Subject: Re: [hrpc] draft human rights considerations

From: Pranesh Prakash <[email-masked]>
Date: Thu, 3 Mar 2016 01:48:57 +0530

Dear Niels and all,

Niels ten Oever <[email-masked]> [Tue Feb 09 2016 21:28:05 GMT+0530
(IST)]:
> Dear all,
>
> I hope this email finds you well. Corinne and I added a substantial
> amount of text to the methodology draft, which we just made available
> for you here:
>

On what basis have the 'technical terms' in section 4.4 / the HRPC 
glossary been arrived at? (I'm curious, for instance, why free software 
doesn't find any mention there.)

I'm sorry I haven't been following the discussions here that very long, 
and so this may have already been discussed. If so, could someone please 
point me to the thread(s) where this has been discussed?

Further, could someone explain to me the basis for this:

    (        Anonymity       )
   (         Privacy          )   = Right to be presumed innocent
    (        Security        )

How is the right to be presumed innocent until proven otherwise linked 
to anonymity, "privacy", or "security" as defined in the HRPC glossary?

The right to be presumed innocent exists even after you've been 
identified (de-anonymised), even after information related to your is 
available to the public/prosecution (so is no longer within your power 
to control), and even after any security has been breached.

Similarly, I have a number of questions on the mapping (e.g., why 
accessibility is part of "Right to political participation" but not 
"Right to participate in cultural life, arts and science", etc.).  What 
is the best manner to have this discussion?

Thanks.

Regards,
Pranesh

-- 
Pranesh Prakash
Policy Director, Centre for Internet and Society
http://cis-india.org | tel:+91 80 40926283
sip:[email-masked] | xmpp:[email-masked]
https://twitter.com/pranesh

---

From: Avri Doria <[email-masked]>
Date: Wed, 2 Mar 2016 16:24:09 -0500

Hi,

Thanks for bringing up these questions.  You make good points I think
need to be considered in the definitions.

I think having the discussions on this list on any of the definitions is
a good idea.  This is the right place.

If there are many though, it might be good to start an email thread for
each just so it is easier to track.

thanks

avri

On 02-Mar-16 15:18, Pranesh Prakash wrote:
> glossary been arrived at? (I'm curious, for instance, why free
> software doesn't find any mention there.)
>
> I'm sorry I haven't been following the discussions here that very
> long, and so this may have already been discussed. If so, could
> someone please point me to the thread(s) where this has been discussed?
>
> "Right to participate in cultural life, arts and science", etc.). 
> What is the best manner to have this discussion?
>
> Thanks.
>
> Regards,
> Pranesh
>
>
>
> _______________________________________________
> hrpc mailing list
> [email-masked]
> https://www.irtf.org/mailman/listinfo/hrpc

---

From: Niels ten Oever <[email-masked]>
Date: Thu, 3 Mar 2016 00:00:12 +0100

Hi Pranesh,

Response inline:

> doesn't find any mention there.)

Free software is very important, but software is not necessarily part of
protocols, and that is the level for which we're developing
considerations here.

> point me to the thread(s) where this has been discussed?

Happy to discuss it here :)

> to anonymity, "privacy", or "security" as defined in the HRPC glossary?

Because anonymity, privacy and security allow for an enableing
environment for the right to be presumed innocent.

> to control), and even after any security has been breached.

True, but having privacy, anonymity and security is conducive for
excercising that right.

> is the best manner to have this discussion?

Any format is fine with me as long as it works for you!

> Thanks.

Cheers,

Niels

---

From: [email-masked]
Date: Thu, 3 Mar 2016 15:56:05 -0500

On 03/02/2016 09:18 PM, Pranesh Prakash wrote:
> to anonymity, "privacy", or "security" as defined in the HRPC glossary?=

A presumption of innocence underlies protections against unreasonable
searches and seizures which I hope connects those dots.

