Subject: Re: [hrpc] draft-tenoever-hrpc-research-02

From: Joseph Lorenzo Hall <[email-masked]>
Date: Tue, 7 Jun 2016 07:20:26 -0400

Are there good examples of a protocol evening effective remedy

On Friday, May 27, 2016, John Curran <[email-masked]> wrote:

> On May 27, 2016, at 10:04 AM, Niels ten Oever <[email-masked]
> <javascript:_e(%7B%7D,'cvml',[email-masked]');>> wrote:
>
>
> Hi John,
>
> Are you referring to:
>
> Article 8
> Everyone has the right to an effective remedy by the competent national
> tribunals for acts violating the fundamental rights granted him by the
> constitution or by law.
>
>
> Yes.
>
> If so, does this mean that your question could be reformulated as:
> 'Have you already resolved the Internet and jurisidition problem?’
>
>
> No, that is not a correct reformulation of my question.
>
> There are already existing processes in the real world for pursuit of
> legal
> remedies between jurisdictions (e.g. MLAT)…   They may (or may not)
> work very well, but either way that’s not our job to resolve.
>
> My question is far simpler:
>
>     What are the technical concepts that need to be considered in
>     Internet protocol development so that the basic human right of
>     ‘effective remedy’ for violation of their rights can be provided?
>
> When someone is the victim of ransomware, it is quite likely that there is
> not going to be a happy outcome to the story.  There are many reasons
> for this, including the fact that our law enforcement cooperation processes
> were developed decades ago, and presume a very small amount of trans-
> border criminal activity - as such, they operate in weeks/months and lack
> any potential for operating at Internet speed.
>
> However, the fact that law enforcement has very limited ability to pursue
> remedy in cyberspace doesn’t necessary equate to valid reasoning for
> precluding meaningful engagement of law enforcement when an innocent
> party is robbed via the Internet.  The IETF is quite capable of designing
> protocols that make it effectively impossible to pursue effective remedy,
> and if it does so, then it is actually inhibiting exercise of basic human
> rights.
>
> (There is actually some merit in proactively taking a stand that the human
> right of effective remedy simply cannot be satisfied on the Internet, i.e.
> that the costs and implications for providing for such are too great.  If
> that
> is the case, then it is a fairly important IETF determination for protocol
> developers to be aware of…)
>
> If this is the case, my answer would be: we're working with human rights
> because this is the most universal standard that we've got, exactly to
> not go down the rabbit hole of different situations in different
> jurisdictions.
>
>
> There is no reason to consider different jurisdictions, nor is that our
> job.
> However, whether IETF protocols facilitate or obscure information needed
> in the determination of the relevant jurisdiction(s) and thus support the
> human right of effective remedy/due process is definitely a valid question.
>
> This is simply the question of whether someone’s basic right to be able to
> initiating legal recourse is or is not not pre-empted via IETF design
> decisions
> made during protocol development.  You may perhaps consider that out of
> scope for your initial effort (i.e. left for future work or simply a human
> right
> not to be protected on the Internet) but then there should be included
> some
> form of statement to that effect.
>
> There has been extensive work in mapping UN Declaration of Human
> Rights to the online context, and this includes recent efforts (including
> the Dynamic Coalition on human rights meeting at IGF) let to a nice
> statement on same - “The Charter of human rights and principles for
> the internet” - <http://internetrightsandprinciples.org/site/>   It might
> be worth looking at this document, as it already has similar mappings
> of the various human rights into the online context and made provide
> an additional basis for this effort.
>
> Thanks!
> /John
>
>
>
>
>

-- 
Joseph Lorenzo Hall
Chief Technologist, Center for Democracy & Technology [https://www.cdt.org]
1401 K ST NW STE 200, Washington DC 20005-3497
e: [email-masked], p: 202.407.8825, pgp: https://josephhall.org/gpg-key
Fingerprint: 3CA2 8D7B 9F6D DBD3 4B10  1607 5F86 6987 40A9 A871

---

From: Joseph Lorenzo Hall <[email-masked]>
Date: Tue, 7 Jun 2016 07:23:40 -0400

Apologies, hit send too quickly. I'm wondering if there is any good example
of a protocol enabling effective HR violation remedy. The only thing I can
think of would be proposals to tag flows or origins with some identifier
for use in levying complaints. That seems to compromise other important
human rights that seem more foundational than remedy.

