Subject: [hrpc] I-D Action: draft-irtf-hrpc-guidelines-02.txt

From: [email-masked]
Date: Mon, 11 Mar 2019 04:46:56 -0700

A New Internet-Draft is available from the on-line Internet-Drafts directories.
This draft is a work item of the Human Rights Protocol Considerations RG of the IRTF.

        Title           : Guidelines for Human Rights Protocol and Architecture Considerations
        Authors         : Niels ten Oever
                          Gurshabad Grover
	Filename        : draft-irtf-hrpc-guidelines-02.txt
	Pages           : 27
	Date            : 2019-03-11

Abstract:
   This document sets guidelines for human rights considerations in
   networking protocols, similar to the work done on the guidelines for
   privacy considerations [RFC6973].  This is an updated version of the
   guidelines for human rights considerations in [RFC8280].

The IETF datatracker status page for this draft is:
https://datatracker.ietf.org/doc/draft-irtf-hrpc-guidelines/

There are also htmlized versions available at:
https://tools.ietf.org/html/draft-irtf-hrpc-guidelines-02
https://datatracker.ietf.org/doc/html/draft-irtf-hrpc-guidelines-02

A diff from the previous version is available at:
https://www.ietf.org/rfcdiff?url2=draft-irtf-hrpc-guidelines-02

Please note that it may take a couple of minutes from the time of submission
until the htmlized version and diff are available at tools.ietf.org.

Internet-Drafts are also available by anonymous FTP at:
ftp://ftp.ietf.org/internet-drafts/

---

From: Gurshabad Grover <[email-masked]>
Date: Tue, 19 Mar 2019 12:30:05 +0530

> This draft is a work item of the Human Rights Protocol Considerations RG of the IRTF.

(Thanks to the chairs for scheduling time to discuss this draft at IETF104.)

Niels and I have updated draft-irtf-hrpc-guidelines with mostly
editorial changes for now. Will appreciate any feedback on how to
improve the draft.

A note: HR-RT has reviewed not only communication protocols but problem
statements, solution architectures, etc. At the same time, a variety of
IDs in the IETF are including a 'Human Rights Considerations' section
(draft-reid-doh-operator has one, draft-bertola-bcp doh-clients plans to
have one, and RFC8492 also has one for what it's worth).

Should we expand the scope of this draft to clearly include
considerations more broadly rather than just restricted to communication
protocols? (The updated title of the draft currently reads "Guidelines
for Human Rights Protocol and Architecture Considerations")

Looking forward to your feedback and suggestions on the list and at the
meeting!

Thank you.
Gurshabad

---

From: Corinne Cath <[email-masked]>
Date: Tue, 19 Mar 2019 12:50:56 +0000

Quick nit:

Section 3.2 says: "Currently three five methods have been explored by the
Human Rights Review Team, often in conjunction with each other: "

I guess that should be five methods?

Best,

On Tue, Mar 19, 2019 at 7:00 AM Gurshabad Grover <gurshabad=
[email-masked]> wrote:

> _______________________________________________
> hrpc mailing list
> [email-masked]
> https://www.irtf.org/mailman/listinfo/hrpc
>

-- 
Corinne Cath - Speth
Ph.D. Candidate, Oxford Internet Institute & Alan Turing Institute

Web: www.oii.ox.ac.uk/people/corinne-cath
Email: [email-masked] & [email-masked]
Twitter: @C_Cath

---

From: Stephane Bortzmeyer <[email-masked]>
Date: Tue, 19 Mar 2019 17:34:44 +0100

On Tue, Mar 19, 2019 at 12:30:05PM +0530,
 Gurshabad Grover <gurshabad=[email-masked]> wrote 
 a message of 59 lines which said:

> At the same time, a variety of IDs in the IETF are including a
> 'Human Rights Considerations' section (draft-reid-doh-operator has
> one, draft-bertola-bcp doh-clients plans to have one, and RFC8492
> also has one for what it's worth).

In the draft-reid-doh-operator, the section is also questionable (the
draft is about giving more power to ISPs and less to the users). It
illustrates the fact that the application of the broad principles of
the UDHR to concrete IETF work is not obvious.

---

From: Niels ten Oever <[email-masked]>
Date: Thu, 21 Mar 2019 13:09:33 +0100

On 3/19/19 1:50 PM, Corinne Cath wrote:
> Quick nit:
> 
> Section 3.2 says: "Currently three five methods have been explored by the Human Rights Review Team, often in conjunction with each other:"
> 

yes, thank you! changed it for the next version.

