Subject: Re: [hrpc] Comments about draft-irtf-hrpc-research-07

From: Stephane Bortzmeyer <[email-masked]>
Date: Mon, 2 Jan 2017 16:12:04 +0100

On Sun, Dec 25, 2016 at 10:35:11PM -0800,
 S Moonesamy <[email-masked]> wrote 
 a message of 119 lines which said:

> https://www.ietf.org/mail-archive/web/ietf/current/msg98613.html

Note that this was a reply to a known and obnoxious troll.

> The Abstract states that "This documents aims to be a consensus
> document of the Human Rights Protocol Consideration Research Group
> of the Internet Research Task Force (IRTF)".  Will it be the
> consensus of the representatives from companies or organizations
> from one country, a few countries or more than that?

Regarding the human rights themselves, the idea is that the Universal
Declaration of Human Rights <http://www.un.org/en/documents/udhr/> is
a consensus. It is mentioned in draft but may be we should move it to
a normative reference :-)

Regarding the draft, well, that's the point of the last call, to
attract as much people as possible, for diverse backgrounds. Do not
hesitate to spread the word.

> Section 3.2.3.2.1 is about the removal of DNS records.  The second
> sentence in that section could be read as meaning that the US-based
> registry in charge of .com was involved in the first example which
> is referenced.

You mean Wikileaks? Indeed, it was done through the registrar (and not
the registry, specially not the .com registry since it was not a
.com). Proposal:

   There have been a number of cases where the records for a domain are
   removed from the name system due to real-world events.  Examples of
   this removal includes the 'seizure' of wikileaks [bbc-wikileaks] and
   the names of illegally operating gambling operations by the United
   States Immigrations and Customs Enforcement unit. In the first
   case, an US court ordered the registrar to take down the domain. In the
   second, ICE compelled the
   US-based registry in charge of the .com TLD to hand ownership of
   those domains over to the US government.  The same technique has been
   used in Libya to remove sites in violation of "our Country's Law and
   Morality (which) do not allow any kind of pornography or its
   promotion." [techyum]

> There is the following question in Section 4.1.1.1.5: "Does your
> protocol allow Unicode encoded in UTF-8 only?"  Does that mean that
> a protocol supporting UTF-8 only does not enable
> internationalization?

Quite the opposite. The current text is badly written (I raised the
point several times but with little success). The idea (see the entry
Internationalization in the terminology) is that the best solution,
for internationalisation and interoperability, is to accept UTF-8
only, thus avoiding any compatibility issues. The second best solution
is to accept several charsets, which will require mandatory tagging,
to avoid guessing. The worst is of course ASCII-only. Proposal:

 Question(s): Does your protocol have text strings that have to be
   understood or entered by humans?  Does your protocol allow Unicode?
   If so, do you have accept texts in one charset (which must be
   UTF-8), or several (which is dangerous for interoperability)? If
   character sets or encodings other than UTF-8 are
   allowed, does your protocol mandate a proper tagging of the
   charset? Did you have a look at [RFC6365]?
   
> There is a discussion of an outage at
> https://news.ycombinator.com/item?id=12759520  Is it the protocol, namely
> DNS, which is brittle?

In the Dyn case, no, the problem was excessive concentration. (In the
same way that excessive concentration of email at Gmail is not the
fault of SMTP or IMAP.)

---

From: S Moonesamy <[email-masked]>
Date: Mon, 02 Jan 2017 13:01:22 -0800

Hi Stephane,
>a normative reference :-)

I read the declaration.

>hesitate to spread the word.

The reply does not contain an answer to the question.

>You mean Wikileaks? Indeed, it was done through the registrar (and not

Yes.

>    Morality (which) do not allow any kind of pornography or its

The proposed text looks better.

>    charset? Did you have a look at [RFC6365]?

It has been a while since I looked into Internationalization.  It is 
advisable to use UTF-8 to reduce interoperability issues.  It is 
similar to what you have in the first part of the proposed text.  It 
can be an issue when different encodings are allowed in a protocol as 
an encoding may not be well-supported on the receiver side.  For what 
it is worth, RFC 2277 was written in the previous century.  It may be 
easier to refer to RFC 6365 only.  The "text strings that have to be 
understood or entered by humans" is discussed in Section 6 of RFC 
6365.  Although your proposed text looks better, that sub-section 
would still look confusing.

>same way that excessive concentration of email at Gmail is not the

Yes.

Regards,
S. Moonesamy

---

From: Niels ten Oever <[email-masked]>
Date: Thu, 5 Jan 2017 15:28:42 +0100

Thank you very much for this review. Initial responses inline:

Niels ten Oever
Head of Digital

Article 19
www.article19.org

PGP fingerprint    2458 0B70 5C4A FD8A 9488
                   643A 0ED8 3F3A 468A C8B3

On 12/26/2016 07:35 AM, S Moonesamy wrote:
> Hi Niels, Corinne,
> 
> I have a few comments about draft-irtf-hrpc-research-07.  First of all I
> would like to commend Article 19 and the Oxford Internet Institute for
> their efforts to research human rights issues.  I did a quick search on
> ietf.org and the following thread showed up in the search results:
> https://www.ietf.org/mail-archive/web/ietf/current/msg98613.html People
> from different parts of the world have different ways of looking at
> topics such as human rights.
> 

That is why reviews are very much welcomed and we've done considerable
outreach to get as much reviews from different perspectives on this draft.

It can also be said that Human Rights (as laid out in documents like the
UDHR, ICCPR and IECSCR) are the most universal values we have in the world.

> The Abstract states that "This documents aims to be a consensus document
> of the Human Rights Protocol Consideration Research Group of the
> Internet Research Task Force (IRTF)".  Will it be the consensus of the
> representatives from companies or organizations from one country, a few
> countries or more than that?
> 

It will be the consensus of the research group and the people therein.
Nothing more, nothing less.

> Section 2 cites RFC 2606 for "Open standards Conform".  I gather that
> the reference is a mistake as RFC 2606 does not pertain to open standards.
> 

Thanks for catching that, it should have been 2026, fixed that.

> registry in charge of .com was involved in the first example which is
> referenced.  The usage of "real-world events" is not clear.  Does it
> mean events which could be described as political or something else?

Replace 'real-world' with 'political'. Thanks for the suggestion. I also
used the text that has been suggested by Stephane with this little tweak.

> 
> Section 3.2.3.2.2 using dns.telecomix.org as an example.  The domain
> name does not exist:
> 
>   ;; QUESTION SECTION:
>   ;dns.telecomix.org.             IN      A
> 
>   ;; AUTHORITY SECTION:
>   telecomix.org.          3600    IN      SOA     ns3.binero.se.
> registry.binero.se. 1482364800 86400 5400 604800 3600

That's sad. Removed the example.

> 
> 
> Section 3.2.3.3.1 discusses about cryptography.  There was an IAB appeal
> related to that in 2014.  Was that mentioned during the interviews
> (Section 3.1.2)?  I could not find a reference to the appeal as it is
> not listed on the IAB web site.
> 

Are you referring to RFC7258 ? Am not completely sure how it would fit
in here, but text suggestions are always welcome.

