efforts as it
> can. If CCG does not outsource some protocol concerns to GNAP and other
> RFCs, then I believe other groups will bypass CCG-related protocols as we
> are already seeing in EU and ISO with mDL.
>
>>> *The specific aspects of our protocol work that give rise to human
>>> rights issues relate to the efficiency of standardized digital credentials
>>> to human persons.* What works for drugs in a supply chain or cattle on
>>> a farm can and usually will be misused on people. Also, transferring
>>> applied to the VC-API standardization process.* I'm also suggesting
>>> that we use a process in VC-API that formally harmonizes our work with IETF
>>> GNAP.
>>>
>>> Adrian
>>>
>>>>>> Decisions made by engineers in internet standards bodies (such as
>>>>>> IETF <https://www.ietf.org/> and W3C <https://www.w3.org/>) have a
>>>>>> large influence on internet technology, which in turn influences people’s
>>>>>> lives — people whose needs may or may not have been taken into account. In
>>>>>> the report Human Rights Are Not a Bug
>>>>>> assessments (a section on *human rights considerations* should
>>>>>> become as normal as one on *security considerations*).
>>>>>> How much would having more diverse stakeholders around the table
>>>>>> help, when ultimately Google decides whether and how a standard will be

---

From: Adrian Gropper <[email-masked]>
Date: Wed, 5 Jan 2022 16:44:39 -0500

Bob,
The design principle is Separation of Concerns (separating control from
possession).

The human rights issue is to mitigate the often absolute sovereignty of the
Issuer by making it obvious in both the technical and the regulatory sense
when the Issuer is reducing the capacity or choice of the Subject through
mandates like OAuth client credentials. GNAP, as opposed to OAuth, makes it
very obvious when delegation is restricted without justification. As such,
it will tend to keep the Issuers more honest and make them more transparent
and easier to judge in terms of human rights.

Adrian

On Wed, Jan 5, 2022 at 4:26 PM Bob Wyman <[email-masked]> wrote:

>> The VC and DID work on data models and related registries is valuable
>> with or without CCG protocol tie-ins. If I were to suggest a formal CCG
>> work item, it would be to develop which specific authorization and
>>>>>       Niels ten Oever refers to the UN Guiding Principles for
>>>>>       Business and Human Rights
>>>>>       <https://www.ilo.org/declaration/lang--en/index.htm>. Given
>>>>>       that you appear to endorse ten Oever's report, do you also propose the same
>>>>>    issue of rights*, with some sort of process, or just that we
>>>>>    should be aware of the issues?
>>>>>>> deemed “too political””*; this came hand in hand with the culture
>>>>>>> of techno-optimism:

---

From: Justin Richer <[email-masked]>
Date: Wed, 5 Jan 2022 17:33:43 -0500

Federated identity and delegated access are separate concerns, please be careful not to conflate them. The choice of a service to delegate login — which GNAP does not define — is the choice of that service.

And in fact, the loss of services is exactly the kind of thing that, I believe, Adrian is asking about. In GNAP core, we improve this over OAuth by moving away from the “go to a web page on the AS” assumptions and allowing a more nuanced and varied means of interaction and consent. Technologies like VC fit really well here: if I can present a VC to the AS, then the AS doesn’t need to “log me in” in a traditional OAuth sense.

https://www.ietf.org/archive/id/draft-ietf-gnap-core-protocol-08.html#name-determining-authorization-a <https://www.ietf.org/archive/id/draft-ietf-gnap-core-protocol-08.html#name-determining-authorization-a>

As I’ve explained on several DID, VCAPI, and related calls so far, this connection inbound to the AS is one of the most important ways that these items can be connected. If I have an accepted and standard way to get my consent, rights, and attributes into the AS without the AS needing me to make an account and log in, the more distributed the end system ends up being :without: requiring an RS to accept tokens from an arbitrary AS. We know from past attempts that this latter request is a bridge too far for nearly every RS. Getting the AS to accept external inputs and interactions, however, is a well-established pattern that GNAP is codifying and making explicitly extensible.

Also a note about IETF process for the W3C folks that this document is not simply an “internet-draft” from an individual (which has about as much weight as a web-page) but an active document of an active working group, and as such has more normative standards weight than any Note the CCG is allowed to produce within the W3C. This is not to disparage the CCG at all, but just to point out that there are different classes of work here, and it’s easy to confuse the two.

Also since this seems to be confusing, the expiration date is an artifact of the group currently focusing on the core document, and as discussed publicly at the WG meetings, the resource server document is next on the queue. As I’m sure you are aware yourself, Orie, there are only so many cycles that a group can apply to work in progress and be effective. It is not an indication that the WG has abandoned or plans to abandon the resource servers draft.