-- 
        -Barry Shein

Software Tool & Die    | [email-masked]             | http://www.TheWorld.com
Purveyors to the Trade | Voice: +1 617-STD-WRLD       | 800-THE-WRLD
The World: Since 1989  | A Public Information Utility | *oo*

---

From: Pranesh Prakash <[email-masked]>
Date: Fri, 4 Mar 2016 11:11:55 +0530

> searches and seizures which I hope connects those dots.

Not really.

A 'presumption of innocence' isn't a presumption applicable to all 
persons, but to accused persons during a criminal trial.

Article 11 of the UDHR states:
	(1) Everyone charged with a penal offence has the right to be presumed 
innocent until proved guilty according to law in a public trial at which 
he has had all the guarantees necessary for his defence.
	(2) No one shall be held guilty of any penal offence on account of any 
act or omission which did not constitute a penal offence, under national 
or international law, at the time when it was committed. Nor shall a 
heavier penalty be imposed than the one that was applicable at the time 
the penal offence was committed.

So, it isn't presumption of innocence that protects persons against 
unreasonable searches and seizures.

---

From: Pranesh Prakash <[email-masked]>
Date: Fri, 4 Mar 2016 11:17:38 +0530

> searches and seizures which I hope connects those dots.

The US "4th Amendment" protects against unreasonable searches and 
seizures while presumption of innocence derives from other provisions. 
Per Wikipedia: "Although the Constitution of the United States does not 
cite it explicitly, presumption of innocence is widely held to follow 
from the 5th, 6th, and 14th amendments. See also Coffin v. United States 
and In re Winship."

Given that criminal trials don't happen over networks, I'm not sure 
there can be a neat mapping of that right to network terms.

---

From: Niels ten Oever <[email-masked]>
Date: Fri, 4 Mar 2016 03:11:38 -0800

On 03/03/2016 09:41 PM, Pranesh Prakash wrote:
>     (1) Everyone charged with a penal offence has the right to be
> presumed innocent until proved guilty according to law in a public trial
> at which he has had all the guarantees necessary for his defence.
>     (2) No one shall be held guilty of any penal offence on account of
> any act or omission which did not constitute a penal offence, under
> national or international law, at the time when it was committed. Nor
> shall a heavier penalty be imposed than the one that was applicable at
> the time the penal offence was committed.
> 

I have to kindly disagree with you here Pranesh. In times of predictive
policing, mass surveillance, data retention and algorithmic decision
making I do think that the notion of presumption of innocence is not
something that is only exercised in court, but is also applicable to
policing practices.

In extension one could also easily argue that the aforementioned
technical concepts enables people to not contribute to providing
evidence against themselves.

Best,

Niels

---

From: Pranesh Prakash <[email-masked]>
Date: Fri, 4 Mar 2016 19:17:20 +0530

> something that is only exercised in court, but is also applicable to

Perhaps, if you are using "presumption of innocence" in a loose cultural 
reference: for instance, a presumption of innocence when faced with a 
trial by media.

But in terms of human rights law, presumption of innocence applies in a 
penal case.  For instance, it isn't even applicable in a tort case.

And even under American law, restrictions on "unreasonable search and 
seizure" comes under the 4th Amendment, while presumption of innocence 
is seen as part of the common law, and is part of a fair trial, which 
can in the US be traced to the 5th (privilege against bearing witness 
against oneself), 6th (speedy, public trial by impartial jury, with 
notice, etc.), and 14th (due process, applicability to states) Amendments.

> evidence against themselves.

In international human rights law, these are distinct rights.  The right 
against self-incrimination (Article 14(3)(g) of the ICCPR) is distinct 
from the right to presumption of innocence (Article 14(2) of the ICCPR), 
which is distinct from the right against unreasonable search and seizure 
(which can be likened to Article 17 of the ICCPR).

All in all, I don't see how anonymity, security, and privacy as 
technical concepts correlate with the legal concept in human rights law 
of presumption of innocence, which really has no applicability outside 
of a tribunal or courtroom.[1]

  [1]: Article 14(2): Everyone charged with a criminal offence shall 
have the right to be presumed innocent until proved guilty according to law.