> Section 3.3.3.6 discusses about Virtual Private Networks.  A few years
> ago, I asked for feedback about BCP 162 [1] about logging
> recommendations due to the lack of privacy considerations.  Would this
> be viewed as an issue in respect to human rights?
> 

Default log settings have an impact on privacy, privacyis a human
rights, so I'd say, yes this could be framed as a human rights issue.

Which does not mean that one should never be able to keep logs, but
rather we should try to keep the storage and collection of Personal
Identifiable Information to a minimum.

> protocol allow Unicode encoded in UTF-8 only?"  Does that mean that a
> protocol supporting UTF-8 only does not enable internationalization?

This was badly written, I went with the proposal made my Stephane:

Does your protocol have text strings that have to be understood or
entered by humans? Does your protocol allow Unicode? If so, do you have
accept texts in one charset (which must be UTF-8), or several (which is
dangerous for interoperability)? If character sets or encodings other
than UTF-8 are allowed, does your protocol mandate a proper tagging of
the charset? Did you have a look at {{RFC6365}}?

> 
> One of the definitions for an "Open Standard" (Section 4.1.1.1.7) has
> the following: "available in multiple complete implementations by
> competing vendors, or as a complete implementation equally available to
> all parties".  How many of the IETF protocols qualify for this?  For
> what it is worth, there is a short thread about standards at
> https://www.ietf.org/mail-archive/web/ietf/current/msg88209.html
> 
> A point that may have been missed in that Section is protocol
> maintenance, e.g. is there a process to fix a defect in the
> specification and does that process actually work?

Interesting. But is this an IETF or a protocol issue? Is this something
that an protocol develop can/should address?

> 
> The "know what is being decided" is unfortunately not easy especially
> when decisions are not taken in a timely manner.  What is the use of
> making "his or her voice heard on the issue" if that voice is not given
> due consideration when the decision is taken?  Does the "right to
> non-discrimination" apply here?
> 

I think it depends on the conception of non-discrimination and equality
do not apply here, since it is equally miserable for everyone.

> There is the following in Section 4.1.1.1.7 "Open standards are
> important as they allow for permissionless innovation, which is
> important to maintain the freedom and ability to freely create and
> deploy new protocols on top of the communications constructs that
> currently exist".  Could the authors please provide an example of this
> "permissionless innovation" in relation to "open standards"?  The
> example referenced in the draft is not about a protocol.

Why could the notification system outlined in RFC6108 not be interpreted
as a protocol?
> 
> Section 4.1.1.1.8 is about "heterogeneity by design".  On reading RFC
> 1958 again I noticed that Section 5.2 of the document list export
> controls as an issue of secondary importance.  The explanation was that
> "all of the technology required to implement Internet standards can be
> fabricated in each country".  Does it affect a technical specification
> when it cannot be implemented due to restrictions affecting
> cryptography?  Is there heterogeneity by design if there are
> restrictions to "extension points" or export controls on a "mandatory to
> implement" feature in a standard?
> 

I do indeed think that export control impact heterogeneity, but I do not
think this can be addressed by protocol designers.

> Section 4.1.1.1.13 discusses about decentralization.  Do points of
> control affect the "right to freedom of expression"?
> 

Thanks! Added!

> https://news.ycombinator.com/item?id=12759520  Is it the protocol,
> namely DNS, which is brittle?
> 
> Section 4.1.1.1.9 discusses about privacy considerations and lists
> "Right to non-discrimination" under "Impacts".  This seems to be based
> on the constitution of a country which protects unpopular individuals
> from retaliation -- and their ideas from suppression -- at the hand of
> an intolerant society.  Isn't this about "freedom of speech" and
> anonymity instead of the "right to non-discrimination"?   Is it actually
> "right to non-discrimination" or is it the "right to equality"?
> 

It's not only by society. The less information is known about an
individual, the harder it is to discriminate against them. Therefore the
right to privacy and the right to non-discrimination are linked.

There is indeed also a strong link between non-discrimination and the
right to equality.

this is also why all human rights are universal, indivisible,
interrelated, interdependent and mutually reinforcing.

> I have mentioned previously that people are encouraged to participate in
> the IETF and contribute through mailing lists but are completely
> disenfranchised relative to other people who attend IETF meetings.  It
> is odd if a person were to talk about human rights and he/she ignore
> such issues.
> 
> Section 9 states that there are no security considerations as the
> document concerns research.  If there weren't any considerations, would
> several of the participants (Section 3.1.2) opt to remain anonymous?
> 

Security considerations here have been interpreted according to RFC3552.

Thanks a lot of the review!

All changes can be found here:

https://github.com/nllz/IRTF-HRPC/commit/a7a16539939777e947a51127e61b42edc30e6931

new version is here:

https://github.com/nllz/IRTF-HRPC/blob/master/draft-research.md

Best,

Niels

---

From: Andrew Sullivan <[email-masked]>
Date: Thu, 5 Jan 2017 09:46:54 -0500

> Identifiable Information to a minimum.

It seems rather important for this document, however, to distinguish
between "protocol considerations" and "operational considerations".
Logging is clearly the latter.

Best regards,

A

-- 
Andrew Sullivan
[email-masked]

---

From: S Moonesamy <[email-masked]>
Date: Fri, 06 Jan 2017 04:03:04 -0800

Hi Niel,
>outreach to get as much reviews from different perspectives on this draft.

Ok.

>UDHR, ICCPR and IECSCR) are the most universal values we have in the world.

Within a group of persons of diverse backgrounds, values can raise 
questions about cultural assimilation.

>Nothing more, nothing less.

The following is related to the previous paragraph about "values": a 
rough breakdown of the mailing list discussions shows that there were 
only participants from North America and Europe.  I don't think that 
is adequate for such a delicate matter.

According to Article19, once this document is published its 
"recommendation could be brought into the IETF to see how Human 
Rights Protocol Considerations could become inherent part of the 
standards developing process, which would be a technical translation 
of Human Rights Impact Assessments as outlines by the UN Guiding 
Principles for Business and Human Rights".  That is not stated in the 
charter of the Human Rights Protocol Considerations Research Group.

>used the text that has been suggested by Stephane with this little tweak.

Ok.

>in here, but text suggestions are always welcome.

I was not referring to RFC 7258.  The point was about not taking a 
simplistic approach to security in a high-risk environment.

>Identifiable Information to a minimum.

Logging is not a protocol issue as such as it falls outside the 
communication boundary which was usually viewed as an IETF 
matter.  There isn't much interest in revisiting old recommendations 
which may have security implications.

>This was badly written, I went with the proposal made my Stephane:

I suggest dropping the last sentence and moving the reference to the 
second sentence.

>that an protocol develop can/should address?

This is an IETF issue.  The protocol developer may not be available 
or interested in doing an update.

>do not apply here, since it is equally miserable for everyone.

Ok.

>Why could the notification system outlined in RFC6108 not be interpreted

That RFC was published in the Independent Submissions Stream and not 
by the IETF.  The document explicitly states that it is not a 
standard.  To put it simply, there aren't any interoperability considerations.