 — Justin

> On Jan 5, 2022, at 5:12 PM, Orie Steele <[email-masked]> wrote:
> 
> I wonder how many services President Trump lost access to when they banned his twitter account.
> 
> Can someone explain how GNAP improves on OAuth in this regard?
> 
> I can't find anything here: https://datatracker.ietf.org/doc/html/draft-ietf-gnap-resource-servers#section-7 <https://datatracker.ietf.org/doc/html/draft-ietf-gnap-resource-servers#section-7>
> 
> Also heads up that this "Internet-Draft" of "Intended status: Standards Track" expires on 13 January 2022.
> 
> 
> OS
> 
> 
> ᐧ
> 
> On Wed, Jan 5, 2022 at 3:46 PM Adrian Gropper <[email-masked] <mailto:[email-masked]>> wrote:
> Bob,
> The design principle is Separation of Concerns (separating control from possession). 
> 
> The human rights issue is to mitigate the often absolute sovereignty of the Issuer by making it obvious in both the technical and the regulatory sense when the Issuer is reducing the capacity or choice of the Subject through mandates like OAuth client credentials. GNAP, as opposed to OAuth, makes it very obvious when delegation is restricted without justification. As such, it will tend to keep the Issuers more honest and make them more transparent and easier to judge in terms of human rights.
> 
> Adrian
> 
> On Wed, Jan 5, 2022 at 4:26 PM Bob Wyman <[email-masked] <mailto:[email-masked]>> wrote:
> Adrian,
> I'm confused by your latest comments. Could you please explain how CCG's adoption of GNAP would facilitate "a focus on human rights as a design principle" (i.e. the goal you stated in your original message) Please forgive me if I'm missing something important in what you've said.
> 
> bob wyman
> 
> 
> On Wed, Jan 5, 2022 at 3:57 PM Adrian Gropper <[email-masked] <mailto:[email-masked]>> wrote:
> In this thread, my focus is the relationship between CCG and GNAP. RFCs are considered in the broader context of an Internet security layer such as Sam Smith and KERI are addressing. My proposal is that CCG will be well-served by adopting GNAP (and RAR) in as many protocol efforts as it can. If CCG does not outsource some protocol concerns to GNAP and other RFCs, then I believe other groups will bypass CCG-related protocols as we are already seeing in EU and ISO with mDL. 
> 
> The VC and DID work on data models and related registries is valuable with or without CCG protocol tie-ins. If I were to suggest a formal CCG work item, it would be to develop which specific authorization and authentication protocols should be layered on top of GNAP and RAR.
> 
> Adrian
> 
> On Wed, Jan 5, 2022 at 2:53 PM Alan Karp <[email-masked] <mailto:[email-masked]>> wrote:
> RFCs have a Security Considerations section.  Are you suggesting that these groups include a Human Rights Considerations section in addition?
> 
> --------------
> Alan Karp
> 
> 
> On Wed, Jan 5, 2022 at 7:14 AM Adrian Gropper <[email-masked] <mailto:[email-masked]>> wrote:
> ORIE STEELE
> Chief Technical Officer
> www.transmute.industries <http://www.transmute.industries/>
> 
>  <https://www.transmute.industries/>

---

From: "Bron Gondwana" <[email-masked]>
Date: Thu, 06 Jan 2022 11:07:49 +1100

Hi Adrian,

I'm having trouble understanding this:

*I urge all of us engaged in the protocol engineering effort to bring their own perspective on "Human Rights" and to advocate for specific technical solutions in specific workgroups.*

It doesn't meaningfully define human rights and allow a reviewer to tell whether a protocol definition has addressed human rights adequately, it's the "I know it when I see it" standard - with everybody is bringing their own idea of what "it" is.

I'd love to have a human rights considerations section in IETF documents in the same way that we have a security considerations.  Many things that are currently in security considerations would probably be just as appropriate for human rights considerations, as many IETF authors already bring their own perspective on human rights and advocate for technical solutions which they believe support those rights.  But that's not the same as having an agreement on what human rights are relevant for our technical work.

Regards,

Bron.