Cheers,

Niels

> 
> Best,
> 
> On Tue, Mar 19, 2019 at 7:00 AM Gurshabad Grover <gurshabad=[email-masked] <mailto:[email-masked]>> wrote:
> 
>     On 11/03/19 5:16 PM, [email-masked] <mailto:[email-masked]> wrote:
>     >
>     [email-masked] <mailto:[email-masked]>
> Web: www.oii.ox.ac.uk/people/corinne-cath <http://www.oii.ox.ac.uk/people/corinne-cath>
> Email: [email-masked] <mailto:[email-masked]> & [email-masked] <mailto:[email-masked]>
> Twitter: @C_Cath
> 

-- 
Niels ten Oever
Researcher and PhD Candidate
DATACTIVE Research Group
University of Amsterdam

PGP fingerprint	   2458 0B70 5C4A FD8A 9488  
                   643A 0ED8 3F3A 468A C8B3

---

From: Joseph Lorenzo Hall <[email-masked]>
Date: Thu, 28 Mar 2019 03:45:38 -0400

> (Thanks to the chairs for scheduling time to discuss this draft at
Not sure if this is the best thread for feedback on this document, but here
is my most recent review:

   - draft-irtf-hrpc-guidelines-02
   -
      - 3.2: "Currently three five methods"
      - 3.2.2, could be clearer: "seeking to understand how it might
      provide a different ordering of the network or society."
      - 3.3.5, internet doesn't want anything: "If the Internet wants to be
      a global network of networks, the protocols should work with languages
      apart from English and character sets apart from Latin characters."
      - 3.3.6, double reference: "[RFC4941] This is why Privacy Extensions
      for Stateless Address Autoconfiguration in IPv6 have been introduced.
      [RFC4941]"
      - 3.3.6, I would reorder those questions
      - 3.3.8, the example seems unfinished?
      - 3.3.10, talks about "the internet" like "hip hop" (throughout the
      document, but especially apparent here)
      - 3.3.14, is this referring to encrypted intermediate storage? "or
      the implementation uses an encrypted store"
      - 3.3.15, how is the difference here between accuracy and consistency
      being thought out? Does consistency have a temporal/stateful
aspect? "Does
      your protocol maintain, assure and/or verify the accuracy of
payload data?
      Does your protocol maintain and assure the consistency of data?"
      - 3.3.15, the MITM description should probably be improved and
      bulleted? Should it hint at inactive MITM and should we call it something
      other than "man"?
      - 3.3.16, "man-in-the-middle-attacks" -> "man-in-the-middle attacks"
      - 3.3.16, "Bob can see the data did not come from Alice but from
      Corinne." remove "but by Corinne" as that may not be true.
      - 3.3.16, what about non-authenticity or knowing when to not ask for
      evidence of authenticity? E.g., attestation of hardware security devices
      like yubikeys may lock out people who use a different brand (Vanguard or
      Fidelity does this now).
      - 3.3.18, impacts bullet list broken
      - 3.3.19, typo "Does you protocol"
      - 5, looks like this should be a bullet list?

-- 
Joseph Lorenzo Hall
Chief Technologist, Center for Democracy & Technology [https://www.cdt.org]
1401 K ST NW STE 200, Washington DC 20005-3497
e: [email-masked], p: 202.407.8825, pgp: https://josephhall.org/gpg-key
Fingerprint: 3CA2 8D7B 9F6D DBD3 4B10  1607 5F86 6987 40A9 A871

Don't miss out! CDT's Tech Prom is April 10, 2019, at The
Anthem. Please join us: https://cdt.org/annual-dinner/

---

From: Joseph Lorenzo Hall <[email-masked]>
Date: Thu, 28 Mar 2019 03:51:40 -0400

oops, there was one very weird comment in there from me that I should
explain: "talks about "the internet" like "hip hop""

What I mean is that there is a line of critique from rapper Mos Def about
how people talk about the musical genre hip-hop... he says, "People talk
about hip-hop as if it's some giant sleeping in a mountain or something
that has human attributes and desires." In essence, we can
over-anthropomorphize certain things in our common language ("hip-hop is
dead" "information wants to be free") and that this is often a crutch we
use when we could be more precise about practical realities.

Anyway, I'd just suggest folks keep an eye out for things like this and
instead reword to make sure we recognize that humans do these things...
e.g., instead of "If the Internet wants to be a global network of
networks..." we can say "If internet engineers want the Internet to be a
global network of networks,"

On Thu, Mar 28, 2019 at 3:45 AM Joseph Lorenzo Hall <[email-masked]> wrote:

> Not sure if this is the best thread for feedback on this document, but
> here is my most recent review:
>
>
>       - 3.3.5, internet doesn't want anything: "If the Internet wants to
>       be a global network of networks, the protocols should work with languages
>       - 3.3.6, double reference: "[RFC4941] This is why Privacy
>       Extensions for Stateless Address Autoconfiguration in IPv6 have been
>       introduced. [RFC4941]"
>       - 3.3.15, how is the difference here between accuracy and
>       consistency being thought out? Does consistency have a temporal/stateful
>       aspect? "Does your protocol maintain, assure and/or verify the accuracy of
>       payload data? Does your protocol maintain and assure the consistency of
>       data?"
>       - 3.3.16, what about non-authenticity or knowing when to not ask
>       for evidence of authenticity? E.g., attestation of hardware security
>       devices like yubikeys may lock out people who use a different brand
>       (Vanguard or Fidelity does this now).