>think this can be addressed by protocol designers.

I suggest discussing about this with an IETF Security Area Director.

>right to privacy and the right to non-discrimination are linked.

I guess that I did not explain my point correctly.  In a country 
which is well-known, the "right" is protected through freedom of 
speech.  Anonymity is not protected through freedom of expression in 
every country.  I agree with your argument that it is about 
privacy.  Mixing this with other "rights" may be suitable when doing 
advocacy.  I don't think that it is fitting in a document about 
considerations for technical specifications.  I'll comment more at 
the end of this message.

>There is indeed also a strong link between non-discrimination and the

Ok.

The question about "permissionless innovation" was not answered.  Is 
an answer ncessary given that the document describes it as "important".

Thank you for the responses.  The document comes out as pushing an 
agenda; which some readers may interpret as the preferred political 
flavor of the IETF.  Instead of explaining human rights in technical 
terms, it does the reverse by drawing a linkage between a technical 
decision and one or more rights.  I am interested in reading the data 
set mentioned in Section 3.1.2 as some parts of the document have 
similarities with promotional material which I have come across in an 
IETF context.

Regards,
S. Moonesamy

---

From: Niels ten Oever <[email-masked]>
Date: Fri, 6 Jan 2017 14:37:09 +0100

Hiya,

<< snipping the resolved parts>>

> questions about cultural assimilation.

I think this draft does exactly the opposite, but please educate me in
how you think this happens.

May I also point to the report by the UN Special Rapporteur which made
the point about responsibility of standards bodies vis a vis freedom of
expression and other human rights, which has been adopted by the Human
Rights Council. So this is hardly a concern of a geographically limited
group.

http://www.ohchr.org/EN/Issues/FreedomOpinion/Pages/Privatesectorinthedigitalage.aspx

> only participants from North America and Europe.  I don't think that is
> adequate for such a delicate matter.
> 

I don't think that is true. We've had involvement in the discussion from
people from all continents and have also tried to broaden the input by
doing interviews, next to the discussions in the RG sessions of course.

> "recommendation could be brought into the IETF to see how Human Rights
> Protocol Considerations could become inherent part of the standards
> developing process, which would be a technical translation of Human
> Rights Impact Assessments as outlines by the UN Guiding Principles for
> Business and Human Rights".  That is not stated in the charter of the
> Human Rights Protocol Considerations Research Group.
> 

I think the key word in that sentence is _could_. I do not see a
discrepancy between the charter and that remark.

> simplistic approach to security in a high-risk environment.

Then I do not get the point. Could you restate it or offer text?

> communication boundary which was usually viewed as an IETF matter. 
> There isn't much interest in revisiting old recommendations which may
> have security implications.
> 

I agree this is an issue, but not within the scope of this draft.

> I suggest dropping the last sentence and moving the reference to the

So you propose changing:

I think the last sentence add useful information. Why leave it out?

> This is an IETF issue.  The protocol developer may not be available or
> interested in doing an update.
> 

I agree this is an IETF-wide issue. But that also makes it fall outside
of the scope of this draft.

> That RFC was published in the Independent Submissions Stream and not by
> the IETF.  The document explicitly states that it is not a standard.  To
> put it simply, there aren't any interoperability considerations.
>

That makes it not a standard, but it is still a protocol. I tihnk this
exactly shows how a protocol can make use of permissionless innovation
to combine uses of different protocols in other ways than it was
originally intended.

> I suggest discussing about this with an IETF Security Area Director.

Stephen?

> I guess that I did not explain my point correctly.  In a country which
> is well-known, the "right" is protected through freedom of speech. 
> Anonymity is not protected through freedom of expression in every
> country.  I agree with your argument that it is about privacy.  Mixing
> this with other "rights" may be suitable when doing advocacy.  I don't
> think that it is fitting in a document about considerations for
> technical specifications.  I'll comment more at the end of this message.
> 

Am not sure I understand this remark.

> The question about "permissionless innovation" was not answered.  Is an
> answer ncessary given that the document describes it as "important".
> 

Which question? There is a definition, there is an explanation among
different topics  (connectivity, open standards, adaptability).

> decision and one or more rights.  

That is quite a strong denounciation of the methodology. Could you
perhaps be a bit more detailed about this claim?

> I am interested in reading the data
> set mentioned in Section 3.1.2 

Have you watched Net of Rights (https://hrpc.io/net-of-rights) ? A lot
of the interviews have culminated in that.

> as some parts of the document have

What promotional material are you aluding to?

Best,

Niels

---

From: Stephane Bortzmeyer <[email-masked]>
Date: Fri, 6 Jan 2017 15:49:28 +0100

On Fri, Jan 06, 2017 at 04:03:04AM -0800,
 S Moonesamy <[email-masked]> wrote 
 a message of 117 lines which said:

> > Which does not mean that one should never be able to keep logs,
> > but rather we should try to keep the storage and collection of
> > Personal Identifiable Information to a minimum.
> 

That's clearly not true. There are several RFCs about logging such as 
RFC 6302, which has clear HR consequences. (There is also RFC 6269 or
7937 or 7422 or even 7011.)

---

From: S Moonesamy <[email-masked]>
Date: Fri, 06 Jan 2017 09:26:00 -0800

Hi Stephane,
>7937 or 7422 or even 7011.)

"What is a protocol" is a matter of debate in the IETF.  The privacy 
impact of an IETF specification was not an issue for a significant 
amount of pre-2014 IETF standards-track documents or it was viewed as 
an issue to be considered when a IETF participant or IETF Area 
Director with an interest in security or privacy raised a 
concern.  Logging takes an IETF standards-track document beyond what 
is known as "end-to-end".

Are there privacy issues in respect to logging?  Yes.  Should an IETF 
standards-track document (this is not the same as a RFC) recommend 
what information should be logged?  No.  Are there HR consequences 
when logging?  Yes.

Using RFC 7422 as an example (it is not an IETF document), it says 
that there is a "legal logging requirement".  Can the legal 
requirements of another country be disputed?

Regards,
S. Moonesamy

---

From: S Moonesamy <[email-masked]>
Date: Fri, 06 Jan 2017 16:35:40 -0800

Hi Niels,
>how you think this happens.

My guess is that there isn't consensus in the IETF on the UDHR as 
there hasn't been any IETF discussion about that.  What this draft 
does is that it takes values from an international political context 
and tries to apply that within a standards-setting context.  The 
Introduction Section borrows a sentence from "the mission" which was 
written over a decade ago.  Is "the mission" to turn the internet in 
"a human rights enabling environment"?  Are there IETF participants 
(and attendees) who reside in "difficult" countries?  Would those 
persons feel comfortable discussing about human rights publicly 
within the IETF?

Is censorship resistance viewed as acceptable by most of the IETF 
attendees from the 53 countries?  Were there views from attendees who 
are impacted by that?  Do those persons agree that censorship 
resistance is a technical concept?