On Tuesday, June 7, 2016, Joseph Lorenzo Hall <[email-masked]> wrote:

> On Friday, May 27, 2016, John Curran <[email-masked]
> <javascript:_e(%7B%7D,'cvml',[email-masked]');>> wrote:
>
>> On May 27, 2016, at 10:04 AM, Niels ten Oever <[email-masked]>
>> wrote:
>>
>>
>> Hi John,
>>
>> Are you referring to:
>>
>> Article 8
>> scope for your initial effort (i.e. left for future work or simply a
>> human right
> e: [email-masked] <javascript:_e(%7B%7D,'cvml',[email-masked]');>, p:
> 202.407.8825, pgp: https://josephhall.org/gpg-key

---

From: John Curran <[email-masked]>
Date: Tue, 7 Jun 2016 08:16:10 -0400

On Jun 7, 2016, at 7:23 AM, Joseph Lorenzo Hall <[email-masked]> wrote:
> 
> Apologies, hit send too quickly. I'm wondering if there is any good example of a protocol enabling effective HR violation remedy. The only thing I can think of would be proposals to tag flows or origins with some identifier for use in levying complaints. That seems to compromise other important human rights that seem more foundational than remedy.

Joseph - 
 
  It’s an excellent question.   The challenge presently is that when someone’s
  security is violated in the real world, they tend to go to law enforcement for
  redress, and conveniently, the real world has excellent hierarchical scaling
  properties – i.e. harm to home or person often happens the local jurisdiction,
  less often in another jurisdiction but within the same national border, and 
  much less often involving a trans-nationstate situation.  The various law
  enforcement mechanisms and agreements (e.g. MLAT) are presently built
  and rely upon this property.

  In cyberspace, we have (and benefit from!) a nearly flat arrangement, whereby 
  another entity you’re interacting is actually likely to be outside the local jurisdiction,
  and easily could be in another nationstate.  Presently, attempts to seek redress
  via law enforcement for violations of your right to security are extremely difficult to 
  pursue, as it is often not clear what jurisdiction the involved parties are located in…
  (For an excellent overview of what this looks like to law enforcement, I’d highly
  recommend a watching a recent presentation given by Gregory Mounier of the 
  European Cybercrime Centre(EC3) at RIPE72 - https://ripe72.ripe.net/archives/video/201/ <https://ripe72.ripe.net/archives/video/201/>
  The challenge that LEA faces starts with determining location of the actors and thus
  jurisdiction, since it is quite possible that one party’s offense is not actually a crime
  for another.  Providing for such information has huge implications for privacy, yet
  not providing for such makes having any lawful remedy next to impossible (and in
  some cases, may cause particularly recalcitrant government actors to use “other
  means” to try and obtain the same...) 

  When we talk about protocol considerations for human rights, one cannot look at
  the rights individually, but as collective set since the considerations and resulting
  recommendations for one might easily preclude support for another.  There is 
  nothing wrong with the IETF taking a particular stance over what set of human 
  rights considerations it considers to be the most appropriate “balance’ for the global
  Internet, but it should do so consciously with the awareness that it is indeed trading 
  off on different public policy considerations; i.e. not its traditional area of work.

/John

Disclaimer: my views alone (& FYI: jurisdiction=USA)

---

From: Stephen Farrell <[email-masked]>
Date: Tue, 7 Jun 2016 14:48:57 +0100

Hiya,

>   means” to try and obtain the same...) 

Yes, jurisdiction is IMO the key problem that needs solving. I don't
however think that solving that problem involves the IETF much.

While the Internet has hugely increased the number of, and importance
of, events for which it's hard to identify who has jurisdiction, I
think the solutions for that can only be worked out by governments.

And while many governments might initially take a stance that their
own laws cover the entire Internet, I can't see that lasting too long
(i.e. maybe a decade or two) and eventually most governments will have
to figure out ways in which they somehow share jurisdiction in some
sense. (I've no clue how they might do that myself though.)

All that the technical community, of which the IRTF/IETF is a part,
can do as part of that is explain the real complexities involved,
which of course change a lot as we innovate and e.g. do better with
protecting security and privacy in ways that partly conflict with
what LEA see as requirements they need to meet within their specific
jurisdictions. It's a very non-trivial problem.

> Disclaimer: my views alone (& FYI: jurisdiction=USA)

How do you know that last bit? I read your mail in .ie and had it
been defamatory I might have decided to sue you in .uk :-)

S.

