Subject: [hrpc] "limits of rights considerations"

From: Andrew Sullivan <[email-masked]>
Date: Sun, 13 Nov 2016 20:47:46 -0500

Hi,

In the RG discussion today, on the "anonymity" discussion, there was
some talk about whether the "flavour" is too strong.  Here was the
sort of thing I was thinking about.  It'd go at the end of 2.1.2:

    In considering these questions, authors will need to be aware of
    the potential of technical advances or the passage of time to
    undermine protections.  In general, considerations of rights are
    likely to be more effective if they are considered given a
    purpose, rather than as abolute goals.

Anyway, something like that was what I was thinking of.  I'm sure the language could be improved.

A

-- 
Andrew Sullivan
[email-masked]

---

From: Niels ten Oever <[email-masked]>
Date: Mon, 14 Nov 2016 14:35:19 +0900

Thanks for this. Accepted with minor tweaks:

In considering these questions, authors will need to be aware of the
potential of technical advances or the passage of time to undermine
protections.  In general, considerations of rights are likely to be more
effective if they are considered given a purpose and specific use cases,
rather than as abstract absolute goals. 

Cheers, 

Niels

---

From: Niels ten Oever <[email-masked]>
Date: Mon, 14 Nov 2016 15:02:05 +0900

Dear all,

I have been trying to capture the thoughts of Andrew, as they were
interpreted by Avri, which I can roughly paraphrase as:

'the IETF isn't neutral, but it aims to have a neutral impact on
people's rights'

Seems in direct contract with RFC3935:

      The IETF community wants the Internet to succeed because we
      believe that the existence of the Internet, and its influence on
      economics, communication, and education, will help us to build a
      better human society.

This clearly goes beyond a 'neutral' impact, in this description the
IETF aims to have a positive impact (similar thoughts can also be
foundin RFC1958). 

I actually found the conclusion we currently have in the document quite
far from being very political, this if what we have now:

   Pursuant to the principle of constant change, since the function and
   scope of the Internet evolves, so does the role of the IETF in
   developing standards.  Internet standards are adopted on the basis of
   a series of criteria, including high technical quality, support by
   community consensus, and their overall benefit to the Internet.  The
   latter calls for an assessment of the interests of all affected
   parties and the specifications' impact on the Internet's users.  In
   this respect, the effective exercise of the human rights of the
   Internet users is a relevant consideration that needs to be
   appreciated in the standardization process insofar as it is directly
   linked to the reliability and core values of the Internet.  [RFC1958]
   [RFC0226] [RFC3724]

Which I still think is still quite 'neutral', similarly:

   The IETF has produced guidelines and procedures to ensure and
   galvanize the privacy and security of the network in protocol
   development.  This document aims to explore the possibility of the
   development of similar procedures for guidelines for human rights
   considerations to ensure that protocols developed in the IETF do not
   have an adverse impact on the realization of human rights on the
   Internet.  By carefully considering the answers to the questions
   posed in the final part of this document, document authors should be
   able to produce a comprehensive analysis that can serve as the basis
   for discussion on whether the protocol adequately protects against
   human rights threats.

All in all, I think the text lives up to the standard Andrew set, if now
I am happy to reconsider.

Best,

Niels

---

From: Eliot Lear <[email-masked]>
Date: Mon, 14 Nov 2016 07:18:10 +0100

Niels,

> IETF aims to have a positive impact (similar thoughts can also be

How do you see a conflict between the two?  What balance of rights is
impacted in the text from 3935?

>    linked to the reliability and core values of the Internet.  [RFC1958]

I come back to what I said earlier.

If there were a proposal that simply negative impacted one or more human
rights without positively impacting others, I would be quite comfortable
with the approach you have taken.  After all, who wants to negatively
impact human rights?  That's the easy case.  The hard case is where
rights must be balanced.  The problem is that, by charter, this group
has not examined ALL human rights but specific human rights.  It's a
problem because some capabilities may support some human rights and
negatively impact some others.  And then the question becomes, how do we
balance such rights?  This work doesn't attempt an answer to that
question.  To be fair, it's a hard question.  But until we have such
guidance, I don't see how it could be proposed that this work be used in
the IETF.  That being said, I don't object to this document being
published as a starting point.