>Rights Council. So this is hardly a concern of a geographically limited

The report makes a recommendation about ensuring that there is 
"meaningful civil society participation in policymaking and other 
standard-setting processes".  It recommends that "Private entities 
ensure the greatest possible transparency in their policies, 
standards and actions that implicate the freedom of expression and 
other fundamental rights".  Is the IETF part of "private entities" or 
"international organizations"?  Shouldn't it be the responsibility of 
a person, company or organization with a strong interest in freedom 
of expression to make his/her/its case?

The issue observed by the Commission on Science and Technology for 
Development of the United Nations is that "meaningful [IETF] 
participation requires a generally high level of technical expertise, 
human rights perspectives are not always included in discussions, 
even though technical and design choices can have a substantial 
impact on freedom of expression".  I would not disagree with that 
observation as, based on my experience, it is definitely not easy to 
meaningfully participate in the IETF discussions if the person does 
not have an adequate level of technical expertise to understand where 
the technical choice is being made and the policy implications.

I suggest relying on statistics to determine whether this group is 
geographically limited or not as such facts can be easily verified.

>doing interviews, next to the discussions in the RG sessions of course.

It would be more convincing if there were public reviews from people 
from all continents.

>discrepancy between the charter and that remark.

Did the RG Chairs request feedback from the relevant IETF body to 
find out whether the "could" is acceptable or not?

>Then I do not get the point. Could you restate it or offer text?

Let's take the case of a person from civil society lobbying against 
corruption in his/her country.  Given the risks that the person may 
face, can he/she rely on the security mechanisms recommended by the 
IETF or should he/she do some due diligence?  The point is that there 
isn't a "one size fits all" security.

Ok.

>I think the last sentence add useful information. Why leave it out?

The last sentence is about making it possible for the charset to be 
identified at the receiver's end.  That does not mean that the 
information which was transmitted will be rendered correctly at the 
receiver's end as that charset may not be supported.  In essence, the 
tagging indirectly causes an interoperability issue.  Although the 
following is not a good example I'll use it for an explanation: 
https://habrahabr.ru/post/130511/  The webpage is sent with 
"charset=utf-8".  It should display correctly in any up-to-date web 
browser.  What if the webpage was sent as "charset=iso-8859-5"?  The 
up-to-date web browser would require support for that charset to be 
able to display the webpage correctly.  It is not worthwhile to 
diverge from the recommended UTF-8 as it would be quite an effort to 
solve the internationalization issues.

>of the scope of this draft.

One of the issues in the draft is that it goes into open 
standards.  It might be easier to stick to protocol discussions and 
leave out "open standards".

The first reference in the draft is to a book which costs USD 
12.95.  It is at odds with the "not available without cost".

>to combine uses of different protocols in other ways than it was

According to Adam Thiere "permissionless innovation" is the idea that 
experimentation with new technologies and business models should 
generally be permitted without prior approval [from government].  It 
is a bit like Uber.  I unfortunately have to disagree with the above response.

>different topics  (connectivity, open standards, adaptability).

I commented about this above (re. permissionless innovation).

>perhaps be a bit more detailed about this claim?

 From what I understand, the methodology is about getting a sense of 
how the people in the IETF work, their beliefs and rituals, and their 
interactions with each other and those around them.  The actions 
within the context of this research group were embodied in some of 
the IETF RFCs.  Some of the beliefs do not usually get written into a 
RFC as those beliefs are non-technical.  It is not always possible to 
understand an IETF decision without the background information.  Is 
that background information relevant if we are discussing about 
technical details?  No.  Is it relevant if a person is interested in 
studying the beliefs?  Maybe.  There is a political flavor to 
beliefs; it is better not to have those type of discussions in the 
IETF as such discussions are usually contentious.  One interpretation 
of ideology is covered in ISBN 0252097106, 9780252097102.

>of the interviews have culminated in that.

I watched the video.  Are those 19 persons representative of the IETF?

>What promotional material are you aluding to?

I was referring to "open standards" and "permissionless innovation".

Regards,
S. Moonesamy

---

From: Andrew Sullivan <[email-masked]>
Date: Fri, 6 Jan 2017 21:12:25 -0500

Hi,

On Fri, Jan 06, 2017 at 04:35:40PM -0800, S Moonesamy wrote:

> What this draft does is that it takes values from an international
> political context and tries to apply that within a standards-setting
> context.

Perhaps there is a more charitable reading, which is that the draft
tries to take values from an international political context and tries
to suggest how they interact with the relevant standards-setting
context.  (One might disagree about the degree to which it is
successful at that, but I think that the documentation of the
interaction really is the goal, not application of the values as
such.)

Best regards,

A

-- 
Andrew Sullivan
[email-masked]

---

From: Jeanette Hofmann <[email-masked]>
Date: Sat, 7 Jan 2017 12:35:10 +0100

Hi,

this is a follow up from what I wrote about various definitions of "the 
political".

I would like to take issue with 2 aspects of the draft's argument. The 
first concerns the relationship between human rights and standard 
development and the second concerns the unclear definition of the 
political. I am sorry if I am being a bit long.

1. Historically, human rights enable and constrain the relationship 
between the individual and the government. Resulting from the atrocities 
of WW 2, governments agreed on various versions of human rights to 
protect the individual against the abuse of *state* power. (This means 
that human rights create obligations for the states in two ways. 
Negative rights restrict state power to protect the individual against 
it; positive rights make it mandatory for the state to deliver certain 
services to enable a dignified life of its citizens. I.e. a right to 
internet access, as in Mexico, Spain and a few others.)

Human rights concern and structure the relationship between citizens and 
public authorities, they do not affect the horizontal relationships 
between citizens or between citizens and companies, standard setting 
bodies etc. In fact, the products and services of many commercial 
companies affect human rights in fundamental ways but it does not follow 
from these affects that they have to modify their actions.

However, there have been debates over the past decades that question the 
restriction of the applicability of human rights to the relationship 
between individuals and their governments. (Likewise, there are many 
debates about restricting the applicability to citizens since on the 
Internet we are mostly foreigners).

Experts are divided over the question of expanding the applicability of 
human rights to the relationship between individuals and the private 
sector. Some fear that this could weaken the power of human rights. 
Others argue that there is no legal infrastructure to ever enforce 
compliance by the private sector, and that enforcing human rights is the 
task of governments. This is a very interesting debate, and the spread 
of digitalisation has fueled it in many ways.

I think it is very good that the IETF takes an interest in this debate 
and that it considers its position with regard to the respect to human 
rights. The fact that human rights bind governments but not societal or 
commercial entities does not imply that non-state actors cannot commit 
themselves to take human rights into account and respect them.

So, my question is what does all of this have to do with whether or not 
standard setting is a political activity? In my view, all the 
controversial references to "protocols are politics by other means" can 
be dropped  from the draft. They do not add anything substantial to the 
proposal.

The essential question is whether, to what extent and in which form the 
IETF wants to take into account that its work does impact the human 
rights of internet users. It is unlikely that anybody seriously doubts 
that internet standards affect the exercise human rights. But what 
follows from that is much less obvious.