On Thu, Jan 6, 2022, at 02:11, Adrian Gropper wrote:
> Bob's are important questions in the context of our specific protocol work. I do not mean to scope this thread to general W3C or IETF groups or their governance. *Bold* is used below to link to Bob's specific questions.
> 
> I'm responding in personal terms to Bob's questions. *I urge all of us engaged in the protocol engineering effort to bring their own perspective on "Human Rights" and to advocate for specific technical solutions in specific workgroups.* For example, I have chosen to focus attention on authorization for verifiable credential issue. I hope others will prioritize human rights impact of authentication protocols especially where biometrics could be involved.
> 
> *The specific aspects of our protocol work that give rise to human rights issues relate to the efficiency of standardized digital credentials to human persons.* What works for drugs in a supply chain or cattle on a farm can and usually will be misused on people. Also, transferring responsibility from an issuer to a subject of a VC is a burden that needs to be recognized and mitigated. With respect to the UDHRs, I would point to 12 (privacy and confidentiality), 13 (anonymity), 14 (limit the reach of DHS and other state actors), 17 (the right to associate with and delegate to others), 18 (associate with and delegate to communities one chooses), 20 (association, again), 21 (secret elections), 22 (anonymity), 23 (trade unions as delegates), 24 (burden of managing decisions in an asymmetric power relationship with the state or with dominant private platforms), 29 (duties to and scope of the community).
> 
> *I'm suggesting that we formally address the issue of human rights as applied to the VC-API standardization process.* I'm also suggesting that we use a process in VC-API that formally harmonizes our work with IETF GNAP.
> 
> Adrian
> 
>>  * *What do you mean by "Human Rights?" *Hopefully, you won't consider that a foolish question. The issue is, of course, that since Internet standards are developed in a multicultural, multinational context, it isn't obvious, without reference to some external authority, what a standards group should classify as a human right. Different cultures and governments tend to differ on this subject... As far as I know, the "best" source of what might be considered a broad consensus definition of human rights is found in the UN's 1948 Universal Declaration of Human Rights <https://www.un.org/en/about-us/universal-declaration-of-human-rights> (UDHR). 
>>    * Does the UDHR contain the full set of rights that you think should be addressed by standards groups? If not, are there additional rights that you think should be considered? 
>>    * In his document, Human Rights Are Not a Bug <https://www.fordfoundation.org/work/learning/research-reports/human-rights-are-not-a-bug-upgrading-governance-for-an-equitable-internet/>, Niels ten Oever refers to the UN Guiding Principles for Business and Human Rights <https://www.ohchr.org/documents/publications/guidingprinciplesbusinesshr_en.pdf>, which adds to the rights enumerated in the UDHR a number of additional rights described in the International Labour Organization’s Declaration on Fundamental Principles and Rights at Work <https://www.ilo.org/declaration/lang--en/index.htm>. Given that you appear to endorse ten Oever's report, do you also propose the same combined set of rights? (ie. UDHR + ILO DFPRW?)
>>    * Some have argued that the Internet introduces a need to recognize rights that have not yet been enumerated either in the UDHR or in any other broadly accepted documents. If this is the case, how is a standards group to determine what set of rights they must respect?
>>  * *What specific aspects of the issues being addressed by this community group give rise to human rights issues?* Also, if you accept that one or some number of documents contain a useful list of such rights, can you identify which specific, enumerated rights are at risk? (e.g. if the UDHR is the foundation text, then I assume privacy issues would probably be considered in the context of the UDHR's Article 12 <https://www.un.org/en/about-us/universal-declaration-of-human-rights#:~:text=Article%2012,interference%20or%20attacks.>.)
>>  * *Are you suggesting that this group should formally address the issue of rights*, with some sort of process, or just that we should be aware of the issues?
>>    * ten Oever suggests that "Those who design, standardize, and maintain the infrastructure on which we run our information societies, should assess their actions, processes, and technologies on their societal impact." You apparently agree. Can you say how this should be done?
>>    * The UN Guiding Principles for Business and Human Rights describe a number of procedural steps that should be taken by either governments or corporations. Are you aware of a similar procedural description that would apply to standards groups?
>>    * I think it was in the video that it was suggested that, in Internet standards documents, "a section on human rights considerations should become as normal as one on security considerations." Do you agree? If so, can you suggest how such a section would be written?
>> bob wyman
>> 
>> 
>> On Tue, Jan 4, 2022 at 9:05 PM Adrian Gropper <[email-masked]> wrote:
>>>> Decisions made by engineers in internet standards bodies (such as IETF <https://www.ietf.org/> and W3C <https://www.w3.org/>) have a large influence on internet technology, which in turn influences people’s lives — people whose needs may or may not have been taken into account. In the report Human Rights Are Not a Bug <https://www.fordfoundation.org/work/learning/research-reports/human-rights-are-not-a-bug-upgrading-governance-for-an-equitable-internet/> (see also its launch event <https://www.youtube.com/embed/qyYETzXJqmc?rel=0&iv_load_policy=3&modestbranding=1&autoplay=1>), Niels ten Oever asks *“how internet governance processes could be updated to deeply embed the public interest in governance decisions and in decision-making culture”*.
>>>> The report describes how standards bodies, IETF in particular, focus narrowly on facilitating interconnection between systems, so that *“many rights-related topics such as privacy, free expression or exclusion are deemed “too political””*; this came hand in hand with the culture of techno-optimism:
>>>> To improve internet governance, the report recommends involving all stakeholders in decision procedures, and adopting human rights impact assessments (a section on *human rights considerations* should become as normal as one on *security considerations*).
> TXAuth mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/txauth
> 

--
  Bron Gondwana, CEO, Fastmail Pty Ltd
  [email-masked]

---

From: Adrian Gropper <[email-masked]>
Date: Wed, 5 Jan 2022 20:04:32 -0500

Hi Bron,

I'd love to have a human rights consideration section in IETF as well. This
particular thread, however, is not about the W3C or IETF standards process
but rather a specific protocol instance where I believe a human rights
framing would add value to both the W3C and IETF work.