> 
> 
> 
> 
> 
> 
> _______________________________________________
> hrpc mailing list
> [email-masked]
> https://www.irtf.org/mailman/listinfo/hrpc
>

---

From: John Curran <[email-masked]>
Date: Tue, 7 Jun 2016 10:18:14 -0400

> think the solutions for that can only be worked out by governments.

I’m sorry - I was imprecise…  I did not mean to imply that jurisdiction in
cyberspace is a problem that IETF needs to solve; only that the IETF
needs to be consciously aware that the protocol considerations that it
does decide to undertake can have a direct impact on the ability for
governments to support other human rights, such as due process and
redress for violation of personal security.

> sense. (I've no clue how they might do that myself though.)

That certainly is a possible outcome, and the IETF can decide to prioritize
human rights considerations in protocols so that such an outcome is the
only technically feasible way forward…  selecting such an approach, rather
than including other human rights as considerations for Internet protocols
is effectively a public policy decision.   Governments are generally very
poorly equipped to describe their technical requirements - they are not
Internet protocol engineers (and thus tend to miss the mark when they
even attempt such (e.g. key escrow/expectational access)   The IETF is
under no obligation to consider their requirements when setting technical
considerations to support human rights, but if it only supports a subset of
human rights in such considerations, then it is making a clear statement
about how the tradeoff between various human rights should be balanced
on the Internet.

> jurisdictions. It's a very non-trivial problem.

Not the only thing - explaining the complexities involved is certainly one
option, another is outreach so that there is a better understanding their
technical requirements is another, actively incorporating those requirements
into Internet protocol design is yet another.   There is no right approach,
but please don’t whine when governments decide on other mechanisms,
if you choose a low-engagement approach.

The IETF should not feel at all constrained in its path forward, but I do
not believe that it should establish technical considerations for Internet
protocols support of human rights without being clear about the impact
those considerations have on human rights, i.e. it is only a subset of
human rights that the IETF has considered, and is this scoping the
result of some determination of precedence of human rights on the
Internet or simply due to lack of work on the "real complexities involved”,
or other…

> been defamatory I might have decided to sue you in .uk :-)

Exactly my point - knowing that I am in the USA, you could very quickly
engage LEA and find out your chances of lawful redress (and they would
explain the various jurisdictional dynamics that apply…)   Absent such
information, you literally have no meaningful process for lawful recourse.

Thanks,
/John

Disclaimer:  my views alone.

---

From: Niels ten Oever <[email-masked]>
Date: Tue, 7 Jun 2016 16:29:25 +0200

On 06/07/2016 04:18 PM, John Curran wrote:
> On Jun 7, 2016, at 9:48 AM, Stephen Farrell <[email-masked]
> <mailto:[email-masked]>> wrote:
>>

What we have done in the draft is map what technical protocol
considerations have an impact on excercising human rights.

That LEAs _might_ have problems conducting investigations is imho not a
problem on the protocol level, nor is it one that has been communicated
by LEAs.

> about how the tradeoff between various human rights should be balanced

I would disagree here. Because the IETF cannot be tasked to analyze the
capacities and needs of LEAs.

> Internet or simply due to lack of work on the "real complexities involved”,

I think the issue of LEAs can only be solved if they come out with clear
needs, and AFAIK, the general trend is that there is a strong support
for strong encryption (for instance:
http://arstechnica.com/tech-policy/2016/01/dutch-government-encryption-good-backdoors-bad/
).

But if there are other protocol considerations I think we should include
them.

The jurisdiction problem is an issue that should be dealt with on
another layer and imho we shouldn't try to find a solution in the IRTF
or IETF.

Best,

Niels

---

From: John Curran <[email-masked]>
Date: Tue, 7 Jun 2016 10:39:01 -0400

> considerations have an impact on excercising human rights.

Did you include the technical protocol considerations that impact the human
right to an effective remedy (UNDHR Article 8)?   If not, why not?

> capacities and needs of LEAs.

The IETF is capable of deciding the technical considerations (for Internet protocols)
that are applicable to certain human rights but the technical considerations that are
applicable for other human rights such as due process?

Please explain why that is the case?  Does the IETF lack the expertise, or has it
excluded these human rights in order to simplify the problem space, or is it some
other reason?

Only considering a subset of human rights is a fairly important decision, and
definitely should be documented, whatever the reason.

