Subject: [hrpc] kind read request draft-political and draft-association

From: Niels ten Oever <[email-masked]>
Date: Wed, 11 Jul 2018 12:42:14 +0200

H all,

I hope you will find the time to read and review the following two
drafts on your way to Montreal, so we can have an informed discussion
about it, (and maybe even discuss RG adoption):

https://tools.ietf.org/html/draft-tenoever-hrpc-political-05
https://tools.ietf.org/html/draft-tenoever-hrpc-association-05

Thanks for considering.

Best,

Niels

-- 
Niels ten Oever
Researcher and PhD Candidate
Datactive Research Group
University of Amsterdam

PGP fingerprint	   2458 0B70 5C4A FD8A 9488
                   643A 0ED8 3F3A 468A C8B3

---

From: Wendy Seltzer <[email-masked]>
Date: Sat, 14 Jul 2018 13:32:33 -0400

> https://tools.ietf.org/html/draft-tenoever-hrpc-association-05

My difficulty with this document is that it seems to be a collection of
ideas loosely associated with association (pardon the pun), not all of
which implicate the human right to freedom of association). The use
cases don't seem to me to strike the right level of abstraction.

So I might first focus either on a concrete associational use case (not
a technology, but "people getting together to organize a protest") or at
the other end, enumerating features critical to enabling association,
such as privacy, authentication, integrity protection, confidentiality,
etc.

I do think there is a core value to thinking about what "association"
offers that's different from other more typical frames such as privacy,
security, or free expression. Along with multi-party confidentiality, it
could also drive a focus on usability and failure-modes -- since a
multi-party communication is only as secure as its weakest-security
party, and different groups might want to make different choices about
what happens when a particular link fails.

Hope this helps,
--Wendy

-- 
Wendy Seltzer -- [email-masked] +1.617.715.4883 (office)
Strategy Lead, World Wide Web Consortium (W3C)
https://wendy.seltzer.org/        +1.617.863.0613 (mobile)

---

From: Tony Rutkowski <[email-masked]>
Date: Sat, 14 Jul 2018 15:16:00 -0400

+1

This draft is not a sufficiently generic abstraction.  Perhaps most
significantly why are these two rights (assembly and association)
constrained by the first sentence in the definition of "internet" in
Sect. 2.   There are many internets.  If the rights are universal, they
should apply to any and all public internet communication offerings -
whatever protocols are used.  You can do that by simply dropping the
first sentence in the definition.

It also isn't clear that pursuant the the Feb 2000 PTAB consent
agreement, the IETF can assert the exclusivity of its own notion of
"internet."  I am copying Patrice Lyons who helped develop that
agreement.  She has also subsequently been helpful in developing broader
internet articulations and can provide guidance.

--tony

---

From: Andrew Sullivan <[email-masked]>
Date: Sat, 14 Jul 2018 15:36:35 -0400

On Sat, Jul 14, 2018 at 03:16:00PM -0400, Tony Rutkowski wrote:
> "internet."

I know of nobody who is asserting any exclusivity of notion of
"internet", and anyway this document isn't an IETF product, so I'm not
sure how that consent agreement is relevant in any way to this
discussion.

Best regards,

A

-- 
Andrew Sullivan
[email-masked]

---

From: Tony Rutkowski <[email-masked]>
Date: Sat, 14 Jul 2018 16:24:40 -0400

Hi Andrew,

Great.  Then the first sentence of the "internet" definition can be deleted.

It is relevant because doing so, applies the rights far more broadly.

The IRTF IPR is held by the Internet Trust which consists of the
Internet Society and CNRI - who signed the PTAB agreement.  The
agreement establishes the "internet" as generic an "indistinct."

--yony

---

From: Tony Rutkowski <[email-masked]>
Date: Sat, 14 Jul 2018 16:46:41 -0400

This past week, the criminal justice and human rights communities met in
Strasbourg at the annual Octopus conference.  There were many excellent
presentations on the expanding arena of human rights and internet
technologies including: attacks on fundamental freedoms to fair elective
processes, e-evidence and human rights, human rights requirements for
streamlined access to subscriber data, human rights of children, human
rights and violence/cyberbullying, human rights and artificial intelligence.

See <https://www.coe.int/en/web/cybercrime/resources-octopus-2018>

These should all be part of an internet human rights ontology that can
them be mapped onto an architecture.

--tony

---

From: Andrew Sullivan <[email-masked]>
Date: Sat, 14 Jul 2018 17:14:22 -0400

> Great.  Then the first sentence of the "internet" definition can be deleted.

I don't think so.  The definition of "Internet" in that document is
several _different_ meanings of "internet" as far as I can tell.  One
of them _certainly_ is the first definition listed there.  That
doesn't mean it's the only one.

> It is relevant because doing so, applies the rights far more broadly.

I don't see how.

(The rest of this note is probably not directly relevant to IRTF or
HRPC.)

> Internet Society and CNRI

I do not know of anything called "the Internet Trust" and a quick
Google didn't reveal such a thing to me.  If you are referring to the
IETF Trust, it does not consist of ISOC or CNRI at all.  I know this
in part because I am currently a Trustee.  ISOC and CNRI were Settlors
of the Trust under an original agreement established in 2005 and
amended and restated in 2014.  The information about this is all
available on the Trust website, https://trustee.ietf.org.