Eliot

---

From: Niels ten Oever <[email-masked]>
Date: Mon, 14 Nov 2016 16:12:41 +0900

Hi Eliot,

Thanks for your comments. Reply inline:

> impacted in the text from 3935?

The language 'better' implies a difference, whereas 'neutral' implies no
difference. 

> has not examined ALL human rights but specific human rights.  

We have looked at all rights that seemed relevant for protocols, as
outlined in the draft. If we missed anything please let us know. We also
outlined in the draft the need to balance rights.

> It's a
> question.  

It does. There is quite some text on that in the draft. Look for
instance at:

   Human rights can be in conflict with each other, such as the right to
   freedom of expression and the right to privacy.  In such as case the
   different affected rights need to be balanced.  In order to do this
   it is crucial that the rights impacts are clearly documented in order
   to mitigate the potential harm in a proportional way.  Making that
   process tangible and practical for protocol developers is what this
   research aims to ultimately contribute to.  Technology can never be
   fully equated with a human right.  Whereas a specific technology
   might be strong enabler of a specific human right, it might have an
   adverse impact on another human right.  In this case decisions on
   design and deployment need to take this into account.

and:

   Note that the guidance provided in this section does not recommend
   specific practices.  The range of protocols developed in the IETF is
   too broad to make recommendations about particular uses of data or
   how human rights might be balanced against other design goals.
   However, by carefully considering the answers to the following
   questions, document authors should be able to produce a comprehensive
   analysis that can serve as the basis for discussion on whether the
   protocol adequately protects against specific human rights threats.
   This guidance is meant to help the thought process of a human rights
   analysis; it does not provide specific directions for how to write a
   human rights protocol considerations section (following the example
   set in [RFC6973]), and the addition of a human rights protocol
   considerations section has also not yet been proposed.  In
   considering these questions, authors will need to be aware of the
   potential of technical advances or the passage of time to undermine
   protections.  In general, considerations of rights are likely to be
   more effective if they are considered given a purpose and specific
   use cases, rather than as abstract absolute goals.

> To be fair, it's a hard question.  But until we have such
> the IETF.  
> That being said, I don't object to this document being

That's great to hear. Happy to continue to discuss and develop this
further.

All the best,

Niels

---

From: Andrew Sullivan <[email-masked]>
Date: Mon, 14 Nov 2016 03:00:53 -0500

Hi,

> 'the IETF isn't neutral, but it aims to have a neutral impact on

I see now something that I did not understand before.  That sentence
is about "the IETF", but that isn't what I thought I was talking
about.  I thought I was talking about "the Internet", as expressed in
protocols and connections and so on.

My impression is that the document makes claims about how the
technologies might or might not impinge on human rights (as defined in
the UDHR or ICCPR or ICESCR or all of the above).  If you want to
argue that a technology as such is inherently politically charged, you
cannot use the intentions of the producer of the technology as part of
that proof.  For the intention merely shows that people who conceive
of or use the technology may not be neutral.  Whether the technology
is thereby value-charged is an independent question from that.

And this was the objection that I had about the reliance on RFC 3935.
For the quote in the draft is, "The Internet isn't value-neutral, and
neither is the IETF."  The point that I understood Avri to be making
is that the value of the network might not be a human-rights value,
but a network-expansiveness or network-access-positive value (or
something like that).  That is, let us grant that the Internet is not
value-neutral.  Still, the Internet (as opposed to the IETF) might
have as its core value that expansion of Internet-type communications
and connectivity is a good (this is like the "selfish gene" value some
biologists and sociobiologists believe in).  From this we can infer
that anything that improves that connectivity is positive and anything
that impedes that connectivity is negative.  None of that entails any
value directly related to human rights, though human rights could in
some derivative way be affected by such a value.  Therefore,

>       economics, communication, and education, will help us to build a

"building a better human society" in the above (setting aside what
"better" means there) is a goal of the IETF, but it _might not_ be
part of an inherent value in the technology.  Instead, it might be a
value that is part of a human will to some end, which can be
instrumentally achieved through the technology that happens to be
usable in that way.

Now, as I tried to argue at the mic, you don't anyway need the
argument you seem to be trying to make.  Instead, you can just say at
the outset that the Internet can be understood as enabling those
rights (for the various reasons that are already in the document, both
in section 1 and to some extent in section 4).  Then you can go on to
argue that, if one wishes to address the ways in which a network
protocol might affect those rights, the considerations in section 2
may be relevant.

This gets out out of a problem that has been bothering me but that I
haven't been able to articulate:

>    Internet.

The problem here is that there are two possible reasons to adopt the
privacy and security considerations in protocol documents.  One is
that you think that privacy and "security" (granting that's a manifold
term) are positive values in themselves that need to be protected.
The other, however, is that you think that attacks on privacy or
security are attacks on the functioning of the network -- on the
engineering value of the network.  Security protections are necessary
because the network is more reliable when its security systems
function reliably and do not leak credentials and so on.  Similarly,
privacy failures reduce the instrumental value of the network by
undermining users' trust in the network, which reduces the virtuous
deployment circle due to the expansion of users and their use cases.

Now you _might_ want to argue along the latter lines here: a protocol
that protects (other kinds of) human rights promotes the virtuous
deployment circle and one that does not protect those rights tends to
dampen it.  But I think that approach is dangerous for your argument,
for the reasons Eliot outlined: when someone claims that two rights
conflict with one another -- particularly when multiple technologies
are deployed together -- then you have a deep problem for your
decision-making about which right(s) to prefer.  And the Internet's
virtuous deployment circle doesn't get you there, because that's the
very trade off you're making.

For that reason, it might be better to motivate human rights
considerations by just saying that there is a useful way to interpret
the Internet as supporting and promoting human rights, and that (if
one accepts that) one therefore might like to consider how a protocol
design contributes to or substracts from the Internet-based expression
of those rights.  I grant you that this claim is weaker.  But it seems
to me to be one that is much easier to defend, and is certainly enough
to motivate the considerations in section 2.  (It also relieves me of
the responsibility of digging out a lot of dusty literature, which I
think of as a side benefit, because the balance of the literature
survey becomes considerably less important. :-))

This is, of course, just an RG document and there's no requirement for
consensus, so I trust my concerns should by no means delay proceeding
with publication.  But I think what you are trying to achieve would be
more easily done along the lines I'm trying to describe.

Best regards,

A

-- 
Andrew Sullivan
[email-masked]

---

From: Niels ten Oever <[email-masked]>
Date: Wed, 16 Nov 2016 00:10:32 +0900

Hi Andrew,

Thanks for this. I am enjoying the thoughtful discussion. Response inline:

On 11/14/2016 05:00 PM, Andrew Sullivan wrote:
> argue that a technology as such is inherently politically charged,

If you mean that technology is inherently political because it
rearranges the social, then I fully agree.*

> you
> that proof.

Fully agree.

> For the intention merely shows that people who conceive

Fully agree.

> biologists and sociobiologists believe in).

This sounds similar to RFC1958, with the difference that that RFC speaks
of 'the Internet community', and not the Internet itself.

> From this we can infer
> that impedes that connectivity is negative.

Yes.

> None of that entails any

But that is a problem that we're already experiencing, right? And
currently we're not systematically documenting this, taking all sides
into account.

I like the terms 'Internet's virtuous deployment circle' btw.

> the Internet as supporting and promoting human rights,

Eventhough I am very sensitive for this argument, I am not sure this is
true. I think with the current implementation of the Internet, one can
easily argue that is both supports and adversely impacting human rights.

> and that (if
> of those rights.

This somehow seems to be based that the Internet is based on a
monolothic value set, I think not all impacted rights can be reduced
from 'the Internet's virtuous deployment circle'. The concept is not
clear enough, that is why we fell back to human rights, because it
offers a bridge online and offline rights, and also offer an analytical
model.

> I grant you that this claim is weaker.  But it seems

But I am quite interesting the literature you would suggest.

> more easily done along the lines I'm trying to describe.

I think we're still trying to aim for RG consensus, and am quite
committed to getting there. Let's see what we can do

Cheers,

Niels

> A

* I got thrown of by the word 'charged', which might imply some kind of
essentialism, but I don't think you mean that.