Thanks,
/John

Disclaimers: my views alone.

---

From: Niels ten Oever <[email-masked]>
Date: Tue, 7 Jun 2016 17:00:27 +0200

> right to an effective remedy (UNDHR Article 8)?   If not, why not?

We reviewed it and could not come up with technical considerations. If
you can provide some (perhaps following the used methodology could
help), I'd be more than happy to include it.

> applicable for other human rights such as due process?

Where it comes to the technical layer, not outside. This work should not
broaden the scope of the IETF imho.

> definitely should be documented, whatever the reason.

I think the document is pretty clear on how we selected relevant rights,
but we could of course have overlooked something. Happy to discuss.

Best,

Niels

---

From: John Curran <[email-masked]>
Date: Tue, 7 Jun 2016 11:49:18 -0400

On Jun 7, 2016, at 11:00 AM, Niels ten Oever <[email-masked]> wrote:
> ...

> but we could of course have overlooked something. Happy to discuss.

The mapping is not as clear as it might be - have you considered using
the "Charter of Human Rights and Principles for the Internet” from the IGF
<http://internetrightsandprinciples.org/site/wp-content/uploads/2015/01/IRPC_english_4thedition.pdf>)
as possible basis for structuring the mapping, as it already has done the
application of human rights to Internet, and thus it only requires doing the
protocol considerations to support those principles (a single mapping step),
rather than doing a two-step mapping (human rights->human rights on the
Internet, then human rights on the Internet -> protocol considerations to
support human rights on the Internet) all at the same time.

I believe that there serious technical considerations if you want to support
effective remedy/due process for violations of personal security that occur
on the Internet, and would recommend that the group either deem those
human rights to be unachievable in light of the technical considerations
of the other human rights, or left for future consideration (depending on
the groups preference.)

/John

---

From: Niels ten Oever <[email-masked]>
Date: Tue, 7 Jun 2016 17:55:56 +0200

> support human rights on the Internet) all at the same time.

I am very familiar with the IRP. The problem with the IRP is that it has
never been ratified or accepted by any intergovernmental body and one
could debate it's interpretation, and it doesn't provide a very
elaborate legal or scientific analysis or justification. Next to that
they are no solely looking at protocols, which also makes the issue
quite hard, because then you need to seperate again. That's why we went
back to the original treaties themselves.

> on the Internet, 

Could you draw some considerations or cases in the light of the protect
/ respect framework?Effective remedy is the role of the state, not
non-state actors.

> and would recommend that the group either deem those

---

From: John Curran <[email-masked]>
Date: Tue, 7 Jun 2016 12:28:26 -0400

> / respect framework?Effective remedy is the role of the state, not

Sorry, private actors (and that includes the IETF and businesses that use
its protocols) also have the responsibility under the guiding principles of
that framework to conduct due diligence to "identify, prevent, mitigate
and account" for how their activities adversely affect human rights.  This
makes it particularly important that the IETF be clear when it chooses to
do so.

/John

---

From: Niels ten Oever <[email-masked]>
Date: Tue, 7 Jun 2016 18:36:36 +0200

On 06/07/2016 06:28 PM, John Curran wrote:
> On Jun 7, 2016, at 11:55 AM, Niels ten Oever <[email-masked]
> <mailto:[email-masked]>> wrote:
>> ...

It could potentially be an indirect issue for which the LEAs would need
to seek remedy, not the IETF. Because the stronger obligation is with
the LEA's and the courts.

---

From: Joseph Lorenzo Hall <[email-masked]>
Date: Tue, 7 Jun 2016 17:10:33 -0400

> of the other human rights, or left for future consideration (depending on

Heya, I can't claim that I speak for the RG (or anyone but myself!)
but I think at this point you'll have to show us how protocols could
support those rights. That is, we've discussed this thoroughly and I
think the point you make here (and that Eliot made in another thread
with no responses, sorry Eliot!) is that by narrowing initial
consideration to a subset of rights there are certain risks to this
approach. When this RG was chartered I believe one of the concerns was
a "boil the ocean" concern that required us to focus on some of the
more tractable human rights principles that clearly map on to protocol
considerations. I don't think any of us thinks that once we're done
with free expression and free assembly that we're done.