---

From: Joseph Lorenzo Hall <[email-masked]>
Date: Fri, 4 Mar 2016 10:19:15 -0500

On Fri, Mar 4, 2016 at 8:47 AM, Pranesh Prakash <[email-masked]> wrote:
>
> All in all, I don't see how anonymity, security, and privacy as technical
> concepts correlate with the legal concept in human rights law of presumption
> of innocence, which really has no applicability outside of a tribunal or
> courtroom.[1]

I feel similarly... I suspect the genre of clustering terms and
associating them with a tenant or human right a la:

(   technical concept 1   )
(   technical concept 2   ) = human rights, values or interests
(   ...   )

may be causing problems with some of the more subtle forms of human
rights? That is, I can read a lot of relationships into that kind of
thing, but I don't think that's what is intended in the document.

We're hoping to have more capacity very soon to participate more
actively in HRPC, so we'll try to make concrete suggestions.

best, Joe

-- 
Joseph Lorenzo Hall
Chief Technologist, Center for Democracy & Technology [https://www.cdt.org]
e: [email-masked], p: 202.407.8825, pgp: https://josephhall.org/gpg-key
Fingerprint: 3CA2 8D7B 9F6D DBD3 4B10  1607 5F86 6987 40A9 A871

CDT's annual dinner, Tech Prom, is April 6, 2016! https://cdt.org/annual-dinner

---

From: [email-masked]
Date: Sat, 5 Mar 2016 17:03:25 -0500

The Scalia et al dissent beginning on page 33 of this SCOTUS decision
does a pretty good job of connecting the dots between "presumption of
innocence", "reasonable cause", and 4th amendment protections.

  http://www.supremecourt.gov/opinions/12pdf/12-207_d18e.pdf

The Exclusionary Rule also provides a bridge between the concepts by
making evidence not obtained via reasonable cause etc inadmissible.

  https://en.wikipedia.org/wiki/Exclusionary_rule

But ultimately this is a question, particularly in terms of
international law, better answered by someone more versed in these
matters than I am.

On March 4, 2016 at 11:11 [email-masked] (Pranesh Prakash) wrote:
 > x[DELETED ATTACHMENT signature.asc, application/pgp-signature]

-- 
        -Barry Shein

---

From: Nick Doty <[email-masked]>
Date: Tue, 8 Mar 2016 19:04:51 -0800

Hi all,

Apologies that I haven't been following this thread as closely as I would have liked. I've read over the -04 methodology draft and include comments below. Some of these may be duplicates of others in this thread that I haven't seen, but maybe that's still useful in identifying what another reader finds as standing out.

Hope this helps,
Nick

1. Introduction

I like the references and framing in this section very much. Recognizing the importance of security and privacy, as this section does, would it make sense to also cite RFC 3552, which provided guidance on writing a security considerations section? That seems analogous to the RFC 6973.

Similarly, should we be citing Morris & Davidson's I-D on public policy considerations as prior work somewhere?
	https://tools.ietf.org/html/draft-morris-policy-considerations-00
"Public Policy Considerations for Internet Design Decisions" is a precursor to 6973, but I would also expect to use it as a guide for finding questions for issue spotting on other topics, including accessibility and free expression.

2. Research Topic

Freedom of Expression and Freedom of Association are certainly broad and important human rights, but do we have a clear justification for limiting this research work to these particular freedoms? (I imagine this has already been discussed, and feel free to just point me to previous discussion on this topic.)

As a particular matter, I would expect accessibility, fairness / freedom from discrimination, and protections against harassment and reputational harms to be values likely to be heavily affected by the design of Internet and Web standards. I think those are present in some form in Articles 12 and perhaps 27 of the UN declaration. Later sections of the document (4.4, e.g.) also refer to many such rights beyond FoE and FoA (non-discrimination, political participation, participating in cultural life, equal protection, etc.).

3. Methodology

Regarding methodology, is it useful to provide academic support for particular methodological choices? That is, in my academic work, I'm trying to distinguish the quantitative vs. qualitative methods and why each is appropriate for different research goals.