2. The draft constantly confuses political effects and intentions of 
protocol development. The fact that a protocol does have politica 
effects does not necessarily make its development a political process. 
If Janet Abate concludes in her very good book that "protocols are 
politics by other means", it is not clear if she refers to the effects 
of protocols or to the intentions of protocol developers. Based on the 
interviews I did back in the 1990s, I would claim that many people 
involved in the development of IPv4 became aware of the political 
dimension of their work (to the extent that it was competing against 
another protocol suit) but this political dimension did not drive their 
work. Many of the early developers primarily wanted to connect computers 
and experiment with network architecture design not code a political 
statement.

This is why I suggested distinguishing various definitions of "the 
political" Political can be an effect or an intention or both. But it is 
not ok to conclude from effects on the intentions of action.

I could add a 3. criticism that concerns the idea of hard coding or 
"baking" human rights into protocols. I think this is misguiding 
language that unduely simplifies the ways values and norms find their 
way into technology. But I will leave at that because this post gets too 
long for consumption.

My conclusion is that the draft should be completely rewritten. It 
should entirely drop the "the Internet is political". It should make the 
case why the IETF should take human rights into account although there 
is no formal obgligation to do so. And based on that, it should suggest 
various ways by which this could be done.

Jeanette

---

From: Niels ten Oever <[email-masked]>
Date: Mon, 9 Jan 2017 14:17:01 +0100

> from these affects that they have to modify their actions.

Hi Jeanette,

You might want to have a look at the UN Guiding Principle for Business
and Human Rights [0] as well as the report by the UN Special Rapporteur
on Freedom of Expression on 'Freedom of expression, states and the
private sector in the digital age' [1] which both explicitly deal with
the relationship between human rights and companies, as did the UN
Global Compact before.

The report of the Special Rapporteur even explicitly mentions standard
setting bodies.

Cheers,

Niels

[0]
http://www.ohchr.org/Documents/Publications/GuidingPrinciplesBusinessHR_EN.pdf
[1] https://daccess-ods.un.org/TMP/8412558.43639374.html
[2] https://www.unglobalcompact.org/

---

From: Jeanette Hofmann <[email-masked]>
Date: Mon, 9 Jan 2017 14:53:23 +0100

Am 09.01.17 um 14:17 schrieb Niels ten Oever:
> and Human Rights [0]

Hi Niels,

I know these principles. They are one laudable attempt among several 
aiming to expand the scope of applicability of human rights to the 
private sector. They are not binding and, so far, they have not been 
overwhelmingly successful. They sort of confirm what I said, that the 
IETF, as much as any other non-governmental organisation, should 
clarify its relationship to human rights. The same is true for the 
reports by UN Special Rapporteurs etc. They don't entail any 
obligations, they specify recommendations.

> The report of the Special Rapporteur even explicitly mentions standard

And what follows from this?
And how is this related to the question as to whether or not the IETF's 
work is political?

It is not for me to say whether the IETF would benefit from clarifying 
the political dimension of its work. But it is obvious to me that 
different understandings of what is political are used on this list, and 
that it is not helpful for the discussion to mix them.

I would repeat that deciding to respect human rights does not follow 
from creating standards with political impacts. I don't understand why 
the draft links these two issues.

(Here is a different argument one could make in favor of including human 
rights into the framework of standard setting for the internet: until 
the privatisation of the telecommunication sector in the 1980s and 
1990s, telecommunication used to be a public service in many if not most 
countries. As long as they were under public control, telecommunication 
providers and services had to respect human rights. Given the importance 
this sector now has for our everyday life, it would make sense to expand 
the scope of human rights to this sector.)

Jeanette

> _______________________________________________
> hrpc mailing list
> [email-masked]
> https://www.irtf.org/mailman/listinfo/hrpc
>

---

From: Niels ten Oever <[email-masked]>
Date: Mon, 9 Jan 2017 14:57:28 +0100

Hi Jeanette,

Reply inline:

Niels ten Oever
Head of Digital

Article 19
www.article19.org

On 01/09/2017 02:53 PM, Jeanette Hofmann wrote:
> IETF, as much as any other non-governmental organisation, should clarify
> its relationship to human rights. 

That's exactly what we're aiming to do here.

> The same is true for the reports by UN
> Special Rapporteurs etc. They don't entail any obligations, they specify
> recommendations.
> 
> 

I dont think this is stated in the draft (as it is now).

Else, could you point me to the text you have an issue with?

> the draft links these two issues.

It doesn't.

Best,

Niels

---

From: Stephen Farrell <[email-masked]>
Date: Mon, 9 Jan 2017 14:03:56 +0000

Hiya,

> the scope of human rights to this sector.)

While I tend to agree with you overall that getting rid of the
protocols-are-politics text from the draft may be better, I'm
afraid that I'm not at all sure the above is a good thing to
include either, for political reasons;-)

The political reason to not add text like the above is that it
could be read to imply that government controlled telcos (which
do still exist) should have control over the Internet on the
basis that it's only those that might respect HR. I don't think
that'd be a good statement to make both because it's not correct
and because it'd be liable to be misquoted for mischief in some
contexts.

Cheers,
S.

PS: I'm still ok if the text Niels and I ended up with after
wrangling the other day is included.

---

From: Jeanette Hofmann <[email-masked]>
Date: Mon, 9 Jan 2017 15:07:21 +0100

> and because it'd be liable to be misquoted for mischief in some

Yes, I understand that, and for this reason I hesitated making this 
point. Just look at it as an example for a historically based link 
between internet standard setting and human rights.

Jeanette

---

From: Jeanette Hofmann <[email-masked]>
Date: Mon, 9 Jan 2017 15:12:42 +0100

>> the draft links these two issues.

If you don't mean to create a link, I don't understand why the draft 
quotes Abate, DeNardis and others to emphasise that protocols are 
politics by other means. Why then don't you drop all this stuff?

Jeanette

---

From: Niels ten Oever <[email-masked]>
Date: Mon, 9 Jan 2017 15:19:11 +0100

> politics by other means. Why then don't you drop all this stuff?

Because the literature shows different positions on the 'societal impact
of protocols'. It shows how technology performs more than a merely
'technical function'.

Best,

Niels

---

From: Niels ten Oever <[email-masked]>
Date: Tue, 17 Jan 2017 23:36:31 +0100

Hi S. Moonesamy,

Reply inline:

On 01/07/2017 01:35 AM, S Moonesamy wrote:
> My guess is that there isn't consensus in the IETF on the UDHR as there
> hasn't been any IETF discussion about that.  

I don't think the UDHR needs IETF consensus.

> What this draft does is
> that it takes values from an international political context and tries
> to apply that within a standards-setting context.  The Introduction
> Section borrows a sentence from "the mission" which was written over a
> decade ago.  Is "the mission" to turn the internet in "a human rights
> enabling environment"?  

I don't think the mission would be at odds with that.

> Are there IETF participants (and attendees) who
> reside in "difficult" countries?  Would those persons feel comfortable
> discussing about human rights publicly within the IETF?
> 

I do not know.

> are impacted by that?  Do those persons agree that censorship resistance
> is a technical concept?

If you have an posiyion about this it would be great to hear your arguments.