If there is work the RG should be doing to address your concerns and
you can show us even a sketch of what that would be, I think this
would be a more productive conversation.

best, Joe

---

From: John Curran <[email-masked]>
Date: Tue, 7 Jun 2016 19:47:06 -0400

> would be a more productive conversation.

Protocols that provided _general_ information about the jurisdiction of the 
communicating entities would be enormously helpful to LEA in providing 
for lawful remedy/due process when folks had their personal security 
violated via the Internet.  

However, I believe that such work goes well beyond what is contemplated
by the RG charter, and would thus recommend simply focusing on how 
standards and protocols can enable, strengthen or threaten just a more
limited set of human rights, e.g. rights of freedom of expression and the 
right to freedom of assembly.  It’s still a worthwhile exercise, so long as the 
document is clear that it does not "produce a comprehensive analysis that 
can serve as the basis for discussion to whether the protocol adequately 
protects against human rights threats”, but instead characterized as a guide
for for assessing protection for specific human rights.  The job of assessing
protocol implications in a comprehensive manner for all human rights requires 
inclusion of either the technical considerations applicable to rights such as 
security of person and effective remedy for violations of same, or reference 
to some form of public policy norm or standard that suggests that such 
human rights aren’t applicable in an Internet context. 

/John

Disclaimer:  my views alone - this message queued two hours under self-
                    imposed rate limiting.

---

From: Eliot Lear <[email-masked]>
Date: Wed, 8 Jun 2016 10:43:05 +0200

Good morning, Joe.

> with free expression and free assembly that we're done.

Taking into account the choices of numerous societies as to how all
rights are balanced would indeed be a daunting task.  Fortunately that
is not my request.  While it is true that the charter of this group
focuses on two specific rights, it would nevertheless be inadvisable to
simply ignore their interplay with the others.  To do otherwise will
lead to a lopsided result that does not reflect the complexities of
reality, and would be better described as advocacy rather than research. 

draft-tenoever-hprc-research-02 does indeed recognize the quandary in
the literature review (Section 4).  Section 5 itself recognizes the
right to security.  But that, it seems, is where it ends.  Section 5.3.2
in particular could do with exploring that tension, which would in turn
lead us perhaps to some additional insights in some cases.  For
instance, had we had it to do again, if someone brought a lawful
intercept MIB proposal to the IETF, would the answer once again be RFC
2804 or would it be a standard with strong implementation advice?

An editorial aside: I would suggest  that the authors unbury Section
5.3.2 and make it a separate section, since it is a major change of
topic, an a specific intended output.  It may even be worth its own
document.

Eliot

---

From: Niels ten Oever <[email-masked]>
Date: Wed, 8 Jun 2016 13:11:33 +0200

> 2804 or would it be a standard with strong implementation advice?

Isn't this concretely discussed in the last paragraph of 5.3.1 as well?

> topic, an a specific intended output.  It may even be worth its own

My personal preference would be to keep this all together for now, since
if we want to operationalize this, it should move outside of the IRTF
anyhow. Section 5.3.2 is a logical conclusion of the research that is
documented in the other parts of the draft and I think it would benefit
from becoming an RFC together.

Cheers,

Niels

---

From: Eliot Lear <[email-masked]>
Date: Wed, 8 Jun 2016 13:15:50 +0200

Hi Niels,

> Isn't this concretely discussed in the last paragraph of 5.3.1 as well?

Well indeed.  And I have thus heeded your plea in that paragraph ;-)

> from becoming an RFC together.
As you wish.  It was an editorial comment.

Eliot

---

From: Niels ten Oever <[email-masked]>
Date: Wed, 8 Jun 2016 13:18:27 +0200

Niels ten Oever
Head of Digital

Article 19
www.article19.org

PGP fingerprint    8D9F C567 BEE4 A431 56C4
                   678B 08B5 A0F2 636D 68E9

> human rights aren’t applicable in an Internet context. 

I think this discussion is getting a bit repetetive. The RG has went
beyond FoE and FoA in the draft, and right to security has been
addressed (5.2.2, 5.3.2). I've also argued here why we did not address
'effective remedy' (because it's an obligation of the state, not of IETF
or protocols, so it cannot directly be impacted by IETF or protocols),
and Stephen and Joe have asked for a concrete case or example that we
thusfar did not get.

So I think we're getting close to an 'agree to disagree'.