In my role as non-commercial volunteer privacy expert and community
representative to specific open standards groups, I have some experience
with W3C, IEEE, DIF, IETF, and Kantara as well as numerous medical SDOs. As
a result, I am very sensitive to the unfortunate gaming of process and
governance as well as the difference between ethics and human rights.

That said, I'm trained as and consider myself primarily an engineer. As
with Facebook and Google and other less publicized efforts to mitigate
social problems by appealing to the engineers themselves, this thread is
meant as a call to action to my colleagues working to standardize digital
identity at scale.

Adrian

On Wed, Jan 5, 2022 at 7:08 PM Bron Gondwana <[email-masked]> wrote:

> *I urge all of us engaged in the protocol engineering effort to bring
> their own perspective on "Human Rights" and to advocate for specific
> technical solutions in specific workgroups.*
>
> It doesn't meaningfully define human rights and allow a reviewer to tell
> whether a protocol definition has addressed human rights adequately, it's
> the "I know it when I see it" standard - with everybody is bringing their
> own idea of what "it" is.
>
> I'd love to have a human rights considerations section in IETF documents
> in the same way that we have a security considerations.  Many things that
> are currently in security considerations would probably be just as
> appropriate for human rights considerations, as many IETF authors already
> bring their own perspective on human rights and advocate for technical
> solutions which they believe support those rights.  But that's not the same
> as having an agreement on what human rights are relevant for our technical
> work.
>
> Regards,
>
> Bron.
>
>       be addressed by standards groups? If not, are there additional rights that
>    - ten Oever suggests that "Those who design, standardize, and maintain
>       the infrastructure on which we run our information societies, should assess
>       their actions, processes, and technologies on their societal impact." You
>       apparently agree. Can you say how this should be done?

---

From: Leif Johansson <[email-masked]>
Date: Thu, 6 Jan 2022 13:16:06 +0100

On 2022-01-05 03:02, Adrian Gropper wrote:
> This is a new thread for a new year to inspire deeper cooperation between W3C and IETF. This is relevant to our formal objection issues in W3C DID as well as the harmonization of IETF SECEVENT DIDs
> and GNAP with ongoing protocol work in W3C and DIF.
> 

With my chair hat on, and given that this was cross-posted outside the IETF GNAP WG:

Folks,

these are complex and important topics. In the interest of making progress and in
order to help our editors sort through the discussion please consider the following:

1. Try to propose text. It is easier to talk about and form consensus (or not) when
discussing specific proposals for inclusion in existing Internet Drafts than when having
a purely conceptual discussion. A conceptual discussion can still happen but it will
be easier to have if somewhat more focused.

2. Sometimes when the thing you want to express is hard to condense into a few
paragraphs of text for an existing I-D, consider writing a short separate Internet
Draft. This does not mean you disagree with everything else or even intend for the
Draft to become an RFC, it is simply a convenient way to focus a discussion in the IETF.

This was meant as as advise on how to progress towards rough consensus.

Please carry on.

	Cheers Leif

---

From: Justin Richer <[email-masked]>
Date: Thu, 6 Jan 2022 08:46:36 -0500

Hi Orie,

> On Jan 5, 2022, at 8:02 PM, Orie Steele <[email-masked]> wrote:
> 
> Thanks for your reply Justin, I'm loosely familiar with IETF, having seen HTTP Signatures work expire before <https://datatracker.ietf.org/doc/html/draft-cavage-http-signatures-12>... (same status type)... vs https://datatracker.ietf.org/doc/html/rfc9162 <https://datatracker.ietf.org/doc/html/rfc9162> (does not expire).
> 
> You stated that the document is incorrectly labeled:
> 
> > Also a note about IETF process for the W3C folks that this document is not simply an “internet-draft” from an individual (which has about as much weight as a web-page) but an active document of an active working group, and as such has more normative standards weight than any Note the CCG is allowed to produce within the W3C.
> 
> Am I linking to the incorrect place here?
> 
> <Screen Shot 2022-01-05 at 4.43.41 PM.png>
> 

You are linking to the correct draft but you’re still missing an important distinction: there’s a huge difference between an individual I-D, which is what the old signatures draft was, and an active working group document, which is what the GNAP resource servers document is. The latter is on a path to become an RFC, the former is not. Both are “labeled” as I-D, which might be the source of the confusion — and that’s why I say that the label of “internet draft” doesn’t actually mean anything on its own. It’s the state of the document within the process of the SDO that matters. This is why the current HTTP Signatures draft within the HTTP working group is considered :much: more normative than any of the old individual drafts, including the series of Cavage drafts. There’s a group of people who have committed to working on it and progressing it, and that progress is being made. So what I’m trying to do here is to stop you from drawing these false equivalences, especially in the service of casting doubt and fear around the documents.