I'm not sure what you think the IRTF IPR is, but it is true that the
domain name irtf.org is held by the IETF Trust.

> agreement establishes the "internet" as generic an "indistinct."

I am unaware of any way that either ISOC or CNRI would be in a
position to establish anything about how I use the words "internet" or
"Internet".  I believe, and I have argued repeatedly, that there is a
meaningful distinction to be made between these two things, in the
same way that there is a meaningful distinction I made when I wrote,
while working at McMaster, "The University is an instantiation of the
university."  One of them is a proper noun and the other is not, and I
don't especially care what ISOC, CNRI, or for that matter API thinks
about the matter.  I shall maintain the distinction regardless.

Best regards,

A

-- 
Andrew Sullivan
[email-masked]

---

From: Niels ten Oever <[email-masked]>
Date: Sat, 14 Jul 2018 23:22:47 +0200

Hi Wendy,

Thanks for the review! Please allow me to respond in-line:

> cases don't seem to me to strike the right level of abstraction.

This level of abstraction was used to show the relation between a
specific right and a number of uses, without mapping the specific uses
exhaustively. While RFC8280 was used to link human rights in general
with Internet protocols, this draft aims to link a specific right with
several uses and thus help the conceptual framing of the relation
between human rights beyond freedom of expression and privacy.

> such as privacy, authentication, integrity protection, confidentiality,

We try to do the latter through the application of
draft-irtf-hrpc-guidelines to specific drafts and protocols, and I think
these technical features are outlined there, if you think they are not,
I think we should add them there.

> what happens when a particular link fails.

Is this perhaps something we could add to 6.1 in general or one of the
examples described under that heading?

Best,

Niels

---

From: Tony Rutkowski <[email-masked]>
Date: Sat, 14 Jul 2018 18:01:18 -0400

> doesn't mean it's the only one.
OK.  So it means essentially anything and everything related to public
internet implementations.  (You don't promulgate anything about private
ones.)  We're in agreement.
>> It is relevant because doing so, applies the rights far more broadly.
The broader the definition of what constitutes an internet, the broader
the applicability of the human rights admonitions. 

-t

ps. Patrice is probably in the best position to describe the obligations
that are carried over to the Trust.  But this doesn't need to be vetted
further here.

---

From: Tony Rutkowski <[email-masked]>
Date: Tue, 17 Jul 2018 07:01:21 -0400

In reviewing this draft, it was surprising not to see any citations to
or treatment of perhaps the best known contemporary author on this
subject, Evgeny Morozov.  Indeed, he recently did a lecture on this
topic at Canada's CCA in Quebec.  The lecture announcement is available at:
https://www.cca.qc.ca/en/events/53642/come-and-forget-the-internet-with-evgeny-morozov
The YouTube clip is at:
https://www.youtube.com/watch?v=f1yJ8eeI2js

A Wikipedia page with treatment of his books and essays is at
https://en.wikipedia.org/wiki/Evgeny_Morozov

--tony

---

From: Tony Rutkowski <[email-masked]>
Date: Tue, 17 Jul 2018 09:26:51 -0400

Article 21 of the Universal Declaration states:
> 1. Everyone has the right to take part in the government of his
> country, directly or through freely chosen representatives.  
> 2. ...
> 3. The will of the people shall be the basis of the authority of
> government; this will shall be expressed in periodic and genuine
> elections which shall be by universal and equal suffrage and shall be
> held by secret vote or by equivalent free voting procedures.  
A somewhat unique opportunity exists in hrpc to use the now public
indictment detailing how Article 21 was massively infringed in the U.S.
and potentially other countries via the use of specific internet
protocols.  See
https://www.justice.gov/file/1080281/download

It falls squarely within the scope "...to research...whether standards
and protocols can enable, strengthen or threaten human rights."

--tony

---

From: "Salz, Rich" <[email-masked]>
Date: Tue, 17 Jul 2018 13:29:24 +0000

An indictment is not proof; it is a claim that things happened.  This can be useful as a *potential* fact to focus our discussions but should not be more than that.

---

From: Tony Rutkowski <[email-masked]>
Date: Tue, 17 Jul 2018 09:34:15 -0400

Hi Rich,

Agreed.  However, we're only dealing with an analytical use case here,
and it indeed provides evaluate the threats and provide mitigations. 
This could probably be done using STIX objects.

--tony

---

From: Andrew Sullivan <[email-masked]>
Date: Tue, 17 Jul 2018 09:34:05 -0400

Hi,

> https://www.justice.gov/file/1080281/download

I read, but only quickly, the PDF and am having a hard time putting it
together with your claim that "specific internet protocols" were
involved.  Perhaps you could say more.

A

-- 
Andrew Sullivan
[email-masked]

---

From: Tony Rutkowski <[email-masked]>
Date: Tue, 17 Jul 2018 11:01:02 -0400

A fair question. The information is that of a U.S. Grand Jury, not me.

This use case was provided because it is currently a very prominent one
that profoundly impacts a very important human right, and indeed has
produced a cascading effect of national and global human rights
disasters.   On that basis, it might merit examining what internet
protocols and related vulnerabilities were involved.  The easiest
course, of course, is to do nothing.

--tony