Best,

Niels

---

From: John Curran <[email-masked]>
Date: Wed, 8 Jun 2016 09:27:45 -0400

> or protocols, so it cannot directly be impacted by IETF or protocols),

“thus is cannot be directly impacted by IETF or protocols”

I’m sorry to be pedantic, but the ability of the state to have the information
necessary to provide effective remedy _most certainly can be impacted_
by Internet protocol development.

Case in point - we have evolved an Internet mail architecture which provides
for unauthenticated submission of electronic mail.  While changes have been
made over time to provide the option for authentication at submission, the
very existence of the basic capability to submit without authentication has a
huge impact in the ability of states to address electronic email abuse.

> and Stephen and Joe have asked for a concrete case or example that we

See above.   There’s nothing states can do in this regard unless the basic
protocol framework were to be changed within the IETF, thus leaving them
either without ability to provide meaningful recourse or having to go outside
this community and use their lawmaking/regulator ability.   Given the near
ubiquitous nature of Internet protocols and inability to work within the IETF
to get their requirements considered, they would be without fault in doing so.

> So I think we're getting close to an 'agree to disagree'.

Disavowing any responsibility to consider human rights implications of IETF
Internet protocols simply because the obligation for some human rights lies
with the states is a very dangerous course of action - effectively, you discount
the states needs as valid requirements and thus all but compels them to use
multi-lateral methods to address those needs.

Yes, I do believe I’ll need to agree to disagree on this one, as it takes the IETF
down a path contrary to the multistakeholder approach to problem solving.

Best wishes,
/John

---

From: Niels ten Oever <[email-masked]>
Date: Wed, 8 Jun 2016 15:42:40 +0200

On 06/08/2016 03:27 PM, John Curran wrote:
> On Jun 8, 2016, at 7:18 AM, Niels ten Oever <[email-masked]

Could you be a bit more specific about the electronic email abuse and
which specific human rights are violated through this and how remedy
could not be sought? A reference to the specific protocol and case would
also be great so that, if we agree, we can make this a case in the
document.

> multi-lateral methods to address those needs. 

That is a wrong representation of what I said. I only said we should not
guess what the requirements of states are to fulfill their human rights
obligations.

> down a path contrary to the multistakeholder approach to problem solving. 

I think this is exactly the multistakeholder way: recognizing there are
different roles and responsibilities for different stakeholders.

And of course (representatives of) states can join the standards
process, and several have done so in the past. The last four IETF
meetings I did presentations for the ISOC policy fellows, which are
mostly governments representatives, and they did not make the point you
are making, actually quite the opposite.

Best,

Niels

---

From: avri doria <[email-masked]>
Date: Wed, 8 Jun 2016 15:38:12 -0400

Hi,

I think this has been, and continues to be, an interesting discussion
and will try  to capture it in a revision of draft-doria-hrpc-report.

As Joe said we did start with  a specific constraint in the work, but I
have heard the call to look at it in the larger HR context several times
in the group.  While I agree that the research draft should remain
focused on FoE and FoA, I think including text indicating that
restricted perspective, is an appropriate addition to the draft.

On the other hand i think these are important issues to work on and to
explore as to whether they are susceptible to reasonable analysis,
similar to what that we are doing on the first more  limited set.

avri

---

From: John Curran <[email-masked]>
Date: Wed, 8 Jun 2016 16:30:50 -0400

> also be great so that, if we agree, we can make this a case in the

Niels -

    I’m sorry - you have stated that human rights that are obligations of the
    states cannot be directly impact by IETF or its protocols, and are now
    proceeding to define a comprehensive guide for assessing human
    rights impacts of protocols based on this assumption.

    As I fundamentally disagree with the premise that "human rights that are
    obligations of the states cannot be directly impact by IETF or protocols”,
    I’ve recused myself from your RG work effort so as to not hinder your
    progress.

    (It is really not productive to elaborate on protocol impacts to the human
    right of effective remedy when you have already determined that human
    rights obligations of the states, like effective remedy, can’t possibly be
    impacted by IETF or its protocol efforts.)

Thanks,
/John

Disclaimers: my views alone

---

From: Niels ten Oever <[email-masked]>
Date: Wed, 8 Jun 2016 22:53:29 +0200

On 06/08/2016 10:30 PM, John Curran wrote:
> On Jun 8, 2016, at 9:42 AM, Niels ten Oever <[email-masked]
>>> <mailto:[email-masked]>

Hi John,

>     obligations of the states cannot be directly impact by IETF or

I never said that human rights are solely obligations by states. States
have a role to protect human rights, non-state actors should respect
human rights. Those are different roles that come with different
responsibilities.