> > The choice of a service to delegate login — which GNAP does not define — is the choice of that service.
> > And in fact, the loss of services is exactly the kind of thing that, I believe, Adrian is asking about.
> 
> Yes, this is my exact point...(sorry if the humor didn't land properly). 
> 
> You seem to be asserting that GNAP does not protect against loss of services (clearly OAuth does not).
> 
> Adrian seems to be asserting that loss of an issuer service is a threat to human rights.... My point is that suggesting GNAP is a solution to this problem is incorrect in the same way you pointed out that conflating federated identity and delegated access is incorrect.... or to put the entire thing in terms of GNAP.... GNAP does not protect against loss of GNAP authorization servers... GNAP users are vulnerable (in the same sense that OAuth users are) to loss of authorization servers... If I am getting this wrong, and GNAP supports decentralized authorization servers that are uncensorable, please explain how that works, because that sounds awesome... and similar to a blockchain :)
> 

Believe it or not, blockchain does not solve all problems — or even most of them. :) Loss of an AS means loss of access to the services that the AS protects, yes. But what you’re missing here is that with GNAP, the AS can now be more closely regarded by the RS instead of forcing it to outsource the AS to a larger provider. This is possible in OAuth, of course, but the process is much easier in GNAP. UMA tried to solve the problem in the other direction of making it much easier for the RS to outsource to an arbitrary AS, but the trust model of that approach never caught on, for what I think are a lot of really good reasons. In GNAP, we’re instead looking at the AS as a “token factory” that provides a set of policies that translate into a token the RS can understand. This means that the relationship between the AS and RS is the choice of the RS, and the relationship between the AS and end user is potentially separated from that. It means that an AS can now give me a lot more different options for accessing my stuff at the RS instead of just “do you have this account”. I am no longer limited to a model where it’s expected that I “log in”, and where “logging in” is just one among many options. Again we see this in OAuth as well, but it’s less common than it could be because of assumptions built into the OAuth protocol flows.

But again I want to point out that you’re conflating API access with federated login. In a strawman twitter example, let’s say they do remove a hypothetical fascist dictator from their platform. That dictator won’t be able to access Twitter, of course, but as you point out they also won’t be able to access their twitter-connected apps. This might :feel: like you’re not able to access the RS’s because you’re not able to access the AS, but that’s not at all what’s happening. What’s really happening is that the apps are a bunch of clients — consumers of the RS provided by Twitter (the Twitter API) which, among other things, provided an identity API and therefore acts as an IdP. Twitter is not the AS that protects the services, it’s the IdP that provides a log-in process to them.

It may seem like a subtle distinction, but it’s vital to understanding how these trust ecosystems actually function, and I am constantly seeing people get these lines crossed.

> I am attempting to learn the answer to the same question Bob asked:
> 
> > Could you please explain how CCG's adoption of GNAP would facilitate "a focus on human rights as a design principle" (i.e. the goal you stated in your original message) 
> 
> Based on what Justin has said so far, it seems like the answer is no, protocols do not solve human rights problems, especially ones associated with issuer's revoking or refreshing credentials, or Verifiers / RPs acting in bad faith.... or any of the other issues discussed here: https://w3c.github.io/vc-data-model/#privacy-considerations <https://w3c.github.io/vc-data-model/#privacy-considerations>
> 
> Since GNAP and OAuth are both equally incapable of compelling an issuer (like twitter, or the US Gov), or verifiers (... like Login.gov <http://login.gov/>, Auth0 / Okta, or other proud operators of OAuth Authorization Servers), or RPs (verifiers who are resource server operators) to enforce human rights.
> 

This is really the crux of the argument — the technology is never going to outweigh the trust and policy side of things. You could have a completely internet-wide fully-distributed system, like OpenID 2.0, and people would still make allowlists and blocklists to limit which sites they accept login from. The same thing already happens with DIDs — implementors are limiting to specific methods and resolvers, which immediately slices the “global distributed” network up into silos. This will always happen. The best thing that we can do is build a technology that makes it easier to connect and work on policies, regulations, and environments that encourage those interconnections to happen. It takes both the capability and the will to do so, and technologies all too often focus on the former.

This is at the heart of what Adrian is talking about, in my interpretation: we need to make sure that the technological choices we are making :enable: the policy and trust decisions to be good ones. This is what the human rights considerations work in IETF is trying to accomplish, to make sure that technologies being developed are considered in that light, in the same way that the security and privacy considerations have done in the past. I applaud and welcome this, even though it means more work for me as a specification author.

> However, GNAP has learned from OAuth (and its many failings), and as Justin pointed out, the core document is the current focus of the working group at IETF... 
> 
> <Screen Shot 2022-01-05 at 5.17.27 PM.png>
> (Same status, expires in April ). -- side note, I wish W3C did the same thing, expiring things seems like a best practice.
> 

Again please see above, you are misinterpreting the document status and expiration tags. Please stop putting this weight and interpretation behind them. To go back to the signatures example, please see the difference between the status of the WG document, particularly in the “Stream” section of the metadata:

https://datatracker.ietf.org/doc/draft-ietf-httpbis-message-signatures/ <https://datatracker.ietf.org/doc/draft-ietf-httpbis-message-signatures/>

And the individual drafts:

https://datatracker.ietf.org/doc/draft-cavage-http-signatures/ <https://datatracker.ietf.org/doc/draft-cavage-http-signatures/>
https://datatracker.ietf.org/doc/draft-richanna-http-message-signatures/ <https://datatracker.ietf.org/doc/draft-richanna-http-message-signatures/>

Please stop extrapolating from the values you have been, your interpretations are not correct and your conclusions are misguided.