4.6.8

I'm diving less into each of the use cases right now (I know there are separate threads on several of them), but I just wanted to note that I'm really glad that Middleboxes is included in this list. At the IETF meetings I've been able to attend recently, that's been a consistently important topic and an apparent location of tussle. (Speaking of which, I wonder if that Dave Clark "Tussle" paper should be cited here or in a related document.)

4.7.2

I like the questionnaire as a model, at least a starting one, for a tool that enables issue spotting by specification authors. That's something we've used to at least some positive effect in both IETF and W3C, specifically around privacy.

That said, I wonder if we can develop some best practices in the design of these questionnaires. One common issue we hear, at least anecdotally, is that if a question is framed as "does your protocol do [bad thing X]?", then the specification author filling out the questionnaire is incentivized to find the answer to be "no".  For example,

> Does your protocol make censorship easier by exposing specific
> identifiers that could be sensitive for filtering?

Might work better as:
> Does this protocol introduce new identifiers that might be associated with persons or content?

Followed by some explanatory text:
> Identifiers of content exposed within a protocol might be used to facilitate censorship, as in the case of HTTP in this particular scenario [...].

Anyway, I recognize that this questionnaire is a placeholder for the time being, but I just wanted us to start thinking about that. I've also been getting the feedback that examples are particularly useful for specification authors. That point has been discussed regarding W3C TAG's Security and Privacy Questionnaire and the Fingerprinting Guidance document I've been working on:

https://www.w3.org/2001/tag/2015/12/security-questionnaire.html
https://www.w3.org/TR/2015/NOTE-fingerprinting-guidance-20151124/

> On Feb 9, 2016, at 7:58 AM, Niels ten Oever <[email-masked]> wrote:
> 
> Signed PGP part
> Dear all,
> 
> https://www.ietf.org/id/draft-varon-hrpc-methodology-04.txt
> 
> Most additions are a first stab at actual human rights considerations,
> modeled after RFC6973. I pasted this specific part also underneath for
> your convenience and consideration. There are also some small
> additions to the middlebox text as well as other nits than can be
> found directly in the draft (and in the diff
> https://tools.ietf.org/rfcdiff?url2=draft-varon-hrpc-methodology-04.txt
> ).
> 
> Looking forward to the discussion, as well as questions and comments.
> 
> Best,
> 
> Niels

---

From: Corinne Cath <[email-masked]>
Date: Thu, 17 Mar 2016 13:35:17 +0000

Hi Nick,

Thank you for your email! Very helpful indeed, comments in-line.

Best, Corinne

On Wed, Mar 9, 2016 at 3:04 AM, Nick Doty <[email-masked]>
wrote:

> Hi all,
>
> Apologies that I haven't been following this thread as closely as I would
> have liked. I've read over the -04 methodology draft and include comments
> below. Some of these may be duplicates of others in this thread that I
> haven't seen, but maybe that's still useful in identifying what another
> reader finds as standing out.
>
> Hope this helps,
> Nick
>
>
> 1. Introduction
>
> I like the references and framing in this section very much. Recognizing
> the importance of security and privacy, as this section does, would it make
> sense to also cite RFC 3552, which provided guidance on writing a security
> considerations section? That seems analogous to the RFC 6973.
>
>
​We added RFC 3552 and are still trying to work out how (and where) to
integrate the work of Morris and Davidson, any advice would be much
appreciated.

​

> "Public Policy Considerations for Internet Design Decisions" is a
> precursor to 6973, but I would also expect to use it as a guide for finding
> questions for issue spotting on other topics, including accessibility and
> free expression.
>
> 2. Research Topic
>
> Freedom of Expression and Freedom of Association are certainly broad and
> important human rights, but do we have a clear justification for limiting
> this research work to these particular freedoms? (I imagine this has
> already been discussed, and feel free to just point me to previous
> discussion on this topic.)
>