>     I’ve recused myself from your RG work effort so as to not hinder your 

I never felt like you hindered the process, having disussions and asking
critical and difficult questions is part of research.

>     impacted by IETF or its protocol efforts.)

As said several times (by me and others), if you give us a concrete case
to chew on I would be more than happy to work it out and see where we
might end up. We did the same with other protocols and issues (for
instance DDoS and the right to assembly and association).

Best,

Niels

---

From: John Curran <[email-masked]>
Date: Wed, 8 Jun 2016 17:27:23 -0400

> instance DDoS and the right to assembly and association).

Very well... Effective remedy (when someone’s human right of security
has been violated) is predicated upon providing due process for redress
against the party who committed the harm.   As you note, governments
have an obligation to provide this basic human right to their citizens.
Governments have (to varying degrees) reasonable processes for doing
such when it involves real-world actors (natural persons & businesses
which exist in specific physical locations.)   Governments also have
processes for mutual cooperation when the actors in another country.

When a party on the Internet suffers harm (e.g. someone clicks on a
ransomware email), governments are challenged providing any effective
remedy to the harmed party because this requires information that is
not presently carried in Internet protocols, i.e. the actual real-world
identity of sender.   I can think of dozen reasons why such information
should not be carried in Internet protocols, but it is clear that its absence
hinders governments in providing effective remedy for those harmed
over the Internet.

Short of carrying identity information, is there something that could
be done in protocols to aid governments with their responsibility to
provide effective remedy to those harmed over the Internet?  Almost
certainly, but if this group wants to consider such in its research, so
so that its assessment guide can be comprehensive, it would need
engage with the law enforcement community to obtain their views
on such matters.  There are existing cases where LEA has pointed
out the protocol implications for effective remedy, but that generally
happens only well after the fact, and via engagement with the operator
community (e.g. IETF RFC 6302/BCP 162) rather than during protocol
design, as protocol developers generally do not give consideration to
possible harm that could result from their protocols and how effective
remedy is provided.

/John

Disclaimer: my views alone

---

From: Stephen Farrell <[email-masked]>
Date: Wed, 8 Jun 2016 22:44:35 +0100

John,

I'm fine if folks here are interested in analysing this topic as
there are some interesting things to consider, but two things...

On 08/06/16 22:27, John Curran wrote:
> identity of sender.

Huh? Email has loads of identifiers, and it's fairly easy to
determine the country of origin, which was what you were asking
for yesterday. Doing something effective about that is not always
easy of course, depending on the countries involved. (Or are you
now changing your "ask" to the point where you want to consider
all packets having some "RealName" construct or something? If
so, I don't think wandering into the realms of fiction is that
good a plan, sorry.)

In any case, mail isn't a great example of what you were asking
for yesterday, so better examples would help a lot. Say where a
web site is hacked or some weakness in web site or protocol
design results in the potential for drive-by downloads of
ransomware?

Even better would be if someone had documented a real analysis of
the technical details of such cases - someone must surely have written
that down in a way that's useful here. I reckon that this RG could
otherwise waste a lot of effort on misdirected speculation as to how
things could or do work. So: have you done the legwork to check if
such a description exists that could be useful? If not, would you?

Secondly...

> it would need
> on such matters.

You keep saying that. It is not unreasonable to want to get that
input. It is not IMO in the RG's power to ensure that happens. So
if you think it's needed, what are *you* doing to get LEA folks
engaged on this mailing list or to engage with the RG? Expecting
others to do that and calling their efforts into question if they
don't do what you say is needed, seems to me to not be a recipe for
success. (And as an aside - constantly repeating that also doesn't
help.)

Cheers,
S.

---

From: John Curran <[email-masked]>
Date: Wed, 8 Jun 2016 18:09:23 -0400

> success. (And as an aside - constantly repeating that also doesn't

Stephen -

   As I noted before, I did not intend to further delay the efforts of this
   RG in developing its guide to assessment of potential human rights
   impacts during Internet protocol development.  Avoiding any delay
   remains my goal, and hence I made a very concrete suggesting for
   limiting the scope of the work such that those who are currently
   participating can proceed; specifically -

> From: John Curran <[email-masked]>
> Subject: Re: [hrpc] draft-tenoever-hrpc-research-02
> Date: June 7, 2016 at 7:47:06 PM EDT
> To: Joseph Lorenzo Hall <[email-masked]>
> Cc: Niels ten Oever <[email-masked]>, "[email-masked]" <[email-masked]>, Stephen Farrell <[email-masked]>
> ...
> for for assessing protection for specific human rights.