> This section seems to speak to the question Bob and I were asking...
> 
> > The role of the authorization server is to manage the authorization of client instances to protect access to the user's data. In this role, the authorization server is by definition aware of each authorization of a client instance by a user. When the authorization server shares user information with the client instance, it needs to make sure that it has the permission from that user to do so.
> 
> > Additionally, as part of the authorization grant process, the authorization server may be aware of which resource servers the client intends to use an access token at.
> 
> > If the authorization server's implementation of access tokens is such that it requires a resource server call back to the authorization server to validate them, then the authorization server will be aware of which resource servers are actively in use and by which users and which clients. To avoid this possibility, the authorization server would need to structure access tokens in such a way that they can be validated by the resource server without notifying the authorization server that the token is being validated.
> 
> -  <x-msg://47/goog_1480019720>https://www.ietf.org/archive/id/draft-ietf-gnap-core-protocol-08.html#name-privacy-considerations
>  <https://www.ietf.org/archive/id/draft-ietf-gnap-core-protocol-08.html#name-privacy-considerations>
> To me, this section of the GNAP spec sounds very familiar.... to this section of the VC Data Model...
> > As detailed in Section § 7.13 Usage Patterns <https://w3c.github.io/vc-data-model/#usage-patterns>, usage patterns can be correlated into certain types of behavior. Part of this correlation is mitigated when a holder <https://w3c.github.io/vc-data-model/#dfn-holders> uses a verifiable credential <https://w3c.github.io/vc-data-model/#dfn-verifiable-credentials> without the knowledge of the issuer <https://w3c.github.io/vc-data-model/#dfn-issuers>. Issuers <https://w3c.github.io/vc-data-model/#dfn-issuers> can defeat this protection however, by making their verifiable credentials <https://w3c.github.io/vc-data-model/#dfn-verifiable-credentials> short lived and renewal automatic.
> 
> > For example, an ageOver verifiable credential <https://w3c.github.io/vc-data-model/#dfn-verifiable-credentials> is useful for gaining access to a bar. If an issuer <https://w3c.github.io/vc-data-model/#dfn-issuers> issues such a verifiable credential <https://w3c.github.io/vc-data-model/#dfn-verifiable-credentials> with a very short expiration date and an automatic renewal mechanism, then the issuer <https://w3c.github.io/vc-data-model/#dfn-issuers> could possibly correlate the behavior of the holder <https://w3c.github.io/vc-data-model/#dfn-holders> in a way that negatively impacts the holder <https://w3c.github.io/vc-data-model/#dfn-holders>.
> 
> > Organizations providing software to holders <https://w3c.github.io/vc-data-model/#dfn-holders> should warn them if they repeatedly use credentials <https://w3c.github.io/vc-data-model/#dfn-credential> with short lifespans, which could result in behavior correlation. Issuers <https://w3c.github.io/vc-data-model/#dfn-issuers> should avoid issuing credentials <https://w3c.github.io/vc-data-model/#dfn-credential> in a way that enables them to correlate usage patterns.
> 
> - https://w3c.github.io/vc-data-model/#frequency-of-claim-issuance <https://w3c.github.io/vc-data-model/#frequency-of-claim-issuance>
> 

Yes, these are similar privacy considerations because of similar underlying problems. Implementors need to be aware of what could happen when the technology is used, because it might otherwise surprise them. And the fact that they’re discussed at all is a testament to the utility of the privacy considerations section.

> Another reference:
> > An application currently utilizing OpenID Connect for accessing various federated identity providers can use the same protocol to also integrate with emerging SSI-based wallets. This is a convenient transition path leveraging existing expertise to protect investments made.
> 
> - https://openid.net/2021/12/17/first-public-review-period-for-openid-connect-siopv2-and-oidc4vp-specifications-started/ <https://openid.net/2021/12/17/first-public-review-period-for-openid-connect-siopv2-and-oidc4vp-specifications-started/>
> - https://openid.net/specs/openid-connect-4-verifiable-presentations-1_0-07.html <https://openid.net/specs/openid-connect-4-verifiable-presentations-1_0-07.html>The questions Adrian is asking regarding human rights apply to GNAP, OAuth, OIDC and the VC Data Model.
> The question remains which protocol is "best for human rights"... OIDC, OAuth, GNAP ?
> 
> I hope they keep competing with each other for that title... 
> 
> Lets not feed the trolls by taking their bait of "Bitcoin is the only solution to human rights issues" or "OIDC is the only solution to human rights issues"... 
> These kinds of moral statements are divisive and unwinnable.
> 

There is no “best” overall, there is only what can do better in specific aspects. I really do believe GNAP is doing better in a lot of aspects because it is built on learning of how people have used other systems, including OIDC and OAuth but not limited to those experiences, of course. In fact, it’s experience with technologies like VC’s and wallets that drove much of GNAP’s open extensibility in end-user interaction, to allow for that kind of connection. Nobody from the VC community has stepped up to help write down that connection in an interoperable way, yet, but it’s something that I keep reaching out to people for and hoping we can do.