​Initially the work focused strongly on FoE and FoA, but after taking the
initial research steps and receiving elaborate feedback on the mailinglist
we decided to position the research wider to include multiple rights with a
strong digital component​
​. This is partially due to the specific characteristics of human rights as
being universal, interrelated and interdependent therefor it seemed
artificial and incorrect to single out two specific rights, so we included
all the rights we thought might be affected. This does not necessarily mean
this list of rights impacted is exhaustive. ​

>
> As a particular matter, I would expect accessibility, fairness / freedom
> from discrimination, and protections against harassment and reputational
> harms to be values likely to be heavily affected by the design of Internet
> and Web standards. I think those are present in some form in Articles 12
> and perhaps 27 of the UN declaration. Later sections of the document (4.4,
> e.g.) also refer to many such rights beyond FoE and FoA
> (non-discrimination, political participation, participating in cultural
> life, equal protection, etc.).
>

​See above​.

> 3. Methodology
>
> Regarding methodology, is it useful to provide academic support for
> particular methodological choices? That is, in my academic work, I'm trying
> to distinguish the quantitative vs. qualitative methods and why each is
> appropriate for different research goals.
>
>
​We added a more elaborate explanation of the different methodological
decisions made, and provided all the academic references and literature.
​

> 4.6.8
>
> I'm diving less into each of the use cases right now (I know there are
> separate threads on several of them), but I just wanted to note that I'm
> really glad that Middleboxes is included in this list. At the IETF meetings
> I've been able to attend recently, that's been a consistently important
> topic and an apparent location of tussle. (Speaking of which, I wonder if
> that Dave Clark "Tussle" paper should be cited here or in a related
> document.)
>
​
Thanks for the support on middleboxes. We mention Clark's  tussle paper in
the literature and discussion review.

>
> 4.7.2
>
> I like the questionnaire as a model, at least a starting one, for a tool
> that enables issue spotting by specification authors. That's something
> we've used to at least some positive effect in both IETF and W3C,
> specifically around privacy.
>
> That said, I wonder if we can develop some best practices in the design of
> these questionnaires. One common issue we hear, at least anecdotally, is
> that if a question is framed as "does your protocol do [bad thing X]?",
> then the specification author filling out the questionnaire is incentivized
> to find the answer to be "no".  For example,
>
> Identifiers of content exposed within a protocol might be used to
> facilitate censorship, as in the case of HTTP in this particular scenario
> [...].
>
>
>
​+1
​

> Anyway, I recognize that this questionnaire is a placeholder for the time
> being, but I just wanted us to start thinking about that. I've also been
> getting the feedback that examples are particularly useful for
> specification authors. That point has been discussed regarding W3C TAG's
> Security and Privacy Questionnaire and the Fingerprinting Guidance document
> I've been working on:
>

​Great suggestion, the example is very good. We integrated it into the new
draft. We are thinking about a way that we can standardize this ​and apply
and incorporate it into the next version.

​Below you will find the links to the new draft and the git for pull
requests.

https://www.ietf.org/id/draft-tenoever-hrpc-research-00.txt​

https://github.com/nllz/IRTF-HRPC/blob/master/draft-research.md

​Best,

Corinne ​

-- 

'The management of normality is hard work'

---

From: Niels ten Oever <[email-masked]>
Date: Thu, 31 Mar 2016 13:18:32 +0200

Hi all,

I have been pondering on this topic for quite a bit am I think Pranesh i
actually right. The description being presumed innocent in the Universal
Declaration of Human Rights (UDHR) as well as other documents strictly
refer to the court of law.

Eventhough in a common sense understanding I think we could fit this
under it, I think we should not let ourselves be tempted to do so, since
it might undermine the credibility of the argument as a whole.

It also helps that the importance of security, privacy and anonymity are
covered under freedom of expression, non-discrimination, equal
protection, and freedom of assembly and the right to security.

So as per the suggestion of Pranesh I have removed the 'right to be
presumed innocent' from the document, as can be seen here:

Other suggestions and comments are of course more than welcome.

Best,

Niels

Niels ten Oever
Head of Digital

Article 19
www.article19.org

PGP fingerprint    8D9F C567 BEE4 A431 56C4
                   678B 08B5 A0F2 636D 68E9