   There’s nothing wrong with scoping the work accordingly, but if the
   RG wishes to state that its work will guide protocol authors in “a
   comprehensive analysis that can serve as the basis for discussion
   on whether the protocol adequately protects against human rights
   threats” (rather then the subset to which it feels presently qualified
   to opine) then it is actually on the RG to enlist the additional input
   to make a more general human rights assessment guide possible.

/John

---

From: Stephen Farrell <[email-masked]>
Date: Wed, 8 Jun 2016 23:19:37 +0100

>    participating can proceed; specifically -

Sure, I saw that. My question was: what are *you* going to do to
make that happen? If you don't have a suggestion you think might
work then I'm quite confused as to how you can call for someone
else to do that. FWIW, I have thought a bit about that but don't
have things to suggest that I think would be that effective. But
given that you are as exercised about this as seems to be the
case perhaps you presumably have better ideas to share.

Cheers,
S.

PS: I note you did not answer my other question as to whether you
had gone looking for good technical descriptions of the kind of
problematic attacks relevant here. That kind of background would
really help to ensure there's no more delay than is warranted by
the importance of the question.

---

From: John Curran <[email-masked]>
Date: Wed, 8 Jun 2016 18:30:02 -0400

On Jun 8, 2016, at 6:19 PM, Stephen Farrell <[email-masked]> wrote:
> else to do that.

Folks in LEA would be most appropriate, but recognize that they have
requirements based on their needs, not a technical understanding of
the protocols.   This means that any engagement would need to be a
lot more cooperative than may be possible given the current stance
of the research group.  I’ve always thought that research involved
seeking out relevant sources of information, but "I am but an egg”
when it comes to such matters.

> the importance of the question.

As noted above, it will require research and collaborative engagement;
I am quite willing to try to enlist folks from the LEA community (e.g. the
presenter of the RIPE 72 presentation I noted on LEA attribution issues:
Gregory Mounier of the European Cybercrime Centre (EC3), as well as
others as I can find), but such efforts are likely inappropriate until the
RG finalizes the scope of the assessment guide it intends to produce.

/John

---

From: Stephen Farrell <[email-masked]>
Date: Wed, 8 Jun 2016 23:47:47 +0100

On 08/06/16 23:30, John Curran wrote:
> the protocols. 

Yes. Ideally if you could find some LEA folks who are willing to
re-consider their requirements in the open then we could I think
make progress. My take on a lot of this is that LEAs feel stuck
with 19th century requirements which no longer make as much sense
in the face of the 21st century Internet, but are worried that if
they openly discuss those they may end up with less than they had
in the past. But if there's a way to find folks who'd have that
discussion in the open, I think that'd be good.

>  This means that any engagement would need to be a
> of the research group.  

That last is not, IMO, helpful. You're essentially accusing folks
almost of bad faith, despite them engaging with you seriously to
try tease out whether there's an issue here that's tractable to
approach. Did you really mean that? If so, where is the "stance" of
the RG documented and did the RG chairs declare consensus or
something? If so, I missed all of that and only see you making what
seems to me to be a dodgy assertion not backed by my reading of
the list traffic.

> I’ve always thought that research involved

I think you know that the IETF and IRTF are places where stuff
happens when people do stuff and not when people tell others
to do stuff. So by all means be an egg, but consider that eggs
are usually undemanding.

> As noted above, it will require research 

Yes. I would expect a proponent repeatedly saying "you must do X"
to have done the research into "X." It'd be different if someone
said once "hey, X could be interesting, anyone know about that?"
but that's not the case here.

> and collaborative engagement;

That last I'd say might be better answered by the chairs. But this is
a mailing list that anyone can join any time so I don't get why anyone
pointing someone at this list could be inappropriate.

Cheers,
S.

PS: Just to avoid one possible dead-end - suggestions that the RG send
a formal liaison to some other body aren't worth pursuing. Lars has
been rightly consistent in saying that the IRTF doesn't do liaisons
since it doesn't do standards. So I'd say focusing on the informal is
a likely better approach.