> Lets avoid maximalist perspectives and embrace the fact that diversity is a security property.
> 
> I encourage folks interested in contributing to GNAP to join the IETF WG, interested in OIDC? Join the OIDF, etc...
> 

While this statement is correct, the connections are also important, and I thank Adrian for continually trying to make these connections happen. It’s important to understand what the best connection points are, though. I do not see this as a competition, since these technologies are working in tangential spaces and can fit together in a  variety of ways, as I’ve presented to this very group.

 — Justin

> The "best protocol for defending human rights" is an observable property of successfully served users.
> 
> Cheers,
> 
> OS
> ᐧ
> 
> On Wed, Jan 5, 2022 at 4:33 PM Justin Richer <[email-masked] <mailto:[email-masked]>> wrote:
>> On Jan 5, 2022, at 5:12 PM, Orie Steele <[email-masked] <mailto:[email-masked]>> wrote:
>>

---

From: Dave Crocker <[email-masked]>
Date: Thu, 6 Jan 2022 06:02:23 -0800

On 1/6/2022 5:46 AM, Justin Richer wrote:
> ou are linking to the correct draft but you’re still missing an 
> important distinction: there’s a huge difference between an individual 
> I-D, which is what the old signatures draft was, and an active working 
> group document, which is what the GNAP resource servers document is. The 
> latter is on a path to become an RFC, the former is not. Both are 
> “labeled” as I-D, which might be the source of the confusion — and 
> that’s why I say that the label of “internet draft” doesn’t actually 
> mean anything on its own. It’s the state of the document within the 
> process of the SDO that matters. This is why the current HTTP Signatures 
> draft within the HTTP working group is considered :much: more normative 
> than any of the old individual drafts, including the series of Cavage drafts

The above clarifications have the right spirit, but I'll suggest some 
simplifications that might make things even easier and maybe clearer:

1. Any and all IETF-related (draft-) Internet Drafts have no formal 
publication status.  None.  They are working documents and the nature of 
venue of the work involving them varies from none to a lot.

2. Outside of the formalities, any individual group -- including an IETF 
working group -- can choose to add their own formal status, such as 
'working group document', but that's an internal status for group 
management purposes.

3. When an I-D has some relationship to a published document, the I-D is 
likely to represent more recent views, obviously.  One can choose to 
favor it, therefore, but that's different from its having community 
reviewed and approved status.

d/

-- 
Dave Crocker
Brandenburg InternetWorking
bbiw.net

---

From: Mark Lizar <[email-masked]>
Date: Thu, 6 Jan 2022 14:03:12 +0000

Hi List,

I have been mostly a lurker on this list as the majority of technical discussion doesn’t include ethics, human rights etc.

To this end, we are working on the next evolution of a project to Open Privacy Notice and subsequently consent with specifications based on international  ISO/IEC standards @  Kantara in the follow on from the Consent and Information Sharing WG, called ANCR WG. \

It is a project human centric transparency, control and rights access, or in short computational privacy law, utilizing these standards for creating Proof of Notice (records), for evidence of Consent (receipts), and we have an implementation with a rights Notary, and Controller State Change Ledger (Not block chain).

In this regard, receipts are easily tokens, signed by a rights Notary (GNAP end point), and can automatically be provided from a data subject client to a Controller, processor or the like.      A service architecture which aims to provide the capacity for micro-credentials to be used, and to enable strong independent authorization and autonomous rights access.  AKA, access to rights and data governance independent of the service provider and technology.   (Not dependent on it). I see GNAP enabling in this architecture what we refer to as decentralized data governance, using public rules/privacy law (which this architecture can implement with standards).