> ensure the greatest possible transparency in their policies, standards
> and actions that implicate the freedom of expression and other
> fundamental rights".  Is the IETF part of "private entities" or
> "international organizations"?  

The IETF is indeed a private entity.

> Shouldn't it be the responsibility of a
> person, company or organization with a strong interest in freedom of
> expression to make his/her/its case?
> 

Not sure what is meant by this.

> human rights perspectives are not always included in discussions, even
> though technical and design choices can have a substantial impact on
> freedom of expression".  I would not disagree with that observation as,
> based on my experience, it is definitely not easy to meaningfully
> participate in the IETF discussions if the person does not have an
> adequate level of technical expertise to understand where the technical
> choice is being made and the policy implications.
> 

I am not sure what the consequences of a conclusion on this would be. As
said, we have been aiming to get quite a lot of input on this draft, and
we had reviewers and contributors from different continents.

> It would be more convincing if there were public reviews from people

It would be great if you could help us find a reviewer from Africa. Then
we would have reviewers from all continents.

> Did the RG Chairs request feedback from the relevant IETF body to find
> out whether the "could" is acceptable or not?
> 

What IETF body do you mean? And what has that to do with a text on an
external website?

> face, can he/she rely on the security mechanisms recommended by the IETF
> or should he/she do some due diligence?  The point is that there isn't a
> "one size fits all" security.
> 
> up-to-date web browser would require support for that charset to be able
> to display the webpage correctly.  It is not worthwhile to diverge from
> the recommended UTF-8 as it would be quite an effort to solve the
> internationalization issues.
> 

I agree, but not all scripts are serviced by UTF-8, that is the reason
for this addition, so if someone uses something else, it should be
properly tagged.

> One of the issues in the draft is that it goes into open standards.  It
> might be easier to stick to protocol discussions and leave out "open
> standards".
> 
> The first reference in the draft is to a book which costs USD 12.95.  It
> is at odds with the "not available without cost".
> 

The reference is not to an open standard.

> generally be permitted without prior approval [from government].  It is
> a bit like Uber.  I unfortunately have to disagree with the above response.
> 

I think the definition follows the one of Adam Thiere, and he does not
solely aim at governments as you indicate between square brackets.

https://www.cato.org/publications/cato-online-forum/embracing-culture-permissionless-innovation

> From what I understand, the methodology is about getting a sense of how
> the people in the IETF work, their beliefs and rituals, and their
> interactions with each other and those around them.  The actions within
> the context of this research group were embodied in some of the IETF
> RFCs.  Some of the beliefs do not usually get written into a RFC as
> those beliefs are non-technical. 

The relation between values and design is address in the literature
discussion.

> It is not always possible to
> understand an IETF decision without the background information.  Is that
> background information relevant if we are discussing about technical
> details?  No.  

If an IETF decision is not understandable, that is a problem.

> Is it relevant if a person is interested in studying the
> beliefs?  Maybe.  There is a political flavor to beliefs; it is better
> not to have those type of discussions in the IETF as such discussions
> are usually contentious.  One interpretation of ideology is covered in
> ISBN 0252097106, 9780252097102.

I think there are a lot of contentious discussion in the IETF, else we
would not have as many discussions. They are exactly about encryption,
privacy, etc, as the topics that are covered in the book you refer to.

> I watched the video.  Are those 19 persons representative of the IETF?

No, that was also not what I claimed at any time.

> I was referring to "open standards" and "permissionless innovation".

?

Cheers,

Niels

PS It would be great if you could leave the thread intact so the
discussion is easier for people to follow (and to respond to).

---

From: S Moonesamy <[email-masked]>
Date: Wed, 18 Jan 2017 11:57:31 -0800

Hi Niels,
>discussion is easier for people to follow (and to respond to).

I apologize for that.  I sent a subscription request last year 
through https://www.irtf.org/mailman/listinfo/hrpc  I assumed that 
the research group might be a closed group as I did not receive an 
email confirmation.  For what it is worth, the threading should work 
correctly for this reply.

>I don't think the UDHR needs IETF consensus.

I'll comment about the UDHR below.

>I don't think the mission would be at odds with that.

The following may turn into an issue then: 
https://www.ietf.org/mail-archive/web/hrpc/current/msg00801.html

>I do not know.

If I recall correctly, I provided a reference to show that there are 
at least a few participants who are uncomfortable to discuss about 
"non-technical" topics.  I have met attendees who reside in what some 
people might view as "difficult" countries.

>If you have an posiyion about this it would be great to hear your arguments.

I would describe "censorship resistance" as a public policy issue if 
I were to write to the regulator about it.  I usually avoid 
discussing such matters outside the national context.

>The IETF is indeed a private entity.

There are some recommendations at 
https://documents-dds-ny.un.org/doc/UNDOC/GEN/G16/095/12/PDF/G1609512.pdf?OpenElement 
Page 9 states that "technical and design choices can have a 
substantial impact on freedom of expression".  I could not find any 
statement about the UDHR or any other right in respect to technical standards.

>Not sure what is meant by this.

I was asking about whether it would be the responsibility of the 
companies or NGOs participating in the IETF to make human 
rights-oriented contributions to technical discussions.

>we had reviewers and contributors from different continents.

In the absence of statistics it is not possible to verify whether the 
above is actually correct.  I took a quick look at the mailing list 
archive and I could not find any review from, for example, South 
America.  I could not find any review from, for example, a country 
from Asia from which a significant number of IETF attendees come 
from.  It may raise questions about the conclusion has some bias.

>we would have reviewers from all continents.

I doubt that one reviewer would be representative of that 
continent.  There is an "IETF Africa" mailing list.  I am not sure 
whether it would help you find a reviewer; still, it may be worth a try.

>What IETF body do you mean? And what has that to do with a text on an

I don't think that a statement to a UN Office has the same weight as 
one sent to an external website.  I would have to ask questions to 
find out which IETF body is responsible for such issues.

>for this addition, so if someone uses something else, it should be

Could the research group please provide an example of a script which 
is not serviced by UTF-8?

It is not that easy to reply on tagging as there are cases where the 
tagging would fail in practice.

Ok.

>https://www.cato.org/publications/cato-online-forum/embracing-culture-permissionless-innovation

I read that part of the book again.  If the approval of a government 
entity was not required, which other entity which is not considered 
as "government" would give such approval?

The reference provided above is one related to "Strategy for American 
Innovation".  There is the following point: "Unless a compelling case 
can be made that a new invention or business model will bring serious 
harm to individuals, innovation should be allowed to continue 
unabated and problems, if they develop at all, can be addressed 
later".  That could be read as meaning that human rights 
considerations should be addressed later when there is evidence that 
there has been a compelling case of serious harm.

Yes.

Ok.

Regards,
S. Moonesamy

---

From: Niels ten Oever <[email-masked]>
Date: Thu, 19 Jan 2017 00:46:24 +0100

Hi S Moonesamy,

On 01/18/2017 08:57 PM, S Moonesamy wrote:
> I apologize for that.  I sent a subscription request last year through
> https://www.irtf.org/mailman/listinfo/hrpc  I assumed that the research
> group might be a closed group as I did not receive an email
> confirmation.  For what it is worth, the threading should work correctly
> for this reply.
> 

Why?

