Subject: Re: [hrpc] review drafts with guidelines on human rights considerations

From: "Giovane C. M. Moura" <[email-masked]>
Date: Fri, 24 Jun 2016 15:36:58 +0200

Hi,

I was having this conversation in private with Niels and Corinne, and he
asked me to maybe have this discussion on the list. So I'm forward it
here, and will answer his response in a following email.

Best,

Begin message.
From: Giovane Moura
To: Niels ten Oever, Corinne Cath
Date: Fri, 3 Jun 2016.

Dear Niels,

Thanks for reaching out.

I just went through your draft and, wow, congratulations on it, also on
its comprehensiveness and clarity.

Some feedback:

Section 1:

  * I guess it would be nice to have a phrase alerting about the values
that are implicitly embedded into a protocol.

In other words, engineers have their own set of values which they, often
without much thought, bring to their protocols, as it if was just a
given. This may have unintended/unforeseen consequences -- namely human
rights violations.

I've seen this first hand: I had to do a exercise like that for my
dissertation, by going through my school's ethics commission. In the
end, the ethicist (Aimee) and I wrote a case study paper on value
sensitivity design (VSD) and Internet security, and its consequences[1].
I was introducing bias, prejudice, unfairness with my approach, while
proving other values at the same time.

So what I mean is: engineers may unintentionally violate HR and values
while being oblivious to that, and this may be worth mentioning. I do no
know, however, how often this happens on IETF.

Relevance to the draft:

 - My draft can be found at [2], and when I tried to apply the questions
from 5.3 on it, and some of them didn't seem to apply to it.

And that's where I have another question: are those guidelines targeted
to protocols that assume a real human using it? E.g.: e-mail, chat, etc.
I.e.: protocols that are use to transmit data by anyway related to human
communications.

I am asking because our protocol is a control protocol, designed as a
SOS mechanism to be used by one server under attack (DDoS) to signal to
another servers that the attack is happening.

Therefore, it does not carry any metadata/data related to human
communication. If it is not human communication related, does it imply
that it does not violate human rights? I am not so positive on that
either...

For example: BGP is also machine to machine but if *used* poorly, can
and has been used in censorship cases (see Pakistan Youtube case[3]).

Could you please share your thoughts on this  so I can carry on here
with the analysis?

Thanks a lot,

/giovane

[1] http://doc.utwente.nl/87095/

[2]https://www.ietf.org/id/draft-francois-dots-ipv6-signal-option-00.txt

[3]
http://www.cnet.com/news/how-pakistan-knocked-youtube-offline-and-how-to-make-sure-it-never-happens-again/

> I hope this e-mail finds you well. As discussed in Berlin, Corinne and I
> worked hard to addressed all brought up issues in the
> hrpc-research-draft. You mentioned you would be interested in reviewing
> a draft your currently working on in the light of the guidelines for
> human rights considerations.
>
> I would like to kindly ask you to:
>
> 1. Take your draft
>
> 2. Read through the guidelines here:
> https://tools.ietf.org/html/draft-tenoever-hrpc-research-02#section-5.3.2
>
> 3. Make notes about your findings, especially relating the following
points:
> 	- Relevance for your draft
> 	- Changes you will make to your draft
> 	- Perhaps even a considerations paragraph that could be added to your
> draft.
>
> 4. Perhaps write a short evaluation paragraph in which you answer the
> following questions:
> 	- Was this a useful exercise
> 	- What can be improved?
> 		- Examples
> 		- Number of questions
> 		- Granularity of questions
> 		- Did going through the questionnaire feel like 'time well spent'?
> 	
> All your thoughts are very welcome.
>
> Best,
>
> Niels
>
> PS If you preper to talk about this rather than do a write up, am also
> more than happy to schedule a call with you.
>
>

---

From: "Giovane C. M. Moura" <[email-masked]>
Date: Mon, 27 Jun 2016 08:57:09 +0200

Sorry Niels, I only had a chance to look at this now.

Please find my response inline.

> Not all questions are applicable to all protocols, but do you think none
> of the questions were relevant for you?

I went through all of questions now and here is my feedback.

First, I found it to be a good exercise that, most of all, helped me to
think it through our protocol design, helping me to re-evaluate it,
working as a eye opener to some properties.

As I experienced on a previous protocols and ethics implications
exercise[1], engineers unintentionally put their "values" (in
value-sensitive design terminology) in our protocols as if they were
just a given. Your draft help me to question those.

Since our draft is about intra-networking signaling[2], some questions
were not directly relevant. I enumerate them here. While I think all the
questions are important and have a different role, they may not apply to
all drafts in a same way. So I classified them with regards our own
draft only:

   * Relevant: 5.3.2.1.(1,2,3,4,6,7,8) , 14 (it's not dependable since
it is fall-back opportunistic),16,17,19,

   * More less relevant: 12 (there was a heated discussion on the
language issue in Buenos Aires, and if I am not mistaken, one of the
conclusions was that (i) is very hard to have it in protocol design and
(ii) maybe we should start at the application layer first, since it  is
the layer that directly interact with the users) , 15 (we employ fields
and data specified by another draft by other authors)

   * Not relevant: 5 (since its machine to machine signaling), 9 10
11,13, 18, (since it does not handle end-user data),20 (same reasons),

>>> 	- Perhaps even a considerations paragraph that could be added to your

I'll have to talk to my co-authors first (I am the last author on the
draft), but one easy change is to discuss the security considerations in
the light of human rights implications.

Other comments: on 5.3.2.1.9, first sentence " .. especially section
6.1.1 ?" . The link to 6.1.1. points to the same draft, but it should be
to RFC6973 I believe.

[1] http://doc.utwente.nl/87095/
[2] https://tools.ietf.org/html/draft-francois-dots-ipv6-signal-option-00

Thanks,

/giovane

> I think infrastructure and deeper layer protocol play a large role in
> inhibiting or stimulating an enabeling envrionment for human rights.
> 
> If this is not clearly communicated in the draft, we should change that.
> 
> 
> And BGPSEC, etc, etc. Completely agree.
> 
> Hope this helps. Also feel free to have this conversation on the list, I
> think we (and others) can learn a lot from it.
> 
> Thanks so much for doing this.
> 
> Niels
> 
>> Thanks a lot,
>>
>> /giovane
>>
>>
>> [2] https://tools.ietf.org/html/draft-francois-ipv6-dots-signal-option-00
>>
>> [3]
>>> 3. Make notes about your findings, especially relating the following points: