Subject: privacy and IETF meetings in US

From: JORDI PALET MARTINEZ <[email-masked]>
Date: Fri, 07 Jun 2019 17:00:11 +0200

Hi,

If I got it correctly, the new US regulation will force to provide information about social media accounts by those requesting a VISA. Not sure if this will apply also for the ESTA.

If this is correct, and considering that we have planned IETF111, July 2021, in San Francisco, despite how much personally I like that city, should we cancel that meeting and start looking for an alternative venue?

Or we don't care about IETF participants privacy rights at all and how much subjective the immigration authorities judgment of our activity in social networks may become?

Regards,
Jordi

**********************************************
IPv4 is over
Are you ready for the new Internet ?
http://www.theipv6company.com
The IPv6 Company

This electronic message contains information which may be privileged or confidential. The information is intended to be for the exclusive use of the individual(s) named above and further non-explicilty authorized disclosure, copying, distribution or use of the contents of this information, even if partially, including attached files, is strictly prohibited and will be considered a criminal offense. If you are not the intended recipient be aware that any disclosure, copying, distribution or use of the contents of this information, even if partially, including attached files, is strictly prohibited, will be considered a criminal offense, so you must reply to the original sender to inform about this communication and delete it.

---

From: John C Klensin <[email-masked]>
Date: Fri, 07 Jun 2019 12:14:35 -0400

--On Friday, June 7, 2019 17:00 +0200 JORDI PALET MARTINEZ
<jordi.palet=[email-masked]> wrote:

> Hi,
> 
> If I got it correctly, the new US regulation will force to
> provide information about social media accounts by those
> requesting a VISA. Not sure if this will apply also for the
> ESTA.
> 
> If this is correct, and considering that we have planned
> IETF111, July 2021, in San Francisco, despite how much
> personally I like that city, should we cancel that meeting and
> start looking for an alternative venue?
> 
> Or we don't care about IETF participants privacy rights at all
> and how much subjective the immigration authorities judgment
> of our activity in social networks may become?

Jordi,

While I'm sympathetic to your concern, two observations may be
relevant:

(1) Many of us believe it is reasonable to hope that the US
elections in November 2020 will result in changes in the US
policy on these matters [1].  While I hope that the Secretariat
and the IETF LLC will have contingency plans for possible
reactions to events that might interfere with any planned
meeting (including, e.g., the possibility of the political
situation in Thailand exploding in the months before IETF 106, I
can't see it as being in the IETF's interest or that of its
participants to start canceling meetings now on the basis of
policies that might (or might not) be in effect significantly
over two year's hence.

(2) I see a huge difference between the question of how we react
to a possible policy of some government's regulations about visa
applicants and "we don't care about IETF participants privacy
rights at all".  Trying to present that as a binary choice is, I
believe, a type of hyperbole that does not help us have careful
and nuanced discussions.

best,
    john

[1] I haven't read (or even seen) the actual regulations and
requirements, only the same news-article reports that you have
presumably seen.  I am not even sure that final regulations or
policies have been issued, noting that the
normally-authoritative information at
https://travel.state.gov/content/travel/en/us-visas/tourism-visit/visitor.html
does not appear to have been updated.  We have no way to know
how the State Department, other parts of the Administration, or
the Congress start reacting to this particular idea once, e.g.,
the UA tourist industry notices the effect of this new plan in
both the context of reducing visa applications and that of
further slowdowns in visa application processing at consulates.
That is especially important given the number of policies this
Administration has announced and then changed its mind about (or
claimed it never announced) within a relatively short period.
IANAL, much less a US Immigration Lawyer and I assume you are
not either.  Let's not overreact, go off half-cocked, and start
canceling meetings, if only because doing so plays into the
hands of those who appear to prefer that no foreigner ever come
to the US and US Citizens never travel abroad.

---

From: Ole Jacobsen <[email-masked]>
Date: Fri, 7 Jun 2019 09:21:15 -0700 (PDT)

You said:

"...the political situation in Thailand exploding in the months before 
IETF 106,.."

IETF 106 is being held in Singapore, so I am not sure how Thai 
politics would impact us.

Ole

Ole J. Jacobsen
Editor and Publisher
The Internet Protocol Journal
Office: +1 415-550-9433
Cell:   +1 415-370-4628
UK EE:  +44 7805 977889
Docomo: +81 90 3337-9311
E-mail: [email-masked]
Skype:  organdemo

---

From: JORDI PALET MARTINEZ <[email-masked]>
Date: Fri, 07 Jun 2019 18:24:30 +0200

Hi John,

El 7/6/19 18:15, "ietf en nombre de John C Klensin" <[email-masked] en nombre de [email-masked]> escribió:

    
    
    Jordi,

I think having a plan is a must, no necessarily cancelling the meeting at this time. However, we know how difficult is to find a venue for IETF in a short time.

At least the LLC must provide a report about what is the real actual situation regarding the actual regulation and possible expected changes.

Well, I may have worded it in the wrong way or actually mixed two topics.

What I'm suggesting is that regardless of our decision on the meetings in US, we as IETF consider this as something acceptable?

What US IETF participants will think if the EU setup an equivalent regulation and they are forced to disclose their social networks, emails, etc., when coming to Europe for an IETF meeting?
    
    best,
        john

---

From: Eric Gray <[email-masked]>
Date: Fri, 7 Jun 2019 16:27:51 +0000

Ole,

	While the distance between Thailand and Singapore is about 2K km, they are connected by a land bridge.  It is not hard to imagine things getting messy in Bangkok have some impact on Singapore.

--
Eric

-----Original Message-----
From: ietf <[email-masked]> On Behalf Of Ole Jacobsen
Sent: Friday, June 7, 2019 12:21 PM
To: John C Klensin <[email-masked]>
Cc: IETF <[email-masked]>; JORDI PALET MARTINEZ <jordi.palet=[email-masked]>
Subject: Re: privacy and IETF meetings in US

You said:

"...the political situation in Thailand exploding in the months before IETF 106,.."

IETF 106 is being held in Singapore, so I am not sure how Thai politics would impact us.

Ole

Ole J. Jacobsen
Editor and Publisher

---

From: Melinda Shore <[email-masked]>
Date: Fri, 7 Jun 2019 08:30:18 -0800

On 6/7/19 8:24 AM, JORDI PALET MARTINEZ wrote:
> What I'm suggesting is that regardless of our decision on the
> meetings in US, we as IETF consider this as something acceptable?

IETF 102 was scheduled to be in SF but moved to Montreal.  I
think it's too soon to know what the situation is going to be
in 2021.

Melinda

---

From: Ole Jacobsen <[email-masked]>
Date: Fri, 7 Jun 2019 09:32:47 -0700

No.

Malaysia is close to Singapore. Thailand is (relatively) not.

Ole

Ole J. Jacobsen
Editor and Publisher
The Internet Protocol Journal
Office: +1 415-550-9433
Cell:   +1 415-370-4628
Web: protocoljournal.org
E-mail: [email-masked]
E-mail: [email-masked]
Skype: organdemo

> On 7 Jun 2019, at 09:27, Eric Gray <[email-masked]> wrote:
> 
> Ole,
>

---

From: JORDI PALET MARTINEZ <[email-masked]>
Date: Fri, 07 Jun 2019 18:38:11 +0200

Some of us, who pay from our own pocket, buy the IETF flights 11-12 months in advance (and they are non-refundable), in order to be able to get as lower fares as possible. Otherwise, we can't attend the meetings.

If the decision is taken only 1 year in advance, is fine to avoid the cancelation of the ticket, but is if the new venue is not announced at the same time, is too late to get a low fare.

This needs to be considered by the LLC.

Regards,
Jordi

El 7/6/19 18:31, "ietf en nombre de Melinda Shore" <[email-masked] en nombre de [email-masked]> escribió:

    
    Melinda

---

From: Paul Wouters <[email-masked]>
Date: Fri, 7 Jun 2019 12:42:17 -0400 (EDT)

> think it's too soon to know what the situation is going to be

And if I understood correctly, this planned San Francisco meeting is
happening because of money locked/lost if we don't use it. So we
might just have to do the meeting in the US. And I guess, we will
find out how bad things really are?

I think it would be okay to keep this meeting, and hoping things will
change. I do think it is prudent not to commit any financial resources
to schedule any further meetings in the US for now.

Paul
ps. at least for me, I will already know in my home city of Toronto,
whether or not I will be refused for not handing out my social media
or web browser history, since we clear immigration at the airport :P

---

From: John C Klensin <[email-masked]>
Date: Fri, 07 Jun 2019 13:23:18 -0400

> politics would impact us.

Sorry.  Misread my calendar.  But I could have as easily said
"Political situation in Singapore" or used any other made-up,
half-plausible, example involving any other meeting location.
The point was that things can happen but that calling off a
meeting (or meeting location) because of some unlikely event is
likely to lead to madness.   After all, I could fairly easily
find an article that claims that The BIg One is coming soon and
then contend that we should cancel the San Francisco meeting
because having an major earthquake in the middle of IETF would
be really inconvenient to participants.

While it was not my intent and your (or my) view of "relatively
close" notwithstanding, Eric's comment also stands -- a major
political disruption on that peninsula could affect other
countries as well, some air connections to Singapore go through
Bangkok, etc.   Given air connections from various parts of the
world, similar comments would apply to significant disruptions
in Hong Kong (which seem plausible, if unlikely, to me).

I think the bottom line is that intelligent and strategic
contingency planning is always a good idea because things we can
barely (or cannot at all) anticipate can happen.  Canceling
meetings more than two years out, or blocking countries even
further in advance, seems unwise to me.  If I were negotiating
hotel contracts for the IETF (which I am definitely not... and
happy about that), I'd be looking to see if I could either get
contract escape provisions or insurance to minimize the costs of
our canceling due to Acts of God or politicians between
contract-signing and meeting dates (and evaluating whether the
marginal extra costs of such provisions exceeded the likely
benefits)   And, if we are actually serious about delegating
anything to the IETF LCC, Executive Director, and/or
Secretariat, I'd hope to see sufficient reporting to leave the
general IETF community with the sense that things are under
control but would hope we can avoid debating every political
action or possible natural disaster on the IETF list, especially
in terms of "if you don't agree with my position or concerns,
you are against privacy, freedom, apple pie, motherhood,
assorted traditionally-disadvantaged groups, etc."

One more comment and then I'm going back into my hole...

--On Friday, June 7, 2019 18:38 +0200 JORDI PALET MARTINEZ
<jordi.palet=[email-masked]> wrote:

> Some of us, who pay from our own pocket, buy the IETF flights
> 11-12 months in advance (and they are non-refundable), in
> order to be able to get as lower fares as possible. Otherwise,
> we can't attend the meetings.
> 
> If the decision is taken only 1 year in advance, is fine to
> avoid the cancelation of the ticket, but is if the new venue
> is not announced at the same time, is too late to get a low
> fare.

Jordi,

As someone who has been paying for tickets out of my own pocket
for years, I've always felt I had to trade off "really low fair
from far-in-advance purchase" against the risks of things going
wrong.  I don't buy tickets a year in advance unless I can
either get insurance against various contingencies or conclude
that the prices are low enough that it is reasonable for me to
essentially self-insure.    Under current policies as I
understand them, if we had a meeting scheduled in San Francisco
(or for that matter, Japan or even Vancouver) and, 30 days or
six months ahead of the meeting, there were an earthquake and
the meeting facility fell down, we'd presumably cancel or try to
move the meeting.  While I'd hope you could convince the IETF to
refund your registration fee, I don't think anyone would be
likely to refund your airfare unless you had personally bought
insurance against such catastrophes.  I'd be happy if the IETF
LLC investigated buying, or offering on a group rate, insurance
to cover participant costs associated with meeting cancellation
contingencies even if the result of such an investigation were a
report to the community about the costs and the conclusion that
it wouldn't make sense.  

And, yes, if meetings are going to get canceled or moved, I'd
far prefer that be done at least a year in advance.  However,
which it is sensible and feasible or not involves many tradeoffs
including data the IETF LLC (and the IAOC before it) have
concluded is not appropriately given to the community.  Probably
they are correct, but that means we need to trust them to get it
right.  And, if we can't do that, we need to either fix their
membership (presumably via the Nomcom) or change their terms of
reference (presumably via the IASA 2/0 WG or, if the problem
lies with the LLC Agreement, whatever revolution is required to
change that.  My conclusion is close to "good enough given the
amount of energy I'm willing to invest".  YMMD.

best,
   john

---

From: JORDI PALET MARTINEZ <[email-masked]>
Date: Fri, 07 Jun 2019 19:49:59 +0200

Hi John,

Short ... just about the fare and insurance.

Yes, it is a tradeoff (purchasing in advance for a lower fare or not), that each participant should consider, but also is something that the LLC should have into account.

While I was working in the venue-selection-criteria document (2006 or so), I recall having asked already for the IETF cancellation insurance to be investigated/considered. I don't think that was actually done by the IAOC or IASA. So, I guess we somehow agree, and now is time to start investigating this.

Regards,
Jordi

El 7/6/19 19:24, "ietf en nombre de John C Klensin" <[email-masked] en nombre de [email-masked]> escribió:

    

    

    
    
    Jordi,

    
    best,
       john

---

From: "Livingood, Jason" <[email-masked]>
Date: Fri, 7 Jun 2019 18:19:25 +0000

(No hats on / personal opinion)
I believe the USG stated this would be the policy in April 2018, so what we have now is an apparent date of implementation (assuming the government is able to meet that - which is often not the case). As noted by others, there is an election next year in the US and no one can predict what the outcome may be and, regardless of outcome, whether this policy will be in force during IETF-111. So lots of unknowns in the political environment in the US, as in many other countries around the world. 

I do not defend this policy, but do wish to note that it is probably also the case for users of social media platforms (like me) that commercial entities know far more about you than the government.

Jason

On 6/7/19, 11:01 AM, "ietf on behalf of JORDI PALET MARTINEZ" <[email-masked] on behalf of jordi.palet=[email-masked]> wrote:

    Hi,

    
    
    Regards,
    Jordi

---

From: Michael Richardson <[email-masked]>
Date: Fri, 07 Jun 2019 14:29:32 -0400

> think it's too soon to know what the situation is going to be

But, it cost like $160K(%) to cancel, and we should have thought about whether
or not to move IETF111 at the same time.

I want to point out to Klensin and others that the difficulties with getting
a timely VISA to the US started prior to 2016.

(%)-actually, we (ISOC) have a credit that we can spend on a new reservation
    as long as we book prior to August 2020, for something that is
    prior to 2030 or something like that.

--
Michael Richardson <[email-masked]>, Sandelman Software Works
 -= IPv6 IoT consulting =-

---

From: Michael Richardson <[email-masked]>
Date: Fri, 07 Jun 2019 14:32:33 -0400

> find out how bad things really are?

No, that's not exactly the case.
We booked two in SF (102, 111), and moved the first (102).
The IETF111 meeting can not use that credit because we already booked.
Maybe the LLC can negotiate something, I don't know.

---

From: Nico Williams <[email-masked]>
Date: Fri, 7 Jun 2019 13:43:42 -0500

> or web browser history, since we clear immigration at the airport :P

So, CBP asking to see your social media or mobile is not remotely a new
thing, and was happening before 2016.  The U.S. is not the only country
to have done that sort of thing, either.  But CBP is also naturally
bandwidth limited as to how many visitors they can apply that treatment
to...

What's *new* here is that those who need a _visa_ to visit now can be
subjected to this treatmeant with a higher natural bandwidth limit at
the applicable U.S. consulate, so more such visitors can expect to be
subjected to it.  I imagine consular officials were always able to
request additional data, such as social media identifiers, but now the
State department will be requiring that information of all visa
applicants.

Now, not every visitor to the U.S. needs a visa.  And other countries
have applied this same treatment at the border.  We can probably expect
other countries to apply this same treatment at visa application time.
Often this happens as a tit-for-tat; Argentina used to have a US$100 fee
for American visitors.

Some data would be nice:

 - How many active IETF participants will be affected?

   "However, you do not need a visa for your business meeting or for
   vacation if you are a citizen of the 38 countries participating in
   the Visa Waiver Program."

   https://www.usa.gov/enter-us
   https://www.dhs.gov/visa-waiver-program-requirements

   Canada is not included in that list, but then:

   "In most circumstances, Canadian citizens do not require visitor,
   business, transit or other visas to enter the United States, either
   from Canada or from other countries. There are, however, some
   exceptions to this situation. These exceptions (and the visa category
   they require) include: ..."

   https://ca.usembassy.gov/visas/do-i-need-a-visa/

   IANAL, but the exceptions for Canadian visitors do not include
   visiting to attend a conference, so I think Canadian IETF
   participants will not be affected.

 - How many countries that host IETF meetings have implemented similar
   policies that we don't know about or are publicly considering it?

   (See above comment about tit-for-tat policies.)

Also, I wouldn't expect that a new U.S. administration would handle this
any differently.  The CBP experience has gotten worse over time for
some, and it's happened under a variety of U.S. administrations from
both parties.

When the Texas Alcoholic Beverage Commision (TABC) started spending its
resources arresting people for public intoxication at hotel bars,
eventually they had to back off when Texas started losing many
conferences, including high-profile conferences.  Of course, the scale
here is larger, as there are probably fewer international conferences
(as a proportion of total conferences) hosting meetings in the U.S., so
I expect that refusing to host meetings in the U.S. will likely have no
effect on the policy.

Then again, I think this new policy is a bit useless.  Finding a visa
applicant's social media is relatively simple given their names and
pictures (which the consulate already demands and long has, and besides,
they have cameras).  And it's not like consular officials can easily
find pseudonymous social media if it lacks easily identifiable contents
like pictures that can be matched by facial recognition.  Yes, it would
be a violation to fail to tell them about things they can't find, so the
rule is still invasive, but from a practical point of view, those that
State might exclude aren't going to be disclosing pseudonyms that State
can't doxx on its own.  I.e., this is just more mostly-ineffective
security theater.

Nico
--

---

From: JORDI PALET MARTINEZ <[email-masked]>
Date: Fri, 07 Jun 2019 20:48:09 +0200

Hi Jason,

El 7/6/19 20:20, "ietf en nombre de Livingood, Jason" <[email-masked] en nombre de [email-masked]> escribió:

I don't think is the same. Commercial entities can only get the information that I'm willing to share and in the scope of the law. They can't use that information to discriminate me, I can clearly spoke in the social networks about a company offering a bad service or whatever. The US government *force* the visitors to provide the data by themselves (otherwise they are discriminated and denied the visa) and then they can further discriminate me and again deny the visa if they believe I've criticized Mr. Trump or whatever. So it is not just about privacy, but also freedom of speech.

    Jason

        Hi,

        
        
        Regards,
        Jordi

---

From: Michael Richardson <[email-masked]>
Date: Fri, 07 Jun 2019 15:13:02 -0400

Livingood, Jason <[email-masked]> wrote:
    > I do not defend this policy, but do wish to note that it is probably
    > also the case for users of social media platforms (like me) that
    > commercial entities know far more about you than the government.

I think the biggest risk is for non-users of social media platforms.
It's hard to prove you really don't have an account, and it sounds obstructionist.

---

From: Michael Richardson <[email-masked]>
Date: Fri, 07 Jun 2019 15:18:49 -0400

> like pictures that can be matched by facial recognition.  Yes, it would

So, how does one prove one does not have a social media account?
And, as there are at least 7 people on facebook with the same name as me,
which one is it?  That's why they want the specific identification.

How do I prove which one is me?

    > can't doxx on its own.  I.e., this is just more mostly-ineffective

You are right: theatre, but it has a useful chilling effect on speech.

---

From: Christian Huitema <[email-masked]>
Date: Fri, 7 Jun 2019 12:33:23 -0700

> On Jun 7, 2019, at 12:13 PM, Michael Richardson <[email-masked]> wrote:
> 

Which is why you need to have an account on Facebook or Instagram or some such, and a cron job to post once every other week a picture of your cat, or your food, or the sunset.

-- Christian Huitema

---

From: Nico Williams <[email-masked]>
Date: Fri, 7 Jun 2019 14:40:21 -0500

> So, how does one prove one does not have a social media account?

You don't.  You assert you don't have one and good luck.  If they
reject, go create one and seed it with harmless content.

> which one is it?  That's why they want the specific identification.

Yes, but it's usually easy enough to check if any of the 7 are yours.

> How do I prove which one is me?

By showing that you post pictures of yourself?  Get vain.

> You are right: theatre, but it has a useful chilling effect on speech.

That's not really intended by anyone with half a brain (meaning it might
still be intended!).  You want those who are security risks to speak.

I'm not sure what speech they would object to.  I suspect State is
probably staffed more by Democrats than by Republicans, and they're
bound to have different views as to what's objectionable -- it's almost
certainly a crapshoot.  The UK has used political speech of the sort
that has nothing to do with terrorism to exclude visitors.  So has
Australia.  The speech chilling train has long-ago left the station --
it's affecting more people, but the trend as to speech curbs is global,
and the U.S. is behind that curve.

Really, considering the 38 countries on the visa waiver program, how
many active IETF participants will be affected?  That should inform any
decision to move/cancel the SF meeting.  Future meetings might not be
hosted in the U.S. at all, but again, when other countries start doing
this too (if they haven't already, just without any fancy PRs), then
what?

Nico
--

---

From: "Livingood, Jason" <[email-masked]>
Date: Fri, 7 Jun 2019 20:10:34 +0000

>  This needs to be considered by the LLC.

We agree. The IETF LLC is aware of this announcement by the US government and we’re monitoring the situation. 

Regards, 
Jason Livingood
Chair, IETF LLC Board
[email-masked] 

++++++++++ How to Contact the IETF LLC ++++++++++
Executive Director: [email-masked]  
Sponsorship: [email-masked] 
Board: [email-masked] 

++++++++++ General IETF LLC Board Background ++++++++++
About the IETF LLC: https://www.ietf.org/about/administration/

---

From: Fernando Gont <[email-masked]>
Date: Thu, 13 Jun 2019 21:07:24 +0300

On 7/6/19 21:43, Nico Williams wrote:
> thing, and was happening before 2016.  

For the USA? Datapoint: I've processed two visas for the USA prior to
2017, and I've never was asked social media details.

> The U.S. is not the only country to have done that sort of thing, either.

Does that matter?

> But CBP is also naturally

How does this criteria play with the "being more inclusinve" thing?

> Now, not every visitor to the U.S. needs a visa.

FWIW, most (if not all) latinamerican countries need a visa to enter the
USA.

Thanks,
-- 
Fernando Gont
SI6 Networks
e-mail: [email-masked]
PGP Fingerprint: 6666 31C6 D484 63B2 8FB1 E3C4 AE25 0D55 1D4E 7492

---

From: Nico Williams <[email-masked]>
Date: Thu, 13 Jun 2019 14:47:09 -0500

> 2017, and I've never was asked social media details.

*CBP*, at the border.  They don't ask everyone, just some visitors.

> > The U.S. is not the only country to have done that sort of thing, either.

Maybe, yes.  If we want meetings only in countries that never do this,
we'll need that data.

> How does this criteria play with the "being more inclusinve" thing?

It's about likelihood of inconvenience / privacy invasion.

> FWIW, most (if not all) latinamerican countries need a visa to enter the

Chile is on the waiver program, so not all.  So the vast majority of
citizens of Latin Americ are affected.

Nico
--

---

From: Eliot Lear <[email-masked]>
Date: Thu, 13 Jun 2019 22:49:48 +0200

> On 7 Jun 2019, at 21:33, Christian Huitema <[email-masked]> wrote:
>> 

I am not sure this is good advice.  I think it best that one live one’s life and tell the truth on the form.  If it looks fake, they may will figure that out too, and then where are you?