Perhaps, rather than a human rights section, there would be a human rights case study / example, to coincide with security considerations?  (A case study that is inclusive and not only the engineering geeks. )

Kind Regards,

Mark

On Jan 6, 2022, at 8:46 AM, Justin Richer <[email-masked]<mailto:[email-masked]>> wrote:

---

From: Justin Richer <[email-masked]>
Date: Thu, 6 Jan 2022 09:15:56 -0500

On Jan 6, 2022, at 9:02 AM, Dave Crocker <[email-masked]> wrote:
>> ou are linking to the correct draft but you’re still missing an important distinction: there’s a huge difference between an individual I-D, which is what the old signatures draft was, and an active working group document, which is what the GNAP resource servers document is. The latter is on a path to become an RFC, the former is not. Both are “labeled” as I-D, which might be the source of the confusion — and that’s why I say that the label of “internet draft” doesn’t actually mean anything on its own. It’s the state of the document within the process of the SDO that matters. This is why the current HTTP Signatures draft within the HTTP working group is considered :much: more normative than any of the old individual drafts, including the series of Cavage drafts
> 
> 
> The above clarifications have the right spirit, but I'll suggest some simplifications that might make things even easier and maybe clearer:
> 
> 1. Any and all IETF-related (draft-) Internet Drafts have no formal publication status.  None.  They are working documents and the nature of venue of the work involving them varies from none to a lot.
> 
> 2. Outside of the formalities, any individual group -- including an IETF working group -- can choose to add their own formal status, such as 'working group document', but that's an internal status for group management purposes.
> 
> 3. When an I-D has some relationship to a published document, the I-D is likely to represent more recent views, obviously.  One can choose to favor it, therefore, but that's different from its having community reviewed and approved status.
> 

Dave, thanks for the added clarifications — I was trying to simplify in my own way and hopefully didn’t mislead anyone. :) 

The core point I’m making here, using Dave’s list as a framing, is that (2) in the steps above is highly relevant to this discussion, so comparing things based solely on (1), which is how this thread started, is meaningless on its own. The process in (2) represents direction and intent. It’s just as dangerous to call an I-D "a standard" as it is to discount a stable WG draft in active development as “just another I-D”. There’s a wide gradient here applied by the status and group management in (2), and I argue that carries weight. There’s also a lot of context that isn’t formally captured, such as active development on the text itself. This is part of what the I-D expiration is meant to capture, but as we can see here, it’s highly imperfect.

 — Justin

---

From: Dave Crocker <[email-masked]>
Date: Thu, 6 Jan 2022 06:21:03 -0800

> The core point I’m making here, using Dave’s list as a framing, is that (2) in the steps above is highly relevant to this discussion, so comparing things based solely on (1), which is how this thre…

+1 (definitely)

d/

---

From: Leif Johansson <[email-masked]>
Date: Thu, 6 Jan 2022 17:04:16 +0100

Hi Mark,

> Perhaps, rather than a human rights section, there would be a human rights case study / example, to coincide with security considerations?  (A case study that is inclusive and not only the engineer…

This is a perfect illustration of my message earlier today.

The text you propose could/should be writen up as a separate I-D as a way to frame the discussion.

You and/or some of the other members of the Kantara WG should consider writing such an I-D in the
context of the GNAP protocol so that it actually informs /this/ WG.

	Cheers Leif

---

From: Mark Lizar <[email-masked]>
Date: Thu, 6 Jan 2022 16:08:12 +0000

Thank you Leif for the very valuable direction, I will add this to the ANCR WG agenda and look forward to reporting back. 

Cheers Mark

> On Jan 6, 2022, at 11:04 AM, Leif Johansson <[email-masked]> wrote:
> 
> 
> Hi Mark,
>

---

From: Leif Johansson <[email-masked]>
Date: Thu, 6 Jan 2022 18:43:50 +0100

> Thank you Leif for the very valuable direction, I will add this to the ANCR WG agenda and look forward to reporting back. 

Excellent, thx!

	Cheers Leif

---

From: Adrian Gropper <[email-masked]>
Date: Thu, 6 Jan 2022 13:41:41 -0500

Mark and Leif,

I too appreciate Mark's comments and that they were cross-posted to W3C
CCG.

Having spent close to a decade working with Kanatara on UMA, I am glad to
see Mark's intent to collaborate more deeply with GNAP.

I'm also quite invested in the W3C CCG and related work because Self
Sovereign Identity (SSI) represents a more sophisticated approach to
today's identity problems than federation.

My immediate challenge is finding implementers interested in putting human
rights ahead of short-term funding. My ability to demonstrate
decentralization at the community level (and keep federation on the side)
requires working libraries and the willingness of the coders to support the
example (HIE of One Trustee).

The Trustee demonstration benefits from most, if not all, of the features
that Mark is describing. It needs to be built with GNAP and community-owned
microservices as the core. DIDs and VCs will be an important
component because they represent SSI. Blockchains are optional in this
version of Trustee.

My point is that I'm personally not much interested in adding human rights
considerations to either W3C, IETF, or Kantara if there is no group of
implementers that are at least willing to provide support for the libraries
that can help demonstrate human rights rather than talk about it.

Please consider reposting our conversation and this comment to include W3C
CCG.

Adrian

On Thu, Jan 6, 2022 at 12:44 PM Leif Johansson <[email-masked]> wrote:

> > Thank you Leif for the very valuable direction, I will add this to the
> ANCR WG agenda and look forward to reporting back.
> >
> > Cheers Mark
>
> Excellent, thx!
>
>         Cheers Leif
>
> --
> TXAuth mailing list
> [email-masked]