>> I do not know.
> 
> If I recall correctly, I provided a reference to show that there are at
> least a few participants who are uncomfortable to discuss about

That was a reference to the IETF 100 discussion, I think that was quite
a different context. That was also the email of one person.

I think the draft also shows the relation to technical topics, if it had
nothing to do with technology or protocols it would indeed not belong here.

> I would describe "censorship resistance" as a public policy issue if I
> were to write to the regulator about it.  I usually avoid discussing
> such matters outside the national context.
> 

Would you say the same about pervasive monitoring?

> Page 9 states that "technical and design choices can have a substantial
> impact on freedom of expression".  I could not find any statement about
> the UDHR or any other right in respect to technical standards.
> 

The right to freedom of expression is article 19 of the UDHR.

> rights-oriented contributions to technical discussions.

See the e-mail of Matthias Ketteman about this, as well as the report of
the UN Special Rapporteur on Freedom of Exporession I referred to earlier.

> America.  

Giovane Moura

> I could not find any review from, for example, a country from
> Asia from which a significant number of IETF attendees come from.  It
> may raise questions about the conclusion has some bias.
> 

I am happy to name more people (you've also seen several in the film),
but it still actually a precondition to any document in the IRTF or IETF
? I think this is something we actually address; more diversity is
needed. But that should not bar us from doing work now, because that
would not solve the issue either.

> I doubt that one reviewer would be representative of that continent. 
> There is an "IETF Africa" mailing list.  I am not sure whether it would
> help you find a reviewer; still, it may be worth a try.
> 

I have already posted there, but thanks for the advice.

> I don't think that a statement to a UN Office has the same weight as one
> sent to an external website.  I would have to ask questions to find out
> which IETF body is responsible for such issues.
> 

You got me confused now. What statement to which UN office?

> Could the research group please provide an example of a script which is
> not serviced by UTF-8?
> 

This point was brought up by Stephane, Stephane could you help out?

> entity was not required, which other entity which is not considered as
> "government" would give such approval?
> 

Thiere talks about needing no permission from social norms,
institutions, companies as well as governments to innovate. Not solely
governments.

> harm to individuals, innovation should be allowed to continue unabated
> and problems, if they develop at all, can be addressed later".  That
> could be read as meaning that human rights considerations should be
> addressed later when there is evidence that there has been a compelling
> case of serious harm.
> 

I think what we're doing here is not throw up a barrier, exactly the
opposite, ensure that the model will not be hampered by external
barriers (governments), because we have thought of a way to respect
human rights ourselves. Else other parties might come in and do it for
us, if we don't take our responsibility.

Best,

Niels

---

From: S Moonesamy <[email-masked]>
Date: Thu, 19 Jan 2017 03:01:33 -0800

Hi Niels,
>Why?

There are different perspectives to the discussions about "technical 
standards".  The one on which the draft is based is that "the 
mission" is about an entity (or entities) gaining an economic or 
political advantage.  It will be problematic for the IETF if that is 
its mission.

>Would you say the same about pervasive monitoring?

That is an interesting question.  I might review a draft, e.g. 
https://www.ietf.org/mail-archive/web/ietf/current/msg96446.html  Is 
that anything in that review which is a political or public policy question?

>the UN Special Rapporteur on Freedom of Exporession I referred to earlier.

I read the substantive comments from Dr Ketteman and I found them informative.

>[person name removed]

There is a mailing list archive at 
https://www.ietf.org/mail-archive/web/hrpc/current/maillist.html  I 
could not find any review from that person.  A quick verification 
shows that the person resides in The Netherlands.  According to an 
overview published by the European Union, the Netherlands is not a 
country located in South America ( 
https://europa.eu/european-union/about-eu/countries/member-countries/netherlands_en 
).

>would not solve the issue either.

My preference is to be provided with URLs to reviews from those 
persons if the draft is to be based on reviews instead of 
endorsements.  The document discusses about society, the right to 
non-discrimination, the right to political participation, etc. and 
yet it did not gather any views from the other side of the 
equator.  IRTF or IETF documents, in general, do not discuss about 
human rights or political participation.

I am not opposed, outside a standards-setting context, to your 
views.  I did commend the two organizations for their efforts ( 
https://www.ietf.org/mail-archive/web/hrpc/current/msg00731.html 
).  Based on the discussions, I am left with a sense that the bar for 
research within this research group is quite low.

>I have already posted there, but thanks for the advice.

That is strange.  I went through the messages from that mailing list 
and I could not find your message.  I doubt that you will find 
reviewers if your message was not delivered by the mailing list.

>You got me confused now. What statement to which UN office?

It is the submission at 
https://www.article19.org/data/files/medialibrary/38604/Submission-to-UNSR---Telecos-and-access-sector-A19-2016.pdf 
I gather that the submission was to the UN Special Rapporteur on the 
protection of the right to freedom of opinion and expression ( 
http://www.ohchr.org/EN/Issues/FreedomOpinion/Pages/CallTelecommunications.aspx 
).

>This point was brought up by Stephane, Stephane could you help out?

I'll wait for Stephane to comment.

>institutions, companies as well as governments to innovate. Not solely

At my location, it is usually government/regulatory roadblocks.  This 
news article is about innovation in a country in Europe: 
https://www.ft.com/content/3d65be7a-2e22-11e6-bf8d-26294ad519fc  I 
don't think that it a protocol consideration.  Permissionless 
innovation does not fit within the end-to-end model which the draft 
uses as a boundary for it discussions about (IETF) protocol considerations.

>us, if we don't take our responsibility.

The external barriers are already there.  People who are not 
residents of that part of the world do not see it or ignore it as it 
is in their interest to do so.  Those barriers are not directly 
related to IETF standardization work.  The interactions related to 
human rights occur at the public policy level.  The model will be 
hampered if an IETF body crosses the line.

Regards,
S. Moonesamy

---

From: Niels ten Oever <[email-masked]>
Date: Thu, 19 Jan 2017 12:25:59 +0100

Dear S Moonesamy,

Somehow the earlier responses got cut from the mail again, it would be
great if you could leave them intact.
On 01/19/2017 12:01 PM, S Moonesamy wrote:
> standards".  The one on which the draft is based is that "the mission"
> is about an entity (or entities) gaining an economic or political
> advantage.  It will be problematic for the IETF if that is its mission.
> 

Where do you read this in the draft?

> that anything in that review which is a political or public policy

That was not the question. The problem is that many technical choices
have an impact on real life events, we cannot deny or ignore that.

> could not find any review from that person.  A quick verification shows
> that the person resides in The Netherlands.  According to an overview
> published by the European Union, the Netherlands is not a country
> located in South America (

I was not aware that nationality is based on where one resides. But if
that is the case the nationality of authors and contributors is actually
more more diverse.

> My preference is to be provided with URLs to reviews from those persons
> if the draft is to be based on reviews instead of endorsements.  The
> document discusses about society, the right to non-discrimination, the
> right to political participation, etc. and yet it did not gather any
> views from the other side of the equator.  
> IRTF or IETF documents, in
> general, do not discuss about human rights or political participation.
> 

Firstly, one of the first co-authors of this draft was from Latin
America. There have been many contributions from people all over the
world, and I would not know why this topic would set a higher bar
document process.

> I am not opposed, outside a standards-setting context, to your views.  I
> did commend the two organizations for their efforts (
> https://www.ietf.org/mail-archive/web/hrpc/current/msg00731.html ). 
> Based on the discussions, I am left with a sense that the bar for

If you come to this conclusion, it would be great to understand where
you base this on.

> That is strange.  I went through the messages from that mailing list and
> I could not find your message.  I doubt that you will find reviewers if
> your message was not delivered by the mailing list.
> 

I see my message bounced and the mailinglist is not open, could you
request my subscription?

> http://www.ohchr.org/EN/Issues/FreedomOpinion/Pages/CallTelecommunications.aspx

So a independent organization submits something to a UN body, and you
think the IETF should have a say about that? How so?

> https://www.ft.com/content/3d65be7a-2e22-11e6-bf8d-26294ad519fc  I don't
> think that it a protocol consideration.  

This is not the argument Thiere makes.

> Permissionless innovation does
> not fit within the end-to-end model which the draft uses as a boundary
> for it discussions about (IETF) protocol considerations.
> 

Why not?

> The external barriers are already there.  

Which ones are you referring to?

> People who are not residents
> of that part of the world do not see it or ignore it as it is in their
> interest to do so. 

If you provide examples we could discuss them or integrate them in the
draft.

> Those barriers are not directly related to IETF
> standardization work.  

I cannot judge if I do not know which barriers you mean.

> The interactions related to human rights occur at
> the public policy level.  The model will be hampered if an IETF body
> crosses the line.

That is not the conclusion of what Dr. Ketteman or the UN Special
Rapporteur on Freedom of Expression said.

Best,

Niels

---

From: S Moonesamy <[email-masked]>
Date: Thu, 19 Jan 2017 11:11:39 -0800

Hi Niels,
>Where do you read this in the draft?

The draft starts with a quotation from RFC 3935.  There is a message 
at https://www.ietf.org/mail-archive/web/hrpc/current/msg00794.html 
about "technology performs more than a merely 'technical function'" 
and some discussion over different threads about the link with the IETF.

>have an impact on real life events, we cannot deny or ignore that.

I was asked a question about pervasive surveillance and I provided a 
URL to a review which anyone reading the mailing list can assess for 
himself/herself.  The argument in the above (see quoted paragraph) is 
that "many technical choices have an impact on real life 
events".  The argument is not accompanied by actual cases which are 
directly related to IETF protocols or standards-setting.

>that is the case the nationality of authors and contributors is actually

It is not about nationality.  In order to know how a person in 
Country X is affected by a decision it is better to ask a person in 
that country as he or she is directly impacted by the laws of that 
country.  I could ask, for example, a person in Europe who is from 
another country (nationality).  Would I get a good view of what is 
actually happening from that input?

To put it differently, would a person living in The Netherlands be 
impacted if HTTP is blocked in, for example, New Zealand?  Would the 
human rights of that person be infringed by that decision?

>world, and I would not know why this topic would set a higher bar

Human rights can be based on academic literature or it can be a 
matter which a person in a far away country with internet access can 
relate to.  As for the higher bar, I did not argue for the draft to 
be a consensus document. If it is claimed that there are people from 
all over the world reviewing this document, that information should 
be verifiable if this draft is research work.  It might help Afnic in 
its efforts (e.g. 
https://www.afnic.fr/en/about-afnic/news/general-news/9961/show/afnic-reveals-figures-on-diversity-within-icann-1.html 
).

>If you come to this conclusion, it would be great to understand where

As an example, I asked about UTF8 and I have yet to receive an 
adequate answer.  If the research group had already done a 
significant amount of technical research it should not be too 
difficult to point me to the answer.

>I see my message bounced and the mailinglist is not open, could you

I sent an (off-list) email about your subscription and copied it to you.

>think the IETF should have a say about that? How so?

My answer to the first question is "no".  The independent 
organization has its name on draft-irtf-hrpc-research and one of RG 
Chairs is affiliated with the independent organization.  I asked 
whether the RG Chairs asked the relevant IETF body about that.  The 
independent organization described the IETF as a sibling.  It does 
not look good when siblings cannot talk to each other.

>Why not?

There is a draft written by the IAB in which it is mentioned that 
"The deployment of ECN across the Interent had failed."  It is nearly 
impossible to innovate at that layer and get deployment across the 
Internet.  Most of the services in wide use on the Internet are built 
above what the IETF calls the "application layer".  It could be said 
that the web is the transport layer.

On a tangent, if services in wide use were permissionless, the 
following should not be an issue: 
https://www.ft.com/content/75796bce-d9dd-11e6-944b-e7eb37a6aa8e

>Which ones are you referring to?

I was referring to regulatory barriers.  I have asked my regulator 
about that; I don't consider the regulation(s) as related to the IETF 
in any way.

>If you provide examples we could discuss them or integrate them in the

If I am not mistaken, the draft is not about regulatory barriers.  As 
such, the examples which I might provide won't fit in it.

Regards,
S. Moonesamy

---

From: Andrew Sullivan <[email-masked]>
Date: Thu, 19 Jan 2017 14:46:01 -0500

Hi,

On Thu, Jan 19, 2017 at 11:11:39AM -0800, S Moonesamy wrote:
 
> It is not about nationality.  In order to know how a person in Country X is
> affected by a decision it is better to ask a person in that country as he or
> she is directly impacted by the laws of that country.  I could ask, for
> example, a person in Europe who is from another country (nationality).
> Would I get a good view of what is actually happening from that input?
> 
> To put it differently, would a person living in The Netherlands be impacted
> if HTTP is blocked in, for example, New Zealand?  Would the human rights of
> that person be infringed by that decision?

I have two problems with this claim, and since this discussion about
consulting everyone appears to be continuing I think I want to object
to the apparent line of reasoning.

The first problem I have is that it simply isn't true that it is
always better to ask someone from Country X about the situation in
Country X than it is to ask some expert about the relevant situation.
People are often extraordinarily confused about how their own country
works.  Many Canadians, for instance, persist in believing that they
vote for the Prime Minister, but I could ask anyone properly familiar
with Westminster systems and each would answer the question correctly.

The second problem I have is that the second ¶ contains two questions,
one of which appears to be a question about how people feel and the
other of which is one of simple entailment given the definitions of
"human rights" and "infringed".  Neither of them, anyway, is relevant
to what is in the previous ¶, except of course that _ex hypothesi_ we
have to ask the person in the Netherlands about the effect on him or
her.  

I think there is a legitimate question about the population of
reviewers for this document (given that it's in the IRTF, that's
hardly surprising).  I think the representativity of nationals of the
countries of the world is not that legitimate question.

Best regards,

A

-- 
Andrew Sullivan
[email-masked]